Latest / You've Been Heard / 343- Corporate Espionage: Security Stories from the Trenches by Maximo Bredfeldt

Transcript

343- Corporate Espionage: Security Stories from the Trenches by Maximo Bredfeldt · You've Been Heard

• 0:00
  Speaker A: Foreign.
• 0:05
  Speaker B: Michael Moore, hosting this podcast for dissecting popularity nerds. I'm here with Maximo Breadfeld, chief information officer at Longship Maximo. How you doing today?
• 0:14
  Speaker A: Hey, Michael. I'm doing fantastic, thank you. What about yourself?
• 0:17
  Speaker B: I'm doing great. We're recording this around the holidays, so everybody is going to be. Everybody that celebrates Christmas is going to be off for the next couple days, apparently.
• 0:32
  Speaker A: Yeah. It's too bad that you're not. That we don't have video because I would love for everybody to see. Michael is wearing a fantastic. The most Christmassy shirt I've seen ever. We got snowflakes, candy canes, snowman. You got everything going, man. I absolutely love it.
• 0:48
  Speaker B: Yeah. I walked out of the house today and my girlfriend just.
• 0:52
  Speaker A: She just shook her head because of all the elves that we're following.
• 0:56
  Speaker B: Yeah. All right. We're going to start things off with Random access Memories. It's our icebreaker segment. I ask a question and then you respond with the answer that comes to your head first. The first question you have is what is the most helpful or supportive IT related person or mentor that you've ever had?
• 1:21
  Speaker A: Oh, gosh, that is a tough one. I have very many fantastic mentors, thankfully. I'll have to give you the latest one. A great friend of mine and great leader and fantastic mentor. His name is Steven Jones. I worked with them at my last job at Dataprise for three years and he's the kind of guy that I vibe the best with. So a down to earth good person, a good leader. And I. I sucked so much out of that man, you know, I guess information wise that I don't know if he has any left. So he has been a tremendous help in my, my life, my career the last couple years.
• 2:09
  Speaker B: Shout out to him. Maximo. That's a. That's fantastic. If you get a good Maximo, you get a good mentor. Right? You definitely want to suck them out as much as possible and get all the information you can out of them. That's a. It's always a great thing to have. So I'm glad that you were able to kind of give him a shout out there. If. Here's the second question you got. If you could improve or enhance any IT related skill or ability, what would it be and why?
• 2:42
  Speaker A: For me or for everybody else? Because for everybody else is like, don't click and don't click on stupid stuff. That'd be great.
• 2:48
  Speaker B: Now let's. Let's go ahead and focus on you on this question.
• 2:51
  Speaker A: Okay? A helpful skill in it. I remember when I was interviewing. I'm going to skew your. To give you a more interesting answer, I'm going to skew your question a little bit because I remember when I was interviewing for this podcast.
• 3:05
  Speaker B: I'll allow it.
• 3:06
  Speaker A: Well, thank you. Because I said a lot of it. People, I feel, have struggled with confidence. So I would like a magic pill for getting the confidence that we need in those tough moments. I've had to learn that the tough way. So that'll be a nice skill to have is like to. To get the confidence to say no when you have to.
• 3:29
  Speaker B: It's a. It's a. It's a tough one. Yeah. You know, confidence is interesting, too, because you have, you know, as you. As you kind of progress through it. Right. You start off and you're very confident, then you learn all the things that you don't know, and then you become less confident. Right?
• 3:46
  Speaker A: Well, yeah, yeah, I think you're right. But I also think it depends very heavily on the path that you take or, you know, where your path takes you, because, like, in my case, it's been a very much up and down when it comes to that. Right. You feel great, and then you meet this one person, or there's one situation that humbles you right down to planet Earth. Right. And then you start, dust yourself off, you get back up again, and you try harder. And then, yeah, it's been a cycle of feeling great and feeling, oh, my God, I don't know anything about anything thing.
• 4:21
  Speaker B: You don't have to tell me that. I talk to a lot of IT folks doing this podcast, and a lot of them know a lot more than I do. So, you know, I always think that if we go back to the first question, you meet somebody like that and then you have that ability to learn from them. Right, Right. And so that's a. That's always a. A fun thing. I think the confidence is not really in what you know. Right. But it's in your capacity to learn.
• 4:49
  Speaker A: Yeah, yeah. Right. Yeah, I couldn't agree more with that. Yeah.
• 4:53
  Speaker B: So the confidence always has to be in that. That capacity to learn and knowing that even though you don't know something. Right. You can learn it.
• 5:02
  Speaker A: Yeah, no, absolutely. And I think that appeared with, you know, trying not to be terrified of screwing up. And if you're smart, you. You can learn a lesson for. For your wins and your losses. Yeah. So add those. If you start adding those up like a piggy bank, and you put them, you invest them, well, that's going to Fuel your confidence in the future too.
• 5:27
  Speaker B: Yeah. To anyone listening, you will screw up. It will happen.
• 5:30
  Speaker A: Yeah, you will screw up.
• 5:31
  Speaker B: You will screw up multiple times. And that's okay. If you learn from it and, and make sure you can kind of change your. Change yourself so you don't in that situation. Right. So, yeah, no, I. Great. Great answer, Maximo. Here's your last question of this lightning round here. If you could choose any IT related theme or genre for some party or event, what would it be and why?
• 5:59
  Speaker A: Ooh, for an event, is it meant to be educational or entertaining?
• 6:06
  Speaker B: You can just decide, you know, whatever you want. Uh, you know, if it wants to be a party or just an event or.
• 6:13
  Speaker A: Well, the. I, I think you, you can never get people bored with cyber security. Uh, there is always, if you have had the, the chance or the, the curse of being involved in, in cyber. I think you can entertain any table or terrify them or a little bit of both. Um, so, yeah, you're just gonna, you'll.
• 6:31
  Speaker B: Throw a cybersecurity themed birthday party and put consoles everywhere that people under, like the cupcakes just controls. Right.
• 6:39
  Speaker A: Right. Yeah. Then. Then watch that. Nobody shows up. Or the only people that show up are the people that have no idea what's going on.
• 6:46
  Speaker B: Probably. Probably because you didn't publish the address because you're trying to be secure.
• 6:52
  Speaker A: There you go. Yeah, that's a good point. Fantastic. Yeah.
• 6:55
  Speaker B: All right now. Yeah, let's. Let's get into it. You know, we were talking earlier and, and you had kind of mentioned some of the stuff, you know, that you're great at. And I, and I was laughing at some of the answers, but it's great. But it's good. We're gonna dive into it and it's gonna be great because one of the things you mentioned was breaking stuff. You're really good at breaking stuff, right?
• 7:21
  Speaker A: Yeah. Yeah.
• 7:21
  Speaker B: And I think, I actually love that answer because I think that every it person needs to be really good at breaking stuff. Right. And you kind of need to break stuff so you know how to put it together, you know how to fix it when it, when it ultimately does break. For real. Tell me a little bit about this great quality of years of breaking stuff.
• 7:45
  Speaker A: Well, so it started when I was very little. I would take apart every toy that my mom would get. And to put it into perspective, I'm 45. So when I was little, we're talking early 80s when I'm right there.
• 8:05
  Speaker B: So I'm right there.
• 8:06
  Speaker A: Yeah. But I'm trying to put this into perspective. Because the toys nowadays, you know, a kid will get an iPhone, a tablet, and stuff like that. Toys back in my days were more simple. You know, a little RC car was like the most technology you would get. And I would take those things apart, like, all the freaking time, to the point that my mom hated giving me anything like a water gun, anything that had a tiny motor or lights, I would take them apart, and I hardly ever put them back together the right way. But, yeah, that's what got me started. And why is it, by the way, when you put.
• 8:42
  Speaker B: Why is it that when you take something apart, you always end up when you put it back together with, like, two screws left over? Like, what is. Well, it works. Two screws left over. What is that?
• 8:54
  Speaker A: Look, my best answer that I can give you is that the engineer that put it together could have saved a couple screws, man. That's it. That's the best answer that I got. Not efficient engineering going on right there. Because for the most part, I could put them apart, I put them back together, and they would work. But, yeah, I had always a handful of pieces left over that obviously not necessary. So there you go. Inefficient engineering as my answer. But to go back to your question. So that's why I think that's generally one of the things that got me interested in computers. The computer, like the personal computer, was the first thing that I assembled by parts that worked and that fascinated me. And ever since I. Yeah, I think I had my. I know. I thought I had my first computer when I was six. And ever since then, I was the one that helped my friends put computers together or fix them. And at some point, I realized that it was a marketable skill. So here I am, pretty much.
• 10:03
  Speaker C: Hey, guys, this is Phil Howard, founder of Dissecting popular IT nerds. I just wanted to take a few minutes to address something. It has become fairly apparent. I'm sure all of you will agree, over the years, that slow vendor response, vendor response times, vendors in general, the average, is mediocre. Support is mediocre. Mediocrity is the name of the game. Not only is this a risk to your network security, because I've seen vendors on numerous occasions share sensitive information, but there's also a direct correlation to your budget and your company's bottom line, not to mention the sales reps that are trying to sell you and your CEO and your CFO on a daily basis. That causes a whole nother realm of problems that we don't have time to address. Our back Office program at dissecting popular IT nerds. We've put together specifically for IT leadership and it's on a mission to eliminate this mediocrity. And the best part is that we're doing this in a way that will not cost your IT department a dime. So if you'd like us to help you out, get better pricing, better support, and jump on pressing issues in minutes, not days, then contact us now so we can get on a call with you and conduct a value discovery session where we find out what you have, why you have it, and where you want to go, and how we can improve your life, your IT department, and your company's bottom line. What you're going to end up with is, number one, just faster support from partners who care about your organization's uptime and bottom line. And because you're going to be able to access our 1.2 billion in combined buying power, you'll be able to benefit significantly from historical data. And on top of that, you'll also benefit from the skills of hundreds of on demand experts that we have working behind the scenes that are all attached to our back office support program. So if you'd like, again, none of this is ever going to cost you a dime. At the very least, it's going to open your eyes to what's possible. Let our back office team provide you the high touch solutions and support that your IT team deserves so that you can stop calling 1-800-Gold-POUND SAN for support. Now, if you're wondering what does this apply to, this applies to your ISPs, your telecom providers, all your application providers, whether you're a Microsoft shop or a Google shop, what you might be paying for aws, even Azure, Colocation Space, any of those vendors that you're paying a monthly bill to, we can help you with.
• 12:46
  Speaker A: Hey, it's Greg the Frenchman, secretly managing the podcast behind the curtain. To request your one on one call, contact us@internetpopularit.net and remember, it will never cost you a dime.
• 12:59
  Speaker B: I love it. I love it. Breaking stuff, but you can put it back together because you have a magic touch.
• 13:08
  Speaker A: I like to think that I do. And the people that know me closely, they get a little bit freaked out by that. And it's. I guess some, some people have a talent for certain things. I have an intuition for nowadays, fixing stuff or figuring stuff out. It's hard to explain. I'm not going to sit here and tell you, oh, I'm super smart and I know everything's like, no, I'm really good at Googling stuff. That's true. But I guess the more that you get into it, you, you get a little bit of like the whisper, right? It's like every now and then I'm facing an issue where you have tried everything and nothing works. And you have this one Hail Mary thought that you're like, there's no way that's going to work. You know, and you hit enter and boom, it's there. It comes back up or whatever it is that you were trying to fix. So that is an uncanny thing that I wish I could figure out because, uh, I think I would be a very, very rich man if I could multiply that.
• 14:08
  Speaker B: Tell, tell us an example. Maybe, maybe you have a, a story or two of, of what, where you applied this, this magic touch and whispered to a computer computer to turn it back on. Like, tell me a little bit about, about this because I, you know, because here's why and I'll, and I'll explain a little bit. I have, I've seen in my career tons of people with this just, you know, inn go, oh, this is the problem, right? And you know, the rest of us have to just troubleshoot through it and, and, and, and, or try and figure out, you know, what's happening. But you know, I have seen people, you know, it be like six in the morning, you've been going all night, and it's like people are going to start coming in like an hour and all a sudden they're like, oh, wait, how about we do this? And it's just like, what, what, how, how did you figure that out?
• 15:02
  Speaker A: Right? Well, actually talking. Hearing you talk. I remember a very beautiful story. Beautiful for me, because I got the winning guess on that one. It wasn't a big deal, but it was a very interesting. So I was working as a tech, an IT tech in a company in Germany, and we did mostly commercial stuff. But every now and then we had either like old clients because that company had started super small with, you know, private clients. So we had a couple of those still, but we were focusing mostly on other businesses. And we had this one old guy, his name was Manfred, and he was like, I don't know, he was way too old to have a computer if you ask me. But he had been complaining for months that he had bought a computer from us and it wouldn't work. It was a laptop. And he would always complain that he couldn't do the. He couldn't work. That, that was as best as the best description that you could get. And all our, I think that by that time, I was doing more, like, heavier engineering stuff, you know, infrastructure and servers and that. And I just got wind of this ticket because it became the joke. We literally every engineer had been there, and every single one of them came back saying, hey, every time that I go there, everything works perfectly fine. We don't know what this guy's talking. And it got really bad to the point. My company used to be in a little town, and this old guy, very German, put a complaint in the newspaper. Okay. That we were not good at what we did. We're not able to help him. Months after. So my boss asked me, have you looked at it? And I said, no. I said, why don't you go take a look? And I don't know what it was, man. I don't know what it was. Because I got there and I look at this laptop, and literally everything worked. Absolutely everything. And I said, can you show me what doesn't work? And he got pretty aggravated. There was still this large gap in age. So he was trying very hard to explain the situation to me, and I told him, you know what? I want to believe you, but why don't we do this? Why don't you just pretend that I'm not here? Show me what you do. When you walk into this. All right, and someone's standing in the corner, and he's very annoyed with me, and. And he sits. He grabs the computer and sits down on. On his. On his couch. Not on his desk, on his couch. And, you know, pops it open and say. Say it doesn't work. The Internet doesn't work. And I go look, and lo and behold, it wasn't working. And I was like, whoa, that. That's. That's wild. You know, we're talking about. It was two minutes it was working on the desk, and now it wasn't working when he was sitting there. And I thought. And we're talking. This was six feet away from. From his desk. So not a far. Not a. Not a wall in between that. You could have said something. All the wifi, you know, black hole of anything. No. So I'm like, okay, that's wild. I grab his laptop, I sit down at the desk with the laptop, and everything's working again. I'm like, no way. I grab it, and I sit on the couch myself with the laptop in my lap, and the Internet goes off. You know, it's just dark skin. And I'm like, I guess guy. I guess this guy has a cursed couch. And I look behind the couch, and it so happens that when this guy would sit down, the power supply of the router was right behind his couch. So every time that he would sit back and lean back on his couch, that would push just enough for his router to blip out, you know, and reset. And this was like months and months of every single engineer that I cannot remember how many laptops we gave him and how many routers we gave him. And it was like I figured out just by that. And I don't. Don't ask me what made me ask him that, but I figured it must be something that this guy does differently. Right? So, yeah, that's one of the nice stories that I remember when you told.
• 19:08
  Speaker B: This guy that, hey, every time you sit down, your couch presses against the router and turns it off so your Internet doesn't work. What did. What he say?
• 19:18
  Speaker A: The scout in German. But, yeah, that's pretty much what he said. Yeah.
• 19:27
  Speaker B: That'S. Oh, my gosh, that's great. Well, at least it wasn't the IT people at that point, right? Hey, listen, your coarse, cursed couch is to blame. All right, yeah, no, that's. I mean, that's fantastic. But you know what's great about that is you did something in which. Which I think was a great thing. You said, hey, I'm just going to observe you. I'm going to sit back in this corner, pretend I'm not here. I just want to see exactly what you do. And that's hard to replicate. In fact, it's hard to replicate today in the days of kind of going around, not going around and going to people's places anymore, but actually just being virtual, right?
• 20:07
  Speaker A: Yeah, yeah, absolutely. Yeah. And not just that. Honestly, it's paying attention not to have tunnel vision. You know, I think in it, we get too used to everything being bits and bytes on and off kind of thing, that we sometimes forget to think either about the person or about the situation, or simply just taking perception into consideration. I think that a lot of us could do a better job at listening, you know, just paying attention. Many, many times I went into a room, or into a server room for that matter, fully confident that I knew exactly what was going on. Right. Just to find myself the second all nighter in a row, still having no freaking clue what I was doing. There you go again. You know, arrogance, cockiness and being humble.
• 21:00
  Speaker B: You know, it's. No, no, it makes sense. And I think I've. I think I've told this story probably on this podcast before, and forgive me if I have, but, you know, I once was Talking back and forth. And there was a server problem going on, and I wanted to have the person reboot the server. And they're like. And I said, I need you to go over and reboot the server. Right? And because we kept having problems, so it was really strange. And then they said, well, I can't do that right at the moment. I said, why not? And the answer was, the bathroom's in use. And I said, hold on, hold on.
• 21:38
  Speaker A: All right.
• 21:39
  Speaker B: I go, how do those two correlate? Right? And then they told me that, well, that's where the server is. The server is in the bathroom. I quickly took a note as to make sure if that server ever got back to me, that I have disinfectant, right? But I was like, okay, well, we should probably not put the server in the bathroom. That's probably not the best place for it, right? And so. But, yeah, I mean, it, like, having that situational awareness, being able to see not just the bits and bytes like you mentioned, right? But able to see the situation that's going on really is a good part of troubleshooting. That. That is extremely important. And I think you're right. I think that's a. It's hard to teach sometimes.
• 22:27
  Speaker A: Yeah, it's hard to teach. And honestly, I started learning that in German. We have a saying. It's like, I've seen pigs fly or I've seen horses fly. The more weird stuff that you come across, the more sober you get and the more. Or at least me, you know, that's what taught me to look at everything first. Gave me a holistic view of Attic. Honestly, talking about this, I remember another story that I really, really like to share, because this one happened here in the States to a very, very. Not a similar situation, but the same learning tidbit at the end, right? Which is to look at everything. And this was. I was doing an assessment for a new client. I was looking to work for a small credit union in my hometown. And while I was running an assessment, I was working for an msp. I was doing sales. And this was my discovery phase. You know, I wanted to know what they had to be able to give them an accurate quote. And so one of the things that I. That I asked them to do, I said I wanted to interview people and I wanted to talk to everybody. I wanted to. And I said, I want to talk to everybody. I want to talk to the general manager. I want to talk to the cfo. That's the. Oh, and I want to talk to the tellers, too. And One of the people in the room was a little bit taken back by that was like, you know, why do you want to talk to the tellers? You need to talk to us, you know, we have all the information. And I said, no, yeah, I understand, you know, from a technical perspective, but I'm going to guess you have, those are the guys that do all the work, right? They have client facing interactions and they operate in a much different way than you do. So I insisted and I got my way and I talked to them. And I'm going to skip to, to the juicy part. So I come back with my assessment, I talk to everybody. And so I couldn't come back to the executive board and I said, hey, you know, like before I prep my quote for you, I do have to ask you about this thing that I learned that slow Saturdays and they're like, what are you talking? I said, well, you know, like I was expecting you to tell me because everybody that I ask, you know, in the three locations, they all mentioned that when I. One of the questions that I asked, by the way, was like, is there anything on your day to day life that you wish you wouldn't have to do or anything that annoys you or any process that you have to do that is involving computers that you don't like? And the answer was universal. It said they hated slow Saturdays. And when I gather a little bit of info. So what was happening was that every Saturday from 8am till about 11am People couldn't work. Certain aspects of the bank were unavailable to the users. I don't remember exactly what it was, but a specific type of transactions that they couldn't do. So they kept having to send people home. And you should have seen the look on people's faces because they were like, we have no idea what you're talking about, man. What is this all about? So to the point that they got so irritated with me that the, the entire board was like eight or nine people in this room. We all went downstairs to talk to the teller to, to get like firsthand answer from the tellers what this was. And they, they said the exact same thing. They repeated the same thing that they had told me that every day, I mean every Saturday from 8 till you know, a little Passover 10, close to 11, nobody could do this. They freaked out, you know, like, why haven't you reported this? Like, well, because it's been going on for years, you know, and I'm never going to forget the face of this, of the cfo, because I knew this guy was Doing the math, you know, like, okay, this has been going on for, I don't know, three, four, five years and in three locations and all these tellers that they couldn't work. And it ended up being the backups, man, the backups were bleeding into the next day and nobody had a clue. And it was so bad that, yeah, a new hire would come in, they would get trained, and the first Saturday that they couldn't work, they would be like, hey, what's going on? Oh, yeah, don't worry about it. It's a little Saturday. So everybody, everybody in this bank, they were just used to not being able to do that, you know, and all it took was ask that question. So. Right. That was one of those, like, wow moments for me, too. And in fact, at my new job that I just started a couple months ago, one of the things that I insisted on, and interestingly enough, they wanted me to do that too, is to do the basic training. We do freight brokerage at Longship. So I had the luxury that I was able to work the board like a broker moving freight for three months. Ish. So I get the firsthand experience, like, hey, you know, 90% of our guys, this is what they do. I want to know what their challenges are, you know, how they operate, how they use the computers, how they use technology, how everything that they do affect them. Because guess what? Now I know exactly how it's like for them, and I can relate to what they go through day in and day out. And now I have a much better idea to better support them.
• 27:52
  Speaker B: I think it's a great. It's a great way to approach it. And knowing and understanding the business process is such a critical component, not just in troubleshooting. Right. But also in cybersecurity. Yeah, that's a big. You mentioned cybersecurity earlier and maybe we'll chat about this, because cybersecurity is one of those things where you can have all the tools. Right. But if you don't know how those tools are applied to the business, you're going to run into trouble. You're not going to be able to secure the right data. You're not going to be able to secure these things. Let's talk about. You have a love of cybersecurity and stuff like that and can talk about it and do well with it. Let's talk about cybersecurity for, for a minute and let's, let's jump into that. What do you. There's so much right now with cyber security that's going on It's a ton of stuff, right? I mean, I mean, I feel like it always is, but it's just, it just keeps getting like, bigger and bigger every year. And like, we keep upping the ante, right? On stuff. When you think about cyber security and, and applying it to your environment, what are the biggest things you do first?
• 29:16
  Speaker A: Well, we just talked about it. The first thing that I do is understand, ask questions, understand my environment, understand the business. I understand our exposure. And look at what I have, not just from, hey, this is my situation, but what are the tools that I have right now in place and are they deployed to their maximum potential? Before I ask, hey, is this the right tool? It's like, you know, if it's there, let's look at it. And is it even deployed? Like, I, I, and I say that because that was perfectly way what, what you said earlier. I've come to, I've seen so many companies that have so many tools and many of them not even deployed or poorly employed or. Yeah, not even, not even sometimes not even the right tool. So the first thing that I do is always listen. It's crazy hard to me because I'm a super impatient guy. I get negative anxiety when there's a problem, as in my anxiety is to resolve it. I want to jump right into it. So one of my mentors, Bill, I love him to that, he's been teaching me patience. So this entire year I've been dedicated dedicating it to patience. And like my current job, of course, there's stuff when I see something that's, oh, my God, you know, we need to address this, we'll do that. But I've been trying really, really hard to be patient and to focus exactly on what I'm trying to tell you is to listen, to learn to ask the questions. Yeah, that's the first thing that I do.
• 30:59
  Speaker B: Yeah, I think that's huge. Understanding kind of the business itself, which we alluded to earlier, and the processes and where the data stored and how people access it, that's so fundamental and I think based on what you said about all these tools, but they're not deployed correctly or they're not even deployed at all. I feel like a lot of times that happens because people don't understand the beginnings of where to go. Yeah, they just want a tool to turn on and be like, yeah, it's protecting me. Right. And. But it's protecting what? Like, you know, you know.
• 31:41
  Speaker A: Yeah, no, absolutely. And to, to give a little bit of, of context to, to the people listening. So I think I've been very lucky because I've worked. This is the first job that I have where I've been working with an end customer my entire career. I've always been with MSPS or MSSPs and this was by choice. I, I guess you could argue that it's the harder route to take. You know, many people would agree with me and I'm sure some would disagree with me, but that gave me a lot of insight into a whole lot of companies. Yeah, right. And a whole lot of people. I'm talking into the thousands. I've been doing this for over 25 years. So yeah, I've been in touch with thousands of people and thousands of companies and you see that so much, let's be honest. As in the more complex your environment, the more complex your team you're going to run. Sometimes in a lot of that, you know, people, the typical situation, there is a problem. There is a guy that's implementing this one thing and he, something happens, he leaves and that gets left there and nobody touches it. And then the next guy comes and he tries to do that and tries to pick it up, oh, this doesn't work. I'm going to try to do this other thing. Now you have two things that are kind of half assed working, right? And the company. You know, companies tend to grow and those small problems tend to escalate and to scale just as much as some of them dip down and come back to bite you in the ass, you know, years down the road. So yeah, I've run into a lot of two things is one, too many tools and B, people who really don't, don't understand what they're doing and they take some tremendous risks because in my opinion they don't ask the right questions.
• 33:35
  Speaker B: Now it's a great, it's a great, a great point. You know, on top of that too, you know, you have things that are not fully deployed, you have things that are deployed incorrectly and then you have things that are deployed partially like, and let me give you an instance. A lot of times I'll see that like something will get deployed but since it's a security thing, executives at the company will go, you know, you don't need to put that on mine, just make sure that everyone else has that protection. And oddly enough, right, if I were to secure anybody, right, it would be the executives, right?
• 34:16
  Speaker A: Oh, wow. Yeah, you touch a sore nerve because yeah, I've been, I've been in meetings. I remember this, this wasn't too long ago, which is Terrifying. Yeah. Just, just an example to what you just said. This was a company they literally like, I'm not making this up. They had dodged a bullet with like compromised accounts, executive accounts where this was a new client that we're working with and we were still onboarding them and we had this incident. It was, it wasn't a big deal. A couple accounts compromised. We caught it early. And the first thing that I do is throw training right for, for them. After, after, of course, after the, everything has dust had settled, I schedule these guys for training. Not a single one of the executives shows up. And this was three guys that literally clicked on the wrong stuff because they weren't paying attention, you know, and top execs of the company. And I, I, I'm not making this up. They didn't want to use MFA because it was inconvenient for their executive assistants because they wanted to share their passwords and they didn't want to go to training. So at that point, you know, like the, the question is like, how do you, how do you deal with that? You know, how, how do you, and I'm asking this out loud for everybody to, to think about it. How do you deal with that? And my answer to that was, write it down. Make people accountable now. Have your risk registered. Even if it's like a crappy looking one. The what do you exec? Stolen lab. Okay. Yeah, I'm gonna, I mean, thank you. He just, he just held up a little paper to remind me that I have a good story to tell.
• 35:56
  Speaker B: You have a good story? You need.
• 35:58
  Speaker A: I have a good story. I'm going to tell that too after this.
• 36:00
  Speaker B: I don't want to give it away completely to the audience.
• 36:02
  Speaker A: No, no, no. Yeah. But let me. So to wrap this one up, one of the tricks that I've learned to make executives accountable is writing in a risk register and tell them, hey, Today, you know, December 23rd at 8:00pm I made you aware that, you know, you were part of an incident that I offered you training. You refused it. And here, you know, please sign here. You refuse this and you would be surprised how quickly people show up to your training when you start doing that.
• 36:30
  Speaker B: Oh, yeah.
• 36:31
  Speaker A: Or when you tell one of the executives that, oh fine, I'll go tell your boss that you thought this wasn't a big deal when you clicked on it. So talking about executives being careless. Yeah. Thank you for the leeway. This is another story that I wanted to share. This is hopefully far enough away and long ago enough that nobody will come.
• 36:54
  Speaker B: Back to chase the details a little bit. Whenever.
• 36:57
  Speaker A: Yeah, no, I'll change the details. Yeah, no, but, but thinking about it, this, because this was still in my, in my Germany times when cybersecurity was in its infancy. Let's, let's be real about that. Okay? So I'm Talking about about 15 ish 18 years ago, where if you had a firewall and you had antivirus, you know, you, your cybersecurity was, was great. Was awesome.
• 37:20
  Speaker B: Those were the days, right?
• 37:22
  Speaker A: Oh yeah, those were the days. It was awesome. So. And this is a story for everybody listening, particularly if you own a smaller or medium business and if you think that this Hollywood level stuff doesn't happen to small companies, I hope this, this changes your mind or at least makes you think about it. So we're talking about a company they did think of, KitchenAid mixers, but big time. Okay? So big time Chemical mixers. And this was a small, ish company, about 200 employees near a small town in northwestern Germany. And it was a pretty niche business. There was only a handful of companies that made the kind of stuff that they, the machines that they made. So they enjoyed a pretty good, not just reputation, but a pretty good customer base. And they have been in business for decades. And this one time, every two years, these guys would organize an expo. They would take part of an expo somewhere in China, I think it was Shanghai. In this one time. The CEO, I was a technician on the account. My best buddy was the account lead. I was the lead engineer. And the CEO gives us a call from China and sends us pictures. And he's like, wtf? What is going on? And these pictures. And I'm not making this up, I wish I could show this to you. But he sends us pictures of this big hallway and on one side you see all their machines all blue. I mean, we're talking a couple thousand square foot of machines built together right in front of them. Like literally across the hall, the exact same machine to the bolt, identical to their machine, just yellow. Okay? Painted yellow. And I wish we had more time to give you all the nitty gritty details of this, because it's fascinating. We put this stuff together working with the criminal police side, the German FBI. Not that we did much, we just provided data for them. But what had happened was that one of the senior executives had gone on a business trip to Berlin and he met a lady in the hotel lobby. Things must have happened because the next morning his laptop and his cell phone were gone. And this guy, instead of doing the right thing, hey, my stuff Got stolen. Instead, he just called us and said, hey, I wanted an upgrade. So I went to the. I bought a new computer and a new phone, and you guys set it up for me. Not even bothered changing the password. Nothing. That was it. So the. What I thought was. Was insane was that according. At least according from the story that was put together after the investigation, that it only took about 11 months for these guys to steal the plants and build up an entire company and build all these machines from scratch based on the plans that they had stolen. So, yeah, very quickly, that company, they made it. But they had some really rough times ahead because guess what? These machines, they were a third of the price, and they were identical. It's not like, oh, they were a little bit. Yeah, I mean, yeah, quality wise, you could argue. But if you can save yourself. These machines are millions of dollars each, Right? And if you can buy three for the price of one, why do you care? Why so much about quality? Right?
• 40:54
  Speaker B: That's like a corporate espionage spy story that you. You could make a movie out of that.
• 41:03
  Speaker A: You can make a movie out of that. And that was the first time that I got that I got in touch like that. That I was so close to something so wild, you know, because that was like, oh, my God. It was like I had only. Yeah. Like I said, I had seen that kind of stuff in movies and we had never. Yeah, not so close to me. Yeah. And in reality, that. That's like there was nothing that we could have done then. Right. But we weren't doing anything when it came to cybersecurity. We didn't. There was no training, there was no policies, there was no procedures. There was like, no nothing. So that was the first time that I said, oh, man, I guess we don't do. We don't know cybersecurity after all. Right.
• 41:45
  Speaker B: See, I'm glad I hold. Held up the sticky note from that one so that you tell that story.
• 41:50
  Speaker A: Yeah. Well, thank you for the sticky note. Yeah.
• 41:51
  Speaker B: You had a good thought going. I was trying to keep it going, but no, I mean, that's. That's just. That's a. It's amazing. Do you. While we're on this topic, a cyber security topic, do you have any other good stories for us? Because you're an excellent storyteller.
• 42:10
  Speaker A: Well, yeah, if that made me remember. I remember another one that was also, like, really, really cool. Again, not a huge company. Okay. This was. This guy. It was so funny because he just texted me the other day after I had talked to your guy about this Podcast. And I asked him like, hey, can I tell your story? And I said, hey, go for it, you know, so this guy's name is Harry Burke, and he had a partner in the same town that this was in Bielefeld. And this guy did industrial light setups. So not a big company. It was just two partners, maybe 15 people working there, small business, like maybe 10, $15 million euro revenue. So not a huge company, right? My client, they get in a fight, the two partners separate, right? And they separate amicable. They split the clients. They will sell sharing offices, right? As in they had the lease going, so they were still sharing office space. And this was a, like I said, an amicable thing. They decided that they were going to start splitting the companies. You know, they were going to form two companies, they were going to split everything through the middle. And I helped my client, like I said, great relationship between them, you know, it just. They had some differences and they, they wanted to go there each of their way, but they were not, you know, like fu or whatever.
• 43:39
  Speaker B: It was just nice and nice and.
• 43:41
  Speaker A: Yeah, nice and easy. So it took up a couple months and then they, they finally ended the lease. So they each. My, my client, the guy that stuck with me, my, my. I'm going to call him friend so you can differentiate them. My buddy and I, I helped him set up new company in a different part of town. And months later, he calls me and he said, hey, I need to talk to you. Yeah, what's up? And he said, no, come over. I want to speak to you in person, because I don't trust anything and anybody. And so we went to a different place and he sits down and said, I think they're spying on me, and I think it's my partner and I don't know how or why. And I checked everything. I checked, man, absolutely everything. At first, at first they were still using the same exchange server. But this came, you know, like almost a year after they had decided to split up. And me, my buddy and another engineer, we looked at absolutely everything. We couldn't find a darn thing that was wrong. And what was happening was very simple. He would send out a quote, and within a day or so there would be another quote or two quotes for the exact same stuff that would reach that client, just cheaper and not from his old partner. And so again, I'm going to fast forward. Big investigation, big lawsuit, a bunch of stuff. The German FBI involved again in the same thing, what had happened? And they went back on the videos and a guy dressed as DHL you could see he walked into the office. You saw him from behind with a package. He delivers the package. You see the front desk person getting up and going to do something. And at that moment, you see the guy reaching over and plugging something into the side of her laptop very clearly, like a little white thing, a thumb drive, right? Took eight seconds, you know, like, put it in, plug it in. He was looking around and took it out. That was a tiny little bit of payload. That was very simple. Every email that was going out was sending a copy to a competition which his partner, his old partner had created a sister company to, to be not affiliated with that. And that's how he was stealing this business.
• 46:08
  Speaker B: This is why you. This is why you disable autoplay on usb.
• 46:13
  Speaker A: So it's. That is so crazy because that's one of the things that nobody wants to do because they think it's like, oh, this doesn't happen. You know, this doesn't happen. And let me, let me tell you to, to, to wrap it up, because this is beautiful. It just happened the other day at my work, okay? Someone comes over and hands me a tiny little thumb drive. And he said, hey, I found this. And do you know what it is? And I look at it, it's like, this looks wild. It ended up being harmless. It ended up being a jewel charger. It just looked funky, right? And I asked him, did you plug it in? And he's like, no, why would I do that? I say, well, because most people are curious. He's like, no, I don't care about that. And then we started talking. What could happen. I told him the same story, and he's like, oh, that's wild. And this reminds me when I was in school in Germany, My thesis was that I grabbed a thousand thumb drives. They were the cheapest ones that I could get. Me and my buddy, we bought a thousand thumb drives and we drew a girl's name on the drive and all that payload. We put a payload in it, and all it did was call home. And so we. Each one has a. Had a serial number and it would just tell us, hey, you know, drive number 772 just got plugged in. We toss them everywhere around town, you know, in the trams and the metro and cabs and the university bathrooms, clubs, whatever. How many do you think made it home from a thousand?
• 47:45
  Speaker B: Oh, my gosh. Let's. Let's just say, because I'm. I feel like when it comes to this stuff, that at least a quarter.
• 47:52
  Speaker A: Of them made it more than three quarters more than three quarters. About 80% about. It was like 76 point something like the more than three quarters. Yep. And I guarantee you that most of the ones that didn't make it home just got lost. You know, someone kicked them into. Yeah. So, yeah, that is such an easy threat to get rid of by just blocking peripherals and do it. It's a pain in the ass. Do it. It's like, yeah, the combination between being curious and how easy it is to put payload on a thumb drive. I mean, anybody can do it. So that's remarkable.
• 48:34
  Speaker B: Well, I mean, this just shows you why cybersecurity is so crucial. And I mean, you mentioned how simple it was years ago. Right. But we're edging up on our, on our last segment, which is the IT crystal ball. This is the future of it. And so I wanna, I wanna do the opposite. I, it was so simple years ago. I, you know, cyber security. And we thought it was complicated, but it was like, oh, no. So simple. And now in the present has gotten extremely complicated and, And I want to know what is cybersecurity, Right. Going to be like five years from now?
• 49:15
  Speaker A: That's, that's an awesome question. And are you asking me what, what my, my vision of this.
• 49:21
  Speaker B: Oh, yeah, this is you. This is, it's all you. This is your vision of what cybersecurity is going to be five years from now. You can, later on five years, you can listen to this podcast and then you can go, was I right?
• 49:34
  Speaker A: Yeah, well, this is, this is tricky because I think I remember some of the instructions that you gave me was don't talk about religion, don't talk about politics. And I think I'm going to say, oh, Lord.
• 49:45
  Speaker B: Well, unless it's, you know. Yeah, okay, that's.
• 49:49
  Speaker A: No, but, but let me try to give you. I think, I think that you cannot talk about cybersecurity without sadly having to drag AI into the equation. Right. And it terrifies me, and it terrifies me at a, at a whole bunch of different level, starting with the fact that AI terrifies me. I studied that. I went to school for applied robotics. Let me tell you, what I learned in school has nothing to do what the stuff that we're doing today. Okay. I understand nothing from like my language models. My, my machine learning was, you know, just completely. It was a Steam machine versus a Tesla now. Right. But truth, I think truth is going to be the key word moving forward. And I don't know what that's going to look like because you're already seeing what AI can do as a force multiplier. And this is what I think that a lot of people that are not in our industry, that the part that they don't understand is that or they don't think about is that the guys that we are fighting in cybersecurity are for the most part way better at it than we are, you know, and they not. They, they not only get a much bigger budget, but they're not bound by policies, they're not bound by laws or by any kind of restrictions whatsoever. They don't give a shit.
• 51:17
  Speaker B: It's that classic good versus evil, right? The, you know, good always has to kind of play within these boundaries and evil gets to do anything they want, right?
• 51:26
  Speaker A: Right, absolutely. But it's such an unequal fight because you have all these incredibly smart guys that have every tool at their disposal. They have free range to do anything they want at any point in time. And your first line of defense is what is your analysts that you're paying 50k to. That's your first line of defense. So now think about what this mean, right? If AI is a force multiplier, which it is, I think in my point of view, this is the next steam engine, right? It's like, what do we do is we amplify energy. How? By making cool stuff. AI is the new cool stuff around the block that we're adopting at a terrifying rate. And I made a post that I felt like it didn't get a lot of love, but I think it was an interesting thought. Right? If you think about it this way, we are putting AI into everything right now, okay? We have toasters with AI. We have like literally every. You have no idea how many. I get so many emails, so many calls of people trying to sell me all this stuff because it has AI on it. Guess what we're doing? If the AI overlords are going to take over, we're paving the road for them. We're putting this shit everywhere without understanding what it does.
• 52:49
  Speaker B: Oh, yeah.
• 52:50
  Speaker A: Or how it works, you know, so all AI needs to do at some point is flip the switch. Guess what? All our cars are going to be in it, all our computers, everything. Every service that we have, we're cramming AI into it, okay? So it's going to have an easy time taking over. But going back to your question, what do I think cybersecurity is going to be like? I think trust and truth are going to be very, very different concepts in the future. Because I think very, very soon. I mean, we already live in a world that you don't know what the heck it's true or not anymore. And even I'm the kind of guy that likes to know facts, and it's getting increasingly difficult to get there. So when you apply.
• 53:32
  Speaker B: When you fact check it with AI.
• 53:35
  Speaker A: Even when you fact check it with AI, it's a difficult thing to do. Like going into rabbit holes to try to, you know, figure out do masks help or not. You know, it's like the. Whatever you. You go and research, you know, and research it means just that it's researching someone that was already researched.
• 53:55
  Speaker B: I mean, what are you going to do, Go and research articles that were generated by AI that were generated by AI and don't exist?
• 54:04
  Speaker A: Precisely.
• 54:05
  Speaker B: It's already happened. That's there.
• 54:06
  Speaker A: Yeah, it's happening right now. It's like the AI is wrong all the time. And you can watch videos of people.
• 54:14
  Speaker B: That look like people, that talk like people. We can kind of see that they're not right. But it's. But it's real close. And it fools a lot of people.
• 54:23
  Speaker A: Oh, yeah. And, yeah, it fools a lot of people. And a lot of people get fooled without AI. Right. So. So. So I think it's going to be very, very interesting what, what truth looks like in the future and. And how is that going to be a thing? It's like we. We already live in such a lazy soc, get their news from Facebook or TikTok or Twitter or whatever instead of doing due diligence. And honestly, it's sad for me to see that. Guess what happens if you try to search on news. Most journalistic articles are now behind a paywall. Okay, so where are you getting your information? Are you doing your due diligence that the information that you're ingesting is legit? It's the truth. Right? So, yeah, that's a terrifying thought, man. Between cybersecurity and AI, I don't know what that's going to look like, but it's going to be very, very interesting to see what comes out of it.
• 55:20
  Speaker B: Well, thanks for terrifying us. I appreciate ending on that note, Nerds. I'm Michael Moore. This has been podcast dissecting popular IT Nerds with Maximo Breadfeld, chief information officer at Longship Maximo. Thank you so much for joining us. We had great conversations and stories from you until you told us about the evil AI overlords that are going to take over.
• 55:46
  Speaker A: Well, thank you for having me to end up in a good note. Happy holidays for everybody. Thank you for having me. This was a lot of fun. Michael, thank you so much for your time. Thank you to everyone listening. Have a wonderful rest of the year and an awesome 2025.
• 56:04
  Speaker B: Same to you. Please come back.
• 56:05
  Speaker A: It.