Cybersecurity Girl

Hey everyone, it's rich. Influencers. They are everywhere. In fact, most experts estimates place the total number of influencers worldwide at well over 50 million. And according to Sprout, social influencer marketing is big business, with a 2024 global forecast surpassing $30 billion. That's with a B. In a Forbes article from 2022, Joe Gaglies, co founder and CEO of Global Digital and social innovation group Viral Nation, made a bold prediction claiming that social influence will be the new bachelor's degree. In the same article, Gaglies also explains why content creators are so integral to today's economy, saying, quote, influencers help brands engage with audiences and customers in a highly authentic way. Well, when it comes to authenticity, I think it depends. For example, a few weeks ago I was leaving the office and in the parking lot was what appeared to be a female model posing in front of a luxury sports car. She had a photographer taking countless pictures as he directed her into different poses. It probably wasn't even their car. Was that authentic, Mr. Gagliese? Well, our guest today is certainly no lifestyle influencer, and she's most definitely far more influential than a micro influencer. And above all, she's positively shaping the future of cybersecurity one post at a time. Caitlin, otherwise known as Cybersecurity Girl, is one of the largest cybersecurity influencers in the world. Her with more than 800,000 followers on TikTok and Instagram combined, her mission is provide the public with sound tips for protecting their personal data, demystify the field of cybersecurity, and encourage more women to enter STEM fields and ultimately a career in cybersecurity. We need more influencers like Caitlin and fewer of the ones like I saw in the parking lot.

Foreign.

You'Re listening to Privacy Files. This episode is brought to you by AnonymiLabs, makers of MySudo, the world's only all in one privacy app and sudo platform, the cloud based platform companies turn to for seamlessly integrating identity protection solutions into their software. And have you heard about the My Sudoweb browser extension? Breaking your online data trail just got way easier. To learn more, visit mysudo.com that's mysudo.com.

Kaitlyn welcome to Privacy Files.

Thank you Rich. So excited to be here.

Yeah, this is going to be a great discussion. So I guess essentially in my research you're an advocate for really three main topics. One is data privacy, protection and safety. Of course, we love that here on Privacy Files. Two, you like to promote careers in cybersecurity and then of course. 3. Encouraging more women to get into STEM fields. Does that sound about right?

Yep, that's exactly it. Those are my three main pillars. So happy to be here and talk a little bit more about that. And I think your podcast is perfect, so I appreciate you doing this.

Yeah, thank you. So I think the best way to start, and I know you probably do this all the time, and you're like, oh, not again. But I think it's helpful for the audience to kind of walk through a little bit of. Of your professional journey. So it sounds like you got your start full time at ey.

Yeah. So I actually. One of the reasons why I started my channel originally was because I kept getting asked, like, how did you get into cyber? And, like, do you hack and. Or even hack my phone? And I got into cyber very oddly. I did aerospace mechanical engineering in undergrad in graduate school. And my family is one of those families that, like, you kind of stick with your job and stay in it until you retire. And so when I had done, I had three amazing internships, all with aerospace or mechanical type backgrounds. And I just couldn't see myself there for, like, the long haul. I was like, these are all awesome and really interesting, but, like, I think I'm gonna get bored after, like, a year or two of being here. So my cousin actually went into technology consulting, and she told me to go into that. And so I was interviewing at different places for technology consulting. You know, the Big four, Accenture, all those places. And when I interviewed at ui, they said they had just started their cybersecurity practice and asked me if I was interested in starting. And in my head, I was like, this lady has no idea, but I am terrible at coding. Like, we had to take, like, two matlab classes. And for those of you guys that don't know what coding is, like, matlab is not really coding. It's like, I don't even know what matlab is. It's just some weird class that we had to take. It's not applicable, but it's the closest to coding that you could get. And I was terrible at that. Those two classes, like, I barely passed. And so I was like, well, let's go for the experience. Let's try this opportunity type of person. The other technology consulting companies are like, you can do SAP or whatever else. And I. I was really intrigued by cyber. And I also had this gut feeling, and this was around 11 years ago now, that it was going to be big. Like, it's really important. And so I said yes. And they trained me on the job. And that's how I got into cyber. I had no cybersecurity experience. Just like many people, I thought cybersecurity was like hacking and coding. I also thought I was not worthy or was not smart enough to be in cyber. And so all of that kind of accumulated into how and why I started my cybersecurity channel, which I never thought I'd do either, by the way. But we're here.

Yeah. And so what was it like? I guess consulting on CyberSecurity topics at.

EY, what did that look like?

It's literally a whole gamut of things. And EY had a lot of different areas of cyber. They had a lot of specialties. I was in the more general one. So we called ourselves the Cyber Transformation Group, which basically needed a lot of broad knowledge, but not a lot of deep knowledge. So what we do is we go into companies and we'd assess them from a cybersecurity standpoint from a lot of different areas. I think it was around 20 different domains. So we assess them from access management, data protection, awareness, physical security, all those things. And again, we had the standard set of questions that we'd asked. It was around 300 to 400 questions. We do these really in depth assessments at incredible companies like Experian and Nike and Cisco and we'd go in and tell them where they had gaps and then we'd come up with a roadmap on how they can fix and remediate those gaps. And usually they ended up hiring us after to kind of fix those, but that's where I started. And after three or four years of doing these types of assessments, I was like, you know what, I really want to go specialize in a certain area. And so I started getting really intrigued by data privacy and data protection. And this was before, you know, all the GDPR stuff came into play. I was in data privacy for about a year or two and then I got the opportunity to move to the UK to help EY kind of build out and support their GDPR data privacy practice out there before it went into place. And then ever since then, I've kind of done a mix of both. Right. I, I love the cyber transformation piece. I think it's so important that companies are able to assess as a whole what their cybersecurity practice looks like. But I think right now, in this day and age, one of the most popular areas of cybersecurity is data privacy, is data protection. Yeah, I just love educating the public on all the new laws and their rights and what they can do.

So I imagine working at ey, you really got a chance to see kind.

Of the full spectrum of what's possible.

In the cybersecurity world in terms of careers.

Yeah, I mean, I literally saw everything and I got to work on the most incredible projects. Like for example, we were at Experian right after the data breach. They brought us in. We were at Target right after the data breach when they brought us in. So we were seeing, I was working with a, of like digital forensics teams and attack and penetration teams and seeing how they handled those situations and what they needed to do moving forward. And then, I mean, even with Nike, there was a really cool opportunity where they were having. And then this is eight or nine years ago, it's not an issue anymore. But they were having issues with bots coming in and buying all their inventory. So how are we going to address that problem? It wasn't just general, let's check the box, let's answer these questions. But we were really looking at like the future of cyber back then. So I, whenever people, people ask me how I started, I'm like, I started in consulting and I would never change it because I got to see everything. It was incredible.

So I would imagine too. And I'm just. And you can tell me if I'm wrong. But so you're in the UK at some point and you are helping out ey, you're working on GDPR issues, you're doing privacy impact assessments and you're helping with M. And as that probably, I would imagine that really opened your eyes to, in terms of how data is being managed at companies and, and maybe in some cases, maybe it scared you a little bit just to see how careless companies are with personal data.

Yeah. It's funny because back in the day when Internet was a big thing, data was huge, data was king. Like, you absolutely wanted as much data as possible because that's who ruled, because you could market and use that and sell that and do whatever you wanted. And then to see, starting the shift of mindset. Obviously I had the shift of mindset first. Same with most data privacy professionals, because we're like, this isn't okay anymore. But being able to convince executives and marketers and salespeople that that shift needed to happen was really, really cool to see. And then even from, like you said, you referenced M and A, I, I got a really cool experience of, for around seven or eight months, I helped with Softbank, Lloyd's of London, all of these companies to assess privacy and cybersecurity from a transactional risk perspective. So not only now are companies looking financially at like, oh, if I invest in this company or if I buy this company, what is my risk in this transaction from a financial perspective? But now you have to start bringing in from a cybersecurity and privacy perspective of, okay, well, if I'm buying this company only for their data, one, can I use their data legally to like, how am I legally able to transfer the data, if that's even possible? Three, like, did they have a previous data breach that if we buy them now and then it gets exposed, our entire company is out of commission. It's not even data breaches, it's cybersecurity incidents. It's how they're storing their data. Is that company like, abiding by the general CyberSecurity best practices ISO 2701 compliant? So looking at a full spectrum and then giving it a monetary value to tell these companies, okay, if you're going to invest in this company, here is the risk from a cybersecurity and a privacy perspective. And I think a lot. And that was like really game changing back then. No one really wanted to think about it. They only wanted to think about financially. So that's why we had to start transitioning cyber and privacy to a financial risk. Because it is a financial risk at the end of the day. I mean, especially for cyber. If you had a breach, that's a huge financial risk that just from if your company's out there and you have to announce the data breach or paying regulators. Now, if you had a data breach or having specific fines, if you're using data that you're not supposed to be using. And there's just a lot of stuff to consider. So it was a really cool experience and again, really shaped the way I looked at even building my own business and what data I'm going to collect on people when they're taking my free course or anything like that.

So, yeah, there's companies, it seems like they're getting sued pretty much almost every week and there's fines being paid out in the millions. And I think you probably saw the most recent one with DoorDash in California where they were sharing information and I forgot exactly. I think you've talked about it before, but is it the California Privacy Protection Act?

Yeah.

Yeah. I don't think people realize just how much is going on on the corporate side. And I think if people did understand, they would be far more cautious with how they share their personal information.

I feel like I grew up in the privacy realm because I, I moved to the UK for gdpr, then I moved back right before CCPA hit and I worked for a global law, which was incredible too with really great people. And that is one thing I will say I've been really blessed too. I don't know how I've been in the room with these amazing people, but I thank God every day that I got to be. But yeah, when I worked at DLA Piper we were looking at everything and they're like one of the top law firms in the world. So being able to be in a room with these partners that are like dissecting this privacy law and understanding, like how are we going to coach and guide our clients the right way? Because I like to say lawyers are funny. They write laws so they need lawyers to interpret laws. They write laws so they have their own job. Right. A lot of these privacy laws are really up for interpretation. They're pretty vague. And so a lot of times also, not only is it hard to even abide by, but it's hard to even come up with a stance on how you're going to do it and why and then move forward from there. So there's a lot of risk analysis that you have to do when it comes to deciding how you're going to abide by the laws. Everyone needs to abide by them. But especially with the ccpa, it made it extremely hard for companies to abide by that.

Let's take a quick break for this message from our sponsor.

Not again. I can't find it anywhere.

What's got you so frustrated?

Hi Bob, just trying to find an important email, but my inbox is a disaster. It's off ads and spam. It's exhausting.

Sounds like you need somewhat of an inbox intervention. Have you heard of my sudo?

My sudo? No, what's that?

It's an awesome app where you can create a sudo. It's kind of like a digital alias. Each of these pseudos comes with its own email to help you organize your digital life. It's the perfect tool to keep your personal and work emails spam free.

So what you're saying is I can use one of these pseudo emails and never have to worry about spamming? Spamming up my personal or work email?

Yep. Plus it's super secure. You should download it.

Downloading as we speak. You are a lifesaver.

Don't let spam emails take over your life. Reclaim your inbox with MySudo. Download MySudo today and start your journey to A clutter free digital world. Visit mysudo.com and remember, stay private.

Do you see now some of the larger corporations having an attorney on retainer who is mostly just focused on this space?

If they're larger corporations, I would say that they usually already have an in house attorney. I do think that they have a retainer for attorneys like DLA where they just need some guidance and gauge like, understand, like, okay, what is DLA also telling their people? Because a lot of times if you're in house, you can guess, but you also don't want to make a costly mistake. And so it's always really nice to have just like an extra person you can chat with me. Like, hey, how did you interpret that one regulation in the ccpa? Like I was going to interpret it this way, but if you're advising your clients on a different way, like, let me know. Also, I mean if you're friends with lawyers, which most lawyers are friends with lawyers, you probably just ask around. But I do think there's a lot of companies that have a lawyer on retainer. And then also, I mean it's kind of needed to have an in house lawyer as well, depending on how much data you collect.

Sure. Now, as a content creator or influencer, I know people love that term, right?

I don't love that term. I don't like referencing myself as an influencer, but people have started to. So I'm like, well, we're here.

Yeah, but so you have to communicate to obviously a fairly wide audience. I think your two main channels probably Instagram and TikTok, correct?

Correct.

So you're talking to a wide audience of people with education levels that span this wide spectrum experiences and so forth. How are you able to take what can be a very complicated and overwhelming topic and bring it down to a level where it's really digestible for a large audience? So what is the trick to doing that?

It's funny that you asked that. I'm going to say two things. One is I'm not very smart and so I have to digest it for myself to even understand. And so the way I explained it to myself is pretty much the way I explain it to the public. The other thing is I always think about my mom or my grandma. I'm like, would my mom be able to understand what the heck I'm saying? So the first thing that my first filtration is, what is this? Because I don't even understand what's going on. And then my second filtration is, okay, now that I've explained it to myself, would my mom also be able to understand what I'm saying without having any cybersecurity context? And so that's usually the two ways I break it down again, like, and I tell this all the time. Cybersecurity and data privacy are constantly changing. There's constantly new terms, there's new rules, there's new interpretations. I can't stay on top of it, and it's impossible for anyone. I mean, especially because I'm so broad now with doing the influencing thing. I don't just, like, really hone in on one area. And so a lot of times, I literally am. I have news alerts set. I have LinkedIn groups, and I'm constantly looking at what's going on. And then when I see something that I'm like, this is really important. I have to figure it out myself. I have to, like, decipher and be like, why is this emotionally tying to me? Like, I feel emotionally tied to share this with someone. And then I'm like, okay, what does this mean? Like, how can I communicate this? And I really, really try not to do, like, the clickbaity articles because there's been some. I mean, news is a lot of clickbait. And so I do get a lot of people requesting, like, oh, did you see this in the news? Or did you see this in the news? And I'm like, it's not even worth clickbaiting. Like, I don't want that. I want to, like, my brand is me and me just trying to, like, clickbait people and get people, like, emotionally exhausted from all this terrible news is. There's no point of that. It's just what is most important that you need to know right now. That's what I try to do.

So, yeah, and you're obviously, you're very passionate about the field of cybersecurity. You're passionate about encouraging women to get into the STEM subjects like science, technology, engineering, and math. How do you get people fired up about cybersecurity? What seems to be a formula that works for you?

To be honest, I think I just get so fired up that it, like, rubs off on other people. I don't understand why anyone wouldn't be fired up about cybersecurity. Because it's, like, the coolest field ever. I mean, can you imagine any other field that's constantly changing and moving and you're always on the polls, like, it's draining sometimes because you have to be on top of it. But anyone that has a love of learning can do this and Then also like it's not just a tech thing, like it's everyone, like we need everyone. And so I think that's what people get excited about because I think this was like back in the day was like this really kind of men in hoodies, like exclusive club where you only could be really cool. I mean that's how a lot of people thought of it. And I think being able to come out with the approach of like everyone's friggin welcome, this is the coolest place to be. You are behind if you're not in it. And like anyone can get in it is I think just makes people excited and want to learn a little bit more. Because I know for me I honestly thought I was the same as everyone else. I thought it was a hacking job. So.

And that's a great segue into the types of career tracks. So you don't have to be an expert coder to do this. Right. There's the governance side of it too. Maybe you can talk about what are some of the typical career tracks that could be options for people who want to get into cybersecurity.

Yeah, I mean there's so many. So I mean I always try to say like the technical versus non technical route and the way I define technical and non technical is technical to me is like actual coding. Like your hands are on the keyboard coding. And that's like a SOC analyst attack and pen, digital forensics, those type of things where you're going in, you're either like an ethical hacker, which means that you're hacking for good, or you're doing like bug bounties or something like that where companies pay you to try to find flaws in their systems. You're also and or protecting the company in the soc or the security operations center. If you don't know what a SOC is, soc. And so those are like the technical routes that you can go. And I think those are really, really cool. I mean when I worked at Experian, when they were my client, their SOC was incredible. It was like so cool to go into their SoC. And same with TikTok and a lot of other companies. So there's a lot of really cool areas that I am not a coder, so I can't do that from there. I mean you can do identity access management which involves like some type of technology, but it doesn't necessarily mean you're coding. I mean I like to say it like this. We get new technology every day. If you know how to figure out how to use a new cell phone, you'll be able to figure out a new technology pretty easily, like identity Access management technology. There's obviously like DLP or Data Loss Prevention and Protection. Data protection, which is like helping companies protect their crown jewels or their most important things. There's privacy, which is honestly now mostly comprised of lawyers. But like we need everyone from an attack in Pensai. We actually need like psychologists and people that are able to get in the mind of hackers. And so you don't have to be technical to be an attack at PEN either. In that sense there's governance, risk and compliance which is very, very non technical. It's for extreme type A people that are good at auditing and like good at spreadsheets and are good at having hard conversations. So there's not one type of personality that I'm like, probably not good for cyber. Like we legitimately need everyone in all different areas of cyber in order for us to succeed.

That's awesome. I guess a lot of the promoting that you do takes place on your website, cybersecuritygirl.net yeah, so I mean I.

Will be completely honest. The website. I will be building a cybersecurity course. The quiz is just about to be finalized where you can take a quiz and it will tell you what area of cybersecurity best fits your needs and your interests, which is awesome because no one's done that before but. And then there'll be courses that you can take that are like affordable, that will allow you to achieve skills so you can actually put them on your resume for those specific areas. So I haven't really touched the website because to me that's really for the course. It's really just my social media channels, everything I do and it's like brain dump of everything on those channels. So I try to organize them a bit. So I have like different sections in each channel, but yeah, pretty much all in there.

And people can find you on TikTok and Instagram. I guess it's just Cyber Security Girl.

Yeah, unfortunately Instagram, it's Cyber Security Underscore girl. I'm working on making sure it's all together, but everywhere else it's Cybersecurity Girl.

So perfect. That's good. And yet you've also spoken at the RSA conference. I noticed. I think you were on a panel.

Yes, yeah, I was on a panel and actually right before this was just preparing my RSA talk for this upcoming year, which I'm speaking on privacy, oddly enough with my dad. So my dad and I kind of got into privacy at the Same time. And it's been something that I've been really, really excited about. Like one day I feel like I just have this feeling that we're going to be speaking at a conference together. I really want that to happen. And RSA is like one of the biggest. Obviously IAPP is a privacy conference. It's huge. And I've been a member of IAPP and had certifications with them for like years, since like 2015. But I really wanted to do RSA because it's really the blend of cybersecurity and privacy. So honestly, this sounds really bad. I don't even remember what I spoke about last year on the panel, but it was great.

Yeah, I watched a bit of it. But that's good that you're going back and talking more about privacy because, yeah, it's a huge topic and we see so much growth in that area. There's so much going on in terms of the legal side of it. Like right now in the United States, of course, people are pushing to get more of a federal space set of laws and. But right now it's just being done by states, so it's really difficult to keep up with, as you said.

Yeah, the US is making it very hard. But the way that I recommend is go with the strictest privacy laws in every section. So GDPR is stricter in some sections randomly. Illinois really strict in biometrics. So I'd follow their laws. CCPA is very strict in certain areas. And so I would just like get a privacy lawyer, have them, map out them the most. I mean, and obviously the most popular are GDPR and ccpa, but there's LGPD in Brazil. There's a lot of really strict privacy laws all over the world. So if your company is global like you need to make sure that you are abiding by all of them. If you're only in the US it's a little bit easier. I would just look at all the different state laws. However, like you said, there's a lot of new state laws coming up, so it's a little bit more difficult. Most people, I would say, align to ccpa, but yeah, I mean, I would just align to like the strictest and try to be the best.

Yeah, sure. Switching gears just a little bit and focusing more on the personal privacy side. You know, one of the things that we see a lot here when it comes to research, third party, off the shelf research. It's typical for people to score really high on being concerned about privacy. But then there's this gap when it comes to what people actually do about it. I'm just curious, as you're out there talking to people and sharing content on social media, are you finding a formula that might work to, I guess, to resonate more with a mainstream audience, to get them to actually take action to protect their personal data?

Yeah, so there's a few parts of that question. So the first is, how am I going to get them to like, take action? And to me, the reason why I think social media is awesome is because I get to constantly post videos about what happens when you don't do that. And so I think, I mean, they always say you have to see something seven times in order for us to even like, understand it. And then I don't know how many times in order for us to even take action on it. I don't know if there's a study about the action part, but even understanding seven times. And so anyone that follows me, I'm constantly sharing why it's important, what you should do, what hackers can do with your information. And I hopefully allows people to start realizing more and more how important it is to take their data privacy safely and securely. And yeah, just make sure it's really important. I think the next thing is, how do they do that? And I mean, there's a few ways. And the two ways that I say are the most important is limit the data that you share as much as possible. And the anatomy labs obviously, like allows us to do that with making sure that we can generate kind of real working phone numbers and emails and assignments to specific people. I literally use it all the time. I don't ever give out unless it's like something really important like an Amazon or something where I'm like, okay, I'm actually going to use this a lot. I should probably give my real email. And even then I kind of have separate emails for everything. So, like I have one email for like online shopping. And it's really only two websites. It's Amazon and another one which I won't mention. And then the other ones are for banking. I kind of separate banking out as well. But just trying not to have your digital footprint get bigger and bigger. Right. And if you're constantly using the same email and the same passwords everywhere your digital footprint is and name affiliated with that, your digital footprint is going to get bigger and bigger. The other thing is from the US perspective, so that was like, the first part is like just limited as much as possible. From a US Perspective, we have a lot of companies collecting our data, even the government sells our data to these data brokerages I find ironic. So I use a company called Delete Me because I legitimately, like, I can't keep up with deleting it all the time. But there's hundreds and thousands of data brokers that make it very easy for you to just search someone's name and get all of their information, including, like, sometimes, like, their home address and their parents and their siblings and their kids. And I just don't want it out there. So it's trying to actively delete your data off data brokers, at least off the main ones. There's like five to 10 main ones. And I show how you can do it on my profile and then, like, limit your data as much as possible. And then from there there's always, like, the precautions of, like, not getting hacked, which is like using password managers and turning on multifactor authentication. Although the government now is saying for multifactor authentication, you should actively not use a cell phone number instead because there's so much SIM swapping going on. But, yeah, like password manager, multifactor authentication, vpn, those are the three key things to keep them safe. But in general, to protect your personal data, Limit your data as much as possible and try to delete the data that you have offline. And that is not just in data brokers, but any random websites that you go on and you don't use anymore. A good way to tell this is going through your email. If you are using the same email and seeing all the emails that you get from all the companies, they all have your data. And it's not just pressing unsubscribe, it's going and actively asking for them to delete your data. And then once they confirm that they deleted your data, then you can unsubscribe and delete the emails. But it's a process that you have to take. And I know all of us, including myself, when we first started the Internet, we wanted to sign up for everything. We wanted to go on every website and create an account. And it was, we get 20% off if we create this account. We just did. The digital footprint, I think at the beginning was massive. And now I'm just trying to, like, lessen what I give. So I don't know. Rich, what about you? I just spoke your ear off, but those are kind of the things that I was. I preach about.

Yeah, we're always trying to figure out, how do you get the message to resonate with people? And a lot of times, what it seems like for me is something unfortunately Something had to have happened. Somebody gets hacked, Somebody's credit card information gets stolen. I taught a small class on privacy at a conference last year, and someone said that their baby monitoring system was hacked and she heard a man's voice come through it, right? So now she's more interested in what happens to her data. And I'm just trying to figure out how do we get to someone before something like that happens. And it's hard to do because you're competing against a whole world of messaging that people are getting bombarded with on a daily basis. But we like to call people that really, they're interested, but they haven't really done anything yet. We like to call them, you know, the normies, if you will. And I guess the question that I would have is, like, what is the first thing somebody who's just completely new to privacy, should they just get a vpn? Should it be a password manager? Should be a strategy for managing passwords. What would just be one thing that someone could do to start?

Oh, no, one thing. I think it depends on, like if they've already been breached or they're like concerned about something specifically. Normally, I think the most important thing is change your passwords. And I say this and I want to hit my head against the wall because it's very annoying to say. And it's also like, I know it's annoying to implement. I can. The only reason why I am able to do this because I have a password manager. Passwords are super important. And I think a lot of people think, oh, well, I have like a kind of the same key password and then I add like a few extra things at the end. That doesn't matter either. Like, there's a very easy algorithms for hackers to use. If one of your like base passwords is out there to like run an algorithm and use that to like find. If you can add a 1, you can add a 1, 2, 3. You can add a 1, 2,3 exclamation point and do that within minutes and get into other accounts. And so passwords are like so important. The other thing we always say is it's like giving out your key to a million people to your house, right? Like, if you're using the same password and you're like, okay, well I use it on this site. And then you're like, oh, I'm going to use it on this. I'm going to give my other friend a key. I'm giving my other friend a key. I'm going, what happens if one of your friends is not the smartest or the safest and they accidentally lose your key. Then someone else has your key to your house. So it's like, how many people do you trust with the key to your house? And I trust no one. I don't know if that's just saying something about me, but I trust no one but myself at this point. So, yeah, I think passwords is probably the best bet. But again, depending on what you really want and what you're trying to protect and do.

Let's take a quick break for this message from our sponsor.

Picture this. You are a key decision maker at your credit union. Your tellers are tired of the lengthy KYC process. Fraud is a constant worry, and onboarding new members feels like a marathon. But what if there was a way to streamline it all? Enter the Sudo platform. Our reusable credential technology transforms a traditional KYC process, reduces fraud, strengthens communication security, and streamlines member onboarding. With Sudo Pro platform, you can prevent fraud, save time, and create secure digital identities. And the best part, it's built right into your credit unions app. This is more than innovation. It's a commitment to providing your members a rewarding experience. We're live and ready to redefine how you do business. Don't wait. Give your credit union the upgrade it deserves. Identify any member in any channel at any time, all while improving convenience and reducing fraud. To learn more, contact us@seudoplatform.com that's pseudoplatform.com.

And what about you, like, personally? Obviously, given the nature of your job, you spend a lot of time creating content. I mean, do you find it difficult to balance that need between, okay, I gotta get my message out there because I'm in the public eye, but I also need to protect my personal data and my safety.

Yeah, well, that's why I use delete me, because I'm like, I can't have these people know my address. But there was a point like a year into it where I started getting big and I was like, I was living with my brother at the time and he was like, caitlin, if we get some crazies showing out of our door, like, I'm going to flip. And I'm like, okay. I mean, I didn't practice what I preached. Actually, surprisingly, you know, as cyber security professionals, a lot of times don't practice what we preach. Like, the amount of times I've heard that the people that are failing the phishing test are cybersecurity professionals is actually kind of sad. But I do practice What I teach, I have, I use the leave me. I have a password manager, I have a vpn, like all that stuff and I really make sure I do it. Obviously sometimes I will say this, a blanket statement is a lot of times websites and stuff don't function well with VPNs which makes it very annoying. I don't know if you've ever experienced that. But like a lot of things just don't work well with the vpn even if it's a VPN out of the US I mean I feel like I have a big target on my back and I've kind of chose this. So I've chose to be in the. I picked my poison. I think it's worth it personally. Knock on wood. Yeah, I just trying my best to literally eliminate my digital footprint minus like all of the videos. And I will say I am worried about someone stealing my voice but I have precautionary measures with my family and my close friends of like if this happens, these are my safe words. But yeah, I'm pretty. I try to practice what I preach. What about you?

Yeah, no, the AI and the deep fakes are really scary. I just saw it was a few weeks ago. I don't know you've caught this article. There was a person who faked a CFO with a deep fake and joined a meeting. I think it was a zoom call. Got somebody, a member on their team to believe that was actually their CFO and got them to wire just an incredible amount of money. That's eye opening to know that again your voice prints out there, your face, everything else. And somebody could come along and do that and replicate you and just like that, money's gone.

Yeah, I do check my bank account statements pretty frequently and a lot of other things. I do monitor a lot of stuff and I have, I actively have monitoring on a lot of other channels accounts, multi factor authentication I do all the time and I don't do it to the same phone number either. I'll do it to different phone numbers so they have access to one, they're not going to have access to the other. It does make it very difficult to sign on or do anything. But yeah, okay.

I think you're right though. I mean if someone can only do one thing, it's definitely take major precautions on passwords because I've had breaches before. I just had an account that I don't use very often. It's an old email address that goes back a long way to one of my frequent flyer accounts and it's on me, it's my fault. But somebody got creative enough to figure out how to get in there and then they stole some miles and booked a one way trip from Europe to somewhere else overseas. So it's like, wow, well, can they.

Like find their name? Because they only have to like register your name to go on a flight.

That's true. Yeah. And we have that. But it's really tough to get law enforcement to do anything on these one off cases. Like I, I got my miles back. Everything was good there. Even though the airline still blamed me, I guess it was my fault. I guess I could take some of the blame, but yeah, you would think. But I just, I didn't pursue it. But it's a shame. This is probably going on every hour of the day, I would imagine.

Yeah, I will say I, I heard something really, really clever from. I won't say what companies. I don't know if they want me to tell, but a company was actually starting. Instead of having you do your password and then like the multi factor kind of code, they actually had a multi factor code first and then you entered the password in later. So it avoided credential stuffing. Because if you don't have a way to constantly hit credential stuffing and you only have a way to do a code and it's like you, I think you have two or three times. I don't know if it was an actual code, but they did it some multi factor step before they even hit the password step.

That makes total sense actually. Yeah.

Yeah. I'm like, why is no one else doing this? Can we talk about this?

Yeah, that makes total sense. Yeah.

Why are we having passwords first now? Like just don't have your password first, have it second.

I guess as we wrap up, I want to be respectful of your time. Maybe you'd like to talk about some of the work you're doing. It sounds like you've got a lot of things going on. Online courses, obviously your content creation, work merchandise, speaking engagements, consulting. I think you've even got a, I think a cybersecurity boot camp too.

Yeah, I honestly, I don't know what's going on in my life every day. I'm like very confused, but I'm very happy about it. So like I said, there's kind of like three buckets of who watches me, follows me. One is the general public. And so there will be a book and an app coming out. The book is kind of like a high level overview of like what is cybersecurity? How can you be Safe and like on the most basic level, the app really goes through. Okay, I just got the nest. What do I need to do to make sure that I'm setting it up securely? So it's like very specific steps. Then I have people that want to get into cyber security. So I will be having a course is coming out in like three or four months. We have an intro course already. I'm in the process of refilming it because I filmed it two years ago. And then we'll have that questionnaire and those will be free, a lot of free resources. And then we'll have available for purchase like the specific areas of specific domains of cyber security. And then from kind of a B2B perspective on overall training and awareness. I think I'm in the middle. I'm trying to partner with a company right now because a lot of companies have cybersecurity training wrong. In my personal opinion, they're doing it wrong. You're not supposed to train your employees as if you're trying to protect your company. You're supposed to train your employees as if they should be protecting themselves because once they feel empowered to protect themselves and they're going to ultimately protect their company. So I'm working with the company to kind of build out more cybersecurity short form content, fun content that actually is relatable and digestible for their employees. And then obviously I have a bunch of speaking engagements coming up. I have merch that's probably going to be launching soon, a lot of incredible things. I have mentors that are like, we're trying to figure out projects. So I would ideally like to create a kid show. I've been working with the government a lot to try to get more people into cyber security and train them correctly. So yeah, there's just a lot, but I'm, I'm happy to be here. And if anyone's listening, you're like, hey, I want to work with you, let me know. Because I'm just trying to build a better, a safer community and empower more people to get into cyber. So as long as I can do that, that's all I care about.

Based on all you just described, it sounds like you have virtually no free time.

Yeah, none. I literally just had a friend come in from, visit from, meet me from London. I had quit my full time job to do this and then I was like, yeah, I'll have so much free time. I'm not good at free time. I'm sure you're probably the same. I'm really bad at free time. I'm working on it. It's a quality that I need to find, figure out and find, but.

Well, that's awesome. This is great. I'm glad that there's people out there like you doing this work, and we need more of it, for sure, because this whole overall topic, it's not going away. And with AI like we were talking about with deep fakes, and of course, bad actors are going to find ways to use that to their advantage. It's. It's just going to get more dangerous out there. So I'm grateful for you, and I hope you can inspire more to do this.

Thanks, Rich. Yeah, I appreciate it. And thanks for having me on. I absolutely love. Your podcast is great, and it's the same thing. You're educating and inspiring and communicating indigestible pieces, what people can do with their own privacy. So I appreciate it.

That's all you can do, right? You try to meet people in the middle and hopefully you impact a few.

Yep, exactly.

Okay, well, thank you. I appreciate your time and. And good luck to you.

Sounds good. Thanks, Rich.

Thanks, Caitlin.

Well, that's going to do it for this episode of Privacy Files. In our next episode, we'll be talking about the story of how a former New York Times journalist was scammed out of $50,000 in cash in a matter of a few short hours on Halloween. Until next time, don't forget, privacy is a human.