August 6, 2025 • 57 mins
What if the pirates of the high seas never disappeared — they just moved online? According to cybersecurity expert and Oklahoma City business owner Josh Cochran, that's exactly what's happened. In this must-listen episode of Small Business Pivots, Josh shares how today’s cybercriminals use AI-powered tactics to quietly infiltrate your business, steal sensitive data, and redirect payments — sometimes without you noticing for months.
Josh is the owner of Diverse CTI, a leading managed IT and cybersecurity company in Oklahoma City. As a second-generation entrepreneur in IT services and a first-generation founder of an automotive upholstery business, he offers a rare dual perspective on risk, business growth, and protecting your digital empire.
In this conversation, you’ll learn:
• Why the internet today is like the lawless oceans of the past — and what that means for small business owners
• How hackers use AI to scan thousands of emails, create fake invoices, and siphon money undetected
• The biggest myth about cloud storage (hint: it doesn’t actually back up your data)
• The essential cybersecurity steps every small business should implement today — from multi-factor authentication to endpoint detection and response (EDR)
• What cybersecurity insurance really covers (and what it doesn’t)
• How running both first- and second-generation businesses shapes leadership decisions and risk tolerance
Josh shares real stories, including one about hackers who redirected $150,000 in payments through a fake invoice that looked exactly like the real thing.
Whether you’re a startup founder, a multi-generational business owner, or just beginning to think about IT security, this episode will help you understand the modern threats facing your business — and how to defend against them.
👉 Visit diversecti.com to try their free cybersecurity assessment tool and find out where your business is vulnerable.
Josh Cochran: CEO of Diverse CTI
Website: https://www.diversecti.com/
LinkedIn: https://www.linkedin.com/in/joshjcochran/
Blog: https://www.diversecti.com/category/blog/
#CyberSecurity #BusinessProtection #JoshCochran #DiverseCTI #AITech #DigitalThreats #Hackers #Malware #FamilyBusiness #SmallBusinessOwner #BusinessGrowth #Entrepreneurship #OklahomaBusiness #ITServices #ManagedIT #BusinessStrategy #BusinessCoaching #BuildYourEmpire #OurBusinessIsHelpingYoursGrow #BOSS #BOSSBusiness #BOSSLoans #BOSSEmpire #SmallBusinessPivots #MichaelMorrison #OklahomaCity
1. Want more resources to grow your business faster?
https://www.businessownershipsimplified.com/
2. Want to connect with our Host, Founder & CEO on LinkedIn?
https://www.linkedin.com/in/michaeldmorrisonokc/
3. Want professional business coaching with our Host, Founder & CEO?
https://www.michaeldmorrison.com
4. Want to set up a FREE business consultation with our Host, Founder & CEO?
https://www.businessownershipsimplified.com/consultation
FOLLOW US ON:
- WEBSITE: https://www.businessownershipsimplified.com/
-WEBSITE: https://www.michaeldmorrison.com/
-LINKEDIN: https://www.linkedin.com/in/michaeldmorrisonokc/
-YOUTUBE: https://youtube.com/@businessownershipsimplified
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
Speaker 1 (00:00):
All right, welcome to another Small Business Pivots.
Today we have another specialguest from around the world and
this guest is almost in my backdoor, the great state of
Oklahoma.
We are featuring Oklahomabusiness owners this year this
summer, and I know that no onecan introduce themselves and
their business like the businessowner, so I always let you do
(00:21):
the introductions so you can sayit like you want it said.
Speaker 2 (00:25):
Well, thank you, thank you.
So my name is Josh Cochran andI'm with Diverse CTI.
We are an IT managed servicescompany and we specialize in
basically managing the ITinfrastructure for small to
medium sized businesses thathave really reached that point
(00:46):
where the hourly IT guy isreally not a match anymore.
And I always tell people youknow it doesn't always mean that
you know you're frustrated oryou think your IT guy isn't
doing a good job.
A lot of times it's justrelated to the maturity of the
company.
You reach a point where youneed something a little bit
(01:08):
deeper, a little wider, maybe alittle more technical expertise,
and that's usually whencompanies come looking for me
and my team.
Speaker 1 (01:19):
Awesome, awesome.
So we've got small businessowners listening.
How do you think we're going tohelp them best today?
Speaker 2 (01:25):
One of the things that I think just recently maybe
in the last four to five yearsthat I've begun reflecting a
little bit more.
I've been doing this for 25years, been an entrepreneur for
25 years.
My dad started the company thatI'm in right now.
My dad started the company thatI'm in right now 40 years ago,
maybe almost 41 years ago, backin 1984.
(01:49):
So I was kind of raised in thatentrepreneurial maybe more of
an epiphany that I've alwaysseen myself as an entrepreneur
(02:11):
because I've started some otherbusinesses I'm in another
business with one of my bestfriends and it's in the
automotive industry but this isreally my passion diverse CTI
but I think I've maybe realizedthat this is somewhat of a
second generation entrepreneurjourney and that's been an
(02:32):
interesting lens to look backthrough the years on, because I
don't think I ever really lookedat it that way.
I looked at it, you know, it waslike me and my dad and we were
partners and I'm one of thelucky ones my dad and I are
still best friends.
He's retired now.
He retired in 2019.
(02:53):
And so that kind of caused meto start looking at things a
little differently, because I'mkind of on my own at this point.
He's been an excellent partnerthrough the years.
He's been an excellent partnerthrough the years.
But anyway, just recently I'vebeen kind of realizing that in
(03:13):
some ways, the journey of asecond generation entrepreneur
is very different than juststarting the business from
scratch, which I've also done.
I've done both of those.
The business from scratch whichI've which I've also done, I've
I've done both of those.
So, uh, my other business thatI'm in involved with, uh, my
best friend is, is a $2 million,you know, uh, gross revenue
(03:34):
business as well.
So so I kind of have both sidesof it and I'm realizing, um,
for whatever reason, I didn'treally think of diverse CTI as a
second generation business.
I just because I grew up, yeah.
Speaker 1 (03:49):
Yeah, so it is different being a business coach
and working with familybusinesses, generational
businesses, partnerships they'reall different and so I think
we're going to be able to helpthem a lot with some insights
that you've got, some tips andall that good stuff.
So let's introduce the showreal quick and we'll be right
back.
Welcome to Small BusinessPivots, a podcast produced for
(04:11):
small business owners.
I'm your host, michael Morrison, founder and CEO of BOSS, where
we make business ownershipsimplified for success.
Our business is helping yoursgrow.
Simplified for success Ourbusiness is helping yours grow.
Boss offers business loans withbusiness coaching support,
apply in minutes and getapproved and funded in as little
(04:33):
as 24 to 48 hours atbusinessownershipsimplifiedcom.
All right, welcome back to SmallBusiness Pivots.
We're talking to a secondgenerational business owner and
family family.
Most family businesses are notpretty, but you said yours was.
(04:55):
Can you give us first anyinsights of how that baton was
handed off, because a lot offirst generation business owners
they don't want to do that andso you must have proved
something to them led thecompany.
You know, kind of what was thatscenario like for us?
Speaker 2 (05:16):
Well, I have to give most of the credit to my dad.
I mean him, him and I have, uh,he kind of raised me just in a,
raised me just in a verywonderful way in terms of I
never felt that I was competingwith my dad.
I never he treated me as anequal in the sense of, you know,
(05:38):
giving me responsibilities andso forth.
So a lot of that I have to.
I just have to say, uh, kudosto my dad.
Um, he's just one of those rareindividuals who, um, just
doesn't have a chip on hisshoulder.
So he was.
He was always open to mythoughts and my, my input over
(06:02):
the years, which, you know,obviously I was a kid, so it
wasn't always good input, youknow.
But yeah, he was willing tokind of let me try things and
fail and put, you know, allow meto put the years in, to kind of
learn, and yeah, so in terms ofwhy he felt comfortable, I
(06:27):
think it was just when I wasgrowing up.
He he told me you know, please,please, don't just be in this
business just because it is thefamily business, don't, don't do
it, because you know I've doneit.
You know, go off, do your thingIf this will be here.
If you want to be involved, youcan be.
(06:48):
And I actually early on didn'twant to be.
I thought, you know, I I reallydidn't want to live in my dad's
shadow at the business.
I thought that would be kind ofwhat it would be like and I
wanted to have my kind of my ownsuccess, not like in a, in a,
you know, like a selfish,arrogant way or anything, just
just wanted to kind of it wasfor more for me, like I wanted
(07:09):
to know, like, hey, I can go outinto the world and survive, and
that was important to me.
And so I went to school for anelectrical engineering degree
and two years in, a couplethings were going on.
I was helping my dad with hiswebsite, which the dot-com boom
was just going crazy.
(07:30):
This was 99-2000.
And I told my best friend atthe time he was going to school
for a mechanical engineeringdegree and I said you know,
we're morons if we don't start aweb business.
We're just complete morons ifwe don't do this.
This is exploding.
(07:51):
And because I saw what wasgoing on with my dad's business
he was selling phone systemsonline like crazy, just left and
right, I mean, and I was kindof assisting him on the in the
on the website side, because Ihad kind of dabbled in some HTML
programming and kind of taughtmyself how to do that because it
looked fun.
And uh, so my best friend atthe time, uh, and still, you
(08:16):
know, still is he's the guy thatwe started the automotive
business together.
He said, okay, well, but I haveno idea what, what should we do
?
And I was like I don't knoweither, but we need to do
something.
So so we eventually totallyseparate story but stumbled upon
an opportunity.
We were car guys and into cars,and so we stumbled across an
(08:39):
opportunity there that wethought would be worth pursuing.
And, and while we were startingto build that business, I just I
was fed up with college, justfed up.
I just was like this is not forme, it's not what I thought it
was going to be.
So I dropped out and kind ofwent full time into starting
this business with my buddy andyou know, my dad said you know
(09:02):
there's plenty of work over hereon the website and running the
online part of the business.
If you want to do that, youwon't be a burden to your new
business.
And I thought that soundedgreat.
So I jumped in to Diverse CTIand was working on the website.
(09:22):
I built a website for my othercompany with my buddy the
automotive side and and um, andso that's kind of how it started
, that I got I got you know backinto diverse CTI full time.
Um, what I began to realize wasthat I really love and this is
kind of maybe something that, uh, the IT you know part of the
(09:46):
business allows me to do.
We would constantly beconnecting with other business
owners because you're makingyou're making a big decision
when you go with a new phonesystem or a new, whole new
network and you know your IT guyand you know all this
infrastructure that goes, goesalong, goes along with that.
So I was interfacing with otherbusiness owners and that was so
(10:10):
much fun.
I would learn their story, justlike we're doing right now.
I would learn their story.
I would get kind of somewhatpersonally invested in the story
because we're installing ITinfrastructure equipment and
helping them manage it, which islike the foundation of their
business, how they interact.
And to do that I have to askquestions, like you know how do
(10:33):
your employees use theircomputers and their phones, and
when your customers call in, whodo they need to talk to and why
?
And you know, because we'remaking phone tree menus and
programming the phone system toring different areas in their
businesses and so forth.
So as I did that more and more,I just realized this is awesome,
I love this, I really like thisportion of it.
(10:56):
I'm it's like I'm a partnerwith these other business owners
.
I'm a part of their success,watching them grow, and that was
a blast to me.
So I think as I got into that,I was exposed to other business
owners, I was exposed to otherentrepreneurs and that was very
(11:18):
fulfilling to me and I think mydad saw that spark.
Think my dad saw that spark,you know.
And so as the opportunities inthe company kind of became
available, I just kept taking onmore responsibility and more
responsibility.
Until you know, really probablyabout 2010, I was basically
(11:39):
running the whole company exceptfor sales and the you know,
sales and marketing.
That that's kind of.
He just kind of stayed in thatside of things.
Speaker 1 (11:51):
What would you say are some traits that your dad
had that showed you how to be agood business person.
Speaker 2 (12:01):
I think this is maybe one of the mysteries about
being an entrepreneur is justthat tenacious drive and
sometimes, in the face ofeverything telling you this is
the, you know this, youshouldn't do this, this is the
wrong way to go, right, likeit's a bad time to start a
business, or nobody wants this,or it's a bad time to start a
(12:24):
business, or nobody wants this,or and, and.
Those are all real questions,and this is like the mystery of
being an entrepreneur is likethere's this small speck in
everybody's story wheresomeone's telling them you know,
this is probably not a goodidea, you're taking a big risk
here.
You know you're going to loseeverything.
You know what are you doingwith your life?
You know you're even askingyourself that question.
(12:46):
You know and some of themsometimes that you really do,
you should stop and quit.
It's a bad idea, right, but howdo you know?
Because, like, so this?
There's something mysteriousthere.
You know about being anentrepreneur where you just keep
going and you, just you justkeep banging your head against
the wall and eventually there'sa hole.
(13:06):
You know, and you go through it.
Um, so, watching my dad do that,um, you know in in the
beginning, uh, he has a reallyinteresting story.
Um, you know, he was workingfor Radio Shack selling phone
systems way back in the day.
If you know Radio Shack at all,yes, wow, and he, at least in
(13:31):
the small division of telephonesales, was number one in the
nation.
He was the number one sales guy.
And there was an old TGNY store, if you remember back in the
day, tgny, tgny store, if youremember back in the day, tgny
kind of like today's Target ormaybe not Walmart size I mean
Walmart's just a behemoth thesedays but yeah, a lot of
(13:54):
department stores back then andTGNY was one of them.
And my dad's beat up brownpickup on a couple sales calls
and gave him his national awardand also told him that, by the
(14:15):
way, they would have to turndown the TGNY deal because Radio
Shack's were franchises,because Radio Shacks were
franchises and so there's nomechanism to put a trouble
ticket in and have it go.
And my dad's saying, well, whatdo you think I've been doing
this whole time?
I've been calling all thefranchisees and getting them in
on all this whole deal.
(14:35):
I've already arranged the wholething, and he says no, no, no,
we can't do it.
So that kind of kicked off thethought in my dad of, like, well
, what am I doing working foryou, for you?
You know, if this is, if thiswas your version, your vision,
and um, so anyway, uh, we werepoor.
(14:58):
I mean we were poor, we weredirt poor.
We lived in a mobile home outin Luther, oklahoma, in the
sticks, and it was about a 20.
He would, he would drive inwith enough gas to get into town
and not enough gas to get back,and he would go door to door
(15:30):
and knock on businesses and meethim and cold call and hope
there was something he could getdone and get paid for that day
to make it home.
Um so, uh, you know, if I tellthat story too too long, I
started to get a little chokedup because, uh, you know, that's
that's what I watched him do.
And and, uh, so, looking back,that tenaciousness and that
(15:55):
spirit of just never quitting,uh, really affected me.
Um, I think there's more tobeing an entrepreneur than just
that, for sure.
Speaker 1 (16:04):
So, it's always important and encouraging to
have a role model, and I knowthat that story touches a lot of
entrepreneurs hearts because,as a business coach, a lot of
business owners will say am Ithe worst business you've ever
seen?
Am I the only one going throughthis or that or whatever?
And I'm like no, be encouraged,we all go through it.
(16:28):
Now, if that makes you happy,probably not, but just know
you're not alone, and so sharingthat story is important.
You started off the show whenwe were talking about you said
second generation versus firstgeneration versus grassroots
what's been the difference thatyou've seen?
(16:48):
That could be helpful for ourlisteners.
Speaker 2 (16:53):
Part of maybe some of the things that I'm seeing
would be that when you'restarting a business on your own,
I think you're very in touchwith the things that it takes to
start the business, what makesyour product attractive to your
client, because you're justright on the front lines and you
(17:15):
kind of have an idea, maybe inthe beginning, of what you want
to do, of what you want to do,and maybe you have identified
that there's an opportunitythere that you can take
advantage of and create anopportunity and create value for
people.
And you're very much tweakingthat idea as you go through and
molding it, and so you're a lotfirst gen.
(17:36):
You're very in tune with theproduct and what it means to
your clients and the value thatit has to your clients.
The second generation didn'talways necessarily go on that
journey with the firstgeneration, and so there's also
the added maybe risk of nowthere's something to lose.
(18:02):
In the beginning there wasnothing to lose.
You had nothing.
You can make wild swings or trynew ideas, and there's nothing
to lose because you don't haveanything.
But with second generation, nowyou've got something and if you
make the wrong decision or youtake it in the wrong direction
(18:22):
or you try something too risky.
There's skin in the game,there's something at risk.
The person who's taking overhasn't necessarily proved
anything.
They didn't start the businessnecessarily.
(18:43):
I'm really kind of a weird in aweird situation in the sense
that I may be not second fully,I'm like 1.5, you know, because
in many ways I grew up with mydad in the business and he did
just such a good job of makingme feel like we were together,
even though I was just a kid.
I would go run cable with himin the ceilings, I would go do
(19:08):
stuff in the summers with him,and so in one sense I was part
of it.
But the piece I miss or missed,was that day-to-day
everything's on the line.
That part I didn't know thatand I shouldn't have Like I was
to day all everything's on theline.
That part I didn't.
I didn't know that and Ishouldn't have like I was a kid,
right, my dad's not going to,and I'm glad he didn't.
You know, I I didn't.
(19:28):
We were poor, but I had no idea.
I was just happy as a lark.
So, um, by the time I got to 12, 13, you know, my dad had had
really begun to see, to see somesuccess and probably by the
time I was 15, we were building,you know, building a 5,000
square foot house out, you know,out in Luther, and so dad did
(19:54):
well and I saw that.
So second generation, I think,struggles probably a little bit
with just of that connection ofyou know what, the journey that
you went through, but nowthere's something that you can
lose and so what's theconnection to that and the other
(20:15):
funny thing maybe too is justthat I wanted, mostly for me, as
I was working in the business,I didn't want people to treat me
differently because they knewmy dad and had a relationship
with my dad.
I wanted them to interact withme because of me and who I was.
I felt like, if they knew thatI was related to my dad, that I
(20:43):
wouldn't get a good, solid readfrom them on my relationship
with them.
Are they treating me so I wouldnot tell them that I was
related to my dad.
We had enough employees at thatpoint where, uh, I would call
(21:04):
him when we would go intomeetings.
I would call him tom, Iwouldn't call him dad, and not
because I had any kind ofdisrespect for my dad or
whatever.
It was.
Just.
It was just simply for me, likeI wanted them to treat me for
me, and not know and and and andalso maybe tell my dad you know
(21:25):
, hey, this Josh guy is a loser,you know he is.
I don't know what you're doing.
You know, like I just wanted, Iwanted my success to be
disconnected from my dad'ssuccess, so that I knew I had a
you know, real feedback aboutwhat was going on.
In a sense, I wanted to provemyself and know that I was
(21:50):
standing on my own two legs.
So that was another thing thatI kind of struggled with.
Speaker 1 (21:55):
What were some of the pivots you made in your
automotive business that youcould share with our listeners?
So they could have been pivotsthat were for the good or the
bad or the ugly, but some pivotsthat you made that would be
worth sharing.
Speaker 2 (22:14):
In the automotive business.
Okay, so automotive upholsteryis what we fell into.
We had a buddy of ours that'show that business started.
Our buddy of ours we were carguys.
He took some guys down toDallas on a trip and one of them
burned a hole in his backseatwith a cigarette on the way to.
Dallas.
And so he called us and he waslike man, somebody burned a hole
(22:37):
in my backseat and I don't knowwhat to do.
And he, you know his clothinterior and um, he's like you
know, I thought of you guyscause your car guys, and you
know, and so I had already hadthe conversation with my buddy,
eric, about starting thatbusiness, or starting a business
, and so we had been going backand forth, like, what are we
going to sell?
What are we going to sell?
So Eric gets on the phone witha local upholstery guy, gets
(23:01):
connected, long story short,finds out that this guy can,
that there's these manufacturersout there that sew a whole
interior kit.
They already have the pattern.
And back in that day it wasusually the upholstery guy would
do the whole kit.
He would pattern it, he wouldtake your cloth off, he would
very carefully cut all the takeyour cloth off, he would very
(23:23):
carefully cut all the seams andlike and re-sew a kit for your
car.
So recently this had kind ofwas a new thing and and so
anyway, this guy offered it as akind of a cheap solution.
You know like, hey, I've neverdone this before, but we could
order this pre-sewn kit and youknow I'll give you a discount
(23:43):
and we'll see what you know ifit's any good.
So our friend went for it.
Eric went down to watch him putit in, because he just thinks
that's cool.
And while he's watching him putthe kit in our buddy's car, he
calls me and he's like bro, I'vegot the idea.
You know like we can sell theseonline.
You know they're alreadypre-sewn, and so I'm like, sweet
(24:07):
, you know, that's awesome, youknow.
So anyway, long story short, wekicked that business off and
grew it.
Just grassroots, we were carguys, we would drive all over
the nation to these differentcar shows and just it was.
It was kind of like just fun,it was just a blast, um.
But during that time we built ashop that could do some actual
(24:31):
sewing.
Like there were some cars wecouldn't find kits for, but we
were like, dude, this is a coolcar.
I mean we want to do this.
And so eric um taught himselfhow to sew and and I was doing
website stuff and and so webuilt some production capacity
and we were approached by somevarious different companies over
(24:53):
the years that wanted to see ifthat production capacity might
be applicable to some, to someother things.
So, uh, for instance, um,there's a, uh, there's a golf
manufacturer that wanted, um,this guy makes custom one-off
putters that are like five, sixgrand.
(25:14):
And um, yeah, and he's like amaster CNC machine guy, right,
so he would put these blocks oftungsten in and he would do this
AutoCAD, basically this drawing, and it would mill out this
just amazing putter head out oftungsten, right, and it's crazy.
(25:39):
So he wanted a really coolleather putter head cover that
would go over and because of ourproduction capacity, we could
make something like that.
And so we designed it and madeit, and so that's maybe a pivot
where we've added in kind ofalmost like a boutique leather
(26:01):
product.
You know that that would allowus to.
That's not really automotiverelated at all, but we, we have
a, we have the ability to dothat, so being adaptable, open
to opportunities.
Speaker 1 (26:13):
I know a lot of business owners.
We get so stuck in what we dothat we're like I don't have
time to do that, and that soundslike it served you well to do
that.
So let's talk about diverse,because cybersecurity is a big
thing right now, and it has been.
It's as they say.
It's stood the test of time andI don't think it's going
(26:33):
anywhere soon.
It's just getting crazier withAI and everything.
So can you share a little bitabout that?
I don't even really know whereto start because it's so many
moving parts, but maybe justsome tips, insights for business
owners.
Here's some red flags.
(26:55):
Here's why it's serious.
Here's some things not to do.
Make sure you know whateverthose high level things are that
you see a lot of in businessesthat they can stay away from or
at least be alert.
Speaker 2 (27:06):
The crazy thing is, you know, I like some portions
of history and it's interestingto go back and study.
You know, like the old piratedays, you know, Basically
pirates would you know?
They'd get in a ship and justgo attack anybody they wanted
and it was an all-out battle andthe oceans were like this
(27:28):
free-for-all and in essence,that's the Internet.
So the oceans of yesteryear arelike the Internet of today, and
back in the day, if you wantedto protect your merchant, you
wanted to protect your ship, youhad guys on the ship with you,
had military guys that trainedand were ready.
(27:50):
So we're back in those days.
Crazy enough, it seems.
Seems just crazy to think aboutthat.
But that's that's really agreat, great, you know, really a
great comparison to nowadays.
Everybody's information is onthe internet.
That's how we do businessnowadays.
I don't know anybody thatdoesn't have an email address or
(28:12):
a website or some kind of webpresence, or take payments
credit card payments online.
We all do business online.
So it used to be that cyberattackers were after your data
(28:33):
to lock it up, what we calledransomware.
They would install something,some malware, some virus, that
would lock all your stuff up.
It would encrypt it and thenyou'd need to pay them in order
to get the key, the encryptionkey, back, and that was the
ransomware game that we're allprobably pretty familiar with at
this point.
(28:54):
With the sophistication of AI,and since AI has now come out,
there's been a major shift tonot just ransomware, an attack.
A ransomware attack a businessright away, get in, establish a
foothold inside the business, apiece of malware that allows
(29:18):
remote access and then harvestdata, and so I'll give you an
example of what that looks like.
We had a client come to us andthey said we've got some really
funny things going on with ouremail.
We, like customer of acustomer's call, they're getting
emails that we didn't send thembut they're from us.
And so, said well?
(29:39):
We said well, someone hashacked.
We did a little bit ofinvestigation, someone's hacked
in to your email system, andessentially what they did was
they used AI to scan throughthousands and thousands of
emails and build a list of thatbusiness's clients, look at the
(30:01):
amounts that they were beinginvoiced.
And then what they did was theychose a weekend and they
created an invoice that lookedexactly like this business's
invoice, and they mass emailedit out on a Friday at four
o'clock, which is a great timeto email emergency emails
(30:22):
because everybody walks in.
Or maybe over the weekend theyrealize, oh my goodness, they
got this email and the businessthat got hacked is closed, so
there's no one to call.
And the invoice was accompaniedby the email which basically
said hey, this and such and suchcompany, we're so sorry to
(30:45):
inform you our bank account hasbeen hacked.
We don't want you to remit anypayments to the bank account
you've been using.
Please use our new bank account, which is safe.
And then you know here's theinvoice account which is safe.
And then you know here's theinvoice.
So over the weekend they theywere the hacker was paid about
(31:10):
150 grand to his, to his, to hisbank account, to the hacker's
bank account.
Yeah Right, so it workedextremely well.
So with the, these attacks aregetting sophisticated because
with the use of AI, I can justtell it, you know, scan through
all this stuff, tell me what theaverage amount of you know of
(31:31):
of these invoices are, and I canwhip up a little copy of your
invoice.
So it's, it's evolved to thepoint where you need these.
You know a little bit more of asophisticated approach and your
average IT guys are probablystill back in the old antivirus
days where they're just lookingfor, like the mug shots is kind
(31:53):
of what I compare it to.
They're looking for the virusand saying, does this match my
mug shot?
And now we need to look atbehaviors.
And saying, does this match mymugshot?
And now we need to look atbehaviors.
We have to look at.
You know, hey, michael Morrisonlogged in to his network at 3
am from Bangladesh.
That's weird.
And then he remoted from hispersonal machine over to the
(32:16):
server and created an adminaccount.
Hmm, that's weird, you know.
Oh, by the way, he's changingall the password, you know.
Yeah, right, so we needsomething a little bit more
sophisticated.
I sat down with another clientand they said we've never been
hacked.
And I said well, why are yousaying that you've never been
(32:37):
hacked?
And he said well, no one's eversent us a ransom demand.
I said that doesn't meananything these days.
They could have.
They might be on your net Ifyou're supplying them with
enough data and information.
You're like an oil well,they're just harvesting
information from you and youdon't know it, because you have
(33:00):
nothing on your network thattells you that you've been
hacked.
You just have an antivirus onthere.
So that's really theenvironment that we're in right
now.
So what can you do?
There was really some questionsthat you asked me earlier.
What can a small business do?
Speaker 1 (33:17):
Well, number one you're listening to Small
Business Pivots.
This podcast is produced by mycompany boss.
Our business is helping yoursgrow.
Boss offers business loans withbusiness coaching support.
Apply in minutes and getapproved and funded in as little
as 24 to 48 hours at businessownership simplified dot com.
(33:40):
If you're enjoying this podcast, don't forget to hit the
subscribe button and share it aswell.
Now let's get back to ourspecial guest.
Speaker 2 (33:49):
Now.
So what can you do?
It was really some questionsthat you asked me earlier.
What can a small business do?
Well, number one, multi-factorauthentication, is like maybe a
huge thing you can just enableand put on right now, especially
with your email.
So Office 365 or GoogleWorkspace are the two number one
(34:12):
, and number one and number two.
You can argue which one's which, but that businesses use either
Google for their email orOffice 365.
Either Google for their emailor Office 365.
And you can go in the adminconsole and you can begin to
turn on multi-factorauthentication for all of your
users.
And that's essentially like,when you log in, the little
(34:34):
thing that pops up that says,hey, is this you Did?
You log in and you hit yes, youknow it's me.
Log in and you hit yes, youknow it's me.
And what that does is it justgives you that second factor of
identity verification.
So even if your password isexposed, it doesn't matter
because they don't have yourcell phone.
(34:57):
The some of the other thingsthat that you can do you do.
Number one would bemulti-factor authentication, but
make sure that you are not anadmin user on your network or
your Office 365 account orGoogle account.
Make sure you create a separateadmin user and then make sure
(35:20):
everyone else is just a regularuser, including yourself, and
that way, what that does is, ifyou do click on anything, that
piece of malware only has accesslevels that your regular user
has.
They don't have adminprivileges.
And a lot of business users dothis.
(35:42):
They're the ones that set upthe Google this, they're the
ones that set up the Googleaccount.
They're the ones that set upthe Office 365.
So they're admins.
Well, that means if you click onany malware, that malware has
all the privileges and accessthat an admin privilege has,
right.
So even I don't do this at myoffice.
I work in my Josh profile andit has regular locked down
(36:08):
privileges.
I can't do anything.
If I need to do an admin,something administrative, I log
out as Josh log in on the adminaccount, do what I need to get
done, then log back out and logback in.
It's like cyber hygiene, right.
It's like a surgeon washing hishands.
So do the stuff you need to doin the admin account, but don't
(36:29):
live in that account, don't workin that account, and that's a
huge protection against thesemalwares being able to install
themselves and do things.
Speaker 1 (36:39):
I know one of the questions that a lot of business
owners ask me is what joy dothese people have in doing this?
Like why is it so rapid outthere?
Like just why.
Speaker 2 (36:54):
That's a great question.
Um, the association of Countycommissioners is one of our
clients and I gave a, I gave a,actually a presentation on this
as and and there's some reallywell-known hackers out there
that have been asked this exactquestion.
One of the most famous one isthe catch catch me if you can,
guy.
You know from the movie withTom Hanks and and DiCaprio.
(37:16):
So that guy was interviewed and, by the way, the book is way
better than the movie, if youwant.
If you read the book, it's likethere's so much better stories
than in the movie.
This guy is just absolutelyamazing.
But it's really about that, thechallenge.
It's about the challenge ofbeing able to get in.
(37:37):
It's like a game and and youcould compare it to the same as
these guys that go out andmountain climb and, you know,
and do the squirrel suit, youknow, fly through the air.
These, like you know,adrenaline, high stakes type
personalities.
It's about the challenge.
They, they want to see if theycan.
They can do it.
(37:58):
They can get in and trickpeople and what they'll fall for
.
They can do it.
They can get in and trickpeople and what they'll fall for
, and the other thing I wouldsay that's a big game changer
has been Bitcoin Bitcoin.
You know, if I wanted to stealyour data before Bitcoin, I
would have had to have you andlock your data up.
I would have had to have yousend me a check or wire me money
(38:20):
or give me cash.
That would be a very, very bigrisk on my part Because you
could call the FBI and bewatching the drop off location
or if it's a wire transfer thatgoes through all kinds of
federally controlled, you know,financial institutions that have
all kinds of ability to trackmoney.
So it was very difficult for meto steal money from you.
(38:44):
But with the invention ofBitcoin, you can now transfer
funds completely without anyoneever knowing.
You know you're anonymous.
There's no way to track it.
There's ways to guess, and thefeds do this.
If they see $10,000 got debitedover here and 10 grand got
credited over here, they can tryto make a guess, but that's all
(39:08):
it is.
It's just a guess.
So Bitcoin has changed the gamefor hackers.
It's made it where you can sendfunds and I can route those
completely anonymously.
So does that make sense?
That's been a massive, massiveboon to the hacker community the
(39:29):
ability for financial transfersto happen completely
anonymously.
Speaker 1 (39:36):
What does a company do with when they have employees
.
So you can only say so much becautious about opening this
email.
If it looks like this, don'topen it.
But it still happens.
I mean, these people are good.
I just got one last week thatsomeone had created through
Canva and it was a PayPal and itsaid this in you know kind of
(39:59):
like what you're talking about,and back in the day you could
look at the domain name and youcould see like a number in there
or something that wasn't right,just, but it was legit the
whole thing.
I sent it to Canva and they'relike thank you for sending this.
We're trying to track thesedown because they're using these
fake PayPal invoices throughCanva.
(40:20):
So it looks like it came fromCanva.
But what can you tell your team?
Like there's only so much youcan tell them and somebody's
just going to accidentally clicksomething that looks legit and
then boom, your whole company isexposed.
Speaker 2 (40:34):
Yeah, yeah.
So you're, you know you're kindof crossing into the territory
where you're going to have tohave an expert, You're going to
have to have a piece of softwarethat that can, that can lock
this kind of stuff down.
And there's, there's somereally great software out there
that can create what we call awhite list.
(40:54):
A blacklist is not so goodbecause the blacklist will say
you know, stop this specificthing.
That's what a blacklist, right,stop this.
A whitelist is the opposite.
It's block everything, onlyallow these things.
Right, this is all that can run.
(41:15):
So we have a software that weload instantly when we come into
a client situation.
That is a whitelist.
It only allows and, and thatwhitelist includes the launching
of the very particular fileslike executables and word
documents, and it, it, itcreates that list, it knows what
(41:38):
that, what those things should.
That should be allowed to run.
So that's a.
That's a big help because, yes,you're right, You're going to,
people are going to click onthat stuff.
And so, having some of thesemore sophisticated tools, the
new version of antivirus orwhat's replacing antivirus and
(42:00):
has for a while now, is calledEDR, which is endpoint detection
and response.
So we want something, like Isaid earlier, that's watching
behaviors of the software.
That's watching behaviors ofthe software.
It knows how a software shouldbehave.
It knows what directories itnormally gets into and saves
(42:21):
files to.
So if it starts seeing thatpiece of software misbehave and
do something, it can shut thatdown immediately.
And these softwares are notsuper expensive.
When you work with an expertlike me or other guys like me
because they're bulk buyingthese, they're bulk buying them
(42:41):
right, and that's the wholepoint is getting with an expert
that's got access to this kindof stuff and bringing some of
those enterprise-leveltechnologies down to the small
to medium-sized business level.
Speaker 1 (42:53):
I meant to ask this earlier and I know is it a risk
or reward.
But about the two-factorauthentication, I know for a lot
of business owners they seethat like that absorbs so much
of my time.
Right, but the risk is okay,you don't do it and you're
(43:14):
putting your, but is thereanything out there that can help
them?
You know, because if you didthat with QuickBooks, you did it
with emails, you did it withall these different softwares.
You're going to be on yourphone all day.
Is there a hack that someoneknows?
That software that says yep,yep, yep?
Because that's the biggestcomplaint I hear from business
owners.
Speaker 2 (43:34):
Yeah, yeah, so there's a great technology
that's baked into a lot of yourmore commercial-grade
cybersecurity firewalls and somedifferent things.
That's called single sign-on.
So what you do is you'recreating a safe space through
API, through securecommunication and encryption
(43:58):
keys.
It's almost like you'repre-logging in to QuickBooks and
all the different softwares youneed to do, and it's like you
pre-log in with these encryptedkeys and that safe space has one
password and one multi-factorauthentication.
You know point right.
So it's it's kind of like onering to rule them all.
(44:22):
If you're a, if you're a Tolkienfan, that's a little helping
all the nerds out there.
I'm raising my hand as a nerd,so you just called yourself out.
Yeah, so it's basically youclick on that single sign-on
window and inside that we haveloaded all of those cloud
(44:47):
applications and places thatwould normally require that.
But since we've digitally usedkeys to kind of pre-sign into
that safe space, then there'sonly the one right Single
sign-on.
So it takes a little bit ofwork to set it up, but it's
worth it kind of in the long run.
Does that kind of make?
Speaker 1 (45:05):
sense.
Yeah, no, that's perfect.
And then I've got a question.
So the ransomware you weretalking about, where they take
your data for ransom, what is acompany to do?
Do they?
Should they immediately run toyou first?
Do they call the FBI?
I mean, what do they do oncetheir data has been compromised
and they can't get it?
Speaker 2 (45:27):
Yeah Well, probably the first thing that I would
recommend that companies do ifthey been hit is to call their
insurance company theirinsurance company.
Usually there's a cybersecurityelement to that.
I hope there is.
If there's not, you need to betalking to your insurance
company.
And if you need a goodinsurance guy, I've got a couple
(45:50):
that are great.
We make no money oncybersecurity insurance.
It's actually against the lawbecause we're not agents.
We're not insurance agents.
Speaker 1 (45:58):
So you're recommending people, if they
don't have it or don't know, goget some cybersecurity insurance
, go get some.
Speaker 2 (46:04):
Yeah, and the kind you get is a big deal.
Because a lot of times in thefine print, these insurance
companies are requiring you todo multi-factor authentication.
You better have EDR loaded, youbetter have a whitelist type
program, you better have ayearly penetration test done on
(46:25):
your network and if you don't,so sorry, we're not going to pay
your claim.
So this is the other thing werun across is nobody's looking
at these policies.
So this is the other thing werun across is nobody's looking
at these policies.
They think that they've got,they're covered, and it turns
out they're not covered becausethey're not doing these things.
That the insurance company,yeah, which it makes sense from
their side, right, it's likewell, otherwise it's just
(46:47):
Russian roulette.
If you don't do this, it's justa matter of time You're going
to get hacked.
But if you're not doing thosethings, you're throwing your
money away at the insurancecompany.
So if, if, if you havecybersecurity insurance or you
have insurance you call them Alot of the insurance have a
cybersecurity response or anincident response team that
(47:07):
they've already made.
They're going to be.
The insurance is going to bepaying this claim.
The insurance is going to bepaying this claim.
So they've already engaged aremediation team and an incident
response team company to dothat.
The second call would be to aguy like me.
If you don't have one, you cancall me.
But if you've already got a guy, call him, of course,
(47:28):
immediately.
What you don't want him to dois go in there and kind of
blunder and mess everything upbecause you need him to.
If you do have a remediationteam, they're going to want to
get in and look at things.
And this is where having asolid backup and disaster
recovery plan is absolutely.
You got to have that.
(47:48):
So with all my clients, backupis like the flip side of the
coin to your cybersecurity.
Right, if you get hit, ifyou've got a solid backup, then
you can just restore from thatbackup and you're good to go.
And this is why you need animmutable backup, because
hackers know that if they don'tget to your backup and corrupt
(48:11):
that backup, then they knowyou're just going to restore
from that backup, so they're notstupid.
This is the other reason whythey don't immediately
ransomware your whole network.
They're going to try to findyour backup and corrupt that and
then ransomware you becausethen you've got nothing to
restore from.
So an immutable backup is abackup that backs up offsite and
(48:32):
then that connection connectionis severed and that file that
gets written.
It can't be written over, itcan be read by you but it can't
be re, it can't be written to,it's immutable.
So, um, it's basically kind ofhacker proof.
And then we always pair thatwith understanding from the
client's perspective.
(48:53):
How old can that backup be?
Right?
Because if it's a backup that,say, you know from last month
that may, you've got 30 daysmaybe of data that you lost and
I don't know what it will takeyou to reenter all that data.
Maybe you can, but maybe ifit's all in the cloud, you don't
(49:15):
have any paper to reenter itfrom.
So a recovery point in time isimportant to establish and a
recovery time objective tooright.
If you're an architect and youget hit and you've got a bunch
of AutoCAD files that are hugeand massive, that run on big
(49:36):
servers, but your server isransomwared, it's going to take
some time to wipe that serverand reload all the stuff on
there.
So that's.
The other thing is how quicklydo you need to be back up?
What's the recovery timeobjective?
So I've got lots of greatlittle stories that I can tell.
Speaker 1 (49:58):
Yeah, I bet we're unfortunately about out of time,
but I do have another question,because another big thing is I
heard a business owner not toolong ago say I should be fine,
all my stuff's in the cloud.
So in other words, I think theywere saying, all my stuff's on
Google Drive Is, in other words,I think they were saying, all
my stuff's on Google Drive.
Is that just as vulnerable asyour computer?
(50:19):
Absolutely Okay.
Speaker 2 (50:20):
Yeah, and this is a misconception with a lot of
people is they think that Office365 or Google is backed up.
It's not.
It's redundant, meaning there'scopies of your data that are
being replicated, your data thatare being replicated.
But if I'm a hacker, I cancorrupt that data and all
Microsoft sees is that the datachanged.
(50:41):
It changed so they replicatedacross all their servers.
It's not a backup.
It's like it's a live copy incase they lose a data center.
If your Dallas Microsoft datacenter goes down, no problem.
They've got a Chicago one thatthey just switch you over to
instantaneously.
(51:01):
You don't even know and youknow your, your live copy of
your data is there, but it'sbecause it's.
It's been copying back andforth.
So, as a hacker, I just need to.
I just need to ransomware yourOneDrive.
There's no backup.
Speaker 1 (51:17):
Wow.
Well, I know you've piqued theinterest of a lot of listeners.
I know you have me, so where'sthe best place to follow you to
learn more?
Speaker 2 (51:28):
Yeah, so I'm on LinkedIn.
You can look me up, joshCochran.
Our website is wwwdiversecticom, and that's diverse, just like
the word diverse and CTI likecomputer telephone integration
or internet or whatever you wantto throw in there.
But yeah, diversecticom is agreat place to go and, yeah, you
(51:53):
can fill out any informationthere.
We're happy to do.
We have a free cybersecurityassessment tool.
It's absolutely free, it'sextremely powerful and I already
bought it.
I get tons of uses of it.
So I love helping entrepreneursand that's just a free tool.
And if you need me, great.
If you don't need me, noproblem.
(52:14):
I'm not interested in trying tosell you something that you
don't need.
I love being with otherentrepreneurs and hearing their
story.
It's why I'm here with youtoday.
This is a blast.
So if you need me, great.
If you don't, either way, I'dlove to get you an assessment so
you know where you're at.
Speaker 1 (52:33):
Well, I want to encourage our listeners to go to
your website, because on yourblog you've got a very active I
mean like every day or twoyou're putting more content up
there.
So for people that want tolearn more, I encourage them to
go to your website and check outyour blog as well and follow
you on LinkedIn.
So I end up with one lastquestion, and so if you're in a
(52:54):
room full of entrepreneurs,different businesses, different
sizes, seasons of business, whatis something applicable for all
of them?
So it could be a book they needto read, or maybe a tip or a
trick or a quote, somethingyou've learned, what's something
that would be applicable to allof them?
Speaker 2 (53:12):
Man.
My favorite thing to share withpeople probably takes too long
to go into, but there's a small.
It's Kenneth Blanchard's OneMinute Manager, and I love that.
He basically breaks down how togo in and manage anybody for
(53:32):
any task and he breaks it downto either you are giving them
support or you're giving themdirection, or you're giving them
both support and direction.
And so he's got a great methodwhere you ask very simple
questions.
You're listening to see whatstage they're in.
(53:54):
Are they in stage one, two,three or four?
Stage one is you don't knowwhat you don't know and in that
stage you need to give them highdirection and low support.
In stage two, you now know whatyou don't know and you need to
give them high support and highdirection.
(54:15):
In stage three, you know whatyou know.
You're kind of consciouslycompetent, so you give them high
support but low direction.
And the final one is stage four, or style four.
You manage them.
They're like a Jedi master.
They're unconsciously competent.
They don't know what they know.
(54:35):
They've been doing it so longthey don't have to think about
it, so you'd manage that personlow support, low direction.
So I find that that right theregives people a framework to
come and ask their.
I tell them I train my people onall of this.
When they come to me they'll belike I'm S2.
And that tells me they needhigh support and high direction.
(54:57):
Right, because they've alreadydone the work for me.
Like they've diagnosedthemselves.
They know exactly.
And here's the problem Ifyou're managing someone and
they're an S3, they'reconsciously competent, they just
need more support, you know.
Like they don't need to be toldhow to do it.
They just hey, what was thecost of that thing?
Again, they don't need to knowwhere to go get it.
(55:19):
But if you don't know that andyou're managing them with high
direction like okay, open yourbrowser, you're going to go to
this site they get mad, they getfrustrated because you're
telling them how to do the job.
They already know that.
Telling them how to do the job,they already know that.
So that is such an awesomeframework to to work with people
in, because it gets you rightwhat they need and everybody's
(55:39):
happy.
Speaker 1 (55:45):
That's sound advice and that has not been shared on
our podcast and I know for thosepeople that are aware of that
book.
Speaker 2 (55:49):
it's a book, right?
Yeah, there's a whole series.
It does a lot of differentstuff, but yeah.
Speaker 1 (55:52):
Yeah, for those that are aware of it, aware of it,
they're probably going abusiness coach.
Never heard of that.
Well, there's so much goodinformation out there we can't
know it all.
That'd be like knowing theentire tax code.
It's impossible, so, but that'sa new one to me, so I
appreciate it.
I'll put that in the show notesfor people to find.
Josh, you've been a blessing tomany and a wealth of
(56:13):
information.
I appreciate your time todayand I wish you continued success
.
Speaker 2 (56:18):
Thank you.
Thank you, Michael.
Thanks for having me on.
Speaker 1 (56:21):
I've enjoyed it, my pleasure.
Thank you for listening toSmall Business Pivots.
This podcast is created andproduced by my company, boss.
Our business is growing yours.
Boss offers flexible businessloans with business coaching
(56:48):
support.
Apply in minutes and getapproved and funded in as little
as 24.
To need help growing yourbusiness, email me at Michael at
Michael D Morrisoncom.
We'll see you next time onsmall business pivots.
All right, welcome to another Small Business Pivots.
Today we have another specialguest from around the world and
this guest is almost in my backdoor, the great state of
Oklahoma.
We are featuring Oklahomabusiness owners this year this
summer, and I know that no onecan introduce themselves and
their business like the businessowner, so I always let you do
(00:21):
the introductions so you can sayit like you want it said.
Speaker 2 (00:25):
Well, thank you, thank you.
So my name is Josh Cochran andI'm with Diverse CTI.
We are an IT managed servicescompany and we specialize in
basically managing the ITinfrastructure for small to
medium sized businesses thathave really reached that point
(00:46):
where the hourly IT guy isreally not a match anymore.
And I always tell people youknow it doesn't always mean that
you know you're frustrated oryou think your IT guy isn't
doing a good job.
A lot of times it's justrelated to the maturity of the
company.
You reach a point where youneed something a little bit
(01:08):
deeper, a little wider, maybe alittle more technical expertise,
and that's usually whencompanies come looking for me
and my team.
Speaker 1 (01:19):
Awesome, awesome.
So we've got small businessowners listening.
How do you think we're going tohelp them best today?
Speaker 2 (01:25):
One of the things that I think just recently maybe
in the last four to five yearsthat I've begun reflecting a
little bit more.
I've been doing this for 25years, been an entrepreneur for
25 years.
My dad started the company thatI'm in right now.
My dad started the company thatI'm in right now 40 years ago,
maybe almost 41 years ago, backin 1984.
(01:49):
So I was kind of raised in thatentrepreneurial maybe more of
an epiphany that I've alwaysseen myself as an entrepreneur
(02:11):
because I've started some otherbusinesses I'm in another
business with one of my bestfriends and it's in the
automotive industry but this isreally my passion diverse CTI
but I think I've maybe realizedthat this is somewhat of a
second generation entrepreneurjourney and that's been an
(02:32):
interesting lens to look backthrough the years on, because I
don't think I ever really lookedat it that way.
I looked at it, you know, it waslike me and my dad and we were
partners and I'm one of thelucky ones my dad and I are
still best friends.
He's retired now.
He retired in 2019.
(02:53):
And so that kind of caused meto start looking at things a
little differently, because I'mkind of on my own at this point.
He's been an excellent partnerthrough the years.
He's been an excellent partnerthrough the years.
But anyway, just recently I'vebeen kind of realizing that in
(03:13):
some ways, the journey of asecond generation entrepreneur
is very different than juststarting the business from
scratch, which I've also done.
I've done both of those.
The business from scratch whichI've which I've also done, I've
I've done both of those.
So, uh, my other business thatI'm in involved with, uh, my
best friend is, is a $2 million,you know, uh, gross revenue
(03:34):
business as well.
So so I kind of have both sidesof it and I'm realizing, um,
for whatever reason, I didn'treally think of diverse CTI as a
second generation business.
I just because I grew up, yeah.
Speaker 1 (03:49):
Yeah, so it is different being a business coach
and working with familybusinesses, generational
businesses, partnerships they'reall different and so I think
we're going to be able to helpthem a lot with some insights
that you've got, some tips andall that good stuff.
So let's introduce the showreal quick and we'll be right
back.
Welcome to Small BusinessPivots, a podcast produced for
(04:11):
small business owners.
I'm your host, michael Morrison, founder and CEO of BOSS, where
we make business ownershipsimplified for success.
Our business is helping yoursgrow.
Simplified for success Ourbusiness is helping yours grow.
Boss offers business loans withbusiness coaching support,
apply in minutes and getapproved and funded in as little
(04:33):
as 24 to 48 hours atbusinessownershipsimplifiedcom.
All right, welcome back to SmallBusiness Pivots.
We're talking to a secondgenerational business owner and
family family.
Most family businesses are notpretty, but you said yours was.
(04:55):
Can you give us first anyinsights of how that baton was
handed off, because a lot offirst generation business owners
they don't want to do that andso you must have proved
something to them led thecompany.
You know, kind of what was thatscenario like for us?
Speaker 2 (05:16):
Well, I have to give most of the credit to my dad.
I mean him, him and I have, uh,he kind of raised me just in a,
raised me just in a verywonderful way in terms of I
never felt that I was competingwith my dad.
I never he treated me as anequal in the sense of, you know,
(05:38):
giving me responsibilities andso forth.
So a lot of that I have to.
I just have to say, uh, kudosto my dad.
Um, he's just one of those rareindividuals who, um, just
doesn't have a chip on hisshoulder.
So he was.
He was always open to mythoughts and my, my input over
(06:02):
the years, which, you know,obviously I was a kid, so it
wasn't always good input, youknow.
But yeah, he was willing tokind of let me try things and
fail and put, you know, allow meto put the years in, to kind of
learn, and yeah, so in terms ofwhy he felt comfortable, I
(06:27):
think it was just when I wasgrowing up.
He he told me you know, please,please, don't just be in this
business just because it is thefamily business, don't, don't do
it, because you know I've doneit.
You know, go off, do your thingIf this will be here.
If you want to be involved, youcan be.
(06:48):
And I actually early on didn'twant to be.
I thought, you know, I I reallydidn't want to live in my dad's
shadow at the business.
I thought that would be kind ofwhat it would be like and I
wanted to have my kind of my ownsuccess, not like in a, in a,
you know, like a selfish,arrogant way or anything, just
just wanted to kind of it wasfor more for me, like I wanted
(07:09):
to know, like, hey, I can go outinto the world and survive, and
that was important to me.
And so I went to school for anelectrical engineering degree
and two years in, a couplethings were going on.
I was helping my dad with hiswebsite, which the dot-com boom
was just going crazy.
(07:30):
This was 99-2000.
And I told my best friend atthe time he was going to school
for a mechanical engineeringdegree and I said you know,
we're morons if we don't start aweb business.
We're just complete morons ifwe don't do this.
This is exploding.
(07:51):
And because I saw what wasgoing on with my dad's business
he was selling phone systemsonline like crazy, just left and
right, I mean, and I was kindof assisting him on the in the
on the website side, because Ihad kind of dabbled in some HTML
programming and kind of taughtmyself how to do that because it
looked fun.
And uh, so my best friend atthe time, uh, and still, you
(08:16):
know, still is he's the guy thatwe started the automotive
business together.
He said, okay, well, but I haveno idea what, what should we do
?
And I was like I don't knoweither, but we need to do
something.
So so we eventually totallyseparate story but stumbled upon
an opportunity.
We were car guys and into cars,and so we stumbled across an
(08:39):
opportunity there that wethought would be worth pursuing.
And, and while we were startingto build that business, I just I
was fed up with college, justfed up.
I just was like this is not forme, it's not what I thought it
was going to be.
So I dropped out and kind ofwent full time into starting
this business with my buddy andyou know, my dad said you know
(09:02):
there's plenty of work over hereon the website and running the
online part of the business.
If you want to do that, youwon't be a burden to your new
business.
And I thought that soundedgreat.
So I jumped in to Diverse CTIand was working on the website.
(09:22):
I built a website for my othercompany with my buddy the
automotive side and and um, andso that's kind of how it started
, that I got I got you know backinto diverse CTI full time.
Um, what I began to realize wasthat I really love and this is
kind of maybe something that, uh, the IT you know part of the
(09:46):
business allows me to do.
We would constantly beconnecting with other business
owners because you're makingyou're making a big decision
when you go with a new phonesystem or a new, whole new
network and you know your IT guyand you know all this
infrastructure that goes, goesalong, goes along with that.
So I was interfacing with otherbusiness owners and that was so
(10:10):
much fun.
I would learn their story, justlike we're doing right now.
I would learn their story.
I would get kind of somewhatpersonally invested in the story
because we're installing ITinfrastructure equipment and
helping them manage it, which islike the foundation of their
business, how they interact.
And to do that I have to askquestions, like you know how do
(10:33):
your employees use theircomputers and their phones, and
when your customers call in, whodo they need to talk to and why
?
And you know, because we'remaking phone tree menus and
programming the phone system toring different areas in their
businesses and so forth.
So as I did that more and more,I just realized this is awesome,
I love this, I really like thisportion of it.
(10:56):
I'm it's like I'm a partnerwith these other business owners
.
I'm a part of their success,watching them grow, and that was
a blast to me.
So I think as I got into that,I was exposed to other business
owners, I was exposed to otherentrepreneurs and that was very
(11:18):
fulfilling to me and I think mydad saw that spark.
Think my dad saw that spark,you know.
And so as the opportunities inthe company kind of became
available, I just kept taking onmore responsibility and more
responsibility.
Until you know, really probablyabout 2010, I was basically
(11:39):
running the whole company exceptfor sales and the you know,
sales and marketing.
That that's kind of.
He just kind of stayed in thatside of things.
Speaker 1 (11:51):
What would you say are some traits that your dad
had that showed you how to be agood business person.
Speaker 2 (12:01):
I think this is maybe one of the mysteries about
being an entrepreneur is justthat tenacious drive and
sometimes, in the face ofeverything telling you this is
the, you know this, youshouldn't do this, this is the
wrong way to go, right, likeit's a bad time to start a
business, or nobody wants this,or it's a bad time to start a
(12:24):
business, or nobody wants this,or and, and.
Those are all real questions,and this is like the mystery of
being an entrepreneur is likethere's this small speck in
everybody's story wheresomeone's telling them you know,
this is probably not a goodidea, you're taking a big risk
here.
You know you're going to loseeverything.
You know what are you doingwith your life?
You know you're even askingyourself that question.
(12:46):
You know and some of themsometimes that you really do,
you should stop and quit.
It's a bad idea, right, but howdo you know?
Because, like, so this?
There's something mysteriousthere.
You know about being anentrepreneur where you just keep
going and you, just you justkeep banging your head against
the wall and eventually there'sa hole.
(13:06):
You know, and you go through it.
Um, so, watching my dad do that,um, you know in in the
beginning, uh, he has a reallyinteresting story.
Um, you know, he was workingfor Radio Shack selling phone
systems way back in the day.
If you know Radio Shack at all,yes, wow, and he, at least in
(13:31):
the small division of telephonesales, was number one in the
nation.
He was the number one sales guy.
And there was an old TGNY store, if you remember back in the
day, tgny, tgny store, if youremember back in the day, tgny
kind of like today's Target ormaybe not Walmart size I mean
Walmart's just a behemoth thesedays but yeah, a lot of
(13:54):
department stores back then andTGNY was one of them.
And my dad's beat up brownpickup on a couple sales calls
and gave him his national awardand also told him that, by the
(14:15):
way, they would have to turndown the TGNY deal because Radio
Shack's were franchises,because Radio Shacks were
franchises and so there's nomechanism to put a trouble
ticket in and have it go.
And my dad's saying, well, whatdo you think I've been doing
this whole time?
I've been calling all thefranchisees and getting them in
on all this whole deal.
(14:35):
I've already arranged the wholething, and he says no, no, no,
we can't do it.
So that kind of kicked off thethought in my dad of, like, well
, what am I doing working foryou, for you?
You know, if this is, if thiswas your version, your vision,
and um, so anyway, uh, we werepoor.
(14:58):
I mean we were poor, we weredirt poor.
We lived in a mobile home outin Luther, oklahoma, in the
sticks, and it was about a 20.
He would, he would drive inwith enough gas to get into town
and not enough gas to get back,and he would go door to door
(15:30):
and knock on businesses and meethim and cold call and hope
there was something he could getdone and get paid for that day
to make it home.
Um so, uh, you know, if I tellthat story too too long, I
started to get a little chokedup because, uh, you know, that's
that's what I watched him do.
And and, uh, so, looking back,that tenaciousness and that
(15:55):
spirit of just never quitting,uh, really affected me.
Um, I think there's more tobeing an entrepreneur than just
that, for sure.
Speaker 1 (16:04):
So, it's always important and encouraging to
have a role model, and I knowthat that story touches a lot of
entrepreneurs hearts because,as a business coach, a lot of
business owners will say am Ithe worst business you've ever
seen?
Am I the only one going throughthis or that or whatever?
And I'm like no, be encouraged,we all go through it.
(16:28):
Now, if that makes you happy,probably not, but just know
you're not alone, and so sharingthat story is important.
You started off the show whenwe were talking about you said
second generation versus firstgeneration versus grassroots
what's been the difference thatyou've seen?
(16:48):
That could be helpful for ourlisteners.
Speaker 2 (16:53):
Part of maybe some of the things that I'm seeing
would be that when you'restarting a business on your own,
I think you're very in touchwith the things that it takes to
start the business, what makesyour product attractive to your
client, because you're justright on the front lines and you
(17:15):
kind of have an idea, maybe inthe beginning, of what you want
to do, of what you want to do,and maybe you have identified
that there's an opportunitythere that you can take
advantage of and create anopportunity and create value for
people.
And you're very much tweakingthat idea as you go through and
molding it, and so you're a lotfirst gen.
(17:36):
You're very in tune with theproduct and what it means to
your clients and the value thatit has to your clients.
The second generation didn'talways necessarily go on that
journey with the firstgeneration, and so there's also
the added maybe risk of nowthere's something to lose.
(18:02):
In the beginning there wasnothing to lose.
You had nothing.
You can make wild swings or trynew ideas, and there's nothing
to lose because you don't haveanything.
But with second generation, nowyou've got something and if you
make the wrong decision or youtake it in the wrong direction
(18:22):
or you try something too risky.
There's skin in the game,there's something at risk.
The person who's taking overhasn't necessarily proved
anything.
They didn't start the businessnecessarily.
(18:43):
I'm really kind of a weird in aweird situation in the sense
that I may be not second fully,I'm like 1.5, you know, because
in many ways I grew up with mydad in the business and he did
just such a good job of makingme feel like we were together,
even though I was just a kid.
I would go run cable with himin the ceilings, I would go do
(19:08):
stuff in the summers with him,and so in one sense I was part
of it.
But the piece I miss or missed,was that day-to-day
everything's on the line.
That part I didn't know thatand I shouldn't have Like I was
to day all everything's on theline.
That part I didn't.
I didn't know that and Ishouldn't have like I was a kid,
right, my dad's not going to,and I'm glad he didn't.
You know, I I didn't.
(19:28):
We were poor, but I had no idea.
I was just happy as a lark.
So, um, by the time I got to 12, 13, you know, my dad had had
really begun to see, to see somesuccess and probably by the
time I was 15, we were building,you know, building a 5,000
square foot house out, you know,out in Luther, and so dad did
(19:54):
well and I saw that.
So second generation, I think,struggles probably a little bit
with just of that connection ofyou know what, the journey that
you went through, but nowthere's something that you can
lose and so what's theconnection to that and the other
(20:15):
funny thing maybe too is justthat I wanted, mostly for me, as
I was working in the business,I didn't want people to treat me
differently because they knewmy dad and had a relationship
with my dad.
I wanted them to interact withme because of me and who I was.
I felt like, if they knew thatI was related to my dad, that I
(20:43):
wouldn't get a good, solid readfrom them on my relationship
with them.
Are they treating me so I wouldnot tell them that I was
related to my dad.
We had enough employees at thatpoint where, uh, I would call
(21:04):
him when we would go intomeetings.
I would call him tom, Iwouldn't call him dad, and not
because I had any kind ofdisrespect for my dad or
whatever.
It was.
Just.
It was just simply for me, likeI wanted them to treat me for
me, and not know and and and andalso maybe tell my dad you know
(21:25):
, hey, this Josh guy is a loser,you know he is.
I don't know what you're doing.
You know, like I just wanted, Iwanted my success to be
disconnected from my dad'ssuccess, so that I knew I had a
you know, real feedback aboutwhat was going on.
In a sense, I wanted to provemyself and know that I was
(21:50):
standing on my own two legs.
So that was another thing thatI kind of struggled with.
Speaker 1 (21:55):
What were some of the pivots you made in your
automotive business that youcould share with our listeners?
So they could have been pivotsthat were for the good or the
bad or the ugly, but some pivotsthat you made that would be
worth sharing.
Speaker 2 (22:14):
In the automotive business.
Okay, so automotive upholsteryis what we fell into.
We had a buddy of ours that'show that business started.
Our buddy of ours we were carguys.
He took some guys down toDallas on a trip and one of them
burned a hole in his backseatwith a cigarette on the way to.
Dallas.
And so he called us and he waslike man, somebody burned a hole
(22:37):
in my backseat and I don't knowwhat to do.
And he, you know his clothinterior and um, he's like you
know, I thought of you guyscause your car guys, and you
know, and so I had already hadthe conversation with my buddy,
eric, about starting thatbusiness, or starting a business
, and so we had been going backand forth, like, what are we
going to sell?
What are we going to sell?
So Eric gets on the phone witha local upholstery guy, gets
(23:01):
connected, long story short,finds out that this guy can,
that there's these manufacturersout there that sew a whole
interior kit.
They already have the pattern.
And back in that day it wasusually the upholstery guy would
do the whole kit.
He would pattern it, he wouldtake your cloth off, he would
very carefully cut all the takeyour cloth off, he would very
(23:23):
carefully cut all the seams andlike and re-sew a kit for your
car.
So recently this had kind ofwas a new thing and and so
anyway, this guy offered it as akind of a cheap solution.
You know like, hey, I've neverdone this before, but we could
order this pre-sewn kit and youknow I'll give you a discount
(23:43):
and we'll see what you know ifit's any good.
So our friend went for it.
Eric went down to watch him putit in, because he just thinks
that's cool.
And while he's watching him putthe kit in our buddy's car, he
calls me and he's like bro, I'vegot the idea.
You know like we can sell theseonline.
You know they're alreadypre-sewn, and so I'm like, sweet
(24:07):
, you know, that's awesome, youknow.
So anyway, long story short, wekicked that business off and
grew it.
Just grassroots, we were carguys, we would drive all over
the nation to these differentcar shows and just it was.
It was kind of like just fun,it was just a blast, um.
But during that time we built ashop that could do some actual
(24:31):
sewing.
Like there were some cars wecouldn't find kits for, but we
were like, dude, this is a coolcar.
I mean we want to do this.
And so eric um taught himselfhow to sew and and I was doing
website stuff and and so webuilt some production capacity
and we were approached by somevarious different companies over
(24:53):
the years that wanted to see ifthat production capacity might
be applicable to some, to someother things.
So, uh, for instance, um,there's a, uh, there's a golf
manufacturer that wanted, um,this guy makes custom one-off
putters that are like five, sixgrand.
(25:14):
And um, yeah, and he's like amaster CNC machine guy, right,
so he would put these blocks oftungsten in and he would do this
AutoCAD, basically this drawing, and it would mill out this
just amazing putter head out oftungsten, right, and it's crazy.
(25:39):
So he wanted a really coolleather putter head cover that
would go over and because of ourproduction capacity, we could
make something like that.
And so we designed it and madeit, and so that's maybe a pivot
where we've added in kind ofalmost like a boutique leather
(26:01):
product.
You know that that would allowus to.
That's not really automotiverelated at all, but we, we have
a, we have the ability to dothat, so being adaptable, open
to opportunities.
Speaker 1 (26:13):
I know a lot of business owners.
We get so stuck in what we dothat we're like I don't have
time to do that, and that soundslike it served you well to do
that.
So let's talk about diverse,because cybersecurity is a big
thing right now, and it has been.
It's as they say.
It's stood the test of time andI don't think it's going
(26:33):
anywhere soon.
It's just getting crazier withAI and everything.
So can you share a little bitabout that?
I don't even really know whereto start because it's so many
moving parts, but maybe justsome tips, insights for business
owners.
Here's some red flags.
(26:55):
Here's why it's serious.
Here's some things not to do.
Make sure you know whateverthose high level things are that
you see a lot of in businessesthat they can stay away from or
at least be alert.
Speaker 2 (27:06):
The crazy thing is, you know, I like some portions
of history and it's interestingto go back and study.
You know, like the old piratedays, you know, Basically
pirates would you know?
They'd get in a ship and justgo attack anybody they wanted
and it was an all-out battle andthe oceans were like this
(27:28):
free-for-all and in essence,that's the Internet.
So the oceans of yesteryear arelike the Internet of today, and
back in the day, if you wantedto protect your merchant, you
wanted to protect your ship, youhad guys on the ship with you,
had military guys that trainedand were ready.
(27:50):
So we're back in those days.
Crazy enough, it seems.
Seems just crazy to think aboutthat.
But that's that's really agreat, great, you know, really a
great comparison to nowadays.
Everybody's information is onthe internet.
That's how we do businessnowadays.
I don't know anybody thatdoesn't have an email address or
(28:12):
a website or some kind of webpresence, or take payments
credit card payments online.
We all do business online.
So it used to be that cyberattackers were after your data
(28:33):
to lock it up, what we calledransomware.
They would install something,some malware, some virus, that
would lock all your stuff up.
It would encrypt it and thenyou'd need to pay them in order
to get the key, the encryptionkey, back, and that was the
ransomware game that we're allprobably pretty familiar with at
this point.
(28:54):
With the sophistication of AI,and since AI has now come out,
there's been a major shift tonot just ransomware, an attack.
A ransomware attack a businessright away, get in, establish a
foothold inside the business, apiece of malware that allows
(29:18):
remote access and then harvestdata, and so I'll give you an
example of what that looks like.
We had a client come to us andthey said we've got some really
funny things going on with ouremail.
We, like customer of acustomer's call, they're getting
emails that we didn't send thembut they're from us.
And so, said well?
(29:39):
We said well, someone hashacked.
We did a little bit ofinvestigation, someone's hacked
in to your email system, andessentially what they did was
they used AI to scan throughthousands and thousands of
emails and build a list of thatbusiness's clients, look at the
(30:01):
amounts that they were beinginvoiced.
And then what they did was theychose a weekend and they
created an invoice that lookedexactly like this business's
invoice, and they mass emailedit out on a Friday at four
o'clock, which is a great timeto email emergency emails
(30:22):
because everybody walks in.
Or maybe over the weekend theyrealize, oh my goodness, they
got this email and the businessthat got hacked is closed, so
there's no one to call.
And the invoice was accompaniedby the email which basically
said hey, this and such and suchcompany, we're so sorry to
(30:45):
inform you our bank account hasbeen hacked.
We don't want you to remit anypayments to the bank account
you've been using.
Please use our new bank account, which is safe.
And then you know here's theinvoice account which is safe.
And then you know here's theinvoice.
So over the weekend they theywere the hacker was paid about
(31:10):
150 grand to his, to his, to hisbank account, to the hacker's
bank account.
Yeah Right, so it workedextremely well.
So with the, these attacks aregetting sophisticated because
with the use of AI, I can justtell it, you know, scan through
all this stuff, tell me what theaverage amount of you know of
(31:31):
of these invoices are, and I canwhip up a little copy of your
invoice.
So it's, it's evolved to thepoint where you need these.
You know a little bit more of asophisticated approach and your
average IT guys are probablystill back in the old antivirus
days where they're just lookingfor, like the mug shots is kind
(31:53):
of what I compare it to.
They're looking for the virusand saying, does this match my
mug shot?
And now we need to look atbehaviors.
And saying, does this match mymugshot?
And now we need to look atbehaviors.
We have to look at.
You know, hey, michael Morrisonlogged in to his network at 3
am from Bangladesh.
That's weird.
And then he remoted from hispersonal machine over to the
(32:16):
server and created an adminaccount.
Hmm, that's weird, you know.
Oh, by the way, he's changingall the password, you know.
Yeah, right, so we needsomething a little bit more
sophisticated.
I sat down with another clientand they said we've never been
hacked.
And I said well, why are yousaying that you've never been
(32:37):
hacked?
And he said well, no one's eversent us a ransom demand.
I said that doesn't meananything these days.
They could have.
They might be on your net Ifyou're supplying them with
enough data and information.
You're like an oil well,they're just harvesting
information from you and youdon't know it, because you have
(33:00):
nothing on your network thattells you that you've been
hacked.
You just have an antivirus onthere.
So that's really theenvironment that we're in right
now.
So what can you do?
There was really some questionsthat you asked me earlier.
What can a small business do?
Speaker 1 (33:17):
Well, number one you're listening to Small
Business Pivots.
This podcast is produced by mycompany boss.
Our business is helping yoursgrow.
Boss offers business loans withbusiness coaching support.
Apply in minutes and getapproved and funded in as little
as 24 to 48 hours at businessownership simplified dot com.
(33:40):
If you're enjoying this podcast, don't forget to hit the
subscribe button and share it aswell.
Now let's get back to ourspecial guest.
Speaker 2 (33:49):
Now.
So what can you do?
It was really some questionsthat you asked me earlier.
What can a small business do?
Well, number one, multi-factorauthentication, is like maybe a
huge thing you can just enableand put on right now, especially
with your email.
So Office 365 or GoogleWorkspace are the two number one
(34:12):
, and number one and number two.
You can argue which one's which, but that businesses use either
Google for their email orOffice 365.
Either Google for their emailor Office 365.
And you can go in the adminconsole and you can begin to
turn on multi-factorauthentication for all of your
users.
And that's essentially like,when you log in, the little
(34:34):
thing that pops up that says,hey, is this you Did?
You log in and you hit yes, youknow it's me.
Log in and you hit yes, youknow it's me.
And what that does is it justgives you that second factor of
identity verification.
So even if your password isexposed, it doesn't matter
because they don't have yourcell phone.
(34:57):
The some of the other thingsthat that you can do you do.
Number one would bemulti-factor authentication, but
make sure that you are not anadmin user on your network or
your Office 365 account orGoogle account.
Make sure you create a separateadmin user and then make sure
(35:20):
everyone else is just a regularuser, including yourself, and
that way, what that does is, ifyou do click on anything, that
piece of malware only has accesslevels that your regular user
has.
They don't have adminprivileges.
And a lot of business users dothis.
(35:42):
They're the ones that set upthe Google this, they're the
ones that set up the Googleaccount.
They're the ones that set upthe Office 365.
So they're admins.
Well, that means if you click onany malware, that malware has
all the privileges and accessthat an admin privilege has,
right.
So even I don't do this at myoffice.
I work in my Josh profile andit has regular locked down
(36:08):
privileges.
I can't do anything.
If I need to do an admin,something administrative, I log
out as Josh log in on the adminaccount, do what I need to get
done, then log back out and logback in.
It's like cyber hygiene, right.
It's like a surgeon washing hishands.
So do the stuff you need to doin the admin account, but don't
(36:29):
live in that account, don't workin that account, and that's a
huge protection against thesemalwares being able to install
themselves and do things.
Speaker 1 (36:39):
I know one of the questions that a lot of business
owners ask me is what joy dothese people have in doing this?
Like why is it so rapid outthere?
Like just why.
Speaker 2 (36:54):
That's a great question.
Um, the association of Countycommissioners is one of our
clients and I gave a, I gave a,actually a presentation on this
as and and there's some reallywell-known hackers out there
that have been asked this exactquestion.
One of the most famous one isthe catch catch me if you can,
guy.
You know from the movie withTom Hanks and and DiCaprio.
(37:16):
So that guy was interviewed and, by the way, the book is way
better than the movie, if youwant.
If you read the book, it's likethere's so much better stories
than in the movie.
This guy is just absolutelyamazing.
But it's really about that, thechallenge.
It's about the challenge ofbeing able to get in.
(37:37):
It's like a game and and youcould compare it to the same as
these guys that go out andmountain climb and, you know,
and do the squirrel suit, youknow, fly through the air.
These, like you know,adrenaline, high stakes type
personalities.
It's about the challenge.
They, they want to see if theycan.
They can do it.
(37:58):
They can get in and trickpeople and what they'll fall for
.
They can do it.
They can get in and trickpeople and what they'll fall for
, and the other thing I wouldsay that's a big game changer
has been Bitcoin Bitcoin.
You know, if I wanted to stealyour data before Bitcoin, I
would have had to have you andlock your data up.
I would have had to have yousend me a check or wire me money
(38:20):
or give me cash.
That would be a very, very bigrisk on my part Because you
could call the FBI and bewatching the drop off location
or if it's a wire transfer thatgoes through all kinds of
federally controlled, you know,financial institutions that have
all kinds of ability to trackmoney.
So it was very difficult for meto steal money from you.
(38:44):
But with the invention ofBitcoin, you can now transfer
funds completely without anyoneever knowing.
You know you're anonymous.
There's no way to track it.
There's ways to guess, and thefeds do this.
If they see $10,000 got debitedover here and 10 grand got
credited over here, they can tryto make a guess, but that's all
(39:08):
it is.
It's just a guess.
So Bitcoin has changed the gamefor hackers.
It's made it where you can sendfunds and I can route those
completely anonymously.
So does that make sense?
That's been a massive, massiveboon to the hacker community the
(39:29):
ability for financial transfersto happen completely
anonymously.
Speaker 1 (39:36):
What does a company do with when they have employees
.
So you can only say so much becautious about opening this
email.
If it looks like this, don'topen it.
But it still happens.
I mean, these people are good.
I just got one last week thatsomeone had created through
Canva and it was a PayPal and itsaid this in you know kind of
(39:59):
like what you're talking about,and back in the day you could
look at the domain name and youcould see like a number in there
or something that wasn't right,just, but it was legit the
whole thing.
I sent it to Canva and they'relike thank you for sending this.
We're trying to track thesedown because they're using these
fake PayPal invoices throughCanva.
(40:20):
So it looks like it came fromCanva.
But what can you tell your team?
Like there's only so much youcan tell them and somebody's
just going to accidentally clicksomething that looks legit and
then boom, your whole company isexposed.
Speaker 2 (40:34):
Yeah, yeah.
So you're, you know you're kindof crossing into the territory
where you're going to have tohave an expert, You're going to
have to have a piece of softwarethat that can, that can lock
this kind of stuff down.
And there's, there's somereally great software out there
that can create what we call awhite list.
(40:54):
A blacklist is not so goodbecause the blacklist will say
you know, stop this specificthing.
That's what a blacklist, right,stop this.
A whitelist is the opposite.
It's block everything, onlyallow these things.
Right, this is all that can run.
(41:15):
So we have a software that weload instantly when we come into
a client situation.
That is a whitelist.
It only allows and, and thatwhitelist includes the launching
of the very particular fileslike executables and word
documents, and it, it, itcreates that list, it knows what
(41:38):
that, what those things should.
That should be allowed to run.
So that's a.
That's a big help because, yes,you're right, You're going to,
people are going to click onthat stuff.
And so, having some of thesemore sophisticated tools, the
new version of antivirus orwhat's replacing antivirus and
(42:00):
has for a while now, is calledEDR, which is endpoint detection
and response.
So we want something, like Isaid earlier, that's watching
behaviors of the software.
That's watching behaviors ofthe software.
It knows how a software shouldbehave.
It knows what directories itnormally gets into and saves
(42:21):
files to.
So if it starts seeing thatpiece of software misbehave and
do something, it can shut thatdown immediately.
And these softwares are notsuper expensive.
When you work with an expertlike me or other guys like me
because they're bulk buyingthese, they're bulk buying them
(42:41):
right, and that's the wholepoint is getting with an expert
that's got access to this kindof stuff and bringing some of
those enterprise-leveltechnologies down to the small
to medium-sized business level.
Speaker 1 (42:53):
I meant to ask this earlier and I know is it a risk
or reward.
But about the two-factorauthentication, I know for a lot
of business owners they seethat like that absorbs so much
of my time.
Right, but the risk is okay,you don't do it and you're
(43:14):
putting your, but is thereanything out there that can help
them?
You know, because if you didthat with QuickBooks, you did it
with emails, you did it withall these different softwares.
You're going to be on yourphone all day.
Is there a hack that someoneknows?
That software that says yep,yep, yep?
Because that's the biggestcomplaint I hear from business
owners.
Speaker 2 (43:34):
Yeah, yeah, so there's a great technology
that's baked into a lot of yourmore commercial-grade
cybersecurity firewalls and somedifferent things.
That's called single sign-on.
So what you do is you'recreating a safe space through
API, through securecommunication and encryption
(43:58):
keys.
It's almost like you'repre-logging in to QuickBooks and
all the different softwares youneed to do, and it's like you
pre-log in with these encryptedkeys and that safe space has one
password and one multi-factorauthentication.
You know point right.
So it's it's kind of like onering to rule them all.
(44:22):
If you're a, if you're a Tolkienfan, that's a little helping
all the nerds out there.
I'm raising my hand as a nerd,so you just called yourself out.
Yeah, so it's basically youclick on that single sign-on
window and inside that we haveloaded all of those cloud
(44:47):
applications and places thatwould normally require that.
But since we've digitally usedkeys to kind of pre-sign into
that safe space, then there'sonly the one right Single
sign-on.
So it takes a little bit ofwork to set it up, but it's
worth it kind of in the long run.
Does that kind of make?
Speaker 1 (45:05):
sense.
Yeah, no, that's perfect.
And then I've got a question.
So the ransomware you weretalking about, where they take
your data for ransom, what is acompany to do?
Do they?
Should they immediately run toyou first?
Do they call the FBI?
I mean, what do they do oncetheir data has been compromised
and they can't get it?
Speaker 2 (45:27):
Yeah Well, probably the first thing that I would
recommend that companies do ifthey been hit is to call their
insurance company theirinsurance company.
Usually there's a cybersecurityelement to that.
I hope there is.
If there's not, you need to betalking to your insurance
company.
And if you need a goodinsurance guy, I've got a couple
(45:50):
that are great.
We make no money oncybersecurity insurance.
It's actually against the lawbecause we're not agents.
We're not insurance agents.
Speaker 1 (45:58):
So you're recommending people, if they
don't have it or don't know, goget some cybersecurity insurance
, go get some.
Speaker 2 (46:04):
Yeah, and the kind you get is a big deal.
Because a lot of times in thefine print, these insurance
companies are requiring you todo multi-factor authentication.
You better have EDR loaded, youbetter have a whitelist type
program, you better have ayearly penetration test done on
(46:25):
your network and if you don't,so sorry, we're not going to pay
your claim.
So this is the other thing werun across is nobody's looking
at these policies.
So this is the other thing werun across is nobody's looking
at these policies.
They think that they've got,they're covered, and it turns
out they're not covered becausethey're not doing these things.
That the insurance company,yeah, which it makes sense from
their side, right, it's likewell, otherwise it's just
(46:47):
Russian roulette.
If you don't do this, it's justa matter of time You're going
to get hacked.
But if you're not doing thosethings, you're throwing your
money away at the insurancecompany.
So if, if, if you havecybersecurity insurance or you
have insurance you call them Alot of the insurance have a
cybersecurity response or anincident response team that
(47:07):
they've already made.
They're going to be.
The insurance is going to bepaying this claim.
The insurance is going to bepaying this claim.
So they've already engaged aremediation team and an incident
response team company to dothat.
The second call would be to aguy like me.
If you don't have one, you cancall me.
But if you've already got a guy, call him, of course,
(47:28):
immediately.
What you don't want him to dois go in there and kind of
blunder and mess everything upbecause you need him to.
If you do have a remediationteam, they're going to want to
get in and look at things.
And this is where having asolid backup and disaster
recovery plan is absolutely.
You got to have that.
(47:48):
So with all my clients, backupis like the flip side of the
coin to your cybersecurity.
Right, if you get hit, ifyou've got a solid backup, then
you can just restore from thatbackup and you're good to go.
And this is why you need animmutable backup, because
hackers know that if they don'tget to your backup and corrupt
(48:11):
that backup, then they knowyou're just going to restore
from that backup, so they're notstupid.
This is the other reason whythey don't immediately
ransomware your whole network.
They're going to try to findyour backup and corrupt that and
then ransomware you becausethen you've got nothing to
restore from.
So an immutable backup is abackup that backs up offsite and
(48:32):
then that connection connectionis severed and that file that
gets written.
It can't be written over, itcan be read by you but it can't
be re, it can't be written to,it's immutable.
So, um, it's basically kind ofhacker proof.
And then we always pair thatwith understanding from the
client's perspective.
(48:53):
How old can that backup be?
Right?
Because if it's a backup that,say, you know from last month
that may, you've got 30 daysmaybe of data that you lost and
I don't know what it will takeyou to reenter all that data.
Maybe you can, but maybe ifit's all in the cloud, you don't
(49:15):
have any paper to reenter itfrom.
So a recovery point in time isimportant to establish and a
recovery time objective tooright.
If you're an architect and youget hit and you've got a bunch
of AutoCAD files that are hugeand massive, that run on big
(49:36):
servers, but your server isransomwared, it's going to take
some time to wipe that serverand reload all the stuff on
there.
So that's.
The other thing is how quicklydo you need to be back up?
What's the recovery timeobjective?
So I've got lots of greatlittle stories that I can tell.
Speaker 1 (49:58):
Yeah, I bet we're unfortunately about out of time,
but I do have another question,because another big thing is I
heard a business owner not toolong ago say I should be fine,
all my stuff's in the cloud.
So in other words, I think theywere saying, all my stuff's on
Google Drive Is, in other words,I think they were saying, all
my stuff's on Google Drive.
Is that just as vulnerable asyour computer?
(50:19):
Absolutely Okay.
Speaker 2 (50:20):
Yeah, and this is a misconception with a lot of
people is they think that Office365 or Google is backed up.
It's not.
It's redundant, meaning there'scopies of your data that are
being replicated, your data thatare being replicated.
But if I'm a hacker, I cancorrupt that data and all
Microsoft sees is that the datachanged.
(50:41):
It changed so they replicatedacross all their servers.
It's not a backup.
It's like it's a live copy incase they lose a data center.
If your Dallas Microsoft datacenter goes down, no problem.
They've got a Chicago one thatthey just switch you over to
instantaneously.
(51:01):
You don't even know and youknow your, your live copy of
your data is there, but it'sbecause it's.
It's been copying back andforth.
So, as a hacker, I just need to.
I just need to ransomware yourOneDrive.
There's no backup.
Speaker 1 (51:17):
Wow.
Well, I know you've piqued theinterest of a lot of listeners.
I know you have me, so where'sthe best place to follow you to
learn more?
Speaker 2 (51:28):
Yeah, so I'm on LinkedIn.
You can look me up, joshCochran.
Our website is wwwdiversecticom, and that's diverse, just like
the word diverse and CTI likecomputer telephone integration
or internet or whatever you wantto throw in there.
But yeah, diversecticom is agreat place to go and, yeah, you
(51:53):
can fill out any informationthere.
We're happy to do.
We have a free cybersecurityassessment tool.
It's absolutely free, it'sextremely powerful and I already
bought it.
I get tons of uses of it.
So I love helping entrepreneursand that's just a free tool.
And if you need me, great.
If you don't need me, noproblem.
(52:14):
I'm not interested in trying tosell you something that you
don't need.
I love being with otherentrepreneurs and hearing their
story.
It's why I'm here with youtoday.
This is a blast.
So if you need me, great.
If you don't, either way, I'dlove to get you an assessment so
you know where you're at.
Speaker 1 (52:33):
Well, I want to encourage our listeners to go to
your website, because on yourblog you've got a very active I
mean like every day or twoyou're putting more content up
there.
So for people that want tolearn more, I encourage them to
go to your website and check outyour blog as well and follow
you on LinkedIn.
So I end up with one lastquestion, and so if you're in a
(52:54):
room full of entrepreneurs,different businesses, different
sizes, seasons of business, whatis something applicable for all
of them?
So it could be a book they needto read, or maybe a tip or a
trick or a quote, somethingyou've learned, what's something
that would be applicable to allof them?
Speaker 2 (53:12):
Man.
My favorite thing to share withpeople probably takes too long
to go into, but there's a small.
It's Kenneth Blanchard's OneMinute Manager, and I love that.
He basically breaks down how togo in and manage anybody for
(53:32):
any task and he breaks it downto either you are giving them
support or you're giving themdirection, or you're giving them
both support and direction.
And so he's got a great methodwhere you ask very simple
questions.
You're listening to see whatstage they're in.
(53:54):
Are they in stage one, two,three or four?
Stage one is you don't knowwhat you don't know and in that
stage you need to give them highdirection and low support.
In stage two, you now know whatyou don't know and you need to
give them high support and highdirection.
(54:15):
In stage three, you know whatyou know.
You're kind of consciouslycompetent, so you give them high
support but low direction.
And the final one is stage four, or style four.
You manage them.
They're like a Jedi master.
They're unconsciously competent.
They don't know what they know.
(54:35):
They've been doing it so longthey don't have to think about
it, so you'd manage that personlow support, low direction.
So I find that that right theregives people a framework to
come and ask their.
I tell them I train my people onall of this.
When they come to me they'll belike I'm S2.
And that tells me they needhigh support and high direction.
(54:57):
Right, because they've alreadydone the work for me.
Like they've diagnosedthemselves.
They know exactly.
And here's the problem Ifyou're managing someone and
they're an S3, they'reconsciously competent, they just
need more support, you know.
Like they don't need to be toldhow to do it.
They just hey, what was thecost of that thing?
Again, they don't need to knowwhere to go get it.
(55:19):
But if you don't know that andyou're managing them with high
direction like okay, open yourbrowser, you're going to go to
this site they get mad, they getfrustrated because you're
telling them how to do the job.
They already know that.
Telling them how to do the job,they already know that.
So that is such an awesomeframework to to work with people
in, because it gets you rightwhat they need and everybody's
(55:39):
happy.
Speaker 1 (55:45):
That's sound advice and that has not been shared on
our podcast and I know for thosepeople that are aware of that
book.
Speaker 2 (55:49):
it's a book, right?
Yeah, there's a whole series.
It does a lot of differentstuff, but yeah.
Speaker 1 (55:52):
Yeah, for those that are aware of it, aware of it,
they're probably going abusiness coach.
Never heard of that.
Well, there's so much goodinformation out there we can't
know it all.
That'd be like knowing theentire tax code.
It's impossible, so, but that'sa new one to me, so I
appreciate it.
I'll put that in the show notesfor people to find.
Josh, you've been a blessing tomany and a wealth of
(56:13):
information.
I appreciate your time todayand I wish you continued success
.
Speaker 2 (56:18):
Thank you.
Thank you, Michael.
Thanks for having me on.
Speaker 1 (56:21):
I've enjoyed it, my pleasure.
Thank you for listening toSmall Business Pivots.
This podcast is created andproduced by my company, boss.
Our business is growing yours.
Boss offers flexible businessloans with business coaching
(56:48):
support.
Apply in minutes and getapproved and funded in as little
as 24.
To need help growing yourbusiness, email me at Michael at
Michael D Morrisoncom.
We'll see you next time onsmall business pivots.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Special Summer Offer: Exclusively on Apple Podcasts, try our Dateline Premium subscription completely free for one month! With Dateline Premium, you get every episode ad-free plus exclusive bonus content.
On Purpose with Jay Shetty
I’m Jay Shetty host of On Purpose the worlds #1 Mental Health podcast and I’m so grateful you found us. I started this podcast 5 years ago to invite you into conversations and workshops that are designed to help make you happier, healthier and more healed. I believe that when you (yes you) feel seen, heard and understood you’re able to deal with relationship struggles, work challenges and life’s ups and downs with more ease and grace. I interview experts, celebrities, thought leaders and athletes so that we can grow our mindset, build better habits and uncover a side of them we’ve never seen before. New episodes every Monday and Friday. Your support means the world to me and I don’t take it for granted — click the follow button and leave a review to help us spread the love with On Purpose. I can’t wait for you to listen to your first or 500th episode!