Well, this past month on the Tech for Business podcast, we've been discussing a layered approach to cyber security.
And today, we've got Todd, our COO, and CISO, who's going to explain how all these pieces fit together.
So Todd, I'm not sure where you want to start.
I know I wrote down MFA and EDR just because those are kind of the top things you've mentioned in the past.
If you do one thing, here's the thing.
So how are these all fitting together?
Yeah, I love that we started with.
If you do one thing, you should do two, which is me in a nutshell.
So yeah, if we've heard any of our previous podcasts, if you've talked to me, I say there's always one A and one B that you need to do in cybersecurity.
And they are MFA and EDR.
And I know those are analogies.
I'm sorry.
Abbreviations for endpoint detection response and multi-factor authentication.
There's plenty of podcasts out there.
I'm sure you know by now, but just wanted to make sure we level set.
And once upon a time, I used to just say it was just multi-factor.
You just need to multi-factor, you need to multi-factor.
But EDR has really come a long way and the old tools just don't work anymore.
So they are the two, the one-two punch in my opinion that absolutely have to go through it to the point where we've started talking about them as non-negotiables.
And to me, they just things that you got to have.
And if anybody out there is working through cybersecurity insurance or any of those other things also required there.
So one-two punch, one A, one B, you got to have them.
So that's typically where I start every other conversation.
I also recently have been kind of trying to find a way to quickly get in now that you've done those things because most people have.
And I probably shouldn't say that most of our customers have because we are so big on it.
I think the adoption rate for multi-factor is still relatively low, like less than 40%.
I think it's like 38 or something like that industry-wide.
Yeah, the report today, sorry, only because I just saw this earlier that it was like 57% have not or have.
It was 57.
Anyways, we'll put that in the notes afterwards if here's the stats.
But yes, it's around that number.
It's globally.
I'll double check.
Yeah.
Thank you for that.
To me, it seems like it's a foregone conclusion and you should just have it.
We've been screaming it from the mountaintops for seven years.
So that's how long I've been saying that you've got to have it.
EDR, we've only been doing that for about two years now.
But for us as an organization, we work with a ton of different companies across industry.
And we just basically started to push them down the path we didn't really even ask anymore.
We just said, again, it's a non-negotiable.
Back in the day, if you use the analogy where you just got a computer and came with antivirus,
this is the same thing except antivirus doesn't work anymore.
You just need to have EDR.
But as I'm trying to get into the next layer, the big one that I'm trying to make a big push for is end user training slash fishing simulations.
And the reason why I want to kind of get into those details is because to me that this is the layered approach as Ariel mentioned.
What you're doing is you're bringing in a lot of different tools to handle a variety of things.
And the two main attack vectors, well, three, quite frankly, are can I get a username and a password?
So that's where the multi-factor comes in as it's that third item that most attackers can't get.
And then EDR in the event they did get in, what happens?
But the main attack vector is people.
And so you do need to train them.
So if you look at them, two of those things were logical controls.
They're technology.
You buy something, you put it in place.
You don't always have to buy, you may already be paying for something like Microsoft.
But those are those ones are logical controls and you do need them.
But then I think you really need that administrative piece, which is where you're fishing or simulations or trainings come from.
As you're really trying to help the individual recognize things to the point where for CIT, our employees, we fish them every single week, which may seem excessive.
And there is laughing.
So clearly the answer is yes, it's excessive.
But there's a reason why I do it that way.
To me, it's funny.
I don't even actually see I get fished that frequently too.
And I don't even actually see the fishing simulations.
I'm so quick to go garbage, garbage, garbage, garbage, fishing, spam, whatever that I don't even see most of my maybe see one a month if I'm lucky because they just seem so obvious to me now that I've seen them so frequently.
And that's what I want.
I want people to just out of hand go.
That's just trash.
I don't need it.
There are times when something will come in and we're getting close to that season right now.
It's it's fall spooky season here.
If you're watching on video, we've got our cybersecurity awareness month backgrounds on and what's coming up shortly after this as you're starting to get into the holidays and there's going to be all of the attacks that are coming in are going to be right place, right time kind of stuff.
Stuff that's going to go like, hey, your Amazon account didn't work.
Your FedEx delivery isn't here. Your pumpkin spice latte is free at Starbucks this week.
All of that.
All of that stuff is coming.
So those are the ones that the training is really going to kick in, right?
So the fishing simulations are going to get that muscle memory in place and then the fishing simulations are going to make it so you can go.
Okay, I'm going to pause before I print off that fake gift card for Starbucks pumpkin spice latte.
Yeah, I'm sorry about that.
It's pumpkin season for me. It'd be pumpkin beers. So I don't do pumpkin spice lattes, but I would do a pumpkin beer. So if you want to fish me.
That wouldn't work either. Nobody gives me free beer.
So I'll pause there, but that's kind of the thrust of the things that go in. And like I said, to me, they all work in concert. To me, we've been referring to them internally as almost like puzzle pieces, right?
You're starting to put the whole picture together, but it wasn't as simple as I just do this.
Problem solved. It's a piece or it's a layer. There's just multiple things that organizations and individuals should be doing to start to protect themselves. And that's kind of how it all comes together.
So we've got our MFA, which we put as our number one together. And then you've got this training.
And what would be sort of kind of next down the line? Because those do feel like things that a lot of companies kind of had in place.
Where does this list for lack of a battery of phrasing this, where does it start to fall apart for businesses? Where do they kind of fall off the rails with their cybersecurity?
It's unfortunately at the moment, it's still the end user or the person that's clicking on them. So, and it is why I feel like you really need these three things. And but I'll use an example. We had a customer who their organization was doing all the right things.
They had multifactored their email and they had, they call it a sandbox approach. So it opens up attachments to make sure they're not malicious, etc.
And they did not have EDR in place. The individual opened up their own personal Gmail and it looked like they had been, as I said, it's that right time of year.
Hey, you recently purchased something from the Apple store. Here's the receipt and the individuals like I didn't buy anything from that. Clicked on the PDF and it launched ransomware on the company network.
So more often than not, it's kind of like a not quite complete security profile. So they have bits and pieces, but they don't have them together. They don't get the layer. So they're not quite putting the pieces together on the puzzle or they've got a missing piece.
And so the attack came through that hole, if you will.
But assuming you do have those things in place, things still happen. Unfortunately, not nearly as frequently and really training those three things to me.
If you're doing them and you're really paying attention and it's really hitting home, you will protect yourself from the vast majority of things out there. So, for example, we have had people that do have MFA in where you push to the phone that says, Hey, did you log in?
And we've actually done this through penetration testing where we're going, well, we're never going to get in. We're stuck on the MFA and the simulated attack says, well, I'm just going to push the MFA and see what happens.
And we've had users go, yep, that was me. And then they got in there like, are you kidding me? How did this happen? And that's where the training piece comes in.
You need to know that I didn't actually enter my credential. I shouldn't be prompted. So I'm not going to accept that. I should go contact my IT company or person.
But other things that I would typically put in the list is there are some other things that are blocking and tackling for me, which is making sure you've got good backups.
Most people have those today because it used to be the number one way of recovering from ransomware, which is why then people started to pull data out and networks is like, well, if you can recover, I'm going to take the data out and then make you look really bad.
So you'll pay me to delete it. So there is another layer that comes into play there. And then we can kind of keep on going because it is a layered approach. And unfortunately, it feels like it's never ending.
And to some degree, that's kind of true. The big trend that we're starting to see on the horizon and I'm kind of getting a little bit away from my course, but I can kind of see this as a future core is that the vast majority of attacks that go into a lot of software is currently,
whether it's Microsoft or something that's relying on open source is what's referred to an escalation of privilege.
And that is we're trying to get access to an administrator account so I can install something else like that. That MFA. I'm sorry. The PDF. For example, that I was doing is what happened is after that PDF opened, it tried to launch another program and that's what launched the ransomware.
If the user doesn't have admin rights, you can't do the install. And I'm sure most people have seen that right. It says, are you sure you really want to do this install and everybody automatically hits yes. That's because you have the admin rights.
Yep. So the new thing that's coming on is called privilege access management. And that's the next thing that I can kind of see as being the easiest way to stop you from installing software. You shouldn't just take away those credentials.
So you can't do that. Does that mean that's going to be infallible? No, the bad guys are really motivated because there's a ridiculous amount of money in attacking.
But for now, it's a tremendous toolset and I would anticipate within the next year or so. You'll hear it from us, but you'll see it start to really take up as the next big thing you gotta have.
For sure. I asked this last week with Nate and Andrew, our guests, but I'll ask it again just to get kind of a different viewpoint is if you're an IT admin and you're like, yes, I need all these things.
How do you start that conversation with your business or your C levels or are reaching out to a tech partner? What does that beginning conversation look like?
Yeah, great question. I do have a C title, so I typically approach things slightly different.
That's great. Yeah.
I want to hear that part.
There's a couple of things that I would typically start with. One is you just start having conversations, but how you frame those conversations are what matters.
And depending on who you're talking to is going to resonate a little bit differently with different people in the organization. So for example, if you're trying to pitch selling something to a CFO, the most important thing to them is probably going to be the dollars.
And so you just need to be aware of it when you start to go into those conversations of what am I paying for and ultimately what's the return on investment.
You're talking to a CEO. You're talking to him about risk. This presents a risk because I now use ransomware as a great example.
If you look at the statistics and you go search them, the statistics are scary as can be. You'll see that they'll say the average attack is $4 billion. That's not accurate.
It is for some industries, but it's not accurate for all industries. We're in the small and medium-sized business industry and those on average are right around $250,000 is what we're seeing most ransoms coming in.
That's for a variety of reasons. One is because insurance companies will negotiate, but also it's underneath a threshold if you will that will get too much attention from the authorities.
You start bumping over $500K and the FBI cares. You stay under that. There's too many of them to worry about.
But let's just use EDR as an example. I feel like I need to add EDR because it's going to reduce the risk of ransomware attack.
And I can give you an example statistically from CIT's perspective as we were doing multiple ransomware remediations every single week.
And once we started saying it's a non-negotiable, you need to have it, we dropped down to about one a month. So a reduction of probably around 85% of attacks went away just because we were using this tool set.
And of those that we're helping out with, those individuals don't have the tool. So I'm one of those customers. I'm trying to get this through.
I'm going to go to my CEO and say, hey, the risk is really, really high because why wouldn't we attack? No longer is it saying we're too small to not matter.
No longer can you say I live in rural America? I don't matter. That doesn't matter. If you've got an IP address, you matter. And you are prone for an attack.
So I would go to the CEO and say, hey, and I average an attack is going to cost an organization about $250,000. Maybe your insurance covers it. Maybe it doesn't.
And you're going to be offline for two weeks.
By contrast, I can buy this tool set. It's going to cost, and it's just a mythical number. It's based on nothing. I actually couldn't give you some real ideas, but we'll just say that the cost of the tool is about $10,000 for the year.
That's a pretty easy conversation to the CEO. I can mitigate $250,000 at risk for $10,000. I'm in. Where do I sign?
So that would be how I would typically approach it is one of those two ways.
The third way is once you've had that conversation, I would start to put it into a budget, even if your budget hasn't been approved for an IT individual.
You are being asked for your input year over year. What do you think you're going to spend?
I am going to, I'm going to earmark 10K for this thing. And then if it goes through and you've had those conversations, typically what ends up happening is you go, hey, you remember we budgeted for that back in October.
I'm going to pick it up. I'd really like to implement it. The budget's been approved. Are you okay with it? Your CFO is going to go. It was approved. The CEO is on board. Yes, proceed.
Easy, right?
Easy. Easy conversations. I love it.
I'm going to pivot a little bit just because I have another kind of closing question, then I'll sort of open it up if there's anything else you want to share.
But this is a question I asked our other guests for Cyber Security Awareness Month. You know, we're talking about a lot of different tools, a lot of different scary situations, a lot of different numbers and prices and budget.
Why do you do this? Why do you keep coming back day after day and work in security and do this type of job?
The funny response or the real one?
I mean, it's you, Todd.
I'm just going to go for punishment.
No, I mean, quite honestly, if it was the real reason why I got into cybersecurity, I've been working in IT for a very, very long time, and I've always had some aspect of security under my umbrella of authority.
But what really drove it to me is, boy, it's been a little while, but I'll just throw the number out of about seven years ago when we started to, in my opinion, really see the uptick in security risk increasing.
At that time, I was going, things are going to get really, really bad.
And I want to get in front of this. And so I happened to be working at CIT at that time. That's roughly about when I joined and I was working with our CTO at that time, who's now our president and CEO.
And I was going, it's going to get ugly. And our customers are going to come looking to us saying, what do I need to do?
And our response together was, well, we need to be in front of it. Being always behind and trying to help people recover just stinks. And it feels terrible for us. It feels terrible for the customers.
How do we get in front of that? And being able to be a part of an industry where I can try to push the charge and saying, here's how you can do it. It isn't as bad or as scary as you think it is.
We do know how to help you get to a defensible position. That's meaningful to me. There is that, I don't know if it's altruistic or intrinsic or whatever the driver is ultimately for me, but that's, that's what I am.
I'm a fixer to a large degree and being able to communicate to individuals that here's where you're at, but we can get you to where you want to be by doing X, Y and Z is incredibly meaningful and fulfilling for me.
That's great. It's, it's, it's so good to hear kind of that human element, especially from people who work in tech, but it really is about the people in the businesses. So thank you so much for coming on today.
If you enjoyed this podcast, please like, subscribe. If you have a question or a topic, please reach out to us at info at cIT-net.com or head out to our podcast cIT-net.com slash podcast and we'll be back next week with a new episode.