SBA NSBW Cybersecurity Panel Washington, DC - May 2, 2016

Oh, they're on already. Hi, everybody, and want to say hello to everybody watching on the live stream, either right now or over the course of the week during National Small Business Week. My name is Doug Kramer, and I'm the deputy administrator at the U.S. small Business Administration. Before we get started, I just wanted to say a quick word of thanks to our host here at the United States Institute for Peace, and President Nancy Limborg, who's a former colleague of mine and just a wonderful person. They've made a great place for us today to have several of our events around National Small Business Week and among the many educational programs that we're pushing out as a part of National Small Business Week, because really, there are two sides to what we're trying to celebrate. First and foremost, celebrating American small businesses their innovation, their economic activity, and everything they bring to the United States economy. We're also using this opportunity to push into information about sba, our programs, and to provide some important education that we want to make sure American small businesses can take advantage of. And so we're using really as a keynote here at the beginning of the week and broadcasting and going to save on our website information about cybersecurity, because we have, I think, thought over the course of the last year that one of the best things we can do in our counseling and education programs is, is make small businesses aware of their cybersecurity risks. So I want to take just a couple of minutes, very few minutes here at the top to set the background, and then I'll get around to introducing our great group of panelists here today and starting a conversation with them. But, you know, part of all the education we do comes out of this place that anybody who is starting a small business is working as hard as they can, has no extra time in their schedule, has no extra money in their schedule. So the things that aren't right in front of them are often very hard to get to. And in addition to that, any sort of obstacle that gets in their way can often be fatal to their enterprise. Something that a larger company might view as something that just cost a little bit more than expected, a rounding error in their budget or something that delays them for a few weeks can mean life or death for a small business. And we think that the cybersecurity challenge being very real and that sort of thing that's difficult for small businesses to focus on is a great threat there. So we're going to talk a little bit about that today as we get started. We want to remind small businesses that the threat of Cyber intrusion and cyber theft is very real for them, even though they may not always see it that way, because they measure their inventories and their assets in different ways. Almost every small business sits on a treasure trove of information that cyber thieves may have some interest in, whether it's their own intellectual property about their products, personal information about their employees or customers, or bank account numbers and credit card information. All of that's very valuable to someone who might want to come in and take that. This may be the most important thing I say in this whole presentation today, but we have found that almost half of all small businesses have been the victim of some sort of a cyber crime at some point. And the average cost per attack is $21,000. So that alone should sort of set the stage for what we're talking about today, something that has the that high of an incident. Incidents and that much cost for small businesses are something that is a real obstacle and something that we should be working on. And these sorts of attacks come in many forms. On the one hand, you may have ransomware attacks, which have gone up as much as 113% since 2014, where an intruder might come in and clamp down your system so you really can't do anything until you pay ransom to get it open again. You may have silent malware attacks where someone gets into your software, siphons off a lot of your intellectual property and information in a way that you wouldn't even know about. And others as you can just merely have extortion threats, too, where cyber criminals will come in and threaten to shut down your business and your system if you don't pay them money to leave it open. So in response to this, the Obama administration generally and the SBA have marshaled resources to bring together to help small businesses and help the federal government as well deal with the threat of cybersecurity attacks. Earlier this year, we partnered with the National Institute of Standards and Technologies, as well as the Department of Energy, to run a series of cybersecurity trainings for small businesses. Those and a number of other resources that SBA has pulled together are available on our website@sba.gov cybersecurity. So you can go at any point to that location and get either 10 quick hints or see events like this where there's a discussion of cybersecurity. The President, on his part, has released a cybersecurity framework back in February that is aimed to getting both the United States government and United States economic sector up to speed where they can defend themselves against cybersecurity attacks effectively and to show that he's putting his money where his mouth is. The 2017 budget seeks $19 billion, which is an increase in 35%, to deal specifically with cybersecurity attacks. So that's sort of the scene center. That's why we're here today. And we have pulled together a group of folks that are going to help us think through these issues and talk about some of the ways that they are real for small businesses. What I'm going to do at the top is I'm going to introduce each of them, and after I've introduced them, I'm going to put one question to them, and for each of them, I'm going to have them answer the same question. And that is for busy small business owners who again, don't have time and don't have resources, if they could advise to them one thing that they should do today or this week to drastically improve their cybersecurity profile before going back to the chaos of the day, what would that be? So we're going to start with Matt Littlejohn, who's from Microsoft. Matt is director on the Microsoft Cybersecurity Identity Azure Infrastructure Services team, focusing on the east region commercial customers. Prior to this role, he led the services sales organization for Microsoft's National Security Group. Matt has an extensive background working with the national security sector, with government agencies and with businesses so that they can really get a handle on their cybersecurity needs. So, Matt, do you want to kick it off for us?

Sure, thanks. I'm Mike four. There we go. Happy to be here. Thrilled for the opportunity. Thanks. And congrats to all the award winners from this morning. Pretty big kickoff for the week, which is very appropriate. I'm lucky enough at Microsoft to really kind of sit at the nexus of a couple of different things. One, the ability to interface not only with our customers, but also with our headquarters and our development folks, but also looking and focusing primarily on cybersecurity and the overlap with that into Identity and then the overlap with that into actually our cloud computing platform. So there's a continuum that runs through all three of those things, and bringing those together is really a very important thing for us.

Very good. Thanks. So next I'm going to turn to Stephen Cobb. Steven Cobb has spent more than 20 years advising government agencies in some of the world's largest companies on information technologies. He now works for the company eset, which works in this space with businesses to help them figure out find solutions to their cybersecurity challenges. In addition to his current job, Steven also co founded two different successful IT security firms that were eventually acquired by publicly traded companies. So he's had a lot of experiences in different areas of this issue, and we're happy that he could join us today. So, Stephen, thanks, Matt.

Yeah, so again, thanks very much to the SBA for shining a light on this, because, yes, I've advised some big companies. I've also advised some very small companies that had small companies. And yes, we see this a lot. A lot of ESYS customers are smaller businesses. And it really is a challenge to tackle something as complex as cybersecurity when you're busy already. You know, a lot of people say, well, I already have a job. And so, yeah, we try to, not only with our product, but also with the advice that we give and the educational material we produce, try and address that, how you can get a handle on it without a lot of resources.

Very good. Thanks, Stephen. The third member of our panel is Bill o' Connell from adp. Bill is the Vice President of Global Trust Assurance for adp. As we heard from ADP representatives this morning, ADP works with a very wide range, a comprehensive range of American small businesses. So what they are able to do in this space is very important for American small businesses because of that reach. Specifically, Bill leads a global security team responsible for vendor risk management, client security assurance and security communication, training and awareness. So, Bill, thanks for being with us here today.

Yeah, thank you for having me. It was very exciting this morning to see some of our clients winning awards. You know, I think I get to, as part of my job, I get to talk to small businesses, large businesses, every day about security. And it's a very tough problem for them. Especially like Steven mentioned, you know, the average small business owner is probably doing five different jobs. And so now to be the technology resource, let alone the security resource on top of that, is sometimes overwhelming. So as part of my job, in addition to talking to clients, I help ADP look at who are our partners that we use and how secure are they. And so, you know, I think it's very important for small businesses, and I'm especially concerned about when they're trying to win that big contract, what are the things that they're just going to need to do and to demonstrate so that they can grow and they can thrive and they can win that big contract as well. So that's another team that I help manage. And then finally, it's about the people, the training and awareness that is so critical. Making sure that the average employee knows what they need to do as well.

Thanks. Thanks. And then last and by no means least, because I'm going to spend a little bit more time talking about about nist. Here for a second is Pat Toth, who's the supervisory computer scientist, Computer Security Division at the National Institute for Standards and Technology. And NIST has become not only a government wide, but a nationwide resource on this issue. They have really been charged with determining for all of us in the federal government what we need to do to get our affairs in order. And I think because of that learning and because of how pervasive those guidelines have been, there's something that are coming up more and more in the conversation even outside of government. So as as small businesses try to figure out what to do in the cybersecurity space, they will inevitably hear about what NIST is talking about and, and recommending for them to do also, because as we talked about this morning, and we'll talk about throughout National Small Business Week, the way we are able to leverage the United States government as the biggest customer in the world for American small businesses. I think we have announced over the past couple of weeks that something like $90 billion in sales have gone from the federal government to American small businesses. Businesses need to keep up with the pace of what government entities are doing and what they're expecting. And so I'm very happy Pat could join us today to talk about these issues from her point of view. So Pat, do you have an idea of what you would tell small businesses to do today, right away to help their security portfolio or their profile?

Sure. Thank you. It's a pleasure to be here today. And I am the lead for the Small Business Outreach program at nist. We work with the SBA and with the FBI Infragard program and put out kind of fundamental guidance for small businesses. We also conduct workshops. We have a lot of information on our website for small businesses and that's@csrc.nist.gov but what I would recommend first for most small businesses is to provide fundamental training and awareness on cybersecurity to their employees. For most small businesses, their employees are their greatest assets, but in many ways they can also be the greatest risk. We need to have these employees really understand how to identify things such as a phishing attack, know when to open an attachment and when to not, and really recognize very fundamental things that they should should be aware of that could put their companies at great risk.

Very good. Thank you. So the first question I want to throw out for the group really gets at something that I think is not cybersecurity based up front, but is very tech based for small businesses up front. And I think for decades, small businesses have thought their IT challenges were just to figure out how to plug their computer into the wall and then maybe set up a wifi receiver, and then God forbid, they'd have to set up a credit card terminal. Then once they could get all those working, they were up and running. Now they're being told that all of that needs to run out of the cloud and they need to make that transition. That's the next big transition that they're looking at right now. So first and foremost might be that question of how important do you think that is as a next step for small business? And then the question for us, as they make that transition, as they're sort of buying that suite of services to move the cloud, are there specific cybersecurity issues that they should be thinking about as they make that transition? Pros and cons on that sort of a move. So anybody have thoughts on that?

Steven?

Yeah. So cloud, like a lot of technology, has a lot of benefits, but also risks. In the benefits area we're talking about, what's the one thing a small business should be doing that maybe it's not? And that would be, in my mind, backup.

Right.

So particularly with the kind of attacks we're seeing now with ransomware, a current backup of all your files is your best protection against that. Although actually the first time I wrote about backup was the first computer security book I did in 1991. And you need backup anyway. What if there's a fire or an earthquake or whatever? So backup is a critical part of your cybersecurity posture and your defense. And the cloud offers a lot of benefits for that. So, yes, you should be backing up to hard media and you should be storing a copy of that somewhere safe in a separate location from your business. But the cloud gives you the opportunity to back all that up pretty much constantly. So my own system is constantly making incremental backup into the cloud. Cloud. I think a lot of the problem, though, for small businesses and the cloud is really understanding the different parts of the cloud, the different types of the cloud. And so you have the public cloud, where, you know, you have Dropbox and anybody can use Dropbox, or you have business Dropbox, or you have a local data center that provides you with your personal cloud or your business cloud. And I think that's the area where potentially an outside advisor, an IT consultant, can help a small business understand where they should be leveraging the cloud technology. I know some small businesses that started up in recent years that have no servers, they have basically no infrastructure. They do everything in the cloud, which from a security point of view can be kind of scary. But on the other hand, the people I know are quite good at security, so they've gone into that with their eyes open. What I worry about is people who just go, oh, we'll use the cloud. The provider said, it's secure, we're covered. So the last piece of advice about the cloud I would give is check that contract. And you can't. Although you can outsource your storage, your backup, you can't outsource responsibility. So even as a small business owner, you say, okay, my IT provider has got all my data. It's their responsibility. No, if it's your data, it's your customers, your responsibility.

So if I'm creating that relationship, what are the two questions I want to ask that cloud provider salesman or what am I looking for in the contract to make sure that I'm going to get that level of security and that's the right way? Where do you think people can go amiss there?

Yeah, one thing I would add to that is how you make that decision kind of along the lines you're talking about, which I think many people may go into it, especially in a small business, you're going to be very price conscious, but there are other factors that you need to have, you know, give the right amount of weight to. And I think it's, you know, some things should cost money because you're getting that, you know, higher level of service. And I think security might be one of those things. So, you know, just like with, you know, produce or surgery, maybe it's better if you're paying a little more because you're going to get something for it. So I think, you know, when it comes to not just the contract, but the deal that you're making, I would look at that, I would do my research to see, see, have there been any security issues. But then specifically, I think that especially for a small business, the contract is going to be a good part of that line of defense. And so you're going to want to make sure that there's certain SLAs in terms of not just basic stuff like access to your data, what do they do with it, how long do they retain it, what kind of recourse do you have? So those are absolutely things that you should make sure that you're getting and not just make the decision based on price.

So does Anyone have any thoughts though, in that sector of what you would, what would be worth paying for? You know, we've all had the experience of going into an auto dealership and they try to sell you, you know, the undercoating and everything they can. But there are some things like cruise control you'd probably like to have if you're on the highway a lot or things like that. Any thoughts of what you might want to pay a little bit more rather than just taking the basic package that, that's important from a cybersecurity space. Any thoughts on that? If not, we can, we can move on. I'm not sure if it's, it's not a one size fits all thing, and I get that. And that's part of the challenge.

It absolutely is. And I think that's, that's part of the, the concern that folks have that there's this picture that the cloud is something and it's all encompassing. And I think you've correctly laid out there's multiple different facets to that. And this is absolutely a shared responsibility mode. But I will say from a security perspective, as you step into this, if you look at the statistics, I mean, from the attacks that we experience day, even in the mainstream, everything that you read about here, the vast majority of those attacks are exploiting fundamental and old vulnerabilities that have been patched. The answer to that problem has been in existence sometimes for years before an adversary goes and exploits that. One of the benefits for a small business, and certainly as you step into a cloud environment, if you're going to do that, is you can actually shift some of that responsibility. You no longer in a platform arena, have to be concerned around, well, do I have to patch this server? What's my state of this? I don't have the staff to deal with this. That's where your service provider can step in and take care of all of that for you. So the vast majority of the things that are being actively exploited are handled on your behalf. But that's, again, it's a very important thing from a contractual standpoint to understand what you're actually moving into. And then the final thing we kind of talked earlier about the if you're going to walk out and do one thing, what's that one thing you're going to do? And this is potentially, I mean, it's a little bit related to the cloud, but from my perspective for a small business, in terms of exponentially increasing your cybersecurity posture almost immediately is enabling multi factor authentication. So just for the folks in the audience here, how many people have enabled multi factor or two factor authentication just on your personal accounts? So maybe 50%. So this is something from a cloud perspective. In the past this used to be difficult and costly sometimes to set up. Now, from both a personal perspective and from a business perspective, you can do this almost immediately. And I think everybody in the room and everybody watching needs to do this right away. I mean, and it's as simple with your, I mean, certainly all the entire Microsoft product stack, Yahoo, Google, you name it, from your email providers, if you look at the security settings, you can actually essentially enter in your cell phone number as that second factor of authentication. So even if I steal your identity, I steal your username and password, I can't use that unless I've also actually stolen your cell phone and know the PIN for that because it's going to be sending a notification to the cell phone to say, hey Matt, are you really trying to log in here? So that's now almost ubiquitous across any kind of a business perspective, a cloud that you're going to go for and also ubiquitous in the commercial space or in the consumer space. So really encourage everybody to leverage that capability. And that's the thing, the value that you get with the cloud computing platforms that you have available to you as an individual and as a business, those capabilities are there and it's lighting those capabilities up in the appropriate order is so, so important.

Pat, did you, were you trying to get a word in there?

Yeah, I was. I think what you said before about it not being a one size fits all solution that I think for many small businesses that's the difficulty is that they do need to look at their risk and do a risk assessment and make those risk based decisions. And if I'm going to put my things in the cloud, is it worth spending a little more to get those extra services? So it would be ideal if we could give everyone a solution, but unfortunately they have to work their way through it to get to their own solutions.

Okay, well that's the perfect transition then into my next line of questioning, which is, you know, most small businesses, I don't know what the tipping point would be, but if you have 10 employees, you don't have one of those employees doing it right. You can't afford to have a dedicated sort of IT person. I imagine in most places they all look around for the youngest person in the room and assume they can do it better than anybody. And so that's what you're left with. So up until that time that you can hire even a half time IT person or something. How should people go about putting together that plan? Or what are the best resources that a small business could go to? Or go about trying to gain that expertise, which they need from day one, even though they're not going to have the scale to be able to hire their own dedicated IT person until a long way down the road, if ever. So what resources do you all think would be best for folks to go to if they really were committed to developing a plan like that?

Well, I'm going to pitch my own resources. If you go to our website at nist, we do have a number of resources and some training programs for small businesses. And the SBA has some wonderful resources. The ftc, DHS has some resources as well. But there's a lot of good information out there that's very readily available. There's great videos on YouTube and you can get a good fundamental understanding of cybersecurity just from that. And I think relying on not just one person in that 10 person company, but everyone to have a good understanding of cybersecurity and what the risks are to the organization and how the bottom line really is that their job could be in jeopardy if there is a breach and if the business owner cannot recover from those expenses.

And I think so. To add to that, one thing I tell a lot of small businesses, if security isn't anybody's job, then it's nobody's job. So if you have 10 people, how can you make it somebody's job? You make it part of each person's job. So maybe you have somebody that runs your financials, so what are the things that they need to do in their day that require, you know, that ensure that they protect that data securely? If you have somebody, you know, on the physical side that locks the door at the end of the night, right, that's part of their job. So we have to think about those things that each person has to do. When you don't have the individual, you know, one person whose responsibility is, and making sure that they understand what those components are is very important. But then secondly, there are going to be things that you're not going to be able to do alone. So just like when you have very important contracts, you get legal advice, when you're doing your annual financials, you might get an accountant. So at what point in time do you need to bring in security expertise, maybe to pen test your website to make sure that it's safe for the, you know, to hit the web, maybe to look at help you conduct a risk assessment of what things should you be worried about. But I think it's probably money well spent if you don't have that expertise to leverage it from the outside.

Yeah, I think outside counsel or consultant has a role to play. And one trend we've seen a lot in the industry in recent years is this thing called a managed service provider, where the companies that they started up quite a while ago to provide computers and software on a per person, per seat basis for small businesses, some of them are now taking on the security responsibility. And if that's done properly, that's very good because a managed service provider might serve 100 companies, all of 10 people, and they can afford to leverage really good security expertise. So they will have, you know, because the thing is, if you hire a security person in a one in a 10 person company, they're not going to be busy enough really, hopefully to. Yeah, so a good managed service provider, along with the hardware, the software, the printer and so on, can provide security services. And an organization that we participate in, CompTIA, the Computer Trade Industry association, is also a good resource. They have security resources on their website and they have certification and education programs for managed service providers to take on that security responsibility. And again, there's the caveat. You know, you can't outsource the ultimate responsibility. But if you've got somebody who is not only providing, you know, your word processor, spreadsheet and printer, but they're also providing a firewall, they're providing your antivirus, they're providing that protection, the two factor authentication and making sure that's all patched and up to date, that can be a worthwhile add on to that basic IT service.

Great. Well, so I think the value of what we're discussing today, hopefully for our audience, is to separate some of the myth from reality, try to talk in very practical terms and all of that. I want to be allowed one sort of abstract question which I think is so important it bears some time and hopefully folks don't glaze over and we lose them. But as I've been involved with small businesses and talking to them, I have come to appreciate more than I think I understood how essential plugging into some sort of supply chain is. And so, you know, there isn't this division between big business and small business. Most small businesses aspire to grow into a big business. And most small businesses, even if they'll stay small, need to plug into a big business where they provide an essential part or a service or whatever. So in addition to people maybe walking through the door of my mom and pop and having that sort of security profile, I will probably soon be faced with the challenge of having to have an interface with a larger company, with the federal government, someone like that, so I can participate in that supply chain. So my sort of general question is what is going to happen in the next year or two in that direction that small businesses need to be prepared for? The nightmare scenario here is that I have my small business, I'm producing a great product or a great service, I'm right on the door of landing that big project, that big contract that'll take me into the stratosphere and they won't let me in the door because my specs aren't up to speed or things like that. So what's going to happen in that supply chain space that businesses need to think a little bit ahead about so they're not sort of left outside the locked door? Any thoughts on that?

I've actually run into that on a number of occasions where somebody, a small business is getting its first big contract with a large company, they're about to sign and the large company says, oh, and we need to see your security policies, your security awareness program. And you know, there's a scramble to do that and they want, some of them have a checklist and it's yes, all our employees get security awareness training at least once a quarter, you know, which you can't honestly sign yes to if you haven't been doing that, you know. So, yeah, the supply chain risk up and down now is really a great concern. And as a small business, obviously if you're getting suppliers supplying you and interacting with you digitally, you want to check them out, but you're definitely going to be checked out by a big company. And so you need to have security policies and training in place so that you can say, yes, we've got this, here they are. And it doesn't become an obstacle.

And I think it's, I mean, for exactly the reasons that you've laid out. There is no business that is too small to be targeted in the cyber arena. I mean, particularly from that supply chain management. And if you look at some of the major breaches that have occurred, it hasn't started at the top, it has started somewhere in the supply chain. And that adversary has been able to work their way forward through that supply chain to get to their ultimate target. You may have a small business and you may not be that ultimate target, but the value that you have, not only the employee data, your customer data, but is that linkage into somewhere else that someone's trying to get to. And also say that from the cloud perspective, you can get a flying head start on some of those things that you're going to be asked. I mean, if you look at the major cloud providers that are out there, you can leverage some of the certifications and the attestations that they make. I mean, because that service is run in accordance with ISO standards, because they have all sorts of security programs that are there, you can build upon that and have a flying head start. When someone comes and says, hey, you're ready to be bigger than just a small business, how do you actually rapidly scale out, not only just at a compute capacity, but in a security capacity and a policy capacity? Those are things that that cloud provider can help you with.

And so one of the teams that I manage does that. And we have a dozen people, we have a lot of third parties that we use to conduct our business. And so we have to make sure that they're doing their responsibilities. So I'm very familiar with this, and I'm sure for a small business, the first time you're seeing these requests for SAS 70, SOC2ISMS, every acronym you can imagine, it's probably overwhelming. But I think it's important not only that people start thinking about it, but also that not just from the standpoint of the check, check the box kind of mentality, like, hey, now I'll get it, now I won't, but also what that does for you internally. So first of all, it starts the conversation around how would I think about this? What should I be concerned about? And so as you go through that process of, you know, whatever the right level of security it is to help you win that contract, I think it also actually, you know, will help increase the posture that you have inside the company. And I think it, you know, can't be overstated how important it is that each individual in your company is thinking about security. And so that plan, whatever the actual deliverable is, that planning, that thought process, it's invaluable so that now you know what's important in your business. If I had one thing to protect, how would I protect it? If that one thing all of a sudden wasn't accessible, how would I operate? So it brings up a lot of good questions that are worth the time thinking about.

And, Pat, I want to make sure you have a moment to speak about this as well. Do you see anything specifically, informally sort of coming down the lane from the federal government and federal government agencies that you expect where they're Going to maybe come up with some more bright line rules for accessing systems or things like that. And what can folks do to educate themselves on that?

Well, we're not there yet, but I'd say that's coming within the next year or two that you will see those types of requirements. And I think what small businesses need to do is start thinking about it now and having those plans and policies and procedures in place. And often when I'm out talking to small businesses, you know, they kind of glaze over when you say those words, especially as a government person saying them. It's kind of a, you know, almost sounds like a big government approach to things. But it's not just to have something within your employee handbook that says what your employees can and cannot do while they're on the Internet, you know, and I would encourage folks, when they do their security awareness training within their small businesses to relate it back to a personal level and to bring it back to people, how they interact, use their computer systems at home. And if you can get the people to think about security in that sense, then when they come back into the workplace, they're often much more aware of the things they're doing in the workplace and how it affects the security of the company as well.

Okay, great.

I'm about to shut the theoretical window. So if you've got one more thing, big picture thing to throw in here, then we're going back to the nuts and things.

Actually, it's a very practical, practical point to pass. Point is, compared to 10 years ago, it's a lot easier to do a security awareness session with people if you just remind them that they've all got computers. You know, we've all got computers in our pockets.

Right.

And we found it much easier these days to get people to come to a security awareness session because it's, you know, if they're not concerned about the company information, they're certainly concerned about their photos and their YouTube videos.

Okay, well, so I'm going to now hit on a couple of different subjects and just do a bit of my man on the street veil of ignorance thing, which isn't that hard for me in this space necessarily to just make sure that we're making clear for folks some of the concepts we're talking about. I know Matt raised two factor authentication. And I just want to walk through this and just some simple questions. So one factor is name and password. And then if you add anything else to make sure that this isn't just someone who got ahold of my password, be it I love teddy bears or whatever. They have to have something else to sort of do that. Now the way that used to be five years ago for banks and law firms and places like that is you'd have these separate tokens which still exist and are in wide usage still that will send out rotating sort of numbers. And that was always two factor authentication. My sense is that has started to change significantly and there are a whole lot of different things. The federal government is using PIV cards now, which is a physical card you plug into your computer, but that there are all sorts of different ways you can do this. So could you just talk a little bit about the different sorts of two factor authentication that work? How do you separate the effective ones from not or is anything good? I've got to admit that when someone I'm working with, especially online, asks me for my phone number, I'm just afraid I'm going to get a whole lot of solicitation calls. And so I might feel like, well, not sure how comfortable I am with this. Is that a mistake? Or is the security benefit of having those sorts of things outweigh maybe the privacy concern of handing over even more information? So for folks that aren't familiar with two factor authentication, can we just talk for a minute or two about what people should be aware of and concerned about and what are the real valuable steps to take in that space? So Matt, do you want to expand on that a little bit more?

And you've correctly laid out that this used to be very, very complicated, costs tons of money to set up internally. I mean, certainly the industry has made a shift on the commercial side towards the cell phone as largely being that second factor for you. I mean, as I think, well, how many people in the room have a cell phone? I mean, I think we're going to get to 100%. Everybody's going to raise their hand and say, of course I have a cell phone. And that's why, I mean the goal here is to make this easy and non intrusive and allow you to still do what you need to do. So from a. I don't think anybody should be willy nilly running around giving everybody your cell phone number. But on your email provider, your service provider. Absolutely. I mean I am 100% that you absolutely need to do that. That is an easy fix to do that. I think that the industry is by and large going to be standardized on that due to the ubiquity of cell phones. But you'll also see that there is a huge move in the security space away from username and password. And certainly from a Microsoft perspective, we're absolutely committed to that as well. So if industry can put you in a position where you don't have a username and a password to actually give away or get stolen, you'll be in a more secure posture. That's the promise of some of these things with, I'm going to look at my computer, then it's going to use biometrics that I can't necessarily give away. I mean, I'm not typing anything into the system to be stolen to actually log me into the computer. But the use case really is very simple. I mean, when you put that cell phone number in, if you're logging in from your normal computer, usually this is set up to recognize, hey, it's Matt, I'm at my normal computer. I'm not going to challenge you. But I go to grandma's house and I try and log on from grandma's computer, it's going to say, Matt's logging in. It looks like it's Matt, but he's not at his computer. Therefore, I'm going to challenge Matt and say, you need to either respond to this text message that I'll send you, you could set it up so it'll actually physically call your phone and you just push a button to enter it in. Or for the majority of these systems, you can also get on your cell phone itself an application that replaces that token. So you can launch that application and it will give you the code that it would normally kind of send to you. And you just type that in and then away you go. Really simple to do. Sounds kind of crazy. Until you actually go through it once and say, oh, well, that really wasn't all that bad at all. This totally makes sense to me now. So don't let that burden or that fear prevent you from doing that. And that's why I encourage everybody with your Yahoo account, your gmail account, your outlook.com account, go set it up. I mean, set it up before you leave today. You can do it right here in the auditorium.

And I can tell you that having given my phone number to the Microsoft Development Network for two factor authentication, Microsoft has not been calling me.

Well, good. If that had been, it would have been the opposite.

No, no, I agree. I mean, if I was to try to get into my company network from here, I would have to get a code off my phone. And we actually have a product that does that. And it doesn't send the code to the phone over the phone network. It generates it. But yeah, it isn't that difficult. And again, if you're using somebody like a managed service provider who's looking after your security, ask them, you know, can you implement two factor authentication for our remote employees so that you know, if they're out on the road they can get in securely.

So I wanted one other subject I want to bring up from the very sort of just practical nuts and bolts point of view is email and specifically sort of email filtering or encryption or when you really have to step up and do that. I mean, I think a lot of us have started to encounter general filters that will say things like, hey, you're sending an email here that looks like it's got nine digits, it looks a whole lot like a Social Security number, or this looks a whole lot like a credit card number. You sure you want to do that? You should encrypt this, you should do all that for pretty entry level small businesses and those sorts of things. Any recommendations of how much is enough, how much might be too much at this point when it comes to things like filters or encryption specifically for, you know, emails that you might be using off of your own, your business email system? Any thoughts on that?

Well, I would say the first thing to do as a small business with email is, is think about what's in email. Right. Because you know, if I'm, if I'm going into hack somebody's information from a company, the email account has probably got the best stuff in it. I could go look through all your spreadsheets, look through all your word processing documents and so on and so forth. We often have the real nuggets of value in the email account. We're seeing that with intellectual property theft, hacking the email account. People are not thinking necessarily what they're leaving in there. And we saw that in Sony, people saying things in email that they really shouldn't be saying. When it comes to encrypting it. I mean there are situations if you're in the medical space, HIPAA regulations pretty much demand that your email has to be encrypted. That's why you can't just send an email to your doctor. Hopefully you're not sending an email to your doctor in plain text. You've got some sort of secure system going. And yeah, you need to look at what's out there in your email. Realize that an email is like a postcard, it's not like a sealed envelope. And then if you have regulatory requirements that it be secure, then look to a secure email service.

Yeah, I mean, I'll bring this Back to an earlier question about where does it make sense to potentially pay some more money? One of the main attack vectors, I mean, how the bad guys are getting in is through email. They'll send you a well crafted email that looks like it's coming from your colleague to entice you to either click on a link or download an attachment. And that's the initial foothold that they gain into the system. So really, an inbound email filtering perspective, that's absolutely something from a reducing your attack surface as we talk about making it harder for the adversary to get in. That's a service, if it's available to you and there's many of them, that's something really to consider to run that through. And then I'll also say, I think from an industry perspective that the ability to control the data that you create is going to become increasingly common and ubiquitous. I mean, the ability to encrypt and you laid out the, hey, there's a credit card number in your email and giving you the choice or the notification to say, do you really want to send it? Number one. And if you do, number two, automatically encrypt that. And as the industry continues to advance, I believe that we're going to get to a scenario several years from now where that's going to be absolutely commonplace today. That's kind of hard for people to imagine that, oh my gosh, all my emails would be encrypted and this looks really hard. That's going to become increasingly common for just those reasons. I mean, that's where the data is and the ability for you to share both internally and externally is where again, this promise of the cloud that you hear about really comes in. It allows you to do a lot of those things and control that data that needs to be controlled. And then the data that is a postcard, great, just let it go. There's no reason to embark on that overhead.

Any other thoughts on email, anything on that?

Well, those encryption services are becoming much more reasonable. And I agree. Over the next few years, I think more and more small businesses will begin to use them.

Very good. So last of my. Well, I may have a never ending reservoir of man on the street sort of entry level questions, but this will be the last one I sort of put to all of you for now. If I own a small business and I feel that someone has broken and entering and gone through my cash register, I call the police. If I have a fire breakout in the back room, I call the fire department. If I think that I have been the Victim of a cyber incident. If either someone sends me an email with a ransomware request or I start to get too many calls and emails from customers saying, hey, this seems weird in my bill from you or whatever I've had, who do I call if I don't have those established relationships? What am I looking for at that point? Where do I go? Do I just go to the Internet and look it up? I mean, if I find myself in that circumstance without preexisting relationships, what are the sort of resources I want to look for?

But you should have the pre existing relationships.

I know, but we can't solve this, people.

I think it's actually kind of a thing of mine now is we have kind of an unfortunate cycle where law enforcement, it gets its funding based on crimes reported and people aren't reporting crimes of the cyber kind because they don't think the police have the resources to deal with it. So I've heard recently from several people in law enforcement, even from the assistant attorney general for cybercrime, they want people to report this. And yeah, in San Diego we have a joint task force which is FBI, Secret Service, local police force, the sheriff, and unfortunately one of our employees last year got hit by tax identity theft. You know where you go to file your taxes and somebody's already done that for you. Unfortunately, San Diego police officer came to his house and took the report. You know, the, the police want to know about this and if we don't tell them about this, they're not going to have the numbers to claim the resources for it. So yeah, I agree. You know, Brian didn't have a pre existing relationship, but he was so upset by this, he basically called everybody and yeah, you should report things as a consumer small business, report it to the ftc, contact the FBI, contact the police department.

Most municipalities do have cybercrime units and they will respond. And what often happens is things increase in a particular area, perhaps an industrial park where your business is located, and they'll see an increase in cybercrime and those businesses being targeted.

Yeah, I think oftentimes people avoid it, like the dentist. You know, it's a lot better to brush and floss than it is when you have to go get a root canal. Right. So here we are in the root canal situation. What can you do? Focus, you know, on prevention. We talked about the technology aspect and the planning aspect, but also a middle layer here is detection. So how would you know if something happened? And you know, in the physical world it's easy. If you show up to work one day and there's a big old hole in the window. I think, you know, you got broken into. In the cyber world, it's a little bit tougher because it's so much more invisible. So, you know, what are things that you can do? And just a specific example, if you have a provider, you know, performing that you outsource a particular part of your business to, you know, they might be able to help you help identify, hey, you know, something looks suspicious here, you need to check it out as well as this third category, which is, you know, now getting business back up and running again. So prevention, detection and response. How do you deal with that? And so only if you do that good plan, will you know how to respond not just, you know, how to reach out to law enforcement. Do you need legal advice? You know, might you have to disclose something? What state laws, what jurisdiction are you susceptible to that you need to collaborate with? What technical provider do you need to work with? Because perhaps you've identified that something's happened and it's still ongoing. So, you know, you've seen a lot of news in the, you've seen a lot of stories in the news about big breaches where the first response is actually to let them continue, believe it or not, so that you can see what is it that they're doing, what were they looking for? Now, in many cases, you know, the first line of response is stop it as quick as you can. But it's important that you have that whole kind of plan built out in advance.

And I think the providers absolutely have a role to play in that. And this is one of those great questions to ask up front. I mean, the time to put your seatbelt on is not during the accident. You need to be wearing it all the time. So really to kind of game through that, think about your response plan, think about what would happen if the power went off in my building, you know, what would happen if I have a flood. You think about some of those things. What happens if they tear up the street? Nobody can park in front of my business. Now, you need to think about that as well with the online world and at least have that, that rough plan laid out on how would you actually respond for that? And again, I think that your service provider and the folks that are closer to that problem are going to be much more directly engaged in actually resolving that. Certainly I think law enforcement needs to be involved from a, an awareness perspective, but you can't expect your local municipality to come in and fix something for you.

Actually, last week we ran a short Survey of small businesses on that question and we found that 48% had no incident response plan, which is the pre existing stuff that you talked about. So I think it's an area that we can do better on and, you know, try and help small businesses to understand the need for incident response and be ready for it.

Well, I think we're going to get us all out of here on a quick hitting question that I haven't teed up for all of you. So I'll put the question out there and then sort of give you a vamp here for a little while to let you think of an answer. And that is, you know, small businesses have a lot on their mind. You know, every single night. You can't really say what keeps them up at night because everything keeps them up at night. You know, are they going to make payroll, are they going to land that next customer, are they going to get the permits they need on time, all of that. But as you think about the one thing that they should have in there, and this is more not what they can prevent, but maybe the one thing they have right now that based on your experiences with small businesses, you have seen to be most vulnerable. You know, we were trying to protect everything, but in reality, if you were to have someone call you from a small business and say, you know, I got hit and here's what happened, do you find or do you expect that the most vulnerable piece that small businesses have right now is email or is it credit cards, or is it payment, or is it intellectual property? What do you think when you pick up that phone from a small business that has that concern will be the thing they just lost that they can't replace. And part of this goes to what I think I heard in the discussion where, you know, you're not always in this completely alone. As we go further down the road, the services you just buy off the shelf are going to come with increased protection. So if you're in the cloud or you're accessing a supply chain from the cloud, it may be that that is providing just services at a base level. And same thing with your email is getting better. But there may be some parts of what's in your store right now or in your operation right now that's still sitting pretty bare and exposed. And so for each of you, what do you think that most exposed heart for a generic business might be right now? So Stephen, do you have an idea for that?

Yes. Yeah, I, I was just, I was just thinking about this. I'm trying to come up with a Cool acronym. And so far I've got elephant.

That's a long acronym.

Yeah.

So the elephant.

Let's see if you can pull this one across the finish line.

No, this. So, so it's, it's a problem. You know, we've talked about the technology and we've talked about the awareness and the role of employees. It's the employee left or fired, access not terminated. And that is so common where particularly small businesses, we often work with people we trust. They come and they go. Sometimes though they don't go under the happiest of circumstances. And so often we see a situation where somebody's access to the system has not been cancelled when they left. And you know, that person gets kind of a bee in their bonnet, they get a grudge or something, they come back in using those credentials and unfortunately they may still have their two factor authentication. So it's that personal aspect, that insider problem.

That's a great answer. Any other thoughts on that question?

I think phishing attacks really having employees be suspicious of every email they get in a sense and thinking about what is this that I'm doing before they open attachment or before they click on a link. And that basic understanding for most small business people really isn't there yet.

I think it's about knowing when to leverage outside expertise. And I think it's going to be a challenge because there's a cost factor to it. But just like, hopefully you're not doing the electric yourself, you're not doing the plumbing yourself.

Right.

You're going to get an expert for a good reason. I think, you know, helping with generic technology issues as well as the security, you really should, you know, think about leveraging an expert and it's worth the cost.

But I think with plumbing and electrical they always just find the youngest kid in the room and have him do all of that as well. So Matt, did you have any thoughts on this one?

No, I want to back it up. Absolutely. The electricity though, and back to the training. If you stick the screwdriver in the outlet in your office, you're not going to blame the power company that something bad happens that's somewhat on you. But to take it a little further, there are things like ground fault circuits, there's other things that go in there that are designed to prevent you from killing yourself. Still not a good thing. And that's what all of this starts to bring together. I mean, as we start to advance into the future, all of those different breakpoints are going to be available to you and you're not going to have to build it yourself, from mining the source of energy to creating the generator and the transmission. All of that's going to be done for you. And it really becomes that discussion that you have with your provider to understand what's available to you. I mean, I think that's really, really a key component of all of this, is as you go forward, have that discussion and really understand what is available to you. Because a lot of times, and one of the things that we see all the time is people don't do the simple things. I mean, certainly from a cyber perspective, it's those simple things that you need to do. But the other thing that I see on a personal level too is people don't understand the breadth and the depth of the capability that they've acquired. They will go out and they will sign up for something to do, one component, and there's all these other things that are available to you. And it really is well worth the time to say, hey, if I'm buying into this provider, here's all this other stuff that actually comes along with this that I can actually then leverage.

Well, great. Well, I want to thank all of you for being here today. As we sort of said at the top, we view cybersecurity as a real, real issue for American small businesses. You know, the numbers don't lie. You've got half of all small businesses feel that they've been the victim of a cyber attack to the tune of $20,000 per incident, which is just a huge obstacle to the success of small business. I think the most promising thing we heard today, among many pieces of good advice, is the opposite of sort of saying, you know, you're on your own. I think almost all of you said there are good resources out there, they're easy to access, and they'll set you on a pretty good path to understanding this issue. We, for our part at SBA have tried to collect a number of those. And again, if you go to sba.gov cybersecurity There are a number of very numerous and different sort of guides you can use. If you're just sort of an entry level person looking for your checklist of 10 things you should do, or access to more wide ranging advice, you can go there and get all of that. So thank you for all your time. Thank you to everybody and we hope you enjoy the rest of National Small Business Week.

Thank you. Turned off. That's plain out.

It'S old.

But.