Latest / Success Story with Scott Clary / Lessons - How To Protect Yourself Against Cyberattacks? | Mark Sangster - Cybersecurity Author and Expert

Transcript

Lessons - How To Protect Yourself Against Cyberattacks? | Mark Sangster - Cybersecurity Author and Expert · Success Story with Scott Clary

• 0:00
  I just want to take a second and thank Cornbread Ham for supporting today's episode.
• 0:03
  Now Cornbread Ham CBD gummies have been this really nice addition to my wellness toolkit.
• 0:09
  I don't use them every day, just when I want to win wine after those extra busy weeks,
• 0:14
  but they're perfect for those moments when you want to take the edge off and just find your balance
• 0:19
  really just shut off from work. Now what makes them special is how Cornbread Ham
• 0:23
  crafts them. They only use the flower of USDA Organic Hamplants. That's the best part for the
• 0:28
  purest, most potent experience, no fillers, no artificial fluff, just clean, full spectrum goodness
• 0:36
  in delicious watermelon berry and peach flavor. I keep them in my nightstand for those moments when
• 0:40
  I just need a little extra help relaxing and I love how transparent they are too. Every batch
• 0:45
  is third party lab tests, so you know exactly what you're getting and they put together a special
• 0:49
  offer for all success story podcast listeners. All listeners can save 30% off their first order.
• 0:55
  Just head to cornbreadhemp.com slash success and use code success at checkout. That's cornbreadhemp.com
• 1:03
  slash success code success for 30% off your first order of these amazing gummies. In this lessons
• 1:09
  episode, explore the rising threat of cyber attacks and their implications for global security.
• 1:15
  Learn how modern conflicts are shifting from physical to digital warfare. Why companies must
• 1:19
  prioritize cyber hygiene and the critical role of preparation in mitigating ransomware attacks
• 1:24
  and safeguarding critical infrastructure.
• 1:36
  I was so Biden put out that list right of all these, right now they haven't they hit
• 1:42
  you know the ones that I'm thinking of is JBS meets colonial pipeline like these are the big ones
• 1:47
  pipeline is definitely core infrastructure JBS meets is big but it's not going to it's not going
• 1:52
  to ruin a country like shutting down a medical system or a financial system maybe for some people
• 1:59
  but for for many of us like these these core things that were on that list could truly just
• 2:04
  cause massive amounts of chaos the power of all these different things they haven't gone after those
• 2:10
  those types of industries yet do you believe that it's because they haven't been able to
• 2:15
  or they're waiting for the right time do you think they'll respect the list I'm curious as you
• 2:20
  see the future of this type of behavior evolving where does it go yeah so I do think that's coming
• 2:28
  I frankly think we live in a in a bit of a you know cyber cold war that like the 1950s post-World
• 2:33
  War II right with Soviet Russia and you know the West and you know there's that constant
• 2:39
  data and right now we sort of exist in the same kind of world right I'm not going to pull the
• 2:44
  Russian spy in Washington DC and go to town to get their secrets because then I know they're
• 2:49
  going to pull the CIA spy in Moscow and do the same right and we're sort of in that same I think
• 2:54
  that same kind of detent now where we're keeping it just south of military action right and it's
• 3:02
  great the real warfare because you know these smaller nation states know you know they can't fight
• 3:07
  with the tanks and the bombers and all that kind of stuff but they can certainly fight nails and
• 3:11
  mountains and caves and jungles and they're really good and I think that's what's going on now
• 3:16
  will it boil over yeah I think it will right it's almost like you know think of the doomsday
• 3:20
  clock we had in you know sort of nuclear war where I would say we're definitely in the 11th hour
• 3:26
  heading to midnight in a cyber one as well because you know I think there'll be that tipping point
• 3:31
  right it'll be a trade war or something that happens in another part of the world where they can
• 3:36
  affect you know influence or extort you know what they want by doing this and and a lot of these
• 3:42
  attacks I think are you know proof of concept right it's the yeah we could shut down a gas line
• 3:48
  and and we saw what the secondary effects of that right you know shortages at pumps gas prices
• 3:54
  spiking panic you know all that kind of stuff what happens as you say what happens when we shut
• 3:59
  off water or we kill the electricity or you know the big one I keep waiting for because it is you
• 4:06
  know things like attacks on airports and I don't mean traditional terrorist attacks shooting down
• 4:10
  or blowing up planes I mean shut down a baggage handling system for a day at Chicago or in
• 4:16
  Atlanta right or Denver and what is major hubs and watch what happens right think of the billions
• 4:21
  that's going to create an economic chaos and so on and I think those are are the things that are
• 4:26
  coming so you know at some point you know is the you know what are we going to do in the west here
• 4:32
  right you know the US Canada the UK and other allies are we fighting back I don't know I probably
• 4:38
  presume so on some level but yeah at some point I do think it will boil over and I do think you're
• 4:45
  going to see you know this sort of like you know testing your muscle strength right and and figuring
• 4:50
  out what works and what doesn't work and I think the more scary part is that's the kinetic side of
• 4:55
  it but what's the potential energy side of it like how many of these organizations have they
• 5:00
  already infiltrated and it's you know bit of the nuclear submarine laying off the coast just waiting
• 5:04
  for the order to you know turn the keys and launch the missiles and I think that that's probably
• 5:09
  the case because a lot of these companies are simply not prepared they've focused on physical
• 5:13
  security like a pipeline you know they don't why I said terrorists getting in and blowing it up
• 5:18
  and they they've not really put enough you know cyber defenses in in in in place to adequately
• 5:24
  protect themselves are there protection because we we mentioned the the people problem quote
• 5:30
  what are the other protections that somebody could put in place to protect against something like
• 5:35
  this so there's there's lots of different security tools and technologies but there's some basic
• 5:39
  things that I always say to companies brush your teeth and floss right do the hygiene part of this so
• 5:44
  things like proper password security use two factor multi factor authentication and those things
• 5:50
  are even offered right in your consumer side like apple iTunes Google Play Amazon all these services
• 5:56
  will offer you know they might call it OTP but that you know it's where you log in and it'll send
• 6:01
  you a code to your phone and you have to enter that as well those secondary controls slow these bad
• 6:06
  guys down using encryption so having a VPN I think now with COVID we all know what a VPN as we
• 6:11
  didn't before just some of the basic hygiene effectively narrows the entry points and what it does
• 6:19
  mean now is it's it's a bit like you know channeling them through that canyon I know where they have
• 6:23
  to come out and I know when they pop out yes there's lots more things they're going to do
• 6:28
  but those are where I can now put my spotlights or put my centuries and I can wait for them to
• 6:33
  emerge from that point and it makes it easier to detect them so you know for many companies doing
• 6:38
  the basics is critical right and and you know and that's going to eliminate the new that's going to
• 6:45
  eliminate the what I call the background radiation of the internet it's also going to eliminate
• 6:50
  the kind of the moderates threats and then we get into the high level threats that's that's a
• 6:54
  different story right that is where you're you're going to absolutely have a Noah's arc two of
• 6:58
  everything kind of security program to be able to protect yourself a huge shout out to bank
• 7:02
  on yourself for supporting today's episode entrepreneurs here's the retirement secret that
• 7:06
  Wall Street doesn't want you to know while you are pouring everything into growing your business
• 7:11
  they want you gambling your future in their 401k casino with no guarantees as a business owner
• 7:16
  you already take enough risks why gamble with your retirement too it is time to discover the
• 7:22
  financial strategies smart entrepreneurs are using to protect their wealth bank on yourself is the
• 7:27
  proven approach that gives business owners what they need most certainty flexibility and control
• 7:33
  in their retirement unlike traditional retirement accounts bank on yourself gives you predictable
• 7:38
  guaranteed growth that isn't at the mercy of market crashes a liquid cash reserve you can tap
• 7:43
  anytime to seize new business opportunities or whether downturns there's zero penalties or
• 7:48
  restrictions and tax free retirement income that shields your hard earned wealth from future tax
• 7:54
  hikes for entrepreneurs who understand the value of financial leverage here's the game changer when
• 7:59
  you access your money it continues growing as if you never touched it this means your capital
• 8:04
  works twice as hard just like you do you can get a free report that reveals how you can bank on
• 8:09
  yourself and enjoy tax free retirement income guaranteed growth and control of your money just go
• 8:14
  to bank on yourself dot com slash Scott and get your free report that's bank on yourself dot com slash
• 8:20
  Scott bank on yourself dot com slash Scott and in one point as I was going through the book one one
• 8:28
  I guess topic or is a gray zone or a gray actor I don't know what that means so what is what is
• 8:35
  yeah so the gray actors is kind of back to a little bit of what I talked about destabilization right
• 8:39
  so gray actors are countries that we haven't declared war with China Russia
• 8:44
  harsh popular you know possibly the Ukraine Iran you know Iran Iraq Syria all these kind of
• 8:50
  countries where we're not at war so there's not a kind of let's call it a global entitlement to
• 8:55
  fly you know rockets over airplanes and bomb them they're not doing the same to us but effectively
• 9:01
  they do seek the same kind of outcome right they wanted to stabilize our economy they are
• 9:06
  sowing mistrust like everything's going on right now just place under their hands right like look
• 9:11
  at covid do I wear a mask do I not should I get vaccinated should I not and I'm not trying to advocate
• 9:15
  for one side of the other but what I am saying is probably 20 years ago we did just done what we
• 9:20
  were told and now we've bumped right so you've got that going on you've got a distrust of government
• 9:24
  agencies of science and all that kind of stuff placed into their hands because they're aligned
• 9:29
  and we're no longer right we don't even want to trust the messenger the messenger
• 9:32
  and then you've got the economic side of it which is can I take down that big major bank
• 9:37
  no but you know what I can do I can cause a lot of problem like like your example earlier I can hit
• 9:42
  a meat you know a meat processing business and what do I know that's going to do that's going
• 9:46
  to spike the price of chicken and that's going to be one more point of evidence to show that
• 9:50
  law enforcement is incapable of protecting its constituents or the government you know can't stop
• 9:56
  a foreign entity from you know extorting control over our economy and you know it's just that sort
• 10:02
  of cycle and like I said it's everything south of of of you know physical war right of semi tanks
• 10:08
  and airplanes and ships but we're pretty darn close so what what happens and I guess you know
• 10:14
  this is it hindsight it's 2020 I probably should have asked this question at the beginning of the
• 10:18
  podcast but I still think it's a good one to break down so what happens when a company is a victim
• 10:23
  of a ransomware attack what are the steps that actually take place that they would be experiencing
• 10:27
  or their employees would be experiencing excuse me or even what happens when law enforcement gets
• 10:33
  involved do they want to get law enforcement involved will that have an impact on the outcome of
• 10:39
  them being able to pay off the ransomware attack or maybe give them give law enforcement potentially
• 10:44
  access to more information that they actually they originally didn't want to even open up
• 10:49
  to a lot of variables there there are a lot of variables so if a company is in a position where
• 10:53
  they feel that they have to pay a ransom right so they've been you know absolutely shut down and
• 10:57
  what we see is really good multi-pronged tactics to extort that right so things like they may not
• 11:02
  shut down everything but then they say you know pay me now and when the company says we're not
• 11:06
  going to negotiate with you they shut down something more critical they'll often publish information
• 11:11
  as well to show that they've gotten in they'll contact partners they'll contact clients and say by
• 11:15
  the way hey we broke into this company we know there were major supplier of yours we've got access
• 11:20
  to your you know your secret intellectual property your designs all that kind of stuff just to kind
• 11:25
  of put more pressure on them to pay when it comes to doing that I would recommend that they engage
• 11:29
  law enforcement because law enforcement is not there to criminalize the victim they are there to
• 11:34
  determine attribution and to build a case for prosecution but they also know what's going on
• 11:40
  in the world right so they see this stuff so they may even have decryption keys that they haven't
• 11:44
  been rotated by the bad guys and they're being lazy they can help determine whether or not it's
• 11:49
  a legitimate you know threat like this is okay this is a major ransomware gang you need to take
• 11:54
  this seriously engaging there insurer so if they have coverage for this kind of thing you insures
• 11:59
  know how to negotiate right so the other piece to this to understand too is the criminals before
• 12:04
  they detonate they've probably done a lot of reconnaissance with any environment and one of things
• 12:08
  we see them going after is things like insurance documents so they figure out what kind of coverage
• 12:13
  do you have so let's say you have five million in coverage they're going to come in and they're
• 12:16
  going to negotiate for ten and they know that you can't pay ten but they know they can walk you
• 12:21
  down to five and you'll walk away thinking you got a bargain per se and they know they knew you
• 12:26
  were going to be you were capable of paying it right so they understand those kind of things like
• 12:30
  you have to they've written the rules they already understand it and they haven't told you what
• 12:34
  the rules are right so it's difficult for you to play law enforcement can help there they can
• 12:38
  determine like I said they can determine attribution they can they can share the forensics which is
• 12:43
  critical too because otherwise we all suffer in silence and that's one of the things I talk about
• 12:47
  in the book right is when these stories don't get shared we don't have a way of vicariously learning
• 12:52
  so it's like each one of us individually unfortunately learns the same hard lesson instead of us
• 12:57
  being able to observe what happens to others and and so yeah it is it's a terrible experience because
• 13:04
  you know one of the things we don't talk about in the security world or in the business world
• 13:08
  is the emotional human side of it right so you're under a lot of stress you've got a board that's
• 13:13
  threatening your job right your name is in the paper you have to deal with crisis communications
• 13:18
  and you know go in front of whoever it is some media outlet that's called you at 4.30 wants to run
• 13:23
  the story at six o'clock and they've done that to put more pressure on you right nobody's your friend
• 13:27
  if that point and if you're not prepared you know you're going through a lot because you know again
• 13:33
  you're trying to determine you know right back the beginning of our conversation is what the
• 13:36
  IT people telling me is that legitimate how do I even pay in cryptocurrency we don't have a
• 13:41
  Bitcoin wallet or whatever it might be how do I do this and that's where law enforcement ensures
• 13:46
  an incident response firms help right that's what that's their you know they're the that's their
• 13:51
  job their first responders they know how to deal with you know things when they've they've gone
• 13:55
  wrong but the best thing I'd say for companies is prepare right is the short scoth quote about you
• 14:02
  know the more you sweat and preparation the less you bleed in battle right and in this case it's
• 14:07
  the less you bleed in response and it's very true right knowing what to do who to call when
• 14:13
  having the right people come in like HR marketing help craft communications having a crisis
• 14:18
  communications player to get involved it reduces a lot of that right so it's still terrifying when
• 14:24
  it happens but you know at least you know what to do versus you know the first 24 to 72 hours are
• 14:30
  spent in a kind of a panic of just even determining what the next step is let alone fixing the problem
• 14:37
  thanks for tuning in if you found this valuable don't forget to hit that subscribe button so you
• 14:41
  never miss an episode and if you want to dive deeper into this conversation check out the links in
• 14:45
  the description to watch the full episode see you in the next one