Hey everybody, welcome back to another episode
of Vision Pros Live. I'm your host and coach,
Fletcher Ellingson. And today on the show, this
is not a regular guest. I've listened to his
show, and I would say this. He doesn't know I'm
going to say this, by the way. But if there was
an award that I could give out for Outstanding
Podcast, Noel. I would give it to you. Why? Yeah,
I'm not joking. I've only listened to one of
your episodes. But I so appreciated this almost
theatrical show that you've got set up between
yourself and Moven. And you've got to listen
to a show to find out who Moven is. But first
of all, welcome to the show. No problem. Thanks
for being on it. Happy to be here. And I want
to continue my thought here, but explain who
Moven is in your show, please. Moven is my co
-host. Moven is not necessarily what she appears
to be. It's not her real name because of the
world she comes from. That will be revealed later.
We have a six -month plan here. All right. But
Mobin is a former government employee in the
UK. And I've been doing what I do for 40 -odd
years. She's been, she's what, 15, 20 years younger
than me. And she came from academia. to government,
to the private sector. And she is funny, scary
at times. I do, depending on which episode you
heard, I do occasionally refer to her as my spooky
friend, if that's not giving too much away. And
we do our sessions, our records, we do two or
three episodes at a time, and we do have a plan.
But every so often, I will throw a curveball
at her and not tell her what we're talking about
in the next episode. Normally, it's a third one
we've recorded, and we're just about to go into
post, and I'll just drop a bombshell on her.
She's expected to be talking about something,
and we talk about... I sort of put her in a corner
and... Change it up on her. Change it up on her.
She's threatening to do it to me as well, but
I have control. It is cybersecurity guy, not
guys. I keep reminding her. And I'll jump in
here because for you all listening, I haven't
even properly introduced Noel, but Noel Bradford
is the small business cybersecurity guy. Yep.
And he is... As I listened to him and I was reading
through his website, first of all, look, he's
not in this for the money. He's not in this for
sponsors. He is literally a wealth of genius
knowledge about cybersecurity. And, again, I've
only listened to one episode, and I've got all
these notes that I took from it because you busted
so many myths for me. You exposed the weakness
in my thinking about cybersecurity. And I can't
recommend this podcast highly enough. So Noel
is in cybersecurity. And he reminded me of like
Rami Malek in Mr. Robot, where there's just a
guy who is just kind of incredibly smart. in
understanding the cyber world, anticipating,
and being able to advise, plan, and adapt. So
I can't wait to get into this. But before we
do, we always start off the show with a win.
Because there's a lot of suffering and uncertainty
in the world. And on all joking aside, I always
like to remind people that, hey, what you focus
on, you feel. And we're about to talk about something
that can be potentially alarming, concerning
at the very least. So we want to remind people
like, yeah, there is still good in the world
too. So what's something that's going well for
you, Noel? Well, if we look at the last couple
of weeks, a win for me professionally is when
I don't when i struggle to find something to
do the next podcast on um hasn't happened yet
um but every so often we have a we have a list
as i say we have a plan um and every so often
we end up scratching stuff out because it's no
longer applicable or it gets replaced by something
more important um so A win there is that the
world is a slightly better place from a cybersecurity
perspective. There are less companies being breached,
especially in my particular niche. So that's
a win there. Personally, it's getting through
the week without killing any of my customers
or my management. I have a day job. This isn't
my day job. This is a weekend, evening, anytime
I can fit in kind of thing. It's nearly 10 .30
in the evening here. I'm that cantankerous, veteran,
grumpy IT guy in my day job. I look after 300
companies' IT, and we go from everything from,
oh, I've got my password, to, oh, we've just
had a call from GCHQ, we've been hacked. Yeah.
And anywhere in between. Yes. And so... A good
week is where I actually finish Friday and can
put my feet up and concentrate on what I really
want to be doing, which is the education piece.
And this weekend was a good weekend. Last week
was a good week. And today's been for a Monday.
Not too bad. All right. We'll take it. All right.
We'll take that. So Noel specializes in his.
and educating small businesses about cyber security
and i'm going to just rattle off a few things
that uh that stuck out for me okay because i
you exposed my my ignorance in the because what
i thought was that i'm too small to be noticed
okay if i had a hundred bucks for every time
that was yes so what what you said was is that
Actually, small businesses are the low -hanging
fruit. They are the extremely low -hanging fruit
because they have looked to an enterprise company
because that enterprise company has enterprise
marketing, a budget for enterprise marketing,
but not necessarily enterprise cybersecurity.
And so that was for sure my thinking, like, oh,
yeah, I'll just hire these people. They've got
a huge budget for advertising, it would seem.
I'm assuming that it's the same for cybersecurity.
And what you're saying is, no, not necessarily
so. But then you went on to say that it's not
that I'm even the target. What you and Marvin
said is that they come in my door because I'm
the low -hanging fruit, and then they make these
lateral moves. And that's what they're really
looking for. And you talk, I think you all refer
to it as island hopping or something. But yeah,
so tell me a little bit about this incorrect
thinking that if you're too small to be a target.
There's no such thing as somebody not being a
target because there are no targets unless you
are big corporate. What happens is you will appear
somewhere on a data bridge, your email, for instance,
and the data brokers have got you and they've
sold it to some guys who've sold it to some guys
who've then leaked it to the bad guys. You will
then go in a phishing scam. You'll get hit by
phishing email after phishing email and they're
getting so good these days. It's not like the...
dodgy Nigerian prince or anything like that anymore.
These things are plausible. And all it takes
is one person within an organization to click
the wrong link and the guys are in. However,
that being said, they can be in your systems
now and you wouldn't know it. Yeah, you said
on the show, you said they... Before you know
it, they may have been in your system for weeks.
Months. Months. The average dwell time in the
U .S., i .e. the time between the breach. Where
was I? We were talking about, yeah, they've been
in your system for months. Dwell time, yeah.
So they've probably been in your system by the
time they're detected. There's a thing known
in the industry as dwell time. Dwell time is
the time between the initial incursion and them
being discovered. It's got better over the years.
It's now measured in months. This is in large,
large, large corporates. But large corporates,
large enterprise have people whose job it is
to notice. SMB, small, medium business, doesn't.
Most small, medium businesses don't have an IT
team. They have people like me. And as such,
the enterprise level tooling, the enterprise
level IT budgets that you were mentioning earlier,
just don't exist. And the concept that you are
too small is not so much that you are targeted
because you are small, because they're not targeting
anybody, they're targeting everybody. So this
email goes out, it's random. Someone, somewhere,
law of averages. You know that, I know that,
we all know that. It's marketing. It's law of
averages. Somebody, somewhere will be interested
and click the link. We've done tests for customers.
I do it on a regular basis. The best one is 50
% off Airbnb. Click here for your free voucher
code. Concert tickets or theatre tickets or,
you know, whatever. It's playing to the psychological
level. And as such, what happens is they're in
your system. They'll have a look around. They'll
go, okay, who's his customers? Who's Fletcher's
customers? And they'll have a look around, work
out who might be interesting, and then start
targeting them. But they won't be targeting them
on a purely random thing. They'll be targeting
them as you. Okay. Okay, so that opens a door.
Now, a lot of small companies are all interconnected
electronically these days. They have systems
that talk to each other. Those are back doors,
potentially. And it just spirals from there.
It spirals from there. And eventually, you know,
the Kevin Bacon game, get to Kevin Bacon in seven
people. You know, you might not have a... customer
that's got VIP level customers, but they might.
One of your customers might, or one of your customers'
customers, and they just walk up the chain. Each
time getting more and more plausibility. Or they'll,
if you're a marketing company, say, they'll say,
oh, so -and -so, who they know is the marketing
company's um customer recommended that we talk
to you and they so they've just hopped a whole
island they've got bona fides they go in the
front door they'll have a conversation emails
will get exchanged documents will get you know
have a look at this pdf or have a look at this
document and then it just moves on and on up
and up and up and up and eventually you are hitting
government you are hitting large wow Wow. We're
hitting CEOs, CFOs, CIOs, you know, et cetera,
et cetera. And at that point is where the value
all the time that's being put in pays off. The
biggest worry now is they can do all of this
automatically with AI. AI doesn't fall asleep.
AI learns from its mistakes and will keep pushing
and pushing and pushing. Wow. It was very prevalent
at DEF CON in Vegas last week. I didn't go, Movin
did. And we put an episode out today about the
whole thing. And it's very interesting that the
attack speed is just vanishing. It's commoditized.
Some of these bad guys are running cyber attack
as a business. wow services payment plans ransomware
negotiators you know the whole lot you pack they
take a cut you get you you infect a bank a hospital
a government department or whatever whatever
that you they pay up the ransomware guys just
take a cut it happened over here recently um
There's been stuff with, you heard of Workday,
the big HR platform? I have not, no. Big HR platform
that's just announced a couple of days ago that
they've been breached. And we're talking one
of the alleged ransoms was for bitcoins, which
is about half a million dollars. Yeah, it's a
half a million dollars about, yeah. Yeah. So,
you know, when you look at it like that, it's
actually quite scary. Yeah, that is wild. So
as people are listening to this and small business
owners, because we have a lot of small to medium
-sized business owners listening, they may, again,
thought they're too small, they're not on the
radar. What we want them to know is, no, no,
no, completely on the radar because everybody's
on the radar. And you're just one door through
which they can enter. And you have, I think you
said... lots of small businesses, they have an
average of 50 third -party vendors that they're
dealing business with. There are doors all over
the place that expose your vulnerabilities. In
light of all of this, where does a small business
start? How do I tighten up my security here?
First acknowledge, take your head out of the
sand and ask yourself, what is my risk appetite?
What am I willing to risk? Am I willing to risk
it all? How long can I be without my systems?
If I took all your computers away from you, Fletcher,
how long would you be in business for? That's
the question to ask yourself. Yeah, I mean, I
could get back up because of the nature of my
business in a couple of days, but I'm just a
very, very small business. But this is the point.
You know, if you're, say, a, I don't know, a
car accident repair service company, you know,
when you bend your car, you take it in, everything's
digital. Well, at least it is here. from their
supply chain to their work coming through from
the insurance companies, not just walk -ins,
their payments, credit card taking, all of that
kind of thing, all the POS stuff. You're looking
at how many days can you be out of business?
How many days can you lose your systems? If you
lost everything and had no backups and there
was no easy way to get them back, you would call
someone like me in my day job. I would bring
my team in and go, okay, before I walk in the
door, I want 20 ,000 pounds, please. And I want
it in cash or I want it in the bank before I
step across the threshold, even before I leave
the office. Because unless you have got insurance,
and if you haven't done everything we'll cover
in a minute, you might be paying for it, but
you haven't got insurance, then you are in a
situation where I've got to take a risk. I've
got to say, I've got to commit some very expensive
resource to me to containing... fixing, et cetera.
Typically what happens is we rip everything out
and just put new stuff in. Wow. That's expensive.
That's expensive. And you're stuck with supply
chain lines. You know, I could, if I had to put
a new server in for somebody, I need six weeks.
Realistically, either I've got to keep one on
the shelf that will fit all my customers, which
is going to be a hundred thousand dollars. Well,
or I've got to order one in specially. and all
it takes is a ship jackknifed in the Suez Canal.
Yeah, exactly, right. Or storms going around
the Cape of Good Hope. Yeah. Or something going
on in the Panama Canal, and you're stuffed. You
just can't get the kit. So let me ask you a question.
Again, totally ignorant in this area. cyber security
insurance becoming a thing now cyber security
insurance is like any other risk it is a business
case it's not a technical thing so if you would
insure against public liability if you would
insure against theft um anything like that cyber
cyber insurance especially this side of the atlantic
is quite a big thing the payout percentages are
Claim to payout is about 40%. So not high. Not
high. You make one mistake, or you can't prove
something, then the insurance companies, let's
face it, insurance companies never like paying
out. So the insurance companies will say, no,
we're not paying your couple hundred. thousand
pound dollar claim. There are things you can
do to mitigate it. And I had to double check
this before we said we were speaking today. Let
me explain how we do it here and how that translates
to a US market. All right. The UK government
created a thing called cyber essentials. It's
a pillar of five. It's a framework, security
framework, which has five pillars. One, firewalls.
Two, secure configuration. So that means, you
know, access control, not logging into your own
machine with an administrative password. So if
you use Windows, you try and install something,
it won't let you do it without putting in a physically
separate password. and things like multi -factor
authentication, so the code to your mobile. You've
got malware protection, so that's your antivirus
that we used to call antiviruses, endpoint protection
malware, and then patch management. Are you a
Windows guy or a Mac guy? Windows. Windows. So
on Tuesday last week, about this time, It should
ask you to do an update. Have you done it? Gosh,
I don't even remember seeing it. Every second
Tuesday of every month is Patch Tuesday. Microsoft
releases its updates, some of which are security
-based, some of which are quality -of -life -based,
bug fixes, all that kind of thing. So last Tuesday,
yeah, Tuesday last week, um was the yeah it was
last tuesday um was patch tuesday okay i'm going
to look into it but 50 of those listening to
this haven't done it i i know i haven't i unless
unless it unless it did it automatically it can
do it automatically that is valid but if you
ever see a little sort of like a recycling symbol
with a little orange dot in the bottom by your
clock That's asking for an update. I see it right
now. Your device needs to restart to install
updates. Yep. Thank you. Okay. The way I deal
with it with my customers, bear in mind we've
got hundreds, is we manage it for them. Got it.
So my team will take those updates because Microsoft
have form of setting out stuff that will brick
their kit. I'll brick your PC or cause it to
crash. The famous blue screen of death is now
a black screen. That was an update a couple of
months ago. Then we check it. We have a few Bastion
machines that we just have sitting around that
literally just constantly getting updated. And
we make sure that they will work. Got it, and
then we release it to our customers now going
back to that framework. We call it cyber essentials
Mm -hmm is the CIS CIS a have something similar
based on our program or the UK program and With
cyber essentials the way it works in over here
is you self -certify so you have a Whole bunch
of questions that get updated every couple of
years and you have to Basically has to be signed
by a director So I do it for my customers. I
do it for us my day job and it's basically have
you seen each of these five pillars taken care
of them Here's detail. Tell us what version of
the browsers you're using. Got it. What version
of Windows you're using. What's your antivirus
called? So if nothing else, you are doing an
annual check. Got it. Okay. They then take that
to another level. As I say, it's self -certified.
You sign it off. You submit it. They'll come
back and ask questions. I have never, ever submitted
one and not had questions back, and I've done
hundreds. It comes back. The auditor will ask
you some stupid question because you haven't
put a dot in the right place or, you know, stood
on your head, stood on one leg, bounced up and
down while you signed it or something. And then
after it's gone back and forth a couple of times,
they send you a certificate. Depending on who
and where you get it, that can come with up to
a quarter of a million pounds of insurance off
that, $350 ,000 of cyber insurance. Cyber insurance
that is covered by the things within Cyber Essentials,
not everything else that goes around it. Got
it. The US version is called, funny enough, CISA,
Cyber Essentials. And they've expanded it in
some places. They've watered it down in others.
It's just, you know, margins. They have six tenants,
the leadership. so the management of your business
and the technology etc um your staff so training
your staff um the workplace you know do you have
locks on the doors it's it's that you know it's
that yeah yeah yeah um and then how you protect
your data how you protect your tech and how you
would respond Now, Cyber Essentials, the UK version,
has a second tier, which is audited by a real
auditor. You submit your audit, your self -certified,
and they basically say, okay, now prove it. Got
it. I want to see X number of computers. I want
to be able to run this audit on them. Are they
up to date? Have they got antivirus? Nobody's
logging in as an administrator, that kind of
thing. They'll do a pen test, so they're checking
the ingress into the business. So they are checking
the external firewalls, and they're making sure
you're running the latest windows, et cetera,
et cetera, et cetera. So that in itself is one
of those scenarios where if you were to come
through us to arrange it, through the day job,
um we'd say okay right you do this we stick a
little agent on every pc we are continuously
monitoring if something changes we know within
15 minutes got it and we'll give you a quarter
of a million pounds worth of cyber insurance
interesting and it's not expensive for a typical
smb say 20 15 to 20 people you're looking at
probably about 4 000 pounds a year so 5 000 Your
insurance premiums that. Right, right. And that's
obviously well worth it. Gosh. All right. So
unfortunately, we have to wrap up. We're definitely
going to have you back because I have got so
many questions. This is fascinating to me. And
to you listening out there, I really hope you
get something out of this. And ask yourself the
question that Noel said, that he asked me, like,
if you were hacked and everything was shut down,
how long can your business sustain that? You
know, is it one day? Is it two days? I mean,
obviously it's not going to be one or two days.
It's going to be much longer. But how long? realistically
can you sustain your business that that kind
of loss and if i mean pay attention to your answer
and if and if it begins to cause concern or frighten
you like begin taking action there thank you
for being here today i'm really happy that you
tuned in to vision pros live i'm looking forward
to seeing your reactions as these episodes continue
to move forward this is going to get more and
more fun we'll have more and more engagement
as well we'll invite people to participate in
the show and thank you for giving us your time
and attention have an excellent time building
out your vision and becoming a vision pro yourself