Seven Digital Risks of Doing Business Online

Well, greetings everybody. Welcome to the Wednesday, April 22nd, 2015 episode of Free Webinar Wednesdays. This is Eric Cook, and I'm with WSI Internet Consulting, where we work with businesses and organizations in helping them better understand and leverage the power of the internet as a strategic business tool. You can learn more about me and WSI online at www.poweredbywsi.com. With me this week is my good friend and Free Webinar Wednesday partner, Mr. Jeff Simpkins. Jeff, say hello to everybody out there in Free Webinar Wednesday world.

Greetings everybody, this is Jeff Simpkins. I'm with Community Bank Consulting, Inc., and you can learn more about me and Community Bank Consulting online at www.communitybankconsulting.com.

So Jeff, as I was stating—

I want to make sure of you With snow this morning or yesterday?

I was just going to say, as I was thinking of you this morning, I had to take the garbage down because Wednesday mornings is garbage day and it was snowing. And for those of you that are frequent flyers here on Free Webinar Wednesdays, you usually get to hear Jeff and myself lament a little bit about the weather. And hopefully we'll be getting to warm weather here soon in Michigan so people won't have to continue to listen to me complain But for those of us that are in the north, and if you saw it too, you were probably just as disenchanted as I was. It was snowing this morning, and I took the garbage down, and I took a picture of snowflakes on my coat, and somewhat of a disheveled, disappointed, frustrated, like, really? It's almost May, and it's still snowing? What's up with that? So I suspect you didn't see any snow on your end, Jeff.

You would suspect right. It rained for about a week here, but no snow. Yeah.

So yeah, pretty frustrating. But I guess we take what we can get. And c'est la vie. So we'll get there sooner or later. It'll just make us appreciate summer months that much more. But it's funny that you brought that up because you were top of mind as I was taking the garbage down the driveway. I can't wait to tell Jeff that it was snowing, but you creeped me on social media and must have seen my Instagram post.

Set up in my Facebook newsfeed, their algorithm. I think you and I are buds because I think you show up.

Yeah, it must. Zuckerberg knows us all too well. So Hey, I shared a little graphic.

On your phone.

WhatsApp?

Because he's been listening in on your phone through the Messenger app.

Yeah, exactly. So hey, I shared with you before we officially got started, but I've got this cool little screenshot. And I see we do have maybe 1 or 2 people that are dialed in via the telephone. Jeff, would you like to explain what this little screenshot means and how it can be advantageous to the folks that are joining us maybe on the telephone?

I would be happy to. In the past, we have had folks that have joined the webinar from the United States, and they used the default number that showed, and that number was a number in Canada. So if you're dialed in and you're in the United States and you want to make sure you're dialed into the United States, check your number and Click on the— as Eric has circled—

Or squared. Or squared.

Squared, yeah.

And additional numbers.

Squared. Somebody knocked on my door, so that's why I was distracted. And additional numbers, and find the country that you would like to locate a local number for. There you go.

Now I did catch, it looks like, and I don't know if they've been listening to us here on Free Webinar Wednesdays kind of lament about the majority of the people are calling from the United States. We'd like to have that changed. When I opened it up today, it actually did have the United States number as the default. So just double-check, see if you're calling in from someplace that it's there. And then we've also grabbed a quick little, here's how you can go ahead and send us comments and questions, because we do like and certainly appreciate when we've got some interactivity. with the show, so feel free to engage. So there's a little public service announcement with some markups, compliments of one of my favorite programs called Jing. So great little tool to do screenshots and arrows and boxes and callouts and all sorts of other cool stuff.

Awesome.

So with that, just a couple of reminders. All Free Webinar Wednesday shows are recorded and made available at freewebinarwednesdays.com. So as you get done with today's show, If you'd like to share it or watch it again or pick something else up that maybe you might not have caught entirely, you're welcome to do that. And we certainly appreciate you spreading the word about Free Webinar Wednesdays and sharing it with friends and colleagues. And then, you know, that question box, it's there for you to use. So if you've got questions, we have an attorney with us today, so I'm sure she—

Eric, we just lost audio, I think. Am I back? Now you are, yep.

Okay. So as I was saying with Deborah, go ahead and use the chat box, and you can go ahead and ask questions, and Jeff will be monitoring those since I'm going to run the slide deck. And give us an opportunity to go through. So with that out of the way, it's my good pleasure to welcome back to the show, although she was a guest a while ago, Deborah Gonzales, the founder of Law2SM and actually the partner of which we have created together a new service called Digital RCP.

Hi.

which is really focused on helping businesses understand their risk as it relates to compliance and legal and strategy and all sorts of other wonderful things that go on once you go online. So with, with that, Deborah, welcome to the show and back to Free Webinar Wednesdays.

Well, thank you so much for the welcome. I'm glad to be here, but you guys were talking about snow and rain Unfortunately, where I am, it's hitting about 80 degrees, nice and sunny.

Good for you.

Rub it in. So, and I also didn't mention in the intro that Deborah is also an author to a pretty cool little book that I have sitting right here that I've used as a resource on a number of my presentations called Managing Online Risk. And so all sorts of cool stuff. So today we are going to talk about the risks that exist in the business world for companies and organizations that are going online and some of the things they should do to help mitigate that. So I am going to be the clicker. I am your Vanna White, and Deborah is going to go ahead and lead the conversation. So with that, we will go ahead and get started.

Great. Well, thank you, Eric. And if you would go to the next slide. I think people have seen my picture enough. And so what I want to do today is I want to talk about 7 particular digital risks. Now, there are a lot more than just these 7, but these seem to be the ones that are either on the top of most of businesses' minds, or even one— you'll notice that I have children there as number 5— where people might not even think of as a digital risk. And we're going to get more into details as to why that is a risk that we need to start taking into consideration, especially since we know that the personal and the professional has blurred so much because of all of this online technology that we're using. These are not in any particular order, and I always give a disclaimer that the information that I'm going to share with you is for general educational purposes only and should not be construed as legal advice. And as I said, this is just a very small piece of all of the legal compliance and risk aspects that are out there when you deal on online activity, as well as social media activity. And some of these, I would assume that most of you have heard about. You've seen them in newspapers and news headlines around. And we're just going to delve into a little bit of the risk aspect of them. Next slide. Okay, so the first challenge is this idea of the mobile, and the BYOD is bring your own device, but I've seen it as BYOA, bring your own app, BYON, bring your own network, or BYOA again, bring your own anything. It seems to be that not only are our employees carrying around their cell phones and their tablets with them. And let's not forget that it's not just a telephone that we're talking about, the smartphones, but also the tablets that have sort of pervaded our business environments. And in a way, you know, people are trying to find ways where they can actually substitute their desktop and laptop with the tablets now. But this idea that, you know, everybody's connected 24/7, 365 days When do we turn off, if we ever turn off? And because of that connectivity, a couple things come up. First of all, does it mean that then we're liable since we're connected all of that time to be responsive to our customers and our clients and our employees and our subordinates 24/7/365? I mean, it's really blurred the line of when service can be expected. Expected versus when the customer expects it. You know, it used to be sort of default accepted that it would take 24 hours, right, before you got a response to an email. Today people get very upset if they have to wait even more than an hour. And added to that, you've got lots of businesses that will even have a chat box if you go to their website so that you can chat immediately with someone. And I've seen, you know, frustration levels rise when you click on the chat box and actually nobody is there. So one of the things to keep in mind is as you're looking at this aspect of who has mobile connectivity in your particular business is how are they using it. We know that most of the time online or social media activity is not done in an hour at a time, it's actually done in minutes, right, when people go and take a break They go to the bathroom, they go out for a smoke, they go on their lunch break, but all those minutes accumulate, and this is where a lot of businesses get concerned about lost productivity because those minutes tend to communicate— accumulate, I'm sorry. But the other thing is what kind of security aspects can you put on these mobile devices? And I don't know, but there are many regulated industries like the financial sector and banking where they might not allow attachments to come through on emails into the bank's official email system, and so the individual employee may actually set up sort of a personal email and tell people send it to me that way and then have it forwarded, or use things like Dropbox, and so they get around some of the security features that are already set in the official system. systems. So I think it's important to take a look at, you know, what's happening in mobile. It's not going to go away. I think we're going to see much more in the evolution of this technology become even more pervasive. I mean, we have the Apple iWatch coming out. We have the Fitbits, which we're monitoring our sensors. But now we have this Dick Tracy gadget, right, that we're going to be able to wear on our wrist. that can do a lot more than what those other items were able to do before. Next slide. The next challenge is authentication. And, you know, how do you prove who you are online anymore? And how do you protect that when we talk about our personal information? And, you know, it was funny because Jeff sort of joked with Eric, well, you know, Facebook knows what you're doing because they're recording you from that Facebook Messenger app. And there's no— once the Facebook Messenger app is activated, there's really no more authentication that needs to take place to sort of control the information that's being recorded. But we're seeing new things now that sort of say, look, beyond the passwords, there are other ways to prove who you are. And we end up in this area of biometrics. Whether it's a fingerprint, like what Apple first brought out with the iPhones, whether it's a retina scan. There is an app for mobile banking that's seeking funding right now called EyeVerify that's specifically for mobile banking platforms that once the individual puts in their password, then they also have to take a picture of their retina. And that gets screened to identify them. I don't know if it was a hoax, But this morning there was an announcement that PayPal was going to ask for a new security measure where people would have to swallow a pill. I'm not sure if we're getting that far yet. But all this is important because of this issue of identity theft and the loss— you know, we've heard a lot about the hacking and the breaches and the loss of data for consumers. Target, Home Depot. I mean, we can list them on and on and on, but the issue is how do we protect that personal information if we don't have a way to prove who we are? And when you have your customer base that is trying to go online and access your services online, how are you making sure that it is them and not somebody else? And this is going to be an issue that's going to be very important for any business that offers online services where it's going to be direct and customized to a particular customer. Next. So here's the social media background checks. Now, you know, it's really interesting because whenever anybody talks about social media and human resources, people get Very concerned. And so, you know, one of the things is that Eric put here, careful what you look for, you just might find it. It's amazing what you can find out there about anybody. I have a habit, if I'm going to meet somebody for the first time, I will Google them to find a picture so that I know what they look like, so that while I'm waiting in the restaurant, I'm not just pointing to every person who walks in and seeing if that's them. But these social media background checks have brought in a series of discrimination lawsuits claiming that if recruiters, if companies are using the social media data that appears, right, part of that can give them information that would be considered illegal when it comes to interviewing candidates. So for example, you, you can't make a decision based on gender, You can't make a decision based on religion or ask a question about religion. And yet from some of the pictures or photos that you see on social media, you can very well determine what religion somebody may be, or you can make an assumption, which is even more dangerous, of what that person may be and find that illegal. So we're seeing that there are third-party vendors that are showing up in this space that are offering to do the background check for the company, and then to filter out all of those defining characteristics so that the company actually gets sort of like a clean report without gender or religion, et cetera, et cetera, identified there. But a couple of issues also come up with the social media background check. One of them is, do you even have a consent for it? A lot of companies have a very standard background check form that candidates will go in and sign. Well, you need to take a look at it and see, does it have the language that includes social media? And the other thing is that the information that courts have deemed that employers are— have a right to is the information that is publicly accessible, right? Information that's not protected by a password, for example. We have laws in some states that say an employer cannot ask a candidate for their social media platform. That would be considered illegal. Also, there are some states that go a step further with that law and says that employers cannot even shoulder surf a candidate. So you can't go to a candidate and say, well, log into Facebook and then Let me see what you have there. You sort of turn pages. That's not allowed either. So you want to make sure, first of all, that, you know, you are having that consent and putting the social media language in the consent form, but too, that you are educating not just you but everybody in your company that may do recruitment or may go out to try to find an employee to be careful of of these certain sort of red flags that we have. Next.

Okay.

So here is something that everybody is really concerned about online. This idea of, you know, I'm there, I'm building my reputation. There's a famous saying that says a reputation takes years to build and 140 characters to ruin. Because we know that a lot of things that happen on social media, number one, go viral, number two, happen so quickly, and number three, has the capacity to really escalate into something much worse than what it began with. And so we end up with these issues of freedom of speech. What does it mean in the online world? Can we just say anything that we want to? And then if that is true, if people can say anything that they want to, how do you deal with these trolls or haters or people that are just out to ruin your reputation, not necessarily because they have a valid complaint against your product or service, but just because they felt that you're going to make a good target? And so one of the first misconceptions to clear up is that freedom of speech is not absolute. Not in person and not online. And it's really important to know that there are specific instances, like yelling fire in a crowded theater, right? That is considered illegal because of the safety issue in that. Now online, the problem becomes how much can we really have a safety issue, or what the courts will call a real Correct. And we have our first case. It was heard by the Supreme Court in December. We're hoping that by May we'll actually have a decision. And this was a case where a gentleman, his name is Elonis, basically put up some posts. And his wife and the FBI claim that these posts are real threats. He claims that they are rap lyrics. But if you look at the specific wording of these, there are things like he, and I'm paraphrasing right here because I don't have it in front of me, but he sort of said something like he was going to go and find the first elementary school and make the worst school shooting. He was going to take his wife's restraining order and put a bullet through it. He was if another FBI agent went to his house, he was going to put him in the grave. I mean, there were very specific posts that sort of addressed number one what was happening in his life, and number two because of the type of personality he had, the rest of the facts sort of bring up the point that this was not just a rap lyric, that he had every intention. Of harming somebody. But we don't know how the Supreme Court is going to decide. The appeals have said that he was guilty, and that's why we have another appeal to the Supreme Court to see if this is the way that they're going to define First Amendment and freedom of speech online. So I think that's important to be aware of, and that should come out in May. As for trolls and haters, you know, it's really interesting what happens when we become targets. Can we retaliate? Can we respond back? And, you know, this is part of our PR crisis plan that we need to have in place when we're engaging in social media, is to make sure we know how to respond, whether we should respond. There's a lot of There are studies being done now on conflict resolution in the online world and it's something that I'm working on in terms of sort of digital self-defense. And so keep on the lookout for that. But we've had some horrible examples of online lynch mobs where people just take up a cause. They don't know the victim. They don't know the complaint. They just decide to add To it. And so it's really important that if you're being attacked online or your company is being attacked online, before you respond, take a step back and ask yourself some basic questions. What exactly was said? Was there something that we did that was wrong that sort of started this? Who is the person who's complaining or making, you know, all of these accusations? Do they have a— Are they just a troublemaker, or have they been a great customer up to this point? See if you can reach them offline, right? Tell them, can you— can we direct message you? Can you give us a number? Can we get back to you? But sometimes your response may be not to respond if it's truly a troll. And one of the famous internet memes out there is don't feed the trolls, right? Right, because what you do is instead give them more ammunition because they know that they've gotten to you. So that's number 4. Do we have any questions yet?

We do not. The question box is clear.

Okay. The one, and it's kind of unfortunate, I know this kind of brought a lot of the— this particular issue to light, but many may remember when Robin Williams passed away.

Yeah.

His daughter actually was run off of Twitter because of the trolls that came out that were just very nasty and saying abusive things about her father and how he wasn't a good person. And it just— I believe she's come back now, but she literally had to leave and just take a break from Twitter because that network seemed to be ganging up on her. And Deborah, I don't know if Twitter seems to be the network that kind of personifies the trolls and the haters more so than some of the others, but from some of the podcasts and things that I've read, it seems like a fire can get started and rage out of control probably probably faster on that network than others. I don't know if you have any comment on that or not.

Well, one of the reasons, and we have a statement by Twitter's legal counsel saying that it is a problem for the platform, and that they are looking as to what else can they do. And Twitter, Facebook, Instagram, all of them have actually put up sites in their help center To help people with this issue of abuse online, right? We call it cyberbullying, cyberharassment. We've had, unfortunately, suicides because of these issues. And it was really sad with Robin Williams' daughter because they also not only talked about her father but also talked about her not being a good daughter. Now, the problem is, of course, who can know that, right? And yet here are these people making these accusations. On Twitter, which is a very public platform, more public than even Facebook, because on Facebook people have to be your friends or they have to fan you. On Twitter, unless you're in their verified program, anybody can follow you and anybody can direct message you. And so you've got a much bigger audience, right, that's going to go out or that has the capacity of going out to attack somebody.

I think one of the other elements, and this is just kind of me watching the different networks evolve, when you take a network like Facebook or LinkedIn or even Google+ for that matter, those are networks that you have to have a genuine real identity. I have to sign up for Facebook and I am Eric Cook on Facebook. I am Eric Cook on LinkedIn. Anything that I say is directly related back to me as an individual. I think what creates an opportunity on Twitter and some of the other sites is I can have, you know, @BikerDude1970 and totally hide that it is Eric Cook from Battle Creek, Michigan, and I can hide behind that Twitter handle and say whatever I want, and nobody really needs to know who exactly I am. So I have So there's some sense of anonymity there in the perspective that it's not directly being attributed back to me. And I think what we've seen is a lot of these trolling hater accounts are very difficult to find out who the real person is behind it because they've set up these accounts almost as a cloak so they can go around the internet and basically be jerks. And, you know, I know that's again, you'd mentioned a lot of what they're trying to figure out, but I think as a business looks at their kind of risk management process, that's something worth considering if they're in an industry that could potentially cause some discussion or volatility. I know in Michigan right now, um, there's a gentleman who came outright and stated that his business would, would not serve individuals of the homosexual variety And that has created a pretty nasty firestorm. And he's not only getting a lot of hate through social media, but they've actually taken to physical vandalizing— physically vandalizing his store and other sorts of stuff. And, you know, I don't agree with his position, but, you know, it's, it's pretty easy for people to take a position and just go nuts on it.

It is, and it seems to be even easier online because you're not seeing the other party, right? You've got this screen in front of you. There are tons of studies about this issue of anonymity and the reason why there's so much hostility online because of that. And so businesses who are trying to protect their reputation all of a sudden find themselves, you know, with a website out there of their company sucks.com, how do they deal with that? What approach do you take? How big is the— and the other thing with anonymity, when you don't know your enemy and you don't know what their interests are, how do you know that it can ever be resolved completely?

Right.

Now, you know, there are mechanisms. There's a whole area of forensics computers that allow to look for the actual IP, even if you don't have the individual's name or identification. But there's still a lot of legal hurdles to get through making that one-on-one connection between the IP address and the individual who actually put in those comments and those targets. So there's a whole bunch of issues on that. We can do a whole show just on The idea of being civil in the digital world.

Yeah, almost digital road rage.

Yeah. So here's the one that I wanted to bring up that I don't think many people think about— children. And we know that our personal and our professional lives really do blur. I mean, it used to be that we were complaining about, well, You know, 9 to 5, that's the work hour. Everything after 5 or before 9, that's my personal time. Whatever I do is mine and mine alone. But what we're finding is that people have very different work schedules than they've ever had before. Lots of people are telecommuting, so they don't necessarily are there 9 to 5. They might actually, you know, have a hybrid type of hourly, hourly Designated time. There are people who work, for example, 4 days during the week and then 1 day on the weekend, or will work only in the mornings 7 days a week. It's all very different, which means that not only are our hours different, but where we actually work is changing. And a lot of us will bring home, you know, our cell phones, right? We don't necessarily have 2 different ones, one for the job and one for our personal. It becomes very— Blended. Burdensome that way, so usually we have just one. We do the same with our tablets, and what happens is we've had situations where, you know, you put your tablet down on the table and your child comes and starts pressing on it, right, and starts doing all of these things and accessing your email and stuff like that, which can actually make you vulnerable to security concerns, but also make you liable for the leakage of confidential information even though you say, well, it's just to my kid. But it's not the idea that it's just to your kid. It could have been anybody who was in your home. It could have been anybody who was in that restaurant when you had the tablet out on the table. It could have been anybody that was at the park where you were. So the idea of security today is that you can't just look at it from the device itself. But from you and where you are and how you're engaging in that device. And so children are a very easy way, we don't think about it, right, we put them on the tablet, we give them the app, but it doesn't necessarily mean that they're going to stay on that app. It's interesting, the studies that they've done with babies, and they put a tablet in front of the baby and the baby knows to, you know, touch the tablet, it knows to move things around. They've done these studies as young as 6 months old with these babies. So I think we really need to be aware— when I put children there, it's also to be aware of what happens when we're off the work premises, when we're on vacation, when we're just in commuting traffic, right, on the bus or the train or whatever it is that you take to get to work or to get back home again. It's not locked up in the office anymore. It's out there wherever we are. And I think the iWatch and those Fitbits are going to add that in. And another thing that just came up that I'll add to this, you know, one of the issues that has come up is that for a lot of these social media platforms, you sort of record things, right? You take the picture, you record the video, and then you decide to put it up into that social media platform. But we also have Social media platforms that do direct digital streaming, so Meerkat and Periscope, where you're streaming it, you're recording it, it's uploading all at the same time, has now added a number of other concerns in terms of privacy of the other people that you're recording who may not want to be recorded. And this is something that's come up with these live Bloggers, individuals who record absolutely everything and now feel, well, it's their life, they're recording it. But you have to be careful about who else is in the picture with you as you're recording.

Next.

Next slide. Okay. So, and that's where we come into this whole concept of the Internet of Things. Things, right? Everything is connected to the internet. I saw a little news story about a crock pot that is connected and you have an app and you can watch it on your phone. I can't imagine why you want to watch a crock pot boiling for 5 or 6 hours through your app on your phone, but they were just showing just how far this connection is going. Well, about a month ago Sony came out and released a statement saying that if you bought a Sony Smart TV, guess what, it's recording you. And they also came out and said, but you know, it's recording you but we don't send that information to anybody. But somebody has that information and somebody will do something. And I think that's the concern with privacy, right? It's not just the information that gets collected, but then what is done with that information? Well, imagine that you're at a, you know, a meeting, you're talking about strategy, you're talking about confidential client information, and you've got a smart TV out there that's being recorded, that's connected to the internet, which is connected through your network system, which then gets hacked. And now they've got all of that confidential proprietary information about your strategic plan at their fingertips and blackmail, extortion can ensue. If you're trying to protect that, we're already dealing with instances of ransomware, right, where these hackers will say, well, if you pay us a certain amount of money, we will unlock your hard drive for you and you can get it back. So with the Internet of Things and the iWatch is one of these things that will be connected to everything, right? How far, right now I've heard a lot of people talk about the issue that, well, right now these things are all connected to the internet. But the next level is that they're going to start being connected and going to start talking to each other. And what's going to happen when that happens, when decisions about our home are really taken out of our hands? So next. So here's the compliance issue, which for a lot of regulated companies, they're always so concerned about, right? You have enough regulations to deal with. What happens when you're online? Can you even be online if you're in a regulated industry? Well, we know that the FFIEC the FTC, the SEC, all of these federal regulatory agencies have come out and said, we know you're going to be on social media. That's where your customers are. That's where your clients are. We understand that. But we also need you to adhere to the basic rules. And the basic rules are, if you can't do it offline, you can't do it online. If you can do it offline, Then online you may be able to do it if you modify a little bit, right? And an example of that would be the FTC with their dot-com disclosures report where they came out and they said things like, you know, you can't use a hashtag to issue a disclosure. So on Twitter you can't say, you know, National Missouri Bank, for example, hashtag disclosure. That they will not accept. But they did say that you can put a shortened URL that'll go directly to a disclosure webpage, and that that would be okay. So again, there you see you can put certain information; you just need to have that disclosure. And they recognize you can't put you know pages and pages of disclosures in 140 characters. But they do give you a way to do that. And so I think it's important to note that. Regulatory agencies are not saying don't use social media. What they are saying is use it within the guidelines, and those guidelines are there really to protect our consumers and our clients, so to make sure that we're protecting their confidential information, to make sure that they're informed about all of the things that they need to be informed about in terms of our institutions. And so regulatory agencies are just one aspect. There are also federal laws. We have a new bill making its way through Congress that deals with Cybersecurity Information Sharing Act, or CISA, and what they want to do is to make sure that companies are sharing information if they have been breached so that they can sort of get one step ahead of these hackers in that way. So, you know, federal legislation is out there. And then the different states will put in certain laws in place that you need to adhere to in terms of social media. So Delaware, for example, passed a law recently that talked about adding a digital executor to wills to pass along digital assets. And that affects small businesses, especially if there's has just a sole proprietor or a family business where things are going to be handed down to the kids. So that Delaware law does affect when you're looking at succession planning in a business when it's in one of those small types of organizational units. And these laws happen each year, they change, right? Even the Social Media Protection Act. Or laws that are put in by the states to protect candidates from having to give up their passwords. Those have been changing as well. So I think it's really important to understand, you know, number one, there are rules, there are laws, we need to follow them. But number two, it's not a prohibition against using social media. You just want to make sure that you're using it The right way. Any questions?

Question box for questions. Any thoughts on your part, Jeff? I've got a couple of other things that kind of popped in just for the good of the order. Give Apple a little—

I always find these interesting.

Yeah, it's—

things come up that I haven't thought of every time we do this session, which is good, hopefully.

Well, let's hope so.

Yeah, hopefully it's good. It's better to think about it now than after the fact, that's for sure.

Right. Yeah.

Deborah, one of the things, and I'm actually doing a little bit of investigating on this from a personal perspective with regards to file-level encryption and passwords, and, you know, we don't have children, and fortunately our dogs haven't figured out how to log into the phone or get access to our computers yet, so We don't have the children threat, but looking at kind of data security, one of the things that I discovered as part of the upgrade to the new Mac operating system Yosemite includes a system called FileVault—

Excuse me.

FileVault 2 that actually has a very robust Encryption capability built right directly within the operating system.

Right.

So if your computer falls in the wrong hands, you've got your hard drive encrypted, somebody pulls the hard drive out and they try to use it somewhere else. I think there's a lot of people, including myself, although I think I know what the risk is because that's why I'm kind of taking the next step, but I think there's a lot of people out there that maybe don't realize just to what extent the information that resides in their computer or their smartphones really could potentially expose them if even the basic password restrictions— and, you know, I know a lot of people that have got phones that don't even have a passcode where you can pick it up and just get on it and boom, you've got access to everything— email, contacts, all sorts of information. So Anybody that's using the new version of Mac, make sure that take a look at that FileVault too and get it activated. There's some other programs if you're on the PC side of things that you can also get that will encrypt your hard drive and make sure your information stays protected. And then to go along with that, I know one of the things, Deborah, when you and I travel, you will not get on a publicly available Wi-Fi point.

No.

For that very reason.

When it comes to me as an attorney, I'm also bound by the rules of ethics and one of those is the duty of confidentiality. If I do not use a secure hub, I can be disbarred because they take it that seriously, the risk of information being lost on these free Wi-Fi. And so I actually have a secure hotspot on my phone with my account. So you'll see me, and you've seen me take out my phone, set up my secure hotspot, and then connect my laptop to that. But you know, there's something now called the twin account or the phantom account where you go into a hotel lobby, for example, And they say, oh yeah, we have a password, here's the password. And you know what, somebody else has set up a dummy double network that uses their same password.

Yeah.

And so you're not even on the secured of the hotel, you're on this one that's out there. And I know that a lot of the things that happen is that you say, oh, I have to encrypt my hard drive. I have to do 2-factor authentication. So for example, on my Google+ account, not only after I put in my password, they then send me a PIN on my cell phone, right? And so then I put in the PIN, then I can get to my Google+ account. And that's what's called 2-factor authentication. You have to go through 2 steps to get into your account. But many people say, oh my God, that's so inconvenient. You know, if I have to encrypt and I lose my encryption key, that's it. I won't get my data. And it seems like so extreme to try to protect ourselves, but we do live in an age where people, you know, we're under attack of people trying to get our data because our data is valuable. And it might not be our individual data, but our contacts into our company network. And that data, the data that belongs to our clients, that's what they're after. And so, you know, we have to be very careful and take those extra steps right now. We're still in transition with these social media platforms in terms of security. So, you know, if you're going to travel, only take what you need to take. Don't take everything if you don't need to take it. Be careful about Flash drives, using flash drives from other people. That is the number one way that viruses get into laptops is by using somebody else's flash drive. So be careful about that. Make sure you know you're using your own flash drive so you know where it's coming from. And as we talk about protecting our data on our hard drives, our cell phones, also think about any of the cloud services that you're using like Dropbox. Google Docs, Google Drive, the Time Capsule for Apple. You know that whole big fiasco with Sony and with Sony Pictures and with I can't think of her last name Jennifer from the Catching Fire Mockingbird series. I hope Hunger Games. It's from Hunger Games. All of her photos that were leaked were actually on. an Apple Time Capsule drive. So as you're trying to do your backups and as you're trying to do your own security, do keep in mind about these other services that you're using that you're putting information on.

You mentioned multi-factor authentication for Google+. But I'm always amazed at the number of people that don't realize that that is available for Facebook. And particularly people that are administrators of their business page.

Yeah.

I know we have that enabled here for my business because we are an administrator for a lot of business pages. Some of them are banks. And the last thing that I obviously want to happen is somebody to compromise my Facebook profile and then get access to one of my clients and start putting false information on their page. And so that's part of our training process internally, but it's one that if you are an administrator on your own organization's page or you work with other organizations and help with keeping page information updated, everybody should have that turned on, but at the bare minimum, make sure that those accounts that are under your control have that enabled so that at least if something does happen, it's not something that can come through you, because then it's not an issue of how did it happen, it's what is your— what's your liability insurance and how much can we sue you for, because now you're the one that's at fault.

So Yeah, you brought up—

Not a conversation you want to have.

And I just want to piggyback off something that you said in terms of training people. Have this conversation even if you are a 2 or 3 person shop, right? Have this conversation with the people that you are working on, working with, because if you do everything that you need to do for security but the other people in your business are not, You're still liable, right? And you're vulnerable. And so you have to— you cannot assume that employees and other people who work with you have the same attitude or perspectives or even the know-how in terms of protecting the business against these risks. So you need to have those conversations. You need to write down your policies and share those policies.

Yeah.

You need to train employees on these issues because security and privacy and all of these risks go company-wide, not just by an individual.

Cool.

Alrighty. Well, I know we've got a few minutes left before the top of the hour, not that we have to stretch it out to consume a full 60 minutes. But, you know, these are all very helpful things. And I can tell you, when I participate in the digital risk assessment process through our Digital RCP effort, and Deborah kind of does what she does and shares what she knows, there is always something that I learn. And it is not that— it is not that it is done with the intent of scaring somebody off of social media or away from digital, because I don't think that is a realistic— option any longer. I think we all have to accept that these are just facts of life that we have to abide by, but making sure, just like when you get in a car, we all now buckle our seatbelt. And maybe— I know growing up I typically didn't. We just got in and drove. And so now there's other things that we just do as a course of life, and this is kind of turning into some of those things. So it's a good reminder, and as Deborah said, excuse me, from a training perspective, maybe even just play this video and do a recap and have that start the discussion, and then after watching this, then have some chitchat internally within your organization to see where everybody's head's at, what sorts of things they feel there might be some exposure, what sorts of things and areas might need to be buttoned up a little bit. At least get the ball rolling and have that conversation. It's a good first step.

We've got somebody that asked how you would set up Google+ extra protection.

You mean the 2-factor authentication? If you go into your settings options on Google+, there is a tab that talks about security. And your password. And when you click on that, it'll ask you if you want to do the 2-factor. It will also ask you, like, I had to give them obviously my cell phone number so that they would be able to send me the PIN.

Yep.

And that, that same function, if you go into Facebook, it's actually under your Account settings and security.

And on LinkedIn as well.

Yep.

So cool.

Any other questions, Jeffrey?

That is it. All right.

Well, I hope I didn't— well, in the silence—

What's that, Deborah?

That I hope I didn't scare everybody into silence.

I think everybody's just probably taking it all in. So on the last slide, I pulled up a picture of your awesome book. You want to close with just a little blurb about managing online risk and how they can learn more about you, and then we'll call the show to a close.

Thank you. Book talks specifically about apps, mobile, and social media security issues. Everything that I talked about today you'll find in that book. It is available as an ebook or regular printed book on Amazon and Elsevier, and it is continuously updated through its companion website, which is www.managingonlinerisk.com. And if you want just If you're looking for tweets from me that deal with online security, you can find that at @DGOnlineSec. If you're looking, however, to contact me with social media legal issues, you can do that at deborah@law2sm.com or Twitter @Law2SM. Thank you.

Very, very cool.

Good deal.

Well, thank you, Deborah. I really appreciate you coming on and sharing your knowledge. And I told Jeff in our pre-chat, Deborah and I actually have an opportunity to do a webinar together later today for another bank-specific network. So we are going to take about a 30-minute pause and then hop back on and talk about some more social media stuff. So I look forward to seeing you in about 30 minutes.

Okay.

But with that, we will go ahead and bring today's Free Webinar Wednesdays to a close. Again, thanks everybody for joining us and being part of the show. Remember to stop out to freewebinarwednesdays.com for this show's recording and recordings of all of our prior shows. Be sure to like us over on Facebook. You will get updates and notifications there of when the recording is made available. And I guess that is probably about it. So with that, we will go ahead and close the webinar. Thanks everybody for joining us. Have a great week, and we will see you next week here at freewebinarwednesdays.com.

Bye-bye. Bye-bye.