8. Fortify Your Business: Cybersecurity Essentials Unveiled with Gus Cervantes

Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Eric Beels (00:08):
In today's day and age, are you maintaining your
business's continuity? What doesthat really mean? In this
episode, we have Gus Cervantes,a cybersecurity expert bringing
to light on what you should bedoing in your business. Hello,
everyone. Welcome to theBusiness Boost Hour podcast.
My name is Eric Fields. I'm thevice president of BNI Escondido.

Crystal Privett (00:32):
And my name is Crystal Privett, president of
BNI Escondido, and this is thesingle CEU podcast.

Eric Beels (00:40):
And on this episode, so we have Gus Cervantes. Say
hi, Gus.

Gus Cervantes (00:47):
Good morning.

Eric Beels (00:49):
And so on, Gus, I have Gus is actually so I kinda
wanted to say say somethingabout you, Gus. You have changed
actually the way I kind of see alot of, like, the digital space
for, like, just in in my ownbusiness and and what I do on a

(01:11):
regular basis. You've impactedme a lot, on that. You have
some, phenomenal stories thatI've I've I've heard and
whatnot. But, so tell us alittle bit about tell the
audience like a little bit aboutlike who you are, what you do,
and and what, how you kind ofgot into what you do.

Okay. So I've got into cybersecurity about, 23
years ago. I worked, most of mylife for, defense contractors.
I've worked for Hughes Aircraft,Raytheon, Scientific Atlanta,
General Dynamics, Raytheon, and,Lockheed Missiles and Space
Astronautics Division. I was aengineer and then a propulsion

(01:56):
scientist for Lockheed Missilesand Space Astronautics Division.
And, working in remote areas,very remote areas on very,
proprietary programs, basicallysecret top secret programs. I,
learned, computer technology,and I started learning
cybersecurity because one of thechallenges that we had in these
remote areas was, gettingsystems built that were

(02:20):
isolated. And it was verydifficult to get people from
what we called, MIS back inthose days, from Mahogany Row or
from corporate. And, so I tookthe challenge on myself to start
learning IT systems so that wecould move on with these
projects because most of themwere DARPA related defense
advanced research projectagency, which was driven by
either the CIA or the NationalReconnaissance Office. And so, I

(02:44):
taught myself IT so we can getthe projects moving because they
were all had a very short fuse.
A lot of them were, experimentaland proof of concept. Mhmm. And
so they really wanted them donein a hurry, and so we just
didn't have the luxury ofwaiting for Mahogany Road, MIS,
for those people to get theirclearances for our programs.

Eric Beels (03:00):
Mhmm. So

that's how I first got into it.

Eric Beels (03:02):
Okay. So I heard a lot of kind of big words there.
I'm sure you probably heardheard the same thing. So in so
someone, who's not as, I don'tknow, technical and stuff too. I
kind of understood a lot of it.
It kinda goes over my head aswell too. How do how do how can
we simplify that? Like, whatwhat does all that kinda mean
really?

So what all that means in a nutshell is that, I
have vast experience working onIBM mainframes, and PCs because
I've been doing this before thePC was invented. And, I've had
resources available to me thatlet me use the best possible

(03:44):
infrastructure and most securesystems, and I've learned to
bring that down to the microbusiness.

Eric Beels (03:51):
Nice. So the what what I like about you, Gus, is
you you really kind of bring thereality of a lot of this
security.

Yep. Scaring us straight. Yeah.

Eric Beels (04:08):
And and so, you know, for me, I have I I used to
kind of, you know, be feel likeI was kind of okay with, like,
password managers and and thingslike that.

A little more lackadaisical.

Eric Beels (04:22):
Yeah. And and but, like, there's there's there's so
much that kind of, like, goes gogoes into it, and I'm really
grateful that I have been ableto meet someone like yourself to
kind of, like, really emphasizeall these the the importance of
of these things. And I know andwhat we what I think really we

(04:42):
wanted to kinda really zero inon, like, what's the what on the
the purpose of, like, securityand cybersecurity and all that
and which I I, you mentionedwas, like, basically business
continuity. Right?

Correct.

Eric Beels (04:59):
So what does that what does that mean a little
bit?

Well, what that means to, any business is,
business continuity from acybersecurity perspective means
that, your name's not gonna besplattered all over the media
and the newspaper because youwere hacked. It means that,
you're gonna be able to deliverthe service that you promised on
time to your to your customers,and the with the commitment you

(05:23):
made because your system wasn'thacked. Mhmm. It also means that
you're not gonna be held ransom,and you're not gonna be paying
out money that could potentiallyput you out of business, because
of a ransomware attack. Sothat's what I mean by business
continuity from the cyberperspective.

Eric Beels (05:38):
So it's kinda basically maintaining, like,
what what what your your youryour your day to day stuff
because, like, you know, it'sit's funny because a lot of
people, I think that, you know,it's like, oh, I'm I'm a I'm a
small business or I'm a smallperson. No one wants to hack
hack me. And, you know, I have ainteresting story on this. Like,

(05:59):
I had a I had a friend who, andand, you know, she she was a it
was a, a hairstylist and, youknow, just a just a, you know,
has her own

small business. Yeah.

Eric Beels (06:15):
Just average average small business. And, she was she
started getting death threats,on her as text messages and even
showing, like, pictures of,like, her kids and stuff with
her kids and all that. And I'mjust, like, I'm just like, man.
And and and she literally hadmoney deposited into her
account. Like, she saw it on,like, on a on a on a bank thing.

(06:39):
And so they were, like,basically kind of trying to,
like I I don't really know whatwas kind of going on exactly
with that, but they werebasically kind of trying to,
like like, you know, use her, Iguess.

Accounts. Yeah.

Eric Beels (06:56):
Yeah. You probably know what they were kinda trying
to do based off off of that, butit's like that was kind of like
a wild, very kind of a scarysituation. It's very you know,
usually your people areexpecting, oh, I'm gonna get
like a Nigerian email orsomething like that, which kind
of most people have heard ofthat stuff.

I think we've moved past that this point. No.

Eric Beels (07:14):
I know. But that's kind of like, I think, you know,
they'll be, oh, I just gottalook for that kind of stuff. But
then you and and, like but then,the you know, when someone, you
know, deposits money into youraccount, that's kind of like,
wait a minute. You're supposedto be taking money from me, not
giving you know, what are youtrying to you know, what's
happening here. Right?
So, you know, I I guess one ofthe kind of questions I have,

(07:37):
what, you know, what are somesteps, I guess, that people can
take to

Like entry level.

Eric Beels (07:47):
Yeah. And like, I guess, entry level level things
that I guess I guess probablyapplies to any any size business
really, but I guess I suppose ifit's bigger, maybe you have you
have might have more more atstake, but what are some some
starting points that I don'tknow maybe account for a lot of

(08:08):
this stuff or help protect youagainst a lot of this stuff?
What what would what would that?

Yeah. So there's some fundamentals that every
computer, whether you're a oneperson show or you're a million
person company, the fundamentalsare all the same. And it really
starts with the computerhardware. So on your computer
hardware, you should haveencryption on your hard drives.
Right?
And so, if you have a Microsoftproduct, that option is built

(08:34):
in, and it's called BitLocker.So that should be enabled so
that if someone's not using yourcredentials, they can't read
your data. So that's number 1.Number 2, you should have a
password on your BIOS so that ifsomeone does a, a hardware
attack, they can't get into yourBIOS and embed something that's
then going to monitor yoursystem. And if you format your

(08:56):
hard drive, meaning if you useyour your hard drive, put in a
new hard drive or whatever totry and get rid of a virus.
If they're in your motherboardBIOS, they're gonna get right
back on your hard drive. So youwanna put a password on that as
well. You also want to, use whatwe call least privileged access,
and that's a big fancy word forsaying that by default, when you

(09:17):
set up your PC that you justbought at Costco because you're
a really small company, you'regoing in and you're creating the
default account, and thataccount has administrative
privileges. So that's a big nono. You need to create a
separate account that you andyour users, your employees use
from day to day that doesn'thave administrative privileges.
And then you elevate thoseprivileges on demand when you
need to install software or dosomething that requires those

(09:40):
credentials. And then, ofcourse, use a complex password
for those. Don't write it downon a piece of paper. Use a
password manager, to manage yourpasswords so that you can use
very complex passwords that andpassphrases that you're not
going to remember, and they'regonna be very difficult to hack.
So a password, phrase that has 8characters or greater is gonna

(10:02):
take about 200 years for someoneto hack.
If you got 12 characters orgreater, it could take thousands
of years to hack. So, and sowhat I like to do, because I'm
multilingual, is I like to makepassphrases. So, typically, my
shortest password is 16characters, and it'll be a
passphrase that's in 3 differentlanguages. And I will take the

(10:22):
characters and change them. Sowhere the a will turn to an at
symbol, the I will turn to aone, and that type of thing.
So it's not you're not gonna beable to do a dictionary attack
in any language against it.

Eric Beels (10:33):
And what's the difference between, like, a
because I've I've heard thewords password and passphrase
before. Are there is there adifference between those at all?
Or is there or

Yes. And so so a passphrase is a sentence

Eric Beels (10:45):
K.

Or almost a sentence, something that's easy
for you to remember. And so thatway, when you change the
characters, you'll Mhmm. Even ifyou don't remember the
characters, it's it's gonna bevery limited options, and you'll
be able figure out yourpassphrase very quickly.

Eric Beels (10:58):
Mhmm. Yeah. I I've started using passphrases myself
actually because I found thatthey're kind of just I don't
know. They're they're longerlike you said, and they're
they're they're just, they'realso easy to, remember or

Associate with a certain account.

Eric Beels (11:17):
Yeah. Yeah.

You should also not use the same password for
everything. Everything shouldhave an independent password,
and that's where passwordmanager comes in. Because people
like to use their birthday,their kid's birthday, their
kid's nickname, that type ofthing. Those are all no no's
because that information couldbe, swiped. And when I say
swipe, I guess, literally meanssteal.
But in the technology term, itmeans it could be grabbed from a

(11:42):
program in your emails, andsorted Mhmm. And then used in a
in a in a dictionary attack onyour Mhmm. On your password.
Mhmm.

And when you say password manager, does that
mean the one that's on the phonestores the passwords, or are you
talking about somethingseparate?

So, yes, they can be on your phone. Google,
everybody has their ownpasswords, and and those are
certainly better than not using,any password manager. Those are
pretty good. However, youtypically wanna have one that
can transcend multiple operatingsystems. You know?
So something like, KeeperSecurity or Dashlane or LastPass

(12:22):
or or 1Password, programs likethat. They'll work on Mac.
They'll work on Linux. They'llwork on, iOS, and they'll work
on, you know, your any mobilephone, any any laptop, any any
tablet. And so you can use thesame password manager to manage
all those devices.

Eric Beels (12:42):
Yeah. I just I just I should've cross cross my mind
that we're not talking about a apassword manager as in, like,
I'm a general manager of a of alocation. Right? We're not
talking about that kind ofmanager. We're talking about a
software program that saves yourpasswords onto Right.
On on your phone. And then whatGus was talking about is, like,

(13:03):
having one that's universal.Because that's been my problem
actually with password managersin the past is like you know you
have you know you see sometimesI'm sure a lot of audience will
relate to this, they'll see youtype in a password on you know a
website, you fill up the sign upfor a site, and then it said and

(13:23):
then like Safari will ask you tosave the save the password or
Chrome or whatever browseryou're using. The issue that
I've ran into with those ones islike as soon as you need to like
go to a different browserbecause there's some
compatibility or something likethat, suddenly you don't have
your password anymore becausethey're not, they don't share

(13:44):
passwords with each other.Right.
Like Safari and Chrome, theydon't get they don't get along
with each other. And so and andthat's what I I think I feel
like is kind of like a bighurdle for kind of like going
into this because it I havefound over the last several
years that it's become a pretty,like, core part of, like, my

(14:08):
digital life where it's like myworld revolves around, like,
utilizing, my password manager.And, to the point where it's,
like, I don't like, if you makea new account, you're you're
you're tight you're goingstraight to your password
manager and generating a newlike random thing. And I found

(14:32):
that like you know Safari andChrome, you know I think they
have good intentions and such,but the problem is as soon as
you go to a different platform,which is inevitable to do at
some point, it just becomes hardto kind of, use those passwords
properly.

Plus, as entrepreneurs, we spend so much
time focusing on how to buildit, the steps I need to take to
build it. Then once you finallyget there and you've built what
you're trying to build, peopledon't realize that there's a
step in securing what you'vebuilt and and making sure that
now that you have what you'vebeen trying to achieve, how am I
going to maintain this businesscontinuity? What can I do to

(15:14):
ensure that what I've nowcreated is protected? Because
like Essence said, you know, oneone attack, and it could wipe
out everything that you'vebuilt. So, do you have any
stories that you wanna share?
Because we know you've got lotsof stories, Gus, and some you
can't share with us.

I know. And, you know, you're talking about what
we call IP in the IT world, andIP stands for intellectual
property. So what you know, yourbusiness, your business
processes, a lot of that'sconsidered intellectual
property. You don't want otherpeople to know because a lot of
it's your competitive edge.Right?
But before I describe one of thestories, you had mentioned,
browsers. And, that's one of thebiggest security risks is your

(15:53):
browser, by default, asks you toyou you want me to save your
password. And that password issaved in in the IT world, what
we call clear text, which meansthat it's not encrypted. And
there's these softwares thatdownload, I don't care whose
website it is. They constantlyget attacked, and it might take
them 3 minutes to solve theproblem.
But in that 3 minutes, they'vedownloaded what's called the

(16:15):
scraper. That scraper grabs thatclear text password and then
puts it all over the dark web.And next thing you know, you're
being compromised.

Eric Beels (16:21):
Ah, so so your browsers are sounds like it's a
terrible location to save yourpassword.

Absolutely. That that's you may as well write it
in big letters on your computerand say, hey, everybody.

Eric Beels (16:34):
No password. Yeah.

Yeah. That that's just that's the biggest no no.
Yep.

Oh, wow. Like writing password.

Right. Right. So using password for password.
Right? Or blank for no password.
Right? I mean, those are theones we always first try. And
then, of course, we havesoftware that

Eric Beels (16:50):
So then those

you can get into computers when we need to.

Eric Beels (16:53):
So then that's what's really kind of doing an
injustice, whereas making youfeel like you're secure and, you
know sense of security. Like,oh, it's gonna save your
password. Yeah. Keep it secure,whatever dialogue, you know,
fluff that they maybe say.

Meanwhile, it's a scarlet letter, like, walking
around with you.

Eric Beels (17:07):
Yeah. So, really, Safari and Chrome and whatever
browser you're using is morelike a hacker's dream than it
sounds like.

Absolutely. Yeah. Yeah. Especially Chrome. Chrome
is like

Oh, no. Chrome is like 90 is like 95 I'm
afraid.

Eric Beels (17:20):
Chrome's like 95% of usages. They that's

Yeah. And so you gotta understand from a hacker's
perspective, Chrome, likeMicrosoft, Microsoft's the most
common operating system outthere, and so it's the largest
attack surface. And the samething with Chrome. It's the most
popular browser. So they'regonna write programs or do
malicious stuff towards Chromebecause it's got the the most
use.
Right? So they're gonna gettheir most bang for their buck

(17:44):
or their most, you know, returnon investment with that. So, to
talk about some, horror storiesI've dealt with, I'll start with
a small one, then I'll go on themore sophisticated one. A small
one, a couple of years ago, a,office with about 23 employees.
They do holistic medicine.

(18:05):
I won't go into geographicdetail because I don't wanna rat
anybody out here. But anyway,they called us up, and, they
hadn't engaged us yet as aservice provider, but they
called us up. They describedtheir problem. They asked if we
could help them. I told them weabsolutely can.
So I went over there, starteddoing some forensics, and, the
problem they were having wassomebody was emailing QuickBooks

(18:29):
invoices to their clients andhad changed the bank routing
number. And so they were payinginvoices to some bank in Central
Africa.

Eric Beels (18:39):
Woah. Oh my gosh.

So they were alarmed, and, they were very
concerned.

Talk about business continuity. Right.

So and reputation, because now

Eric Beels (18:50):
you gotta

call your clients and say, hey. We got hacked and
blah blah blah. And the personis not gonna pay you because
they already paid. Right? And sonow you now they talk to their
insurance company and theydidn't have, cyber insurance and
blah blah blah.
Right? So, anyway, so what hadhappened, it was, they had
hacked, the back end of theirOffice 365, which is very
common. And they were copyingtheir templates and just editing

(19:14):
the templates and thenreforwarding them off.

Eric Beels (19:16):
Keeping everything the same and just changing the
link. Yeah.

And then

Eric Beels (19:19):
and the here's the crazy thing about that is the
other side is expecting thattoo.

Right.

Eric Beels (19:25):
So they see it, and they're like, oh, yeah. It all
checks out and subdue.

And they just pay the invoice. So, we corrected
that problem very quickly.Another one that, became a big
problem for a while was escrowcompanies. So escrow companies,
same thing. They were gettingwire instructions.
Another escrow company in NorthCounty, won't mention their
name, but they lost several$100,000 before they called us.

(19:48):
And then we sat down withCitibank and the FBI. We
described the forensics that wefound. I explained to the FBI
how they were doing it. FBI sentout a bulletin.
And, anyway, we corrected thattoo. So they were, changing the
wiring instructions. So theescrow company was getting it.
Everything looked legitimate.Their logo, everything, except
for the wiring instructions, wasgoing to some foreign bank.

Eric Beels (20:07):
Mhmm. Oh, man. See, that's that that to me is kind
of, like, one of like like thescariest ways almost because
it's like you could be on hyperyou could be well hyper alert
actually. And, you know, theactually something kinda similar
happened to me with my websitehosting provider. And what

(20:35):
actually queued me and so Iactually I use a lot of email
aliasing.
So I'm sure you probably knowknow what that is. Email email
aliasing is you can basicallycan put it could do like
123@diffmix.com somewhere elsefrom for my for me or I could do
and I could do my name,eric@diffmix.com, that sort of
thing. I could do all differentI could do it different places,

(20:56):
but it's all gonna go to thesame email address.

Right.

Eric Beels (21:00):
And I started implementing that a lot, and
this actually helped me withthis this situation. So my
hosting provider, I wasreceiving emails for emails from
them, and, and and I useNamecheap, for my hosting
provider. And they and what keepme in email looked perfect.

(21:22):
Everything looked looked rightand has notified me of, like,
you know, a domain's expiring orsomething like that. I get
those.
I'm like, okay. I get those. I'mlike, okay. I didn't think
anything to to to of it. Andthen, and it was actually around
the right time too when it wasexpiring.
And what queued me in though isI I I looked at the 2 who it
went to, and it went to an emailaddress that I know my web my

(21:47):
domain provider does not have.

Correct.

Eric Beels (21:50):
And so I was like, wait a second. They don't have
that email. I know what email Iuse for my hosting provider.
That is not it. And I was like,hold up.
And then I and then I went andthen I so I just went straight
to the website just to kind ofverify and check. I was like,
oh, it's not expired. I waslike, this is a phishing email.
And I forwarded it off to them,and then a few weeks later, I

(22:11):
started receiving actual emailsfrom them. They're like, hey.
A lot of people are, arereceiving this. It wasn't just
me. It was a a lot of people onit too. And so in a similar
vein, what you kind of you kindof talked about is is in that
case, it wasn't like an invoice.It was like notification that
something's expiring and thenyou, of course, click the button
to, you know, oh, your creditcard information needs updating

(22:33):
or whatever it might be.
Right?

And Gus is the guy you want to know, but you
don't want to have to call him.

Eric Beels (22:40):
Yeah. Basically. Yeah.

Preventative seems to be a much better
approach than, some of thethings that could be happening
to us.

And I think a lot of people have also gotten the
Microsoft 365 email that says,you know, your password's
expired. You need to reset it.Mhmm. And it's really just some
third party criminal, you know,asking for your password, you
know, but it looks legitimate.It's got a lot

Eric Beels (23:01):
of people who want the same password that that they
want it, like they already have.And then it goes, oh, it's
accepted, you know, whatever.And then

the next thing they do is they start hitting
all your accounts because themajority of people use the same
password for different accounts.And so you just, you know,
you're super vulnerable thatway. So you really gotta you
really gotta straighten out youract on the cybersecurity side of
that. Mhmm. But, anyway, so thatthat was a real common, one.
Another one that's really commonthat we see a lot is, domain

(23:29):
spoofing or email spoofing,where people will be getting
emails. Someone will send,someone will respond to an email
to somebody and saying, hey. Wedidn't really understand this
question, or we already paid youfor this, or where do you took
care of this, whatever. And,what they've done is they've
gotten a very similar domainthat might have an extra
character in it. Like like, yourdomain might have one r.

(23:51):
It'll have 2 r's.

Eric Beels (23:53):
Or or or a capital I versus a lowercase l or
something like that.

They'll just change it a tiny bit and spoof
on your behalf. The other thingtoo is, what people should be
doing is, setting up what'scalled DKIM and DMARC and SPF on
their emails. And this, whatthis does is it validates the
source of the email so that itverifies that it's actually
coming from your domain, fromyour mail server, and not

(24:17):
somebody else's so that somebodycan't act as an intermediary,
which is the way a lot of theseattacks happen and a lot of
these, cybercrimes happen.

And you mentioned cyber insurance, and I
don't know. Do most businessesmight not even know about what
cyber insurance is. Could youmaybe explain that to the
audience?

Yeah. So, so cyber insurance, it's evolved,
and it's still somewhat easy toget. What's happened is the
requirements have gottenstricter because several years
ago, after a bunch of ransomwareattacks, the insurance company
started wising up, and now theydon't just give everybody
blanket insurance. So forexample, 5 years ago, I have a

(25:00):
client in North County inCarlsbad. They've got about 240
employees, 3 locations.
5 years ago, they asked me tolook at their insurance, cyber
insurance application. And in anutshell, it was, do you have do
you have a backup, a dailybackup? Yes. Do you have an
antivirus? Yes.
Okay. Here's your policy. So 3years ago, that same insurance

(25:21):
application had a 110 questionson it.

Wow.

And, those 110 questions were part of a
cybersecurity framework calledthe NIST 80171, which is
something that we specialize inbecause the Department of
Defense adopted that as part oftheir cybersecurity framework,
and all every defense contractorhas to meet all a 110 controls.
So anyway so now the commercialinsurance businesses have
adopted it, and they're askingall those questions. And the

(25:47):
other thing I've noticed is ifyou're a micro business I'm
gonna say micro business, 20people or less. They're more,
liberal. They'll insure you, butit's a flatter rate, and it's a
higher rate than if you have abunch of controls implemented
because you're a higher risk,but at the same time, a lower
risk because of the size of yourcompany.
I see.

Eric Beels (26:08):
It was saying. So you're higher risk because you
probably aren't implementing thethings that you should be.

Right.

Eric Beels (26:14):
But you're a lower risk because you are smaller.

The dollar amount. Right.

Eric Beels (26:17):
Got it.

Yeah. So they have, like, a blanket flat rate
for those. But everybody shouldhave cyber insurance. It's, it's
not that expensive, especiallyif you're a smaller business. If
you're a larger business, theyget they get pretty granular.
One insurance company that we'vebeen working with a lot, is
called Coalition, and they havetheir own SOC, which is a SOC,

(26:38):
SOC, security operation center.And they scan the client's
networks and look forvulnerabilities every month. And
if you find a vulnerability,they have 45 days to remediate
the vulnerability. Or if theyget attacked and and it's based
on or because of thatvulnerability, then they won't
honor the claim.

Wow.

So they've gotten very sophisticated. All the big
insurance guys are

now warning. You better resolve it or else
you're out.

Yeah.

Alright.

Eric Beels (27:03):
Well, I mean, you know, I think on on the flip
side of that too, you know,they're they're it sounds like
they're taking the initiative toactually kind of, like, alert
you of these things too, though.Right? I mean, I think, you
know, usually insurance isn'treally doing that sort of thing.
Like like, actually, that soundslike they're doing proactive
stuff, which is gonna be better

for you

Eric Beels (27:24):
in the long run anyway. I I

I love it.

Eric Beels (27:26):
Yeah. Yeah. So that's that's really good. And
and I think, you know, it it'ssuch a complicated thing because
there's there's, you know, one,people don't know what they what
what they don't know. There'splenty of things that I don't
know that, you know, especiallywith the advent now of of AI.

Yeah. There's so much fraud that you have to
be so hyper vigilant. I mean,like he said, the spoofing, I
had to actually call Gus becauseI was dealing with something
with I think they use reputablenames as well because I was
dealing with Amazon for a bookthat I had, and someone spoofed
me on the phone, and I thought Iwas still talking to Amazon, and

(28:06):
it was it was someone else, andthey tricked me into purchasing
a program that didn't even existfor my book, so it was a little
bit tricky situation, because Ireally I literally thought I was
still on the phone with someonereputable, because I was the one
that called them, and little didI know that they could switch
your phone line over. I didn'teven know what spoofing was

(28:29):
until I met Gus, but it there'sthere's a lot of things going
on, and even one time, my mom myson called me from school. He
goes, Mom, are you okay?
I said, Yeah. Why? He said, Aman just called me and said, we
have your mom. And so and he waslike, just just glad to know
you're at home. Like, you'regood.

(28:50):
Okay. I'm going back to school.

Eric Beels (28:51):
Well, you know what? So have you heard now that
they're doing that they're doingAI spoofing on voices. Mhmm. And
so what they'll do, you can lookthis up and type in on on on
YouTube.

Gus knows all about it.

Eric Beels (29:03):
Yeah. And and they and basically, there's all these
kinds of, like

I used to record

Eric Beels (29:07):
news articles and stuff or news videos where they
kind of show this Mhmm. And,where they only need, like, you
know, 10, 20 seconds of of, youknow, your voice, which
everybody has their recording,you know, somewhere. Like,
you're just recording something.Voicemail. Yeah.
Voicemail. They could just calland hope you don't answer. Call
at 3 AM or whatever. You won'tanswer that sort of thing. Get

(29:28):
your voice mail from that.
And, and and what they'll do ina similar vein with you with
what you just said was they'llgo, oh, we have your mom. Here
she is.

Mhmm. And

Eric Beels (29:37):
then it'll be your voice Yep. As an AI Yep. Like,
basically, to to the otherperson online be like, you know
and they'll they'll say stufflike, yeah. So you need to send
us 5,000, $10,000, whatever itis to this Venmo or whatever it
is right now, or we're gonna orwe're gonna kill kill them in

That's why we have a family password for those
types of situations. So, if,like, someone says that, it's
like, well, what's the password?If they can't provide that, then
we know it's not real.

Eric Beels (30:05):
Don't say it here.

Obviously, obviously not. Gus probably
reread my mind or something.

Eric Beels (30:11):
Yeah. Gus is like, I'll take it. I'll take it.

Well, my response is, thank you for taking the
time to talk to me. I've alreadygeo fenced your IP, and I have a
tactical team on the way.

Eric Beels (30:20):
Oh, no. Yeah. We're gonna be done with this
recording here. We're gonna havea

Is that what the helicopter is?

Eric Beels (30:24):
Yeah. Is that what that is? Is that why I'm seeing
SWAT people walk outside?

Yeah. That's another problem because, phone
systems, the majority have nowmoved over to what's called
voice over IP and, IP beingInternet protocol, which is with
99.9% of the computer systems onthe planet now use. And, so, it
can be hacked just like anythingelse. You know, if it's got bits
and bytes going across, over amedium, then it can be hacked.

(30:52):
You know?
So, yeah. So that that's anotherbig problem. Tell you a story
that we ran across a a few yearsago. This one was interesting,
and this one from a was from astate actor. And when I say a
state actor, that's DODtechnobabble for, an adversarial
country.

(31:12):
And so there was a company inMira Mesa that had 5 locations,
about 700 employees. We used todo their IT. They outgrew us.
They ended up have hiring theirown IT staff, but we still
provided high speed Internet andtheir voice over IP phone system
for them. So I still had arelationship with them.

(31:34):
So one day, it was on a weekend.It was a Saturday morning. I was
getting ready to work with myyouth program, and this person
kept calling me. And I hadn'theard of him in a while, and I'm
like, okay. Something's wrong.
So I answered it. And, thegentleman was in Spain on
vacation, and he said, hey. ICan you do me a favor? I said,
yeah. What can I do for you?
He said, I need you to go overto corporate and see what's

(31:56):
going on. And, he described alittle bit what was going on
with their IT systems. And,basically, he you in his words,
he said, I think my IT guys areBS ing me. I need you to go over
there and tell me what's reallygoing on. So, that evening, I
called him back, and I said, soand so.

(32:16):
I'm not gonna use any nameshere. I said, so and so, You've
got 3 choices. You could donothing. You can pay a almost
half $1,000,000 ransom, or youcan go out of business. And he
said, what are you talkingabout?
I said, this someone has hackedyour network. They've encrypted
all of your servers, all 23 ofyour servers. They've encrypted
all of your backups, bothlocally and in the cloud, and

(32:40):
you have no air gap backups.

Eric Beels (32:43):
Oh, man. So they basically just locked them out
at and of everything, it soundslike.

Everything. And so, when we got done doing our
forensics, we brought in theFBI, of course, because we
started seeing signs, you know,esignatures that it was
definitely a state actor. Itturned out it was North Korea.
And, the way they got on theirnetwork, which at the time of
me, which fat was fascinating,they used a a printing protocol,

(33:14):
or a or a file transfer protocolcalled SMB, SMB system message
block 1 point o, which they hadon an old copier of theirs. And
so they came in through that oldcopier.
And, and then once they got onthe network, of course, they
started downloading more andmore information, and they were
on their network for about 8months. And studied the company,

(33:35):
did the demographics, figuredout what kind of revenue they
had, figured out blah blah blah,figured out the best time to to
lock them all down, and thenthey encrypted everything.

Eric Beels (33:43):
Wow. So so there was a so so there was a printer,
like, like like that wasconnected via Wi Fi or Ethernet
or something like that. And theywere to they were able to just
bait and because that hasaccess, they were able to kind
of basically hack into the howdid they get access to the
printer in the first place thenin that in that instance? Like,
how did the

Well, they they they came into the firewall.

Eric Beels (34:08):
Okay. So

And so, gosh, there's gonna be a little bit of
technical babble, and I'm gonnatry and break it down as simple
as I can because this isimportant for people to
understand about firewalls. Soin the battle days, 3 years ago,
firewalls, the the the wayeverybody puts in firewalls, and
I'm willing to say most of yourfirewalls out there are still

(34:32):
configured this way, so you needto pay real close attention to
what I'm about to tell youbecause it's gonna scare you,
and you need to act on it. Mostfirewalls out there, they block
everything coming in. They trusteverything going out. K?
Okay. So all so all the portsexcept for a select few ports
that come in are being blocked,because that was the old

(34:53):
security model everybody used.Everything can go out. Nothing
is blocked going out.

Eric Beels (34:59):
The process assuming that, like, everything inside
oh, it's it's going out. So ifyou're sending an email, it
disappear or whatever. Right.

Because it doesn't account for insider
threat. Right? So what happensis a little payload comes down
through port 80, which is yourweb browser, so you're cruising
the web, and now this littlepayload comes down on that port.
It then goes to your printer,starts infiltrating printers,
finding another open protocolthat it needs to download a
larger program or a moresophisticated program, finds an

(35:25):
open port, and starts to exploitit. Now it starts the phone home
saying, okay.
We need this now. We need thisto take the next step, and it
starts downloading more and morestuff. And so that's why, most
people don't realize thatransomware, there isn't a zero
day. It doesn't happeninstantly. It takes months for

(35:47):
ransomware to take effectbecause these little programs
are downloading a little appletat a time until it builds up
more and more sophistication,more and more capability, and
then it strikes.
So most firewalls out theretoday are are configured that
way. They're configured to blockmost things coming in, not block

(36:07):
anything going out.

Eric Beels (36:09):
I see. You know, that actually kinda makes sense
if if if I was even, like, kindof looking at that. I'd be like,
well, I want everything goingout. I'm okay. I'm not doing
anything.
Right? It kinda sounds likesurface level. It sounds like,
oh, no. I want everything goingout. You know?
Especially because I'm sure alot of people have run into this
issue before too where it'slike, maybe someone did have it
set up that way, and it's forsecurity, and they try to do

(36:31):
something, and then it's likejust not working. And you're
just like, why isn't it sending?Like, allow everything, you
know, and they just kind of gointo the hill, allow allow all
things going out and stuff toobecause they just wanna send
this thing or whatever too. Sothere's a I know I I've kind of
been in similar I don't knowabout sending something out, but
I've been in similar situationswhere it's just like, oh, they
just disable it or whatever andsuch too. But, like, when you do
that, you're kind of makingyourself vulnerable.

(36:53):
And so that happens so so adevice or a software or
something gets downloaded, like,maybe it sounds like a malware
thing, like, maybe you downloada a Sketchy software or
something like that. And thenbecause it's on because you
approved it, you installed it onthe computer, and because it's
able to phone home, whereverhome could be in North Korea or

(37:16):
something. And now because ithas full access, it's able to to
so then how does that work? Itphones home, but then there's
still the receiving side ofthings. So it's able it's still
able to because you give itpermission, I guess, now, and
this the computer, you're like,oh, well, you give this
permission so I can downloadstuff now.

So so it opens a port on the way out.

Eric Beels (37:37):
Oh, I

see. And now that port, we call it a pinhole. Now
that pinhole is open. And so Andit's bidirectional
communication. So now that it'scommunicating to home, to the
death star, if you will, it'snow you know, bidirectionally
sending bad information down,right, or bad actors down.
And, again, it's using port 80.So port 80 is your web browser.

(37:57):
So you could be you could beshopping on Amazon, and the
applets could be downloading inthe background you're not even
aware of on port 8. Right? Sothe other problem is most people
have obsolete firewalls.
So if you're if your firewall'solder than 3 years old, it's

(38:19):
basically doing nothing for you.It's worthless.

Eric Beels (38:22):
3 years?

3 years old. It's doing absolutely nothing for
you.

Eric Beels (38:25):
Oh, wow.

It's worthless.

Eric Beels (38:26):
Is there

Completely worthless.

Eric Beels (38:28):
So is that is it a matter of just, like, updating
software or something? Or It'supdating to the to

the next generation of firewalls. Mhmm.
What are your what are some ofyour favorites? Depends

on the business, but the one that most
small businesses

and when I say small business, I'm gonna say a
100 people or less, and I'mgonna narrow that. I'm gonna say
50 people or less. It's gonna belike a sonic wall or a Fortinet.
You get larger than that, then,then I like Palo Alto. Palo

(38:59):
Alto, in my opinion, is the bestfirewall on the planet, And we
use that with all our enterprisecustomers, and those things are
they're extremely sophisticated,but they're not inexpensive.
SonicWall's are fairlyinexpensive. So the the
challenge is this. Google pushedan initiative several years ago

(39:20):
where everything had to beencrypted, which is why
everything's HTTPS now. Theproblem with that is that
firewalls can't read encrypteddata. So your old firewall is
worthless because everythingthat's coming in or out now is
encrypted.
So we can't inspect the packetsthat are coming down for
malicious software signatures.

Eric Beels (39:40):
I see. So, you know, that's kind of a misleading
thing too because, I know hHTTPS. Well, I don't know h the
HTTP part actually stands for,but the s stands for secure.

Security. Right.

Eric Beels (39:53):
Right. And so but it kinda sounds like, oh, it's
secure. It's safe. And so too.Right?
And so it's almost like there'sall these, like, good intentions
on things, but then it's like,oh, well, what you just said,
everything's if everything'sencrypted, I guess, on on your
web activity, the fire like whatyou said, the firewall, your
security system on yourcomputer, whatever, can't, like,

(40:18):
monitor that stuff now.

Right.

Eric Beels (40:20):
And so

It's almost like it's almost like going to
the doctor where now you have togo and be your own advocate. You
can't go to the doctor and,like, expect the doctor to
figure out what's wrong withyou. It's almost like, okay,
here's the here's the bareminimum procedures that you
should be doing, but really, ifyou listen to guests, it's like
you really should step up a lotof these levels to to get to a

(40:43):
point where we won't have to bescared straight on a personal
level.

Eric Beels (40:47):
Well, it also sounds kinda like that. It almost
sounds like going to the doctorand then not telling them
anything about what's going onand stuff too. Yeah.

Oh, I feel great and my leg's hanging off.

Eric Beels (40:57):
Right. Exactly. And then they're just left to kinda,
like, look at you and just kindof expect to kinda figure out
what's going on.

Yeah. Or I would liken it to going to a doctor
and and, you go get a blood testand you can't read any of the
results.

Eric Beels (41:08):
Oh, yeah. It's all encrypt yeah. It's all it's all,
like, numbers or whatever. Youcan't read anything.

You're sure you can't read the results. Yeah.
What good is it if you can'tdecipher?

So the next generation firewalls can break
those, packets down. They stillcan't read the data because it's
encrypted, but they can read theheaders for signatures, for
malicious, activity. You know,for so for things that have a
malicious signature, they cansee it, but they can't read the
data. But they're far moresophisticated than the old
firewalls.

Eric Beels (41:36):
So so you mentioned that a new firewall that's,
like, older than, like, like, 3years. Is that, like, a hardware
thing then or on a

It's a hardware. Yeah.

Eric Beels (41:44):
Oh, okay.

Yeah. And you gotta see if they're using next
gen or what they call nextgeneration technology. Right. If
it's able to read encrypted, youknow, and so forth. Yeah.
And so you're not going to findthat with the low end consumer
stuff, you're going to have togo to what I call prosumer, like
the low end sonic walls, andthen you get more sophisticated.
You move to a to a more Mhmm.Beefier system, you know, but

(42:08):
more cost.

Right? But if someone comes to you, an ITS
team, you would probably helpguide them to the right fit.

Absolutely. Absolutely. Yeah. Because this

is a this is a lot for an average consumer to
not know necessarily where tostart. The firewall, yes. The
password protection, yes. That'ssomething that they could
probably start on their own,But, what what does it look like
when someone comes to you?

So it depends. I'm, entertaining a prospect
right now, and I've gottenpretty hardcore. I have
requirements before I'll dobusiness with them.

Eric Beels (42:46):
Mhmm.

And, you know, I'll see if they have a budget,
and I'll see how they feel aboutsecurity, and what their
willingness is, you know, toimplement security measures and
stuff. Yeah. And, if they thinkit's just a giant waste of time
or whatever, then, obviously, Ijust move on because I I'm not
gonna waste my time nor am Igonna become part of their
liability when they get hacked.So but, it really doesn't matter

(43:08):
on the size of the client. It itreally matters on the attitude
of the client.
Mhmm. You know?

Eric Beels (43:14):
How serious are they? Not not really locked

Are you coachable? Yeah. Yeah.

Eric Beels (43:18):
Yeah. Because it you know, there is kind of a
learning process, I think, withwith with with all of this. You
know, I I there's kind of a it'sfunny because it's it's it's not
kind of cracking down on thesethings. It's sort of like, you
know, complaining that your caris locked, I guess. Mhmm.
But we lock our cars all thetime now, but, you know, there
was a time period where locksweren't on cars and such. Right?

(43:40):
And so it it's like, I thinkit's just like a learning
process and kind of being openminded to whatever that, you
know, it's unfortunate we haveto do this in the first place.
Right?

Fraud isn't going anywhere unfortunate.
These people think that it's acareer, and and we have to kind
of make it a little bit of acareer to combat it. Mhmm. I
mean, we do wear lots of hats asentrepreneurs, but I'd be wet
very much willing to give thishat to to Gus to wear because
it's a heavy hat for you.

It is. But one of the things that you know, when I
think in terms of businesscontinuity, I think of
resiliency. Because if if you,let me rephrase this. If you
haven't been hacked, it's only amatter of time before you're
hacked. It's only a matter oftime.
Your number will come up. So howare you gonna survive that hack?

(44:33):
How resilient are you? What whatkind of systems do you have so
you can bounce back quickly?Right?
So so that's what I focus on alot with my clients is is the
resiliency. So we're gonna we'regonna try and bulletproof your
network as best we can. We knowthere's sophisticated actors out
there that if they really wannaget in, they're gonna get in. So

(44:54):
what do we have in place tobounce you back to normal?
Right?
And so, we call that an RTO inour business, which is a
recovery time objective. Right?And some people want a 2 hour
recovery time objective. Somepeople want a 72 hour recovery
time objective. Those that wanta 72 hour recovery objective
usually realize after they'vebeen hit that they wanna close

(45:15):
that window considerably.
Right? Because 3 days is a longtime to be completely out of
business. Right?

Yeah.

So one of the best ways you can do that is
just by something really simpleand having a backup. Okay? So
the challenge with backups andagain, I'm talking to you out
there in the audience. You needto talk to your IT guys because
I guarantee you, 9 9.9% of yourIT guys aren't doing this or
probably aren't even gonna knowthe word I'm gonna tell you.

(45:42):
It's called immutable.
So what does immutable mean?Immutable means that it can't be
tampered with. It can't bechanged. 99.9% of people out
there are not doing immutablebackups. So where it used to be,
you could have a good backup youcould just restore from.
Well, hackers are encryptingthat backup now. Mhmm. And so
now you can't restore. Right? Ifit's immutable, they can't.

(46:06):
They can't encrypt it. If it'sair gapped, they can't encrypt
it because they can't get to it.So air gapped means that it's
detached from the system. Mhmm.It's not tethered by any
electronic form.
Okay? And so what we do with ourall of our clients is we air gap
their backups, and we doimmutable backups, both locally
into the cloud. And all datawith our backups are encrypted

(46:29):
in transit and at rest. Mhmm. Sothey can't they can't tamper it.
So that's how we can guarantee arecovery time objective.

Eric Beels (46:37):
So is the air gap is that basically, like, you know,
plugging in a hard drive,letting it back up, and then
just physically disconnectingit?

Exactly. It's the old school magnetic tape. Right?
You back up to a tape drive, andnow you can't hack it because
it's right? It's a standaloneentity.
Right?

Eric Beels (46:55):
Well, you know, it's it's interesting because it's,
you know, it's it's funnybecause it it it's such it it
sounds such a,

like Like a step backwards?

Eric Beels (47:05):
Yeah. Almost. It's like, well, I gotta, you know,
disconnect it and such. Right?Because there's not because I
and and but I kinda just thoughtof too.
I've I've heard that, like, evenin in the the military that I
guess I think, like the like thenuclear stuff that they try to
keep it on like old, really oldtech that's like, I don't know,

(47:26):
from seventies or eighties orsomething like that, that that's
completely disconnected, butthen it's not even like a
regular computer. It's likerunning off of, like, I don't
know, floppies or something likethat. It's like or it's a analog
or something. I don't reallyknow. But for, like, the the
purpose of that, okay, modern,like, you know, viruses can't

(47:49):
infect this because it's it'sdifferent technology, basically.

Right.

Eric Beels (47:52):
It's in a similar vein as that. Mhmm. Wow. So how
okay. So I have a few okay.
A couple questions. I guess,what are some some of the key
businesses if if there's any,that are like at most risk for
for being hacked? Like, maybewhat's what's who are the

(48:13):
businesses that hackers arelike, oh, I wanna really go
after these guys because ofdon't know, some reason that if
if I'm

It would be hard to narrow down because it really
depends on the intent of thehacker. So some hackers might be
going after, companies that arepolitically persuaded because
they disagree with theirpolitics. Some may be going
after financial institutionsbecause they support things that
they don't like. Other ones mayjust be doing it for monetary

(48:43):
gain, and some might just bewanting to steal state secrets.
And but but the biggest threatout there now is ransomware.
And and ransomware, it's notyour dad's ransomware. It's
changed considerably. And nowwhat's out there is called
ransomware as a service. Andwhat does that mean?

Eric Beels (49:05):
As a service?

Service. So let me describe what that means. I
have $20,000 in Bitcoin, whichcan't be traced because it's,
you know, it's, it's Bitcoin.So, cyber currency. So I go into
the dark web, and I buy aransomware as a service
software.

(49:27):
And I pay this company to hostit and might be some East Block
nation or whatever, one of ouradversaries. They'll host this
for me, or I can host it on myown server if I want. And what
this ransomware as a servicedoes is it starts sending out
all these bots that startshacking all these networks. And
it's gonna get on networksbecause most small businesses

(49:47):
don't have very sophisticated,you know, you know, technology
to prevent it. And it justautomatically starts sending
them ransomware notices afterthey've been ransomed.
And some will have a good backupand restore the data and say,
forget you, and some will paythe ransom. And when they do,
you're just cashing in.

Eric Beels (50:04):
Wow. So you're just basically paying a hacking
company to do the hacking forhacking as a service, actually.

Yeah. That's right. They call it ransomware
as a service.

Eric Beels (50:15):
That's crazy. And because of, like, all the
cryptocurrencies that have beenuntraceable, it's, like, makes
it an easy way to pay them

Exactly.

Eric Beels (50:23):
Versus yeah.

And this is where before, when really small
clients would say, well, how bigof a target are we? I'd say,
well, you know, they're notreally after you. But ransomware
as a service doesn'tdiscriminate. It's not
intelligent. It doesn't know.
It doesn't care what size youare.

Eric Beels (50:38):
They just it's just a little more. Okay. We'll put
it out there and do this thingor whatever, and that's it. And
that's not And

what they're finding is the smaller companies
are the least sophisticated andthe most likely to pay out.

Because they don't know what to do.

So, yeah, that's ransomware as a service. That is
the new ransomware out there.

And one last thing I know that we've talked
about a lot, but what about whatabout people's cameras? Is there
anything that you wanna, like,as far as, like, your cameras on
your laptop and things likethat? Is there any security
measures that you wouldrecommend on something like
that?

Yeah. So you should have, a really good
endpoint protection. That's afancy word for an antivirus. You
should if you can, again,encryption, and you should have
your camera disabled and youenable it on demand. Don't
because most of the softwarewill automatically enable it.
You don't want it to do that.And one thing that a lot of

(51:40):
small businesses, most of themdon't do and should be doing now
because it's affordable now. Andthat is having, what they call
an XDR. What an XDR does is, itties to a SIM and a SOC fancy IT
terms. Or, basically, what itsays is it's grabbing everything
that's happening on yourcomputer.
Is sending it to a securityoperation center, and they're

(52:03):
analyzing it. And then they sendyou an email alert if they see
something suspicious. If it's ona threshold of 1 to 10, if it's
greater than an 8, then theyautomatically triangulate it and
shut it down. So you should bedoing that on every computer now
because it's affordable. Forless than $10 a month, you can
implement some of thattechnology now.

Eric Beels (52:22):
So they're look and that's kind of, like, almost so
that's kind of they're lookingfor, just certain things that
might stand out as red flags.Like, hey. This could be a
problem. So there's a certainawareness, I guess. It's like
Yeah.
Okay.

And I'll tell you a story. I'm not gonna name
names, but I I got a call from aBNI member a couple of years
ago, and, they were being,blackmailed. And, what happened
was, their kid was looking atpornography online, and they had

(52:54):
another computer across thefamily room from it. And someone
had hacked the camera and wasvideoing their kid watching
pornography.

Eric Beels (53:03):
Oh, wow.

So then was telling them that we're gonna
put this all over the Internetand on your social media if you
don't pay us x amount of dollarsor what have you. Right?

Eric Beels (53:11):
So they're black back blackmailing them by by
recording that. Oh, wow. So theother thing you do,

of course, is you have those little camera covers
Sure. And you can get them foryour laptops or what have you.
You should always have thatcovered until you're ready to,
execute.

Eric Beels (53:25):
What about microphones? The mic the audio
side of things on that.

Same exact thing. Yep. Same thing. Yeah. You gotta
lock it down and enable it on tome.

Eric Beels (53:34):
But it's like, how you know, the camera, okay, you
can block it physically, but Idon't know how how do you you
know? Because it's so like, someof these laptops, you know,
they're still built in. Right?Right.

So

Eric Beels (53:47):
if you're con if someone's, like, concerned
about, like, you know, somethingbeing recorded that that
shouldn't or whatever, how wouldyou how would you prevent that
on a laptop?

You go to command line and type in services MSC
and then shut off the audioservice.

Eric Beels (54:01):
I see. So you gotta go into Manually. DOS or That's
what I do, man.

Take you 30 minutes to power up your
computer in those markets.

Eric Beels (54:10):
Mine has, Yeah. I know.

It takes a little bit.

It takes scan of blood analysis.

Eric Beels (54:17):
Yeah. It takes us a little bit. It it it takes Gus
an hour and a half to log in toZoom. Yeah. You gotta connect
everything together.

Yeah. It's a

And in 4 different languages.

Eric Beels (54:27):
I know. Right?

You know, there's, I was talking about
firewalls earlier, and, I wantedto describe it a little bit. I
think this is important for theaudience and, for people to
know. So the way, firewalls workis that they use a couple
different technologies. One'scalled stateful packet
inspection, which is wheneverything is TCP IP, it's

(54:51):
little data packets that comedown, transmit up and down
through through the Internet oracross a computer network. When
these come down, a stable packetinspection, it tries to dissect
the packet and look formalicious headers or those type
of things that might give it anindication that something bad's
happening.
Right? So that's one way that'sstateful packet inspection. The

(55:12):
other thing that they do is allthese firewall companies
subscribe to the services thatalert other security companies
that they've found a, either avulnerability or they found an
exploit. Okay? And so some ofthe most higher end firewalls so

(55:33):
for example, I, you know, I Italk about SonicWall a lot.
They they subscribe to 2 ofthose services. So so they have
a lot of information constantlyupdating these firewalls and
letting me know what to block.The most expensive and
sophisticated firewalls outthere like Palo Alto, they

(55:54):
subscribe to 5 of thoseservices, so they have a greater
chance that they're gonna findsomething. They're gonna be
alerted sooner. Right?
We deploy a product, called DartCubed, and it was developed by a
friend of mine who used to bethe head cybersecurity guy for
the National Security Agency.And it has a 125 plus of those

(56:17):
signature services coming in.And so we put that on our more
sophisticated clients, and, itit does far more than any
firewall is going to do. It willshut down things long before I
mean, because these things we'reusing these for the DOD as well.
So if the government sees athreat, you're aware of it.
It's blocking it before it evergets to you as well. So that's,

(56:40):
and Dark Cubed, it's a service.It's an it's a cloud appliance,
and we sell that for a $125 amonth. And, again, it's far
better than any firewall you canput your money into, and it's a
super cheap way to really helplock down your system. And so
when we first

great investment.

It is. When we first meet clients, the 2 things
we do immediately is we put darkcube on the front end, and then
we do immutable backups on theback end. And then we work our
way into the middle. Mhmm.Right?
Hardening all the computers andall the services and setting up
policies and procedures thatthey have to follow. Mhmm. Your
procedures, Eric. Yeah. Policiesand procedures that they have to
follow.

Your procedures, Eric.

Eric Beels (57:18):
Yeah. Seriously. Yeah.

So it's, yeah. So those those are the 2 most
important investments you canmake immediately is getting a
product like Dark Cubed and thenan immutable backup system.

Sounds like everybody could use your help,
guys.

And the dark cube well, even like the MDR, XDRs,
those type of things, those havegotten so inexpensive now.
Literally, everybody in our BNIgroup should be using that to
protect them. And if their ITcompany doesn't know what those
what they are, then they need togo shop for another IT company
because it's really elementarynow.

Like an ounce of prevention could save you a
half a $1,000,000 or more. I'mwe never found out which option
that guy chose, but Right.Right. I know you can only tell
us so much, but, yeah, I hope Ihope

Eric Beels (58:03):
Well, that's, you know, that that's the that's the
crazy thing that that like,because all the AI stuff is kind
of making the hack stuff easier,so it's almost like because it's
like what you said with the, youknow, with the ransomware as a
service and whatnot too, it'skind of like it's kinda getting
to the point where, you know,the hackers, they're not really
it sounds like they're notthey're they're doing less

(58:24):
actual hacking and just letting,like, bots do a lot of it.
Exactly. It's all kind

of automated

Eric Beels (58:29):
at this point. So it's like it's it's it's like
they're not necessarilytargeting you directly, not
going like, oh, I'm gonna goafter Eric Beals or whatever and
stuff too. Right? They're just,you know, you just kinda get
become another number, a numbertarget Yep. In the Right.

There's automated. Yeah. But there's a I
mean, there's so many securityholes. And, what so what we'll
typically do when we engage aclient is, we have a software
called Network Detective, and itgoes through it does an analysis
of their network. It doesvulnerability scan, and then it
shows us where all the holesare.
It creates an executive summary.We show them the executive
summary, like, on a scale of 0to a 100, 0 being you're a 100%

(59:06):
secure. Most new clients we runinto, they'll be, like, 97, 98.
I mean, you could drive afreight train through their
security. There's it's almostnonexistent.
Mhmm. And, a lot of it's justreally simple stuff. You know,
like, with all of our clients,nobody without elevated
privileges can put a thumb driveinto the computer and have it

(59:28):
read data. Because one of thebiggest problems, over 80% of
the hacks, 87% of hacks lastyear, according to the FBI
statistics, were insider threat.Mhmm.
And insider threat doesn't meanyou're intentionally being
malicious. It means you downloadsome app on a thumb drive
somebody gave you or youdownload it from home and you go
and plug it into the corporatenetwork because you wanna use it
at the office. And now you justinfiltrated your system with the

(59:51):
virus. Right?

Eric Beels (59:52):
Yeah. Plugging it in. It's it almost sounds kind
of like, oh, well, it'sphysically here, so it's okay.
Kinda like the outgoing thing alittle bit. Like, oh, it's going
out, so it's must be safe orwhatever.

Gus Cervantes (01:00:01):
Right. So so we prevent all that. You know, you
can't just plug a thumb drivein. We use PAM Solutions, which
is a, a password accessmanagement solution. And so one
of the things that especially inscientific companies, and we
deal with a lot of engineeringcompanies, You have, I I I say

(01:00:22):
this with affection.
I'm I'm a recovering engineer,so don't get offended when I say
this, but we're the smartestpeople on the planet. Just ask
us. And so we we seem to feelprivileged. Like, well, I'm
intelligent enough. I know whatI'm doing.
So I got you know, I needadministrative privileges so I
can install the software orwhatever. And so they're one of

(01:00:45):
our biggest, challenges isworking with scientific people,
analytical people becausethey're typically more
sophisticated. They dounderstand technology, but they
don't look at it from a from athreat perspective. Right?
They're looking at it from, howdo I leverage this technology to
make a product better?
I

Eric Beels (01:00:59):
see. It's like it's like someone being, you know,
familiar with electricity and,like, they like, oh, I can
install this.

You know?

I can install this this this electric charging
thing Yeah. For the car orwhatever and stuff too.

Crystal Privett (01:01:10):
Says a a handy friend is a dangerous blend.

Right. It's almost kinda like that, but in a in a
digital space. Yeah.

So what a PAM solution allows us to do is it
gives us a dashboard where wepreauthorize certain individuals
within the within the businessto get elevated privileges on
demand, but they never know thepassword. So what happens is a
QR code will pop up on their, ontheir screen. They'll
acknowledge it with their phoneas an MFA, multifactor

(01:01:40):
authentication, and then it'llgive them access privileges,
elevated privileges at thatmoment for that software so they
can install that software. Andthen the password's constantly
changing, so they never see thepassword nor do they ever know
the password. And then it alertsus immediately that someone just
used the PAM solution, and wecould take a glance at it and
go, okay.
We're showing so installingsolid works or whatever it was.
It's legitimate. Right? Mhmm.You know?

(01:02:01):
Mhmm. So it's constantvigilance, but it keeps them it
keeps the prima donnas in check.Right? So because they you know,
a lot of people just feel theygotta have that. The other
problem that we run into a lotis, as the owner, well, I should
have all the passwords becauseit's my company.
I own the property. That'sgreat. So we use password

(01:02:24):
managers where we can share thatinformation with the owners. And
the other problem we're runninginto with owners is like, well,
I should have admin privilegesall the time so I can do
whatever I need to do. Right?
And that's a big mistake. Youknow, as I mentioned earlier.
Right? You wanna have a lesseraccount that doesn't have those
elevated privileges, and youescalate as you need them.

So how do you I know we're going, like, a little bit
longer here, but I have it butthe how because I feel like, and
I've kinda gone through this,but I was one who was really
willing, I guess, to kind of,like, push push through this
because it was definitely alearning curve for me when I
kinda got into doing passwordmanagers. And the hurdle that I
came across was it was, like,you know, either constantly

(01:03:03):
asking for a password orsomething like that, or it's,
you know, just not functioningproperly. And I don't really
know why necessarily. And maybethat's that's just kind of like
for the IT guys in the area thatkind of, help figure it out.
But, like, I guess the questionI have is, like, how what do you

(01:03:28):
have any suggestions on helpingsomeone kind of overcome, like,
those hurdles?
Like, that that kind of becauseit's like, because, oh, I just
wanna be able to do it becauseI'm I'm the owner, I'm the admin
or whatever, but it's like,those those might be the worst
people because they're typicallynot the one that's, like, most
mindful about security becausethey're the business owner.
They're trying to run thebusiness or whatever. Right?

(01:03:48):
They're not something focused.Right?
So it's so I I could see thembeing, like, the biggest culprit
at times because they want thosethose things.

Crystal Privett: Unintentionally. (01:03:56):
undefined
Unintentionally. Right.

Right. But do you have any suggestions on on, you
know

The mindset behind it?

Yeah. Maybe the mindsets or helping someone kind
of, like, how do you pushthrough

that Overcoming that objection.

Yeah. Overcoming, like, the the the The fear. The
hurdles or the fears that Mhmm.Kinda come come along with
getting through learning how todo it.

So we do quite a bit of cyber training

Yeah.

With our clients. And and, typically, we'll do
that too before we implement aparticular solution, like
password manager or any type ofaccess control. We'll explain
what the result's gonna be ifthey try and do certain things
and some of the problems thatthey may run into and how to
overcome them. One of the thingsthat, one of my clients
yesterday, the owner, at 4 inthe morning, signaled me. And I

(01:04:48):
say signal because we use signalbecause it's encrypted.
And, he forgot his UB key athome, and his UB key is
something they have to stick inthe computer as part of the
multifactor authenticationprocess to be able to log in.
Right? And so I can generate acode, a one time code that he
can use to bypass that. But, youknow, it's

You were his backup.

Right.

So I was backup. Right. And and there's a bunch
of us that are his backup.Right? It's happened to be the 1
person on call, so I was able toanswer that immediately.
So I sent them a code. But,yeah, I mean, there's times
when, you know, business ownersget frustrated because but it's
for their own good. And, andthey understand it. And that's
why I said when I'm vettingclients, I'm looking for that

(01:05:32):
attitude. You know, do you seeit as a strategic initiative
that's going to make you morecompetitive?
Or do you see it as overhead?Because you see it as overhead,
you know, saying I rather right?And that's the LaVista. Right? I
don't I don't got no time todeal with you because you don't
have the right mindset.
Mhmm. You know, and you're justa failure looking for a place to
happen from a cyber perspective.Mhmm. So

And do you so I'm I'm assuming it sounds like you
do audits of our companies aswell too to kinda see where
they're currently at.

Oh, all the time. So that's what ITS team
specializes in. We specialize incompliance as a service,
specifically for the defenseindustrial base. And so there's,
different compliancerequirements they have to meet.
And so we have software that'sconstantly checking them real
time and alerting us whensomeone comes out of compliance.
Mhmm. And it's constantlyscanning for, user accounts that

(01:06:22):
haven't been logged into in 30days. So why would that be
important? So if an accounthasn't been logged to in 3 days,
either the person is no longerwith the company or they're on
extended leave and the accountneeds to be disabled because no
one's monitoring that account.And that's a hacker's dream.
Right? So we'll disable thoseaccounts. Right? And we have
onboarding and offboardingpolicies. You know?
What happens to somebody's emailthat gets forwarded to so and

(01:06:44):
so, blah blah blah. You know,shut down all their access,
their voice mail, and all thatother thing. Mhmm. So, yeah, a
lot of compliance, a lot ofauditing that goes on with the
compliance. So we do CMMIcompliance, we do CMMC
compliance, ISO, the 27 1,001ISO.

Mhmm.

Not too much HIPAA. Certainly, 853, the 171,
any any of the big,cybersecurity frameworks, we we
definitely deal with. So, yeah.

So people who should just send their referral
slips in now.

So, yeah. So like, if if, you know, I imagine, you
know, a lot of our listeners arekind of, you know, this is a
certain fear aspect on this,right, that's the natural of it.
But I think it's a healthy fearthough, if you're a little bit
afraid after this. I thinkthat's kind of a healthy fear

(01:07:44):
because, you know, you youshould have a little bit of fear
on this. And so if someonewanted to, like, reach out to
you, contact you maybe do anaudit, have you do an audit or
something like that, how wouldthey contact you?

They can email me, Gus@itssteamdot com or info
at its team dot com. Or if theywant to get everybody's
attention, send it to support atits team. And we're more than
happy that you bring in ournetwork detector tool, put it on
your network and and share withyou, our discovery. And I think
most of you will be shocked.And, it's also a good way to

(01:08:19):
keep your current IT companyhonest.
You know, we'll come in thereand do a audit. We give you the
executive summary, and we evengive you the technical, what I
call a punch list of everythingthat needs to be fixed, the
actual computer needs to befixed on. And you can share that
with your IT company and say,hey. Go fix this for us. Yeah.

So good. So So important. Thank you, Gus. We
appreciate you being here todayand sharing your wisdom and
scaring us

straight. Yeah. Yeah. So, yeah, thanks so much,
Gus. And so, yeah, if you guysif you got value from this
episode, which I imagine prettymuch everybody will to some
extent, because most of us arenot super tech savvy, especially
on the security standpoint inthis in this area.
I think there's very few peoplelike yourself. So we're very

(01:09:04):
grateful to have someone likeyourself, Gus, that, you know,
is willing to kind of do all ofthis and kind of, you know, be
this, this security knowledgedatabase, I guess, and really
kind of bringing to light allthis. So if you know somebody
who's who maybe has actuallyeven been through a hack, I hope

(01:09:25):
not. But, you know, if ifsomebody has and they just don't
know what to do or Like

you said, if they haven't, then they probably
will.

So Yeah. Or that's the thing, you know, it's
because we wanna kind of bepreventative. Right? So if I
would say if you know somebodythat, maybe in particular deals
with a lot of sensitive data inparticular, but you can you just
know they're like, I don't thinkthey're really protecting them
themselves that well.

Or someone that doesn't know where to start
because a lot of people don'tknow where to start, and Gus has
so much wisdom and knowledgethat he can't guide them.

Yeah. If you know someone like that, share this
episode with them because, Ithink it sounds like that the
particularly though those peoplewill get a lot of value from
this just to kind of bring a lotof this, to light. And we wanna
be preventative. We wanna beproactive. You know,
cybersecurity stuff is onlyhacking is only really I only

(01:10:20):
see it getting worse personally.
I don't really see it slowingdown.

Protecting our friends and family by sharing
this episode is, kind of abeautiful gift to give someone.

Yep. Yep. And that's also how how we grow this show
is is sharing it with with otherfolks, particularly in b and I.
And, yeah. So thanks so much.

Yeah. And, you know, I'd like to just say, feel
free to contact me and pick mybrain. I have clients, that have
one computer working out oftheir home, and I have clients
that have multiple locationsthat have over 1100 employees.
And I mean this when I say this,I live in a constant state of
paranoia, so you don't have to.

I love that. Oh, man.

Don't forget to track your CEU, and we will see
you on the next episode.

Thanks so much, guys. Thank you.

Thank you for joining us for the Business
Boost Hour. My name is CrystalPravette, and this is Eric
Beals. Thank you for joining usand don't forget to document
your single CEU. See you nexttime.

See you in the next episode.

All Episodes

Episode Transcript

Popular Podcasts

Amy Robach & T.J. Holmes present: Aubrey O’Day, Covering the Diddy Trial

Betrayal: Season 4

Crime Junkie

.css-15opob5{left:0;position:absolute;top:0.8rem;} All Episodes

.css-14f5ked{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:2;overflow:hidden;}8. Fortify Your Business: Cybersecurity Essentials Unveiled with Gus Cervantes

Episode Transcript

Popular Podcasts

.css-r6mb8g{margin:0;word-break:break-word;display:-webkit-box;-webkit-box-orient:vertical;box-orient:vertical;-webkit-line-clamp:1;overflow:hidden;}Amy Robach & T.J. Holmes present: Aubrey O’Day, Covering the Diddy Trial

Betrayal: Season 4

Crime Junkie

All Episodes

8. Fortify Your Business: Cybersecurity Essentials Unveiled with Gus Cervantes

Amy Robach & T.J. Holmes present: Aubrey O’Day, Covering the Diddy Trial