8: Cyber Security for Dummies: The Least You Need to Know with Willie Jackson

Hi, this is Charles Michael Davis. Toyotathon is on so stop by your local Toyota dealer for incredible year end deals on the cars, trucks and SUVs known for their legendary reliability like the stylish and efficient Camry. The Ready for anything RAV4 or check out a rough and rugged Tacoma or Tundra, all with great financing and lease options available to qualified customers. Visit buyatoyota.com to find out more Toyota let's go places.

Hi, I'm Jenny Blake, your host of the Pivot Podcast and author of the book Turn what's Working for you into what's Next which comes out with Portfolio Penguin in September of 2016.

In this podcast I talk with peak performers to reverse engineer their most successful career. Pivots interview experts on what it takes to be agile in a rapidly evolving economy and open the kimono on what happens behind the scenes of my book and business. You can learn to capitalize on risk, fear and uncertainty as the doorways of opportunity. My promise is that you will leave every episode with practical tips, tools and tactics. For show notes from this episode, visit JennyBlake Me podcast.

If change is the only constant, then let's get better at it. Here we go.

Hi everyone. Welcome back to the Pivot Method podcast. We're going a little sideways today and talking about personal and cyber security. I am so thrilled to have my good friend Willie Jackson.

Here to talk with us. I'm really fascinated by this at the moment for a few reasons. One, we see all the cyber attacks in the news and these big huge companies like Target and JPMorgan Chase getting a compromise. And as some of you may know, the Jenny Blake website was recently hacked and it's been a long slow month of putting the pieces back together. So we're going to start with some conversation about personal security for everyone and then we'll get into backups and monitoring and things that people who actually have websites. What you can do to protect yourself First, a little background on Willie. We got connected through Auntie Pam Slim I think back in 2009 or 10 she featured us both on her side Hustle series for her blog Escape from Cubicle Nation. Willie and I been had a phone call. He also had escaped corporate land as a something computer related consultant Grant Science Accenture. Is that right Willie? Okay, cool. And since he's been working as a web strategist, Willie's specialty is in web performance, site speed, page load times, optimization, all that good stuff. He completely saved me when my sites were crashing constantly under Dreamhost Purview and so it's a real pleasure, Willie. And Willie also helped me spot a hack attack and figure out what to do about it. So thank you, Willie, for being here with me.

Cheers. I also babysit and mow lawn, so let me know if you need some help.

Wonderful. He loves gummy bears. If you ever need to bribe him.

Oh, my gosh, the gold package. So this is a little premature to be sharing my wish list, but it's important information.

Amazing. All right, well, the first thing I want to ask, I think when it comes to personal security online, it's easy to go with the ignorance is bliss mindset. Like, well, it hasn't happened yet. I'm probably fine. I think maybe nowadays people are having slightly more complicated passwords, but not everyone. Many people I know don't even have a lock on their phone, which to me is like leaving your front door unlocked. I know. So what's important for everyone listening to this call? What's important about actually paying attention to this and learning more about how to stay secure online?

Yeah, it's a really. It's a great question. It's a tough question. I don't know that there's a straightforward answer. Security is challenging. The best and the brightest that you've seen don't have it figured out. Not even close. And what I would encourage people to do is what you said, Just start paying attention because it's really easy to get overwhelmed and there's so much to know. I would just start thinking about it and just being conscious of places where your personal information goes. So this stuff makes sense as you can start putting it into place, because there's just an overwhelming number of places where your personal security can be compromised. And I think the starting point really is awareness, because it depends on what we're talking about. Are we talking about the physical device? Are we talking about your computer? Are we talking about your website passwords? Who has those passwords? Is it your web developer? Are you outsourcing your security? So much to know and so much to think about it. Think about. So that's why I was happy to join you for the podcast today, because starting the discussion, I think is the most important piece.

Yes. It can be so intimidating for people. I think even those who are are concerned about web security. And like you said, it's not just online, it's also our physical devices. A lot of them don't know where to start. So what I want to do now is a rapid fire Willie as our human dictionary, I'm going to throw out. I listened to this really fascinating podcast with Tim Ferriss and Mark Goodman. He wrote a book called that's coming out in February called Future Crimes. And at the end it was this very, almost offhand rapid Fire listed five to 10 different types of security and tools for individuals. And I thought, you know, let's break that down for people in a really clear, easy to understand way. So I will link to that podcast just so everyone knows in the show notes. But Willie, is that cool with you if I throw out some terms and you give us the least you need to know? 30 seconds.

Okay, absolutely.

All right. The first term, two step authorization. What is it? Why does it matter?

Sure. It's also known as dual factor authentication. It's basically an additional step in order to authenticate. So for example, if you have it set up with your Facebook account and you're logged out, in order to log back in, you will need to be, for example, sent a text message with a short code to enter in order to complete the authentication process. You can enable this on your Apple devices. I believe Facebook supports it. I know at the very least.

They can send you a text message whenever your account is logged into. And.

There are some other devices that support it as well. But essentially it's a pain in the ass is what it is, because you have to take an additional step and passwords are a pain anyway. So two factor or dual factor authentication is essentially an additional step when logging into a product or service that typically includes being generated a short code via text message and having to enter that in order to complete the authentication process. In many. Actually, I don't know any products for the mass market that include this enabled by default, so you actually have to do it yourself. So we can include perhaps links to where you can do this with your Gmail account and with your Apple ID and things like that.

Great, thank you. Let's take one step back and even go more basic. Do people really need to have that crazy complex password? And if so, why? Because I think I know for a fact people who still use an actual dictionary word.

The answer is yes. And there's no excuse because there are products like 1Password, for example, that's absolutely phenomenal. It prevents you from needing to remember passwords because there is a client for your Apple device, for example, there is a client for your browser, which means that it can dynamically generate a secure password for you. And this can be sent between all of your devices, so you don't actually have to remember any passwords. And even if you lose your phone, even if you lose your computer, you still have an encrypted archive of your passwords for everything that can be accessed when you obtain a new device or log in wherever you need to obtain this information again. So there's no excuse, and I highly recommend taking a look at one password. It is absolutely worth the investment. And you absolutely do need a complex password. The reason is twofold. One.

It'S trivially easy to set up a script or a form of computers on the high end in terms of complexity and ambition to automatically try every word in the dictionary, just repeatedly logging into your account. And if you don't have something called brute force protection enabled, meaning if the service or the product detects a rapid or a significant number of back to back attempts at authentication that are failing, it will block that IP address or the username or some combination that, depending on your settings. But if you don't have that enabled, then someone could foreseeably try for hours and hours and hours and eventually they're going to guess it.

We have access to vast computing resources with the advent of cloud computing, so you could literally spin up a farm of servers that are trying hundreds of thousands of username and password combinations per minute. And since many people use really predictable usernames, such as admin with WordPress, or first name last name or first initial last name, with their various products and services and accounts will make it really easy for hackers to get into our personal accounts. And then to make matters worse, we'll have a really, really easy to remember password. And that's just.

It's not really a question of whether or not we can be hacked. It's when somebody cares enough to try. Because I deal with a lot of passwords in my line of work and it's terrifying to see how simple these passwords are. Another factor is the issue of passwords being transmitted in plain text, in plain English. If you're logging into Facebook and Bank of America and things like that on unsecured WI fi, public WI fi in Starbucks, or really even at somebody's apartment where there are a lot of people connecting to the network, you stand the risk of your password being.

Captured. You can use free software to grab usernames and passwords out of thin air. And it is incredibly easy to do. And there are all sorts of terrifying stories where this is done and it doesn't take a lot of work. There are other issues that relate to that, but those are the two reasons why, yes, absolutely, you must have a complex password, and I would strongly recommend.

Keeping an eye out for things like your login information being transmitted over HTTPs. So if you look in the address bar of your browser, you notice that some sites like Facebook has a URL that says HTTPs, which is Secure socket layer. It's just a method for securing the transmission of data between your computer and their servers. Which means that if somebody did try to intercept these packets of information, as it's known in the technology nomenclature, they wouldn't be able to do anything with it because it would be scrambled. Whereas if it were just being transmitted in plain text or over an unencrypted connection, rather, this information would be visible and they could use it. So I know I'm pointing that out at you, so if you want to unpack any of that, then let me know.

Great. Super helpful. Before we, I have some follow up questions on public WI fi. First, with one password, can someone share that account with, say, an assistant or specific accounts within 1Password with others on their team?

Yes, they have the concept of vaults where you can have one for your personal banking information, for example, and you can also have a vault with shared login. So absolutely there's support for that.

All right, good to know. That knocks out my objection. Why I haven't taken the time to set it up yet. No excuse, Hashtag no excuse me.

Because we haven't done this. We haven't done the podcast yet.

I know. All right, Willie, you mentioned how terrifying it is that when we're on a public WI fi, even Starbucks, hotel, Internet people, it is so easy, and I think it's so much easier than people realize for hackers to grab anything and everything you're sending through the ether if it's not on a secured network.

So airplanes as well. That's what I figured. I forgot to mention, you know, it's so easy. So easy.

And airport. And airports as well.

My goodness, yes. I'm going to break out in hives as we keep talking about.

Oh, my gosh. Okay, I'm going to owe you a bag of gummy bears. All right, talk to us then about vpn. What is it? How do people get it?

So VPN stands for virtual private network. It essentially creates a secure connection between you and the public Internet and it proxies your requests in a secure fashion. So it's kind of like, I don't have a useful metaphor handy. But the thing that's important to realize, or I think it's important to know, is that if you're using VPN service, it mitigates the significance of you not using a secure connection. Because your connection to the Internet is secure by virtue of the fact that you're using a vpn. These technologies are becoming more and more prevalent and they're really cheap. I personally use a product called Cloak.

I believe the website is getcloak.com and I've had a fantastic experience with them. I believe it's $100 per year and they have other plans. They just released an updated version of their website. So I'm not familiar with the pricing off Canon, but I believe when I purchased it a couple months ago, it was $100 for 12 months, which is fine. It has an iOS app, it has a desktop app for your Mac, and I believe other platforms are supported as well. But it's a web based technology, so you can technically set up a VPN regardless of the platform you use for your computer. And I could not recommend that enough. I constantly connected to a VPN on my iPhone and my Mac and my iPad and whatever else I own.

Pardon my throwback question, but when I was at Google we had VPN and we had to use a physical card or device. Is that out now? All web based?

I missed the second half of your question.

When you're at Google you need a VPN these days. Does it have a physical component? I know some people plug in a little tiny black thing to their USB port. Or is it all able to be virtual now?

No, that ties together VPN and the dual factor authentication. So you were using it and you didn't even know it. So that's what that is. And VPN can be used.

Oh, sorry, go ahead, please.

No, please.

Well, tell me if this works. I would say the analogy of what a VPN is, it's like a moat around your castle. And when you sign up for VPN you're lifting all the drawbridges and now there's at least a moat. So maybe people could swim across the moat and fight the dragons. What do you think?

That's pretty good. That works for this context. And the reason I'm qualifying that is because it can be used for multiple things. VPNs for example, can also be used to connect you to a private network. So that's probably how you're using it at Google, where when you use the vpn it connected you to this private, private connections where you are. It was as if you were on the private network that they had set up, which is inherently more secure than making the network available over the public Internet. So the VPN can serve multiple technical functions based on the business goal. But for our purposes, we're simply using it to secure our connection to the public Internet.

Awesome. Thank you.

Okay.

The last personal security tool or strategy at least. Actually two more, but one, this is one Mark Goodman brought up on the Ferris podcast. He said, don't log into your admin account. Let's say you're on a Mac. Don't log into your admin account for daily use and certainly not public use. Create a user account and use that. What's important about doing that?

Well, the thinking is that if someone obtains remote access to your computer, then they'll be able to do everything that you can do. I think it's good advice. I can't imagine anybody listening to this. Who's going to follow that? So it's challenging. It's challenging to think about these things. And.

Who'S going to set up a separate account? It's already hard enough to get our software working, depending on what you do for a living, and then to set up a separate account and deal with those permissions and have to authenticate with additional passwords. That's a bit challenging. So that's not yet something I'm recommending. It's not bad advice. It's great security advice. But the best security advice is not just something that makes sense, it's something that people are actually going to do. So I'm not going to shout that one from the rooftops, but I understand it and it is sound advice.

Right. Okay. Then the other one. I'm curious what your thoughts are. He suggested buying something like a Chromebook for public use or international travel. Chromebooks are basically Internet only type machines and they're under $300, hovering maybe even around 200 nowadays. What's your thoughts on that? Do you do that and is that something you would ever consider?

It's a great idea. I don't think I'll do that in the short term because there's so much software that I use.

Is set up and configured more comfortably for me on my Mac. So I have these shortcuts and things like that. So it would be a bit of a challenge to connect or to transition.

My workflow to a Chromebook. It's something I would consider if I was doing work that was more in the public eye. For example, I have a number of friends who are doing activism work and they come under attack for, you know, hate from hate groups who don't want to see their cause furthered. So I would certainly consider it if I were in that kind of position where my personal safety was in danger and where they were actively, you know, there were active attack attacks being made on my personal security and privacy and my safety. But as of right now, I don't think enough people care about me to actively seek out my personal security. Except for maybe a few ex girlfriends. But I'm more technically.

I'm safe for now. So I think it's great advice. But again, I can't imagine anybody getting off, you know, listening to the podcast saying, dan, I'm going to go Circuit City right now and buy a Chromebook. So it's sound advice, but I'm not sure that that's practical for the vast majority of consumers.

And what are your thoughts on desktop antivirus software? I think we've all had that 1990s nightmare of the software hijacking your computer and expiring and sending you all the pop ups. So what is any thoughts on that for today's day and age?

I haven't used a Windows computer in a long time. I don't even know how to turn on a Windows computer when I'm at my parents house and they want me to do something. I don't even know how to get to the place where you do things. It's just icon. But anyway, if you're using a Windows computer, then an antivirus is not optional.

The Mac operating system is not impervious to attacks, but the incidents of compromises are just vanishingly low in comparison. So there are antivirus applications available for the Mac and if you're paranoid for giving you peace of mind, I would absolutely do it and have an antivirus software. It's better to have it and not need it than to need it and not have it. But I don't personally use antivirus on.

My.

The Mac OS is built on an inherently much more secure operating system than Windows, and of course if you're using Linux, the same is true for that as well. So I think antivirus is a great idea. I think it's not optional if you're using Windows, so stop what you're doing immediately and download one. If you're using a Mac, then if you like to live life on the wild side like I do, then there's a I believe you have a link to Kyperskies or Mac. Is that right?

Yes. Kaspersky Yep, I'll put it in the show.

Notes yeah, they've been around for a while and generally have a good reputation in the security community.

They did at least the last time that I was tuned into the desktop security world. So I think that would Be a really strong foundation for people using Macs as well.

Fantastic. Let's move on now to security backups, monitoring and recovery for anyone who manages a website online. As I mentioned at the start of this podcast, hallelujah. For Willie Jackson's monitoring systems that he had set up, we started to see, as he mentioned earlier, this idea of brute force attacks. And we started getting these notices on the hour, basically. And I had a very complex password, so I thought, though admittedly had used it on multiple sites and had sent it over. I try not to send it over email. The point is, these kept coming in. Willie and I start. Ears started to perk up. But we thought, oh, this thing happens. You know, it's no big deal. But it was pretty relentless. And next thing we know, they're in, the site is down. And this is not for lack of trying or knowledge on Willie's part, but as you said, they're very, very sophisticated, and no one is immune. So.

It was just a really interesting process. And I'm so grateful that we had the monitoring tools that we did in place just so that this was on our radar, because I listened to former FBI head of cybersecurity, Sean Henry, talk about how major, major corporations. It is not a question, like Willie said, of when, of if they will be compromised, but when. And many of them will have been hacked months ago and they don't even know it or they haven't been following the clues. And these are the biggest Fortune 10, Fortune 100 companies in the world, so you can only imagine what we may be facing. And it was only a month after the attacks. I wondered, why me? What are they doing? What do they want? You know, it's kind of weird not to know what they had done.

Leave alone, right?

Where's my umbrella? Okay. And so then once we had recovered the account, I still didn't know why they had been there. And then finally, I was doing a. I had Google site search installed on my website. I did a search for something random, and all of a sudden I see hundreds of pages called Jennyblake me christianlouboutinforsale. And there were all the link bait and everything inside those pages.

And you're like, first of all, I'm never right. Second of all.

That'S right.

I know. Like, hey, if I'd put that there, that's one thing. But no thanks to these Eastern European hacker content. All right, so on that note, Willie, let's dive in now. Let's first talk about security and backups in general, and then we'll move into monitoring and recovering after a hack attack.

Yeah. So some necessary context for people listening Jenny's websites use WordPress. WordPress is an application built on PHP. And yeah, WordPress has a reputation for being a bit insecure, which has become less and less true over the years. They do put a focus on security and security releases are really common with each update that they make. So there are bugs in all software, there are security vulnerabilities in all software. So it's important to set that context. If you're using WordPress, it's a different ball game because it's open source software, meaning that anyone can contribute to the project. So a 16 year old kid in Serbia can write his first plugin. That plugin can get distribution with literally the entire WordPress community the next day. So it's really challenging because you don't know what you're opening yourself up to by installing this software that hasn't been vetted by security professionals. So the interesting thing about working on your site and investigating this is that we weren't even looking for this specifically, but we found, I was honestly shocked at the volume of attempts being made on your site because you just don't have a gauge for it. And that was one of the really illuminating things. So I believe we were using, we're using a few products. One was called WordFence, which is a fantastic plugin for WordPress that can do a few different things. There are a number of policies that you can set and once I enable that and the Sucuri plugin, there's a company that specializes in web application security called Sucuri. S U c u r I.net I believe is the URL.

Once we started logging these attempts, I saw the volume of them that you were mentioning and it was staggering. And what this illustrates is the fact that someone was targeting your IP or your site specifically or your IP range. Something. It could be this IP range in your data center. It could be somebody who actually hates learning about life after college and things that you do professionally. Who knows? Who knows what the reason it's irrelevant. But the point is you were definitely being targeted for whatever reason. It could just be your IP address.

And they were really trying to get in. So we had to take some measures to make that more challenging for them because it's a numbers game. Eventually the right combination could conceivably be matched and someone could gain access to your site. So there wasn't somebody sitting behind their computer and saying, what is it? All right, Skittles hello Kitty 69. Nobody's actually doing that. That's a script that's running and trying to gain access. So we put something called basic authentication on your site, which helps with security, but it also, because WordPress is PHP, makes it susceptible to your site going down if someone hits a script over and over and over because it's. It's not intelligent, it's just code. So that code is executed when a file is hit. And we wanted to prevent your site from going down as a result of repeated attempts being made. And so that's some of the thinking behind the steps there. I'm going to turn it back over to you because I'm getting lost in the answer and I want to make sure we're staying on track.

This is great. To recap, Willie mentioned Wordfence is a WordPress plugin. Sucuri. Net. They are fantastic. It might seem like it's on the expensive side. I was paying for two sites, maybe 80amonth. But I got to tell you, it's worth it. They're very responsive. They send a monitoring report, they flag immediately if it looks like your sites have been compromised. And they're very helpful at getting things back up and running. Willie also mentioned basic authentication. And then for backups, I use VaultPress. Willie. I know. I think bloggers is kind of like, eat your spinach. They know to back up. Are there any other backup tools that you recommend.

VaultPress for? WordPress is probably the best product I can recommend. It's actually from the company that makes WordPress, a company called Automattic. So it's really good at what it does. I believe it just starts at $5 a month if you want to do some basic backups. And I believe it goes on up to 40 or more for the professional plan. And the higher tiers include.

Active security scanning, so when changes are detected, it will flag those. And.

You can actually patch these things dynamically using the web interface. So that's an interesting component. I wanted to clarify that security is not just a they have a WordPress plugin, but they're also a service so you can subscribe. It's a subscription service where they can actively monitor the security of your site and the integrity of your files. And if they detect a change, then they'll alert you via email and you can take action. You can engage them to remove the compromise from your site and harden it, which is a term in the security nomenclature, to increase the security on file system. So there are a number of steps you can take. I just wanted to Clarify the fact that Security has a free plugin and also a paid service. And if you are subscribing to their service, then when your site, in the event that your site is hacked, they will fix that for free.

Got it. Thank you so much. On the subject of security, and that is surprisingly hard to say. By the way.

I've seen you spell it like four different ways. I think you did it in Swahili the last time, but I'm amused nonetheless.

Oh my God. I gave up trying to figure out how to spell it. But I'm saying.

They did us no favors with the name.

No, they certainly did not. They also have a cloud based firewall. Can you explain to us what a firewall is and who, if anyone, should use it?

Sure. A firewall can be a physical device or a software product that filters traffic based on predefined rules. So.

Whatever they call it, Security has a web application firewall product called Cloud Proxy. And one of the important things that this does is it prevents unauthorized IP addresses from reaching the admin portion of WordPress.

It works for virtually any application, but they specialize in WordPress, so I'm speaking to that specifically. So it's super useful and it's relatively affordable. And there are a number of products that do simple things, but they're probably at the forefront of WordPress application security for the mass market. And I haven't personally tried the Cloud Proxy product, but I've worked on sites that had it enabled and I can assure you that I was not able to reach any kind of login screen until my IP was wide listed. Another one that's free that has both performance and security implications is cloudflare. Cloudflare is a product that they call themselves CDN product. And I wish they wouldn't because it's confusing a lot of people that I work with. But Cloudflare is actually a security product that happens to have some performance benefits as well. And they do traffic proxying at the DNS level and all the sounds. But essentially it invisibly improves performance and security of your site. And there's a free tier that I'd recommend for everyone as well. I'm a Cloudflare customer and I recommend it very highly.

Great. I wanted to mention you mentioned. Oh yeah, go ahead.

One final thing. The reason that a lot of these security products are so beneficial isn't just the function they serve. It's because there is a network of people using the products and there is this intelligence being gathered. So, for example, if you subscribe to the Security blog. They will regularly make updates about the state of the industry with WordPress or Joomla. Or Drupal or the various products. And these attacks spread like wildfire because when something works, then that will spread through the hacking community and that will in turn spread through the ecosystem of the particular product. So what you gain by plugging into these products is this universal awareness, if you will, because it's a constant battle. And I don't know about you, but I would personally rather have a full time dedicated team, if you will, thinking and working proactively to secure my site, rather than just hoping my number doesn't come up, if you will.

Absolutely. And for that reason, we moved my website to web synthesis, which is a product of Copyblogger, which surprised me. And they include backups and have a partnership with Sucuri for monitoring. So that's where I am now. That's kind of where I ended up. But it's like Willie said, it's nice and it's very important to have kind of a team of people and these companies employ people to be monitoring around the clock. Because I think for me, I'm pretty tech savvy, I'm not at Willie Jackson level. But it's a helpless feeling to be watching a site under brute force attack and not know what to do about it. Thank goodness for Willie, who so generously kind of held my hand over email through what was going on and helped point me to the next thing and the next tool. But if you don't have that, it's really.

Intimidating of what to do while you're under attack. So it's nice to have these teams in place and these accounts already set up, they're under watch. They do look at what's happening. And as Mark Goodman mentioned on the podcast, not only is kind of our coding and Internet sophistication, it's growing at a very exponential rate, much faster than Moore's Law. But hacker sophistication is growing at a staggeringly exponential rate, as are the number of attacks. So as Willie said, it's not a great strategy to just sit back and wait for your number to be called and then panic and then have to figure all of this out in that moment. Ideally, you'd have some of these set up in advance.

Yes. It's not optional. And what you're mentioning, synthesis, which is the hosting product, the managed WordPress hosting product from other guys at Copyblogger, they have a lot of these things built into their infrastructure. So it's the same thinking they don't want to train up a team of people to actively be firefighting and doing that for their customers. So they created a partnership with Sucuri to address lot of these things. So it's a major issue. And these more boutique hosting companies and companies that really put the customer and security and performance at the forefront, those will best position you to care about these things. Because one of the promises is security. So if, for example, you're hosting a site with bluehost or dreamhost or any non. Any product that doesn't actually put security at the forefront and that's not a feature, if you will, your risk is higher because the nature of shared hosting means that these compromises can propagate through all of your sites, for example. So I have some sites with bluehost and because of the way that shared hosting works, if one of the sites on your account gets compromised, it's trivially easy for that compromise to spread through your other sites. And that's the entire business model, if you will, of the compromise because they have to propagate and sometimes these things will just be sitting there. I can't tell you the number of times I've been working on a friend's site and noticed something that didn't look right on the file system. A file that was doing something of some kind of back door. And I think that's what happened with your site as well. I wasn't even looking for that. And God knows when that file was uploaded there. In some cases it might just be sitting there. In some cases it might not have actually done things. It might be old. Who knows? The point is that we have no idea and we have to take these proactive steps to secure our businesses. In this case, this is not. These aren't just our kale smoothie blogs. We're running our. No disrespect to people who make a living talking about kale smoothies on their blogs. I love me a good kale smoothie, but these are people's livelihoods and we have to really protect that. Just like we would have a security system on our house if you don't live in New York City. Or there are layers of physical security and these things translate to the paradigm of security on the web. So it's the same principle.

Right? It's such a great point. And.

I think this is also like telling people to eat their spinach. But when updates are available or updates for plugins, the whole reason that they're having you update is usually it's a security flop. Maybe it's additional functionality. But I know in the past when I've gotten compromised, it's because they kind of came in through an out of date plugin. And like you said, having. My main sites are on their own hosting system now, but I have a lot of smaller sites through DreamHost that are on shared servers or where I don't update the plugins because I haven't even looked at that site in a long time. And so that's very vulnerable. I wanted to mention, Willie, you talked about Vault Press for backups. I have to share a funny story that you don't even know yet, which is that I was like, thank goodness VaultPress it has my site. We're going to be okay. So we wrote to them, we exported the most recent backup and it's wonderful. There was a whole calendar. You can pick what day of the backup you want. We reinstalled it and my sidebar was gone. And I was so disappointed. I didn't even know what it used to look like, what it used to say. So my friend melissa ansman of launchyourself.com she said, check out the Wayback Machine. It archives the Internet and there are screenshots and you can grab the code. So I grabbed the code, I did this this weekend, rebuilt the sidebar, finally made a note to myself to back up every widget in an Evernote text file. And then I realized I scrolled down the page down on the far bottom left, it says inactive sidebars. And here was my whole sidebar. I could have just drag and dropped those widgets, but I spent the time rebuilding it. So there's a tip. If you use a VaultPress backup, your sidebar probably is there. It's just down on the bottom left. But if you need to, Web synthesis does have this fantastic kind of frozen in time. It's not every day like Vault Quest, but maybe once a quarter sites will be backed up, which is nice.

Yes. The more you can do this to your site, the better. And this can get really, really technical. You can, for example, deploy your website from a GitHub repository. Git. Git is a technology that allows for distributed collaboration on software projects. And a lot of huge software products and projects are using Git for collaboration among team members. It's a wonderful technology. GitHub. GitHub.com is a fantastic company that creates a hosted repository service for these GitHub projects.

In the GitHub nomenclature, they're called repos repositories. And you can actually check in if you will. Your entire WordPress site into GitHub and deploy that repository to your server. What that means is that in the event that your code base is compromised, you can roll back changes, you can see what changed. You can always have a separate copy and a secure copy and a distributed copy of your code base to where it adds a really, really strong security layer to the product. So there are so many things that you can do. And deploying your code base from GitHub is not really within the reach of most people. So the rabbit hole can go really deep. I was working with, I was talking to a mutual friend of ours, Peter Shallard, on what it looks like to have an optimized and secure footprint. And it was a novel. It was an absolute novel. The point I was trying to make to him is that we have to take these small steps and be proactive because if you get caught flat footed.

The results can be disastrous. Peter owns a high revenue and a growing.

Community on one of his websites and it's just not optional to really think proactively about security. So to your point, there's so much to know and I'm really glad you're doing this for your listeners.

Awesome. Well, thank you for being here. I know kind of as we approach wrap up, more and more people, myself included, are experimenting with Squarespace. Do you happen to know anything about security or monitoring? I know they're very new to the site, pun intended.

Squarespace has actually been around for quite some time. I like their product and I'm more familiar with WordPress. I've been making a living with WordPress since 2010, but I can't speak with any authority to Squarespace's product and the security, but by virtue of the reputation that they still have in the market and just the ethos of the company. Based on what I know, and having worked with their product years ago and just seeing how they operate, I would feel pretty confident in having a Squarespace site. One of the reasons that Squarespace is interesting from a security perspective is that it's a hosted product, meaning that they're on the hook for security. And the reason that makes sense just from a practical perspective is it would be devastating PR for a company to have to report, especially a privately held company that charges a premium for a lot of their services. They integrate hosting and e commerce gateways and they have these beautiful galleries and things for creative professions.

People are really unhappy if there is a large scale attack, so they really care about it and because it's a platform, they can build security into it. So whenever possible you want someone on the hook specifically for security and I would certainly consider squarespace.

Okay, great. Thank you. Are there any other thoughts post JB Me learning experience? Is there anything else that you learned or would do differently the next time? I'm such a rookie of this that I already learned plenty.

No, I'm kidding. There was a ton I would do.

I think you're doing the right things by being curious and the things that make you uncomfortable are the problems that some people have solved on some level. So just start thinking, just start asking around, what do you do secure and you're just going to have to keep asking about it. There are a lot of things I don't know about, but I have people in my network who do know. So I ask these questions. But I think the one password would be I think one pass would be a fantastic start off point for a lot of people. I think getting some kind of VPN software like Get Cloak I believe is the URL getcloak.com IVPN.net is another product I like. It just didn't have seamless integration with my iPhone and my computer as I like. So Cloak is probably the best one. And having a product like Sucuri in place. S U C U R-I.net in place. Honestly, those things.

Put you in rarefied company in terms of proactively thinking about your personal security. If you use Apple device and WordPress in particular, I'd strongly recommend those things. So really the things that we've touched on, we can include a few additional links and references in the show notes. I think the things we've discussed are a huge step forward for most people because you know, honestly, it's just I deal with so many passwords, it's just terrifying. I have close friends who, you know, I won't preach with them, but I preach with them and it's just a matter of time before they have a very, very bad Monday morning. So do these things. People of Earth.

I love it.

You read my mind. Because I was just gonna ask you of everything we talked about, what is most important And I want to say something related to what you just said to me and stay curious. I did a fascinating interview with a professor. His name is Dr. Tom Guariello. I may have butchered his last name there. I'm interviewing him for the book the Pivot Method and he's launching a platform in January around Robo Psych, the Psychology of Working with Robots. And I'm fascinated by this idea that more and more things are being automated and technology is really becoming just increasingly more integrated into our lives. And I asked him, what skills do people need to play well with technology? And he said, it's not about skills. Skills atrophy. Typing may be obsolete in 10 or 20 or 30 years.

For Tom, Dr. Tom Guerrillo, he said, the two things you need is a mindset. You need to be open and conscientious. Open. Are you willing to try new things? Are you willing to learn? Are you willing to admit what you don't know and then conscientious. When you do pick something, can you apply yourself and can you be really thorough with how you use that? And, Willie, it just. That came up for me as you were talking, which is that using any one of these tools is almost a skill that's not necessarily going to be the tool that you stick with for the rest of your life, for all time. So it's very important to maintain an open mindset and one of constant curiosity, really, and being willing. Maybe it's a lot. Maybe it's like managing a finance portfolio that once a year you need to rebalance and understand, okay, what's working, what isn't, what has been upgraded. And it's not something, I think more and more cybersecurity and personal security is both a mindset and a skill set that behooves us all to invest in.

Yeah, I think that's brilliant. And I do recall you.

I do recall how you felt, how you mentioned feeling when these security things, these security issues were taking place, because it felt like. I'm sure it felt like somebody knocking on your front door repeatedly. It's such an awful and disempowering feeling. And the quote you just shared is brilliant in that it truly is a mindset. The products come and go, but the posture of somebody who has to care about these things, which is everyone, that will never change. So I think that's wonderful. And we can extend that to, you know, if you want to purchase a product or purchase a service, you can ask them what they care, what they think about or what security measures are in place. And you can, you know, there are all sorts of things. So I will. I'll give this some more thought, and if there are some additional links I can share, I'll do that. But I think that's a brilliant way to think about it because it really is overwhelming, but you still don't have a choice. You have to think about it.

Right? Willie, thank you so much. Where can people find you if they want to keep in touch, ask questions and or send you a bag of.

Gold hair bugami Bears okay, it's Willie W I L l I e jackson.com if you start there, you can find me everywhere. That's my handle on Twitter and I'm around these Internets, so get in touch. Happy to chat.

Awesome. Thank you so much Willie and everyone. Thank you for listening. Good luck with your next steps and if you have questions about this, go ahead and throw them in the comments on the JVBennyBlake Me blog.

Thank you. Bye everyone.

Thanks so much for listening to this episode of the Pivot Podcast. To learn more and get in touch, visit JennyBlake me where I blog about systems at the intersection of mind, body and business. Or find me on Twitter ennyblake. And remember, build first, then your courage will follow. Hasn't it always.