Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / 031722_GoDaddy-In-The-News-Again+Massive-Fines-for-Breach

Transcript

031722_GoDaddy-In-The-News-Again+Massive-Fines-for-Breach · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:14
  Craig: Welcome to another episode of the Petronella cybersecurity podcast.
• 0:18
  Craig: Got Erin, BJ and Blake on the line.
• 0:21
  Craig: I'm gonna talk about the latest cybersecurity news today.
• 0:23
  Craig: Folks are welcome to join on the live stream as well.
• 0:25
  Craig: If anybody had questions that you wanted us to address, you can join the live stream on any of our supported platforms on YouTube, LinkedIn, Facebook, and you can join the party.
• 0:35
  Craig: I saw one of you guys posted something about the GoDaddy backdoor breach that was announced with WordPress
• 0:41
  BJ: we just talked about.
• 0:43
  BJ: and use the word authority in regards to go daddy just two or three days ago.
• 0:47
  BJ: So let's talk about.
• 0:48
  BJ: GoDaddy having a backdoor problem.
• 0:50
  Craig: Yeah.
• 0:50
  Craig: So a lot of people get started with GoDaddy because it's cheap, right?
• 0:54
  Craig: Domains are cheap postings cheap.
• 0:56
  Craig: But we've actually gotten a lot of clients that came from GoDaddy.
• 1:00
  Craig: Because they had a breach of some sort.
• 1:02
  Craig: And.
• 1:03
  Craig: Oftentimes on those low end packages, there's little no security.
• 1:07
  Craig: pretty much nothing there.
• 1:08
  Craig: So I think what this particular issue there was a WordPress.
• 1:12
  Craig: And I think that The lack of updates allowed for this backdoor action to happen?
• 1:16
  Craig: Is that right?
• 1:17
  BJ: Yeah.
• 1:18
  BJ: WordPress has come up in breech news a few times.
• 1:21
  BJ: We've heard quite a bit going on with WordPress.
• 1:23
  BJ: So what's going on there.
• 1:24
  BJ: You think.
• 1:24
  Craig: It's like Microsoft, right?
• 1:26
  Craig: So WordPress is a super popular in the community for an easy to use, easy to launch content management system.
• 1:35
  Craig: Where you don't need a lot of coding or technical knowledge to host or to manage a website, once it's thrown up there, WordPress has a lot of different kinds of templates that can be purchased.
• 1:45
  Craig: Very inexpensively could make a rather modern, pretty website, very inexpensively.
• 1:51
  Craig: But the problem with WordPress is since it's so well known, it's also the prime target for a lot of hackers.
• 1:56
  Craig: So there are security options and security controls that need to be.
• 2:00
  Craig: onto a WordPress.
• 2:01
  Craig: Website to make sure that not only is it protected, but it's also backed up.
• 2:05
  Craig: And we've got a lot of experience with that and security hardening those folks.
• 2:09
  Craig: also hosting requirements to WordPress is to Microsoft where it's got my opinion, a lot of bloat to it.
• 2:16
  Craig: So it requires really fast servers and hosts, which on the cheapest side will cause site to be very slow and.
• 2:25
  Craig: Sometimes unresponsive.
• 2:26
  Craig: So you need a lot of horsepower, so to speak.
• 2:28
  Craig: To properly host a WordPress website, but yeah in the hackers.
• 2:32
  Craig: Lens because of its popularity and how many people use it.
• 2:36
  BJ: WordPress definitely seems to tailor to those with a lesser degree of technical knowledge.
• 2:41
  BJ: So when you go on there and you create a WordPress website, Is it right to say that literally There's really no built-in security that you should be able to count on pretty vulnerable.
• 2:51
  Craig: Yeah, it's similar to a windows 11 computer.
• 2:54
  Craig: You could take it right out of the styrofoam.
• 2:56
  Craig: And connected to the internet, but if you don't have it patched first, it's going to get infected within minutes or seconds.
• 3:02
  Craig: And it's similar to that approach where out of the box.
• 3:05
  Craig: It's not going to really have any cyber capability.
• 3:07
  Craig: It's obviously going to want to fetch its latest update from the internet.
• 3:10
  Craig: And, WordPress has, what's called sequel database backend.
• 3:15
  Craig: A, my SQL database backend.
• 3:16
  Craig: so there's different pieces of what's called a stack.
• 3:19
  Craig: Typically it's a lamp stack.
• 3:21
  Craig: It's called Linux Apache, my sequel and PHP.
• 3:24
  Craig: And those technologies, which are all different.
• 3:27
  Craig: Different groups that make those technologies.
• 3:29
  Craig: Those together form the stack.
• 3:31
  Craig: And once you have that stack, then you put on top of that, the WordPress, and then it uses all those other components.
• 3:37
  Craig: But all of those components in the stack.
• 3:39
  Craig: Must be properly secured, maintained, and patched.
• 3:43
  Craig: Because if they're not, and they're not up to the latest and greatest, that's how loopholes happen and hackers exploit those loopholes.
• 3:51
  BJ: None of my WordPress or is that on the user
• 3:53
  Craig: No, this is all prerequisite.
• 3:55
  BJ: Ooh.
• 3:55
  BJ: So then, am I correct in saying that the user has to safeguard.
• 3:59
  BJ: And keep current cases of that stack.
• 4:01
  BJ: And then on top of that, what plugins they use on WordPress?
• 4:05
  BJ: Are they responsible also for security?
• 4:07
  Craig: So a lot of these pro.
• 4:08
  Craig: Providers like GoDaddy.
• 4:09
  Craig: We'll have what's called a one-click installation.
• 4:12
  Craig: So it's a script let's say you go on a GoDaddy really inexpensive and it's not just GoDaddy.
• 4:17
  Craig: It could be any.
• 4:17
  Craig: Inexpensive shared hosting provider.
• 4:20
  Craig: But any kind of inexpensive hosting providers going to be shared, and it's going to be shared with hundreds or most often thousands of other people on that server.
• 4:28
  Craig: Okay.
• 4:29
  Craig: And typically in the configuration, they have what's called a one-click install.
• 4:33
  Craig: Most modern host providers have this where you can literally click one button, it'll kick off a lot of scripts to set up the mice, SQL the PHP and all this stuff.
• 4:41
  Craig: And then it'll get it all.
• 4:42
  Craig: Ready for WordPress.
• 4:43
  Craig: And then it'll install what we call in the technical world of Anela installation.
• 4:47
  Craig: A very basic installation of the software has a default template assigned to it.
• 4:52
  Craig: it looks pretty bland out of the box, right?
• 4:54
  Craig: After that's all done and you have this vanilla installation, you have to go through the patch process and the securing process.
• 4:59
  Craig: So you've got to make sure that it's got all the latest updates that's at the WordPress level, but you have to do the same under the hood a lot of people.
• 5:06
  Craig: They don't ever see under the hood because most people are not technical.
• 5:09
  Craig: They're relying on these scripts to do this thing right.
• 5:12
  Craig: And a lot of providers will do auto updating and patching at some of those other levels stumble, not because sometimes patches break things.
• 5:19
  Craig: And then you mentioned plugin.
• 5:20
  Craig: So any kind of plug in.
• 5:22
  Craig: That makes the website prettier from a cosmetic perspective, or maybe you have a plugin for a form or a plugin for a Google analytics, all these different plugins.
• 5:31
  Craig: They all need to be updated and secured as well.
• 5:34
  BJ: Wow.
• 5:34
  BJ: to manage.
• 5:35
  BJ: website, it sounds like you really need to be looking at a lot of things that maybe people aren't looking at right now on.
• 5:40
  BJ: When you're on WordPress and you mentioned that people are sharing.
• 5:43
  BJ: Can other users on WordPress.
• 5:45
  BJ: Be a risk to.
• 5:46
  BJ: Other users is that even a thing?
• 5:48
  BJ: Because it starts somewhere and then it grows and then it goes sideways and upwards and downwards and diagonal.
• 5:53
  Craig: yeah, we'll take a step back.
• 5:55
  Craig: So one click install makes it super easy for really anyone to install WordPress.
• 6:00
  Craig: But like we had said many times cyber security took a back seat.
• 6:03
  Craig: So you're relying upon the provider to not only make sure that all these prerequisites are up to date and stay up to date, but in the fine print of the provider, They hold themselves harmless to any kind of security or configuration.
• 6:17
  Craig: And they leave that up to the user to properly secure and configure.
• 6:20
  Craig: So even with Amazon and Google and Microsoft environments, you can get Amazon web services.
• 6:25
  Craig: For example, most people can sign up for it.
• 6:27
  Craig: It does require a little bit more technical expertise to even know what you want to sign up for.
• 6:32
  Craig: But my point is that they give you all these dials and controls, but it's your responsibility to secure it.
• 6:37
  Craig: And most people just gloss over.
• 6:39
  Craig: They don't do it.
• 6:40
  Craig: And that's how these breaches happen, but to touch on what you just said, what happens there is.
• 6:44
  Craig: now They got this WordPress website.
• 6:46
  Craig: They get plugins and they dress it all up with a new theme and everything.
• 6:49
  Craig: Make it look pretty.
• 6:50
  Craig: But oftentimes again, the security takes a back seat, so they move on.
• 6:54
  Craig: They go about their day.
• 6:55
  Craig: And then they get hit with something like this vulnerability.
• 6:58
  Craig: And then all the people that are hitting that website.
• 7:01
  Craig: Are now at risk of infection, because if there's ransomware on the website, And you're infected because of this whole, every visitor that hits your website is now a potential victim.
• 7:11
  BJ: So you're literally putting all your visitors at risk.
• 7:14
  BJ: And then is there a sideways risk, for other sites that are hosted on WordPress?
• 7:18
  BJ: Is there a sideways risk as well?
• 7:20
  Craig: That depends on the host provider.
• 7:21
  Craig: I would think that most hosting providers have what's called segmentation so that they wouldn't be spillover like that.
• 7:27
  Craig: But I'm taught to never assume anything.
• 7:30
  BJ: Yeah.
• 7:30
  Craig: sure that there are risks that exist at some provider level for spillover like that.
• 7:34
  Craig: That are not properly segmented, yeah.
• 7:36
  Craig: And then you've got local and regulations too.
• 7:39
  Craig: You've got ADA and FTC regulations.
• 7:41
  Craig: And if you're in a state that has a data breach notification laws, which most states have, if something happens with that website, you may be obligated.
• 7:49
  Craig: And by law to disclose that something happened.
• 7:51
  Craig: And then now you got brand tarnishing and, reputation management to withhold.
• 7:56
  Craig: You know what I mean?
• 7:56
  Craig: It just gets really nasty,
• 7:58
  BJ: of FTC, we just all FTC seeking to find a company cafe press for a breach in 2019.
• 8:05
  BJ: They didn't report in time, and they're not a cybersecurity further.
• 8:08
  BJ: They make t-shirts I think, but it looks like a half, a million dollars is the fine that the FTC is seeking in regards to that breach.
• 8:16
  BJ: I always feel sad when I see a certain company, hit by that because these types of things are happening to a lot of.
• 8:21
  BJ: Companies and then they get the brand.
• 8:23
  BJ: Tarnish, but these problems are so deep and widespread,
• 8:26
  Erin: but I think the reason they got in trouble, though.
• 8:28
  Erin: And I could be wrong, but I think they got in trouble just because they didn't.
• 8:32
  Erin: Report it.
• 8:33
  Craig: That's why.
• 8:33
  Craig: All of our customers.
• 8:35
  Craig: get data breach.
• 8:36
  Craig: Guidance by a certified privacy officer.
• 8:39
  Craig: So any of our clients if they were to have an issue like that, which most likely they wouldn't, but the point is if they did suffer, something like that.
• 8:47
  Craig: They would get assistance and support around that.
• 8:49
  Craig: But that story, it is sad It's also though how all these rules and regulations are changing every day.
• 8:56
  Craig: And it's so hard for the business or the business owner to keep up And it's just so important a trusted.
• 9:02
  Craig: Third party to help them with that.
• 9:04
  Craig: And that story reminds me of the ADA compliance.
• 9:07
  Craig: I don't know if you guys remember, but I talked about this a while ago around how a, I think it was a shoe store.
• 9:13
  Craig: I think a sneaker store or something, and they had a similar issue it wasn't around a breach.
• 9:17
  Craig: It was around their shoe store.
• 9:19
  Craig: Wasn't friendly to blind people.
• 9:21
  Craig: So they failed ADA compliance.
• 9:24
  Craig: they got hit with I think it was 50 or a hundred thousand dollars fines because their website was not ADA compliant.
• 9:31
  BJ: Oh, wow.
• 9:32
  BJ: What we're seeing on a big picture right now, what you can see current state of a war.
• 9:36
  BJ: And stuff and how it's going.
• 9:38
  BJ: definitely branching into physical and cyber, this is probably the first time we've never seen something like this the war took a cyber twist.
• 9:46
  BJ: And if that's not a sign of the times and the fact that your cyber presence is becoming every bit as important as your brick and mortar, your physical presence.
• 9:55
  BJ: If not more.
• 9:56
  BJ: So I would agree with that.
• 9:57
  BJ: when you start to hear about fear that's emerging and this thing could go, and what the possibilities are, they're all really related to cyber threats, for example, next gov.com.
• 10:07
  BJ: out something, I guess they have a solarium commission they determine when to use force Depending upon the level of the risk.
• 10:15
  BJ: it does seem like a lot of the anxiety is related to the escalation of cyber war.
• 10:20
  BJ: that should be really indicative to people that, your cyber presence is so often neglected, this should be not a wake-up call, but an awareness called this is a shift in, what's really important in protecting your cyber presence.
• 10:32
  BJ: is not something to be overlooked anymore.
• 10:34
  BJ: It's really catastrophic, right?
• 10:36
  Craig: And it's also.
• 10:37
  Craig: Brought the risks at more of a global level though, right?
• 10:40
  Craig: Cause if you have a website.
• 10:42
  Craig: And that website's available anyone in the world.
• 10:45
  Craig: Let's say you have that shoe store that t-shirt store right.
• 10:48
  Craig: You know that t-shirt store.
• 10:49
  Craig: Might have a customer radius of maybe five miles, from that store.
• 10:54
  Craig: Maybe they do online shipping and the other parts of the world, so they have some more global or international presence there, but a typical mom and pop.
• 11:01
  Craig: Does not need to do business across the world.
• 11:04
  Craig: But my point is that, A long time ago before.
• 11:07
  Craig: The internet and really, mom and pop businesses we're really more physical on the security side.
• 11:14
  Craig: Like you said, now they're more on the cyber side, because think about it.
• 11:17
  Craig: you're in a country and you're paid to be a cyber criminal, and that's your day job and, drop in malware and ransomware and that's how you make money.
• 11:24
  Craig: Are you going to go get up out of bed, get dressed and go to the local place to try to see something
• 11:30
  BJ: Yeah.
• 11:31
  Craig: get arrested?
• 11:32
  Craig: Or are you going to go.
• 11:33
  Craig: Try to attack somebody across the world
• 11:35
  BJ: Right.
• 11:36
  Craig: does not typically have any kind of.
• 11:38
  Craig: Protection or even insight into you doing something like that.
• 11:43
  BJ: There's no segmentation anymore.
• 11:45
  BJ: You used to be able to have a corner store and you could put bars on the windows and keep yourself separate from every other business and just isolate yourself and protect yourself.
• 11:53
  BJ: But now the world is becoming very connected and probably it always was.
• 11:57
  BJ: But now because of cyberspace we're actually coming face to face with the reality of the connectivity of the world, example about WordPress is a perfect example about how, even if you don't even know these other businesses, you're on the same platform you're all connected.
• 12:09
  BJ: now.
• 12:09
  BJ: And you're all susceptible to the same breaches and backdoor things.
• 12:13
  BJ: Let me read this.
• 12:13
  BJ: This is a definition I found online when I just Googled IOT, cyber security, IOT being internet of things.
• 12:19
  BJ: And as we talked about yesterday pretty much if you're connected to the internet, you probably have an IOT device and you're holding one in your hands all the time, but it says IOT security is the technology segment focused on safeguarding connected devices.
• 12:32
  BJ: And networks and the internet of things, IOT involves adding internet connectivity to assist them with interrelated computing devices.
• 12:40
  BJ: Mechanical and digital machines, objects, animals, and, or people.
• 12:43
  BJ: If that's not a definition of connectivity, And we can't deny any more.
• 12:48
  BJ: The fact that is a connection just these platforms go, daddy, how many businesses have become connected?
• 12:54
  BJ: Do you two
• 12:54
  Erin: go daddy.
• 12:55
  Erin: and I wanted to bring up a point too, because with that other cyber breach that we were talking about the, Cafe press.
• 13:01
  Erin: the database contained 23 million, 205,290 records.
• 13:08
  Erin: Uhhh, including email addresses, names, phone numbers, and physical addresses.
• 13:14
  Erin: And then half of them also had encrypted passwords attached with most of them hashed using an older form of encryption.
• 13:21
  Erin: That can be easily cracked.
• 13:22
  Erin: So when you're talking about connectivity and things like that, It's like a small.
• 13:25
  Erin: T-shirt company, but.
• 13:27
  Erin: That's a of records.
• 13:28
  Craig: not only is it a lot of records, but look at the data that you identified name.
• 13:32
  BJ: Very powerful data.
• 13:34
  Craig: Yeah.
• 13:34
  Craig: So that's considered personal identifiable information or PII, which is why breach was so devastating because not only the quantity, but the type of data really
• 13:44
  BJ: Yeah.
• 13:45
  Craig: on the individual.
• 13:46
  BJ: Ooh.
• 13:47
  BJ: Very identifiable.
• 13:48
  BJ: They're very much identifiable.
• 13:50
  BJ: It's interesting Greg, because.
• 13:51
  BJ: I've known you for years now.
• 13:52
  BJ: And it just in the day-to-day.
• 13:54
  BJ: Interactions, we don't typically hear all the knowledge that's in your brain come out because there's just not typically an outlet for it because there's other things going on, other things to focus on.
• 14:04
  BJ: But when you start talking, when you start speaking, almost sounds like.
• 14:08
  BJ: Surely he's reading from an encyclopedia.
• 14:10
  BJ: This can't all be in this.
• 14:11
  BJ: But it is in your head this is really eye opening so many people, don't understand even what the internet is or what.
• 14:18
  BJ: devices are or what cybersecurity means.
• 14:20
  BJ: And some people make the false assumption that, oh, as long as it's encrypted, it's safe.
• 14:23
  BJ: That wasn't true before, because you can break encryption in lots of ways, but that's especially not true now with.
• 14:30
  BJ: They were announcing these quantum safe algorithms.
• 14:32
  BJ: Quantum safe encryption.
• 14:34
  BJ: And there was articles saying that recently it was easily broken.
• 14:37
  BJ: So even the quantum safe encryption is not safe.
• 14:39
  BJ: Encryption is not a catch all.
• 14:41
  BJ: So cybersecurity is.
• 14:43
  BJ: The key.
• 14:43
  BJ: And for so long, this knowledge has been in the dark, obscure, people like you have carried it around in your brains.
• 14:49
  BJ: For all these years.
• 14:50
  BJ: And there's just such a disconnect between, the level of intelligence and knowledge on these topics in the cybersecurity people, and then the mainstream.
• 14:58
  BJ: I see that this is all having to come together in a convergence.
• 15:02
  BJ: Now that's the only sustainable pathway.
• 15:03
  BJ: You are knowledge has to leak into the mainstream we need this understanding.
• 15:07
  Craig: Yeah, It gets really complicated.
• 15:10
  Craig: think you're right.
• 15:10
  Craig: I think a lot of people don't realize.
• 15:12
  Craig: How much this stuff touches everything and how intertwined it all is.
• 15:17
  BJ: We've always known.
• 15:17
  BJ: It was complicated to a certain degree in our field.
• 15:20
  BJ: But yesterday when you mentioned the 60,000 ports, even for me that showed a new light, this is complicated at a level that even I didn't comprehend.
• 15:27
  BJ: this.
• 15:28
  BJ: Truly the definition of complicated.
• 15:30
  Craig: Oh, yeah.
• 15:30
  Craig: And that's why people don't do anything with cyber.
• 15:32
  Craig: They're scared of it.
• 15:33
  Craig: And they don't understand it.
• 15:35
  Craig: they just do nothing.
• 15:36
  BJ: Yeah.
• 15:37
  Craig: and the sad reality is that doing nothing is super harmful as you've seen with t-shirt company.
• 15:42
  Craig: And.
• 15:43
  Craig: People might be listening or watching and think my business is too small.
• 15:46
  Craig: Maybe I'll only have 50 or a hundred records in my database.
• 15:49
  Craig: Nobody wants that.
• 15:50
  Craig: But that's actually not true.
• 15:51
  Craig: The little guys are at high risk because they don't have near the defenses of the big guys.
• 15:56
  BJ: they're a high target to be used as a staging ground,
• 15:58
  Craig: A launching pad or even identity theft, even if you have a small business and, you're somewhat successful.
• 16:04
  Craig: Your identity might be worth something to the bad actor.
• 16:07
  Craig: Maybe you have good credit, maybe they want your credit.
• 16:09
  Craig: Maybe they want to get a surgery.
• 16:10
  Craig: I think.
• 16:11
  Craig: I told you guys when we did a show one time where I told you about guy that got nailed with fraudulent medical bills and he was fighting and fighting, and finally went up to the hospital and had a up a shirt and say, I never had a surgery.
• 16:22
  BJ: Recently a piece of mail came for my daughter.
• 16:24
  BJ: Who's 12, about to be 13 for a bill from children's mercy hospital.
• 16:28
  BJ: She's never been there.
• 16:29
  BJ: Yeah.
• 16:29
  BJ: Within a different city and state and everything.
• 16:31
  BJ: So yeah.
• 16:32
  Craig: When she was born at some point in time, in those 12 years, somebody's passed that information and there's actually, bad people that are in the hospital right after that baby's born, they'll sell that information.
• 16:44
  Craig: And then most people don't think to put identity protection on their kids, which they should.
• 16:49
  Craig: should protect their whole family.
• 16:50
  Craig: Not just when they turn 18 or whatever, because oftentimes things like that happen.
• 16:55
  Craig: And you would never know unless you were monitoring it.
• 16:57
  BJ: Or you get that bill in the mail and you're
• 16:59
  Craig: That's right.
• 17:00
  Craig: Now you've got to fight it though.
• 17:01
  Craig: And then.
• 17:01
  Craig: now you have to spend all your time dealing with it
• 17:04
  BJ: was that the only thing done?
• 17:06
  BJ: not.
• 17:07
  BJ: So then what else was done?
• 17:08
  Craig: Yeah.
• 17:08
  Erin: parents too, that do that to their children, which I think is so awful.
• 17:12
  Erin: They get credit cards and their young children's names and just don't pay them back and stuff.
• 17:16
  Erin: I worked in credit counseling for a long time.
• 17:18
  Erin: is actually pretty common.
• 17:21
  Craig: Wow.
• 17:21
  Erin: Just reminded me of that.
• 17:23
  Craig: Craziness.
• 17:24
  BJ: Yeah there's quite a bit of that, but it looks like there's a visible pathway for me, for all this to sort itself out.
• 17:30
  BJ: It's for people like you that have quite some time now since the Dawn of digital age.
• 17:34
  BJ: That computing age have.
• 17:36
  BJ: very much ingrained with all of this and the knowledge that you hold in your head.
• 17:40
  BJ: Can really be a benefit to all of us right now.
• 17:43
  BJ: computers a child.
• 17:44
  BJ: So I don't know what drew you to it.
• 17:46
  BJ: Originally, but ever since then, you've probably soaked up so much information There's no price that you can put on that.
• 17:52
  Craig: Yeah.
• 17:53
  Craig: As a curious kid, it was taking things apart and.
• 17:56
  Craig: Putting them
• 17:56
  BJ: Yeah.
• 17:57
  BJ: But you were actually successful to a degree in rebuilding computers as a child, and that's probably not considered quite normal.
• 18:05
  Craig: Ask my wife I'm far from normal.
• 18:07
  Erin: I don't think we have to ask your wife.
• 18:09
  Erin: They're all weird.
• 18:09
  Erin: It's cool.
• 18:10
  Craig: Yeah.
• 18:11
  Craig: just taking things apart, putting it back together and then, building my own computer, ripping it apart, putting it back together, learning what all the parts did and.
• 18:18
  Craig: That was fun for me.
• 18:20
  Craig: I am weird.
• 18:21
  BJ: Yeah maybe.
• 18:22
  BJ: Even larger scale from a different perspective, maybe that's what we're doing with the whole internet and internet of things.
• 18:27
  BJ: Now, maybe it started on one pathway just because it had the launch somewhere, but maybe now it's actually, coming together for its clean up basically so that it can go in the right direction because the path that it took to begin with definitely led us to a place we don't really want to be.
• 18:42
  Craig: Yeah, I did a lecture for some Up and coming law students at a university.
• 18:47
  Craig: About an hour ago, I had one of the students had a parent, I think that worked in the defense industrial base and.
• 18:53
  Craig: They were saying how they thought that it was cost prohibited for them to get CMMC for example.
• 18:59
  Craig: And had no idea that 2.0, came out and how it reduced it and made it so much easier to get.
• 19:05
  Craig: There's just so much misinformation facts are.
• 19:08
  Craig: Even at the defense industrial base or CMMC level, not that hard and it's not that expensive.
• 19:14
  Craig: The reality is it's not that expensive to get compliant and do the right thing.
• 19:18
  Craig: It's oftentimes much less than hiring another body in your organization.
• 19:22
  Craig: the same thing at the consumer level.
• 19:24
  Craig: There's so many free and powerful tools.
• 19:27
  Craig: Like signal, for example, and, prevail has a free option and, there's different tools out there.
• 19:33
  Craig: That the average consumer can take into their own hands, have guides on this stuff that we've produced.
• 19:39
  Craig: We've done lectures on it.
• 19:40
  BJ: It's true it's the same thing with the extended detection and response tools.
• 19:44
  BJ: I think it's pretty obvious that the more people that use those, less, the price can be because as the machine learning, unfolds and it gets more and more effective and efficient, then there's going to be less of a need for human oversight the machine learning develops.
• 19:59
  BJ: And so the price of those tools can come down.
• 20:02
  BJ: So it's just about adoption and,
• 20:03
  Craig: It's about adoption and then proper configuration orchestration.
• 20:07
  Craig: But even with the tools that have a commercial pricing side to it, we work hard as a company to vet and test those solutions.
• 20:14
  Craig: then, the reality of the situation is oftentimes we're able to negotiate better prices than those consumers go in direct.
• 20:20
  Craig: So that's why we encourage that.
• 20:21
  Craig: They come to us, can give them the shortcut that catalyst.
• 20:24
  BJ: There's a definite change recently in level of value that's applied to cybersecurity experts.
• 20:30
  BJ: If you read through the headlines, like some of the government news, this year, especially being really on the hunt for top cybersecurity.
• 20:37
  BJ: Talent.
• 20:37
  BJ: Simply because just like I said, when we hear you talk and you can do that for hours is going on and on with all these facts in your head you can't recreate that.
• 20:46
  Craig: Yeah.
• 20:47
  BJ: you've amassed all that.
• 20:48
  BJ: And there's no way that can be mimicked or duplicated, that's authentic and genuine.
• 20:53
  BJ: And that's really, in these times, it's priceless to have somebody like that in your corner.
• 20:57
  BJ: And obviously the government is realizing that, cause they're on the search for top cyber talent, there's no price that you can put on someone that can actually keep your business because what's the cost of CMMC and compliance compared to business continuity overall.
• 21:10
  BJ: And if your business.
• 21:11
  BJ: I can't continue.
• 21:12
  BJ: That's the highest cost of all.
• 21:14
  Craig: Yeah.
• 21:14
  Craig: And the sad reality is, A lot of these small businesses that do nothing like maybe the t-shirt or the mom and pop company.
• 21:21
  Craig: They've worked hard to write.
• 21:22
  Craig: They started that business, who knows.
• 21:24
  Craig: Whether it was from, their life savings, for example.
• 21:27
  Craig: Why would you want to lose all that to something stupid from a cyber criminal on the other side of the world, that would just literally overnight erase you.
• 21:34
  Craig: all that hard work that you built up in your small business is gone.
• 21:39
  BJ: It's a perfect example of how forward progress requires constant evolution.
• 21:43
  BJ: You have to constantly stay.
• 21:45
  BJ: Pointed in the direction of forward progress and keep moving, keep evolving, because that's a perfect example of that.
• 21:51
  BJ: There's a lot of people caught up in this mess right now, cyber security and business continuity.
• 21:56
  BJ: But the truth is, yeah, we have to keep evolving as things change in the world.
• 22:00
  Craig: Yep.
• 22:00
  Erin: One thing that always gets to me though.
• 22:02
  Erin: I feel sorry for.
• 22:03
  Erin: The small businesses that Rely on these government contracts.
• 22:06
  Erin: Because they have so much work to do, they've already been paid to do this for the most part in their contracts.
• 22:12
  Erin: A lot of time.
• 22:12
  Erin: They're supposed to be NIST.
• 22:14
  Erin: Compliant, but a lot of them aren't.
• 22:16
  Erin: I feel bad.
• 22:16
  BJ: I'm on the borderline between sympathy and now we have to keep moving forward and now it's a mess.
• 22:21
  BJ: Bible and national security.
• 22:22
  BJ: It's guys.
• 22:23
  BJ: We'll be cyber secure ukrainian Russia.
• 22:25
  BJ: War is proof that now cyber war is actually how war is going to be fought going forward.
• 22:29
  BJ: So if you don't want to be cyber secure, we really can't have you part of the DIB, the defense industrial base, because you're putting us all at risk.
• 22:35
  BJ: So if you don't want to take your cyber security seriously, then we really need you to look at other contracts and not department of defense contracts, because then that puts us all at risk.
• 22:44
  Craig: I also think that the biggest problem, though, for the dip contractors that took contracts and self attested and not fully understood all of the work.
• 22:54
  Craig: And continuous work that needs to be done to be compliant.
• 22:57
  Craig: To get that contract with NIST 801 71 at my point is that had there been more.
• 23:04
  Craig: Underscoring or highlighting of those requirements.
• 23:07
  Craig: I think that then those businesses would not have made some future decisions.
• 23:11
  Craig: Maybe they thought they could afford to hire another.
• 23:14
  Craig: Body or human or whatever, or maybe they thought they could afford the rent at that better location.
• 23:20
  Craig: But.
• 23:20
  Craig: If they knew how much work is to be compliant.
• 23:24
  Craig: And how it was really the baseline, then they may not have made those other financials.
• 23:28
  Craig: So yeah, I get it.
• 23:29
  Craig: I understand what you're saying, Aaron, I agree with you, but.
• 23:32
  Craig: I think that there should have been more emphasis in education five years ago on this stuff.
• 23:38
  BJ: When you were rebuilding computers went off into cybersecurity as a very young person, you were forward thinking at that time and on the cutting edge at that time.
• 23:45
  BJ: And unfortunately the upper levels of governance in the world at the global level was not at the cutting edge with you there.
• 23:53
  BJ: And so what's happened is they've not led humanity.
• 23:56
  BJ: Towards.
• 23:57
  BJ: When the cutting edge leading.
• 23:58
  BJ: So now here we are dealing with the consequences of that.
• 24:01
  BJ: Because as soon as the internet started, as soon as we started using the internet, cyber security should have been the top priority.
• 24:07
  Blake: If you think about Holly, The Internet's a ball Daniel Lane from their home landlines.
• 24:12
  Blake: To connect to the internet.
• 24:13
  Blake: There wasn't wifi.
• 24:14
  Blake: We're just learning about the internet and all of his coolness And good sides and flowers and smiles.
• 24:21
  Blake: The people that were too busy, instant messaging.
• 24:22
  Blake: I could be wrong, but most likely people at that time were.
• 24:25
  Blake: Oh, how can we use this?
• 24:27
  Blake: For monetary advantage.
• 24:28
  Blake: Or how can we use this To take advantage of somebody else at that time.
• 24:32
  BJ: But there
• 24:32
  Erin: had to be some people that realized
• 24:34
  BJ: it right.
• 24:35
  BJ: People
• 24:36
  Craig: Well,
• 24:36
  BJ: Who was stuff.
• 24:38
  BJ: And the start of your career, you were laying network cables and stuff for lots of government places.
• 24:42
  BJ: And you probably started to get an inkling back then that some of this is not quite tied up.
• 24:47
  Craig: Yeah.
• 24:47
  Craig: You all seen the movie war games?
• 24:50
  BJ: No.
• 24:50
  Craig: Oh, gosh, that's your homework assignment.
• 24:54
  Craig: that's a great movie.
• 24:54
  Craig: That's a classic.
• 24:55
  Craig: So war games.
• 24:57
  Craig: about this topic about modems and connectivity at that early stage in time and how he went with his modem.
• 25:04
  Craig: and broke into government DARPA system simulated global thermal nuclear war.
• 25:10
  Craig: And basically other sides of the military thought it was really happening.
• 25:14
  Craig: won't spoil the movie, but yeah, you definitely need to watch that.
• 25:17
  Craig: that was my childhood of growing up in that, era, that time and, popular publications at the time.
• 25:22
  Craig: And this is still around, but 2,600 magazine, have you guys ever heard of that stuff?
• 25:27
  BJ: No.
• 25:27
  Craig: Oh, yeah, that's another homework so 2,600 is the frequency.
• 25:32
  Craig: Of the quarter-tone of the analog payphone was founded by the handle.
• 25:39
  Craig: I think it was fiber optic was his handle to be able to whistle 2,600 tone into a payphone to get free credits.
• 25:46
  Craig: And the payphone thought that he was putting quarters in it.
• 25:49
  BJ: Oh, wow.
• 25:50
  Craig: That's where 2,600 magazine came from and the magazine is all about the hacker community and educating.
• 25:57
  Craig: In a small magazine format, educating the people that are interested in it like me at the time.
• 26:03
  Craig: And I still read it actually.
• 26:04
  Craig: Of all the exploits and all this stuff.
• 26:06
  Craig: think that you are reading every day, it's actually published in the magazines.
• 26:11
  Craig: And this is where, you heard about Kevin Mitnick, I'm sure where
• 26:14
  BJ: Yeah.
• 26:15
  Craig: large corporations, like at T broke into their phone systems.
• 26:19
  Craig: I grew up in all that time.
• 26:21
  BJ: That's such.
• 26:21
  Craig: it didn't exist, then it
• 26:23
  BJ: Yeah.
• 26:23
  Craig: existed, then it was just at an analog level.
• 26:26
  Craig: And now since we're all connected, the landscape has grown exponentially and now you've got technologists and hackers that are doing this stuff, not locally anymore, but across the world.
• 26:36
  BJ: Cause now you're pointing out a fact that people of masses.
• 26:39
  BJ: Likely do not really comprehend is that the internet and the cyber realm is not separate from science and nature itself.
• 26:47
  BJ: These things are all the same forces at play, just different pathways and different routes.
• 26:52
  BJ: But if you can whistle.
• 26:54
  BJ: Full machine about a frequency.
• 26:56
  BJ: There you go.
• 26:56
  BJ: We're coming full circle, this is all related to nature and science as well.
• 27:01
  Craig: Yup.
• 27:01
  Craig: It's a crazy world we live in right now.
• 27:04
  BJ: Yeah.
• 27:05
  Erin: Maybe one day we can talk about the mycelium network.
• 27:07
  Erin: It is crazy.
• 27:09
  Craig: Yeah.
• 27:10
  Blake: I got a new idea for your next book.
• 27:13
  BJ: Cyber security.
• 27:14
  Craig: Okay.
• 27:15
  BJ: Let's say that again, Blake, I didn't quite hear.
• 27:17
  Blake: The cyborg of cyber security.
• 27:19
  BJ: Yeah.
• 27:19
  BJ: I know I was reading it.
• 27:20
  BJ: It's funny you say that.
• 27:21
  BJ: Cause I swear, this came to me naturally this morning.
• 27:24
  BJ: I go through the little news headlines in the morning and I was reading an article where they were speculating that Elon Musk has a new Twitter photo where he's wearing these glasses and they say that he's trying to emulate a Terminator.
• 27:34
  BJ: And as soon as I saw that, the first thought that popped in my head is, oh, that's actually not the one.
• 27:39
  BJ: It would be Craig veteran.
• 27:41
  BJ: The world is not as simple as we thought, cyber security is so complicated.
• 27:44
  BJ: So is the whole world you have concepts such as quantum entanglement how does all this really work and how does it really all connect and how does creation work and the cosmos, and then, when you have people that have a ton of knowledge about things that are relative to all of these very mysterious and important points, it's worth paying attention.
• 28:02
  BJ: Some significance to that, when you scale out 500 years and you'll see that there's some places that shine extra bright, and those are worth paying attention to.
• 28:11
  Blake: Yeah, it's funny that you say that when you bring up the Terminator.
• 28:13
  Blake: If you look at the Terminator movies.
• 28:15
  Blake: It perfectly describes the evolution of the internet.
• 28:18
  BJ: it really does.
• 28:19
  BJ: And then you have that one blockchain, not saying that's it, but it's interesting because you have a blockchain called Skynet.
• 28:24
  BJ: And that's from the Terminator movies and a lot of the things that the community says and stuff, and there's this Logan machines, or, it's just really interesting because, as far as the.
• 28:33
  BJ: quantum realm goes and quantum mechanics it's literally outside of time.
• 28:37
  BJ: And so then you start thinking about all this okay.
• 28:40
  BJ: So something from the future making its entrance into the present in a very organic way.
• 28:46
  BJ: The honest answer to that would have to be yes, scientifically.
• 28:49
  BJ: Yes.
• 28:49
  BJ: The answer would be yes.
• 28:50
  Blake: Yeah.
• 28:51
  Blake: I think about the first movie when they shaved back a human and that was the internet.
• 28:54
  Blake: And the empathy phase, And then the second movie they said back.
• 28:58
  Blake: And he was the first machine.
• 29:00
  Blake: And then they sent him back and then they sent the liquid side war.
• 29:03
  Blake: And then in the following features,
• 29:05
  BJ: This crazy hybrid.
• 29:07
  Blake: Mechanisms and Bible words.
• 29:09
  Blake: metal.
• 29:10
  Craig: Yup.
• 29:11
  Erin: don't think I've seen.
• 29:11
  Erin: Any of the Terminator movies.
• 29:13
  BJ: It's very interesting it's obvious, even if you don't certain scientific concepts and stuff, it's fairly obvious that if something from a different timeline or different place, Was to be here in the physical presence.
• 29:25
  BJ: It would be obvious that it would probably have to forsake some of its memory enabled to pull that off, which would explain why people don't necessarily understand themselves fully until, Maybe a certain point, but it makes perfect sense because you would have to give something up.
• 29:39
  BJ: In order to pull that off.
• 29:41
  BJ: When you talk about quantum entanglement, we know that quantum entanglement is real because it's been studied, it's been proven.
• 29:46
  BJ: And if there is such a thing as quantum entanglement, then just due to the wall of homeostasis, there has to be something.
• 29:53
  BJ: To the idea of quantum unfoldment.
• 29:56
  Craig: Yup.
• 29:56
  Blake: I'm waiting for the real life Tron to happen.
• 29:59
  Blake: I dunno if you guys have seen.
• 30:01
  Blake: But this guy, Zach.
• 30:03
  Blake: Himself into his computer and then build the world.
• 30:06
  Blake: In the computer.
• 30:07
  Blake: Or.
• 30:07
  Blake: The digital space.
• 30:08
  Blake: And everything has a function of program and.
• 30:11
  Blake: And yeah, waiting for that to happen.
• 30:13
  Blake: I've told people before, if there's two things I can do that would never come back Ever.
• 30:16
  Blake: Let's go to space.
• 30:17
  Blake: knowing that it is a one way.
• 30:18
  Blake: I would die.
• 30:19
  Blake: and then do Y Tron go into my computer.
• 30:21
  Blake: Knowing I can never come back.
• 30:22
  Blake: As long as I knew that type of environment would exist.
• 30:25
  BJ: Wow.
• 30:26
  BJ: It's going to be the opposite.
• 30:27
  BJ: Blake, maybe that type of environment is stepping from the background to the foreground and merging with.
• 30:33
  BJ: And maybe that would be a great uplifting to all of us,
• 30:35
  Erin: How do you know it hasn't happened yet?
• 30:37
  BJ: I'd say that deep down he suspects it's happening.
• 30:39
  BJ: I personally will never be convinced that it was a coincidence that around the time that Craig was doing his heavy Bitcoin mining, there were all these Sonic booms in Raleigh that were on the news.
• 30:49
  BJ: I'm not hearing the boom.
• 30:50
  BJ: Kinda news stories about it.
• 30:51
  BJ: And I was like, that's interesting.
• 30:53
  Blake: think it's happening now because obviously all the digital things are coming into the real world.
• 30:58
  Blake: But the organics aren't going into the digital world.
• 31:02
  BJ: Perfect combination, because I think you hear people throwing around the term metaverse and I think even Zuckerberg misunderstood.
• 31:07
  BJ: What metaverse could really be or should really be because he was looking to make it, this blue and purple galaxy world.
• 31:14
  BJ: That's.
• 31:14
  BJ: Not real in the 3d, but maybe it's supposed to be the opposite.
• 31:17
  BJ: Maybe it's coming through of dark matter and the quantum, whatever you want to call it, coming into 3d and just giving us that extra sprinkle of.
• 31:24
  BJ: A little, stand up straighter and everything's going to be okay.
• 31:27
  BJ: A little bit of help.
• 31:28
  BJ: Maybe that's the metaverse, maybe it wasn't the other way.
• 31:30
  BJ: Maybe that's why a loss of many billion dollars recently.
• 31:33
  BJ: Around that concept.
• 31:34
  BJ: Maybe it wasn't to be excluded.
• 31:36
  Blake: I read this article about the metaverse and how it's not really the metaverse.
• 31:41
  Blake: can't remember what the name of the movie was, or it was a book or something.
• 31:44
  Blake: At the whole concept of the matter verse was constructed.
• 31:47
  Craig: ready.
• 31:48
  Craig: Player one.
• 31:49
  Blake: Kind of what it was a different.
• 31:50
  Blake: I can look it up and I can send it to you.
• 31:52
  Craig: I think ready player one is probably the best.
• 31:54
  Craig: Book
• 31:54
  BJ: For sure.
• 31:55
  Craig: Neal Stephenson and snow crash, coined the word metaverse.
• 31:58
  Craig: I think it was a great read.
• 32:00
  Craig: And really.
• 32:01
  Craig: Painted the picture of what the metaverse could be.
• 32:03
  Erin: You guys should really consider reading.
• 32:05
  Erin: The girl who's blind and then she wakes up and she can see the internet basically.
• 32:10
  Craig: the title.
• 32:13
  Erin: wake.
• 32:13
  Erin: It's three books in this series it's really cool.
• 32:16
  Erin: I've talked to BD about this so much.
• 32:18
  Erin: a story it's coming of age, it's the awakening of AI.
• 32:21
  Erin: And how this girl can see the internet.
• 32:24
  Erin: But she also is really smart and teaches it.
• 32:28
  Erin: to add and stuff and.
• 32:29
  Erin: The learning on it.
• 32:30
  Erin: Then it just learns more.
• 32:31
  BJ: Let's just talk facts it's a weird, because sometimes people don't accept certain concepts because they consider them to be fanciful.
• 32:38
  BJ: But they're looking at the concept through preconceived notions and judgements instead of just looking at facts.
• 32:43
  BJ: And when you just look at the facts If you look at it, a lot of ancient scientists and philosophers, they were quite fanciful.
• 32:49
  BJ: And because they looked at these facts and the facts, big these questions, because for an example, we were just talking about the internet and how it's connected to nature and science and along those lines, following that fact.
• 33:00
  BJ: Our bodies are 98% dark matter.
• 33:03
  BJ: They're 98% space.
• 33:04
  BJ: And there's religious teachings.
• 33:06
  BJ: Cause it's nice to study religion.
• 33:07
  BJ: Just through the lens of the history of humanity, because there's religious teachings.
• 33:12
  BJ: it said bringing forth what is within you.
• 33:14
  BJ: Now that they're approaching quantum trying to understand quantum computers and they can't understand why they can't achieve this certain level of coherence with quantum computers.
• 33:23
  BJ: I propose that there's a large number of possible humans that are computers that are just had been in a sleep state not been in a full awareness.
• 33:32
  BJ: that when a certain level of awareness is unlocked, I do think that there are walking quantum computers all over the earth right now.
• 33:39
  BJ: And they're just.
• 33:40
  BJ: Coming into awareness and that seems fanciful until you just studied the facts.
• 33:45
  BJ: You have 98% space within you.
• 33:48
  BJ: internet is literally cyberspace, and it's connected to science in nature.
• 33:52
  BJ: So tell me from a reverse engineering standpoint, how that could not be possible.
• 33:57
  BJ: There's no way you could tell me it's not possible, that look at how the brain works.
• 34:00
  BJ: Look at how the brain works that is unremarkable.
• 34:03
  BJ: The brain is a remarkable computer, but there's a disconnect between the mind, body and soul.
• 34:07
  BJ: And maybe when those things are connected and not in the right alignment, maybe these quantum computers awakened.
• 34:12
  Craig: Very interesting.
• 34:14
  BJ: It brings us back full circle of why it's very important to know a smart cyber guy, because if we're all quantum computers, we're going to need some help.
• 34:20
  BJ: My awareness has definitely changed over the last couple of years.
• 34:23
  BJ: There's no doubt about that.
• 34:25
  BJ: I have reached a different level of awareness for sure.
• 34:28
  BJ: And I can attest to the fact that when I do such things as yoga and stretching and certain things to work on my spine alignment and stuff, I can assure you that my body feels different than it used to.
• 34:39
  BJ: Let me give you an example.
• 34:40
  BJ: Yesterday.
• 34:41
  BJ: I was standing what appeared to be standing still.
• 34:44
  BJ: And my daughter walks by and she's mom, what are you doing?
• 34:46
  BJ: You're just standing there.
• 34:46
  BJ: I'm like, no, I'm actually working out.
• 34:48
  BJ: she was like, what are you talking about?
• 34:49
  BJ: You're just standing still.
• 34:50
  BJ: I'm like, yeah, but you have no idea what's going on inside my body right now.
• 34:53
  BJ: I can feel all the space in my body and I'm in touch with it.
• 34:56
  BJ: I'm aware of it.
• 34:57
  BJ: And so I'm aware of movements in my body that I used to overlook.
• 35:01
  BJ: I never was in touch with the space in my body before and now I'm so attuned with it that I can literally sitting here right now, talking into my microphone.
• 35:08
  BJ: I can feel 5 million things happening inside of me.
• 35:11
  BJ: And this was always the case, but I was not aware of it.
• 35:14
  BJ: as we know, the observer definitely affects the outcome, right?
• 35:17
  BJ: Of the scientific process.
• 35:18
  BJ: So now that I'm in an active awareness state, observing these things, I'm unfolding in myself, and I'm bringing forth what's within me.
• 35:25
  BJ: And I proposed that.
• 35:26
  BJ: I'm not the only one that can do this, This is the potential for humanity that we don't have to be shorter slumped in rope, we're being led to destruction.
• 35:33
  BJ: No, we can stand and we can shine our own white,
• 35:36
  Craig: yup.
• 35:36
  BJ: all right guys.
• 35:37
  BJ: We'll see you tomorrow.
• 35:38
  BJ: Have a good one.
• 35:39
  Craig: take care.