Simply Solving Cyber - Sally Illingworth

All right.

Thanks for joining Simply Solving Cyber. I'm Aaron Pritz.

I'm Teddy Guzik.

And we are here with Sally Eilindworth from the other side of the world, Australia today. And we're excited to be trying video and be connected to two points around the world. A couple of us here in a live location. Sally was commenting on, wow, that's weird after a year of everyone being sequestered, but Sally, Welcome to the show.

Thanks so much for having me. I'm excited to be here.

Yeah. So in every show, we like to start with two kind of basic questions. We'll unpack them one at a time, but the first one, we like to get to know you and tell us your journey from a career standpoint and into technology and how you touch on cyber today. I know that you're not a cybersecurity full-time CISO or practitioner, but you have elements in what you do that really resonated with me and I thought it was worth a chat. But yeah, let me turn it over to you. Tell us about your journey and yourself.

It's a great question. And, you know, just a quick point, you know, you mentioned I'm not a cybersecurity practitioner, which is certainly the case. But it's been interesting, I think, and you guys have probably seen this more than I, but I think with the way that the world's moving and the way the world's changing, a lot of us, you know, in our practitioner and leadership capacities are having to become more in touch with cybersecurity because of what's happening in the world, right? So, in that sense, we're all having to further educate ourselves and understand a lot more about what cybersecurity means, what does cybersecurity mean, et cetera. But for me and my career, I started out in the food retail industry. So, working with a large franchise group and dealing with 1,200+ outlets. And the way I started to get into tech was, In the later years of working with that company, I sort of, you know, moved into a strategic project management role. So, it was focused on technology sourcing and adoption. And then also looking at existing technologies that we were using, whether it was in hardware or software, and working on ways that we could sort of standardize and improve our approach to technology for these consumer retail outlets, if you like. So, that's where I started to get more into the techie side. And without realizing it, I was very young at the time for the sort of work I was doing. I progressed quite quickly. So, but in hindsight, you know, I'd been put in a position where I was taking on sort of product owner roles and stuff like that. And just based on the dynamics of the company I was with, I was in a position where I had become sort of the key primary contact with the major technology vendors and service providers that we relied on. So, I was sort of really on the coalface and started to— I was in a position where I had to learn a lot about what was going on. And so I would be on the after-hours calls when things go wrong with technology, including in a cyber sense. Yeah. And there's some sort of great stories there. So that's sort of how I started to get into it. And then cybersecurity more specifically, it was probably in around 2018 that I really started to take sort of, I call it a leisurely focus on cybersecurity. And in particular, it was relating to the whole sort of 5G radio access network infrastructure debate in Australia, and then more broadly across the world. Dealing with particular vendors and the decisions that were being made there to block certain vendors. And I just became interested in what is this debate actually about? It's clouded by politics, but I want to understand it. So, I just started reading. I love reading white papers and stuff like that and try to understand what's this debate about. It's obviously about security. And then from there, now I'm fortunate to be in a position where since then I've worked with a number of cybersecurity professionals professionals and companies. And yeah, still learning a lot and trying to do my best to sort of help where I can with, you know, supporting with comms strategies in the space and cyber awareness more generally.

Yeah, that's awesome. And speaking of comms strategies, uh, I know right before COVID and lockdown I started watching your show, The Reboot Show, and it was cool because it's technology and propping up brands and, and tech firms that maybe don't have a broader voice. But tell us about that. Tell us about how you engage with companies in Australia and beyond from there.

Yeah, it's a great question. We've got a Reboot Show Live streaming session tonight as well, which I'm excited about because we put it on hold for about 2 months. But yeah, so the work we do there is that business was founded just before COVID great time to start a business. And so we started a business myself with a partner, you know, because I mean, he's got sort of 30+ years working in chief information officer roles and all sorts of things in technology. Then myself, just very passionate about technology and have done bits and pieces there, but I'm by no means an expert in the space. We sort of, with my comms background, his technology background, we were sort of working on some other projects and we sort of arrived at this point just sort of off topic and we were like, there's no, all of these technology brands, technology practitioners are really struggling to gain access to good information that's also entertaining because particularly cyber. And I love what you guys are doing with this podcast. Things like cyber and other disciplines of technology can be quite dry and boring. So we were like, how can we contribute to the process in which we make that exciting and engaging but still highly informative? So out of that, The Reboot Show was born. And The Reboot Show is operated under Lamp Media. And with Lamp Media, we work specifically with enterprise and startup technology brands on communication strategies, campaign planning, and demand generation. So yeah, it's some exciting stuff. Happening.

Awesome. So, let's back up for a second to when I said, you know, Sally, you're tech and cyber and marketing comms, but not a practitioner. And you, and you corrected me and said, we're all becoming cyber practitioners. I want to double-click there because that's so interesting and that's so relevant because, you know, as cyber practitioners in big corporations, a lot of times I would say the broader workforce looks for IT and cybersecurity to fix the bad things and they don't do enough themselves. And same with our families. Like, we hope that maybe a parent may fix the internet router to make sure we don't do bad things, but that is not real and everyone's being impacted differently. So talk to me about, you know, maybe your perceptions of how that needs to change and how we all need to be, you know, educate ourself and be engaging differently in cyberspace and within our companies and within our families.

Yeah, it's a great point. And, you know, I think in an ideal world, cybersecurity would remain this big IT issue. And, you know, you guys probably laugh about it as much as I do. And I think it's funny because even sort of where I come from and when I started to dip my toe in cybersecurity, you know, I remember one story with— it was a pizza shop within the franchise group I was dealing with. And there was one night and I get called at 7 PM and, you know, they've got an issue where they've been, you know, they've been victim to a ransomware attack. So anyway, it was just sort of an incredible wake-up call to realize, you know, people who use systems— and we all use systems now, you know, it's no longer really a luxury, particularly in developed countries, to use a laptop or use a phone or use a computer. That is just standard, you know, that's how we operate in a standard manner in today's day and age. So in that respect, we've all got an increasing responsibility to be mindful of how we use these systems and better understand what are some of the consequences or the risks of using them. Because I think, you know, technology has developed so fast, so quickly. We've all embraced it, but we've focused on the positive sides. And that's not to say we shouldn't focus on the positive sides, but we need to be increasingly mindful of, well, what are the cons to using these things? What are the things we need to be mindful that can go wrong? So, that really starts with awareness. And to, you know, to not get sidetracked and try and answer your question from my perspective, I think we all have a baseline responsibility to understand the machines we're dealing with and have a greater awareness about what happens online. That doesn't mean we all need to have the capability that you guys likely have as practitioners where you can go into systems and really go and diagnose an issue and understand what's going on. We don't all need to know how to do that, but we do need to be mindful of what's happening because, and I'd love to hear your thoughts on this, but from what I understand, it's still really basic tradecraft in cybersecurity, whether it's email phishing or otherwise, that causes the most amount of issues for the most amount of people and businesses. So, and a lot of that stuff does come down to human error, you know, on the victim side when we're being attacked and are we mindful of, you know, what links we're clicking, those basic things. So, yeah, look, I think, you know, the core responsibility still sits with the practitioners and firms like yours, you know, who get paid to solve these problems and help tackle these major issues. But there is an increasing importance for all of us to become a part of a bigger mission which is, yes, let's, you know, benefit and profit from the fruits of technology, but let's be mindful of what we're dealing with here because we're all a part of the problem and the solution at the end of the day.

That's a great point. And actually, I want to turn it to Teddy because you said you'd love to hear our thoughts and then you were talking about the different attack vectors. And Teddy professionally, you know, his core background is penetration testing and red team and, you know, being the good bad guy, right? Try to exploit the bad things that are open and vulnerable before the actual bad guys can. So Teddy, maybe talk, talk to Sally about some of the things that you have success with. And maybe I want to hear you guys get into a dialogue about how Sally might be more defensive against some of the things you might be able to do.

So, so yeah, very frequently we'll run into, you know, clients asking for an external penetration test that says, you know, and at the end of it, it usually comes back with, hey, look, it's pretty secure from a patching perspective, from a configuration perspective. You know, a lot of companies spend a lot of time, a lot of money trying to secure those things. Um, but where we usually get in is through, you know, a weak password, right? Or, you know, there are controls that do help mitigate that. You've got multi-factor authentication and stuff like that, but not every, not every system can support that. So you're— we run into issues there. Um, but then also the other thing is, okay, what's, what's the point of spending all this time and money to secure external environments if someone can A, walk right in the door and plug a laptop in, or B, send an email from across the world and have someone click on it? There's all sorts of controls in place that can stop these things from happening, but they're not foolproof, right? So why aren't we investing more time more money in our people to learn these things in that security awareness. But instead, people usually go with, well, the penetration test shows that we're good, so we're definitely going to pass that. Most of the time when I'm selling a social engineering assessment or some security awareness, people will say, oh, you know, regardless, we're going to fail that test, so there's no real point in us going about and doing that. That's always a frustration for me when it's like, you know, you have an issue there and you're turning the other way. So that's just kind of some of the things that I run into on a daily basis where the technicals are not where most people are getting in, where most of these ransomware attacks are happening and these breaches, that kind of stuff.

Yeah. Just this afternoon I got a text and it was a good one. I sent it to my team here at Reveal Risk and it was a text about a UPS package and it said the logistics had been changed. And it had a link and, you know, it looked like the exact UPS or DHL or pick your courier text that you get when something like that does happen. And I actually, you know, I ran a scan on that hyperlink and it was confirmed malware ransomware. So, so, but, but the average person doesn't realize that, right? They just get a text and they're quick to click because it's like, oh my gosh, I got to get my package. Um, so I know I've seen some of your recent posts online and you've kind of shared, which is part of awareness, right? You're helping your community understand that these things are out there and they're pretty tricky. Um, but talk to me more about kind of what you're seeing, how, how you think, uh, yourself as an influencer could help with getting that word out, getting, you know, making people realize it's not the hardcore IT stuff that's probably the, the most vulnerable, it's the human and how they interact throughout their day on their phone or their computer.

Yeah, it's great. And I love the points you make, Teddy. You know, to add a couple of things there, I love that you say, you know, we need to focus on people, right? Because people are the last frontier of technology at the end of the day. And so that's a really important thing we could never forget. And the other thing, you know, that's sort of, you know, half comical, but on the password note, you know, over the years I've become so paranoid about having easy passwords. That I create the most ridiculous passwords for everything. They're so ridiculous that I always forget them. But it's good because, yes, it's frustrating and it takes time, but I'm constantly resetting my passwords for everything because I forget them. I think, "Well, if I've forgotten what it is and therefore it's not something simple or obvious to me or someone else," you know, it might be describing an object in a building or something like that, that's good, right? So, I'm not saying that that is the sort of advice that you would come give an enterprise.

Pretty good. Long phrases and sentences where you say something that's memorable, but it's the most characters. And, you know, for a while there, it used to be complexity, like use every single character and make it so complex, but nobody remembers that. So they write it down or they save it on their desktop. And I think you're spot on, like that is industry best practice guidance to say long passphrases, like look out window, see car. That's probably stronger. Than an 8-character password with a couple of dollar signs. So, spot on.

Yeah, certainly, certainly. And it's an interesting thing. And I think, you know, back to what, you know, you were saying, Teddy, around people, you know, even when it comes to passwords, right? Like, I'm sure you could build out, and I'm assuming here, you know, some sort of, you know, great password strategy framework for a client, right? And here's how everyone in your organization should be creating passwords. This is the approach they should take to password changes, etc. But at the end of the day, the issue that you have there is if people don't stick to that, because we live in a world where we can save all of our passwords in every browser, etc., that there is on the World Wide Web, right? So, it becomes easy. People want a seamless experience. They don't want to have to enter in a password every time they go into something. So, back to your point, that comes down to people and retraining people and getting people to understand that unfortunately, this is the world we live in. We live in. So, as much as we want these seamless, frictionless experiences where we don't have to put in any effort to enter in a password every time, we need to be mindful of what that might potentially cost us. And I think a lot of these challenges come back to the fact that, you know, the natural human wiring for every person on this planet is path of least resistance. And now we're seeing, I think, a lot in cyber that the path of least resistance, which means how can I put as little energy as possible into using technology, an online solution, that's now starting to cost us a lot. So, it's a big challenge. But back to, back to your point, Aaron, around, you know, maybe part of what's my role or what can I do or what am I trying to do to try and play my part in at least using my, you know, my online reach and my online engagement for good in this space. You know, I was really proud, you know, so a couple of months ago I was contacted by the Cybersecurity Forum Initiative in the US. So, they do a lot around trying to connect you know, great expertise around cyber warfare training and education with industry. So, from what I understand, they're doing a lot to sort of grow in that space in what they do. And they contacted me, they have a fellow model, and they'd asked me if I wanted to be the first Australian fellow with them, which I was really proud and excited about. I almost had a bit of imposter syndrome. But because one of the core focuses of their work is to raise awareness and education on this matter, it really aligns for me. So, you know, that's one thing I'm doing, I suppose, from an industry perspective.

Sure.

But the other thing is trying to, you know, force myself to continue studying things about cybersecurity and where it makes sense to talk about them and talk about cybersecurity things, you know, or cybersafety things in ways that people can understand, right? Which comes back to the work I do, which is simplifying complex things. Because for me, I don't want to be in a position where I go online and, you know, ramble off things I've recited from a paper about the technicalities of a zero-trust architecture, because that's not my domain. That's not my circle of competence. I can sort of talk about it and offer some commentary on it, but I am really trying to force myself to continuously focus on how can I talk about real-world experiences. And, you know, I know we touched on it briefly before this podcast session. You know, I've had some, particularly around cyber safety and cyberbullying. So how can I talk about those things at minimum to try and, you know, get people engaged in the conversation, force us all to just be a little bit more aware of the world that we live in now.

Yeah, and actually on the cyber safety, cyber bullying, a lot of our clients, we, we kind of advocate if you're not going to get every employee at a company to care about protecting the company data like we would in roles where we do it full-time, but that said, you can resonate with some employees and there are other employees where you can get the same behavior change by talking about their personal family and protecting them. So when I was reading your story online about what started happening to you in 2019, I kind of was like, well, that's cyberbullying. I mean, it's adults, it's career manipulation and all that. But talk to our users about that. Like, what, what can we learn from that? Tell us a little bit about your story there and how do we think about that and how we might protect our families or our colleagues and things like that?

Yeah, yeah, it's a really, it's been emotionally exhausting and you know, and all that sort of stuff and debilitating in some senses and scary and intimidating, but you know, if I try and focus on the positives and the learnings from it, what's been really fascinating is that this entire experience which has been going on for almost 2 years now has made me realize that you know, not in a negative way, but in cyberspace, we all are, you know, whether it's our device or a profile, like it's insignificant in the grand scheme of things. It can be used against us because what I've learned from this is that this person, you know, who was using cyber to do wrong by me and try and threaten and intimidate publicly known affiliates of mine, all they're really doing is finding information online and trying to weaponize it against me. And particularly for those who are active, you know, on social media, that it's a scary thought to realize, hey, I, you know, harmlessly and innocently posted this thing, but someone's managed to take that post, they're going to pick out a few words, and then they're going to make all these defamatory claims. And that's having an emotional impact on me at minimum, let alone a financial impact. And so, it's been a very eye-opening experience. When it first happened, the first instance I became aware of in 2019, I tried to ignore it. I was like, you know, I'm just going to get up and get on with my stuff and I don't want to deal with this. But then as it escalated, I was put in a position where I had no choice. And, you know, the consequence of that was because of how someone has been so creatively using cyber to bully me and threaten me, you know, it really put me in a position where I felt like I just want to delete everything online. I want to go and hide in a hole. I just want to get off all these platforms. And so, that is a real issue. And, you know, then I started to ponder, well, I can't be the only one who experiences this in a lifetime. Other people will. And what's been fascinating about this experience is that even in speaking with members of parliament, Australian law enforcement, you know, ProtonMail is a service provider based in Switzerland. There are currently not the regulatory or legal frameworks in place to even help try and begin to combat these sorts of things where people are so creative. With using cyber to bully and intimidate others. So, you know, there might be basic laws in place around cyberbullying and you can't do that. But in terms of trying to tackle this issue and easily, I suppose, solve the problem by saying, "Yeah, there's evidence here, there's evidence there," you're battling with, you know, different privacy laws in different countries and all that sort of stuff. And so, yeah, it's been an incredible experience in negative ways and in, I suppose, ways in which I can learn from and I hope others can as well. For me, we're talking about it online. I'm the sort of person, I don't like to lay out dirty laundry. I like to, you know, high energy, always talk about good stuff that's gonna value add. And to your point though, I think speaking about it, you know, it does consequently raise awareness about this stuff. And it's forced me to think about things and go, you know, how conscious am I of what I'm doing online and how, you know, something may impact someone else. Because, you know, to the point Teddy raised earlier, like, you know, even from a cybersecurity perspective and looking at threats, et cetera, Everything always comes back to people. It's about people. So that's where we've got to start. Yeah.

Well, and we should maybe talk offline because we've deployed a solution for protecting executive VIPs that scans the dark web and it looks at what's happening online and looks for abnormalities. So just thinking about your brand and your company and what you're doing, there may be some creative solutions to look out for yourself versus just kind of waiting for the next thing to happen and trying to deal with it real time. So happy to connect offline on that. But, uh, yeah, it's a, it's a tough problem. Sorry you're having to go through that. Um, it sounds like, um, you're starting to raise awareness. I know I saw it a few weeks ago. I'm like, oh, that's, that's horrible. Like, but what we can, what can we learn from this? So that's awesome. Hey, last question. I know we're running short on time. Um, talk to us about, uh, the, the last question we always ask in our, in our show is tell us about, you know, technology is very important, but tell us about a scenario where people and process won the day. Maybe it was a technology project, but it's really the people and human processes that were put in place to really save the day. What do you got for us?

Yeah, there's a lot, to be honest with you. A lot. Yeah, particularly in scenarios where I've been working on a project and, you know, whether it's executive leadership, you're having challenges trying to get something across the line or pitch something to them and then things go wrong with technology and people and process day to day and you go, "See, this is why we need to invest over here. You know, we can't do this. Technology's not working." But yeah, I've sort of put a bit of thought into it and one that, you know, to try and link it to a cybersecurity conversation, you know, I'll never forget the first instance in which I became aware of, you know, a cybersecurity situation that impacted a small pizza shop that serves a lot of customers, right? And I think this is a good example in the sense that hopefully, you know, I can imagine some of your listeners are on the large enterprise side of things, but then some are probably on the small business side of things. And Teddy, you'd probably know this better than I. I think there's a lot of perception that, you know, the smaller businesses think, oh, we're not a threat, you know, we're not Microsoft, we're not these big companies. No one cares about our data, no one cares. But going back, you know, this must have been back in 2007, 17 or 18, and as I mentioned at the time, I was sort of key after-hours contact for any sort of major IT issues, etc. I had this franchisee call me, it must have been about 7 o'clock, I was going to dinner, call me saying, "Oh, we've got a problem here. There's this stuff on our server," and so evening time is peak trade for a pizza shop, everyone knows that, so they've got hundreds of customers to serve. "Oh, we've got this stuff on our screen, you know, and it's saying we need to give them money and stuff." And this comes down to awareness, right? They didn't understand the basics of cybersecurity and a ransomware attack. And so, I'm like, "Oh, God, you know, like, I'm trying to go out to dinner and they've got this problem." And the only way we could resolve it and allow them to get on with business in that moment until the IT team came in to try and help solve the problem, you know, was to fall back on people and process. And I said, "Right, just leave the server. Don't touch the server. Don't try and do anything. Just leave it all alone. Don't touch any of the computers because someone's trying to attack you right now and they're going to take all your data and stuff like that." they're trying to get money out of you, so just forget it. And so serving hundreds of customers in one night, the pizza shop had to go back to the process of let's just get paper, take all the phone calls and write down manually all the details for every order. And they were frustrated when they said, "Can't the IT, the level 1 support IT vendor solve this problem?" And I said, "No, this is going to take time and you've got customers knocking on the door, so you're going to have to go back to the old school ways. Forget the technology." just pretend you've thrown out the server and just get on with it. So, and I still always think about that example. And for me, you know, in a weird way, you know, it ended up happening at a good time because in that period I was in the process, not as a cybersecurity professional, but just as someone responsible for technology improvement and adoption, where I was trying to pitch at the time the importance of updating all of the franchise agreements for this group to make sure that we could put in place good governance measures to ensure everyone had up-to-date hardware and software the entire time. So it ended up being at a really good time for me. This is why we need standards.

Yeah, how— Teddy, how important is patching up-to-date servers and computers? Is that pretty important still?

Extremely. I was, I was just talking to someone about the difference between Windows 7 and 10, and just, it's miles, miles from an attack perspective.

Awesome.

Awesome.

And I think, you know, if I can just, sorry, not to try and shift roles here, but to ask a question just quickly on that point.

Yeah.

You know, I think, is it, I can imagine it's a challenge, you know, particularly for say groups like that where, you know, you've got, you know, you're operating multiple outlets, et cetera, like standards and, you know, having that sort of place stuff in place is really crucial, right? Because then you have something, you know, consistent to rely on and lean on. 'Cause I think what happens in a lot of cases, business of all types, you know, we don't have internal standards around this stuff, keeping things up to date. And then so that's when you fall into a heap of problems because, you know, to the point you raised, Aaron, at the beginning of this is, "Oh, it's just an IT issue, they'll fix it." But now cybersecurity is becoming a business priority, an economic priority. And so, you know, a lot of these businesses are being forced where they have to, you know, review their standard operating procedures. How do we, you know, prioritise these sorts of things? I just think I'm probably not making much sense of it.

No, no, it's spot on. Fundamentals, basics, written stuff down.

It flips that question that Aaron just asked you about people and process back to us, and it's really, you know, everyone expects IT to patch and security to patch all the systems and stuff, but it's important for that to be a built-in process that the people are following when they're rolling out these systems, these computers, right? Having that standard image. And having, you know, whatever you need to have enabled on that computer to continuously update and patch that. So, um, no, that's a good question. It's a very good question.

Yeah, awesome.

Well, Sally, it's been so much work in the future. Cybersecurity's, you know, going to be one of the fastest growing disciplines, I believe.

Yeah, we're excited, and we're excited that more people even outside of the core IT tech are getting into it. And, you know, you're taking a interested. We hope others do as well. Your voice matters. It has reach. And really, outside of IT, the more people that we can get inspired to do something and own their family's security as well as help their company, I think it's going to be a better world for all of us. So, we really appreciated talking to you today and getting to know you a little bit more. And thank you for all you do. And we will talk to you soon.

Yeah. Absolute pleasure. Thanks for having me, Aaron and Teddy. See you, Sam.

Thanks so much. Bye.

Bye.