So who would you be in the crime heist group thinking like the brains or the hacker, like
the guy in the chair, you know, the driver?
Who do you think you would be?
I'd be the buzzkill pointing out why it's not going to work.
Is that a time?
So you were like we could all get caught, right?
So you realize it's going to happen.
So you're the planner, you're the contingency planner.
Yeah, it would be terrible at the con artist because I don't lie well ever.
Not even trying to.
I was trying to think of anyone of clever being clever and maybe it's the mastermind
or brains but like the con artist.
I was like, I think I think Anna would be great at being the brains because she loves
trivia so she knows all this just random info.
So I think that would be great for her.
I think I'd probably be the hacker or the driver.
You know, the obviously cyber security here love that hacking, you know, computer side
of things but I also love cars.
And then also what's the movie, the Italian job where they got the loaded up mini coopers.
That one was always a phenomenal movie to me as a kid.
So loved that part of it.
What about you Tara?
My gosh, I kind of wanted to do like all of them but I was just thinking like I would
like to be the planner like I would have our plan and then task be like, all right now
you guys are going to go here and do this and once you've completed that I need you
to like go to the next step.
So I would just make sure that there's the execution following like we're going to get
this and we're going to make it happen.
So between you and Matthew, we're going to actually make a successful heist somewhere.
Yes.
Challenge accepted.
I'm going to add another one which I don't think is on our list of archetypes but I'm
also the one who referenced so many other heists as it happening that we all think there's
twists coming.
Like some random person is walking down the stairs and we're just like, isn't that your
partner like in Ocean's Eleven and they're like, no that's a stranger.
Stop.
Oh man.
Oh my God, yes.
That's great.
How about you Ariel?
Just the wrench of the work.
I think out of our list that just leaves the muscle.
I wasn't going to comment.
That's why I am.
Oh yeah.
It's a good thing this is an audio podcast for most people because yeah, there's no muscle
here to be a wowed by.
I like the smallest one out of all.
Yes, you're petite.
But I got us.
I got us covered.
Don't worry about it.
Our group will succeed.
The mom looked down to like steer people into submission so I think that could be where
something.
I love it.
We got all of our bases covered and then Matthew who's following us around throwing
wrenches in the work.
Yeah.
Bucket of cold water on everything.
Here's why that won't work.
Also reference to thing no one else has seen.
Perfect.
I love it.
That's great.
I mean, no heist is complete.
We've got Nate our hacker, which is fitting because today we're talking about cybercrime.
Tara and I are joined by Nate our director of cybersecurity and our quality assurance
analyst and GRC specialist and Matthew R. V. C. So.
And just to kind of open it up, I don't know if we want to start with when we're talking
about cybercrime, what are we talking about, maybe some terms just to kind of level set
for our audience on what we're talking about.
Definitely.
We've done a couple of podcasts now on certain things like this.
If you haven't, definitely go back and listen to them.
So we've done a podcast on the IC three report from this year.
We've done a couple others as well, including the Verizon yearly report and there's kind
of break down what those crimes are.
We go into a lot of detail of what those numbers are.
But in short, cybercrime relates to anything or any type of crime that impacts a business
or individual that is done using computers or telecommunications of any kind.
That is a very broad scope and it does mean things move into and out of cybercrime.
It's a big problem at the moment with defining what is and isn't a cybercrime.
But that's because there's a lot of scope to it.
There's a lot of things where people can get pulled into something that previously wasn't.
Suddenly it is now it's a different, you know, organization that gets involved.
The majority of it comes down to ransomware on the business side.
Scams very big one as well.
People just trying to get money rather than getting anything else.
The gamut of real crimes, but just computers are involved.
Yeah, there's, we could probably break it down a couple different ways, right?
And this is where some of the nuances will come in about, you know, what's the full scope
that you want to really focus on.
We could go deep either way.
But in terms of the business side of things, you know, Matthew had mentioned, you know,
the ransomware is the, you know, some of the social engineering, which is essentially
trying to exploit human behavior in order to gain access to systems, information, something
along those lines, right?
That could be phishing emails, calling in and having someone illicitly provide that info,
you know, vocally there.
Otherwise, there is data theft, right?
So insider threats, that could be something where you have a disgruntled employee who
is intentionally taking data.
So that's just a very, very high level of the business side.
You could even take that to just personal cyber, or, you know, in general cybercrime.
There's a whole bunch of stuff out there.
We can go deep into this in a little bit.
But really, there is always some type of motivating factor behind the intent to commit this type
of cybercrime.
I guess I can maybe I quick mention just a few of them, and then maybe we go deeper.
I'd like to mention one thing quickly, just kind of building on from that.
There's one other thing that we talk about when we're differentiating, and that's internal
versus external crime.
So external crime is when the initiator is external to the organization.
This is really a business side of things, but someone who's not a part of the organization.
Internal is when it's someone who actively works for the organization, and generally,
if we're talking about internal, we're talking about someone who is acting maliciously.
So someone falling for a phishing scam is not an internal crime because they aren't meaning
to.
They were tricked by an external actor.
There's a little confusion around that.
So I'd just like to clarify that first.
Internal when we mention it is someone who is actively choosing to cause harm to an organization
internally.
That may have the appropriate access.
It applies to say your family environment as well.
Exactly.
Yeah.
The quick breakdown, and this is mentioned in the IEEC report, is that that's about four
out of five threats.
And this is across all industries for business are external.
We're looking at averaging out across all businesses about 80%, right?
Are external actors rather than internal?
So external is far more common.
Just want to mention that again, because I know insider threat can be a little scarier
sometimes.
But basically four out of five are external from that business perspective.
Sorry, back to you, Nate.
Yeah.
No, you're good.
Before we go deep into some of the actual cybercrime and the activities there, one of the things
I just wanted to mention is, why does it even happen?
And I started touching on this a little bit is there's different reasons why someone may
be motivated to do this.
Financial motivation is by far the number one.
If you go take a look at the Verizon report that recently came out, it accounts for about
94% of all data breaches.
Is there some type of financial motivation to it?
Whether or not it's trying to process wire transfers, ransomware, stuff like that.
Extortion, so maybe there's a threat actor group called Carecurt.
They typically don't even ransom files.
They just take them and say, I have your files, give me X amount of money, and then I will
just delete them.
They don't cause actual impact to the organization other than everything you have to deal with
due to data loss.
Another one is just grudges.
So this could be, again, disgruntled employee.
Maybe someone worked there, got fired, now they're upset, that kind of stuff.
Espionage is another big one.
It's not as common, but it does especially happen at the government or the critical infrastructure
side of things, your oil, your gas, your electricity, people trying to gain additional
info to use for later exploitation or just information gathering for other nation states.
So those are state sponsored from other nations there.
That aligns with corporate espionage too.
We're stealing from a corporation on their intellectual property to exploit and sell
when it's not yours in the first place.
But for the monetary gain or notoriety gain.
This is kind of a pivot, but the corporate espionage side of things is definitely one
of the things that got me interested in cybersecurity in the first place.
Just people knowing that you're releasing a product and then being able to release their
product first so that they get the buzz from it.
There's so much that goes into what these crimes are and what their purpose is.
But cyber crime doesn't mean crime that results or requires a digital ending.
You're not getting money from the computers that you're stealing or something.
It's about what the process is and what's used to commit the crime.
Three last ones and I'll make it really quick, I promise, is convenience.
You just happen to come across a company that's doing something very insecure.
Let's just say it's remote desktop.
That's wide open.
You can't just go to the company to connect to computers.
Oh, I don't happen to just log in just because it's there.
And then go commit crime.
You can't just do that.
That's a felony right there.
Ideology, so this is where we see things like, I'm just going to go pick on WikiLeaks,
for example, right?
There's the ideology that the government is misbehaving.
They want to expose that.
So there's some type of motivation there.
And then sometimes it's just for fun, right?
There's no other intent other than they're just curious.
So one of the ones that come to mind right off the bat is there's a great report out
there about some students who wanted to re-crawl their entire district.
And so all they did was they-
I heard about that.
Yeah.
Minneapolis right now.
Yeah.
It's in the news.
Yeah.
That and this one came out a couple of years ago, I believe now, where these kids got into
the chime system, all the projectors, the video player for the school announcements.
And then they just thought it would be funny.
So they just did that.
And then while they did that, they also wrote up a full pen test report and they came clean
and provided it to the district.
And they weren't punished because they did such a good job documenting their work.
So if you're a school administrator, that's a little disheartening there that you're
students are actually very, very skilled at computers.
And oftentimes students have some of the most time in the world.
Right.
And instead of playing with friends, let me just go hacking.
Hack things, right?
We just saw that with things like Uber, right?
I believe that one was a 14 or 17 year old, but it's still some type of minor, right?
So there's-
Firstly, definitely not recommending kids do that.
They should have voted for it.
Just because that is a crime, it's dangerous to be doing that.
I would agree with your point though about time.
Many of you may have heard about the Lazarus Group.
To my knowledge, and I haven't heard anything recently, there have not been official charges
placed or anyone committed for that.
But the people who were arrested for it were teenagers in the UK.
The person who was apparently the ringleader was 16, right?
This is not someone who, A, maybe fully aware of how bad what they were doing was, right?
But at the same time, they're not doing it for the same type of gains or for the same
reasons that most people are.
Maybe it started out of a boredom or I can't believe this worked type scenario.
We see that a lot when it comes to people finding flaws in environments.
There are a bunch of tools, no I'm not going to name them, that allow you to scan boards
on systems just on the internet.
You can do it pretty much very easily.
And so if you know what you're doing and you have some skills set in that or maybe you're
bored and have a lot of time, finding flaws in systems is possible.
This is why we do vulnerability scanning and external vulnerability testing because that
way we find it before someone else does.
The number one reason is capital gain.
It is money.
And that depending on the industry ranges from 70 to 95, sometimes even 100% of the reason
that these crimes are committed.
But the reason for that is that that is a good motivator.
So when we're talking about what you're seeing and why you're seeing it, most of the time
monetary gain is the reason it's being done.
Whether that's a secondary or tertiary gain rather than the primary gain is secondary in
the case of like espionage, for instance.
But people are looking to get money.
And the amount of money is where things start getting really fun because the organizations
that go for incredibly large scores, considering our highest conversation earlier, are different
to the people who are going for the small numbers.
And that main difference is generally, are they going for individuals or are they going
for businesses?
Couple years ago, I say that was probably pushing five now, many, many iCloud accounts
were hacked and the devices were locked.
From what I remember of this, the cost to get those devices unlocked was only a couple
hundred dollars, definitely less than the cost of a new device at the time.
So they weren't taking tens of thousands of dollars from or hundreds of thousands of
dollars from a couple of businesses, they were getting two or three hundred dollars
from 10,000 people.
And that's kind of, I think, one of the biggest differences we see between the internal and
external attackers here.
It's across the board, there's a real shotgun analogy of we're just trying to hit as much
space as we can and see what sticks and who's going to run back and give us money, which
is why we always recommend not paying a ransom right out the gate, speak to your insurance,
speak to whoever you need to, find out why, if you're being directly targeted, if you
are just the result of someone else being targeted.
There's so much to what's going on and there's so much benefit that these organizations get
from trying to impact as many people as possible, rather than trying to get incredibly large
amounts from one group of people.
I guess two quick thoughts here.
If you have no idea who the Lazarus Group is that Matthew talked about, there's a book
and a podcast called The Lazarus Heist, go read about it, it's phenomenal.
It's one of the core reasons why the United States had to redesign their hundred dollar
bill.
I'll just leave it at that.
Otherwise, in terms of Matthew's comments here about rather than maybe want to lump
some that they're trying to gain, threat actors, they know that and they're trying to adopt
their tactics to elicit different ways of gathering money.
Actually right here on my other screen, I'm looking at a website that is dedicated to
ransomware and this threat group, they will take that data, they'll post it online and
then there's three different ways that they gather revenue.
They will oftentimes with ransomware, they will have a timer saying if you don't pay
within a certain amount of time, we will leak your data.
They have a payment method saying you can extend the timer for another 24 hours for
X amount of money, it might be $10,000, $20,000, something like that.
There's another way that says delete all my data and get rid of it.
This would be like a, for the company that got compromised, you can pay X amount of money.
The one I was just looking at was $5 million.
The other one was same price, $5 million, but anyone can download that data before the
timer is released.
So there's three different avenues that they're trying to take from the same cyber crime,
which just again is showing that these tactics are evolving and oftentimes with ransomware,
I'm not going to go too much deeper, I promise.
To put additional pressure on you, they will actually call your company saying I know that
you got compromised, I am from that threat group.
Call someone to go take a look at the website and start negotiating with us.
And then we've even seen it before where they start calling your customers and trying to
have your customers pressure you to pay that.
So the tactics are changing rapidly on the cyber crime side of things.
I'll stop there.
I can keep going.
I love ransomware, not supporting it or endorsing it, but it's just a very interesting process.
I think it's absolutely fascinating.
I want to make a quick fix there.
I did say Lazarus.
I meant to say Lapsis Group, L-A-P-S-U-S. Lazarus is an absolutely amazing situation that occurred
and definitely those books, the book and podcast are fascinating, which is why I misspoke.
This is the group I was thinking about.
I just want to clarify that because it would get confusing with what I said before for Lazarus.
That did not make sense.
Secondly, one of the things that always blows me away with the ransomware side of things
you were talking about, Nate, is just how good the support of some of those websites
are.
Firstly, the websites look more professional than your average website does in general.
On top of that, they have incredible support teams on hand that they're paying large sums
of money to guide you in how to pay their ransom, how to buy Bitcoin quickly and easily
so that you can send it straight to them.
It is horrifying how well they've corporatized that side of things.
You also mentioned the threat of it, calling people up, threatening them, calling their
customers.
These are things that we see done elsewhere, but when they're put here and you're also
feeling that pinch of your data being gone or missing or just inaccessible, that's a
lot.
It does work.
That's the next thing I wanted to talk about with this, which is the biggest – what was
that?
Sorry.
I was just going to say my favorite because with these ransomware negotiations is when
you join the chat and it says, hi, how can I help you today?
You know how you can help me.
High quality customer service.
This call is being recorded.
I'll say one thing and then I'll let Matthew keep going, but these are oftentimes full
organizations.
Just like you have your own business, they have their own business.
They've got sales.
They've got support.
They've got engineers.
They've got leaders of that group managing the different teams.
That's my little blip there, but Matthew, sorry.
No, no.
I'll not jump into that too much.
There was a ransomware group that came up about a year or two ago.
They were only around for six months and they made something like $38 million.
Of course, they have a whole team.
It makes sense if they're going to make that much money.
Then they disband and move on.
To go back to what I was saying, the most effective way that these criminals work is
by making you feel fear.
When they make you feel fear, they make you feel a sense of time criticality.
If you've ever received any of those emails requesting that you buy something to do, gift
cards or anything like that, you know that when they're doing that, they're saying, we
need this or we'll lose a customer.
We need this or we'll lose XYZ.
I need you to pay this right now or something bad will happen.
We've seen some truly horrific ones come around more recently.
We may get into those later.
The general point is they're going to try and say you have to take an action that you
don't think you need to take or that you should take without speaking to anyone else so that
we can be sure we fix this problem that you haven't yet confirmed exists.
ransomware is a bit different, obviously, because you can probably see your data disappearing
or getting crypto locked right in front of you.
But generally when it's a phishing or a scam or anything like that, don't try to confirm
this, just pay us.
That is to me at least a surefire sign that what's going on is not legitimate.
If you start feeling that fear happening, if you start freaking out like that, hey,
I know taking a step back or getting off the phone is pretty hard.
Generally most things are not that critical, right?
Business deals, they tend to take a little bit of time to go through.
They don't tend to get signed in a full afternoon for ridiculous amounts of money, especially
not with gift cards.
There's a lot of things that go into those types of it.
But when it comes down to what you can expect if you're the target, whether that's intentionally
or otherwise, is that there is going to be that there is a sense of urgency, of time
criticality, and that you, the person they're speaking to, are the only one who can fix it.
If that feels out of place, if you're feeling, oh, that's not quite right.
I'm feeling really out of my depth.
This is not something that I should have to handle.
There's a good chance it's not.
There's a good chance you can take a step back because personally, I would prefer getting
reprimanded for not having done something like that than the opposite of it.
Hey, I'm sorry, I don't really feel comfortable doing that right now is a much better thing
to have to say than, I'm sorry, I sent $10,000 in gift cards to someone.
So I think that's something I just wanted to recommend is looking out for.
Maybe the whole conversation before that about ransomware doesn't really tie in, but it's
just something that came up with what you were saying, because they do push it and it's
very true in the ransomware side of things because they want that money quickly.
They want to resolve the issue because then they can move on to handling it or committing
the same crime again.
That's the business side of things.
On the personal side of things, just be on the lookout for it.
Yeah, I guess I'll see if marketing has any questions, but I would love to just give a
little bit of depth into just certain types of attacks.
Maybe not even to the corporate level, but then talk about some of the steps or the roles
that happen in these various ones and sometimes how they're chained together.
But yeah, Terri, I don't know if you had any questions before we try and dump it in something
like that.
That is one key element to keep in mind that it's typically not just one kind.
It is several married or mixed into fishing can then be a virus, then it's really hard
sometimes to differentiate and then try to figure out the point of both attacking control
to remediate.
It's hard to separate the different elements because the reaction is going to be different
as well.
Exactly.
And just before you jump into that, Nate, just to build on that.
The forensic side of things of what happens after these attacks when people are trying
to figure out how it all started is one of the most intense things you can think of because
it requires that the person doing that work knows every step of your system, every piece
of hardware.
If you fall for one of these crimes and it does end up getting to that point, the entire
system gets ripped apart because the people need to figure out exactly where it occurred,
how deep into the network someone got, things like that.
The reason for that is, like Ann said, it builds.
You fall for a phishing scam, you then download a file and it gets on your network.
Suddenly it's on six computers and the server and it's extricating data elsewhere to another
network.
What started as just a phishing attack became a full blown ransomware event with a full
forensic team coming in afterwards.
So yeah, there's so much going on and it is tied together.
It is just you very rarely just fall for one thing.
You end up falling for multiple things that results in it.
So if you're feeling uncomfortable with it at any point in the process, stopping there
is a good thing because it often means if they're jumping onto another one, they're
either trying to get deeper into the network or something can place has stopped that first
one from working, which is a great way to know that if they're trying to pivot midway
through, you can also stop.
Maybe make things less bad than they were before or could have been.
So to blend the two of your guys' conversations together there, one example that comes to
mind is a phishing email, right?
Someone falls for a phishing email and this is going to be a legitimate case that CIT
has helped assist with as well.
So a user had clicked on a phishing email unbeknowningly granted access to their mailbox
then and that could be a whole different threat actor.
So they they sent off an email.
Their entire job is just to gain access to accounts.
That's it.
Then from there, they can potentially sell that access and then someone else can come
in and maybe that team is focused more on lawyer transfers.
And so what they can do there is that team will just sit there and monitor your emails
for a given period of time, waiting for the perfect opportunity for a wire transfer.
So Matthew had mentioned I need the gift cards in a different case that CIT has assisted with.
It was the CEO was flying back from China for business and while they were flying, the
threat actor knew that because they had the flight details, emailed the accountant saying,
I had a great time here in China.
I'm looking to do a business deal.
Please immediately transfer.
It was $283,000 to be able to secure this deal.
They process that went over to another country.
By the time that the CEO got back, they said, can you send another one?
And that's that's where the accountant said, OK, by the way, I processed the first one.
Do you want me to do the second one now?
Because I have no idea what you're talking about.
So again, a multi-chained attack that started off with phishing.
Someone monitored emails for a while, led to a wire transfer.
And that's actually pretty common.
We've done that.
We've seen that multiple times.
But yeah, otherwise, there's so many different other ways that this can happen.
So I've seen different groups working together.
So some will set up the servers just to deliver ads, and then they'll rent that out.
And then there's people creating malicious ads, and they'll use that service to pair
that all together and make a malicious advertisement system.
We've seen things like we haven't talked about SIM swapping.
That's a SIM swapping is basically just where you convince the cell phone provider to change
the SIM card from one phone to the other, because that's often where multi-factor is
tied to for text messages.
Oftentimes there's someone who is holding the phone, someone who is trying to convince
the retail employee to sidestep processes, someone who is trying to gather the multi-factor
code at the same time.
They work as a team to try and accomplish that.
Two other ones that I'll maybe quick mention is there are teams that are dedicated to just
gaining access to networks and then stopping and then selling that access to others.
So for example, we've seen it where someone will break into a network and then they'll
sell that access for $600 or something like that.
From there, they're done.
That's their specialty.
Someone else who maybe specializes in ransomware, and there's groups out there that you can
buy their ransomware services.
And so you essentially don't have to be a coder.
You just say, I want to buy this for X amount of money.
You run that in the software, the people that developed it get a portion of that money,
and then you get to keep the other portion because you did the crime.
It's wild out there.
You can hire hitmen.
I don't recommend that.
Also, I guarantee that 90% of those sites that if you ever go trying to look for it are FBI
just trying to get you.
We see all that.
We see that all the time.
But it's a full underground business.
We'll just leave it at that.
I think you make a good point that's often overlooked when we talk about this.
People think of the people committing these crimes as the hackers, as the people who have
spent so much time learning how all this works that they know how to do it.
And to be blunt, it's not really that anymore.
It's a lot of people who just have enough money to buy a version that is currently known
to work, and then they send it to people.
Because if a known company who's done this multiple times can make $36 million or $38
million in six months, someone can just make a million or $2 million doing it on their own
with a little bit of scripting work.
With my compliance mind reeling, there is also the element of possible deniability and
separating the individual crimes.
So if someone were to be convicted or brought, have charges brought against them, the idea
of stealing one access or a group of access is not as terrible as gaining access, stealing
information, selling information.
It's all the different steps aggregated that would be the true and the monetary gain, of
course, or the separation of the monetary gain to stay under the radar of what's important
to say the FBI.
We're always going to keep it at a $4,000 steal.
But again, like you were mentioning earlier, a thousand times, then we're at millions of
dollars, but it still was under the radar of the controls set by different agencies and
crime bureaus.
Yeah, exactly.
I want to mention, we've talked about a lot of what is done.
I think we've mentioned a lot of things that haven't really shown any consequences, and
I just want to mention a couple of those quickly.
People going in and buying data, people going in and buying access, there are sites where
that can be done.
Nate mentioned that.
One of the big ones that got shut down recently was breached.vc.
Not only do they get shut down, they were raided by the FBI.
The owner and creator of that forum is currently under arrest, or is as of our last update
on the matter.
And all the information from that site was given to the FBI.
Those people who use that site, those people who signed up just to look at it, they're
on a list now.
There is something like just being curious about this in specific ways is going to have
that.
We sign up and get certifications and specifically work with the good guys because that shows
that we're doing this for research and because that's what we're doing it for.
We need to know where this is happening.
But this is something that is actively charged, actively reviewed, and investigated heavily.
And there are limits to what that money basis is before they get incredibly involved, but
they're tracking all of it just because they haven't found enough reason to focus on one
individual over a giant group yet.
It doesn't mean that the time won't come when they do, and if you're making these types
of mistakes, which you are, because it's all trackable, you're going to be caught.
It's just a matter of time for how long.
And we see this with the Silk Road guys who thought they were getting away with so much
for so long.
Fun fact, he actually tackled in a library.
He was on his laptop and they swooped in and tackled him, and his laptop is now in a museum
if you're interested.
But the one thing I'll kind of put my closing thoughts, because I think we did a lot of
great work telling how fun or interesting this cybercrime could be.
Interesting is different than fun, though.
I did say, hey, there is a motive of being just having fun.
But I guess the one thing that I maybe summarized for my closing thoughts, and it's kind of
writing on Matthew as well here, is these are old statistics, so please don't hold me
to it.
But the last time I looked into this, it was about 5% of all cybercrime has a conviction.
But if the FBI or some other type of investigative agency gets you in their sights, it's over
a 95% conviction rate.
So we also often hear stories of people who did get caught, and it's usually one IP slip
up at some point.
And then that was the main way that they were able to track and start putting that to a
particular individual.
And so the risks, if you're going to commit cybercrime, which we don't recommend, you
can make a lot of money, but you always run the risk of saying, when is my time to get
caught?
And oftentimes it's not even that you may be slipped up, but there's a bigger picture
that starts developing.
There's a podcast out there.
I'm not going to go into the gritty details here, but there's a website.
It was a fairly small site, but it was sharing questionable content that's highly illegal.
And they found one individual's Bitcoin address, found that individual, got them convicted,
and then that turned into a couple hundred arrests because one person slipped up.
So even if you do everything perfect, yeah, even if you try and do everything perfect,
again, the FBI and the other agencies have the resources and the time to hunt you down,
potentially, and make sure you are convicted and brought to justice.
Yeah, so that was a very light closure there.
Yes, but I really like it.
I've always said, if I ever don't show up to work one day, it's because I'm either in
jail making very good side money or I got hit by a bus.
So I'm still here at work, which means I'm not a cyber criminal and I am not hit by a
bus because I fear the felonies and the time of being convicted.
Oh, man.
Wow.
Well, we are very happy you are here and not hit by a bus.
We've got some good people.
Well, committing crimes.
Yeah, or committing crimes.
Yes, we've got good people on our side.
FBI is going to be all over this podcast now.
I know.
Oh, my gosh.
Well, to end, I'd like to end a little bit on a high note, just as everybody's worried.
Some of the things, if you had to pick just one thing, because we will have a podcast
in the future about best practices and what you can do, but what would be some advice
that you would give a person or a business?
I think Matthew, I'm going to take his about just trusting your gut.
I think it was a huge thing if it doesn't feel right, stop, back up, talk to somebody.
But if there is anything you had to share about how to help or prevent or best practice.
Have a full incident response plan.
Have full internet security policy.
Basically have a GRC analyst, as I've said in every.
I've said this during every other podcast about this, but every time I've talked to
someone who has said, oh, we nearly fell for one of those scams, but didn't.
It was because they had rules or policies in place that were like, we always get double
confirmation before we send money.
So someone came to us and said, someone asked us to send all this money and the other person
went, wait, because they didn't have the time crunch the first person did.
They could see the reality of what was going on.
Policies and procedure will save you more times than any specific tool.
Policies and procedures and tools will save you even more.
I'd say start with the basics.
That is.
John Casper, man is running an MFA.
I've mentioned this on other podcasts.
I have sunglasses that are engraved with MFA everything.
And it is because it is so critical.
Really what we have conversations with customers about is you can implement some of these basic
security tools, multi-factor endpoint detection response, and you could pay for those for
10 years at the cost of one cyber incident, right?
And they will absolutely help you far more than that 10 years there.
And so it's just blocking and tackling the basics that if you are joining this for the
first time, please just implement multi-factor wherever possible, especially your VPNs,
your email accounts.
Those two alone will help out a lot.
And the impact to your end users will definitely be significantly less than the impact to your
users and your mental health if you ever have to go through a major security incident.
I'm going to quick touch it down a little bit on the high part is we've had business
leaders crying on the other end and we have to play the empathy to help them through that
situation.
I don't have business leaders crying to me when they're talking about implementing multi-factor.
That's more of just a slight annoyance.
So again, start with the basics.
Yeah, for sure.
All those things.
We've got podcasts on all of them.
We'll put some links in the description.
Thank you, Nate, Anne, and Matthew for joining us today.
If you have any questions, if you need any help, please reach out to us at info at cit-net.com
or head out to our website cit-net.com slash podcast and we'll be back next week with an
all new episode.