163. Cyber Safety Made Simple With Cam Rule

Welcome everyone to another episode of Professional Builders Secrets. In this episode, I interview Cam Rule from Downtime Assassin. Cam is on a mission to help builders protect themselves against the growing risk of cyber attacks. Now, with more builders becoming targets with because they've got outdated systems and are not fully digitized, Cam's expertise is absolutely essential for making sure that you look after your business and all of your data. He shares some really interesting tips and advice on how you can protect your construction business against potential downtime, which is costly and irreversible damage, by putting some simple and really easy to apply cybersecurity foundations in place. So keep listening to learn how you can safeguard your building company. It was a great episode. This episode of Professional Builder Secrets is brought to you by Apparatus Contractor Services. Apparatus provides full scope end to end QuickBooks, Precision Construction accounting and CFO services for residential builders. If you feel like you can't completely trust your weekly and monthly financial reports or you feel like you're flying blind, Apparatus Root will rebuild and operate your QuickBooks accounting system and give you precision construction accounting capability you can trust. Learn more@apparatusteam.com or or on the APB Rewards Partner Directory.

And this is an interesting thing about technology. You can have all the technology in the world, but it's all about the people in the end and how they handle it. The current trend is increased ransomware and phishing scams. Unfortunately, they're not going away, they're just increasing. A lot of that is because of the use of AI in the cybercriminals are using that to automate these tasks. They're not doing a lot of the manpower anymore. Insider threats will increase so staff members that are disgruntled or paid by cybercriminals can get in there and do some damage. So this could happen to some of the platforms builders use.

Welcome to Professional Builder Secrets, the podcast for building company owners wanting to grow safely and securely. I'm your host, Will Blunt and today I'm joined by Cam Rule. Cam, welcome to the show.

Thanks very much for having me, Will.

Now, before we dive into all the details of today's show, can you just give the listeners out there a little bit of a background on who you are and what your business does?

Sure. I am the downtime assassin, so I hate seeing great construction businesses lose time and money because they are not using the right technology in their business. I've been in business for 12 years now in the IT space, have a great team around me and we primarily look after builders with their it with their security and get in there and make sure they are as efficient, as efficient as possible.

Sounds good. You've got that elevator pitch nailed down.

Very good.

I do love the name downtime Assassin. I think it has good undertones.

Thank you.

So what are some of the unique risks that builders face when it does come to cyber attacks?

It is a very unique industry because it's the least digitized industry in the world. Builders have been playing catch up with technology for quite some time. So they become a bigger target for two reasons. The first is because there's a race to catch up with the latest technology out there. Often security gaps are left there and not plugged as they go because there's such a rush. So cybercriminals take advantage of that. And also there are a lot of builders out there that just don't have much security technology in place anyway because they're behind the curve. So they become an easier target naturally because of that way. Some of the unique ones and ones I've seen a lot with builders, I'll give you one example is phishing scams is quite a big one. So phishing is where the cyber criminals out there will use social engineering to try and grab some details from you, like bank details or something like that, where they can use that information to steal money. A good example is Builder joined us a couple of years ago. Before he joined us, he told me that his email got hacked. Fake invoices were being sent out from his account. He didn't even know until one of his contacts gave him a call in a bit of a panic and said they were going to pay him about 30 grand, but wanted to check over the phone first because it just looked. Just seemed a bit weird. They weren't sure about a couple of line items. The invoice looked really good. He showed me it. The only thing that was different was the BSB or the account number. The bank account number had changed. So if they paid it, obviously they would have thought they'd paid my client, but it would have gone to a fraudulent account, straight to the cybercriminal. So it turned out for that one, his email password was cracked. He didn't have a great password. The cybercriminal got into his email, logged into it, stayed in there for a while, learning about who he invoiced and the typical amounts he would invoice out, then actually copied one of the invoices, modified it and then used his account to start sending them out. Quite a few went out and there was a really like the lesson Here is there was a really simple thing to do to stop that happening that he wasn't aware of, but he was so far behind the curve with the tech that he didn't really know about it. So we just called, we turned on something called mfa, that's multifactor authentication. And your listeners probably would be familiar. It's like when you log onto a bank or some of the other things that are, have money in it or important, you have to pop a code in as well as your password. That's multi factor authentication. It's pretty much impossible to hack. So we turn that on. If that was on in the first place, this sort of stuff wouldn't happen. A bit of a close call. A very quick and simple thing that's there. The other one that I see a lot with builders is ransomware. Ransomware is where a virus comes in, usually through email, and it locks all your files. You can't access anything. The cybercriminal will ask for a ransom to unlock it all, usually in the form of Bitcoin in that instance, I think the stat in Australia anyways, in the last year, 50% of businesses got hit by ransomware and I believe the construction space is a little bit higher than that. So yeah, those two things are the biggest unique issues that happen. Yeah.

So what should I be doing to avoid those ransomware attacks? Is that just not clicking on certain things in the emails and stuff like that?

Yeah, it's a good question there. So for ransomware in particular, there's a few safeguards that can be put into place. They're quite simple. Obviously I would speak to an IT professional before implementing these things. But the very first One is because 70% of ransomware viruses come in through email. You can put in these email security safeguards in place. You pay a few dollars per mailbox to get this filter put in. Basically, IT quarantines those really dodgy emails that could be ransomware, so you can't click on them accidentally. The other thing is having a really, really good backup system. One that's preferably monitored, but one that's, that, you know, is, is working, that's being checked, is automated, that's backing up regularly. So not like every week, but, you know, every hour. So if you do get hit by ransomware, you will be able to overwrite all that data with the good stuff that you have on the backup and you can just get on with your day and you can just tell the cyber criminal to go away because they won't be able to do anything after that those two things are the most important. Of course there's other more technical things that you can do if you talk to your IT person but things like edr, which is like an antivirus on steroids that should block ransomware if it sees it on the network and a couple of other things you can do as well. But those two ones, making sure that you have have email security and a good backup system are the most important.

Going back to the multi factor authentication and the email getting hacked. Is there any particular email provider you recommend is like having the best security protocols?

Most people use Microsoft 365 and they're what they call Exchange Online. I would say that's probably best one only because the email security products that are out there work best with that one. So you can bolt them on easy Google and Gmail, you know they're very good. They have their own built in sort of security. Not as good as these third party ones I'm talking about but it has some level of security there and they're a very big company and they place a lot of importance on that. So you've got the two big ones, Google, Microsoft, I put Microsoft at the top then followed by Google. There's quite a few other ones out there. I'll try and avoid the email systems that you get with the domain providers like GoDaddy, Crazy Domains, all those sort of ones. Sorry if anyone out there works for those companies but the reason is they're very hard to manage for. Like if you grow and then you want your IT personal team to start working on those ones to implement security and all that sort of stuff. It's an absolute nightmare. It's all locked down and you can't get into it. And I don't believe their technology is up to scratch as well. So usually I'd stick with Microsoft at the top there just mainly because the security products can bolt in really easily to them.

It's funny that story you told. Well not funny actually it's quite scary. But that story you told about the invoice scam logging into the email and sending the invoices out, that's not the first time I've heard that about a build up getting done with that scam. So it's obviously one that is quite prevalent.

Yeah, yeah.

And it's scary to think that that could be happening in the background. You don't know about it. So the builder I spoke about that had something had heard about something happening as well. They were talking about implementing other processes. So all invoices need to be confirmed over the phone or something like that. Do you feel like that would be a necessary measure to take as well?

Absolutely. So I can actually give an example of what happened to me one time in my business. So we had a office administrator a few years ago, not with us anymore, but we have an email security product which blocks those emails in particular as well, those dodgy emails that are phishing attempts. What happened here? And this is an interesting thing about technology. You can have all the technology in the world, but it's all about the people in the end and how they handle it. So she came into my office and said, just wanted to check whether or not you wanted to get me to pay that 15 grand to so and so particular supplier for some computers. And I said, what are you talking about? And she goes, oh, there was an email that was quarantined by the email security product, but I released it. So you can press a button to release it to your inbox because it looked, it looked legit and I just thought I'd release it. But of course she checked because we have checks and balances in place. I would have had to sign off on that. But it just shows that even with tech in place that you do have to have these processes in place. Someone needs to sign off with these big purchases. You need to have policies in place, obviously business, to make sure that if money's going out the door and big, big amounts in particular, that someone high up is signing off and is aware of those sort of things. I've seen, I've actually seen it where businesses have got hit and it's just gone through and tricked everyone. There was no checks and balances in place and the CEO only knew about it after the. I think for that instance, it was like $50,000 went out the door. Someone near the top needs to know about it and sign off.

Yeah, that makes sense. I'm interested to get your thoughts on the paper based versus digital system of storage because you mentioned that the building industry is probably a bit far behind in terms of digitizing. But if a builder said to you, well, I won't get attacked digitally if I've got everything in paper. I guess there's a balancing act, right, between having solid storage for your files and backups and all that kind of stuff versus, you know, offsetting the cyber attacks.

That's an interesting argument. Look, if you got everything on pen and paper, you are totally safe. But of course you're going to be massively inefficient and your competitors will smash you. You've got to compromise somewhere. And what I'm trying to convey as well is there are very simple things builders can do and put in place that can mitigate the risk very significantly. So you can get on with digitizing your business and put in certain things in place that are quick, easy and will protect you for. For a long time.

You've also got a single source of failure if you've got everything physically in an office.

So you do and if it burns down and you know, sort of. So there are their own set of risks trying to find things too. That's all. Paper based is a bit of an issue anyway.

We don't need to talk too much about paper based on this chat now.

It's quite common though. Yeah. A lot of clients of mine came from paper based backgrounds and we help them digitize.

We were chatting about this in our pre interview, the CrowdStrike outage. Now if you could just go into a bit more about that. What that was, I know from my perspective, I noticed that when I went to my local supermarket and couldn't purchase any that day when it was down because it was so widespread. But what was the CrowdStrike outage all about and what are the implications on that for the future for builders?

Yeah. So the CrowdStrike added, just to break it down a bit, it was due to this security software they use called Falcon. And this type of software is called edr. Endpoint Detection and Response. I think all your listeners will know what antivirus is. It's those sort of the software you put on your computers to block the viruses if they come in. So this is like antivirus on steroids. It's constantly on the lookout for nasties and more so the behavior of things that are running on your computer and it'll just shut it down. So what happened with this one is Falcon's really intertwined into the operating system of the computers and servers that it's on. So they released an update and they didn't really check the update too well. It didn't. Didn't seem to go through the process, the normal process of making sure it's not going to break anything. They released it and it just broke the actual operating systems of the computers and servers that this sat on. So a lot of the computers had this thing in the IT world we call the blue screen of death. So that people just looking at a blue screen with an error code and not knowing what the hell to do. So this affected a lot of huge enterprises. Zero for instance I noticed that day it was down airports, big government organizations and things like that. It's not common. That particular product is not common with small to medium enterprises. Really. You find that one more so with the bigger ones, other products that we use for the smaller businesses that do the same thing. So yeah, that was essentially what it was. It was a bit of a wake up call, I think, to the world that tech can go really, really wrong because it's so intertwined into everything we do.

Yeah, it was quite amazing that. And scary in a way that there was just obviously one mistake made by someone in this company that no one even knew about. Like the average person had no idea what this company was or how it was being used and all of a sudden everything, you know, a lot of things were shut down.

Yeah, crazy. That's not the first isolated incident we had the Optus outage 23. I forget the actual cause of that, but it's just, I think it's down to human error as well. Anyone with Optus would be nodding their heads in that one around the world. Yeah, Optus is like one of the biggest mobile carriers in Australia and they went down for quite some time there and yeah, it caused a lot of havoc across Australia.

They also had that large scale data leak as well. But we don't need to get into.

A. Yeah, yeah, I'm actually not.

Yeah, haven't had a good few years. Optus. Anyway, no, let's get back to the topic at hand. Cyber attacks. What can small construction companies do proactively to protect themselves?

Yep. So first and foremost, as I've mentioned before, make sure there is a backup in place. That is really your last line of defense if you do get hit. So you can overwrite things that have been compromised. There's various types, so just to be broad, just make sure your backup is going off site. Now that can be automatically happening anyway. If you're using products like Dropbox, SharePoint, OneDrive, Google Drive, you are saving your files essentially off site in the cloud. So that's a good thing. Say you lost your laptop or it got smashed or stolen or your office burnt down. You can just go get another laptop and log into your files in the cloud. So that's, that's a good thing. So you can consider that an offsite backup, but make sure that's getting backed up as well. Because things can happen to your files that are in the cloud. There's various products that can do that. Make sure the backups are frequent rather than, you know, one day rather than one week, two weeks, and things like that you do not want to store. Your files are a week or longer older. It's not a good, not a good thing. Make sure it's automated so you're not actually manually doing anything that someone is checking them. If someone is technically literate in your business, get them to check it because backups do fail quite a bit. Believe it or not, they are a piece of software that have bugs and if you don't check them and fix it up one day when you need it, you'll find that it hasn't been working for several months. Other things that are very important these days is setting up Multi Factor authentication, which I mentioned before, not only for email, but any other particular products that are important and have confidential data on Set it up for those. Make sure your computers are updated so if you have Apple or Microsoft computers, they all send updates to your computers. Make sure it's all turned on because those updates actually contain patches or security updates. So hackers outside will find it harder to get into your computer. Also some performance updates there. Make sure you have some form of antivirus. Windows has one built in called Defender. It's pretty good. You can get other ones, third party ones. I recommend it for your Macs as well. The Mac users out there, they do get viruses. It's a myth. They don't. So make sure you've got antivirus on those. And if you can get email security, as I mentioned before, that's a big one. All these things I must mention are in something called Essentials 8. That's an Australian government initiative. The eight things you can do to protect your business in terms of cyber security. I know other governments around the world have something similar, but you can always search online for essentials 8. So if you can invest in cyber awareness training, it's very cost effective these days. It was sort of exclusive to training companies and cyber companies and things like that. But now it's quite automated so you could pay a few dollars per license per person and away they go. And they're going to learn a lot about what to look out for all the dodgy things. Read a stat the other day that 88% of cyber breaches were from human error. So it really is a huge thing we need to address. And a lot of these products are bundled with other things. One of them that we have as well as the cyber awareness training is bundled with this thing called Dark Web Scan. So the Dark Web is like where all the bad people go on the Internet. It's a private Internet. Think of it that way. It's kind of like invite only. It's where all the nasty things are done. But on there there's like usernames and emails and passwords released and up for sale so that people can use them to try and hack into your account, things like that. So this, this dark web scan is really great. A good example is one of our clients signed up for one of these a few weeks ago. He did a dark web scan straight away and the director's details came up. He was really shocked about it. It turns out his details were harvested when canva got hacked a little while ago. It was a really bad one. Almost all the accounts got hacked harvested from that hack. So he's a type of bloke that uses 1Password for everything. So he had to reset his password across everything immediately because it was a hack waiting to happen. So it's really powerful. Only took a few seconds to turn it on and bang, there it was. So these things are quite cost effective these days. Talk to your IT professional about that sort of thing and get them in place. I do know, I've read a stat that this regular training for your staff and tools like this can reduce the breach potentials by 60% in the first year alone. So very cost effective, can protect your business very effectively.

What are your thoughts on password managers? There's obviously Google has its own one which is inbuilt into Chrome. There's LastPass, Dashlane, there's probably a number of others. Maybe Microsoft has an option as well. It feels like a single point of worry. But what are your thoughts on them?

Yeah, it's an interesting one. Look, I think anything's better than having it on your desk on a post it or in an Excel spreadsheet that's not password protected on a Word document because that stuff can be stolen so easily. Look, there's good products out there like LastPass. Although LastPass got hacked.

Yeah.

But I would imagine that after they hack they would have uplifted their security quite significantly. So even though it's, it's left a stain on them, you got to think that they'll be sort of a cut above the rest at the moment. Now the benefit of these places as well is we got so many passwords these days, I think if I looked at mine I would have over 100. So we use a product as well, similar to our last passwords. It's more geared towards the IT world and also our clients share it as well. They put their stuff in there and it's very secure because you log into it with the password that you know, but also with a code. So multi factor authentication is there as well. It's very hard to sort of hack that. And when you're in there, the benefit is you can just search for the password that you need. So I need my Internet banking password. Click, click, go to the site. It's already put it in there for you. You're not scrambling around to try and find any passwords. Very efficient. But you know, it's. The scary thing is these bigger companies that have all the passwords are naturally a massive target, aren't they? Yes, they have everyone's password, but I would still recommend using these things. Make sure you do a bit of research on where you're putting your passwords. Are they a reputable company? Do they have great security, all these sort of things that you are trusting them with, the keys to the castle, so to speak?

Yeah, I think one benefit that I like about those, those tools is they help you generate the stronger passwords as well. So you'll, you'll essentially have a different password for every, every login. Right. So it's much harder in that respect. Like to your point, someone that has the same password for everything, if they get hold of one password, they can just go and use it everywhere, whereas this is a much more laborious process.

But yeah, that's very true. And just on a side note, for those that aren't using these things, if you do want a, a password that's high security and memorable, you can use like a passphrase, which is pretty hard to crack. So you could say like dog rain path that you can remember or maybe another word there, Dog, rain path, budgie or something. One, two, exclamation mark. But if you remember that, that's, that's super hard to crack. So passphrases are a thing now. So for those that don't use the randomly generated passwords that we have in these products, just do something like that.

I think the thing that frustrates me, and this is a bit of a tangent, is pretty much all of them require some sort of special character or a number now. And I always forget that portion of the password and then I end up resetting my password. And because I'm trying to get into the app that I'm trying to get into at that time, I just pick a new password. Don't, don't store it anywhere, don't remember it, have to reset it next time I come to login.

Yeah, so inefficient, isn't it, when that Happens, that's all. These password managers are great in that sense.

Yeah, Unless you forget your password for the password manager, then you're in a bit of strife.

Well, you're in a bit of strife then, aren't you?

Anyway, let's not talk about my incompetency. You're talking primarily about files on a computer, right? I'm assuming you're talking about, you know, building contracts, standing operating procedures and internal documents and things like that. The other side of it, which I was thinking about before, is also exposure on a builder's website, for example, or their social media profiles and things like that. So it is very common from my understanding, for, for cyber criminals to attack websites and try to take control of them and then get ransoms and things like that. Is that something you've seen as well?

Yeah, I certainly have. So on the website side of things, the very first thing you need to do is make sure that the back end password, you know, if most common one is WordPress, so whatever that account is, the admin account, make sure that that is got a very strong password. Try and enable multifactor authentication as well. The other thing is updating these things called plugins. It's just basically these little bits of software that sit in the website that do different things. All those sort of things need to be updated because they might have vulnerabilities. Yeah, that's a pretty constant thing with websites. Make sure whoever manages your website is doing that. That is should be part of a maintenance plan if possible. If it's not done, these hackers can find vulnerabilities and get in various ways and do. They can use your website as a bot network. So it means that basically they're utilizing the resources from your website host or where it's like the server to send out spam emails or anything like that. You wouldn't even know about it. I've seen some really bad ones happen where there was a saw, it was like the Zionist sites of Victoria or something like that, got hacked by some, some terrorists and stuff like that and they put their bat on it, things like that. So it's very, very. It was one of the most awful ones I've seen. I got told about it and logged onto it. I thought, oh, that's not good. And that's only because I hadn't been updating their website, look like it hadn't been touched in a long time. So they can actually just overlay your homepage with something else, which is. Would be very shocking for any business owner.

Yeah, so WordPress like, to your point, is used so prolifically across the world and it's one of the most exposed because the plugins like you mentioned, if there's one plugin which isn't updated in time and can be exposed and there's a vulnerability there, then a hacker could get into your website and they can actually. I can't remember the name of it before it's happened to me before because I used to have a lot of WordPress websites. Essentially anyone that comes to the website gets redirected to another website. So it can be sending, you know, your customers, potential customers, to like these really dodgy websites that you don't want them to go to. And that experience is hard to recover from. From a builder, I imagine.

Yeah, it would be. And also they put in like Trojans, which is like a virus that you sort of says, oh well, yeah, install this thing while you're here, you've got a virus. And it's not. It's just software that actually installs virus. It's very important to make sure your website's updated and things like that. There are pretty good products out there like wix for the builders that don't have a web designer or want to engage them. You can use wix or Square Alpha I believe it is, where you can just drag around templates and set them up and they, they keep things updated in the background. You don't have to worry too much about the maintenance of it. I just pay a little bit of money, some of them are free actually, and you can have something looking pretty professional. Just got to spend a little bit of time on it. But that's, that's a good idea for the guys starting out. I certainly did it myself when I started out. I use WIX just to get on the board and then eventually when I could afford it, I got a web designer to do the website.

Yeah, there's an in between one that we actually use called webflow, which is really cool too. I mean, not to say that you can't use WordPress. WordPress is a really powerful tool too and there's a lot of, a lot of great things about it. But to your point, if you've got like a. It's kind of like having your stuff stored on Google or Microsoft OneDrive and things like that, you can trust that that company has really strict security processes in place.

Right.

So you're kind of trusting them to look after your stuff in a way by keeping their software up to date.

That's right, yeah.

So we've spoken A bit about being proactive with cyber security. What happens, though, if a builder does get attacked? How can they. What should they do next? Like, if they, if they think they've been exposed in some way?

Well, there's various ways that businesses can get hit. But let's just talk about, for instance, the phishing scam or something like that. That's a pretty common one people worry about. So say someone's called you and said, oh, hey, I think you've got some invoices going out that aren't from you. It doesn't look like you. Bank account details. Very first thing to do if you have an IT professional on board is call them immediately. They will reset your password. That's the first thing to do. So also if you can do it yourself, reset your email password. So if someone is in there, they won't be able to do it anymore. Make sure it's a strong password. Assess the damage, see, go into your mailbox and see what's actually been sent out. Get someone in the business to contact anyone that has had those ones sent out. If you don't know for sure, you need to get some communication sent out to your, your suppliers or clients, whoever it is that it may have gone out to, just to say, please ignore this, there's been a. There's been an incident. And then through that, set up more security. So obviously multifactor authentication is not already on and putting on email security as well to mitigate the risk of this sort of thing happening. Again, very basic steps there for ransomware. If, unfortunately, that did happen to you, which is very awful, but if it did, very first thing you do is talk to your IT person to overwrite all those files with your backup as soon as possible. You want to get back up and running as soon as possible while that restore is taking place. Hopefully all your backups are good to go while that's happening and it could take a few hours, make sure there is a plan in place to uplift the security. Find out where the entry was. As I said, most of the time it's email, sometimes it's websites and if that's the case, just uplift the security there. So make sure you've got email security in place, that the antivirus is spread out across the business and it's all up to date. Look into things like edr, endpoint detection response, which will actually stop the ransomware spreading most of the time. It'll detect it and will stop this happening in the first place. Yeah, they're the main things I'd look at certainly as a process, if those two most common things happen, what do.

You recommend, like in terms of making sure your team abide by all these things you're talking about? Obviously, if you know you're the sole person in a business, you can do multi factor and have security plugins and all this kind of stuff, but as your company grows, you've got so many different people coming in and out and onboarding into the team, the risk increases, right?

Yeah, it does. So vigilance is always. One of the most important things in a business is training your staff on what to look for and being careful about things. So if an email doesn't look quite right, making sure you call the sender and say, is this legit? And it goes back to that cyber awareness training I was talking about before. It's very cost effective now, so you can actually just roll it out across the company and get people doing this training. And a lot of these products cost quite fun. You know, they got a little video, make it fun and they talk about things like how to go, how to connect to a public network, what sort of security you should have in place, what sort of passwords you should be using, other things that come bundled with these products, as I said, is the dark web. Another one that I haven't mentioned yet is fishing simulation. And it's nothing to do with having a great time on the water.

A lot of builders probably love fishing as well, I'd imagine.

Out there it's more about sending out fake emails to your staff. I know it doesn't sound great, but it is a great training tool. You're not there to trick them and point fingers at them. It's. It's more about education. So these emails, the ones we use, we have about 300 templates and they, they go out on a monthly basis or weekly, depending on what the client wants. And that can be monitored. They look kind of like, they look really good, but there's little telltale signs in there. What happens is if a staff member clicks on it, it goes into a report, management will know they've clicked on it. And if, if they've actually clicked on a link and given away their credentials, then management knows about that too and it becomes a red flag if that happens. It's a great educational tool. A lot of the products too is if they do, you know, make the mistake of giving away credentials, the training actually kicks in as well. So they'll get a link to how to, how to look out for, for dodgy emails, course and all. These things have certificates and things like that. It's quite gamified, so you can make it fun. But as I said, that's a very effective thing of cyber awareness training.

Some, some great tips there, Cam. So appreciate you sharing that. You mentioned a few times around about having an IT professional in your corner, someone that can help you if something does go wrong or kind of get you set up initially as well. There's probably a number of builders out there thinking, I don't really want to bring an IT person into the team. I can't have them on flight time. What are some more practical, affordable solutions for small, small builders?

To be blunt, in this day and age, you kind of need to lean on someone that has some sort of literacy in IT because the risks are too great. Totally. When you're small or you're starting out, it's a cost that you don't really want to deal with. So what I'd recommend is follow the essentials. 8 if you can grasp it. It's a little bit technical in there. If you can't, just call an IT professional that will offer an on demand service. So pay them by the hour, just ask a few questions, get them to tidy up a few things. Install antivirus or AMF multifactor authentication. Look, just outsourcing anything that can be a tough, tough ask. I've been there. As a small business owner, outsourcing things is expensive. Eventually you have to do it as you grow and the states become bigger, I think. I mean, I wrote an article about this recently. I got asked about this too. So on demand services, a start. But yeah, as I said, once the stakes are higher and you're larger, you really do need some sort of managed service in place where your IT is monitoring and maintaining everything in the background and you're paying like a flat rate. That way you know your security is covered. I've got a good example of that. So one of our builder clients, they're on an ad hoc basis, but they're actually getting quite large. We did recommend that they go on a managed service agreement so we can monitor and maintain everything. And one day they just called us in a bit of a frenzy. They'd been hit by ransomware. They were managing their backups. They insisted on that. It was a very old school backup system. They had USB drives that they'll plug it into. They hadn't rotated them. You've got to rotate them to make sure one's off site in case the place burns down or whatever. They weren't really managing it well, at all. When the ransomware came through, it actually got into the backups as well. Ransomware could do that. So they got asked by the cyber criminals to pay about 50,000 Aussie dollars equivalent Bitcoin to give them the key to unlock all their data. They were completely down. They couldn't do anything. We came in, were able to salvage their data through other means. It took many days. We estimate the downtime would have cost them at least 50 grand anyway, in business. Had a big bill from us by the end of it and a huge amount of stress. Users are up and running. So that was good thing. But if they're on a managed service agreement where we're managing the backups, monitoring and making, checking them all the time, worst case, even if this got through, which I don't think it would have, with the products we would have had in place, and even if it did get through, they would have been up and running in a few hours rather than down for a few days. So that sort of investment, when you pay for that IT managed support, is just a drop in the ocean compared to the catastrophe that could be endured. It can be a business case killer, these sort of things. So sort of, I always say, as you get bigger and the stakes are higher, just make sure you've got a reputable company on your side and just get a managed service agreement so everything's covered and you can just get on with what you do best. You don't have to worry about the IT and security. It's, it's, it's just, you know that if something bad happens, you're going to be up and running quickly.

Yeah. It makes a lot of sense and just gives you that peace of mind rather than like. To your point, we've all had that moment where like, your stomach drops because you think something's happened and you just, you can take away all of that stress if you feel confident in your partner.

Yeah. Yeah.

All right, Cam. Well, to round things out, do you want to talk a little bit about what the future looks like? How do you see cybersecurity changing in the building industry?

Yeah. So the current trend is increased ransomware and phishing scams. Unfortunately, they're not going away, they're just increasing. A lot of that is because of the use of AI in the cybercriminals are using that to automate these tasks. They're not doing a lot of the manpower anymore, so the volume is exponentially increasing. Unfortunately, insider threats will increase, so staff members that are disgruntled or paid by Cybercriminals can get in there and do some damage. Probably third party exposure increasing and being an issue for data breach. Like for instance, Toyota got hacked through a third party that was plugged into their system. They don't control their security, obviously, this third party. So Toyota got shut down for a few days. Yeah. So this could happen to some of the platforms builders use. It's good to just sort of look into the security of these builders, their white papers, things like that, or get your IT pro to have a look at it as well. And yeah, so that's what's going to happen over the next few years actually.

That's a great point. We were talking about that before we got on air and you were talking about some of the construction software and things like that. There's so many different construction softwares now and I know a lot of the builders are trying to try different ones out, project management software and things like that to, you know, get the most effective thing for their business, but also the most cost effective thing because there's a big range in pricing. But one thing which would be really important based on what you're saying there is just to make sure that whoever you go with, especially if it's a smaller player, that they've got, you know, good security protocols in place as well.

Yeah, it's super important. The thing is they can, they don't have to tell you everything you know, but you can get a good sense of how comprehensive their security is. They do, they all have a wide paper that can get a bit technical, but if you have someone technical on your side that can sort of tell you what, if it's good or not, then definitely do that before you sign up to any of these big players.

Awesome. Kamal, thanks so much. We've had a really long chat now about cyber security. It's a really important topic though for builders to be aware of because to your point, your whole business can can rest on whether or not you're looking after your business from a security perspective. So appreciate you jumping on today and sharing all your insights.

Yeah, thanks very much, Will. I really, really enjoyed my time. Cheers.

Awesome. So for APB members out there, Downtime Assassin is a rewards partner. So check them out on the directory. Otherwise, where's the best place for other builders to go cam to find out what you're doing?

Yeah, just go into your search engine. Time Assassin in Downtime Assassin contact details are all there. I'm happy to have a 3 minute, not three 30 minute, 30 minute consult. Happy to impart my wisdom and help you along the way. We can just do it over a teams session or over the phone anywhere around the world. Just. Yeah, happy to give you a fair bit amount of time just to send you in the right direction.

Awesome. Well, really appreciate that, Ken. Yeah, thanks for coming on.

Appreciate it. Thanks Will.

Awesome. Also, a big thank you to our listeners wherever you are in the world. If you like the show today, please subscribe to Professional Builder Secrets on your platform of choice. And if you're feeling generous, leave us a review. But until next time, have a great day.