John Jonas says Filipino specialists' hardware and internet are fine, but social engineering is the real threat. Attackers impersonate executives via lookalike emails to trick staff into clicking malicious links. The fix: hover over URLs, check email headers, refuse unexpected downloads, and encrypt sensitive files.
Chapters
Welcome to the Secret Sauce of Outsourcing podcast that's dedicated to making you better at working with OFS online. Filipino specialists. This is episode 169, the Best Ways to keep your data secure with an ofs. People have two really big concerns when working with ofs. How do I trust the person? Like, are they going to steal my stuff? Are they a problem? Are they going to talk bad about me if it doesn't work out? That's one. And then number two is what about data security? Like, how do I keep my data secure? Are they going to get hacked and cause me a problem? Are they more likely to get hacked than me? So let's talk about it. So the interesting thing about the Internet in the Philippines is most of the technology that they have is the same as our technology. A bunch of people on my team, they're using MacBook Airs. They have iPhones, they have recent generation Android phones. The Windows computer they have has the same firewall that your Windows computer has. Routers in the Philippines are still made by Cisco or Linksys, the same companies who make your router. So how secure is the Internet? Are they more likely to get hacked than you? Well, it's probably about the same. And the reality is that the weakest link in the chain is you and them. It's the human. In fact, this security vulnerability of you has a name. It's called social engineering. So social engineering is when a scammer, a hacker, whatever, cons someone into giving them information because they think they are someone else than who they are. The hacker, the scammer, perpetrates themselves as they pretend to be someone that they're not. So here's what happened to us. This week, our support people got an email from me asking them to handle something urgent for me. It didn't say what the urgent thing was, it just said reply with your mobile number. And it said, best regards from me. Right, well, the email was from me, it was from John Jonas, but if you looked carefully at it, it was actually the email address. I'm going to read this to you. The email address was Sarah Bailey, 202323 mail.com so someone else had created an email address at Gmail and put in the name John Jonas in order to send our support people something. I don't know what they were trying to get. And this, fortunately for us, Gmail caught it. Like Gmail had a big yellow warning message on it that said, be careful with this message. But one time in the past, our support people got an email saying, will you please re enable this account. And Gmail didn't catch it and it was from me and it was actually from the person in the Philippines, the job, the OFs who we had banned them from using onlinejobs ph because of the way they behaved and they couldn't figure out how to get another account. And so they had resorted to creating an email address me and emailing support saying, hey, re enable this person's account. Now that's, you know, that's social engineering. That's someone pretending to be someone else trying to get something that they want without going through the proper channels. So I sent an email, actually I sent an email before this second email, the one with the big yellow message. I sent an email to my team saying, hey, I want you guys to be careful about this because I asked my team for a password that I didn't have that I thought they had and said, hey, be careful because we've had problems before in the past with someone pretending to be me. I want you to verify this email is actually from me. And then the next day we had this other email that came in that was someone pretending to be me. It was a really good lesson for my team to say, like, oh, when something important happens, when someone is asking for important information, you need to verify the source. In terms of securing your data with your team, this is the most important thing that you can talk about with them. It's not like you, how's the firewall on your computer? Or like what, what kind of Internet do you have? Or don't use public WI fi, All those things are kind of less important, especially when someone, when they're using HTTPs with the website secure, an HTTPs, the secure site, is going to encrypt everything happening between them and the server. The problem is when they have information that someone else could get from them. Here's what I did with my team this week just to make sure to increase our security. So I told them a couple of things. One, think before you click any email that you get. If there's a link in it or an attachment in it, think about it before you click it. If you're unfamiliar with what it is, then don't do it. If you're not expecting this attachment, if you're not expecting the link, don't click it. It's a problem. This is where problems happen. And a good way to check a link before clicking it is to hover over it and look at the bottom left of the brow and see what the URL actually is. Oftentimes you'll see scammers pretending to be Microsoft, and then it sends you to a Russian website. And you can see that by looking at it, looking at the URL before you go to the link. Next, I asked them to verify who actually sent a message, an email message, before. If the message contains something important. And the way you do that is by if you click like in Gmail, you click the three dots and you click Show Original, it'll show you all the header information for it, which is a whole bunch of garbage. But you can look through that and see, like, oh, what email addresses are associated with this message? Is it some weird random Sarah Bailey, 202323 mail? Well, that's clearly not John, so that's an easy way to check and see. Okay, this is asking for important information. What should I do with this? Is this legitimate or not? Number three, I told them, was don't download files you're not expecting, period, ever. So now, as another piece of advice, if you're really worried about security, and this would be number four, you can encrypt and password protect your files. You can do this in Google Drive. You can do this in Microsoft's OneDrive. It will secure things from it just being passed on to someone else on accident where, you know, it can't just be shared to the wrong person because it has a password and it needs that in order to be used. So, in summary, the Internet in the Philippines isn't less secure than yours. Their computers aren't less secure than yours. Typically, they're not more likely to get hacked than you are. This mostly comes down to social engineering. Are your ofs susceptible to social engineering where they could get. They could have someone pretend to be someone else and get data from you, educate them on these things that we've talked about. And maybe your industry has other things that might be able to be socially engineered to change passwords or to give out sensitive information that you should educate your OFS on to prevent this problem in the future.
