Ep. 121: How To Handle Security and Manage Risk With Your OFS

Welcome to the Secret Sauce of Outsourcing podcast that's dedicated to making you better at outsourcing to the Philippines. This is episode 121, how to manage security and risk with an OFS. So we're an outdoor family and there's risk associated with everything. We love to trail, run or ride mountain bikes or road bikes or ski. We sled a lot with like single track sledding on little sleds that are interesting. My favorite thing to do in outside is ski in the backcountry. It's exhilarating. It requires both physical and mental strength and awareness. It requires your attention. So last week I was able to ski. We had a big storm and I was able to ski three really steep lines of fresh powder. Nobody had been there. It was amazing. But part of skiing in the backcountry is managing the risk. Like, what happens if someone gets hurt? What are the chances of someone getting hurt on this line? What if this slope avalanches. What are the safe zones? Where can we stop? How do you get. How do you avoid an avalanche? What kind of avalanche is going to happen if it happens? Where's a stopping zone? What are the emergency numbers to call in this area where we are? Who's going to get here to help if we have help? Does everybody have all their equipment? There's all kinds of things that go into managing the risk in the backcountry. And there's a lot of risk management in working with OFS also. Now, fortunately, a lot of that risk management is kind of simple because of the culture of the Philippines. Like, they don't want to steal your stuff and so there's just less risk. However, let's talk about the managing risk in the Philippines and ways you can do things you can do to mitigate risk. So I have a list here of like 11 different topics that I want to cover. So let's start with one cultural factor. So Filipinos are honest for the most part, and especially with foreigners. Once they get a job, they really just want to keep the job. They don't want to steal from you along with that. So personal data isn't. There's. There's not really any value to it in the Philippines. There's not a market for them to sell it, at least. I've asked my team about this and they were like, what the. Why would. There's no value to this data there. Credit card information, like your credit card for them is if they were to steal your credit card, number one, they'd lose their job, which is like the worst case scenario for them. Number two, it's so easy to get your money back. If something gets stolen, you tell the credit card company, hey, this was fraud, done, your money's back from your credit card. That's super simple. Number three, in the Philippines, so they really, really respect authority. I don't know if you've, if you know the power distance index, it's like Hofstadter's power distance index, which measures how much does this culture respect someone above them? Like how much do you look to them for decision making or whatever? In the US we have very little respect. We're very low on the list. The Philippines, very high on the list of respect for authority. And so theft in the Philippines, number one, comes with severe penalties. The Philippine government has made cybercrime laws especially strict because they understand the importance of virtual work, what it bring into the Philippines. And then digital theft also has double the punishment of normal theft. So like stealing something in the Philippines is there's not an incentive for it. There's such a strong deterrent for it. I've seen hundreds of thousands of people hire people in the Philippines and I've seen so few cases where someone stole something. In almost every case it was because the employer tried to cheat the worker out of doing work and not paying them. Okay, so those are the cultural factors going on in the risk management with the Philippines. Now let's talk about some like sharing things, sharing passwords, sharing data. So sharing passwords. The best thing that we've ever found is using a Password Manager LIKE LastPass WHERE you can store your passwords in there. Then in your account they have their own account. You share your password with their account. It does not actually give them access to the password. It just lets them auto fill the password into a website so that when they go to the website, LastPass will fill the password for them. They can log in, they never see the password. And then if you want to, anytime you want to in your account, you can just revoke the password and it's out of their LastPass account. So they never, they never saw it and they don't have access to it anymore. Super simple. You don't even have to go in and like change your passwords or anything. You can just revoke it. That's a really, really easy way to manage passwords. Next, like data. So sharing data and files, whatever Google Drive allows you to give specific permissions on files or even down to like permissions to view the contents of a certain cell in a Google sheet, they give you all kinds of access rights, so you can grant access and you can revoke access. It's really good for managing data access. So now let's talk about, like, actual work getting done and security. So, number one, if you can make sure that your OFS has their own computer, that's a big deal. Any work done, like at an Internet cafe where it's on a shared computer, the more people that are accessing that computer, the more ch that someone else gets access to your data. Now, the chances of someone malicious getting on the computer after your OFS does is pretty slim, but it can happen in the Philippines. I don't know why this is the case, but everybody I've ever talked to said the computers are notorious or the systems that they're using are notorious for not actually logging you out at an Internet cafe. So you use it, you log out of the system, and it doesn't actually log you out. And someone else comes in and. And they're in your email account. So that's weird. That's why we say have them have their own computer. Even if they're working at an Internet cafe on their own computer, totally fine. If they're bringing their own laptop now at home, this is the number two. So very often in the Philippines, they'll have a single computer for the household, and multiple family members will share that computer, which is. I mean, this is standard in the Philippines. So it's not the same thing as having, like, a shared computer in an Internet cafe, but there is some risk involved where, like, a family member can access stuff. So what we recommend you do is ensure that they have set up their own profile on the computer and that other family members aren't using that profile. And this is really just all you can do is just ask your people to do this right, have them set up their own profile on the computer. When they work, they use their profile. When they're not working, they log out of the profile, and family members need to log into a different profile so that they're not accessing the same things. So next I got a question asked recently like, what about them getting hacked in their work? Are they more likely to get hacked because they have a crappy computer or something? The answer is no, they're not more likely to get hacked. Targeting an individual computer is really difficult. And then the Philippines is kind of less likely to have valuable data than someone in the US and so I've never heard of a case of someone getting hacked with the purpose of stealing. In fact, I've never even heard of any, any of my ofs or anybody from online jobs getting hacked. I'm sure it happens, but I've never heard of it. So if you want to improve things, here's a couple thoughts. Number one, if they're using HTTPs, if they're using a website that has HTTPs, everything's encrypted. Number two, you can easily have them use a vpn, a virtual private network which will encrypt everything on top of that. So if they're connected to a vpn, it's going to encrypt everything, it's going to run it through the VPN servers encrypted. And so it just adds a layer of security. VPNs are super cheap. If you pay for a year, it's like two to three doll. And that's a super, super easy way. It can also add some really good benefits of a lot of VPNs will have servers all around the world so they can log into the VPN in the US and have a US IP address so that they can access services that maybe are geo restricting content. So like if, if a tool that you're having them access only allows a US based IP address, then a VPN is a really good way to get them a US IP address, even though they're still in the Philippines. And it shouldn't slow them down any. So next, if you don't actually want them working on their own computer with things you can actually set up remote desktops. So here's how this works. If you've ever used like Log me in or Remote PC or anything like that, what you can do is set up so that on their computer they have software that they log in and it'll connect to your computer. And it doesn't have to be your personal computer, but you can set up a computer in your office where they log in and then they're doing the work on this computer. So there's a screen on their, a window on their computer that is showing what's actually happening on this computer. And if this computer's in your office, you could be sitting there watching that computer and see them moving the mouse and clicking on things. You could see what's actually happening. They're sitting on their computer and the data never leaves your computer, it never leaves this computer here. So anything they're doing, it's on this computer. You can set it up with. Like they can download files to their computer or they cannot download files to their computer. There's, there's all kinds of options in using A remote desktop situation. And there's all kinds of services that'll do this. Like logmein.com is a super prominent one. There's also free ways of doing it. I'm not going to get into that. There's a couple issues with this. Number one, there's because there it's show. It's like sending the whole video feed to them. It's going to slow things down. They're going to have lag and it's going to slow their work down. How much depends on their Internet connection, depends on what they're doing. So you can test it. Number two, each person in the Philippines would need to have a computer in your office. You can't have two different people logged into the same computer. That won't work. So if you have a team of people and you need them all doing this, then you have to have a team of computers for them to log into. So the last thing I want to talk about is like virtual card numbers. So I talked about credit cards and how secure they are. However, if you're still concerned about it, you can easily use a virtual card number. So like Capital One, for instance, is. One is a credit card provider where I can log into my Capital One account and create a virtual card number. I can then give that virtual card number somebody in the Philippines, they can use it. And then if I want to, I can just deactivate that card number. So that's an easy way to give access to a card and then take away access to a card. Where like if you give them your actual credit card number, well, now they have your credit card number and when you fire them, they could do something. It's super unlikely, but they could, right? And then in terms of like them stealing from you. Well, I've already said that with credit cards, it's super easy to just get your money back. You just tell the tell Visa or tell your bank, like, hey, this was fraudulent and it's almost like instant. They give your money back. So the last thing I want to say about this is, and this is, I mean, I've given you opinions throughout this whole thing, but here's my opinion. In my opinion, you are more likely to have data stolen, get hacked, have a problem with someone sitting in your office in the US Than you are having an OFS in the Philippines working on things for you. The incentive for them to steal just isn't there. The culture changes it. They don't want to steal your stuff. The penalties, it's just not likely to have a security issue. With working with someone in the Philippines. So I hope these tips have been helpful to you in making you feel more secure towards hiring someone or towards working with people, or giving your current people more access than what they already have to make your life easier.