Latest / The Decision Advantage / Building Cyber Resilience & Protecting What Matters
Transcript
- speaker-0: Welcome to the Decision Advantage, a fusion intelligence podcast by Fernand Consulting. I'm Brian Leclerc and today I'll be speaking with Randy Nether, the director of cyber resilience at Fernand Consulting. Randy, welcome to the show. speaker-1: Thank you very much. Good to see you. speaker-0: Great having you here. ⁓ I understand that you have a real passion for risk management and cyber resilience. And those things aren't always topics that people really associate with passion. ⁓ given your blend of a technical background and your MBA, how did you first get drawn into this space? speaker-1: Well, ⁓ I've been in IT for a little over thirty years, and about fifteen years ago I was hired as the IT manager for a small company in central Maine that aggregates ⁓ health insurance payer data on behalf of state ⁓ governments. And when I took on that position, the company was kind of the wild west when it came to cybersecurity. They really didn't care about those things very much. On my first day there, they were in the process of moving All of their data for their central database, which was basically their business, from an old ⁓ storage facility to a new ⁓ that they had purchased about a month before. And they had a consultant who was an expert on these systems. And ⁓ I think I'd been at that company for about two hours. And ⁓ he said this very worried oops. ⁓ no. And it occurred to me, you know, actually this is my responsibility. And I said, So what's oops? They said, ⁓ don't worry about it. And Could you elaborate don't worry about it? So ⁓ the next day he was fired, what he had done was he had moved all the data from one system to the other, destroyed the data on the original system, and then discovered he had made the copy incorrectly. speaker-0: Wait a minute. This is I would hire speaker-1: And he was fired pretty quickly after that. ⁓ and then we spent ⁓ two weeks trying to recover that data. The my boss had some contacts with Indiana University, some Wisbang database guys, and they were able to restore that that data, but I spent my first two weeks working for that company. ⁓ I think I I put in a hundred and ninety hours my first two weeks there. ⁓ I slept underneath my desk. And the company ⁓ nobody else in the company worked except for the IT department. And I was sitting in the in the ⁓ president's office, I don't know, about 10 days into this little project, and I realized that the things that I did directly affected well, ⁓ one of the data analysts, her her daughter, ⁓ had just gotten some trophy for She was like six for doing dance. And her her daughter had this passion for dance. And I guess she had been a dancer as well. And so it it it occurred to me that my efforts there affected whether or not this little girl got to go dance or not. And, you know, that doesn't sound like a lot, but to them it was very important. And so that's kind of where the passion came from. some years later, ⁓ the company speaker-0: Mm. speaker-1: ⁓ took on a client that normally health insurance payer data for them, all the personal identifiers, they don't care about it. It gets scrubbed before it's transferred to them and it's aggregated into a database and then is used for doing studies and stuff. But one of their clients decided they wanted to start taking in federal d federal data from the center for centers for Medicaid and Medicare. And the the federal government wouldn't scrub the data. So it had to be live identifiers. And for ⁓ the company to receive that data, they had to ⁓ meet all the requirements for it's kind of technical, but ⁓ a medium impact ⁓ risk on the FISMA scale, which FISMA is a federal data requirement. And ⁓ So going from the Wild West to meeting that requirement and actually passing an audit that was done by CMS took three years and about a roughly $150,000 for a company that had at the time 30 employees. So it was a major effort. And ⁓ me being the IT manager, it all fell on me. ⁓ and it was it was a very challenging project. and ⁓ We we did it. I mean it it it was ⁓ it was quite an effort. And ⁓ but it it really opened my eyes to that first incident, ⁓ at the very beginning of my tenure there, and then this whole process of becoming a qualified entity with the centers for ⁓ Medicaid and Medicare, that kinda opened my eyes to this whole idea of risk management and cybersecurity. So ⁓ since then it it has been a passion to mine because you know, information technology is is central to pretty much any business's operations. I mean, even if you're Amish and you don't use computers, you still have some sort of method of keeping track of what crops you're you know, when you're rotating crops and that sort of thing. It that information is is key to any business. Right. And losing that information, as in the case of the company that I work for in central Maine, could have been the difference between having a business and not having a business. ⁓ in the last five years I've I've helped companies try to recover from ransomware attacks. And I've had some some success where one company only lost a million dollars a month ⁓ having been hit with a ransomware attack, but they survived. They had a they had a a method of getting around that problem. And another company where they lost ⁓ everything and it included ⁓ over three hundred jobs in the Boston area. So ⁓ yeah, it's a passion. Because in every case, in every ransomware case that I I've been involved in, it was completely, entirely preventable. It shouldn't have happened. And so ⁓ you know, it's it's kinda like dealing with a, you know, a a building a and and they don't put in sprinklers. It's like put in the sprinklers. So don't cost us compared to the cost speaker-0: Frustrating sort of thing you're seeing that you know you can help with and and speaker-1: Yeah. Yeah. It it'd be so easy to prevent that. Just do it. Right. speaker-0: Right. Well you've ⁓ you've recently joined Friend and Consulting. ⁓ can you tell us why you joined now and, you know, what you hope to bring to the company? speaker-1: The folks that I've met at Ferndon, beginning with ⁓ Dr. Hersey and and the other people, it's just an amazing group of people with a wide variety of expertise. And using that expertise okay, so I talk about it from my perspective and managing risk, you know, I I know certain things about certain areas, but I don't know about I mean like everybody, I don't know a lot about a lot of things. And but you get all these experts together and who we can build a a very strong defense of ⁓ to help manage all kinds of risks for companies. And and I see that as being something that is I I mean it's always been the case, but it's desperately needed today because we live in perilous times. And ⁓ companies, whether they know it or not, they they need ⁓ what services like what Ferndon offers. And and I see you know my expertise, my 30 plus years in information technology and cybersecurity as ⁓ as an add ⁓ to ⁓ shoring up those defenses for for Ferndon's clients. speaker-0: Right, so I think you might have touched on this a little bit earlier, but organizations seem to operate kind of under a false sense of security, maybe, when it comes to cyber readiness. So in your experience, I'm wondering what are some of the biggest blind spots that companies have and what are they missing in their preparations for possible attacks? speaker-1: Yeah. So what I found is that a lot of owners and leaders ⁓ believe that they are not of any interest to hackers, which is absolutely false. Anybody that's got a revenue stream is going to be of interest to somebody. And then there's a lot of organizations out there, some of them are nation state actors, others are criminal organizations, ⁓ people with bad attitudes. ⁓ they're out there just to mess things up. And ⁓ if they can If they can get in and and that's the thing is that ⁓ many of ⁓ operate with botnets that are just looking for a weak spot. They don't really care where the weak spot is. speaker-0: ⁓ so a lot of these aren't really targeting specific companies. They're just looking for any vulnerabilities that they can get at, right? speaker-1: Correct. So they're you know, they're just doing a scatter shot and and see what hits. And when they hit something that's vulnerable, ⁓ they're just going to go and exploit it. It doesn't matter whether it's a ⁓ multi billion dollar company or just a little mom and pop shop that has one computer. They don't really care. ⁓ and as far as what they're missing with preparations is that, you know, cyber risk is a relatively new thing. ⁓ but there's a lot of areas in in especially in manufacturing ⁓ that ⁓ that people are used to. They're used to ⁓ making sure that they are meeting whatever the OSHA requirements are or dealing with other risks like flood or fire and that sort of thing. ⁓ and so a business owner will do what what is necessary and and somebody that's diligent will do just a little bit more than is necessary to make sure that for instance their building doesn't burn down. Or if they're gonna have they're gonna deal with flooding, they'll do whatever they can to prevent that from happening. But when it comes to cyber risks, ⁓ it like I said, it's a new thing. And so they're not used to addressing those things and and often will discount the importance. So the biggest preparation that they're missing is that there are some basic things that they can do ⁓ that will mitigate you know 80, 90 percent of the risk. speaker-0: So it sounds like companies can make both good and bad investments in their cybersecurity. Can you offer some examples of where companies could spend their their budget dollars more wisely in preparing for a cyber attack? speaker-1: Based on the recent examples we've seen of attacks on ⁓ water waste treatment plants in Minnesota, ⁓ the way they got into that was ⁓ a lot of equipment still had its default passwords. ⁓ so I would say first and foremost, you get a new piece of equipment, reset the default password. ⁓ but seriously, the the biggest bang for the buck when it comes to cybersecurity ⁓ spending is on training. Training people to know how to respond to things that happen, to incidents and events, ⁓ and also to prevent them. Because most cyber ⁓ attacks go through people, whether it's a person clicking on ⁓ a bit of phishing email or maybe ⁓ allowing somebody to come into a facility that shouldn't through tailgating or or things like that. So training an employee properly to respond and do the right things is by far the best ⁓ spend in cybersecurity. speaker-0: Right, 'cause you had mentioned, for an example, like people know how to prevent fires, but they probably or at least some people do not know how to prevent fishing attacks or whatever else. So just gaining more knowledge, right? speaker-1: Yes, exactly. Exactly. And I and I think, you know, we are getting better about that. I think most people know now not to go clicking on links on a p on an email that I don't know where it came from, but it still happens. And it happens enough to be of ⁓ significance. speaker-0: Right. Okay, that's great. So over the years you've you've you've written a book about this and you've you've also written a lot of blog posts. Where can people get more information or what what kind of additional takeaways would would you like them to find in your writings? speaker-1: Well, of course, ⁓ I'd like him to buy my book, but ⁓ speaker-0: Uh-huh. And the what is the name of your book? speaker-1: Practical cyber resilience. Okay. I I don't have it on Amazon quite yet, but it will be soon. But th there's a lot of really good information out there. of course we live in the YouTube generation and ⁓ there's there's some good information to get out there, but it is kind of overwhelming to get the i the information you need. ⁓ Fernan Consulting would be a good place to go. ⁓ we can consult speaker-0: Fernand does a lot of blog posts and and updates. speaker-1: Yes. Yes. ⁓ but there's a lot of good organizations out there. one organization that I I I've used throughout my career is the Center for ⁓ Internet Security, CIS. ⁓ they have a lot of good information that help ⁓ organizations to ⁓ achieve what we call ⁓ cyber hygiene. They're basic things that a company could do, like for instance resetting default passwords and having a clear idea of what assets you actually own so you know what you need to protect, ⁓ things like that. So and also the ⁓ National Institute of Standards and Technology, which is run by the United States Department of Commerce, they have a number of standards out there that are of great use. And ⁓ currently a lot of companies use the ⁓ cybersecurity framework, ⁓ which is in its second version. And that's an excellent ⁓ document for helping small and it was intended for this for small businesses to use to guide them to ⁓ cyber resilience. speaker-0: Okay. Great. All right. Well, as we wrap up, is there any you know, obviously you you hit on on a a bunch of things, but is there any like one key message you'd want to get across to to leaders? speaker-1: Yeah, so you know, like I said, cybersecurity is kind of a kind of a new thing when it c when it comes to risk management. ⁓ but one of the things that I I I want company owners and leaders to keep in mind that their company is important. That a lot of times people don't realize how important their company is. Their company is important for stakeho stakeholders, whether it's ⁓ Their employees, obviously their company is very important to their employees because their employees make their living from what they do for the company, ⁓ but for for their vendors, for customers, for the entire supply chain. And they're also an important part of the economy. And so it's it's vital for the company to protect its information. And it's important that a company do what makes sense. Right? If I don't have national, ⁓ nationally sensitive information, there are certain things I don't need to do. I don't need to set up you know, all these controls and whatnot. But so what what I I tell organizations is that we need to make your risk management strategy fit what your business does. So you need to do what makes sense in your situation. And the important thing is to do it. Maybe you're not going to get it perfect, but if you've done what you need to do, chances are nine out of ten, you're going to defend yourself against the attack. And and don't skimp. You you don't need to go buy the the the the the gold plated version of it, but but do what you need to do. And and you know Exactly. And actually and and do so do what it takes and just a little bit more because your import your business is that important. So that's that's kind of my thing. speaker-0: What scale is that you need to That's great. All right. Well, thanks, Randy, for the chat and the deep dive into your passion, right? Cyber resilience. Yeah. Thank you very much for ⁓ coming on. Thank you for tuning in to the decision advantage.