Latest / Bonita Bay Club's Podcast / How A Club IT Director Chooses Tech And Stops Threats

Transcript

How A Club IT Director Chooses Tech And Stops Threats · Bonita Bay Club's Podcast

0:07
SPEAKER_01: Hello, Bonita Bay Club.
0:09
SPEAKER_01: Welcome to our podcast.
0:11
SPEAKER_01: Today I'm joined by Mark Neneman, Director of IT at Benita Bay Club, who has been with the club for three years now, which I find unbelievable.
0:22
SPEAKER_01: Thank you.
0:22
SPEAKER_01: Thank you.
0:22
SPEAKER_01: Glad to be here.
0:23
SPEAKER_01: Welcome.
0:23
SPEAKER_01: You and I have an interesting career connection.
0:26
SPEAKER_01: We both had communications in IT under our umbrellas at one point.
0:31
SPEAKER_01: Eventually I said goodbye to IT, and you said goodbye to communications.
0:36
SPEAKER_00: I did.
0:37
SPEAKER_01: So I have to ask you, why IT?
0:39
SPEAKER_00: Well, I have always been a techie, probably since I was in elementary school.
0:44
SPEAKER_00: I think I built my first computer when I was in third grade or something back in the mid-90s.
0:50
SPEAKER_00: So it's been a it's been a hobby of mine for well over 30 years at this point.
0:56
SPEAKER_00: However, I did get my start in country clubs shortly after high school working at Mission Hills in Rancho Mirage.
1:02
SPEAKER_00: And after bouncing around a few positions there, I settled in the membership office and essentially did most of their like early communications work.
1:10
SPEAKER_00: This is what you would have seen as like a communications department, probably in the early 2000s, essentially, before we had dedicated communications directors.
1:18
SPEAKER_00: And if you recall, it kind of all fell under membership and marketing at that time.
1:22
SPEAKER_02: Yes.
1:22
SPEAKER_00: So a little history.
1:24
SPEAKER_00: Following that, I went off, got a degree in commercial art development and game development, did that for a little while before coming back to country clubs.
1:32
SPEAKER_00: And since I had the art background at the time and the marketing background, I fell back into membership and marketing, did that for some time, and then fell into communications work as the natural progression.
1:44
SPEAKER_00: And then throughout this time, I've always taken on as many technological responsibilities and IT responsibilities as I could get my hands on, just kind of being the natural candidate in the room for it.
1:56
SPEAKER_00: And so when the opportunity presented itself to go pure IT, I felt that it was the correct move to make.
2:02
SPEAKER_00: Yeah.
2:03
SPEAKER_00: Giving me the opportunity to really focus and silo myself into something that I really enjoy.
2:10
SPEAKER_00: Yeah.
2:10
SPEAKER_00: And don't get me wrong, I I enjoy communications.
2:12
SPEAKER_00: I enjoy how creative you can be.
2:14
SPEAKER_00: All the fun, you know, I'm love flying my drone around.
2:18
SPEAKER_02: Yeah.
2:19
SPEAKER_00: I love making videos and skits.
2:20
SPEAKER_00: We had a lot of fun with that at my last job.
2:22
SPEAKER_00: Always loved working with the members, trying to help them market and communicate their ideas, their organizations to everyone else, you know.
2:30
SPEAKER_00: I felt I did a really good job at it, but I've also always felt my true calling was on the technology side.
2:36
SPEAKER_01: Yeah.
2:37
SPEAKER_01: And I can see that.
2:38
SPEAKER_01: I can see you're you're really good at IT.
2:40
SPEAKER_01: And this company, I think, why Fred decided to split both of them, communications and IT, because it's just grown so fast.
2:49
SPEAKER_01: Oh, yeah.
2:49
SPEAKER_01: And so big, both departments.
2:52
SPEAKER_01: And it's crazy.
2:53
SPEAKER_01: So I think you just got certified in.
2:56
SPEAKER_01: I did.
2:57
SPEAKER_01: And what is your certification in?
2:59
SPEAKER_00: So recently I picked up my certified information systems security professional.
3:04
SPEAKER_00: So I am a fully fledged CISSP with the ISC2.
3:08
SPEAKER_00: They are the main governing body for cybersecurity professionals across the world.
3:13
SPEAKER_00: They've been around since the late 80s, and the CISP is kind of the gold standard for being able to develop and manage security programs at large organizations.
3:23
SPEAKER_00: It's DOD approved, it's you know Fortune Fortune 100 approved.
3:28
SPEAKER_01: And more now than ever, we really do need someone who's on top of cybersecurity because it's becoming more and more of an issue, as I'm sure all our members know this.
3:38
SPEAKER_01: So, how do you decide which new technologies are worth investing in?
3:43
SPEAKER_00: So, really, it's all about looking forward.
3:46
SPEAKER_00: And it's all about paying attention to what's coming down the pipeline, what new technologies are available.
3:53
SPEAKER_00: What are the what are the Fortune 500s?
3:55
SPEAKER_00: What are the large enterprises and governments out there?
3:58
SPEAKER_00: What are they using?
3:59
SPEAKER_00: If you pay attention to that, you can really start to get an idea of what's going to be popular and what's not.
4:06
SPEAKER_00: You know, how how is the market shifting?
4:09
SPEAKER_00: And then for an organization of our scale, the real trick is how do I take those technologies and those ideas, figure out what's going to work at a scale that makes sense for us.
4:20
SPEAKER_02: Right.
4:20
SPEAKER_00: You know, obviously what works for a 50,000-person enterprise doesn't necessarily make sense down at our scale with about 600 employees.
4:29
SPEAKER_00: But a lot of the core tenants and ideas do.
4:32
SPEAKER_00: Unfortunately, there is a plethora of information out there that you can get your hands on.
4:37
SPEAKER_00: You know, NIST has phenomenal guidance and documentation.
4:42
SPEAKER_00: SANS is another wonderful resource.
4:44
SPEAKER_00: Uh, now that I'm a member of the ISC, the ISC is an incredible resource and knowledge body that I can draw from and have been, particularly as it comes to the use of artificial intelligence.
4:55
SPEAKER_00: ISC as an organization is currently going through and reviewing and working with professionals across the globe to develop their new AI guidance and certification programs as we speak.
5:06
SPEAKER_00: And so that's something I'm keeping a very close eye on as we move forward, because it's a technology that we're absolutely going to want to take full advantage of.
5:15
SPEAKER_00: But naturally we have to do so in a secure and responsible manner.
5:18
SPEAKER_01: Yeah.
5:19
SPEAKER_01: And myself having some background with IT and knowing that it's constantly changing so fast.
5:26
SPEAKER_01: And you and I have had this conversation.
5:28
SPEAKER_01: It's like, you know, what's good today might not be good a year from now.
5:33
SPEAKER_00: That's absolutely true.
5:34
SPEAKER_00: You know, the biggest thing that I try to coach newer IT employees on is you can never stop learning.
5:41
SPEAKER_02: No.
5:42
SPEAKER_00: It is it is the core tenant of the profession.
5:45
SPEAKER_00: The the technology, as you said, moves so quickly.
5:48
SPEAKER_00: You have to be in that mindset that I'm going to learn and improve, you know, even if it's by 1% every day, 365 days in a year, that compounds quite a bit.
5:58
SPEAKER_00: And you look back and you'd be shocked at how much you know.
6:02
SPEAKER_00: I know.
6:03
SPEAKER_00: I IT is an industry as a whole that is rife with imposter syndrome.
6:07
SPEAKER_00: And many of us walk around with it constantly.
6:10
SPEAKER_00: And it's, you know, we have to gut check ourselves very, you know, consistently.
6:14
SPEAKER_00: And like we realize, oh, hey, you know, we we actually really know quite a bit.
6:18
SPEAKER_01: Yeah.
6:18
SPEAKER_01: Yeah.
6:19
SPEAKER_01: And me being a little bit older than you, a little bit, probably a lot.
6:25
SPEAKER_01: I mean, I was around when IT wasn't a big thing.
6:29
SPEAKER_01: And I've seen over the years how it's overtaken, how it's so important for the clubs to really invest in good IT cybersecurity, because it's just it's getting worse and worse every year.
6:44
SPEAKER_00: And I I liken it to, you know, it's another team like your accounting team.
6:48
SPEAKER_00: Yeah.
6:49
SPEAKER_00: Like your human resources team.
6:50
SPEAKER_00: It's a it's a meta department, if I will.
6:53
SPEAKER_00: It's it's one of those teams that's going to impact every other team within your organization.
6:58
SPEAKER_01: I agree.
6:58
SPEAKER_00: Ideally, as a force multiplier.
7:01
SPEAKER_01: So, how do you balance innovation with reliability and security?
7:06
SPEAKER_00: So at the end of the day, always research and follow your best practices.
7:10
SPEAKER_00: In some cases, if you're working with completely cutting-edge technology, that that's a day-by-day operation.
7:17
SPEAKER_00: It can change like the wind.
7:19
SPEAKER_00: But in most cases, you're going to want to pressure test your tech before you let it out into the wild.
7:26
SPEAKER_00: But that does come with certain handoffs.
7:29
SPEAKER_00: We can test everything in the lab as best we can.
7:33
SPEAKER_00: And we can, you know, put our seal of approval on it and let it out into the wild.
7:37
SPEAKER_00: But to quote a famous idiom, you can never anticipate every possible edge case that could ever come about.
7:45
SPEAKER_00: And people will always surprise you.
7:48
SPEAKER_00: You can think that you have gotten everything figured out and thought of every little way that someone might make use of your technology.
7:56
SPEAKER_00: But at the end of the day, someone's going to come along and surprise you and do something completely different that you never thought of.
8:03
SPEAKER_00: So the goal is how do we make this as efficient and reliable as possible?
8:09
SPEAKER_00: And in many cases, it's really coming down to having proper redundancies, having proper procedures and policies in place, and always having a backup plan.
8:20
SPEAKER_01: Backup after backup.
8:22
SPEAKER_01: That much I've learned.
8:23
SPEAKER_00: Yep.
8:23
SPEAKER_00: And having backup plans.
8:25
SPEAKER_00: Yeah.
8:25
SPEAKER_01: For sure.
8:26
SPEAKER_00: Knowing what to do when your technology fails you.
8:29
SPEAKER_01: This question I think is very important.
8:32
SPEAKER_01: How do you work with other departments to understand what technology they actually need?
8:37
SPEAKER_01: Because I know sometimes I'm sure you felt some departments that might not want to work along.
8:46
SPEAKER_00: So a lot of it comes down to I I spent a good deal of my probably my first 18 months here observing.
8:53
SPEAKER_00: Right.
8:54
SPEAKER_00: Observation, documentation.
8:56
SPEAKER_00: A big reason why I push the use of our help desk, the use of our ticketing software is that allows me to document and find out, you know, what are our day-to-day struggles and really kind of hone in and figure out, okay, what are what are the the little problems that everyone's having?
9:14
SPEAKER_00: Because you can typically chain those together.
9:17
SPEAKER_00: And instead of running around and slapping band-aids on everything, you want to address the deeper issues.
9:22
SPEAKER_00: And I think that's something I've been able to do rather well, actually.
9:25
SPEAKER_00: If you look back to the day-to-day stuff that we had, and how do we address it and how do we update it?
9:31
SPEAKER_00: How do we revise our policies?
9:32
SPEAKER_00: How do we revise our procedures?
9:34
SPEAKER_00: How do we address employee education, awareness?
9:38
SPEAKER_00: It's a slow process.
9:39
SPEAKER_00: It's a grind, if you will.
9:41
SPEAKER_00: But at the end of the day, it's all about communication, observation, and documentation.
9:46
SPEAKER_00: And then really just having that good discussion with the different team leaders and the different different members of senior management, figuring out, okay, what do you want to do?
9:54
SPEAKER_00: Because at the end of the day, I don't want them to have to really think about it.
9:57
SPEAKER_00: Right.
9:57
SPEAKER_00: Nobody, nobody doing their job here should have to think, is my tech going to work today?
10:02
SPEAKER_00: It should just work.
10:03
SPEAKER_01: There's nothing more frustrating.
10:05
SPEAKER_01: And I know, again, from past experience from other departments that if something's not working, they're just going to come after you.
10:13
SPEAKER_01: Oh, yeah.
10:14
SPEAKER_01: And I see that.
10:15
SPEAKER_01: That's frustrating.
10:16
SPEAKER_01: If you need to accomplish your job, especially today, you need technology.
10:20
SPEAKER_01: You cannot work without it.
10:22
SPEAKER_00: And referring to my previous point, having a good backup and a backup plan.
10:26
SPEAKER_01: Yes.
10:26
SPEAKER_00: You know, knowing what to do when things go wrong so you can maintain speed of service and all those other factors that go into providing an excellent member experience.
10:35
SPEAKER_00: That's key.
10:36
SPEAKER_01: I agree.
10:37
SPEAKER_01: So what are the biggest cybersecurity risks organizations face today that we face today as a club?
10:45
SPEAKER_00: Well, in a broad general sense, not necessarily specific to us, because I think we've done an excellent job on this in the past year.
10:53
SPEAKER_00: Education and awareness.
10:54
SPEAKER_00: We at Benito Bay Club, we have invested considerably over the past year in education and awareness for cybersecurity training for our staff.
11:02
SPEAKER_00: Our new huntress program has been radically successful in my book.
11:06
SPEAKER_00: We're well above 80% compliance, which for for a first year, I think that's quite good.
11:12
SPEAKER_00: I have heard the comments from members and staff like, wait, why are why are you all watching cartoons day to day?
11:16
SPEAKER_00: It's like, well, no, no, no.
11:17
SPEAKER_00: These are these are cybersecurity training videos, and you've seen them, Jonathan's seen them.
11:22
SPEAKER_00: I think they do a phenomenal job.
11:24
SPEAKER_01: I think the Huntress is definitely a lot better.
11:27
SPEAKER_00: I I love that it's it's not threatening.
11:30
SPEAKER_00: It's, you know, it's very open, friendly, it's funny.
11:33
SPEAKER_00: It's not somebody like, hey, let's sit here in front of PowerPoint and we're gonna go over this.
11:37
SPEAKER_00: Is how you spot a phishing email.
11:39
SPEAKER_00: It's you know, it's presented in a much more engaging manner in a method that resonates with the staff.
11:45
SPEAKER_00: And then we've stacked that on top of a brand new XDR system within Huntress to monitor all of our workstation servers and every other device that we have here.
11:54
SPEAKER_00: We maintain a full SIEM system, security information and events monitoring that also goes into Huntress.
12:01
SPEAKER_00: So we are able to spot cybersecurity incidences within minutes and react accordingly.
12:07
SPEAKER_00: It's really brought our response time down.
12:10
SPEAKER_00: And I'm sure you've you've seen a couple of times where we get a notice and we are on top of it.
12:14
SPEAKER_01: Yes, I have.
12:15
SPEAKER_01: So what's one cybersecurity mistake employees commonly make?
12:21
SPEAKER_00: Thinking it can never happen to them.
12:23
SPEAKER_01: Yeah.
12:24
SPEAKER_00: Again, in the most general sense, thinking that you cannot be a victim.
12:29
SPEAKER_01: And what I see is that the cybersecurity or whoever's out there doing these, these hackers or whatever, they're getting smarter and smarter.
12:37
SPEAKER_01: Or better well equipped.
12:42
SPEAKER_01: Yes, yes.
12:43
SPEAKER_01: Some of them look real.
12:45
SPEAKER_00: They do.
12:46
SPEAKER_00: And I and I will say, as a as a general observance, scammers and absolutely hackers, some of the most clever and creative people walking around on the planet.
12:56
SPEAKER_01: Yeah.
12:57
SPEAKER_01: And it's not just computers now that are attacking your phones, doing it through your phones.
13:03
SPEAKER_01: As you had mentioned, you know, it's just awareness.
13:06
SPEAKER_01: I think that's why the huntress is so important.
13:08
SPEAKER_01: It's just you have to be aware of what the different things that they're using.
13:12
SPEAKER_00: Yeah.
13:13
SPEAKER_00: And if that's one thing our listeners would want to take away is that just having a general awareness of some of the threats and some of the attacks that are out there.
13:22
SPEAKER_00: My newsletter articles over the years tend to dive into various, you know, just general ideas revolving cybersecurity and how you can better defend yourself.
13:31
SPEAKER_01: Yeah.
13:31
SPEAKER_01: And I would recommend going back and reading any of those or you know, if you Well, I think this season we're probably going to add some more on cybersecurity because it's so important.
13:40
SPEAKER_01: So I'll really look to you to put more information in our newsletter.
13:45
SPEAKER_00: And I'll say this over the over the course of my career, I've dealt with countless members who've fallen victim to one cybersecurity scam or another.
13:54
SPEAKER_01: Oh, yeah.
13:55
SPEAKER_00: And seeing the fallout from it, and it can be devastating.
13:58
SPEAKER_01: Yeah, it sure can.
13:59
SPEAKER_01: So, what are three simple things everyone can do to be more secure?
14:05
SPEAKER_00: Well, what can the members do?
14:06
SPEAKER_00: What do you think?
14:08
SPEAKER_00: So, kind of like we're doing right now, password vaults at Benita Bay Club, we're undergoing our Bitwarden rollout.
14:14
SPEAKER_00: We are getting everybody on board with becoming comfortable with using password vaults and learning how to use secure password managers and things of that nature that live outside of your browser.
14:24
SPEAKER_00: In many cases, if you have an iPhone, the Apple keychain nowadays actually works quite similarly to like a password vault like Bitwarden or LastPass.
14:34
SPEAKER_00: So that is something I highly recommend.
14:36
SPEAKER_00: Get away from using passwords that you can remember.
14:39
SPEAKER_00: The second token, multi-factor authentication.
14:43
SPEAKER_00: If a service offers multi-factor authentication, you should take advantage of that.
14:48
SPEAKER_01: Well, I think that's becoming more and more mandatory with a lot of different websites and organizations.
14:54
SPEAKER_01: I notice that with the banks.
14:56
SPEAKER_00: I was just gonna say financial organizations in particular are imposing it.
15:00
SPEAKER_00: I will say that if you're only currently using SMS, like a they text you a six-digit code, I would caution getting away from that.
15:08
SPEAKER_01: So just so for our members, what's SMS?
15:11
SPEAKER_00: Text messages.
15:12
SPEAKER_01: Okay.
15:13
SPEAKER_00: So if they are text messaging you that six-digit code every time you log in, I would caution you to get away from that.
15:18
SPEAKER_00: Cybersecurity as an industry, we are moving away from any kind of text messaging or voice messaging just due to the inherent risks that are out there.
15:28
SPEAKER_00: And that's something we could get into as well.
15:30
SPEAKER_00: Really, the push these days is moving toward pass keys and hardware tokens.
15:34
SPEAKER_01: I noticed that everywhere.
15:35
SPEAKER_01: I I was we were having this conversation because I'm like, everybody's asking for a pass key now.
15:41
SPEAKER_01: You know, again, it's a constant change.
15:44
SPEAKER_01: And and trying to keep up with everything, it's just like sometimes it's mind-blowing.
15:49
SPEAKER_00: This is an ongoing process.
15:51
SPEAKER_00: Um, you're going to see revisions, you're going to see changes, you're going to see enhancements on an annual basis, possibly even sooner than that, because we just have to stay on top of it.
16:02
SPEAKER_00: Everything is changing.
16:03
SPEAKER_00: It's it's never going to stop changing.
16:06
SPEAKER_00: And AI has only made that it's only made that cycle go faster.
16:12
SPEAKER_01: Okay, so that is my next question.
16:14
SPEAKER_01: How has AI changed the cybersecurity landscape?
16:19
SPEAKER_00: Massively.
16:20
SPEAKER_01: It is gone from you want to expand on that?
16:23
SPEAKER_00: It has gone from a toy to one of the leading causes of cybersecurity incidences across the globe.
16:32
SPEAKER_00: And there have been some extremely high-profile cases in recent memory.
16:36
SPEAKER_00: For example, OpenAI, their latest model, broke out of its containment not too long ago so it could cheat on its test, its capabilities test over at Hugging Face.
16:48
SPEAKER_01: Wow.
16:48
SPEAKER_00: Yeah.
16:49
SPEAKER_00: That's a scary thought.
16:51
SPEAKER_01: I see that it is a cybersecurity risk.
16:54
SPEAKER_01: However, I'm seeing a lot of people that are using it and that love it.
16:59
SPEAKER_01: So where do you balance that out?
17:01
SPEAKER_00: So you have to think about AI in the different ways that it's applied.
17:06
SPEAKER_00: Most people are in their day-to-day experience are going to be familiar with the use of large language models.
17:11
SPEAKER_00: Your Chat GPT, your Claude, your Grok, sitting there on your phone or your browser typing back and forth to it.
17:17
SPEAKER_00: That's all fine and good.
17:18
SPEAKER_00: That's that's kind of layer one, if you will.
17:22
SPEAKER_00: Much more recently, we're moving into agentic AI.
17:26
SPEAKER_00: That's where you get into autonomous AI that can interact with your computer, interact with your network, interact with your devices with full autonomy and agency on your behalf.
17:38
SPEAKER_00: That's where we are now.
17:40
SPEAKER_00: That's where you're seeing these cybersecurity incidences start to take place.
17:45
SPEAKER_00: Oops, the agent accidentally deleted the database.
17:47
SPEAKER_00: Or oops, it, you know, it decided to hack into this all of a sudden to because it's goal driven.
17:54
SPEAKER_00: It's non-deterministic and goal-driven.
17:57
SPEAKER_00: So you can never quite be sure how it's going to accomplish its task.
18:01
SPEAKER_00: So that's why human involvement is key.
18:05
SPEAKER_00: Human human review is key.
18:07
SPEAKER_00: Now, I'm bashing on OpenAI a bit, but on the flip side, you also have anthropic, whose mythos class model recently, since its launch earlier this year, they have they have helped resolve, you know, well over 10,000 previously undisclosed and undiscovered vulnerabilities across entire suites of software.
18:26
SPEAKER_00: Blue teams across the globe are using it currently to patch their software.
18:29
SPEAKER_00: So while AI can also be a weapon in cybersecurity, it's also a shield.
18:34
SPEAKER_00: It's a it's a two-sided street.
18:37
SPEAKER_00: You know, we always have red teams and we always have blue teams, and they're constantly at odds with each other.
18:41
SPEAKER_00: So it's always an arms race of who can attack and who can defend and who can do it better than the other.
18:47
SPEAKER_00: And it's constantly flip-flopping.
18:49
SPEAKER_01: I remember maybe six months ago that we had FGCU professor come and talk to our staff about AI.
18:58
SPEAKER_01: At FGCU, they're holding like whole classes on AI.
19:02
SPEAKER_02: Yeah.
19:02
SPEAKER_01: And I remember him saying that, yeah, you are just look at it as you're the pilot and AI is the co-pilot.
19:09
SPEAKER_01: Absolutely.
19:09
SPEAKER_01: Yeah.
19:10
SPEAKER_01: But that's where you come in with IT to help us with the cybersecurity part of it.
19:15
SPEAKER_01: But AI can be a very useful tool.
19:17
SPEAKER_01: And one of the things I think that you and I discussed is that if we're going to use it, make sure that we don't use and don't let the staff use the free version of it.
19:27
SPEAKER_01: Do you recommend that for the members?
19:29
SPEAKER_00: So without oversimplifying it here, the biggest distinction that the free models do not allow you to do is generally when you take advantage of a free online AI model, you are forced to opt into their training data.
19:42
SPEAKER_00: So anything you discuss with it, anything you disclose to it, is going to stay with that company's data for training purposes.
19:51
SPEAKER_00: You have no method of opting out of it, you have no method of deleting it.
19:55
SPEAKER_00: A lot of people, I don't believe, recognize that or understand that.
19:59
SPEAKER_00: Not to put Anthropic on a pedestal, we'll talk about a recent egg on their face incident where their shared conversations feature.
20:06
SPEAKER_00: If I have a conversation with Claude and I want to share it and send it to you, they had a breach where they didn't flag those correctly.
20:14
SPEAKER_00: And they were searchable on Google.
20:16
SPEAKER_00: This happened, I believe, a little over a month ago, about six weeks ago, maybe.
20:19
SPEAKER_00: And just millions of private conversations were leaked to the internet.
20:24
SPEAKER_00: And those are there forever.
20:26
SPEAKER_00: Something a lot of people may or may not realize is once something's on the internet, it stays on the internet.
20:32
SPEAKER_00: What kind of data remnants are you leaving in your conversations?
20:36
SPEAKER_00: What are you telling it?
20:38
SPEAKER_00: Because it's uh realistically, unless you're making the proper safeguards and with the free models, you don't have those options.
20:47
SPEAKER_00: Those bits of data, those conversations, they are gonna stay with the vendor.
20:52
SPEAKER_01: So we just have to, again, I know you're working on the AI portion as a company and what we're gonna be putting in place for our security.
21:02
SPEAKER_01: Yep.
21:03
SPEAKER_01: What can we say to the members to help them out if they're thinking about using AI or if they do use AI?
21:10
SPEAKER_00: Well, one of the things that I need to obviously get clearance from Joseph and Fred on this, but Bonita Bay Club, we are an industry leader, and I want to continue that through our technology programs as well.
21:20
SPEAKER_00: So as you mentioned, I'm currently developing our AI workshop series for our staff, which would be a training class that they have to go through in order to essentially be certified to make use of AI and agentic protocols and things of that nature.
21:34
SPEAKER_00: But as part of that, you have training on the cybersecurity principles.
21:38
SPEAKER_00: How do you handle personally identifiable information?
21:41
SPEAKER_00: How do you use the software, you know, et cetera, et cetera?
21:44
SPEAKER_00: But the the key takeaways here are how do you handle the personally identifiable information?
21:48
SPEAKER_00: How do you use it in a secure manner?
21:50
SPEAKER_00: What can you tell it?
21:51
SPEAKER_00: What can't you tell it?
21:53
SPEAKER_00: Something I'd like to do is open source that information.
21:57
SPEAKER_00: Essentially put it out there for all.
22:00
SPEAKER_00: Other clubs to use for our members to use so they can see and they can also gain access to that training.
22:06
SPEAKER_00: Not necessarily as a uh come and watch a video, but at least have some documentation, have some guidance.
22:12
SPEAKER_00: And that's something we could also address in newsletter articles and blogs, what have you.
22:16
SPEAKER_00: But I think that's key.
22:18
SPEAKER_00: Cybersecurity training falls on awareness is key.
22:23
SPEAKER_00: You know, an ounce of prevention is worth a pound of cure.
22:26
SPEAKER_01: I agree.
22:27
SPEAKER_01: And moving forward, maybe now that you're talking about it, maybe we can do some videos that we can communicate to our members.
22:35
SPEAKER_01: Because videos really uh I think are very impactful.
22:39
SPEAKER_01: They're able to see it.
22:40
SPEAKER_01: So you and I can kind of work on that and see if we can get some videos out there.
22:45
SPEAKER_00: Falling back to the previous question about AI and cybersecurity, one of the other things I wanted to touch on is AI vision.
22:52
SPEAKER_00: I know fishing sounds like a weird word, but this is this is using AI to clone your voice or clone your face for a Zoom meeting.
23:02
SPEAKER_00: As you know, I just got back from DEF CON about a week ago.
23:04
SPEAKER_01: And what's DEF CON?
23:06
SPEAKER_00: Um, DEF CON is the largest hacker convention on the planet.
23:09
SPEAKER_01: Okay.
23:09
SPEAKER_00: About 35,000 hackers gather in Las Vegas every year as a part of a larger hacker summer camp.
23:15
SPEAKER_00: We actually have three conventions that go on over the course of two weeks out there: Black Hat, B-sides, and then DEF CON as well.
23:22
SPEAKER_00: But it's uh oh, it's a trip.
23:24
SPEAKER_00: Yeah, I mean, if if you can hack it, it's there.
23:27
SPEAKER_00: And you see some really crazy stuff.
23:29
SPEAKER_00: It's generally the cutting edge of the cutting edge.
23:31
SPEAKER_00: One of the big standouts for me this year was over in their call center area, where we were demonstrating how you could very easily take a recording of their voice, just like this podcast.
23:41
unknown: Yeah.
23:42
SPEAKER_00: And then go on to create AI clones of that to use in your own phone calls for scamming purposes.
23:49
SPEAKER_00: The bar continuously lowers.
23:52
SPEAKER_00: It's become very easy, something you can do within minutes and minimal training.
23:57
SPEAKER_00: You don't need a whole lot to do these kind of scams anymore.
24:00
SPEAKER_00: They're only going to become more and more prolific as time goes on.
24:04
SPEAKER_01: And I've mentioned to members before, and maybe something that we can communicate to them, especially our older members, because they can be scammed, is to have a code word with their family.
24:16
SPEAKER_00: Yeah, absolutely.
24:16
SPEAKER_01: You know, ask them a question, a code word that if somebody calls them saying, you know, I need this is an emergency or whatever.
24:23
SPEAKER_01: And then the member should ask, What's the code word?
24:26
SPEAKER_02: Yeah.
24:26
SPEAKER_01: And so they should work with their families to have a code word, at least try to prevent it.
24:32
SPEAKER_00: Yeah.
24:33
SPEAKER_00: Then the IT team, we have adjusted our own internal policies just this past year.
24:38
SPEAKER_00: We will no longer do password resets or anything of that nature over the phone.
24:42
SPEAKER_00: Right.
24:42
SPEAKER_00: We have automated methods in place where you can verify your identity and whatnot, and we'll we'll send you down that path.
24:48
SPEAKER_00: But if you just pick up the phone and call us, we're generally going to direct you to those channels.
24:52
SPEAKER_00: We're not going to take your voice for it, unfortunately, anymore, just because we know how easy it can be.
24:58
SPEAKER_01: Well, that happened actually at Bellagio when I was in Las Vegas for a conference.
25:03
SPEAKER_01: The whole system went down.
25:04
SPEAKER_01: Bellagio was down completely because of a phone call that somebody made and gave the information out.
25:12
SPEAKER_00: So I think it was um DEF CON 32, three years ago, two years ago?
25:17
SPEAKER_00: Yeah.
25:17
SPEAKER_00: Where we were we were demonstrating, you know, full Zoom capabilities where I could I could go on Zoom and pretend I'm I'm anybody, essentially.
25:24
SPEAKER_00: I could mask my face, I could change my hair, my clothes, and my voice changes to meet to match their cadence and everything like that.
25:31
SPEAKER_00: And there's been there have definitely been some high profile scams where millions of dollars have walked out the door because someone jumps into a Zoom meeting pretending to be the CEO or the CFO and orders a staff member, hey, I need you to wire all this money over to this account.
25:45
SPEAKER_00: And they do it without a second thought.
25:47
SPEAKER_01: Talking about cybersecurity, I don't want to scare the members to feel like you know they have to be scared at everything that that they're doing on their computer or their phones.
25:56
SPEAKER_01: Yeah.
25:57
SPEAKER_01: So how can we help them see that this should be a positive podcast?
26:02
SPEAKER_00: Aaron Powell Going back to the three simple things everyone can do, my third thing was be a little bit of a skeptic.
26:08
SPEAKER_00: A healthy dose of skepticism can go a long way.
26:10
SPEAKER_00: Yes.
26:11
SPEAKER_00: Because a lot of times these scams, they do prey on motion.
26:15
SPEAKER_00: You know, oh my God, you have to do this right now.
26:17
SPEAKER_00: Right now, they prey on urgency, or they prey on just being irrational, trying to push you, trying to do things.
26:25
SPEAKER_00: You know, oh, this has to be now, or we're gonna repossess your car, or we're gonna ding your credit, or we're gonna hack your computer, or we've got malicious information on you.
26:34
SPEAKER_00: The biggest thing I can recommend to people in that sense is slow down.
26:39
SPEAKER_00: No formal, legitimate organization is going to push you like that.
26:43
SPEAKER_00: Or scare you like that.
26:45
SPEAKER_00: Or scare you like that.
26:46
SPEAKER_00: Exactly.
26:47
SPEAKER_00: Yes.
26:47
SPEAKER_00: It's never going to happen that way.
26:50
SPEAKER_00: Always, always, always reference official channels.
26:54
SPEAKER_00: Yes.
26:54
SPEAKER_00: If, you know, if if someone calls you and says, hey, call me back at this phone number.
26:59
SPEAKER_00: I'm calling from your bank.
27:00
SPEAKER_00: Maybe not take their word for it.
27:02
SPEAKER_00: Take that extra two seconds to go online and look up your bank's phone number.
27:08
SPEAKER_00: You know, look up the mailing address.
27:09
unknown: Right.
27:10
SPEAKER_00: Confirm with that friend that, okay, yeah, you want me to send you that money, you know, confirm with them in person.
27:16
SPEAKER_00: Right.
27:16
SPEAKER_00: You know, it's it's when we when we allow our emotions to control us in those situations where we tend to fall victim the most.
27:24
SPEAKER_02: Yeah.
27:24
SPEAKER_00: So the the biggest piece of advice I can give them is simply slow it down.
27:30
SPEAKER_01: Yes.
27:30
SPEAKER_00: And call a family member, or like you said, just call somebody else, slow it down and it never it never hurts to get an outside opinion on what's going on.
27:40
SPEAKER_01: Okay, so on a more humorous note, what piece of technology could you personally not live without?
27:50
SPEAKER_00: The internet.
27:52
SPEAKER_00: Not a very specific piece of technology, but more a general piece of technology.
27:57
SPEAKER_00: The ease of access to information, communication, everything that the internet's about is probably the one thing that I need the most.
28:07
SPEAKER_02: Yeah.
28:08
SPEAKER_00: Oh, I'm I'm a fiend for learning.
28:10
SPEAKER_00: If I didn't have the internet, I'd probably be stuck in the library all day again.
28:13
SPEAKER_01: Yeah.
28:15
SPEAKER_01: Which might not be a bad thing, but the internet is wonderful.
28:18
SPEAKER_01: So, Mark, without sharing anything confidential, what happens behind the scenes when IT identifies a potential security threat?
28:29
SPEAKER_00: Well, that's a great question.
28:30
SPEAKER_00: Unfortunately, I don't have to share anything confidential.
28:33
SPEAKER_00: Um, I don't have to dig into any details of our of any incidents that we may or may not have had.
28:38
SPEAKER_00: But I will say I prefer to follow the NIST model, the National Institute for Standards and Technology.
28:44
SPEAKER_00: They're a federal government organization.
28:48
SPEAKER_00: And essentially we break down incident response into four large chunks.
28:52
SPEAKER_00: We prepare for them, we detect and analyze them, we then go into containment, eradication, and recovery, and then we review.
29:02
SPEAKER_00: And it essentially works as an ongoing cycle.
29:05
SPEAKER_00: So, as I alluded to earlier, Huntress is our main detection.
29:10
SPEAKER_00: It constantly looks out for any kind of anomalies that may occur.
29:15
SPEAKER_00: This could be something as innocuous as logging in from a new location.
29:19
SPEAKER_00: Many times, if staff travel outside the country, we'll get a notice and then we'll quickly isolate and lock their account until we can verify, oh, okay, you did actually travel over to, you know, the Bahamas or Colombia or Europe or wherever.
29:32
SPEAKER_00: So in a lot of cases, we we tend to take a shoot first and ask questions later approach when it comes to isolation and containment, which is excellent because it gives us a phenomenal response time, a sub-five minute response time, if you will.
29:46
SPEAKER_00: And fortunately, our false positives are extremely low.
29:50
SPEAKER_00: Well under 10%, I would say.
29:52
SPEAKER_00: But naturally, every time we have one of these cybersecurity incidents, we're able to review the logs, review what happened.
30:01
SPEAKER_00: We're able to issue further awareness training that's much more tailored.
30:05
SPEAKER_00: If a staff member runs astray, maybe they click a bad pop-up or something of that nature.
30:11
SPEAKER_00: And not to throw the staff member under the bus by any means, because we absolutely take an education first approach because it goes both ways.
30:18
SPEAKER_00: It's not just education for them, it's education for us.
30:21
SPEAKER_00: How can we better protect the staff and by extension the members?
30:26
SPEAKER_00: Right.
30:27
SPEAKER_00: And so we are constantly learning, we are constantly evolving our protections.
30:32
SPEAKER_01: I know that very well, constantly.
30:34
SPEAKER_01: And it's uh like I said at the beginning, it's constantly changing.
30:38
SPEAKER_01: And you always have to be on top of it, and you're good at that.
30:42
unknown: Yeah.
30:42
SPEAKER_00: Right now we have a new incidence response disaster recovery playbook.
30:47
SPEAKER_00: That's something that's getting ready to be deployed out to all the departments so that we have hard paper copies of, hey, if something happens, this is what should do.
30:56
SPEAKER_00: Much akin to how we prepare for hurricanes here at the club, something you're quite familiar with.
31:02
SPEAKER_00: We have the same thing in the works for IT.
31:05
SPEAKER_00: Right.
31:05
SPEAKER_00: So that we can have paper backups.
31:07
SPEAKER_00: Because obviously, if God forbid worse comes to worse, if we can't access our files on the servers, then we need paper copies of what to do.
31:14
SPEAKER_00: And fortunately, we we're also partnered with a, you know, well-known and very capable local MSP as well.
31:20
SPEAKER_00: That's one of the great benefits about Huntress as well, is that it is a managed product.
31:25
SPEAKER_00: So we have full access to an enterprise level SOC team security operations center.
31:30
SPEAKER_00: And they're quite helpful too, whenever we have suspected incidents.
31:34
SPEAKER_01: Just so maybe our members might be asking, is Huntress just something that's for large organizations?
31:40
SPEAKER_01: Does it work for a person, a layman, like you know, anybody at home?
31:45
SPEAKER_00: Unfortunately, it is an enterprise level product.
31:47
SPEAKER_01: Okay.
31:48
SPEAKER_00: Realistically, these days, for our members listening out there, most of you are most likely running Windows, which, to be quite honest, is much as I could go against Microsoft here, Windows Defender has come a very long way over the years.
32:04
SPEAKER_01: I would say most of our members probably use Apple.
32:08
SPEAKER_00: Apple, I can't speak to as well because I'm I'm simply just not as familiar with the product.
32:13
SPEAKER_00: I don't work in Apple's ecosystem.
32:16
SPEAKER_00: And realistically, I know everyone used to say, oh, well, Apple doesn't get viruses.
32:20
SPEAKER_00: That's not true.
32:23
SPEAKER_00: The reality of the situation is Apple's market share of workstation computers just tends to be very small, single digits.
32:30
SPEAKER_00: So a lot of people out there who are writing malware and viruses simply don't bother jumping through the hoops to do so for Apple because it's not worth the payoff.
32:40
SPEAKER_00: It's easier to take a large shotgun style approach, targeting those Windows PCs than it is to go after the Apple PCs, if that makes sense.
32:48
SPEAKER_01: Yeah.
32:48
SPEAKER_01: Do you think that might change?
32:50
SPEAKER_00: It has changed over the years, particularly with the proliferation of iPhones.
32:54
SPEAKER_00: iOS in particular is one that there are plenty of vulnerabilities out there for.
33:00
SPEAKER_00: And now I will admit Apple does a pretty good job of patching them up.
33:03
SPEAKER_00: But as far as having like an additional product or an additional layer on your phone, there's really not a great offering that I'm aware of.
33:13
SPEAKER_00: It tends to fall under awareness and education.
33:16
SPEAKER_02: Right.
33:17
SPEAKER_00: The one thing I will say I would recommend to everybody to get is get familiar with using an ad blocker on your phone and your computer.
33:26
SPEAKER_00: I've yet to meet anyone who actually enjoys seeing internet ads, number one.
33:29
SPEAKER_00: And number two, malicious advertising actually does cause a fair amount of incidences and cases.
33:35
SPEAKER_00: You get that crazy pop-up on your phone as you're doom scrolling Facebook or TikTok.
33:41
SPEAKER_00: And I think we've all seen them though.
33:43
SPEAKER_00: Oh, your device is infected.
33:44
SPEAKER_00: You've got to click here now to solve the problem.
33:46
SPEAKER_00: That's that's really just another entryway for scammers to get to you, whether it's on your phone or your computer.
33:52
SPEAKER_00: Having an ad blocker in place will block those.
33:56
SPEAKER_00: You will never even see them.
33:58
SPEAKER_01: So where do you get an ad blocker from?
34:00
SPEAKER_00: Uh it's gonna depend on your device and your setup and your technical abilities.
34:06
SPEAKER_00: Typically, using a browser like Firefox is a great method, is a great entry-level method.
34:12
SPEAKER_00: Brave is another browser that has these built in and pretty much ready to go out of the box.
34:17
SPEAKER_00: If you're using Chrome or Edge or even Safari to a lesser extent, they actually tend to actively discourage you from doing that.
34:26
SPEAKER_00: Because that's how they make their money.
34:28
SPEAKER_00: It is how they make their money.
34:29
SPEAKER_00: Yeah.
34:30
SPEAKER_00: They're happy with accepting a little bit of maliciousness on top of your everyday ads.
34:35
SPEAKER_00: Right.
34:36
unknown: Right.
34:36
SPEAKER_00: So I think that's that's always a good entry-level strategy that I try to get people on board with.
34:40
SPEAKER_01: Okay.
34:41
SPEAKER_01: We could spend hours talking to you, Mark.
34:43
SPEAKER_01: And you know me, I'm tend to be sometimes some techie, and I love to talk about this stuff because I find it so very interesting.
34:50
SPEAKER_01: And being part of communications, you know, it's kind of sometimes intertwined.
34:55
SPEAKER_01: I think we'll do another podcast down the road.
34:59
SPEAKER_01: We will talk more about AI because that you can talk a lot more about.
35:04
SPEAKER_00: Absolutely.
35:04
SPEAKER_01: And we'll do another podcast on AI for members.
35:08
SPEAKER_01: And hopefully we'll start doing some videos for them.
35:11
SPEAKER_01: I think that would be very helpful for them.
35:14
SPEAKER_01: And as much as we're as a company being made more aware of our cybersecurity and our protection here, I think the members would benefit from your knowledge.
35:25
SPEAKER_01: So we'll work on that, right?
35:27
SPEAKER_00: Yeah, we could absolutely do some of those and just try to spread the awareness.
35:30
SPEAKER_01: And yeah, I think it would be very helpful for them.
35:33
SPEAKER_00: Put some efforts out there in hopes of keeping everybody safe.
35:36
SPEAKER_00: Because at the end of the day, helping one person not get scammed, it's a it's a win in my book.
35:41
SPEAKER_01: So finish the sentence, please, before you call IT always.
35:47
SPEAKER_00: Well, if we're talking about our staff.
35:52
SPEAKER_00: So a couple of things.
35:53
SPEAKER_00: I think you and I have discussed this off topic a couple of times, but a new knowledge base is currently being developed.
35:59
SPEAKER_00: So that's going to be a huge benefit to our staff members.
36:02
SPEAKER_00: They'll have access to an incredible amount of troubleshooting knowledge just at their fingertips.
36:08
SPEAKER_00: And hopefully that'll help them self-service, if you will.
36:12
SPEAKER_00: I'm a big proponent of self-service in the IT space because it helps with education, it helps with awareness, it helps with speed of recovery, and it makes people feel good when they when they can solve their own problems.
36:22
SPEAKER_00: On top of that, that knowledge base also helps us build what's called tier zero agentic support.
36:29
SPEAKER_00: So you and I have discussed teams a lot.
36:32
SPEAKER_00: We love teams.
36:33
SPEAKER_00: I love teams.
36:34
SPEAKER_00: So having a Teams channel that's manned by an AI agent that can quickly read that knowledge base.
36:40
SPEAKER_00: And I'm sure many of our listeners and our members have encountered that before, where you click on the support portal of a website or a service, and then it says, Hey, what's your problem?
36:49
SPEAKER_00: And you type it in real quick, and then it quickly comes back to you and says, Okay, you should do X, Y, and Z first.
36:54
SPEAKER_01: They're all using it now.
36:56
SPEAKER_00: Everybody is switching to it.
36:57
SPEAKER_00: Depending on the service, it can be a detriment to customer service.
37:00
SPEAKER_00: So there's there's definitely a middle ground there.
37:02
SPEAKER_02: Yes.
37:03
SPEAKER_00: And I don't want to say we're going pure AI by any means.
37:07
SPEAKER_00: But the old tried and true, and I hate to use it because it I've used it for years.
37:11
SPEAKER_00: It works, but it's it is a band-aid.
37:13
SPEAKER_00: It doesn't solve the problem.
37:15
SPEAKER_00: That's right.
37:15
SPEAKER_00: But reboot it.
37:16
SPEAKER_00: Reboot.
37:17
SPEAKER_01: Yes.
37:19
SPEAKER_00: It it solves more problems than you think, but at the end of the day, it's kind of a cop-out from an IT perspective.
37:25
SPEAKER_00: Yeah.
37:26
SPEAKER_00: Because it it tends to mask the issue, not solve the issue.
37:29
SPEAKER_00: And I'm big and I'm a big proponent of let's solve this thing.
37:34
SPEAKER_00: Yeah.
37:34
SPEAKER_00: Yeah.
37:35
SPEAKER_01: All right.
37:35
SPEAKER_01: Well, thank you, Mark, for spending some time with us.
37:39
SPEAKER_01: I really enjoyed this podcast.
37:41
SPEAKER_01: And I think our members are going to enjoy this.
37:43
SPEAKER_01: I hope they do.
37:44
SPEAKER_01: I know they will.
37:45
SPEAKER_01: And we'll be doing more, just educating our members.
37:49
SPEAKER_01: That's great to hear.
37:50
SPEAKER_01: Yeah.
37:50
SPEAKER_00: I'd love to help them out.
37:51
SPEAKER_01: And you know, if I think they will enjoy this, especially with today's technology.
37:56
SPEAKER_01: It's just it's ever changing.
37:57
SPEAKER_00: It changes way too fast.
37:59
SPEAKER_01: Way too fast.
38:00
SPEAKER_01: So thank you again.
38:02
SPEAKER_01: Thank you.
38:03
SPEAKER_01: We'll talk soon.
38:04
SPEAKER_00: Glad to hear it.