E12: Cybersecurity Best Practices with Daniel Zborovski from RestWell Technology

Foreign. This podcast is brought to you by Gensler Wealth. Normally, in this spot we included a disclaimer about investing, but this podcast is not about investing. It's about cyber security. So why am I wasting your time? Let's go. Today on the Gensler wealth podcast, we have Daniel Zborowski, the founder and principal consultant at Restwell Technology. Daniel is a cyber security expert. We talk about the current state of cyber security impacts in Canada and worldwide. We talk about how humans are the biggest issue and what you can do to protect yourself and your company from hackers and cyber security breaches. This is important. Let's go. Foreign. Welcome everyone to the Gensler Wealth Unlimited podcast. Today, a deviation, I guess, from our normal standard of talking to folks in the investment, wealth management, economics world. These are the ones that I get excited about because I think about all that other stuff all day, every day. It's nice to have something a little different. And this is a subject near and dear to my heart because I've really been personally affected by this. And this actually is cybersecurity and how people, businesses, families, et cetera, should be protecting themselves in this era of constant hacking. So really pleased to have with us today Daniel Zaborovski. He's a founder and principal consultant at RestWell Technology. I've decided on this podcast I'm not going to go through the line by line bios of everybody because they'll be in the notes. But the key for Daniel is he is a multi decade cybersecurity expert. Companies hire him, people hire him, families hire him and his firm to make sure they're protected and they're not going to get hacked or breached, et cetera, et cetera. And so the idea here is to share with the listeners what's happening in the cybersecurity area and how you protect yourself. So, so Daniel, after that long winded intro that was supposed to be short. Daniel, thanks for joining us.

Thanks for having me. Looking forward to this.

No problem. So what I thought I would do, we have this wonderful guest, but I'm going to keep speaking just for a minute, what I thought I would do. As I said, I've been personally impacted by this. I want to tell you my story of whether it's cybersecurity or hacking or whatever you want to call it. This is more identity theft, but it, I think highlights, you know, the real pain in the butt I should say that this causes. Luckily it's not a health related thing. You know, you're not going to die from this, but it really is a pain in the butt. So this was about five or six years ago. I was away on vacation with the family and I landed back at home, came home and my home answering machine. And I don't know if most listeners like me, no, no one leaves messages on your home answering machine anymore because we all use cell phones. But my home answering machine had multiple messages from a, I guess a payment processing hardware manufacturer, hardware reseller, basically saying that I've, I'm overdue on the payments for my credit card processing machines and you know, they're going to start sending people after me and whatnot. And I had no idea what the heck they're talking about. I don't use or have credit card processing machines. And long story short, I basically asked them to send me a copy of this agreement that I purportedly signed to sign up for these leases of these credit card processors. It took me about five seconds to realize. I mean, I, I knew it wasn't me to begin with, but it took about five seconds for me to realize this is totally fake. I did a Google map search. The address that was on there not only wasn't my address, it basically didn't even really exist, or the office that was supposed to be there didn't exist. And then I spent months trying to figure out how to get that cleaned up with the company itself. And then I had to get a new SIN number. And if anyone's ever had to or tried to get a new SIN number, that's like your core tax identification number with the government, they don't give those away easily. You have to prove to them that your sin was compromised, et cetera. And then once I did that, they initially denied it and I had to get them to reopen it again. And they apologized. They said, sorry, we, we've gone through your file. We don't believe you need a new sin. And we've already microfiched up the file. This was five years ago. Last time I saw microfiche was, you know, when I was studying in University, maybe 20 plus years ago. More than that. Anyways, eventually it got all settled up. Legal fees, time, money, etc. I didn't technically lose anything, but I had to change my sin number everywhere. And we'll talk about maybe SIN numbers later, but my point is, and I will stop talking in a second, this is a challenge. And that was just a single person, my personal identity SIN number, very important. You know, identification number taken. Can imagine if that was at a company and your client's information got taken, or if you know it was a family or yourself and credit cards and all this stuff. So this is pretty important and the world's getting much more challenging in this space. So Daniel, maybe just give our listeners a little bit of the sort of state of cybersecurity and hacks in Canada worldwide, like paint the picture as to how big of a problem this really is. I think people know, but I think it's much more pervasive and concerning than maybe people think.

Yeah, I'm sure you've heard lots of news, especially in the end of 2021. TTC in Toronto, they got hit with a ransomware hack. They were down for the Philippines, were down for weeks, 25,000 records and their employees were released and leaked. Newfoundland Labrador had a big data breach of their healthcare system October 30th, which was just the next day from the TTC and it delayed care for thousands of patients. They also reached 38,000 medical records of people and it took 30 days to get fully up and running. A couple weeks ago, Uber got hacked. It got hacked by 17 year old hacker who was later arrested in the UK. That's an interesting one and we'll touch on that one in a bit. But that hacker, that 17 year old hacked Uber, which everybody knows who Uber is, but he went on and hacked also a company called Rockstar which is one of the largest game publishing companies in the world. And they released video clips with this massive game that they're expecting to release in a couple years. So it's everywhere. Largest corporations. Microsoft had a massive hack last year, you know, Red Cross got hacked. It's everywhere. You basically have to assume that it's possible. You can't be 100% safe across the board, but there's things you could do to protect yourself and to protect companies, obviously.

And so I think the answer's obvious but. Well, two parts. Who's doing this hacking and why? What are they trying to get out of it? I'm sure the answer is money, of course. Or maybe it's showboating. That, you know, 17 year old kid could have back a major public tech corporation. But who's doing this and why? And why can't this be stopped?

So who's doing this Showboating? So the 17 year old. Yeah, that was his purpose. There was no other reason for him to do it. He just wanted to show that he could do it. But the other two are state actors or large nations like Russia, Ukraine, China. Obviously those state actors, if they want to get in, they're going to get in. Those are targeted attack. But the other ones are ransomware groups, they're called or hacking groups that are set up like a business. They really are. They have different divisions within them. You know, one division in charge of penetrating a network, another one's in charge of getting credentials. And then another group's in charge of encrypting your data and dealing with, you know, the process of getting your data back. And it's really, it's about money at the end of the day. So if you're susceptible and your business or your personal data is not secure, then their chance of getting it is high. And then you have to deal with what happens. And it's really about money. It comes down at the end of the day. You know, in the first half of 2021, if we look at kind of the amount of attacks, it was up 151% compared to the first half of 2022. And it's, it's still rising. It hasn't gone down. It's on an increase. And then when you look at kind of how the cost of these attacks, you know, they vary from $5,500 to get your data back. And then there's been two cases actually where over 40 million was required to get data back for large organizations. So it is just worth the money, right? It's definitely. If there's money, it's going to happen. And that's kind of what the problem is.

Is it getting the data back or is it getting the data with a confirmation it won't be shared to the outside world? Because I assume most companies have, I hope, full backups of all their data that they could flip a switch and turn on. If, if you don't, that's probably a problem. But is it getting it back or, or preventing it from being spread around the web? Both.

Absolutely both. So yes, you should have proper backups and then disaster recovery business continuity plan in place in order to recover from events. Now, keep in mind, recover from event. The average lost time for an organization against it with an attack is 22 days. So if you look about, think about how long you would be down, like, how much would that cost the business? 22 days of downtime. And that's with backup procedures in place. But it's twofold. One is, oh, my backup didn't work right. Cause I never tested them. Or the threat actor got my backups too, because they weren't for that properly. And so all my data is encrypted, so I have to pay the ransom to get it back. The flip Side is, and I deal with organizations on both sides of the fence. The other side is the data was breached and I was able to recover no problem. I pulled the threat actor go away. And then all of a sudden, the data starts getting used as a weapon. So in one case, if you think about a healthcare system, data is breached and then use, say, they start calling the patients and say, I know that you had this procedure done. Pay me $100, I'm going to release it. So there really is that People then, threat actors are getting very smart. You know, five years ago, they'd be happy with encrypting your data and getting a payout, but now they're realizing that it's more to it. So they get into your system and they kind of extract all the data from your system, and then they kind of hit the okay, I'm going to crypt button. So they do have both sides in, into kind of that, that hack. And believe it or not, the average time of threat actors in your system is over 200 days. They get in, they poke around, they learn what they need to learn. They see what kind of data you have, and they're like, oh, this is going to be more valuable. The price will go up. And then they encrypt it. So again, it's like a business. They have different parts of the business that do different parts of these.

Right? Yeah. So let me reiterate that, because I, I have that circled on. We have notes for the podcast here, and I have that circled. So a hacker is often inside your system. You don't even know, and they're in there, you said on average over 200 days. Yeah, they're just getting familiar, poking around, you know, monitoring from the outside and figuring out what's the best way for us to exploit a vulnerability.

Yeah. And a lot of times they just get in and leave it. Right. And they go three months later, and they sell that access to another group who then comes in and actually does the data breach. And it's an interesting world out there.

Okay, well, we need you to tell us how to stop them from getting in in the first place and then spotting them when they are in. But before we get there, maybe what's, what's the biggest vulnerability that you see? Because you, you look at and help a lot of companies or individuals as well. What's the main cause of an ability for a hacker to get in?

Yeah, it's. It's us, the humans. So 88%, you know, our breaches are because of humans. And there's there's many reasons why humans are the worst. Like we have passwords, you know, everybody likes to reuse password.

We are the worst.

Yeah, we are. When it comes to security, we are, you know, we've put in as security people and technologists, we've put in different kind of applications in place to help, like multifactor authentication. So if you think about your password, right, a weak password's bad. There's breaches of platforms all the time. So LinkedIn famous breach a couple years ago. And what happens when these data breaches happen is everybody's password that was used on LinkedIn for example, becomes available to every other threat actor or hacker. So what they do is they basically say, oh, I know Brian's password that he used on LinkedIn, let's try using it against his email. Oh, I'm in his email. Oh boy. Now I can start sending emails to other people and say, send me money, I'm Brian. And it really is a problem with these reuse passwords. So a lot of organizations are moving to multi factor authentication, which is amazing. So what that means is every time I log in I need my password and I need something else, like it sends an SMS to my phone or you have to put in a one time password or you have to hit go on your phone, like it pops up. This is great. Hackers stop hackers for a bit, but then they started getting around that. They started social engineering and this is how Uber got hacked a couple weeks ago. And basically what happened was the hacker, the 17 year old, got a list of all the employees for Uber and he starts hitting them over and over with multifactor authentication messages. So if you think about an employee sitting at home, working from home, their phone's buzzing, going msa, yes or no? No, that's not me. No, that's not me. No, that's not me. And then eventually the human gets so annoyed by hitting no, they hit yes. And then that yes gets the hacker into their platform and that's all it took. So here you have mfa, which is amazing, which is should stop everybody from getting into the password. Yet you still have humans who just take yes. They don't think about it, they just hit yes.

I would think if I'm getting an MFA message, the immediate first thing I think is, well, I'm not trying to get into my app. So this is weird. Like that would put my Spidey sense up very high. But I guess these folks know how to do it in such a manner that people, I don't know, they Just do it. Wrong button.

I hear this story all the time. Somebody's, you know, trying to get into their email, right? A hacker's trying to get in and somebody in organization's driving and their phone bings and they're like, okay, what's that? Oh, mfa. And they ignore it. Then their phone bings again and they just don't think about it. They just automatically go, okay. And they hit yeah. The next thing you know, the hackers in their email or whatever platform they want to get into, the other side, which is even scarier. Again, like you have these different mechanisms. One of them is like just six digit one time code that we've all seen. I think we use it when we log into our banking in Canada and you basically this code changes every 30 seconds. And it's one of the most secure ways of getting it right. But what happens is hackers are now calling from like an IT department. Hi, I'm calling from Citibank IT department. My name's Bob. Does anybody know if Bob works at Citibank? I'm calling for my team. I just need to fix your account. Can you just tell me the fixed code on your RSA key right now? And they're like, okay. And they tell it. And then the hackers in platform. So again, these, we put technology in place, but it's up to the humans to be able to actually call.

I keep getting calls from the CRA saying I owe them a whole bunch of taxes and they're sending the police. So what do I do? No, I'm just joking. So let me ask you a question, actually. So mfa Multifactor authentication. It's a policy at Gensler wealth, and frankly, in the Gensler family, although my wife and children scream at me like crazy because they can't get into their Amazon account because, you know, I, I have the mfa. But as you say, there's the text to your cell phone, there's the pop up on an app, there's the code that switches on like a Google authenticator or another type of device. Is there any other type of MFA that I'm missing?

The best one is they have hardware tokens now.

Oh yeah, sure.

It's the hardest one to use, right? You take a token, you plug it into your USB or you tap it against the back of your phone. And that is the hardest one to get, right? So I mean, it could get stolen, someone could break into your house and find it. But if you think about a threat actor outside of your physical area, that is the hardest one. You can share that code with anybody. You can't, you know, a hacker can't say, plug it into my computer. It is really the best way to do it. They're becoming a little bit more popular. And in the organizational side of things, when we look at multifactor authentication, we generally use codes like we use the physicals for securing like administrator access or something that's really not high level of access.

Right?

Yeah.

I have something called a Yubikey which I use for certain things. Okay, but assuming people aren't getting the Yubikey and doing that, because that, as you say, is sort of a.

They're not. Right. It's not going to happen.

You gotta carry it with you. And it actually, it's spectacularly secure, but also the most cumbersome to have with you of those three because a lot of people, they'll sign up for an app and they'll say, what do you want? Do you want to get a text? Do you want to use a code? Do you want to. Whatever. My sense is the text is the, is the weakest of them all for a variety of reasons.

Yeah, so email is the weakest. So there's even some out there now

that, oh, email, Right.

Weakest bottom link, do not do that because that's, you know, you assume a threat actor could get into your email quite easily. SMS or text is also very weak because again, these threat actors, these hackers are very smart. So they said is, hey, let's just start, you know, trying to take over people's SMS mailboxes. And this was famously used around cryptocurrency hacks. There's been a number, a number of high profile, 40, $50 million crypto wallet taken from personal individuals. And basically what happened is individuals are securing a crypto wallet with an SMS password. And what happened was hackers did some social engineering, realized that Brian has a crypto wallet. I know a cell phone because you can find anybody's cell phone nowadays. And they actually went to the carrier like T Mobile or Bell or Rogers and they said, hey, I'm Brian, I lost my phone, I need a new SIM card. You know, here's my SIM number, can you transfer it? And they do it. And so there's. Now the carriers, at least in Canada are getting better about asking for identity and proof. But you should definitely be going to your carriers and say, hey, can you please make sure you check identity before you transfer any of my phones or my account numbers? So SMS pretty well in a totem pole only because they figured out how to get around that.

Right. So every once in a while on this podcast, I think we'll do tips, you know. So here, as, as Daniel just said, there was the tip, but if you missed it, here's my tip. So I called Rogers and I said if anyone, including myself, says we want to switch the sim, I think first of all they can't do it immediately. They have to wait 24 hours or something and they contact me. I actually don't remember cause I did this a little while back. But you know, if I switch from Rogers to Bell, let's just say if I walked into a Bell store normally they'd say, no problem, just give us your number, we'll switch it over. And it's all good. I think because I've advised Rogers not to let anyone change my sim. You wouldn't be able to switch carriers like that. Obviously you could give them permission if you really wanted to switch carriers, but more so it's to protect against what you just said. Like you just gotta make it harder for people to accomplish what they want to accomplish and they'll just move to the next person, I hope.

Yeah, low hanging fruit. Unless you're being targeted. It's low hanging fruit. Right. If I can't get in, if there's a barrier for me to do what I need to do to get your money, then I'm going to move on to the next person.

Right, okay. So you said humans are the worst. That's the quote of the podcast from Daniel. If we take anything away, humans are the worst. We're the biggest vulnerability. You talked about social engineering, any other sort of key types of attacks that you know are common or that people should know about and therefore be thinking about trying to not let happen.

Yeah, I mean this is something that's interrupt phishing links though. Phishing attack, Believe it or not, the number one costliest attack were these phishing schemes. So basically, you know, it happens in different ways. You get an email that says, hey, Brian sent me a document on Word. Open it up and you get a webpage that looks like Microsoft and you put in your username and password and then nothing happens like, oh no, bad document. But what happens in the background is the threat actor, the hacker, hook your credentials and they're then going to log in as you. They're now logging in as Brian and they're going to send an email to all Brian's contacts and they're going to read your email. So they're going to know how Brian writes an email and how they talk and they're going to send an email to everybody. They're going to say, hey, it's Brian. Here's an invoice. Transfer money into this bank account. And believe it or not, think about it, two people have to fail the phishing in order to get this one, Brian has to fail it. So someone gets into his account, this is mail account, and then the other side has to realize and, you know, actually fall for it. That is Brian. And believe it or not, that was the largest losses. 43% of all losses in 2022 were, because of these emails, compromised. And, you know, I hear stories all the time. I have one story on a Friday late afternoon, controller gets an email that says, please transfer $50,000 to this while you're transferring this bank account in China. And the controller's like, well, we do business with China, so it's not unheard of, and blindly transfers out the money. Monday morning, the CFO comes in, does a little bank reconciliation, is like, what's this $55,000? It's gone. You can't get it back. It's a loss. Another one would be a law firm that had a very sophisticated phishing attack that happened. And they ended up transferring out $500,000 into their trust account, their lawyer's trust account. And the lawyers didn't realize how it was all happening in the background. And the threat actor was talking directly to the bank. And the lawyer only realized that had happened when they got, you know, final email saying, your wire transfer is complete. And the lawyer was in the meeting and obviously saw that email ran as quickly as they could to the local branch, which is down the street. And they ended up stopping that transfer from happening right before it left the local branch to the bank account. So these are common. They don't get reported, obviously, a lot because it depends with us. And the other thing is, it's not just businesses that this is happening to. It's individual. I see it all the time where individuals get emailed from people they may know. And it may say something like, hey, I'm stuck in this country. I got robbed. I don't have any money. Can you transfer some money into my bank account? I'll pay you back and get back. And like, it's coming from Brian. It's coming from his legitimate email address. It's written like, Brian, like these are. It happens all the time and is really. It's human, right? You have to be able to look at these emails and go, is this normal? Like, would Brian really reach out to me? Like, who Am I in Brian's life that he reach out to me and ask me for money because he's stuck in Ruby or something, right?

Yeah, I may need to ask you for some money after, but that's a whole other story. So, speaking of the emails and the links, you know, again, I hope people are vigilant when they see these emails come through with weird links or it comes from what appears to be someone you know. But if you look at the email address, it's ABC123 at something weird. But any more sort of advice or color on sort of what people should be doing than what are the telltale signs that something might be off? I get email from the banks that aren't really the banks, from PayPal, from Amazon, then of course, a whole bunch of random people. And I think I've been pretty good at identifying when they look weird. But what's the telltale signs that something is a little strange in an email that someone's trying to make look real?

Yeah, a couple of them are, you know, the graph of the English language. So a lot of time, grammar won't be correct, spelling won't be correct, misplaced, you know, apostrophes or periods. If there's a link within the email, if you hover over that link on your computer or if you're on an iPhone, you can kind of short press on it. It will actually show you a preview will tell you where you're going. So if it's like something saying, hey, PayPal sent you a link to log into your account to read the new Terms of Service, how we're over with, does it go to PayPal or does it go to ABC XYZ y y z dot com? So those are kind of like the things you need to look at and, and really, you know, question every email that you get and see if it makes sense. Right. Don't blindly just start clicking on things. And if you do click on the link, if it opens up a website that's, you know, Microsoft login, but again, it doesn't look right, then it's not right. Exit it, be done. You don't need to deal with it, walk away.

Right. What's strange to me, just following on your conversation or the earlier part of the conversation, if these are very sophisticated groups and they're in your systems for 200 days, they've got the technology to do everything, but they don't know where to put an apostrophe or a comma. It seems like they need to upgrade their skills, maybe call Some HR experts in. But you know, I think actually what, what the best practices now seem to be and should be for companies is when they email you and say, hey, we need you to update your account. Or in our industry, financial services, your account statement is ready. The best practice is actually to include zero links. Even though it would be easier for the client if we just said click here to go to the portal. In fact, we're protecting the client by saying just go to the portal, which you can find to our website or otherwise, as opposed to putting in a link. So sometimes just the very fact that there is a link in an email should be a red flag. I almost never click on links and emails anymore as a result.

Yep, yeah, it's the right way to do it. Like that's, that's the right way to do it is not to offer any link and just say, go into your account and check it out.

Right. You can tell I'm a little paranoid on all this stuff. But, you know, it's both personally but also for our business. We obviously have some very sensitive data and so we put a lot of things in place to protect that. So maybe let's go through just other sort of day in the life or year in the life of individuals and what they might do and come across. Maybe travel is an interesting thing. Like what do people do to protect themselves when they're out and about in the world? At a Starbucks, in an airport, at a hotel where you're not in your home environment, you don't have whatever your greatest systems are or your Internet or whatever. What do you tell people or what should people be doing?

Yeah, so first of all, don't use public WI fi. I know it's tempting. I know people like it. You're at an airport, you want to get on public WI fi, you're at Starbucks. Just don't do it. Definitely don't do it from a machine that is a work machine or has any personal information on it. If it's your cell phone, your kids, you know, Wii or Switch, fine. But if it's your device with information on it, do not get on public WI fi. The problem is anything that's transmitted from your computer to the access point on the public WI fi is not encrypted and anybody else on the public WI fi has a chance of seeing it, including passwords and whatnot. So definitely tether your phone. Like most of our phone plans nowadays in Canada have. Roaming in the States and roaming to the rest of the world. Tether your phone, use that, Try not to get on public WI fi, please. It's definitely not a good one. Another one which people don't really think about is you're in a resort. Time to go home. You want to your forwarding path, you go to the business center. Don't log into your email in the business center. Don't log into your Air Canada account, Don't log into your anything on a business center computer. Those things are just bad. So I mean, if you do have to print something, go to your room, you have your laptop, download your boarding passes onto a USB key, bring that USB key into the business center and print the PDF from the USB key and then throw it to USB key and then. But don't do anything.

But the problem is I don't. You know who's carrying USB keys these days?

Maybe. Oh, that sound normal. I do.

Maybe the better thing is to get the front desk email address and just email your boarding pass to them. Maybe that works if you really have to do that. Everything's electronic these days, though, for the

most part, you're stuck in some weird island somewhere that hasn't upgraded.

Right.

The last one, which people really don't think about. But this is like, it's interesting. Tinfoil, hot time. Don't plug your phone into chargers randomly. Like, you know, they're at the airport, they're in restaurants now. You, you don't want to plug in your phone to charge because you don't know what it is on the other side that's actually providing the power. There's been many cases where on the other side of that is actually a tool that hacks your phone. Right. So you plug it in and depends on what phone you have, it could give you. It could give the device that you're plugging into full access to your phone. It could plant malware. And then you bring that phone to your office, your house, and then it's on the same network as everything else. So it's just a really good idea not to plug stuff into chargers. Just randomly bring a charger with you, plug it into the AC power and charge it that way. I wouldn't plug anything into a random USB drive.

Right, Got it. You told me Interesting story about a bank card. Going back to passwords for a second because now we're in the sort of little tips and tricks, I guess, stage for people. And then I want to talk about businesses in a minute too, because a lot of our listeners and my clients are business owners. But back to passwords for a minute. Maybe share that story with our Listeners here.

Yeah, so if you think about PIN code, so you have a PIN for your Visa, when you put in your chip, chip and pin, your, your bank card obviously is a pin. And what's happening now is banks are getting a little bit more sensitive if you use not a strong pin. So there was actually in the spring of this year of 2022, somebody from Ontario was downtown Toronto shopping and they realized that their wallet was stolen. Two hours after they realized their wallet was stolen, their $20,000 worth of charges rung up on their various credit cards and debit cards. And so when this person called rbc, which was one of the card that was stolen, they got in touch with the fraud department and the fraud department said randomly, is your PIN related to something personal like your birthday? And the purchaser answered, yes, it is. And RBC said, well, that violates their terms of service and we're actually not going to refund you for all the purchases that were made with that pin. They were funded for the tap, which is, I think it was $200 of refund. But this person was out almost $9,000 because RBC said it's actually your responsibility to have a strong pin. And so if you think about it, the person who stole the wallet have the driver's license which had the birth date on it and it probably was 10 minutes before they realized what the PIN was for their Visa card. So that's a, it's a new thing. This is very new and it's happening. The banks are starting to kind of put the onus on the individual when it comes to securing their cards in their bank account. So first thing, have a PIN that's random. Do not put your birthday on that PIN and make sure it's random because you could be stuck with those, those fees now.

Right. So here's a test question or a pop quiz for our listeners. The good news is we can't actually hear anyone respond. But you can respond in your car or with your family. You know, with a four digit PIN that a bank card or Visa has, they don't give you an option really to create a 12 digit or a random thing. But just for fun, how long do people think it would take a hacker to figure out and break a four digit pin? You know, Jeopardy Music do do, do. Anyways, the answer is instantly. So the hackers are so sophisticated now, four digit PIN is completely useless. Let's see, I have, I have a big chart in front of me. So let's just see something. How long would it take for a Hacker to break an eight digit password that has upper and lowercase letters mixed. Any guesses? Obviously it's just silence on the other end. The answer is three hours. So that's pretty good. You stop them for three hours. But what about a 10 digit password with now a lot of places are saying you need, you know, numbers and uppercase and lowercase and symbols. If you had a 10 digit password with numbers, upper and lowercase letters and symbols, it would take a hacker 928 years right now with today's technology to break your password. And if that number went up to 18 characters, I don't even know what this means. One quad trillion years. So how are you going to remember a password with multiple characters, uppercase, lowercase symbols, etc. You ultimately have to hopefully this is what we do use a password manager that's presumably not been hacked and very secure. And so basically I was, when Daniel and I were thinking about this podcast, I was saying to him, like if someone came in to me right now and said I need your password for your corporate email or we're going to kill you. Unfortunately I'm dead because I have absolutely no idea what my password is to log into my work network. I only know what my very long, very secret, super secret. It's not Bosco, for those who are Seinfeld fans, passcode for my password manager. And it controls sort of the complexity for all my other stuff. So have a complex password is my tip for folks.

And don't reuse that password and don't reuse it because if that password gets breached, it means nothing. That password's now available.

Right. So last thing before we get to company stuff. This world is evolving. People with their homes have the smart homes and the smart cameras and the WI fi in the house and the doorbells and all this sort of stuff. Any tips to do's not to do's for folks around that sort of like in the house type of equipment.

Yeah, I mean like this is, I mean you get super techie. I mean my house is done really well just techie wise. Everything's segregated on different networks and whatnot. But really it comes down to making sure your computers are updated. Like an entry point into your network is going to come from an unpatched Microsoft, you know, Windows or your Mac that hasn't been updated or you're running Chrome that has been updated and you had a bad website. So making sure your computers, your kids computers, everybody's computers are always updated. Very important. Your phones obviously always should be updated. Too. The other issue, and I wrote into this both in the personal and the business side of it, like if you have a camera system, for example, and you kind of open a hole from your outside in your firewall so you can view those cameras when you're not home, you're opening a hole for anybody to get into your network. And the issue is some people have old camera systems that don't update and they have vulnerabilities in it. So something like low hanging fruit and we talked about is like people are scanning the Internet all the time looking for vulnerabilities and they get in if you have a NAS or like a server, like it's called a QNAP or Synology. Both those manufacturers have been hacked in the last couple of months and everybody's acknowledging QNAP has been accessible from the Internet, have been encrypted completely. So people have lost all their personal information in the picture. So, you know, as much as possible, don't open ports on your firewall. You know what that means? Don't do it if you don't know what that means. Hopefully whoever set up your, your camera system, you should, you should talk to them and leverage things like Ring and Net and you know, Apple camera kit and HomeKit, which are great. Apple's is actually amazing because what it does is it allows you to see your video streams by using their server. So there's no bullets open up in your network. It's like all outbound. And then, I mean, it depends how sophisticated your network is. I would set up a wifi network, one for my family and one for my guests. I don't like my kids, friends coming over with their computer and just getting on my network because who knows what they're doing on that computer. So if you have the ability to set up kind of different networks within your environment, that would be a huge tip as well.

Awesome. Okay, good. So we've covered a lot, we've covered a lot on the personal side too. And we've actually crossed over and talked individual and corporation. But there's a couple of things on the corporate side that I think our listeners should know about or may find interesting. So maybe two key questions or two, two key items. Number one, people listening to this or business owners listening to this might say, this is all great, but you know, I'm trying to run business. Who can I engage to do all this work? Plus, how am I paying for all this work? To make sure we're protected, There appears to be a new program from the government to support this, which is great. So actually maybe talk about that first. Then I'll ask you one other question on the. On the corporate side.

Yeah, absolutely. So, you know, the government knows security is a big issue. They know it is for organizations. And the federal government and states have been doing this for years. But the Canadian government, in their budget in 2021, set aside $4 billion for what they call the Canadian Digital Adoption Program, CDAP. And what it allows you to do as an organization is apply for a grant from the government for up to $15,000 to have a security expert come in and do a review and assessment of your organization's security controls and basically come up with a gap analysis of where you are with your security, where you need to shore up your security and kind of lay out the risk. So the government is willing to pay for that. So you could sign up on the CDAP website. Restwell is an approved vendor to provide the service. And then once the assessment is done, you could then apply for a DDC interest free loan in order to implement any changes that are required based on the assessment. So let's say the assessment comes back and you need to install a new firewall and your computers are old and they need to be updated or your ERP system is not supported anymore. The government will give you a loan, a five year interest free loan to pay for all that work. Because the government knows they're doing this on purpose. They know that organizations have to shore up their security. We're talking 22 days of downtime average. Like that's a lot of missed work for organizations. So the government created this program. It's amazing. I just started and already there's a lot of traction. So it's a great program.

That's great. Good to know. And so to find more information about that, what did you say the website was? Cdap?

Cdapp? Yeah, it's called the Canadian Digital Adoption Program.

Okay, so search for that. We'll put that in the nose. And then maybe we've covered a bit of this already, but we're in a sort of hybrid work world these days. Obviously through Covid, almost everyone was at home. Now it's sort of back and forth any September or October, I guess, 2022, major issues or things that businesses should be doing in this new sort of working world that we're in to protect themselves, their employees, et cetera. From this type of threats.

Yeah, I would say the biggest thing is, I mean from an organizational point of view, I think organizations have to understand the risks and it's Not a scary thing to understand where risks are, but to understand them so that you can plan for either fixing or reducing that risk and budgeting and also understand what kind of data you hold. Right. Because that, that makes decision on how to deal with a mobile workforce. Like for example, if you're dealing with personal information or financial information, you're not going to want to allow your employees to access it from their personal computer. Right. Or their kids gaming computer. You definitely want to provide them with an organization owned device. You want them to have a laptop or computer at home. All your tools are on it, your EDR encryption and all that. You shouldn't allow anybody to come in from a random computer to see their data. I think that's still going through organizations, you know, and how to deal with that. I deal with a lot of organizations that still are allowing individuals to use their computers, believe it or not, their personal computers to access organizational data. And you have no control over that. Multi factor authentication. I can't even say it enough, but I do run into organizations that still do not have it implemented. It might be a pain for the employees and they might complain it's a month using a VPN or allowing, you know, some sort of encryption or dealing with data. And then training. I think the biggest thing that we forget about again with a cyber attack, we need to train humans. And so there's different ways. You could do phishing testing, you could do video awareness training. But what I find is companies will do it once a year, you need to do it quarterly, you need to do it all the time. And it has to be front of mind for every employee all the time. To really be on the lookout for something in an email, they have to understand the latest threat and then it helps them in their personal life too. If you think about it, if you go through security awareness training at work and you get an email on your personal email address that looks funky, you're going to, you know, that skill will move over that training will move over your personal world as well, right?

Yeah, training is key. We do a lot of that here. Again because I'm pretty paranoid about this stuff, but that's a good way to summarize this whole discussion.

Yeah.

Knowledge is power.

What?

What did G.I. joe used to say? I can't remember what the phrase was. I'm too old to remember it now. Anyways, that's fantastic. Thanks for all this color and info. One last question we always ask our guests before we let them go free here is, you know our theme around here is unlimited we can look at anything. We can help clients in a whole variety of ways. You know, we're not limited by the types of products or services that we are able to offer from the on the financial side. And so we always like to ask our guests, if you weren't doing what you were doing right now, you had unlimited ability to do anything in the world, could be the greatest rock star, you could be on the moon, you could do whatever the heck, what would you be doing right now?

Is it cheesy to say that I'm actually doing what I'm doing? Okay, but besides that?

Because I'd say half the people do say that, but I don't know.

Okay, good.

I don't know if I believe when you were a kid, you know, when you were four years old and your parents be when you grew up, I don't know if you said a cybersecurity expert that protects companies from hackers.

So I would say playing and rebuilding old cars, not super old, but maybe you know, cars from like the 90s and 80s, not cars nowadays that are all electric and computer driven, but you know, rebuilding an engine, maybe doing oil change, something with my hands like that.

Nice. I'm a car guy as well and I drive a Tesla now. So it's all electronic and it's amazing what they can do remotely. You don't have to do anything. But that sounds like. That sounds like fun. Okay, sir, well look, thank you so much Daniel, really appreciate your time, your insight and sharing with our listeners the do's and don'ts of cybersecurity and clicking and passwords and pins and all that fun stuff. So wish you the best and thanks again so much for your time, really appreciate it.

Thank you very much. This was a quite an experience.

Okay, thanks.

Take care.

This has been Brian's conversation with Daniel Speroski from RestWell Technology. Cybersecurity impacts all of us. So hopefully you've learned some best practices and do's and don'ts on how to better protect yourself, your family and your business. This has been a Gensler wealth audio production. The unlimited podcast is hosted and produced by Brian Gensler and edited and mixed by me, Katherine Donville. If you're interested in hearing more from us, please like subscribe and give us a five star rating and follow us on all social media. We can be found at Gensler Wealth. See you next time.