Unspoken Security Ep 5: How the Hell Are Small Businesses Supposed to Be Cyber-Compliant?

It's not just that people don't have the money to do this, it's that they don't have the capacity, the relevant resources allocated to them, the influence to get those resources allocated to them. So we are watching right now a creation of haves and have-nots in information security.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host, AJ Nash, engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made.

Hello and welcome to another episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy. I spent 20 years— well, about 20 years— in the intelligence community, both with the United States Air Force and then as a defense contractor, and most of that time was spent at NSA. I've been in the private sector for about 8 years now, primarily building or helping people build effective intelligence-driven security practices. And I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! So the goal with this podcast is to bring all of these elements together with some incredible guests and have authentic, unfiltered conversations, even debates, about a wide range of topics, challenging topics, frankly. And most of them are topics we're facing every day. It's not gonna be a typical polished podcast. You might hear or see my dog. She's usually around here someplace. People may swear here. Uh, we may argue or debate, and that's all okay. Think of this as a podcast. It's more like a conversation you might overhear at a bar after a long day at one of the larger cybersecurity conferences. These are those conversations we usually have when nobody's listening. Today, our guest is Tara Wheeler, which is pretty amazing. She's a founder and CEO of Red Queen Dynamics, as well as senior fellow for global cyber policy with the Council on Foreign Relations. She's been a star and a leader at all sorts of well-known places— Microsoft, Silent Circle, Symantec, Splunk— and she's probably the most educated person who would tolerate me. She's got degrees and certificates all over the place, but international relations, political science, she's agile development, cybersecurity. Institutions, I mean, from the Northwest, of course, Carroll College, Portland State, University of Washington. She's also been to Harvard, right? And she's a senior Fulbright scholar. I don't know why she wants to spend time with me. I know she's been a little under the weather, something, maybe the cold medicine got to her and she was tricked into talking to me. So we're going to spend some time together. But Tara, is there anything I left out about your profile that you want to add?

Oh, totally. See this one right over my head right here?

Yeah.

Paper on the wall behind me. The one that I like to keep nice and centered right up there is my GED.

Yes, I also have a GED. That's amazing. I didn't know that about you.

It's, it's super important. People should know this, right? Like, I very clearly have an academic inferiority complex. That's why I go and do all of this shit, right? But like, I keep, I keep like two things kind of like front and center for me when even when I'm having these kinds of conversations with you. One is John Wick right behind me. I made my own motivational poster. And it says, work until you no longer have to introduce yourself. And right over that's my GED. Just to— it's not to keep me humble. I don't need anything to keep me humble. I'm always like, you know, scared and trying to fix shit, right? But it is to remind me that everybody has their own journey, and the missteps and stumbles that we make along the way sometimes get us to where we wanted to be.

I think that's great. And it's funny, I've said the same thing before, right? It was— so this show's Unspoken Security, and a lot of people share unspoken things, right? They've shared secrets. And in another episode, one of them is, yeah, I also have a GED, which is something people wouldn't expect. Yeah, but you're right on. It's about the journey, right? Listen, I made some choices and things happen, but you sort it out, right? You never have to stop moving. So I think that's awesome. It's something we have in common, which is very cool. I just have to get a whole bunch more degrees and get a lot smarter so people don't need me to introduce myself and then I'll catch up on the rest. But we got one, we got a place to start, right? That's good.

Killer.

So, yeah.

So I'm, I'm curious now, like we're going to talk about this episode, right? So today we're going to talk about the title of the episode is how the hell are small businesses supposed to be cyber compliant? But I mean, what are we talking about? Cyber compliance for small businesses? I'm not gonna lie. It sounds kind of boring, but you and I talked a bit and that was enough to convince me there's something really interesting and important here. And I know you're passionate about it. So, you know, the first question is, what are you seeing when it comes to compliance, Tara? Like what's got you fired up here?

Okay, so what's got me fired up? What got me started to begin with? Okay, so AJ Nash, the first time I dropped out of high school, I was 16, and I went and started building computers for my stepdad's MSP, for his computer repair company. He's still, he's still, you know, more of the computer guy, right? This is, this is what he did and does. And, you know, I ended up with my after, you know, post-school job, you know, trying to scrape my way through community colleges, building, you know, ATX mid towers, right? So you're building MIDI towers because jumper configurations were just jigsaw puzzles with computer parts, right? And what I got a chance to see was the quantity of people who were intimidated and frightened by computers, by the stuff that they didn't know. And they were all, it was the old folks' home, it was the local retail shops, it's agriculture, it's small businesses that somebody like my stepdad and the businesses that I was raised around in rural Oregon have to cope with because we use these things as tools. So, why do I care about it? That's the origin of me caring about it. But what am I seeing right now is that a quarter of a century, maybe a little more than that later on, and you know, these problems haven't fucking changed, dude. They've not changed over time. You still have the phone calls from old folks home where they've gotten hacked and retail businesses that have their machines compromised and they have Excel spreadsheets full of credit card numbers stolen. We're gonna go with a quarter of a century later on and just like use that as a great like rhetorical number. But I will tell you this right now, if you wanna hear the kind of conversations that we have at bars, at information security conferences, it usually starts with, "This shit hasn't changed in 3 decades," and we're gonna go from there. So, what am I seeing right now? Let's, I mean, let's dig a little bit more into it. And this is the thing that is making me furious right now. I'm gonna give you a point in time a few weeks ago and then tell you why this is so ruinously problematic. So on October 27th, the Federal Trade Commission published a new regulatory requirement.

Yep.

And this regulatory requirement— yep, you did. And it mostly kind of went out there on, on Halloween. No, it was not a joke, although it was terrifying, which is to say that all non-banking financial institutions in the United States, after have to report data breaches of more than 500 customers' data within 30 days to the FTC. As soon as this regulation comes into effect, now in about 5 months, it's been, it's already been 30 days. These regulations come into effect in half a year. So 5 months from now, any business that does financial transaction processing, think of construction companies that work with credit agencies to help people finance remodels on their homes.

Sure, I did all that.

There you go. Exactly. So did you do any— did you do any credit processing? Did you— of course, you know, get like a bespoke loan? Exactly.

Yeah.

You had to get a builder's loan. You had to do all those things, right? And let me tell you, my builder is not a financial genius. So this is part of his problems. His life's not about to get better, I can assure you. Nice house, but not a financial wizard.

So it's not— but they don't have to be, right? Like, my clients are wizards in other things, right? They know how to get like the shit that I want from Amazon from one side of the coast to the other. They do taxes there, they're lawyers, they're accountants. Like, I don't want to do that for a living. I like what I do for a living. They can do that and I will try to keep them safe and they will make sure that, you know, my money and legal stuff gets handled. Exactly. We have these, we live in a fucking society for a reason. Okay.

Right.

So here's the thing. This is the thing that's scary. In that regulatory ruling, there is no limitation on firm size. That's the problem. You can be an 8-person used car dealership in Auburn, Washington, and this applies to you, okay? And I want to, I want to make sure people understand that there's, there's been no real pushback on this regulatory ruling, which means I think most people just don't understand what this is, because there is no way for most small businesses to even understand that they've been breached, much less have any, any concept of how they would report it to the FTC. What, 1-800-REPORT-DATA-BREACH to the FTC? How the hell do you even do that? I would have a hard time understanding how to do that. Most of the time when I tell small businesses they need to report something or get help, I tell them to go to their CISA state or regional representative, right? CISA has regional and local reps that can help you with that now. So that is the thing that I'm seeing. And, and that's a point in time issue. And what it is, is this just ruinous incapacity for state and regulatory and federal agencies to understand the bottom half of information security in this country and how small businesses are burdened by it. Now, they get help from their MSPs. Managed service providers are the API to cybersecurity, to information technology for small businesses in this country.

Sure, sure.

Like, at the point at which you're— you are a small business and you're— and you are like doing some business, you pretty much have outsourced IT, right? So those are the people that are going to be get— getting hit with these kinds of requests and guarantees and compliance and paperwork. So, this is why I'm mad. Like, this is why I've started out mad, and this is why I'm mad right now. And any minute, I'm gonna grow a beard, and I'm gonna join, like, all the guys at the bar at, like, after DEF CON, and, like, just start yelling, like, "This shit's never gonna change!" This is why I'm frustrated. This is why I care about it. And this is a thing that, that I think needs to get brought to more people's attention right now. Like you've got 5 months, you know?

Yeah. Well, and I didn't know about it until you and I started talking, right? I mean, I, you know, full disclosure, I say I've read it. Well, I hadn't read it. I mean, you showed it to me. I was like, oh my God. And I started digging into this a little bit. And it's, it's, it is fascinating. I think you're right. The lack of pushback almost has to be from an ignorance. Either people don't understand it, or a lot of cases just don't know it exists, right? There's millions of small businesses in America. America's built on small business, right? That's, that's the American dream. Start a business. Most of them don't pay attention to FTC, to government rulings, to new policies and regulations unless it specifically affects their business. I got to believe there's a lot of people who have no idea that this is now part of, or going to be part of their problem set for next year. Right. And they're just going to, they're just going to live their lives. They're going to run their shoe store or their coffee shop or their car dealership or, you know, wallpaper department, whatever the hell they do. Right. And they're not going to think about this at all. And it makes me wonder how enforcement's going to work too. These breaches are going to happen all the time, everywhere. People are getting breached constantly. You know, and as you pointed out, like, shit's not getting better. Like, I can't imagine having a conversation at any of the bars where we don't all say that. It always comes up, right? It's very frustrating, whether it's, whether it's about simple things like hygiene, whether it's about intelligence, you know, which I rail about all the time, you know, policies, procedures, all these things, right? Shit's not getting better. Bad guys are getting better. If we're getting better, we're not keeping up, it seems like. But this strikes me as one of those things where it's maybe a good theory, but in practice, I can't imagine how this is going to work, how enforcement is going to work. The FTC is either not going to get reportings or they're going to get overwhelmed with them. You know, like I said, these MSPs that these companies are depending on are just going to be flooded and they're going to be sending all this stuff forward. And then what's going to happen? Who's going to even process any of this stuff? So, you know, I'm not going to lie. I'm embarrassed that I didn't know more about this before you and I talked. Right. And, you know, full disclosure for those listening, listen, Tara, I'm kind of a fanboy of Tara on the side. Don't tell her. But, you know, I've been following her for a long time. She's freaking amazing. And I was like, I got to get on the show. I don't know what to talk about. Well, not— yeah, not like that.

Like, not— no, no.

Not creepily, but, you know, I was like, I want to have Tara on the show. I don't know what she wants to talk about. And so, you know, I reached out and said, hey, Tara, what do you want to talk about? Like, I like to leave it open for a guest, especially smart people with great ideas. And you started talking to us. I was like, what the hell is this? And now I just look at it and go, God, I'm embarrassed. I didn't know more about it. It's an absolute mess. Like, it's really frustrating. And I don't know how people are going to deal with this. You know, the next question I thought of was like, what about the Small Business Administration? I mean, do they fit into here somewhere? Is this under their umbrella? You know, there's an MS-ISAC out there. Like, what are the thoughts in those areas? Who's gonna be helping people?

So, there's two different answers to that question, like who's gonna be helping people. What I wanna do is I wanna point out that you just said, look, I'm embarrassed, I'm frustrated that I didn't know about this. You know, people tell me that about cybersecurity all the time, the sheer quantity of like small business CEOs I've talked to. I mostly talk to managed service providers now, those are our clients, and they've got some handle on it. But the number of business owners leaders that I've spoken to are like, I'm embarrassed, I don't know anything about this. And I was like, join the club, buddy. Like, we're all out here, you know, just trying to figure out who did this, you know. And so the answer is, I should not have to know the intricacies of updated IRS regulations, right? As long as there's something that over time they're going to stack up, somebody's paying attention to. My managed service provider for my finances is my accounting firm.

Right?

It's their job to know and understand these things, also to translate them a little bit to me. But if a major new tax regulation comes up that is going to impact an entire swath of businesses in the United States, accounting firms have their shit together enough that they send out an email saying to people, hey folks, just want to let you know, this is going to become— you're, you know, you won't be able to claim your home office anymore. Something like that would be sort of the equivalent of something like that.

Sure, sure.

Everyone's trailing along claiming their home office,. And the FTC is like, what? Half of you people weren't supposed to be doing this. And they're like, but the accountant never told me not to. Why? Because we have different jobs we do. It's not my job to keep up with the tax code. It's my job to pay somebody to the best of my capacity to find a specialist who can translate much of this for me and help me walk through how I best discharge my ultimate responsibility as the fiduciary for my company, right? Because I can't know everything. So this, in the same way, it whose responsibility is it to start translating these things for small businesses? Your question is so on point. The answer is there needed to have been better communication on these policy changes. But second, the answer is mostly managed service providers are the ones who are going to end up with the burden of this, okay? And now, of course, the question is, where is the Small Business Administration? You know what? The number of people that I've talked to in cybersecurity where I've said, hey, have you thought about the Small Business Administration? Is some of them have to stop for a second and retranslate that in their head and go, you mean the federal agency? Like, that's what they're talking about. Like I said, I grew up in rural Oregon and the SBA, the extension schools for ag in the area, like these were bodies that were deeply meaningful in small business life. And from what I'm able to tell, the Small Business Administration of the United States is fully absent from this conversation. So I just checked and next year, For, for the period of time between now and I believe the end of 2024, and I gave you, I threw some links up there for you and we can post them later.

Yeah.

The SBA has a $6 million budget for cybersecurity for a pilot program to aid small businesses in the United States. That is $6 million, not per state or per industry. That is for the United States. Now, I, I did the math on this one. I did the math on this and I, and I wanna tell you.

It's not gonna be good.

Oh yeah, so right now there are, there are at, at last count by the SBA's own numbers, 33,185,550 total U.S. small businesses. Over 33 million U.S. small businesses. And the SBA next year is going to spend $6 million. That is 18 cents per business in the United States that's qualified as small.

It's nothing. It's nothing. It's absolutely nothing.

Yeah. Yeah. I lost that this morning, you know, in— that was— that's less than the amount that it costs to put extra whipped cream on my latte in the morning. You better believe I drink a lot of coffee at this point.

Oh, that's a good context for it.

So where is the SBA? Like, they're a rounding error for small businesses right now when it comes to cybersecurity.

That's insane. I mean, the last intel team I put together, I had a $3.2 million budget, you know, and that was one company, one team. And by the way, that wasn't everything I wanted. That was like initial operating capacity for, you know, a 9 to 12 month project. It was, it was, yeah, like I said, $3.2 million. I think we spent a little south of that when it was all done, but that's one company, right? And you're saying there's millions of these companies who also don't have cybersecurity expertise.

Tens of millions.

Yeah. And I was working with experts, right? We were cyber experts. Well, I wasn't, but I worked with smart people. And, and you're talking about, again, the, you know, the mom and pop shops and the, you know, the small businesses, people who are just doing the things we all need done. You know, as you pointed out, I'm not a carpenter, I'm not a doctor, I'm not a lawyer, and I'm not an architect. You know, name all these businesses, right? But we need all these people. And now they're going to be asked to do all this with no funding of any kind. So like you're telling me that the Small Business Administration is nonexistent on this. I didn't ask you this in prep, so you may not have an answer for it. But no, no, it occurred to me as we were talking like Does MS-ISAC get involved in this at all? Is there, is there a place for them to play in this? You know, the multi-state ISAC having an opportunity to, to create support here. I mean, it feels like it could be an ISAC kind of a thing. I don't know if anybody's talked to them yet or if they've talked to, to FTC yet about this. I don't know if you know anything on the subject.

I mean, I literally, I know what you're talking about because I know what the initials ISAC stands for. Other than that, like that, that initialism has never walked across my desk in any way, shape, or form. Couldn't, never interacted, wouldn't, wouldn't know where to go find them or who runs them. And, and this is, this is part of the problem. We, we think that this is— there's going to be a technical solution to this. Okay, so there's two problems with this, with thinking that there's going to be a technical solution to this. First of all, we as an industry have— we think that there are going to be technical solutions to these kinds of security problems when, for small businesses and for the managed service providers that we specifically— I'm, I'm, I And we build a product that helps compliance for MSPs that work with small businesses. And I can tell you about it later and I'll brag about it if you want me to. But the important thing is part of the reason that MSPs have issues, managed service providers, the IT guy has a problem helping small businesses because many of the information security tools that we built are fucking cool, right? Like Metasploit, right? They're like, we build a tool like this. You got HD Mori at Egypt. You got amazing people building these tools that I think Rapid7 owns Metasploit now. These amazing tools that are incredibly important in information security, the enterprise and cutting-edge level. I took Metasploit, I think Advanced Metasploit, from like Egypt and Moobix at Black Hat, maybe, a few years ago. Like, I can run Metasploit. I've done pen testing. I got a couple certs, who's saying stuff like that. Like, I'm a respectably decent person in offensive security. But the problem is, is that when you take Metasploit's Community Edition, and you hand it, and it requires all of the additional configuration, and you hand it to an MSP and say, okay, good luck with that. You need an Egypt or a Moobix to configure it at that level. And AJ, they can't afford me. I promise you, they can't afford those hourly rates, right?

Yeah, they don't have budget.

So, so a cut-down, chopped-down free version or small, small version of an enterprise tool that's handed off to a smaller organization with without the expertise to configure it, operate it, and keep it patched, for God's sake, is useless. And it makes people feel even worse. And then, you have the other side of that where it's not just the small versions of it. It's that often we as technologists think that we can solve this with my 3 least favorite words in the English language.

Oh, no.

Can't you just? Can't you just install EDR on every endpoint? Point in this SMB and monitor and then create the audit trail that way? Can't you just do monitoring? Can't you just install, watch EDP, get a firewall? These are not organizations that have firewalls. They don't have a corpnet. They've got 15 guys in trucks who are using their personal Android devices that are all out of date, and you can't force them to update it. You can't even force MDM on these devices. You can't solve a human problem in information security using technology.

Yeah, no, it's a great point. You're exactly right. These are not technologists. You got guys out there that are doing their— or, you know, guys and women, obviously, people out there doing their jobs, getting things done. And this isn't what they live. They don't live tech. They aren't buying the new smartphone when it comes out. They've got, you know, whatever 4 iPhones ago was at this point, right? And it's got a cracked screen and they use it because they have to because, you know, phones are required. Requirement, but they're not updating things. They don't understand them. And they don't have to. And this is not an insult to say they don't understand. I mean, some people are brilliant. I'm sure there's truck drivers who know tech better than I do. I'm not saying everybody, but in general, like you said, these are people, they have really strong skills in what they do. And the rest of this is just in the way. They just want to go do their thing, right? I want to get my, my truck where it needs to go. I want to deliver what's going where it's going, or I want to, whatever it is, I want to sell the thing I'm selling. I want to move product. I want to move services. That this is all on the side for them. Like you said, they outsource it to other people. I got accountants for that. I got an IT guy for that, but there's no money for them. So what's the next step? Are we going to see, you know, managed service providers are going to have to raise their cost, you know, so they're going to raise their rate because they're going to have to invest in more tech. So they raise their rate and then they pass that back on, which means the small businesses pick up harder, you know, harder charges for, you know, account— all the services they need, right? Accounting and whatnot, payroll, et cetera. And that then gets passed off to the customer. So we're going to see a raise in prices. I mean, are we looking at a systemic challenge that could go all the way there as opposed to the government being able to provide more support? Is that going to be the other answer?

Yes. The, the short answer to that is yes. The 30-second version of that is two things provide the teeth in that. One is cyber insurance and the other are, uh, related upstream supply chain security requirements for enterprise and DOD. So those two things are driving those cost increases for MSPs. Is cyber insurance is one of the very, the, one of the, the, the first things a small business notices when it comes to their inability to do business because they don't have cybersecurity. They don't have controls, they don't have compliance. So I have never in the now thousands of businesses I've talked to in this ever found a small business that bought cyber insurance because they felt like it, right? Not, not a single one. And what's more, none that have ever bought it because they want to actually be insured against a cybersecurity threat, ransomware, data breaches, whatever. Not one single one of them, other than me, because I'm a nerd. I have never seen it. It's always about revenue enablement, and they either have a current enterprise or revenue-based partner. They're, they're making money from someone. They've got some kind of partnership or sales agreement where the compliance requirements for that agreement are being upgraded on a year over year. And they get told you have to have cyber insurance coverage now. Or they can't get through a vendor assessment process without all of their relevant paperwork and demonstrating continuous compliance. It's never about getting protected from cyber threats. It is always about making money.

I was just saying, it's all about revenue, right? That's all revenue. None of that's going to make anybody safer. It's all about, you know, we know we're all going to get breached, so now we got to pay somebody else and it's insurance and it's a whole, it's going to, It's this giant industry that's growing, I'm sure, because insurance industries always do. And a whole new, you know, period and opportunity for revenue generation, none of which is going to reduce breaches or make anybody safer. None of it's going to cut down on any sort of consequences for the average consumer, right? You and I, for that matter, in this case, all of our data is the data that eventually is going to get owned and compromised. And instead of coming up with solutions to be proactive and to protect, the answer, it sounds like from what you're saying, is We can't fix this. Let's just buy insurance. So at least we're legal when things go bad. But now they're going to have all these, you know, new reporting requirements that they're not going to know what to do with because they're not going to have the visibility to do the reporting. And is it— I don't know. I didn't read this well enough. I should go back and look now. So the reporting requirement, if I remember correctly, you said it's like 60 days from a breach. Is it? I assume it's 30 days. Oh, 30 days. It's 30 days after discovery. So, which reminds me, there's a loophole there, right? 30 days after discovery. So if I really don't see anything, if I, if I don't understand my network or whatever it is, then, then, so it's going to be more about plausible deniability, right? Just, I'm actually, as a small business, better off to have less security, aren't I? Have no antivirus, have no ability to see this stuff, and then you can't get me because I didn't discover it.

Do I ever have bad news for you about how the IRS works when it comes to plausible deniability with your— that's what's happening right now is that the concept of cybersecurity liability is being professionalized by this. So I, I don't get plausible deniability on my taxes when it comes to whether or not I've done the right thing. I just get assessed for what they are, right? It doesn't matter if I know or don't know. I still, as a fiduciary for my business, I'm the person with the ultimate responsibility for it. And so I have to make sure that this all seems sensible. But if I looked at how I spent what, you know, our budget for the business. And I, and I said, well, as long as I throw away my credit card expenses and I don't pay attention to what's happening in our QuickBooks, you know, install and stuff like that, then I'm not liable for whether or not we've correctly written off our expenses. I think that any accountant would tell you that you're in some very serious trouble there, sweetie. And that's what's about to happen to people in, in cybersecurity with this, this compliance measure, because there's no requirement that there be knowledge of it, right? There's no requirement that somebody have an understanding of what happened, just that they have to report it. So they're— and, and demonstrating good faith, I'm sure, will matter. And I'm sure, because I've seen this process work before, I'm sure that when this regulation comes into play, that the FTC will start by going after people who are operating in bad faith, right? They'll start by going after companies that definitely should have known better, definitely had the staff to handle it, definitely were internally notified of and didn't follow the regulation when they knew about it. So they'll start there, but that's not where this ends. Right?

Well, that's a good point. I mean, we've seen some of that now already, right? I mean, with large enterprise, we've seen, you know, recently we've had a couple CISOs now that have run into some legal trouble, right? So, I mean, we're seeing the government start to try to take actions to hold people accountable, which, listen, I've been very vocal and public about that, that I think it needs to happen. I'm screaming all the time about organizations that are intentionally prioritizing, you know, bottom line over security. And so I think that matters, but I think you make a good point of where does it stop, right? Okay, so that's great for the large enterprises and, you know, CISOs that are making millions of dollars and are conveniently quietly hiding problems and know better, right? They're going to start paying some prices. And that's not many of them, by the way. I think most CISOs are really trying to do hard work, but there's enough of them out there. But where does it land? I will say, I'll challenge you a little bit. I get your point on the tax piece and you're exactly right. You can't— ignorance doesn't do you any good with the IRS. But they wrote this as saying no later than 30 days after discovery. Now, I'm no lawyer, but I pretend to be one a lot of times. If I were a lawyer, I'm absolutely going to focus on that and say, prove when we discovered it. I think ignorance in this case could be a solution. It shouldn't be, but I think based on the way this is written, it could be a solution to allow small businesses to sidestep this. It'll force the FTC to rewrite it and change the wording. But from discovery isn't the same. Like taxes, we don't get that. I, oh, I didn't realize this. It doesn't matter. They don't care. You better follow all your money. They don't, IRS doesn't hold any from discovery piece into there. Oh, I didn't know about it. Isn't going to work. But this says 30 days after discovery. So it seems to me as a small business, if I can not discover things, like if I can actually be intentionally ignorant, I may be able to duck the requirements here for a while until the FTC fixes that. So I hope that's not the solution, but If, if I were a company who didn't think I could stand up to this and was afraid of what it would do to my business, I'd certainly have a chat with my accountant and my lawyer right now and be like, what does this say to you? I'm sure some lawyers are gonna focus on that. You know how they are with the, the small pieces of words, right? 30 days after discovery is good. I would probably tell some companies to get rid of some of their cybersecurity, which sounds ridiculous, but mm-hmm. If you've got antivirus, get rid of it. If you've got endpoint, get rid— like, if you can't solve this the way you need to to keep your business running, then you're better off not to know it exists and let the breaches happen. Because you're theoretically protected then, because it says you have to discover it first before you can report it.

I think first you're correct, and I think that there's going to be a—

stop there. I like when you tell me I'm right.

Just—

we should—

I think—

go ahead.

This is in—

this is improv. I'm disagreeing with you by saying yes and—

ah, here we go. Okay, here we go.

So I—

yes, and I think there's definitely going to be a swath of businesses that do this, just as there are businesses where where levels of knowledge are carefully maintained on things like HR or spend or whatever to make sure that people don't experience too much liability. I think that in small businesses, the capacity for that kind of like the— what they call the Chinese wall in, in the legal world, what you would call that kind of gatekeeping, that specialized liability— it doesn't exist in a business of 8 people, right, like that are selling cars. And so there's, there's no way to keep that, that knowledge not only technically, but provably isolated away from a person who would have that requirement. Because if you have that ability to keep that knowledge appropriately firewalled away, you have the ability to fix the problem at that point, right? So, what I think is going to happen is that, that small businesses are more and more going to expect their MSPs to assume liability for not discovering problems or to assist them in this process. Now, now, the reason that I have a company The reason that we built the, we built Dyna, which helps MSPs do this kind of work, which is discovery in small businesses and maintaining continuous compliance for these exact problems is why I care, right? But I think what's going to happen is that managed service providers are going to experience much, much more pushback from small businesses to assume liability for both discovery and reporting. And that's going to become a professional service of MSPs that the, the, the process of doing that reporting of maintaining the records for that is going to become part of an MSP's service provision. And that's going to get more expensive because the next thing that's going to happen is the MSPs are going to want insurance to cover it. And that's hard to get. It's really hard to get. MSPs are getting harder to insure.

Yeah. And then they're going to have to hire people too. A lot of these MSPs aren't built for this either, right? If I'm an accounting firm, I'm not necessarily a cyber expert for myself. So you and I know, I mean, I've seen accounting firms and law firms and medical firms, just as, you know, 3 quick examples who've all been popped. Because they have tons of PII and they have lots of things, you know, oh yeah, lots of things you want, right? Confidential information. They're not historically great at cybersecurity in a lot of cases. So they already are outsourcing to somebody as it is. And now that's another chain that might have to go down the line further, right? So their accounting organization for the medical facility, now that accounting organization is also going to have to have a service provider that does this piece of the puzzle. So it's another chain that's got to be added. Which of course also creates more links and more opportunities for compromises, by the way, for anybody paying attention. That's more data flowing around and more opportunities to socially engineer somebody to get in another, you know, sideways entrance to get into the databases. What a mess, man.

Yeah, it is. Yeah, it genuinely is. And what you're describing, what you were describing right now is exactly what Wendy Nather talked about originally in 2011 and continues to talk about now, which is the security poverty line. We're describing— and there's 4 elements. It's not money. By itself. What does she say it is? It's, uh, money, expertise, capability, and influence. So it's, it's not just that people don't have the money to do this, is that they don't have the capacity, the relevant resources allocated to them, the influence to get those resources allocated to them. So we're watching right now a creation of haves and have-nots in information security.

And that's an interesting point. Like, I hadn't even thought about it until you said that, right? I mean, the the poverty line of cybersecurity. I mean, that's, that's pretty powerful and you're right. And that's exactly what this is going to turn into. I mean, you can see it laying out, right? You have to have a lot of money for security. We know that it continues to grow. And yet we have companies who have enough money who won't spend it because they're determined to get that extra 1 or 2% on their bottom line and, and, you know, risk be damned, somebody else will pay the price for it later. And the other side, you're saying, you know, here we are, the small businesses, the small, medium-sized businesses are going to get crunched. And it's going to be layers and layers of cost and risk that they're going to have to take on. And then we're going to wait and see how the enforcement works. And, you know, using the IRS as the example of, you said, I could feel this going that path too. Listen, how many audits do billionaires get versus how many audits do working class get? Right. We run into this all the time. I don't want to turn this into this huge political discussion for anybody who's paying attention, but, you know, we run into that all the time, right? It seems like the, there's a point when you get over a hump on wealth where consequences just seem to dramatically drop because you've got the resources to avoid the consequences. You have, you have all the things you talk about, the money and the talent, everything you need. And somehow it just, you get over whatever that number is, whatever that hump is, and everything seems to get easier. And for everybody else left behind, we're carrying the weight of all of the rules and all the regulations that you do have to follow because the IRS doesn't give a damn if I say I didn't understand. Well, that's great. You know, we'll take your house and your car and you can understand now. And it could be the same with this, I guess. You know, I don't know. You're more well-versed on this than I am, clearly. Have you seen anything yet discussing what the enforcement will look like for this or what the penalties or punishments will look like for organizations that fail to report within 30 days? Have they released anything like that yet?

I haven't seen anything that describes that, but I have to say that at least part of this process, the process is the punishment. I think, just as you would describe it for, for people when we're looking at, like, you know, what is it, carceral justice? The process is the punishment. For a small business to be faced with an FTC, uh, civil suit— can you imagine being sued by the FTC? And this is done in batches, right? A small business facing something like this, it doesn't matter if they can defend themselves, they're done. Yeah, they're done. It's not— and it's— we use small businesses as this collective fiction to describe an economic activity that's agreed upon by, you know, 10, 15, 100 people where we all get together, we make something, we think it's pretty cool, and we provide an economic benefit for society, and then we all, you know, get W-2s and healthcare. So the problem we have here is not just that small businesses are faced with this, or that MSPs are going to have to charge more and face more liability. The real problem we're having is what you just described, which is that a lot of people are going to think that if discovery is the key term there, that the best thing that they can do is not have— is not discover it. Which means, who are actually getting impacted by this? This is the bottom half of the bottom half of small businesses who are serving people in rural communities who are less technical, who have less opportunities available to them, who have less choice available to them. These are the people who are always going to get the total fucking shaft. They're going to get it from every direction on this one because they're the ones whose information is going to get stolen. Identity theft plus anything else that happens to a person who's already on an existence line that just the subsistence line for economics in this country, that puts anybody over the edge. So that's the real challenge we're looking at is individual human stories of injustice that come from this. And let's not forget that the people whose fault this is are the ones who are committing the crimes, who are harvesting money from small businesses and managed service providers. You know, North Korea collects what, a couple billion dollars a year just farming?, ransomware from just certain segments of American small businesses every year, per the UN. So, you know, small businesses in the US might do farming, but they're also being farmed, and that's where the crime originates. There's got to be better protections for it, and we have to stop penalizing the people who are victims of crime as opposed to the ones who are actually creating it.

Oh, and you make an excellent point, you know, when you talk about who's really going to suffer for this, right? You said, you know, the less technical— like I said, the girl. And you talk about when it comes down to identity theft is a great example, as you said. Listen, identity theft is, can be devastating. And you know, you or I, you know, please, right, anybody out there listening, please don't try to steal my identity. I don't have time or energy for it right now. But yeah, we probably have the resources and, and, and knowledge and, you know, friends, and we could probably recover from it. It's, I've seen it firsthand and it's devastating for people who are middle class, upper middle class, who have resources, money, education, and time. If you don't have any of those things, if you're just, as you said, on the subsistence line, you're just getting by, and one day you wake up and your bank account's empty, you know, you're listed as dead on a database, whatever it might be, you're done. Like, the recovery for that is incredibly difficult, and you don't know where to start because it's completely, you know, alien to you, right? This is not something you've grown up with, you've lived with, you don't even know who to ask. If tomorrow my shit all went south, I call you. Or I'd call, you know, people like I'd call somebody, right? I know a few people, at least if nothing else, I would know somebody I could cry to who would at least understand what I'm crying about. Right. So that's an advantage, but you're right. The people that are going to pay the most for this are going to be the ones who are least equipped to solve for it. And it's just going to be bad. I mean, this, this is, again, this is why I wanted to talk about this when you, when you showed it to me. I'm not going to lie, when you first start talking regulations, like, oh my God, I don't know if this is going to be as exciting a show as I had hoped for. But as soon as you start digging, I was like, holy shit, Terra makes everything exciting. Like, this is really interesting and scary shit, right? And I don't have a good answer. So, you know, the question, and I don't know, you tipped on this a little bit as we were talking, but I mean, the last question we had in the setup here was, you know, what do you see as the way forward for these businesses? Like, what are the positive solutions? I've already talked about, hey, just shut all your shit off and don't know anything. Be ignorant. And you're safe, which probably isn't true, you know, but it might be a place to start. But, you know, and we talked a little bit about maybe MS-ISAC, maybe I'll do some follow-ups for that. Maybe if MS-ISAC's listening and wants to talk about this, maybe there's a place there. Small Business Administration doesn't need to be doing much with this. If you guys want to come yell at me, feel free to. I'd love to talk with you guys too. But what do you see as some positive things? Like, what can people do? What is the way forward for these businesses now? Just solve the problem, Tara.

I'm just gonna— Okay, I'm gonna set aside the fact that this is what I do every day for a living, and instead just step over into a couple of things that need to happen kind of on a societal level. And obviously anybody who wants to know more about this, please come talk to me. I will enthusiastically talk your ear off about it all day long. But here's one of the things I need. I need to see people in the information— I'm gonna turn this back on us— people in the information security community, need to hear and really deeply understand love and anger. I am nail-chewingly angry over this, which is enough to get me up in the morning and get my first 2 cups of coffee. But just like, you know, just like Captain Tight Pants says, it's love that keeps her in the air, right? You have to love the institutions, the rural small businesses, the people that make up the economic activity of this country. You have to have that love in you. And without that love, if there's the, if there's a hint of contempt or stupid user tricks and peb cac shit, you know, when we, we make fun of users all the time, right?

Of course.

Are we like, I, I try to never do that. In fact, it's one of the filtering things I use for hiring for my company is I hear a whiff of that, no hire. Because you have to have this love for people that don't do the same shit you do every day. You have to love people that have spent 40 years in accounting. And say, "I treasure the fact that we live in this society with you and that you are doing what you're doing, 'cause I don't wanna do that for a living. I wanna do what I do." Without that love and with contempt, people try to create technical problems to automate away a solution that is a human one. So that's the security industry's issue and community's issue. On a governmental level, I am appalled at the budgeting for the Small Business Administration, which is often the API for many of these small businesses to go to, to understand what they should be doing for best practice, practices for small firms in this country. They had accounting standards, they have best practices for ethics, for retail standards. How is cybersecurity just, just an afterthought? How is that half a whipped cream side from Starbucks per business? So I want to see some regulatory understanding of this. Third, I love the work that CISA is doing in a non-regulatory advisory way to get local representatives in, into spaces where they can be the, the first point of contact for reporting of problems. That's wonderful. They're under-budgeted. They need a little bit more of that. They are— they're a wonderful prosthesis for the Small Business Administration to use if they began sharing data. You know, if I'm just redesigning the government here, just give me a second, I'll be right back. I've gotta— I've got a spreadsheet for this. I'm just redesigning this, this whole situation. I want to see governmental understanding of that. And I think the last part of this, uh, really goes to, I think, It does have to land with the people that are doing managed service provisions, providing managed services to small businesses, IT people that do this. It is the responsibility of managed service providers to communicate well and clearly the consequences of some of these regulations, just as I would consider it to be my accountant's responsibility to communicate to me if there was going to be a major change in the way that I do the finances for my company. Ultimately, I'm in charge. It is my responsibility to put my name on something and say, you know, under penalty of perjury, I believe this to be true. And that same choice is coming up for every small business owner in this country when it comes to whether or not they know about whether or not they've had cybersecurity issues and data breaches of their PII and their customers. And I don't want to sign on the bottom of that document unless I know the truth. And I don't think most small business owners would either. So I think it's, it is the responsibility of MSPs to communicate well and clearly what those consequences are for people that, that need to know that and that have that ultimate responsibility.

I think that's great. I think all that would be helpful. I love the call out to CISA, by the way. And I think you're right. I think there's, there's some opportunities there. I'm a big fan of CISA. I know they've taken some shots over the last few months for a lot of different things and—

yeah, sure.

Politics, whatever. Listen, it's a hard job. And anytime you do anything that's a hard job, people are going to not all agree on how it should be done. But I think that's a great call out. And I do like a lot of things they're doing. And maybe there's an opportunity here for them to do more local outreach, right? I'm curious. It's not part of the questions, but I mean, I wonder, so there's 5 months until this ends up being a real thing, right? So it's going to go in spring. What are we talking like April-ish timeframe, I guess? I wonder, oh, hey, now we're getting places. What's the cat's name?

It's Frankie Sings. He decided he wanted to come over. He's just gonna, he's gonna flop over. Just, all right, buddy.

That is my kind of, that's, that's what the show's about. Listen, my dog Riley's not in the room today. She's out in the other room. So she won't come up, but I love when there's animals on the show. It's the best part. So, I mean, I think it's interesting. I hope there's enough time. Like, I don't know if there's enough time for people to just, because it's 5 months away, but also the holidays are going to be in there. That's going to take a month off for everybody essentially. So now you're down to 4 months away. And again, the ignorance, a lot of organizations probably don't even know this exists because like you said, it's not it's not something that's being pushed. You know, if, if you're an accountant, you follow everything the IRS puts out. Of course you do. Who's following the FTC on this? You know, cybersecurity, as you said, is, it's too much of an afterthought, which is hard to believe. Everything we do is cyber at this point. We're all connected all the time, like it or not. And yet this isn't on the front of everybody's mind all the time. So it's, it's really, it's really an interesting topic. Like we could probably keep going on about this, quite frankly, which again, surprises me because I didn't expect it to be as interesting. Now I'm going to want to follow up on this more. And see where this goes. I think people should be paying attention to what the FTC has put out here. If you are a small business or you work with small businesses, obviously, or you're doing these, you know, provisions you're talking about for services, this is something that affects a whole lot of us. And for vendors, cybersecurity vendors, we're all trying to figure out how we're going to help the small and mid-market. This is going to be another area. We got a chance to look and see how we can help them. And, you know, service providers like yourself, Tara, you know, with, you know, with your organization, obviously having a chance to do it with Red Queen, you know, it's, it's there's always opportunity. I hate to look at it that way. I'm not really big on the business side usually, but there's opportunity here. People have needs. I really think the part that I want to emphasize that you hit though was that whole love for your fellow person, right? That I think phila is the brotherly love. I think that's a key point, right? Is I think you're exactly right. To be successful, we have to actually care about other people. You know, and I think I've grown increasingly jaded and frustrated. Especially in our industry, frankly, when I see so many people in positions where they're putting, in my opinion at least, the wrong things forward as their priorities. I, I think, I think greed's getting a little outta control if you want my honest answer. And I think it's a challenge and this is gonna require somebody to go against that because to help your fellow person is gonna require not necessarily making all the money you can make to do it. You know, I like that lawyers are required to do so much pro bono a year. I wish we had some of that maybe in some other industries. Maybe cyber could use some requirement to do that. We're going to need to help these folks somehow. And it's going to hit all of us. You know, like you said, you know, in terms of certainly the lower economic areas of the country, but it's going to hit all of us eventually. All of our data flows through all these companies at some point. That's just all interconnected. And so this is a universal problem, right? And I think it's, I hope we figure out a way to solve it. So I really appreciate you bringing it up. It's something I hadn't talked about before. I hadn't even thought about before. And now I'll of course, probably go down the rabbit hole for days on this FTC piece and see what I can learn more about. And maybe I'll see if I can get Jen Easterway to come on the show and talk about how CISA is going to get involved in this. It's a stretch, but if anybody knows Jen, feel free to give her my number. So listen, we're running out of time here. I do want to close up, but as everybody knows, we end the show with the same question for every guest. You know, it's, it's, we're not going to have a real tearjerker moment in here. I don't try to pull too much out of you personally, but I do always ask, you know, the show's named Unspoken Security. So, you know, with that in mind, tell me something you never told anyone, something that's unspoken.

So I was, I was thinking about this, and let me be fair to everybody here, like, I got warned that this question was coming, right? And I was sitting there thinking and just thinking about something that I've never said to anybody that I would be okay with saying on, on this broadcast. And I was sitting there, I, I'm married to a, a lovely physical security specialist. His name is, um, Deviant Oliff. And I was hollering at him just before this podcast got started. I was like, babe, can I, can I have a cup of tea? And I was thinking about this and thinking like, what, what have I not told him? What have I not told people that I would be okay saying here? And I was like, I can't think of anything. I was just, and I thought to myself, God, this is like a security question, right? Like what's the thing that only you can think about that you're going to come up at the right time, you know, and you get the banking flow to like regain access to your account. And I was just thinking to myself about how. People often use their security questions as this, in this super emotional way that I actually really hadn't thought about until I'd grown more familiar with this over the last few years. People will use security questions to memorialize dead pets. Talk about, they'll add like their life bucket list, life goals. They'll track things that way and they'll have like a key in their head. Like, you know, it's a hash where they like one question goes in, but the answer that is a different question pops out at the end because they've mapped this in their heads. And I just thought how incredible that is. And I was like, okay, well, what's not a security question for me but could have been? And here's the thing, I, I read American Gods, I don't know how long ago at this point, but I always wanted to go to the House on the Rock, and it's a place I never got a chance— I've never got a chance to go to. And it is gloriously kitsch in this kind of Milan Kundera sort of, sort of way. And at the same time, what a beautiful expression of the oddities that can all sort of collect in a center of gravity in, in the United States in one place that is just this consuming experience. And I just, I wanted to do that. And that's not a security question I can think of that I've ever answered in that way. But it's something that people, I think, often do. It's something to remember as information security professionals, that people will use security questions in that way. But I always wanted to do that. Like, I want to go on a— I want to fucking retire, AJ. I'm done. I'm— I'm done.

Me too.

I also— yeah, I want to get in— I want to get it. I don't want to do van life because that's not enough space for me. I want to, you know, I want to like RV. Either an RV or it's a motorcycle and a backpack. And I wanted to like see the biggest ball of twine and the House on the Rock and roadside attractions. And I want to do the trout derby in Eastern Washington. I, I don't know. I just, that's, that's what I want to do. And I don't think I really, I certainly haven't expressed that enough lately that, you know, I guess there's this, there's this thing of joy that I haven't gotten a chance to do yet. I want to do that. Maybe I'll just make time to do that this next year. Have me come and talk at a con in Missouri or something, please.

Listen, come on up. House on the Rock isn't all that far from me. Like I'm in It's in Wisconsin, for those who don't know.

Or is it? Yeah, Wisconsin.

It's like, it's in Wisconsin, right? It's in Spring Green. And I didn't know that off the back of my hand, by the way. I just Googled. I'm over here Googling on the side. I'm cheating. I knew it was Wisconsin. I know where, but it's really interesting for those who don't know House on the Rock. I highly recommend Googling it. It's a really interesting place. You're not the first person in the last 6 months even to tell me, hey, we should go. Well, in this case, they said we, you haven't invited me, but you know, we should go to the House on the Rock. So, Yeah, I've got a couple relatives and friends who've said the same thing. So it's actually on my list probably for 2024, just because several people around me want to go do this thing. So, but I think that's cool, right? I think, I think it's also interesting. You're the first person so far who has really put as much thought into, well, hold on now, this is how security questions could answer it. Like you're such a professional, like you, you just immediately went to that. It makes so much sense, right? So many people just threw out an answer and you're like, well, hold on a second now. I don't want, he could be social engineering me and I don't want to get What answer could I not give? And I, which I think is brilliant. Like frankly, the GED thing could have been the answer to this. You just gave it away too early and you were stuck giving me something else now. But I think that's awesome. And I think, I think wanting to make more time to do things like this is a big deal. You know, I often, it seems like I end up having a reciprocal answer to this every time. So people are gonna know everything about me, but as it turns out, I just scheduled a vacation into January, into February. I'm taking a real vacation, like 10 days, 11 days. I haven't taken one in— it'll be about 16 years. So when you talk about making time to do these things, listen, the time goes really fast. You know better than anybody, I'm sure. Make the time. You want to come to the House on the Rock? Let me know. Like, I'll check and see exactly how far away from my house it is. Like, I'm going to—

it's a great idea.

It looks like it's about 4 hours from me. So not bad. Oh yeah, it's just, it's just west of Madison, basically. So I think my nephew is going to go to Madison next year for college. So anyway, Yeah, we'll do it. We'll do it.

I'll bring Deviant along and we'll just like— the problem of course with bringing Deviant anywhere is that he's like, oh, a lot— oh, a space I'm not supposed to be in. And then he's all of a sudden waving at you from the other side of it. So we'll take him along because that's half the entertainment right there.

I think that'll be fun. That's good. Cops— if the cops get involved, we can get them out. It's all right. So I'm not real worried. I think that's awesome though. So we're going to wrap up here. Is there any last thoughts you want to leave people with? I mean, we've done a lot. If you're good, you're good. But I'm curious if you want to plug, you know, Red Queen real quick, you're certainly welcome to, or anything you want to leave people with before we wrap up for the day.

Look, I, I always want to, I always want to help. If you're a managed service provider, you know, we, we help you do this. And I wouldn't dedicate my time, economic capacity, and brainpower to this if I didn't care about it this deeply. Like, this is the thing I do, and I want to express that love and understanding. People don't get listened to. That are frustrated and afraid of these, of these kinds of problems and want to find ways to make it better. So, I'm here to listen. I'm always around. I'm not on Twitter anymore or whatever the hell it is now because, eugh. But come find me on Mastodon. I think I'm Tara@infosecexchange. Love to talk to you. Tara@redqueendynamics.com. And we're just at redqueendynamics.com. Come talk to me. And I'm more than happy to chat and we'll get you set up. Absolutely.

That's awesome. Yeah. And, and Tara genuinely is one of the nicest, smartest people in the industry, like, that I'm, I'm aware of, frankly. I'm truly flattered you took the time to even come on the show. So I, I, I couldn't, couldn't be more appreciative. So, and, and for everybody listening, you know, thank you for taking the time to listen to us today. You know, if you, if you like what you're hearing, you know, please subscribe and, and rate and all the things you're supposed to do, right? If you don't like it, give me feedback. Actually, if you like, give me feedback. If you don't, well, give me feedback anyway. But I wanna know, right? The, the show isn't about me. The show is about the guests. It's about, it's about who's listening. You know, the idea is to really be informative and, you know, and also entertaining and all the things that make people get a little bit better and have a good time. So, you know, please do give that follow-on, do give that feedback to us. Really appreciate you taking the time. Tara, again, thank you for being on. You're obviously welcome back anytime. The next thing you're passionate, excited about, even if it sounds boring, I'm clearly going to listen because this turned out to be amazing. So, you know, as I would expect. So, you know, with all that said, thanks again, everybody. This is going to be the wrap-up for this episode of Unspoken Security. All right, until next time, I'm AJ Nash, and thanks again, Tara Wheeler, for joining us. We'll talk again soon.

Cheers.

Thanks. It's a pleasure.

Cheers. That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.