Well, before we get down to the nitty gritty of everything fun about cybersecurity reports,
I wanted to put the question to both of you.
I know we've had it before, but what's on repeat currently in your playlist?
What's getting you through the workday?
I'll go first to give you two just a moment to think of your response.
I've been listening a lot to the Bear McCreery, Apple, Radio, whatever you do right with the
artists that I've pretty much been like at started without Lander, and then the amount
of productivity that I've lied myself that I've been able to accomplish through soundtracks
has been 100% that soundtrack on repeat.
What about you, Matthew?
I am listening to Noah Cahan's Stick Season that came out, I think, a month or two ago
now.
Highly recommend it.
Very fun album.
So good.
What about you, Todd?
Here has been a five-year-old in my house and so Baby Shark with a bullet.
I'm just kidding.
I mean, that is plain, but for me, the song that's been on repeat for whatever reason
is called The Loneliest by Maniskine.
The band in general has been kind of on my list, but that song for whatever reason has
really stuck with me for the last week or so.
Nice.
And Baby Shark.
Yeah.
And Baby Shark, adding both to my up next 100%.
Well, awesome.
As to why we're sitting down today, sadly, it's not to talk about Baby Shark, but it
is for the Tech for Business podcast that we're sitting down and talking about insights
from that 2022 ICCC report.
Lots of acronyms.
I'll let you guys explain it, but as to who we're talking to, who you've heard so far.
I'm Kelsey.
I'm a member of our marketing team, and I'm the moderator.
Matthew is our GRC analyst, and Todd is our CISO and COO, and I'll let you guys take it
away for what is it and what is the report talking about?
Definitely.
So the ICCC is a segment of the FBI that is about the Internet crime, and I really should
have looked it up again, but it's Internet Crime Complaint Center.
I knew I'd get that.
Just a little stalling is all we need.
And basically, they are a group of people that wait for complaints and respond to them
as necessary, which as necessary is a fun term there.
In short, they're a place where you should be reporting if you have an Internet crime
that is committed against you.
This can run the gamut of business to personal.
People falling for scams or being extorted, blackmail, etc.
Those included here, if it's being committed online.
Bullying and harassment are included as well, and I highly recommend anyone going through
anything like this does report as much as they can.
It's always useful.
It's very helpful.
I've had instances where I've used it for reporting previously outside of my job.
So I can't recommend it highly enough.
As part of that, I like to keep up with what they report every year, as a lot of us do.
And their report from last year has come out based on all the complaints that they received,
which amounted to approximately 2,000 reports a day.
So as mentioned, this includes information related to both the business side of things
and the personal side of things.
But it's a very good insight into the attacks that people are talking about and what the
monetary losses of that can be.
Yeah.
Yeah, one brief little thing that I was going to add to that is, if you're not sure what
ICCC is, and you were going through some sort of incident, if you have cybersecurity insurance
or if you're working with a party that tends to get engaged in those processes, they'll
typically get engaged for you.
So it isn't something that you need to have the deep knowledge of the what, the how, etc.
Those people will tend to help you through that process.
And then I did want to kind of expand briefly, and I will try to stay brief for a change,
on one of the comments that Matthew made is, when do they get engaged?
And I would echo what he said is, anytime I would report basically everything, and I
think it's the appropriate thing to do.
What we typically see for engagement is if the event is less than $500,000, they typically
do not get engaged.
The caveat being, if money leaves the United States to another country, they will always
get engaged, which actually does lead to one of the interesting statistics that's in the
report.
I don't know if you've got it off the top of your head, Matthew.
I can look for it real quick, but I wanted to say it was something like 73% of all funds
were recovered by the RAT team.
Yeah, I think it was around 73%.
We'll get to it.
I think I've got that number specifically written in here.
Yeah, 73% success rate in freezing payments and, in their words, keeping money safe.
So I'm assuming, and we're assuming that that means didn't leave the country was blocked
prior to being exported in any way.
I'm a little bit ahead of myself there, but I do think it's interesting that when they
do get engaged, they are very, very successful in what they do.
Exactly.
And on that, one of the things I do want to mention is you said, like you mentioned,
the insurance companies, these sometimes are filled out by them as well.
It'll be as part of their internal process.
Sometimes it'll reach the point where it's blocked by, say, your bank first.
And so I have had instances where customers were falling for these and were attempting
to send wire transfers and their banking team caught it and blocked it.
Your report, you should be reporting as much of this as possible.
This is not just going to be me repeating, please report everything to the ICCC every
sec, every five minutes, but I'll try and stop mentioning it.
But please do anyway.
Yeah, I agree.
In case you're wondering, I do agree because they will look at things in aggregate too.
So even if your event is less than 500,000, if it does get to a point where it's an aggregate
and they're seeing it's the same threat actor, they will again get engaged and they will
take action.
So we'll be adding the link to the report to the notes of this podcast.
So please have it open if you want to kind of follow along.
It's very dense, but there is a lot of information, especially at the end that covers some of
the definitions we're using.
So if there is a term that we use that maybe we don't expound upon as much as we probably
should, it is covered in the document and that'll be a good way to review it.
Diving into the big thing that I think this is based around and the main thing that they
work on obviously in terms of being on the monetary and blackmail and extortion side
of things.
Last year, there was $10.3 billion in losses from scams, extortion, blackmail and all other
forms of crime that were submitted via ICCC.
That's so much.
I know it's an increase from last year as well, but it keeps growing.
Yeah, we often do cybersecurity training and typically we start the process of a lot of
people want to understand what's going on in the world and that kind of gives you the
context of what's happening.
Unfortunately, there's a lot of the term in cybersecurity is again another acronym because
why wouldn't there be but it's called FUD which is fear, uncertainty and doubt.
But the point I was trying to make in this particular instance is people are like, well,
why do they keep attacking me?
Well, $10 billion is an awful big reason to continue to do it.
Exactly.
So that'd be kind of the basis of why you're typically seeing most of it as almost all
for financial gain.
Yeah.
And Todd, you and I were speaking about this not too long ago and we've done this in a
previous podcast, the large hacking groups work like legitimate businesses.
They aren't obviously because it's a crime, but they work that same way.
They have fantastic looking websites with very easy support systems to help you pay.
There are jobs posted online looking for people to do this work, to assist them, to put together
the websites and those support teams and be part of the chat team.
It is growing because of that price.
For context, over the past five years, there's been $27.6 billion in losses.
So last year's $10.3 billion accounts for more than a fifth of that.
It's growing exponentially.
In 2018, it was just $2.7 billion.
So it's grown almost four times in five years.
When we dig into those numbers more and what that actually looks like, of those of that
$10.3 billion, $4.9 billion of it was from people over the age of 50.
So that was monetary loss from that.
Now, this document doesn't break down whether or not that was business related or personal.
So we can't define how much of this was from business loss and how much was from personal
loss.
But we can say that phishing is still the top form of crime that's committed in the main
attack vector.
But business email compromise was ninth on the list and accounts for $1 billion in losses
on its own.
So if we ignore the split of ages and go purely for what the attack vector was, there's a
lot of money here that's coming out of businesses from a direct email compromise that may also
include additional money from other sectors.
I have a lot of opinions on this.
So I'll pass it off to Todd first before I just keep rambling.
No, I think it's excellent.
There were a couple of stats that I thought were interesting.
That's all back up just briefly as Matthew was covering some of the statistics that went
in there.
He talked about being about $10.3 billion in $22 billion.
It was only about $6.9 billion in $21 billion.
Oddly enough, the statistics that are in the report is there were actually less complaints
filed by roughly 40,000 less reports and yet the increase was over 34% more dollars out
there.
So when Matthew says they're getting bigger and bigger, 100%.
Going back to the phishing comment, the reason why business email compromise is not as much
of an aha.
It's only that $1 billion again only.
It was only $1 billion.
I think the big threat that we're still seeing is ransomware and there's other types of
attack types that tend to be very heavy in the dollar amounts.
Business email, I'm sorry, email phishing is still the number one, obviously, form that
that process begins.
We've talked about it at Nazium.
Anybody who wants to go under the Wayback machine to 2022, there is an MFA and there
are EDR podcasts out there too.
So there's some really good content on how you can protect yourself against those types
of attacks.
Yeah, there's so much of it that comes down to what we call the attack vector, right?
How did it get in?
And while some of the things we're saying, like a business email compromise and phishing
may seem like they go hand in hand, we could spend the whole podcast explaining how they
don't or how they differ or how they don't have to when they can be divergent.
So one thing I will mention as part of this is that this is all self-reporting.
So while some notes may be updated by the ICCC to reflect information they have, keep
in mind that we can't guarantee the information provided directly reflects what occurred because
it's impossible to know the technical level of everyone who was filling out this form.
So while it does just, I would actually say expand most of these numbers.
And especially the business email compromise number because it does include different actions
and different attack vectors that may have impacted and caused it in the first place.
I don't want to stick too heavily on that, but it is also very focused around numbers.
As Todd mentioned, the FBI, so the team that actually does this work is called the RAT
team, which is just great, they're called the recovery asset team.
So they'll get pulled in for this if there is that monetary value of over $500,000.
And again, we're averaging this number is specific to each incident, but that's what
we've seen.
And then on top of that, it's about where that money's going.
So there is that monetary basis for how important some of these things may be weighted and what
is and isn't included.
We don't have specifics on too much of how that information is coming out, except to
say that they're providing what they provide.
So that 10.3 maybe smaller, maybe slightly larger.
I would say it's probably slightly larger because there's going to be more people who
were uncomfortable reporting information than there were people who under reported what
was taken.
You see a lot of this in the numbers that have changed from year to year.
One thing that hasn't changed is that healthcare is still the biggest sector for ransomware
attacks across the board.
It's still growing by magnitudes.
Yeah, I wanted to expand on that a little bit too.
The way that Matthew phrased it, it almost seems like it's kind of a surprise.
And it sort of is.
And it doesn't seem like it should be a surprise, right?
There's so much information that healthcare has access to.
But I think what potentially gets lost in just the overall thinking is everybody tends
to go healthcare.
That means hospitals and it means whatever.
It doesn't always.
There's a lot that goes into that healthcare category.
That can be your optometrist.
It could be the dentist.
It could be anything, quite frankly, the chiropractor falls into that category.
So there are insurance.
So there's a lot of different areas that fall into that category.
And a lot of those businesses are quite small.
They're just not automatically a massive business like a United Health Group or Kaiser Permanente.
So there's a lot of people that are in those industries and it's difficult for them to
keep up with the cybersecurity, the threats and everything just like everybody else is.
And especially when you're looking at those smaller individuals, it's much, much harder
for them to go, I don't have the people I'm not big enough to afford the multi-hundred
thousand dollar CISO in my back pocket.
Those things are very, very difficult to find.
So it is interesting.
Do you want to get into the states that are mostly affected by that?
I mean, yeah, it starts with California.
Let me, yeah, so it starts with California.
The number of victims for California was almost double that of Florida who were next on the
list.
So 80,000 victims from California, 42,000 from Florida.
Does this represent that California is being more attacked is kind of a question that we
can't answer from this as well.
But it does imply, and when we look at the specific numbers of losses, California had
$2 billion of loss out of that 10.3 came purely from California.
So what I think we can say from this, and I am extrapolating, is that while there were
more, it seems like there might be more of an attack vector there purely based on what
the funds that are coming out of it are.
So that doesn't again mean that any other state is more safe or less safe.
It just means that there's possibly more attacks going to California than anywhere else.
A surprise for me was that Texas and New York are almost neck and neck on here.
I thought there would be a bit of a distinction there, but they're third and fourth, and then
fourth and third based on number of victims and victims of and victim loss.
Yeah, again, it's really hard to look at those numbers and say this is what it means.
And obviously, partially it's got to be population.
So there is at least that factor that goes into it.
But again, it's hard to know exactly what it was.
Was there just a really large breach or whatever?
And I guess we could figure that out if we dug into it deep enough.
But again, this report really doesn't dig into that detail.
I did want to back up real briefly too, because as we're talking about the number of attacks
and locations and whatnot, at the very beginning you did the intro and you talked about the
sheer quantity of dollars that were attacked on the over 50 population age wise.
And I thought it was an interesting statistic for a couple of reasons.
And again, now I'm extrapolating.
I know Matthew mentioned at the beginning, we don't know exactly what that is.
But I was shared a story somewhat recently with Matthew and Kelsey that I had a family
member that sent me a screenshot of the typical pop-up that says, hey, you seem to be having
problems with your PC.
Click here to engage a phone call and we'll help you through that.
And the question is, is this legitimate?
And the answer obviously is no, because Microsoft isn't going to tell you to call them.
That's not how they behave.
But it was targeted at somebody that was well over 50.
And I go, oh, so is it a personal thing?
And there are some statistics in here that how many attacks were personal versus business.
But again, you're still digging into it.
In the context of business, what we typically see a lot of companies do, and maybe this
isn't just the company itself.
Maybe it's a culture.
Or maybe it's just the individuals at the top is you'll often see the people that are
at the board level or in the officer level or that senior executive team tend to go,
yeah, I fully support security so long as it doesn't impact me.
That was kind of the main thrust I wanted to make on talking about this a little bit
more is, what does that mean?
Should I continue to just go, I'm a little wiser since I'm a little older.
Therefore, I can spot a fish or I can do whatever better than anyone else.
Is that a fair statement?
Or should people treat things differently as they understand these statistics?
Exactly.
I mean, there is so much that goes into what an attack is now that knowing that so much
money came from that portion of the population means we should be taking additional actions.
Now, I agree with you.
I've heard from multiple people the argument you can implement it for everyone else, but
leave it for me.
Hard of that is that it is a real interruption for a lot of people.
I have actively had to have conversations which changed the mindset of signing in as
just username and password to not signing in is always username, password and MFA.
If you don't use MFA, you're actually signing in unsafely and changing what people think
of as that initial process.
That's just an easy example of it, but that is the type of thing that can definitely increase
your risk within the space.
There are also attacks of as you get into those positions, there are more things that
you're handling, there's more things you're making decisions of.
The chances of you having an email that would seem obviously suspicious to someone else
being incredibly not suspicious for you and in fact, just part of your regular day increases.
There's a bigger attack vector for the things that you would do as well.
The solution is not treating yourself differently to everyone else.
Yes, it's different.
It is a change the way you may work and it may increase the amount of time it takes you
to do some things every day.
Is that better than a $100,000 fine?
A $500,000 fine?
That's just from the HIPAA perspective.
What if it's an actual ransomware attack and they're asking for $10 million?
What point is you not having MFA on your phone worth that?
Those are things that I focus on and I try to instill when I'm discussing this at that
level is 20 seconds, 30 seconds in the morning to set up MFA and then use it every day, if
that and-
Wait less than that.
Exactly.
If that's not worth the potential of the business losing millions of dollars, there's
a question there as to why.
But the other reason that I believe that age range is so targeted is because you are making
those decisions.
Of course you're being targeted.
We have entire names for fishing at sea level executives, which we call whaling, which is
purely around this fact.
Of course there are going to be more attacks and the monetary numbers are going to be bigger
because there are more resources that you're in control of.
Something that while it may seem like an annoyance, you have this position of power and therefore
should be doing your best to respect and safe keep that as much as possible is where I try
to come down on it.
Especially given these numbers, I will make one very brave prediction.
If you are a healthcare provider in California-
Use MFA.
You might want to use-
It feels like a comedy skit, you might want to use MFA.
These numbers show that there are things that make you a bigger, using that language from
before, a bigger whale, a bigger prospect for these organized teams.
Do what you can to mitigate that.
One thing that I'll add to that very good overview is I don't want to insinuate that
only senior individuals as far as age tend to be in those upper positions because it
definitely is not the case.
There are plenty of smart young people out there that are in those positions as well,
but this information still applies to you where we're just extrapolating on a specific
statistic.
One thing that I would add in addition to when it comes to what else should you do about
it is training.
It's a huge thing.
If you are in a compliance industry, it doesn't really matter what it is.
It is very specifically called out that your senior executive team should have additional
training from the rest of your staff for exactly this reason.
Your board of directors should have specific training.
Your lines of business could potentially require specific training to what the threats
are to them specifically.
But in this case, I think the point that we're really trying to bring home is this impacts
everybody.
I was going to pitch in in the middle of what Matthew was saying and go, but I'm important,
Matthew, I don't want to.
But it's really not true.
I wanted to expand on that piece too, as he was talking about multi-factor and how there
is some friction that goes with it.
It is not always convenient, but the reality is it's not that inefficient.
It's not always that much friction.
If it is, there are plenty of options out there to reduce friction.
The downside if there is one is that friction removal does tend to have a dollar sign that's
associated with it, but there are some excellent tools out there that will help mitigate that
friction for companies as they need it to, especially that group that may feel like their
time is incredibly valuable.
They may be willing to pay for those kinds of things.
I'll agree.
Just quickly on that, there is obviously so many ways to do it, so many different tools.
If you get the right one for your organization, it becomes not just a point of pride, but
a point of excitement.
The amount of times I've been out at implement something that seems like science fiction
and does make life easier at the same time while also increasing security, those are
the moments that I look for the most because it means you're not just making it more secure,
you're creating a more streamlined process.
When we talk about MFA, most people think about having to get a text message or bring
up an authenticator app, but there are hardware keys that you can use, which will sign you
in automatically when you plug them into workstations and provide a fingerprint or an
arse code in healthcare environments.
They can be very time-saving, and that was the scenario I was thinking of.
I had multiple doctors who were annoyed at the login process and then got hardware keys
and would just plug it in and sign in and then pull it out and plug it back because
they were like, look at how easy this is.
If you can save time, especially when you're moving between multiple computers, don't think
of it as just a time sink or as a decrease in availability to your software and hardware
and information.
Look for some of them and remember that while there may be a cost to that, like Todd said,
if it's streamlined your process beyond where it is now, you may actually get a saving out
of it from people being more efficient.
This is not a healthcare podcast.
No, we probably should do one.
What I wanted to emphasize that really quickly too is when you're in healthcare, there are
some people that get paid some significant amounts of dollars, and they tend to be the
ones that are saying this is slowing me down.
When I said that there is potentially a dollar or figure that potentially goes with some
of the solutions to reduce friction to Matthew's point, when those doctors are getting paid
very large dollars, you're willing to pay a couple cents for them to log in very, very
quickly because on the grand scheme of things, that makes them more efficient.
It makes them less frustrated, et cetera, et cetera.
You can see how that would be a huge boom for anybody in that particular industry.
There are absolutely ways forward.
Again, I know I tangent a little bit into healthcare there that I didn't anticipate
doing, but it was just really good information and I felt like we just had to sneak it in
real quick.
Todd, you should have warned me.
Todd, I was reading HIPAA documentation before this podcast, so I've probably guided us down
that as well.
I know we're running short on time, so I just want to mention, definitely read through this
document.
There is risk and awareness of risk that you can gain from reading documents like this
every day or whenever they come up.
You don't have to read them every day like I do.
Keep in mind that it is a select amount of information.
It is self-report as much as we want to take all of this and start making big decisions
from it.
Keep in mind that it's about what's relevant to your business, what's relevant to your
industry.
On top of that, don't use the fact that maybe your state is lower on this list than you
would expect it to be or anything like that as a reason to not care because the numbers
are growing.
Even though your state isn't as high as maybe California, the number for your state is still
increasing.
While people are being targeted, generally these types of attacks happen in a shotgun
blast style effect where it's not just the thing that they're looking for as a big organization,
but every subset and subcontractor and vendor they work with that's being targeted at the
same time.
While you may not be the exact target, you can get caught in the crosshairs of that as
well and that's what you're trying to protect from.
We focused a lot on MFA.
There's a lot of other things that you can do as well, but MFA is a basis and really
everyone should have it by now or should be looking at it at the very least.
I just wanted to mention that.
Any last thoughts from you, Todd?
No, I think we summarized it really, really well.
I think overall, I guess I can throw the training in there again because we did just mention
it, but between those two, those would be the massive thrust.
I'd say these are the good places to focus for this particular report.
There's a lot of good information in there, but that was about it.
That's awesome.
Both of you made that very interesting, which I am not somebody who reads these reports
daily, so thank you.
As we mentioned as Todd alluded to, that we have a lot of previous podcasts to talk about
MFA, EDR, our passwords going away, which covers a lot of this content.
As far as we should do one on healthcare, that's actually, I think, three weeks down
the line we're doing a healthcare one, so we've got it coming.
On that note, this is my marketing promotion to say, yes, please subscribe wherever you
listen to podcasts or watch us on YouTube.
My preference is listening.
But if you want to get in touch with either Todd or Matthew, geek out with them, read
reports daily, get coffee, all the good things, you can always reach out info at cit-net.com
or head out to our website cit-net.com backslash podcast or else this is a bonus episode, which
means we'll be back in less than a week with another episode.