Scott Alldridge: Zero-Trust Cybersecurity: The Key to Staying Safe | DSH #1513

Summary

Digital Social Hour: Scott Alldridge – Zero-Trust Cybersecurity: The Key to Staying Safe | DSH #1513

Date: August 28, 2025
Host: Sean Kelly
Guest: Scott Alldridge (Cybersecurity Expert, Author)

---

Episode Overview

In this episode of Digital Social Hour, host Sean Kelly delves into the evolving, increasingly perilous landscape of cybersecurity with industry veteran Scott Alldridge. Their candid conversation unpacks the realities of modern cyber threats, the concept and necessity of "zero trust" security, how hackers are getting more sophisticated (and organized), and practical guidance for businesses and individuals to protect their digital lives. They also discuss alarming state-of-the-art threats, like AI-fueled attacks and quantum computing, pulling back the curtain on how the "bad guys" are currently outpacing defenders.

---

Key Discussion Points & Insights

1. The Expanding Threat Landscape

• Explosion of Cyber Attacks:
  • Hacking is no longer a niche activity; it's global, organized, and targets everyone from major corporations to mom-and-pop shops.
  • "It's crazy world out there. There's just so many threats and things that are going on that it's almost hard to get your head around the growth of the cybersecurity hacks and the ransomware stuff that we read about really almost every day in the news." (Scott, 01:33)
• Hacker Organizations & Franchises:
  • Ransomware is franchised on the dark web, with “kits” and call centers for negotiating payments.
  • "You pay $299, you get a kit, they give you some tools, some training... you can actually join a franchise for ransomware and to do hacking." (Scott, 02:37)
• Crypto as Ransom:
  • Hackers prefer cryptocurrency due to its untraceable nature, making prosecution and restitution difficult.
  • "They want to be paid in crypto, too, because they can't trace the dollars. You know, the FBI or Interpol can't trace them." (Scott, 04:05)

---

2. Zero Trust & New Methodologies for Security

• Assume Breach:
  • Zero trust begins with assuming that your systems will be breached, so security must be multi-layered and continuously verified.
  • "You assume breach... they're going after everybody. And it's become so crazy, it's growing so fast... It's supposed to grow in the next three years to over $20 trillion." (Scott, 04:15, 05:09)
• Organizational Importance:
  • Cybersecurity is now a board-level, business risk—not just an IT concern.
  • "It's a business problem. It's not an IT problem. And that's what shifted." (Scott, 06:36)
• Changing Regulations and Reporting:
  • Most hacks are unreported unless regulations require it.
  • "Right now the latest statistics are, is that seven out of ten hacks don't get reported." (Scott, 07:37)

---

3. Techniques of Hackers & Common Vulnerabilities

• Weak Public Wi-Fi:
  • Public hotspots (airports, cafés) are extremely vulnerable. Hackers can capture unencrypted data streams, emulate your screen, and even copy your device remotely.
  • "You can basically see the streams of data that are going on. And then they have emulators so you can almost, they literally can almost emulate your screen and watch everything you're doing." (Scott, 00:40, repeated at 09:00)
• Social Engineering:
  • Many breaches originate from manipulating humans (employees, customer service, etc.) to gain access, such as convincing someone to reset a key password.
  • "They convinced the call center to change a password. One password cost them over $100 million." (Scott, 10:02)

---

4. Practical Security Steps for Businesses & Individuals

• Modern Multifactor Authentication (MFA):
  • Basic SMS/email MFA can be compromised—app-based authenticators (e.g., Google Authenticator, Microsoft Authenticator) are now recommended.
  • "We're using an app on your phone because that actually has a little crypto key on it. And it's kind of decentralized." (Scott, 12:09)
• Immutable, Off-Network Backups:
  • Essential to have backups that are "air-gapped"—completely unreachable from the network—to avoid ransomware wiping both systems and backups.
  • "You have immutable backups, which an air gap, which means that they are completely separate from your network." (Scott, 12:26)
• Endpoint Detection/Response:
  • Next-generation antivirus (EDR) is a must for all businesses to monitor, detect, and stop intrusions in real time.
  • "Every business should be using some form of EDR... that's a really basic thing." (Scott, 15:25)

---

5. AI, Deepfakes, and The Future Threat Model

• AI in Offense & Defense:
  • Hackers use AI to automate and disguise attacks (e.g., deepfakes for social engineering); defenders use AI for anomaly detection and mitigation.
  • "They'll figure out something with AI that they can do to try to hack people... but then new AI deterrence." (Scott, 13:53)
• End Users as Weak Points:
  • Most breaches stem from tricking users via social engineering—phishing, deepfake requests, etc.
  • "70 to 80% of all hacks... it really comes from the end user that's the biggest threat." (Scott, 13:53)

---

6. Quantum Computing and The Next Arms Race

• Powerful Decryption Threats:
  • Quantum computers can break today’s strongest encryption (256-bit) in just days.
  • "A quantum computer... can break that in usually less than seven days... There's a race to 2030, where a lot of mandates that you're going to have to have quantum post-quantum cryptography in place." (Scott, 37:49)
• Data Harvesting for Later:
  • Hackers are collecting encrypted data now to decrypt once quantum tools are online.
  • "They're harvesting data... they don't care if it's encrypted because they're waiting until they get access to the quantum computing." (Scott, 37:49)

---

7. Compliance, Insurance, and The False Sense of Security

• Compliance ≠ Security:
  • "Checking boxes" for compliance doesn’t ensure safety from a real threat. Ongoing validation and attestation are key.
  • "There's a little bit of a false sense of security there because just because you're checking boxes ...doesn't necessarily mean that you're keeping your system safe." (Scott, 25:39)
• Cyber Insurance Tightening:
  • Insurers are refusing claims if required security controls weren't actually in place and maintained.
  • "Forty some percent also of cyber security claims got denied last year... and it's growing this year." (Scott, 31:26)

---

8. Change Management and Operational Discipline

• Most Breaches Start with a Change:
  • Unauthorized, poorly tracked or untested system changes (by humans or attackers) are the root cause for most breaches and downtime.
  • "No security breach happens without a change or a need for a change. Either I brute force hack something... or I convince you to change something." (Scott, 28:03)
• Leadership Responsibility:
  • "It starts with leadership… you really got to have a strategy and a philosophy around how you're deploying and protecting your business with your cybersecurity." (Scott, 21:37)

---

Notable Quotes & Memorable Moments

• On Zero Trust:
  • "You assume breach... it's no longer about 'if', it's about 'when.'" (Scott, 04:15)
• On Small Business Risk:
  • "They're going downstream and the threat actors are going for very small businesses... you can be a business with 500k or a couple million in revenue and they're going after you." (Scott, 04:15)
• On Social Engineering at Major Companies:
  • "They convinced the call center to change a password. One password cost them over $100 million." (Scott, 10:02)
• On Reporting (or not):
  • "Seven out of ten hacks don't get reported." (Scott, 07:37)
• On AI Deepfakes:
  • "If I become you, Sean, and you've got access to everything... I have the ability to basically have access to anything I want." (Scott, 13:53)
• On Quantum Decryption:
  • "A quantum computer can break that [256-bit encryption] in usually less than seven days." (Scott, 37:49)
• Summary of the Problem:
  • "The bad guys are winning. They're hacking more and more networks, getting paid tons of money, and it's very profitable… Right now, the bad guys are winning." (Scott, 16:35)
• On Cyber Hygiene:
  • "It's just like brushing your teeth—if you do the preventive steps, you'll avoid catastrophic events." (Scott, 22:05)

---

Practical Takeaways & Specific Advice

• ALWAYS update your systems and apps immediately when prompted (24:56)
• Use app-based, not SMS/email, multifactor authentication (12:09)
• Routinely conduct third-party penetration testing; don’t rely on just one tool (34:27)
• Have immutable, off-network backups and ensure you can fully restore (12:26)
• Monitor employees’ change capacity—and have detective controls in place (28:31)
• Review (and don’t blindly trust) your cyber insurance—know the fine print (31:26)
• Don’t assume compliance means security; ongoing attestation and testing are vital (25:39)
• Stay wary on public Wi-Fi, never perform sensitive tasks unless protected (09:00)
• Use encrypted communications for important info (36:43)
• Consider the risk of legacy systems in your network (40:46)

---

Key Timestamps

| Timestamp | Segment | |-----------|---------------------------------------------------------------------------------------------------| | 00:40 | Public Wi-Fi vulnerabilities explained | | 02:37 | Ransomware ‘franchises’ and call centers on the dark web | | 04:15 | Zero Trust approach and “assume breach” | | 10:02 | The MGM Casino breach: social engineering leads to $100M+ loss | | 12:09 | Advanced multifactor authentication and backup strategies | | 13:53 | AI-powered hacking, deepfakes, and the future threat landscape | | 19:04 | SIM-swapping and identity theft using leaked Social Security numbers | | 22:05 | Prevention costs vs. remediation costs after a breach | | 25:13 | Patching/updating systems as essential security maintenance | | 28:03 | Importance of disciplined change management in IT and cybersecurity | | 29:24 | Story of the massive Target data breach via a third-party HVAC vendor (vendor risk) | | 31:26 | Cyber insurance claims often denied; importance of knowing policy requirements | | 37:49 | Quantum computing and the obsolescence of current encryption standards | | 43:12 | Data loss prevention, insider threats, and the need for resilience | | 44:25 | Scott offers free executive-edition book and penetration test (contact info at 36:25, 44:25) |

---

Closing & Resources

• Scott Alldridge offers:
  • A free e-copy of his “Executive Edition” book on cybersecurity (non-technical guide for business leaders)
  • A free third-party penetration test for qualifying businesses
  • Contact: Text “secure” to 541-359-1269

---

For listeners:

Scott’s urgent message is clear—cybersecurity is no longer optional or delegated to IT. It is a business survival issue, and proactive, multi-layered defenses are crucial as hackers get smarter, faster, and richer.

---

Transcript

[Audible Narrator]

The wait is over. Dive into Audible's most anticipated collection, the best of 2025. Featuring top audiobooks, podcasts, and originals across all genres, our editors have carefully curated this year's must listens. From brilliant hidden gems to the buzziest new releases, every title in this collection has earned its spot. This is your go to for the absolute best in 2025 audio entertainment. Whether you love thrillers, romance or non, your next favorite listen awaits. Discover why there's more to imagine when you [e-mail] BestOfTheYear yeah, so if you.

[Scott (Cybersecurity Expert)]

Go to public wi fi, because there's such weak security protocols, so there's little hacks that you can put in and you can basically see the streams of data that are going on. And then they have emulators, so you can almost. They literally can almost emulate your screen and watch everything you're doing.

[Podcast Host]

Holy crap.

[Scott (Cybersecurity Expert)]

Snip, pat word passwords. They can do all kinds of stuff. They can even do little applets to log onto your. Your phone or your mobile device, your laptop, and basically just make a copy of it. Wow.

[Podcast Host]

Okay, guys, we got Scott here today, cyber security expert. What's new with you, man? I know you got the book launch and you're busier than ever.

[Scott (Cybersecurity Expert)]

Yeah, well, thanks for having me on. Really excited to be here. Big fan of you and your show, and so it's really cool. Thanks. But, yeah, I. I live in the world of cyber security. That's where. Where I camp Clash of two worlds.

[Podcast Host]

Right now because I'm in the entertainment business and you're in cyber security.

[Scott (Cybersecurity Expert)]

Yeah, it's crazy world out there. There's just so many threats and things that are going on that it's almost hard to get your head around the growth of the cybersecurity hacks and the ransomware stuff that we read about really almost every day in the news. It's crazy. And it's obviously a global problem, too.

[Podcast Host]

Yeah. Because data is really valuable. So these people or groups want to basically get all this data. Right. That's how they're hacking into these companies for the data.

[Scott (Cybersecurity Expert)]

100%. Yeah. They're. They really want. The data is the value. And certain types of data is more valuable than other types of data. So, you know, they love, you know, health care data, not only for the health care, you know, kind of hr, the doctors and the nurses, but the patient data is really valuable, too. So on the dark web, which is where a lot of this lives, and, you know, that's one of the problems, quite frankly, is it's becoming so prolific for anybody. You know, if you're a middle school or a high schooler that really loves tech and you want to start hacking, just get the Tor browser, go on the dark web, you can actually join a franchise for ransomware and to do hacking.

[Podcast Host]

Wow.

[Scott (Cybersecurity Expert)]

So you pay 299 bucks, you get a kit, they give you some tools, some training, and then if you go out, try to hack maybe some local businesses or whatever, you can, because, you know, you're connected, so you really can. You know, we get hacks from all over the world that come into the US and get businesses, and the other things are going way down to small businesses, but you basically join up a franchise, crazy as it is, and they'll bring in. If you can't hack in, they'll bring in one of their experts, one of the really good threat actor guys, and they'll actually work with you, and then they'll split the profits of the ransomware. So once they get the Bitcoin, and it's a sophisticated world. And the other thing is, is that a lot of times when they finally do negotiate and, you know, they show up with a black screen and all your networks down, I mean, just kind of imagine, you know, your whole thing is whether you're a small business and a coffee business or you're, you know, a hospital, you know, your systems come to a complete halt. So you just get a black screen of death. As we say, it's got a text file. It says, oh, by the way, we have all your data encrypted. Please Pay, you know, 50 Bitcoin to, you know, whatever, 100 Bitcoin or whatever. And so then in a couple of cases we've been pulled, you know, pulled into ex post facto of, you know, ransomware, they're ready to settle and negotiate because they didn't have proper backups. And some of the things you should have in place. And they said, oh, call our 1-800-number to our call center, and they'll settle up the transaction. So they're so sophisticated, they actually not only have franchises, they have call centers.

[Podcast Host]

Wow, that's crazy. A call center just for reaching settlements.

[Scott (Cybersecurity Expert)]

Yep, 100%.

[Podcast Host]

Yeah. Some of these hacks are clever. The crypto ones are crazy because those are hard to trace. Right.

[Scott (Cybersecurity Expert)]

Really impossible to trace. And that's why they want to be paid in crypto, too, because they can't. They can't trace the dollars. You know, the FBI or Interpol can't trace them.

[Podcast Host]

Yeah. So those ones, what can you really do right.

[Scott (Cybersecurity Expert)]

There's nothing you can do unless you go into where I talk a little about my book. We talk about zero trust, which is kind of a methodology, it's about layers of security. But one of the, you know, big prerequisites to this method of zero trust to enhance your cybersecurity is you assume breach. Because you know, we look at all these big companies, you know, even the casinos of they spend millions of dollars on cybersecurity. They have the best and the brightest people, guys that are making half a million bucks a year, expertise, all the tools and yet they still get hacked. So the idea of assume breach if you're a smaller bit and they're going downstream and the threat actors are going for very small businesses. You can be a, a business with 500k or a couple million dollars in revenue and they're going after you, they're going after everybody. And it's become so crazy, it's growing so fast. 10 trillion this year in cyber, you know, hacks that will happen across businesses that's supposed to grow in the next three years to over 20 trillion. Holy crap.

[Podcast Host]

So it's going to double in three years.

[Scott (Cybersecurity Expert)]

It's crazy.

[Podcast Host]

I was just going to ask who the, who the targets are, but it sounds like just everyday mom and pop businesses.

[Scott (Cybersecurity Expert)]

Exactly. And that's really a lot of the reason that I kind of wrote the book. There's an altruism to it that I kind of want to raise the tide that floats the boats of everybody being more aware about security. And so my, you know, the visible op cybersecurity that we, that we, that I wrote is basically been pretty popular because cyber people care about their cybersecurity. And then realizing that the first book, you know, that's pretty big is a little technical. And so for some of the more executive audience I need to pay attention business owners, presidents, vice presidents that maybe are being told by their IT they're good or they have a current provider that's managing their IT and their cybersecurity, how do they really know? So I actually wrote the executive companion that really has no geek speak as they say. It's really written in more plain English. Even like examples like there's a delete and 2 study of businesses like this is what the average spend is on your IT spend and out of your IT spend, your information technology spend on your technology systems. Here's how much you should be spending on cybersecurity. So just like really real world examples of how do you prioritize cybersecurity and are you budgeting enough? And a lot of things in the book is that really a lot of businesses need to go upstream because cybersecurity is such a threat to the business. Like so many risks that really the board, you know, your board and your, and your executive teams really need to be talking about cybersecurity. They need to care about it, they need to prioritize it, which means they're going to budget it, which means you need really smart IT cybersecurity people that are communicating in more business terms. It's a business problem. It's not an IT problem.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

And that's what shifted.

[Podcast Host]

Yeah. I really see cyber security on a, on a pie chart when I look at a business of how they're spending money. Very much so at my level at least I feel like the top companies probably spend a lot of time but when I look at six, seven, eight figure businesses, I don't see too much spend there.

[Scott (Cybersecurity Expert)]

Yeah, exactly. And that's, that's the problem domain I guess at this point. And so getting businesses to recognize how, you know, prolific and real the threat is and that they are target is really important. And there's a lot of people, you know, an IT in some ways is kind of its own worst enemy because a lot of times you have pretty good IT systems. They just kind of work and everybody expects them to work and then when they don't, everybody freaks out. Even though they'll tell you initially, well, we can handle a little downtime. It's not a big deal. It's kind of the same as cybersecurity. It's a little bit out of sight, out of mind. So it's not really in the forefront of thought and that has to change. And it is changing because you know, you just read the news, you know, it's almost every day you're reading some hack somewhere. The other thing is not only you're reading it like that, you know where it's so prevalent and common. But right now the latest statistics are, is that seven out of 10 hacks don't get reported.

[Podcast Host]

Wow.

[Scott (Cybersecurity Expert)]

Because you only have to the Trilite from Therasol.

[Podcast Host]

No joke. Medical grade red and near infrared light with three frequencies per light. Deep healing, real results and totally portable. It's legit photo bio modulation tech in a flexible on body panel. This is the Trilite from Therassage and it's next level red light therapy. It's got 118 high powered polychromatic lights each delivering three healing frequencies. Red and near infrared from 580 to 980 nanometers. It's sleek, portable, and honestly I don't.

[Scott (Cybersecurity Expert)]

Go anywhere without it reported. If you're under some kind of compliance or regulatory mandate, state mandates, sometimes they have laws and compliance. So you know, if you're in healthcare, of course you got to report it. If you're in finance, you know, certain compliance. But if you're a manufacturing company that's completely private and you get hacked and a lot of, you know, customer information or user information gets hacked, you don't have to necessarily disclose it.

[Podcast Host]

Yeah, I got hacked. I didn't tell anyone about it. You know, I got SIM hacked. That's a nasty one.

[Scott (Cybersecurity Expert)]

That is a nasty one.

[Podcast Host]

Yeah, that one could end up bad. Especially if you have crypto or like important login somewhere connected to your email.

[Scott (Cybersecurity Expert)]

Big time, you know. Yeah. On the personal front, you know, the, the threat, you know, just using public WI fi. You even got to be careful. You don't think it's safe to just go to Starbucks. I log on there all the time. You gotta be careful. There could be somebody in the corner totally sniffing your WI fi. They can hijack it really easily.

[Podcast Host]

Holy crap. So if you connect to a public WI fi, what can they do from there?

[Scott (Cybersecurity Expert)]

Yeah, so if you go to public WI fi because there's such weak security protocols, a lot of em aren't up to date. So there's little hacks that you can put in and you can basically see the streams of data that are going on. And then they have emulators so you can almost, they literally can almost emulate your screen and watch everything you're doing.

[Podcast Host]

Holy crap.

[Scott (Cybersecurity Expert)]

Sniff pat word passwords. They can do all kinds of, they can even do little applets to log on to your, your phone or your mobile device, your laptop, and basically just make a copy of it. Wow. Yeah, it's crazy.

[Podcast Host]

That's not so even. I like the airport. You could get compromised there.

[Scott (Cybersecurity Expert)]

100%. Yep. You got to be really careful. It's not that you can't ever use a public WI fi, but if you do, you have to make sure you've got the right, you know, security tools on your, on your phone or your device to be using it.

[Podcast Host]

That is good to know, man.

[Scott (Cybersecurity Expert)]

Yeah.

[Podcast Host]

Because a lot of people use public WI fi like hotels, airports, bucks, big time.

[Scott (Cybersecurity Expert)]

And it's, it's. Yeah, they're learning that people just don't, aren't paying attention and it's easy to get that. And that's on the personal side, you know, so there's a lot, a lot to think about in, in the whole world of, you know, cyber. I was thinking about, you know, the, you're kind of going back to the big corporate things, you know, like the casino that got hacked here.

[Podcast Host]

Yep. Mgm, right?

[Scott (Cybersecurity Expert)]

Mgm. Yeah, that was really interesting. You know, they literally just called the call center, the it, you know, support center and got a password changed. One change of one password. And people are still, you know, sometimes putting passwords on sticky notes and not taking it seriously in smaller businesses especially, but they even have protocols there. But they basically convinced, you know, and these are some of the groups. There's a lot of bigger groups that come together. They're hacking groups. And these, these threat actors often are kind of one of three buckets. Sometimes they're doing it because they want to make just a statement, like a political statement. Sometimes these hacker groups is just all about the money and there's some in between. But in this particular case, they convinced the call center to change a password. One password cost them over $100 million. They said they weren't going to pay. They were down for over 30 days. Cost the business over 100 million bucks. And then because they got a bunch of data that was personal data, they just settled like last month for $49 million. I think it was for the people that got their information hacked because they didn't have the right controls and cybersecurity systems in place.

[Podcast Host]

That's nuts. They had to settle with the people that got their info leaked.

[Scott (Cybersecurity Expert)]

Yeah, yeah, yep. Big, big, big court case that went on and that just happened. So it's, it's not only real there, but more on the front of, you know, the personal, or I should say the smaller business side. More your small to medium, you know, you're 100, 500,000 employee type business. Those are the really the sweet spot right now that they're coming down to and they're going after and like MFA Multifactor, where we all, you know, log into Amazon, we get a code neotex. The other thing is they're really getting good at hijacking your mfa. They can get SMS streams, so. Or if you're going like a code that's being sent to your email, which is really common, like, oh, we're going to email you code. They first hack your email and then they will of course get your code just like they will your sms. So regular mfa, a lot of people aren't even using it. It's still a good thing to use. It's better than nothing. But there's actually the next level, which is kind of an advanced MFA we call it. In the book there's a chapter called Verify Credential Access. It's more where we're using an app on your phone because that actually has a little crypto key on it. And it's kind of decentralized. So you're not just getting one point of a place to send you a code, it's talking to another point.

[Podcast Host]

Right.

[Scott (Cybersecurity Expert)]

Two different points as decentralized to authenticate and make sure that you are who you say you are while you're being connected. It does regular check ins so it knows that it's you. These are some of the practical things that you know, businesses really have to implement and get serious about using. That's just one of many things that's.

[Podcast Host]

Like a Google authenticator operate.

[Scott (Cybersecurity Expert)]

Yeah, like a Google or Microsoft authenticator is really popular ones. The other thing point I would make about that is back to kind of the zero trust. The big, you know, assume breach. The way you defend against and put yourself in the best position as a business is you actually don't just have backups. But if you're assuming breach, you have immutable backups, which an air gap, which means that they are completely separate from your network. So if the threat actors are very patient, they'll get on there, they'll sit for a while, watch for a month, two, three months, sometimes they'll see where you're streaming. So I'll be like, we're streaming our backups to another location, we're streaming to the cloud, we got backups, we're good. They'll actually watch where you're putting them. Then they'll go encrypt where your backups are if they're not encrypted. And so that's a really scary thing. So a lot of people don't understand and a lot of organizations and companies that the level that you need to have in your backup strategy, it sounds like, oh, we've got it covered, I'm sure. But he's saying they've got good backups, but can you restore and are they mutable? Really important. And then you got to decide at what point in time do we want to restore to? Can we lose four hours of the data? Can we lose no data? Can we lose a day? And then how long is it going to take us to restore? If we do that way when the black screen of death as we call it and the text file says that we have all your files encrypted and you want access to your network, you need to pay us this amount of Bitcoin to this address. You can basically just not pay it, ignore it. And you know that within eight hours, or maybe 24, 48 hours, you can get your business back up from your backups. You can truly restore them because they're really immutable, they're separated.

[Podcast Host]

That is crazy. Have you been seeing any AI hackers or anything like that lately?

[Scott (Cybersecurity Expert)]

Yeah, there's a lot of AI that's out there. They're using it, it's making it more difficult. It's kind of like a little bit back to the old days of the antivirus. We'd buy an antivirus software and it would protect you against most of the popular malwares. And then they would write new malware that would go around the antivirus software. So then you'd have to do your updates that you got the latest anti malware. That's a little bit the cat and mouse that we're in with cybersecurity all the way around is that they'll figure out something with AI that they can do to try to hack people and different methods. But then new AI deterrence. And we use a variety of different AI tools in our business that can actually do a really good job of, you know, cutting down the noise and finding some of the AI hacks. But where it really gets tricky with AI is when we get into deepfakes and we get into this idea of really using it as social media because still 80%, 70 to 80% of all hacks or network, you know, infiltrations that happen, it really comes from the end user that's the biggest threat is the person. There's. There's no real. If I become you, Sean, and you've got access to everything, and I convinced that, you know, it's you, I have the ability to basically have access to anything I want to have access to. So that really, is that one of the big, big pieces you got to look. And so there's some certain things that you deploy in good practices that we talk about in the book and stuff that you deploy to really what. What we call end points of the end users to really make sure you protect that endpoint. So it's a product called edr, which is an acronym in our world, but it's called Endpoint Detection Response. It's like the new antivirus software of today.

[Podcast Host]

Wow.

[Scott (Cybersecurity Expert)]

So every business should be using some form of an edr. If you're not, that's a really basic thing. Every Business should definitely have good backups that are immutable, completely off the network, which is a little tricky to do, and a plan to be able to restore them. Those are really foundational things.

[Podcast Host]

I hope you guys are enjoying the show. Please don't forget to like and subscribe. It helps the show a lot with the algorithm. Thank you. That's good to know. Yeah, I need to start thinking of how I could do that with all my footage, all my data.

[Scott (Cybersecurity Expert)]

Right, sure.

[Audible Narrator]

Yeah.

[Scott (Cybersecurity Expert)]

You have a lot of valuable stuff. Yeah. And so it's important to think about it being not just on site, but off site. But not only just off site, but a place off site where it can't be reached through this network.

[Podcast Host]

Right. It's like your crypto wallet.

[Scott (Cybersecurity Expert)]

Yeah, like your crypto wallet. Great analogy.

[Podcast Host]

Yeah. Because if you have the regular wallet, you could get hacked easier, big time.

[Scott (Cybersecurity Expert)]

Yeah, there's a. There's a lot of threats like that. So, yeah, there's a lot of parallels. AI is definitely, you know, the future. They're using back to the AI thing, you know, they're using it to really try to fool people in so many different ways. And it's, you know, so fast and creative and how it can convince people who they are. And then we talk about deep fakes. Right. I mean, that's a whole scary world.

[Podcast Host]

You know, that scares me because when you think about facial recognition and voice recognition, cannot even bypass that potentially down.

[Scott (Cybersecurity Expert)]

The road, potentially, it certainly can. And that's why it's. It's a big concern, you know, as well as just all the implications. Right. I mean, if, you know, you could deep fake, you know, Sean doing something nefarious that Sean would never do, whatever that is. And how do you really know? I mean, you know, and so they're of course writing, you know, better deep fake software and then kind of like the cat mouse game, but then better detection, but I don't know it right now. The bad guys are winning. That's really the theme, you know, the bad guys are winning. They're hacking more and more networks, getting paid tons of money, and it's very profitable. They make it very easy to do, and it creates for a lot of challenges out there for businesses to properly defend and what we call really have the proper cybersecurity hygiene.

[Podcast Host]

Also, I wonder if the punishments are enough time because I remember my friend got sim hacked. The guy only got a few years, but he got eight figures in crypto, you know what I mean?

[Scott (Cybersecurity Expert)]

Wow. Yeah, that is a problem. They're still catching Up a little bit with, you know, how do you track down, you know, threat. And the other thing is that, you know, it's anybody that's connected across the world. So, you know, the hacker may not be somebody that's US based, likely could be another country and they may or may not have stringent laws. You know. Good point.

[Podcast Host]

Certain countries, I know there's groups in North Korea that hack crypto. There's groups in Asia. Right.

[Scott (Cybersecurity Expert)]

Other countries, big time. Some of your biggest groups are there and a lot of them are decentralized groups. Right. They just come together for a common cause. Like I was sharing earlier, they have, you know, some, some cause they decide is important or something they don't like. And so then they just gang up and they'll the bad kind of franchises in a different way. There's like groups like almost businesses. You almost would imagine somebody literally like, you know, getting dressed, getting ready to go to work every day and they're saying goodbye to their family, but they're actually going to a complete hack shop like you'd see in a movie.

[Podcast Host]

Yeah, I've seen those in India, the call centers that scam elderly people. Seen a ton of YouTube videos on those, 100%.

[Scott (Cybersecurity Expert)]

And it's a very real, and it's just a, you know, deeper, more advanced version of that that are going after a lot of the businesses, particularly here in the US they're very interested in US businesses.

[Podcast Host]

I saw something, I'd love to know if you think this is true, but I saw some hack where a bunch of Social Security numbers got leaked. Almost everyone lives in the U.S. did you see that?

[Scott (Cybersecurity Expert)]

Yes. Yeah, there was a huge, it was a governmental hack. There was some agency, I believe, and so I read about it. Not, not deep up on it, but they, they definitely can. And with the Social Security numbers, of course they're going to sell that to people that are doing identity theft. So that's the real value there.

[Podcast Host]

I think that's how I got SIM hacked, honestly.

[Scott (Cybersecurity Expert)]

Huh.

[Podcast Host]

Very possible because they probably called my carrier and had my social and then just said, can you send the SIM card to this phone?

[Scott (Cybersecurity Expert)]

Yep, yep. And so, you know, being able to authenticate people more from a physical perspective right on the phone, that's why you're getting. People are catching up a lot like your banks and stuff, they're learning. I can't just take a little bit of information. I've got to ask more questions that are very unique and discreet that only you would know. Right. So that's really important. And the Same thing is kind of true. As you think about, you know, rolling out better cyber into the businesses.

[Podcast Host]

How often do you, you get hacked because people try to play with you, I bet, right?

[Scott (Cybersecurity Expert)]

Yeah, yeah, we, we do get, you know, we have a lot of different layers of security in place. And all the things that we talk about, we kind of joke, we eat our own dog food. We make sure that's important. But there are a lot of threats. I mean, somewhere, I think I was reading recently that, you know, there's like 362,000 on an average, you know, like network. And I'm averaging things out. 360 bots that are trying to hit your firewall at any point in time.

[Podcast Host]

A day or a day.

[Scott (Cybersecurity Expert)]

Holy crap. It's that many thousands of things. There have been some scenarios where people put what they call honey pots out there on the Internet where they purposely don't really secure things and they kind of leave it open just to see what kind of. And that's where the AI and the bots are coming in at a, you know, crazy level. And they just need one little port, one little mistake that's open. And again, kind of like the password, example, one password cost a casino over $148 million. It's crazy, you know, so imagine that to a small business. So what it can, what it can do.

[Podcast Host]

Yeah, especially I feel like with elderly people, they just get an email, they're like click this link and they're screwed.

[Scott (Cybersecurity Expert)]

Right? Very easy. Yeah, very easy. And again, those are, those are kind of the low lying fruit and those are kind of more your, you know, franchise hacker group. It's more the sophisticated groups. Then some are, you know, organized, some are not so organized, but they're the ones that recognize that if I can get this business to shut them down, right. It's a, you know, like I said, it's a, some kind of a, even a software business or whatever, right. I get in there, I get their data, I get their intellectual property. So anyway, it's, it's really a crazy thing that they're, it's. I don't have to make it up, you know, sit here and talk on and on about, I mean, there's story after story. But the thing I kind of keep coming back to and that I'm reminding people about is that we only hear about a few, a small percentage, right? There's so many more that are hacks that are going on and it just costs businesses so much money, so much distraction, the downtime. There's just a lot of issues around, you know, this cyber security world that we live in. And one of the things I talk about in my book is kind of the efficacy of it processes. One of the things that people get kind of in love with this idea with a new tool. So if we know my IT guys said we're going to deploy this one new tool and that somehow one tool is going to put us in a better, you know, protected state. And that's just a fallacy. That's not true because you've got to have all the layers. And so we joke about a fool with the tool is still a fool. You, you really, you really got to have a strategy and a philosophy around how you're deploying and protecting your business with your cybersecurity. And it starts with leadership. And I talk about that in the book a lot.

[Podcast Host]

Yeah, yeah. I'm sure you've heard the craziest stories, the horror stories, lost business, lost revenue.

[Scott (Cybersecurity Expert)]

A lot of stuff. Yeah. We usually get pulled in expose facto right after the fact of the hack or the breach. And they're looking for stuff and it'll cost a business between seven and ten times more money after a breach happens than if they put the preventative tools a little bit like brushing your teeth. Right. You do the, or medical, you do the preventive maintenance stuff and you're going to avoid hopefully some catastrophic event.

[Podcast Host]

Yeah, it's like, would you rather have you guys on hand when it, when and if it happens or after and maybe you can't even fix it at that point?

[Scott (Cybersecurity Expert)]

Yeah, exactly. A lot of times it's too far gone. Yeah. If a hack actually happens or a breach like that, one of the important things actually a lot of people is they'll just start erasing, rebuilding stuff. But it's actually really important to protect the forensic data because if you are going to bring in, you'll report at the FBI or even bring in some of the smart folks that we work with and that we do to do the forensics, to understand how it happened, to prevent kind of root cause, you can prevent the breach from happening again. So it's kind of important to stop, drop and roll, if you will, when a breach happens and not overreact, but yet you're concerned because you're trying to get your business back in, back in business or back online. And it's very, very stressful. It's a very difficult situation and you really don't want to be in that situation.

[Podcast Host]

What percentage, if you had a guess of the hacks and breaches you dealt with were you able to trace back the hackers?

[Scott (Cybersecurity Expert)]

So pretty small percentage because they're pretty smart. Like I said, they're kind of winning the game. But I think statistically they're saying that less than 20%.

[Podcast Host]

Okay.

[Scott (Cybersecurity Expert)]

You can actually get to sources that is small. Yeah, there's a lot of interesting technologies, you know, like ProtonMail, which is a Switzerland based system. They have Proton technologies. They really are become proxies and hiding people behind things you really can't. You know, nobody can trace down where it's actually coming from. For ProtonMail, yeah, that's one example. There are multiple tools and services out there that make it really easy to basically hide your IP and not be non traceable. It's pretty easy to find on the dark web. Of course there's all kinds of services you can get.

[Podcast Host]

Do IP changers still work like the VPNs, does that still work to hide where you're at?

[Scott (Cybersecurity Expert)]

VPNs? If you keep them patched and up to date and using kind of the latest greatest VPN technology, you're in pretty safe shape. But if you're using an older vpn. No, they're hacking them. There's all kinds of vulnerabilities in those old VPNs and a lot of people, they just don't get around updating them because it is busy and they don't have time to do the updates or their cyber team isn't really aware they're working on something else. So there's a lot of really basic kind of foundational things that you should always be doing, like even patching your systems a little bit. Like even your phone when you get those updates are annoying, but if you don't do them, you could be opening up threats even on your phone as an individual. Same thing's true in a corporate network. You have to keep your servers and your systems and your network devices and your firewalls and your VPNs. You got to keep them patched and up to date and it's not always that easy to do. Besides, there's downtime and nobody wants to do that. Or it just takes a lot of effort. Effort after hours work, it's difficult. There's a lot to be done out there.

[Podcast Host]

That's actually really great to know because I'm one of those guys that procrastinates the phone updates. But now when I see one, I'll immediately update it.

[Scott (Cybersecurity Expert)]

Yeah, it's really important because often in this day and age you can almost assume that any of those updates are Blocking some security bonus vulnerability that's on your phone or your system or your laptop or whatever it might be.

[Podcast Host]

I wonder if that's ever happened with Apple, if someone breached into them.

[Scott (Cybersecurity Expert)]

Oh, well, I think Apple is a target and I think there are. Again, they would only have certain disclosure that would apply depending on what kind of breach. But if it's just their intellectual property, then, then they probably aren't going to let people know.

[Podcast Host]

It's a good point because a lot of companies probably don't want to ever admit that they got hacked.

[Scott (Cybersecurity Expert)]

Yeah, exactly. It's not a comforting sign. It's a bad signal to your customer base.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

It's not a good look, particularly if you're, you know, financial institution, you, you know, you really don't want that to happen. And so some of your safest, you know, where you've got a lot of compliance. A lot of people are in this fool businesses that, well, we got to be compliant. My IT guys have filled out a list and they checked a bunch of boxes and so there's a little bit of a false sense of security there because just because you're checking boxes that you have a security policy that doesn't necessarily mean that you're keeping your system safe. Right, Right. You got to actually back it up with what we call, you know, attestation of controls. Right. You actually have to test those controls and know that those systems and tools are in place to really do what they say they do. So that's, that's again, not easy to do. Difficult.

[Podcast Host]

I mean, I'm on a couple of credit monitoring services and I feel like there's a hacker breach at least once a week. Like I get a notification that my stuff's been leaked.

[Scott (Cybersecurity Expert)]

Yeah. And I would say again, that's probably only getting notified on a small percentage.

[Podcast Host]

Which is crazy because there's already so.

[Scott (Cybersecurity Expert)]

Much, there's so many. Yeah. It's really a scary world. And I'm not saying here not to create what we call, you know, fear, uncertainty and doubt. Right. It's. We're kind of in a world and in our business space, we've been doing it for a long time. I started in it 30 years ago as kind of a techpreneur. I was in a software business and we reinvented ourself into kind of network integration. And then we eventually spun out what they call a managed services provider. And we built a network operations center and a niche data center, 15,000 square foot facility and it's certified and what all that. But then over the last 10 years, that's where we really evolved, where we lead with cyber security and we really become what they call an mssp. So you're a managed security service provider, and so that's really what we lead with. Because everything in management of IT really does require that you're managing all of the IT systems with a security first mindset. And I talk about that a little bit in the book. Matter of fact, one of the things that's really important is kind of getting back to the processes, is that there's some older studies, and they're still true recently, that 70 to 80% of IT downtime and IT failure is correlated to like some unapproved, unauthorized, untested change. So if you have really bad change management practices, you likely are going to have a lot of IT downtime. And here's the quip of cybersecurity that I talk about in the book a little bit is that no security breach happens without a change or a need for a change. Either I brute force hack something. Right. I use some tool to get in and hack in and get in your network, or I convince you to change something. I become your social engineer.

[Podcast Host]

You interesting.

[Scott (Cybersecurity Expert)]

And so then I do. So the idea that the efficacy of IT processes. What I'm really saying in there is I'm saying you really need to have good change management practices. And that involves some other things you need to have in place, like configuration management, a couple of things. But the point is you got to have good change. We really focus on that. It kind of becomes a really important backstop to your cybersecurity.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

So it's kind of common sense. Even though it sounds a little process and technique, it's mainly just saying you got to have really good change management practices. That helps your cybersecurity posture too.

[Podcast Host]

That's great to know because, yeah, you got to think about your employees too. If they get hacked, how much control do they have over what they could change? Right.

[Scott (Cybersecurity Expert)]

Yeah, exactly. And that's why it's super important that, yeah, you're monitoring change. You have what we call kind of detective controls. So it's monitoring something and saying, oops, something's not right. There are some old stories. I'll tell one about, you know, the target breach. It was one of the first big credit card breaches that happened. This is about seven, eight years ago now. And what happened was, is that they actually had a H VAC vendor that manages their air conditioning and heating systems that actually had a dedicated connection, VPN connection into the target network. And so what happened is they actually figured out a hacker that they had access to all these businesses. They liked the target one. They used their network to get into the Target network, and it was what they call a flat network. In other words, once you're on their network, you can kind of get to everything.

[Podcast Host]

Wow.

[Scott (Cybersecurity Expert)]

And they had a bunch of point of sale servers that were living in their data center at Target, the hq. And this threat actor put a little piece of code, a little applet as we call it, that basically allows you to just siphon data, stream data to another place, another point. It put this code, it set their, the breach happened in April. They set their April, May, June, July, August, September. And it was in a, it was November, late October, early November. They started siphoning, you know, the Christmas season for retailers and they started siphoning off all the credit cards to some, you know, data centers in another country, I think it was in the Ukraine actually. So they siphoned all of the data off. Holy crap. And that was one of the biggest credit card breaches that had ever happened. About 70 has millions of customers, millions of customers. And so that's the kind of stuff that, you know, these threat actors, they're sneaky and they'll sit there, they're patient, they don't need to, you know, get an immediate reward like you might think they would. They're, they're pretty smart about what they do. So it's, that's the kind of stuff that now smaller businesses back then, it was more of the bigger targets because, you know, there's a bigger payday, but they'll, they'll take small paydays. Now if you can, if you can, some, you know, half a million dollars of bitcoin, they can get that out of you. Also statistically, you know, 40 some percent of businesses that, you know, get a hack or a breach in a serious way actually go out of business within a year.

[Podcast Host]

Wow, that's actually really high.

[Scott (Cybersecurity Expert)]

4 out of 10, which is crazy. Matter of fact, in that same thing, not to just fit, you know, statistics, but it's just kind of interesting that not only going to business, but a lot of companies are relying on, on cyber security insurance. Well, they're saying, well, you know, we're pretty good. I've been told we're good. But if we get hacked or something bad happens, I've got good cyber insurance. That has changed the last three years. This, the cyber insurance world has gotten really smart and now their fine print in their policies are calling out certain cybersecurity controls or, you know, tools that you must have in place. So they're basically saying, if you don't have these things that are actively monitoring your network for cyber and so forth, they will actually not pay. So I think I was 40. Some percent also of cyber security claims got denied last year.

[Podcast Host]

Holy crap.

[Scott (Cybersecurity Expert)]

And it's growing this year. So a lot of people, businesses, you know, are just saying, well, I've got great cyber, but be careful. You should have that cyber insurance and policy reviewed. You should be taking a look at what the fine print says.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

Because they're getting smart because they were having to pay out so much and people weren't doing anything about their cybersecurity. So you kind of understand the insurance side of the world too. But that's a real problem out there. That's a. We run into that a lot where people like, well, we want to do a little better with cyber. We don't want to do much because we got insurance, so we're good. It's like, well, maybe you are. So we actually do an assessment around their cyber insurance forum and it's eye opening what you, what you find that the fine print and what they have to have in place that they don't.

[Podcast Host]

Typically, I might have to have you look at mine because I think I have like a $10 million policy, but it might not be enough, you know.

[Scott (Cybersecurity Expert)]

Yeah. They might have certain things in there that they say that you should be doing. If we're going to pay a. We're going to pay a claim.

[Podcast Host]

That's what happened with my, my lemonade. It was my home insurance, so my car got broken into, but they didn't give me the full amount because of some loophole. There's always something with insurance companies.

[Scott (Cybersecurity Expert)]

There is defined. They've learned to kind of play the fine print on you big time. Yeah. And with big companies, you can imagine they're paying millions of dollars in cyber insurance. So there's a lot that goes on there.

[Podcast Host]

Yeah. It seems like it'll always be an ongoing war though, with the hackers.

[Scott (Cybersecurity Expert)]

It is. Yeah. And unfortunately, I mean, you'd have to say pretty honestly, they're winning.

[Podcast Host]

Right. Based off stats. Yeah. It sounds like they're winning by a lot right now.

[Scott (Cybersecurity Expert)]

Yeah. I think I read another stat again that I think it was 28% of small to medium businesses actually fill in a survey and it was like 20, 2500 companies actually feel like they're doing a good job of cybersecurity. So they kind of know it's kind of learning that I don't think we're as prepared as we think we are. And a lot of your IT people, I mean, they're overworked or they're not properly budget or funded in some cases. In other cases, there can be kind of arrogant. We see that a lot where they just think that they've, you know, they've got, they're smarter, they've got it figured. They will think they're better than best practices. They'll use words like that. And it's like, really? And then when you start working with them a little bit, you start to realize, yeah, you've got huge gaps, huge pieces that are missing and you're really vulnerable.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

So it's a big, it's a big deal right now. And so a lot of people, you know, the executive suite is kind of fooled into thinking because those guys want to protect their jobs too, start telling them, no, no, we're good, we're really secure. We've. We just deployed the latest tool, whatever tool that is. But back to my fool. The tool could still be a fool. So it's kind of interesting to see it from that perspective too. And then a lot of them have providers. So like, well, we pay X, Y and Z company, like my company and MSP or an MSSP to deliver a certain amount of services. But how do you know? Are they giving you regular reporting to provide? Again, back to kind of attestation. So one of the things we do is we use a full third party. Then we can't be the people managing your cybersecurity, but then telling you that we're doing a good job. So we use a complete third party. It's actually called Galactic Partners, great company. And we use them to actually do regular penetration testing, which is more than vulnerability testing a lot. Just vulnerability is a pretty typical simple thing that used to be okay. Now you have to actually use tools that try to penetrate the network to emulate things like ransomware attacks and do those kinds of things. So that's one of the tools that we use.

[Podcast Host]

Have you ever, you don't have to say the company, but have you done a penetration test on a large company and they failed before?

[Scott (Cybersecurity Expert)]

Big time, I would say hundreds. And we're seeing tons and tons of them, you know, and, and some bigger companies, some enterprise ish type companies, we don't typically work with the Fortune 1000s. We're working with a lot of SMB, you know, so a lot of them are, you know, 250 employees, 500,000 employees that's a lot, but yeah, and they're still fairly good size and we have a few, you know, customers that are in the 100 employee range. But yeah, I would say that's where we start. Usually when we engage with the customers we like, hey, let's run a penetration test first and let's take a look and just see what gaps exist. And the report does a really good job. It's not even the, there's five levels of pen tests. We're actually just doing a one but and usually it's only sampling like 10% of the network. They'll run this little tool on a few workstations and it goes out and automatically creates a bunch of great penetration data. That's testing and the gaps are unbelievable. It's like shake your head. I mean you're like crazy some of the stuff.

[Podcast Host]

And for people watching this, you got a deal on that, right?

[Scott (Cybersecurity Expert)]

Yeah, matter of fact, yeah, I was going to share with your, with your audience that a couple of things. One is, is that we have my book, the executive edition that's kind of the non geek speak that's on sale for Amazon for like 1795. You can order. But my team, if you text me, they will actually send you out a complimentary copy of that. But even to go a little further, I would like to offer a free if you will, no cost on qualification, but penetration test. We'll do a pen level one test through our partner, a third party. So it's not us telling you that your security is bad and all that and really you can use it for internal. You can go Google it. They're 2,500 to $10,000. They're not cheap even for a basic pen test. And they'll give you great data. You can take it back to your IT team, to your cyber security provider, whatever it is and help fill the gaps that it finds. But, or obviously if we find things and you'd like to improve your cyber. We'd love to talk to people about how we can bring our solutions to bear as well.

[Podcast Host]

I love that. Yeah, check out the link guys. We'll link it in the video and if you're watching on audio, check the description too.

[Scott (Cybersecurity Expert)]

Yeah, My text is 541-359-1269. That's a business text line. 541-359-1269. And if you just text like secure 25 or secure, we'll know where that's coming from. My team will reach out, we'll get you set up.

[Podcast Host]

What are the text Messaging apps you use, I heard signals good. Is telegram good too?

[Scott (Cybersecurity Expert)]

Yeah, and those are both good. WhatsApp's pretty good too.

[Podcast Host]

WhatsApp?

[Scott (Cybersecurity Expert)]

WhatsApp is a really fully encrypted end to end communications.

[Podcast Host]

Okay.

[Scott (Cybersecurity Expert)]

If it's set up properly.

[Podcast Host]

That's good to know.

[Scott (Cybersecurity Expert)]

So yeah, those are all decent.

[Podcast Host]

What about regular imessage? Can that ever get weird?

[Scott (Cybersecurity Expert)]

You know, there were a lot of hacks back in the day. We heard about where people were going into imessage, getting into icloud, doing different stuff. They've tightened it down pretty good. So imessage actually has some encryption services as well. You really kind of want more end to end encryption anymore. It's just even a standard.

[Podcast Host]

Could you explain that for people that don't know?

[Scott (Cybersecurity Expert)]

So encryption is where it's basically using an algorithm, you know, some kind of a software program to basically turn data into a bunch of ones and zeros when you get right down to it. And different methods of, of types of encryption actually that are out there, some are stronger than others. But being encrypted is basically just making garbly gook, if you will, out of all of your data. So if it does get hacked or stolen, if they don't know how to de encrypt or have the encryption keys, they won't know what the data is. And they wouldn't have those if it's encrypted properly.

[Podcast Host]

Interesting. Yeah. I remember when I think it was Snapchat got hacked, their photos weren't encrypted or something.

[Scott (Cybersecurity Expert)]

Yeah.

[Podcast Host]

So everyone's info got leaked.

[Scott (Cybersecurity Expert)]

Totally. And what's a little scary about that and pivot a little bit is this whole idea of quantum computing. Right. I mean quantum computers are crazy what they can do. And so there used to be like this standard they used to call 256bit. They still call it 256bit encryption. A quantum computer. And that is like a standard. In fact a lot of government, you know, compliance standards, NIST and some of these things, you know, CIS the Center for Internet Security, they'll all say, you know, 256 encryption minimum, some 512, a quantum computer can break that it usually in less than seven days. Holy crap. And they're coming on right now big time. And so this whole PQC is what we call it. I talk a little bit about my book. It's post quantum cryptography. And so you've got cryptography or cryptography in place that will actually defend against those things. Imagine the bad actors getting a hold of that. And so you know what they're doing right now? They're harvesting data. This is how smart they are. So they're going out and they're just getting data they can get. They don't care if it's encrypted because they're waiting until they get access to the quantum computing. And even three or four years from now, your Social Security number is still going to be the same. They're going to just go then, you know, decrypt it with the quantum computer capabilities and they're going to have all the data. So there's this whole crazy thing going on where there's a race to 2030, where a lot of mandates that you're going to have to have quantum post quantum cryptography in place to protect yourself. Because these quantum computers are so powerful. It's amazing. So there's a whole. It's only getting started. How scary it's going to get.

[Podcast Host]

That is scary. So does having a longer password help with the quantum computing?

[Scott (Cybersecurity Expert)]

It does. It makes it to, you know, strong passwords as we call them. Every business should be using a password manager so you're not repeating matters. And they actually make it pretty easy anymore. It'll pop up when you're in a browser. Make it easy, easy. You know, you have one kind of central secret pass, strong password. Then you can have access to your other apps. That's really important. But yeah, strong passwords are important. They help. But the quantum computing is more about the type of cryptography. So strong passwords Being encrypted by 256 type encryption, bit encryption is still breakable.

[Podcast Host]

Wow.

[Scott (Cybersecurity Expert)]

So you, you really are going to have to have strong passwords in a stronger cryptography, a type of cryptography that will defend against the quantum computers they can't break.

[Podcast Host]

That's not so like special characters.

[Scott (Cybersecurity Expert)]

Special. Yeah, special characters. And the cryptography is more actually technical than that. So we won't get into the details. But there's things like lacing cryptography and different stuff where it's constantly evolving and moving so hardly ever be hacked.

[Podcast Host]

That's crazy.

[Scott (Cybersecurity Expert)]

That's the kind of, I mean it takes, you know, an infrastructure so you got to have the right, you know, devices that can actually do that. So a lot of the big corporate networks and big businesses, banks, as if they're spending millions right now to try to get ahead of the curve. Because you can imagine if, you know, in just the next three years we're going to be able to break some banks cryptography because they aren't using the latest opposed quantum cryptography, then the exposure is unbelievable. And think about medical and how they're already getting hacked and they're already not ready for it. So again, not to create a bunch of fear, uncertainty and doubt, but it's getting more sophisticated, they're getting smarter. The power of computers will be used for both good and for bad.

[Podcast Host]

Yeah, I mean, I've seen some of the systems, these banks and medical uses, archaic. It's from like the 70s, the 80s.

[Scott (Cybersecurity Expert)]

Crazy.

[Podcast Host]

Some of them still use the square computers. You remember those?

[Scott (Cybersecurity Expert)]

Yeah, yeah, exactly. Terminals. Yeah, yeah. It's a, it's a really is a problem. And the other thing, you know, not to get on this subject, but you know, really in terms of the geopolitical, as we talked about countries hacking countries, you know, China, Russia, these are big, you know, Ukraine, there's a lot of independent ones, but there are big countries that don't really regulate a lot of that stuff. And they really have infiltrated our infrastructure. There's this kind of old system like you were talking about called scada, and that's what a lot of the dams and the electrical systems in our country are. They're on the SCADA systems. And they're already hacked. Holy crap.

[Podcast Host]

And they're never seen that in the news.

[Scott (Cybersecurity Expert)]

Yeah, they're already hacked. They're already there. They can basically do different things. They want to, and they're working very quickly over the last year or two and getting there to try to come up with defenses to be able to isolate that so that those hacks obviously won't cause crazy effects like, you know, taking down a water system or whatever it might be, or an electrical grid.

[Podcast Host]

I think that's the future of war. It's going to be all cyber big time. I don't think it'll be troops on the ground as much as it used to be.

[Scott (Cybersecurity Expert)]

100%. Yes. Yeah, I believe that completely. That that is the big threat. And of course there's a bunch of things that go into that, you know, where they talk about, you know, different technologies that can freeze electronics, you know. Yeah, they've got technologies where they can basically disperse a blast. It's basically a burst that will freeze all electronics, sometimes scramble them, make them incapable of being used. So there's a lot of the. In the cyber warfare world, there's a whole nother, you know, discussion. But for now we're just trying to get small to medium businesses, really is our focus and really help them improve and get better, you know, cyber security, hygiene, deploy Things and it's really, it's not cheap. But to be honest, you do have to invest, but it's also not crazy expensive. If you're looking at the ROI going, look, if we invest a little bit now and we avoid having to pay, you know, a half a million, 2 million, 5 million in crypto that we don't even have, we have to go to a call center. But if we can avoid that or even just having, you know, something, you know, leaked data, you know, one of the things they call is data loss prevention as a service that we work around where people just stream data, even employee innocently. I'm going to move this to my Google Drive. I'm going to move this where it's not secure and it's not safe. Taking data off the network. Yeah, that's another huge problem. And opens up, you know, intellectual property could be recipes or code or personal information that shouldn't be there. So there's just all kinds of ways that data can be hacked, stolen and used nefariously.

[Podcast Host]

Yeah, I mean, for me, like as a business owner, I want to be able to sleep at night. So I'll hire the best lawyers, I'll hire the. I'll get the best insurance. I'll get something like this because I'd rather spend a little more because I know I can. I did everything I could on my end because there's a lot you can't control.

[Scott (Cybersecurity Expert)]

Yep.

[Podcast Host]

But at least I did everything I could on my end. And if something happens, hopefully I'm ready.

[Scott (Cybersecurity Expert)]

Yeah, absolutely. And you know, if I was talking to you, I'd say let's make sure you have good backups and that they're fully immutable.

[Podcast Host]

Yeah, I need to work on that because. Yeah, right now we just have it on Google Drive, but we're working on hard storage. Yeah, the footage because there's 2,000 episodes.

[Scott (Cybersecurity Expert)]

So yeah, that's a lot of data and needs to be protected.

[Podcast Host]

Yeah.

[Scott (Cybersecurity Expert)]

Yep, for sure, man. Yeah.

[Podcast Host]

Well, Scott, this has been real fun. Anything else you want to close off with here?

[Scott (Cybersecurity Expert)]

No, again, I would kind of circle back, you know, willing to, you know, get a hold of me. Text me at the 541-359-1269. My team will get you a E copy of the book out Amazon. You can get the full book if you want to do a 405 page cyber security read. Love to have you read our book. We've sold about 350,000 copies of that book in the series. This one just sold several hundred copies a few thousand, I guess, but we're. It's growing. But there's a series of books that it's tied to that we've released, and then the executive edition will get that out to you. Then, of course, more importantly, in the real value, they want to jump on it. I'm happy to offer that up. Is the, you know, penetration test that we'll offer up.

[Podcast Host]

Perfect.

[Scott (Cybersecurity Expert)]

So again, just text us and we'll. We'll get you set up. My team will get you going.

[Podcast Host]

Awesome.

[Scott (Cybersecurity Expert)]

Thanks for your time. Thank you. Appreciate it.

[Podcast Host]

Yeah, next time.