Are You Being Misled When It Comes To Data Protection?

So, cheers, boss. Yes, thank you. Joining for session number four of our virtual farm.

It goes by quickly, you know, I.

Just thought about it. It's like almost two months now. Yeah, yeah.

You know what? I might. We might start, then the. The rest will catch up. Hopefully they can come on in here. Yes, we're recording. Yeah, we are recording. So greetings everyone. Episode number four. Way to go there, Sean.

Hello.

Look, this is a rare sight of him coming down to Canberra. So thank you for coming down. It's excellent. Yes. So today we have a very interesting topic, but before we'll talk about the news and I'll start off with what's happening on today's TVs quite a lot, and that's Black Lives Matters. And without a moment of hesitation, we see hackers taking advantage of Black Lives Matters and some quite funny ones. I read an article from a Swiss research company that they see a lot of phishing emails taking place trying to get people to click on certain links and obviously get compromised. One was quite funny. I had a little picture from KFC saying, together we stand united with black communication to listen and speak up against inequity, oppression, racism. That's why we're giving away $20 worth of meals with this coupon. So these. So in a few of those happening, and KFC to the credit, and I think one of them was Starbucks.

Starbucks. Starbucks, yeah.

Also had something similar. Basically had to come out and say, look, it wasn't us who actually did it. There's also a very interesting site. It was a fake Black Lives Matter site, funny enough, was linked to Australia and it had 700,000 Facebook followers. And in the website it had the opportunity for you to donate money. Guess where the money went to? Yeah. So it was repeatedly transferred to Australian accounts. So these are the things. I actually wrote an article about it so I can put it in the link. People are interested to find out more about Black Lives Matters and scams. We've also seen huge spike of ransomware. No surprise, no surprise. What's interesting, cpa, which is the certified practicing accountant in Canada, got exposed with 300 and I think it was 329,000 individuals. This is more of an hacking extra. Third party. We talk about a lot about third party risk and having access to assets. Now why is that important? Because as we know, accountants have a lot of clients, which means now I can do social engineering attacks, I can do phishing attacks, targeting their clients and so forth. So we can see a lot of that happen going to take place. The City of Knoxville in Tennessee in the US their IT system got knocked down. No surprise. Ransomware. Honda, the motor company also got targeted and Samurai plants got shut down. This happened on the 8th of June. But typically the Japanese tend to be tight lipped and not much information has come out but there's been news about it. Interesting. Talking about beverages. I'll have another sip.

Yep. It was an Australian company, the beer beverages.

Yeah, exactly. The ones that own 4X.

Yep.

They call Leon and they got it. And so that there's rumors flying about, this is quite interesting, rumors that Leon has actually agreed to be purchased by the Chinese. So they're thinking that maybe they got denial of attack because they're being bought out. You know, well known brands like Forex is one of their owners. Interesting story. And last but not least, we've got a story, it's just been recently published. CIA, what can you tell us about that?

Yeah, well, comes again the old problem in the world, people. It happens in 2017, I think 16, it took them one year to discover it. So one of the most sensitive departments in the CIA that was designed to develop hacking tools to hack organizations and countries, its own, well, they put a lot of investments in time to develop these tools but they prioritize the development over securing themselves. So they actually, this department is not secured, people were not monitored. And apparently an employee took to himself 34 terabytes of information which includes a lot of very sensitive proprietary health hacking tools, including 2.2 billion documents. It was discovered only a year after when it was transferred. Guess where? WikiLeaks. So they only covered that when it was already outside. And the funny part that they said after a lot of investigations they claimed that, well, monitoring was not required there because they are trusted and they didn't think they need to monitor themselves because they are trusted people. And now imagine those tools that were designed to hack organizations, countries, they develop very unique capabilities such as activating cameras and microphones on other parties, tablets and mobile phones. So you can imagine the CIA had to notify the other parties even sometimes on the, how do you call it? The other enemies.

Yeah, the adversary.

Yeah. To let them know that that happened. Which put them obviously in a lot of embarrassment.

From the sounds of it, and having read it myself, it sounds like very poor governance.

Well, they managed to publish very good stories almost every few months. So it's great for the industry.

It's a topic that we're going to be talking about, which is basically governance, but around policies in terms of why can, you know, you talk about the should and can. Why do we have a culture that can be negative? Why do we have an organization that does follow policies or don't follow policies? What causes those issues to happen? So that's going to be on a separate discussion, but it was quite evident there that, you know, they will do what they wanted to do. So basically they will talk the talk.

But one walk the talk.

That's in essence, correct. Yeah. So now that we've got the news out of the way, we wanted to get stuck into the meat. Not because I'm that hungry, but the title of this topic is quite interesting and quite controversial because what we're talking about is why organizations are being deceived when it comes to data leakage. So instead of jumping it into the water, what we sort of doing is a little bit of a role play. And I actually know Sean for some time. He's a person. And we're going to pretend now that he works for an important organization. And we actually meet in the evening hours at a. At a pub like this one, and we're just talking about life. And when I see Sean, he's quite all right. He's not a happy camper. So, you know, I know him. And I'll say questions like, you know, what's wrong?

Why?

What's going on?

Well, you know, you know, me, kids, wife, family, mortgage. I have a lot of stuff in my head, but everything is fine. I'm struggling at work. Struggling at work really hard. You know my manager, John.

Yeah, I know. Yeah.

We've worked for nearly 80 years.

Yeah.

Just left and I got a new one, someone external. I was hoping that I would be the manager of this department because I'm. I'm there. I'm the product manager and the product designer. And I'm one of the foundations of this company. I was hoping that I would be promoted.

I would get promoted. Yeah, you mentioned that you did.

Suddenly they brought someone from outside, doesn't know me, doesn't know the history, doesn't seems like it doesn't really appreciate everything that I did for the company. I raised that company, if not me and my initiatives. The product wasn't so successful. Yeah, so, yeah, pretty depressed.

Yeah.

It doesn't listen. And what I hate the most, he started to do micromanagement, which I hate. I was independent. Now I need to report for, you know, little things that I'm doing every day. Get me crazy, mate.

But so hold on. So when did this happen?

About six months ago. He stepped in, was big announcement by the CEO, you know, it started when my old boss left. So we gave him a great farewell on that farewell. Everybody was staring at me. They thought I'm going to be the new boss. Everybody liked me. I mean I have a lot of friends. I collaborate really well with all the management people and especially with the Department of R& D and marketing and sales. So I have very good relationship, very good friends. And you know, I thought I'll be the next one.

Yeah.

Yeah. And they just dropped a bump. Yeah.

Did you get a chance to talk to the CEO or someone?

No.

What is actually going on? No.

Pretty much ignoring me since then. Yeah. Yeah. So it's, it's really sucks. Yeah.

And what about the other colleagues? Are they. Do they feel the same as pretty pissed off?

Well, you know, we go to lunches almost every day. We talk and look. They also express their surprise and disappointment. I mean they hoped I'll be, I'll be their boss.

So.

Because we have the same, you know, we talk the same frequency, we talk the same language, we understand each other, we have the same, we share the same plans over the year. You know, meetings into the night, weekends. We put a lot of from our soul, heart and soul into that product to the success. We invested our life into that product. Yeah.

So. So what options have you got? I mean, well, where you're right now.

It'S been six months now that I really, really not satisfying from working there. So I'm literally every day I'm working there, he's watching me, the meetings, you know, he's asking me about the performance. He doesn't really know about the history. It's like, you know, from, from fourth. Then I'm back into a white belt. So I need to prove myself. And the worst part is that I don't get any back win from the CEO because obviously he wants, he needs to, you know, support his new recruitment.

Yeah. So where does it leave you now?

To be honest, but it's just between us.

We're having a beer anyway. Oh, sorry. A glass of wine.

Yeah, well, nobody's watching us and nobody listening to us. Look, I recently started to think of moving, you know, moving forward and maybe leaving the company. Really? Yeah.

And is there much going on? I mean, have you checked what's happening?

I had few interviews with a few good companies, some of them competitors. Obviously I'm very attractive for them because I have a lot of experience, knowledge, I have contacts, I have good contacts with the industry. I know the product really well. Well, I'm the chief designer. And you know what you know you're not Smith from the R D. Yeah, yeah, yeah. So we talk, I talk with him and we have a plan. We have a plan.

So how do you see it working?

Well, if that goes.

Do you have a positive outcome? Can you see it working?

Well, look, I'm actively, actively working now to make a change in my life. And I think if I put my life in this organization and I created that product and it's so successful and now someone else will get the recognition. I don't think I want to let this happen. So what I think is we already started to collect some codes.

Oh really? Yeah.

So Smith from the R and D in the last couple of months we, we are saving and backuping and taking some data outside and also. Well, I'm preparing my leave. I don't want to hand over all my years of experience in investment to the company.

Yeah.

So we already doing some stuff. Yeah, I'm well prepared.

Is it easy to do? Because I would have thought that would be that.

Are you joking? I'm in the company eight years. I was part of designing all the controls and all the. I voted when they put all these ridiculous firewalls and all the access controllers in identity management systems. You know it's funny. Yeah, yeah. I don't. It blocks all the external threats, but yeah, it doesn't do much to me.

And no one suspects you? I mean no one actually knows. How are you going? Maybe a few people.

But when the company started we were like 10 people. I was one of them.

Yeah.

Now we are almost 150 million. A few. I think we're worth like 200 or 300 millions dollars. Yeah, I'm one of the foundations. Why should they suspect? And also I'm talking with some others. So we have a plan and I don't think someone suspect us. And even if you suspect, they can't prove anything.

Yeah. So it's not so much about money, it's just more about the way they've sort of looked after you or the way that they haven't looked after you.

Mate. You know, I have four houses I bought four properties and a yacht I bought because of this company. Yeah, I'm getting paid quite well. It's not about the money. At some stage it doesn't, it's not about the money, it's about the recognition. It's about my, my pride. I mean you can just let me go or you know, minimize me now.

Okay, so you could do that, but you could also just walk away. Why not just walk away?

I Can walk away, but I don't think they deserve to stay with my. In with my ip. It's my ip, it's not theirs. I created them.

Well, I know. Yeah, you mentioned that you were working.

I worked. The success of that product, it's because of me. So why should I just hand it over to them? It's mine.

Yeah, so. And have they talked about also dismissing you or was it. Well, in the last six months, this.

Guy that just did, the new boss, I noticed that he's. He's in and out in the last couple of weeks. Yeah, maybe it's something personal, but maybe he's interviewing others and. And worse than that, I saw some jobs posted on LinkedIn, so I know they are actively looking for people. Now, they don't specify the role, but the requirements similar to my experience. So. Well, we don't get along, so I suspect you want to get rid of it.

So what's the worst case scenario? I mean, what, you probably get fired and then.

Well, look, I'll get fired. I have money. Yeah, but it will piss me off.

Could you see it being the other way around where it could be a good scenario. Could it?

No, no, no, no. Because. Yeah, it's either. Well, he must go, otherwise I will go. We can't stay together there. It's impossible.

Good. So that's the role play. So the question is, what's the real problem here? And this is the challenge that most organizations are facing today. When they look at risks specifically around data, they look at the data. But when we talk about being deceived, we're talking about understanding what the root problem. So what do you think it is there, Shaun? What are we talking about here?

Yeah, so here we presented a scenario where a disgruntled employee or dissatisfied employee talk to his friend and share his frustration. Now, this employee has the access to the most sensitive. Well, he has access to the IP of the organization, the product which is the code. Without that code, without that product, the company does not exist. Now not only did he has access, but he is also collaborating with others. So it's only not only about him, but he's also communicating and working with others to achieve a goal. Now initially he doesn't want to ruin the company, but if he puts himself on the scale versus the company is more important. Now he knows what are the vulnerable points that can be exploited. He was sitting in these meetings where they voted about the identity management systems and the encryption systems and the protection systems and even the dlps data leakage.

Well, well, I Have a wonderful word for it. It never walks out the door by itself. Well, but I was gonna say, here's the question. If data doesn't work by itself, how can someone circumvent the organization's security system? Give me some examples.

It's so simple. And you know, the more you think about it, the funnier it can get. When you talk about DLPs data leakage prevention, you think of data that leaves the door and works by itself. But it never happens. When you look at data, it's always a people provide or people determine the importance or the sensitivity of data. Data by itself is not important. It's important only when people have access and people need it. Now how many times I said people in this sentence? It's all about people. It. Now if data doesn't leave the organization by itself, someone is responsible, someone with access. Otherwise, if there is no access, there is no business. When we filter all the external threats using all the other devices and just name them, we basically look at the trusted layer of people. The people that have access to the ip, to the most sensitive information, to the corporate layers, they are exposed. So when, when they are exposed to data, they basically sit after all these controls. For sure, all these controls are meaningless for them at this stage. Okay, now I don't need to be a genius to steal data. You can put the most sensitive security systems and most sensitive and most expensive data leakage prevention systems. But I can go and simply use the one of the most freaking and cheap anti DLP systems in the world, my phone, and take pictures and maybe record. I can take notes and write to myself and put in my pocket. I can memorize, I can even buy. I think I found today, I think it's a $24 Google Glasses.

Well, or something similar.

Or something similar, yes. That can record. Nobody check my glasses. I can buy any device on ebay that cost dollars like a button. I can even bring my teddy bear sitting on my table. And as a gadget that can record and transmit my screen and transmit data, even record board meetings and transmit it in real time where nobody notice. So now if you ask any CEO that experienced data theft or data leakage, if you triple the amount of systems that you had, would that still solve the problem?

Obviously not.

Obviously not.

And I like the metaphor. And you might want to talk to the guys here about the tennis player metaphor. That's a great little story.

Well, when I drove one day nearby a tennis court, a tennis ball flew outside, went outside the tennis court and hit my car. So on my Way home. I thought about that and it was funny because this is like a data leakage. A ball leaked from the tennis court. So if something like that happen, how the tennis court manager can solve it. So he popped the question and a vendor comes in and say, look, I can solve it. Let's raise the fences, let's double the size of the fence. So they spend few thousands of dollars and they really raise the fence. And a couple of days after someone hit the ball, again, the same player.

So.

The tennis court manager seeks for another alternative and another supplier comes with another bright idea. Let's build a Trump wall. A trump wall that will surround the tennis court that will be four times higher than that fence. It costs them few tens of thousands of dollars to build that wall. And again after a couple of days, the same player hit the ball outside the court. This time they have a very interesting proposal from another entity that offer them to plant very high eucalyptus and pine trees that are twice higher than that trump wall. So they do that and they spend few hundreds of thousands of dollars. And again a few days after the ball goes outside, now they turn to some techies, companies and that company tell them, look, invest few millions. We have special drones. Those drones will intercept these balls, catch them, fire them, and will never let them go outside the tennis court. So they spend these few millions. Two days again, what happened? Ball goes out, the court manager doesn't know what to do. They spend so much money and they still can't prevent the ball from going out. So desperately, desperately, he posts that ad again and this time someone come and say look, for 20, $25 per hour for a week, I can solve the problem. How come bigger vendors and suppliers try to surround the tennis court with so many fences and walls and trees? And even I invested millions in drones and I couldn't stop it. So you will stop it with $25 per hour for over a week. Tell me, what's your secret? He said, well, till now you try to deal with the balls, obviously they will keep flying outside. My idea is to train the player how to play. So this basically story tells that when you look at the problem of the tennis ball going outside the tennis court, where is the problem? If it's the ball problem, then you can keep building walls and fences or.

Change balls or change rackets or and so forth. But yeah, you're absolutely right. I mean teach the person how to play, which basically brings down that issue that. So we've got data leakage that we're so concerned about. Let's get another technology. So the question is, why is the industry being duped by another technology? Whether it's a DOP or a SIM solution or, you know, whatever data protection system, why is the industry so keen and saying, okay, let's find another technology?

Well, first of all, it helps to solve very big problem to the vendors, cash flow. So each vendor will come to organization and we'll tell them, you know, what, you feel sick. Here is a pill. Not check you, not assess the problem and just give you endorphin and say, well, that will solve you the problem. You will never trust that doctor. But what the industry does today is when they approach clients, when they approach organizations that suffer from a challenge from, let's say, data leakage, they give them a patch, they give them something to shut down the symptoms, they give them morphine so they don't feel the pain. But then the pain comes again and again. Eventually the person can die because the problem wasn't solved. If you shut down the pains, it doesn't mean that you solved the problem.