Privacy and Cybersecurity: What YOU Should Know

According to the National Small Business Association, half of small businesses report that they have been the victim of a cyber attack. And in spite of that, many small businesses think cybersecurity is only necessary in big business. So today, that's what we're going to be talking about on Marc Haine Live. Welcome to this episode. This is where small business owners and entrepreneurs pick up core skill sets to help them create the show-stopping, jaw-dropping experience that their customers and their employees deserve. I am your host, Service Expert and Master of Experiences Marc Haine. I am so glad that you are here with us today because my guest for this episode is security geek Ross Sanders. And today, we will talk about the importance of privacy within your business and some things that you should know about cybersecurity. So, stay with us. I am absolutely shocked when I talk to small business owners about the issue of privacy. I get the, ah, there's no such thing as privacy anymore. So, why even bother? And yet, when you see that the statistics say that those people who do have privacy breaches, 60% of those small businesses who get affected actually end up losing their businesses. For leaders, in-house and online privacy is an absolute must. So that brings us to our Question of the Day. So, what do you do to secure all the data that you collect in your business? Because it's vast. You're collecting employee files, customer content, all sorts of information every single day. So, what do you do to secure it? I'd love for you to share and let us know. So, go ahead and post it in the comment box. And please use the hashtag #ExperienceLeadership so that we can track the conversation and make you a part of it. As I mentioned, today's guest is privacy and security geek, also known as the PrivSec Director at Bamboo Data Consulting. Ross Sanders. Ross is a global privacy defense security and infrastructure specialist working in numerous industries to implement privacy programs and cybersecurity controls. And by his own admission, privacy can be a little bit, uh, but today, it's going to be exciting. Ross does hold a master's degree in the management of technology and innovation and holds designations and certifications in privacy legislation, ethical hacking, and paralegal practice. Ross serves as a co-chair of the International Association of Privacy Professionals for Johannesburg chapter. Ross, welcome to the show! It's great to have you.

Great to be here. It's exciting.

I was so happy that when we connected just before the show that we actually got to laugh already. So, I know that this is going to be exciting. Hey, before we get into today's topic, could you just tell us a little bit about about what you do for your clients.

Yeah. So, I mean, one of the things that we very much believe in is privacy and cybersecurity is not necessarily one of these chores that you have to do. It can make it out to be quite a chore. But it is there to benefit the business. It's a good way of doing business. So, we assist businesses in doing the real practical implication or implementation of privacy and security. Because you can go to lawyers and get lawyers to draft things for you. And they will give you fantastically legally binding, protect you, all sorts of things in your contract. But when you come to implement that into the business, it's wildly impractical. So, and I mean, not slating anyone who goes the legal route. It's very much required. But there is a translation to how you do that in the real business. And that's where we come in. We help with the policies, the procedures, the actual technical controls that you need to put in place on your laptops, in your offices, things like that to really secure the information that you've got. Make sure you're complying with legislation because, oh man, there's a lot of legislation at the moment around this. And we really try and make it absolutely practical. We train companies to do this themselves. We help them to really get involved in this privacy and security thing because every business is a tech business nowadays. And everyone's got to know what they're doing here.

And even though you might have owner operators who go, I don't know anything about technology. I don't. It is. It's absolutely true. Everybody's dealing with technology and everybody's connected now. I understand that you have had personal experiences with getting hacked.

Probably far too many. One is too many really. But a number of years ago, it's kind of the way I got into privacy and security was kind of twofold. One being I was working in the tech space. My whole career so far has been in the software as a service space, delivering software to clients, working with these multinational software companies. But during my time working at one of these companies, I had my identity stolen. And that was a real eye-opener of a horrible, horrible experience. So, it seemed as though what happened was some documentation was disposed of previously from a previous company that I'd worked for years prior. But the information that was in there was enough to build a profile of me and take out credit. And I ended up purchasing dozens of laptops and cell phones and furniture suites and all sorts of things that I never ever saw.

It's amazing because you hear these stories. You know, at about probably about 10 years ago, we had a big thing happening in our town where somebody had come in and installed fake debit machines at certain businesses. They hired, they got some kid to come in and get hired. And then, they switched out machines and they started stealing credit card information. We've seen hacks where something went over the bank machine like somebody puts something to hack in there. So, I know how tenuous it is, how hard it is to know for sure that you're dealing with somebody that's going to be taking care of you. I guess before we can really dig deep into today's topic, could we maybe clarify what privacy is and what cybersecurity is? Let's go down to basics.

Sure. And that's like a— that's a really valuable question because I think a lot of folks confuse the two of them. They hear about privacy and they're like, oh, that's that cybersecurity thing. Or they hear about cybersecurity and privacy doesn't even enter the conversation. But they're two very different but very intertwined parts of your business and any work that you do when you're dealing with customer information, dealing with employee information, dealing with your own confidential information. So, if we have to look at it as kind of an umbrella that we're looking at, we've got this umbrella of data protection. And underneath that protection of the data in business falls privacy and cybersecurity. And Privacy is really a lot more along the lines of the legal side of things. So, we're— and the ethics side of things where we're looking after the information of our clients, employees, suppliers, providers. It's that obligation that we have to make sure that we don't leak information out or we don't modify information that shouldn't be modified and put people at a disadvantage. So, it's very much around your Your policies, your procedures. How do you do things inside the business? What is right for you? What is wrong? What don't you agree with when it comes to data? That's the privacy side. But with any of those sort of decisions, you have to look at the security side because you can't have privacy without securing that information. So, the security side gets into a lot more of the technical aspects. Do we have antivirus and tools to stop ransomware hitting us? Do we have firewalls? Do we have protection for people who are working from home? Do they have tools on their laptops that can protect them? Do we have— this is going to sound funny talking about it in a cybersecurity sense. But in the security sense, do we have locking doors and locking drawers on cabinets?

I was just going to ask you that.

Because information is also physical. It doesn't have to just be on a hard drive or in an Excel spreadsheet. It can be physical. Security comes down to locking that information down.

Yes, yeah. So, people hear the word data and I know that some people, their eyes would just glaze over because like we mentioned, some people don't even know that they are accessing data. They don't know that what they're handling is data. So, being able to redefine it and turn it around and saying, hey, it's the application forms that are sitting on your desk. It is the files, the staff files, employee files that are sitting in your filing cabinets. It is loyalty programs and draw boxes with people's personal information on it. All these things is the data that we're handling.

Yep. And that's a very interesting point because we talk about privacy legislation. And privacy legislation specifically mentions the term processing. And processing is not just that, oh well, I have some data and I'm actively working on it. Therefore, I am processing it. Just the nature and virtue of storing data is seen as a processing activity. So, storing the data, collecting the data, having the data, each of those different aspects is seen as processing. And there is a legal obligation attached to that.

Yes, yeah. So based on what we've just talked about now, basically the definition of privacy and cybersecurity. What are you seeing that organizations are doing wrong or are really challenged with?

There are a number of things that folks are challenged with. And I think one of the major things we see is people don't realize what privacy entails, if I can start on the privacy side. Because a lot of times, when you do have someone who knows about privacy or has heard about privacy, it would be a case of, oh well, we have a privacy policy on our webpage. Therefore, it means we're compliant with it. But that's only one component of this entire framework that you should actually have in place in your business. When we talk about privacy, there's actually 10 pillars that you go into, which is around how you manage the data in your company. Do you have processes around, well, this is how we collect information. This is where we store it. This is what we're going to do with it at the end of it. This is how we delete it. You've got to not retain information for too long. It's around your consent and your choices. Do you give your consumer the choice to opt out of this? And can you actually action that? There's a lot of questions you have to ask yourself in the space. So, I think a big challenge in privacy is people not knowing what they don't know. And we're very much there to try and educate people. It is a lot broader. There's a lot more things to do.

Yeah, yeah. It's so funny that you said that because anytime that I come across any kind of a small business owner and we talk about privacy, they really do have kind of this limited perception of what that means. Are there any myths that you think need to be busted? Like people have these preconceived ideas about privacy and cybersecurity.

Yeah.

What are you hearing out there?

You know, I think a lot of the— I think probably the biggest one that we see is that people think it's a destination. And that's a very big misconception. So, your compliance to privacy, it's a journey. And it's something that you go through and it becomes business as usual. And it really should become business as usual. People should be talking about privacy. And I think that is a a huge misconception that we're going to put in a privacy policy on our website. We're going to have a couple of processes and policies internally. We're there. We don't have to look at this again. But every time your business changes or you start collecting different information from offering a new service or something like that, your privacy landscape internally changes. So, you have to keep that up to date. So much like you would keep a process document up to date, your privacy should come into that. So, So, we have these terms or a term called privacy by design. And that speaks to products. It speaks to processes. It speaks to any business process that you've got that you take into account like, is this going to affect privacy in any way if we change this? And that's a really good way of looking at things included in your decision-making. Then, it becomes part of day-to-day business. And then, it becomes easy. The initial fitness exercise to get fit Takes a lot of effort. Once you're fit, it's just maintaining. And that's where you really get rolling and it really, really works.

So, the one message I get from that is whatever you decide or businesses decide to do, it's not a set-it-and-forget-it process. This is a living, breathing, ongoing kind of focus on everything that we do.

Yeah, absolutely. It's ongoing. And that applies to your privacy and your security. Things that applied to security in 1997 don't apply to security now. Things that applied to security in 2015 don't apply now. It's an ongoing moving thing. Like even passwords. I mean, there's better thought around passwords nowadays as to how to build a password that is more secure and easier to remember but goes completely Completely against what we were taught to do 10, 15 years ago. So yeah.

So, you're saying that password1234 is not so bad anymore?

No, I'm not saying that. I'm saying that's terrible.

No, no. I thought you looked like you were just about to have a coronary.

It was interesting. I was looking at a thread on Facebook the other day with one person saying that, oh, their password, they need to change their password. How do they choose something that's memorable? I'm like, oh cool! I'm going to jump in here and give a little bit of advice because a passphrase is what we use now. So, let me just give that like find 5 things on your desk. Start each word with a capital. So, you could have glass and headphones and microphone and split those up with a number between them. And you've got easy-to-remember password that's massively long. But the advice that was in this Facebook thread was horrifying from all angles because it was just all this terrible information to create a password that's nice and short. That's only 5 or 6 characters. Don't do that. That's the quick way to getting hacked. There was advice of just adding a number at the end of your password every time you requested to change it. That's terrible. Don't do that. But the world has changed and we've got password managers out there now. And we've got the ideas about doing passphrases. Those are 2 really, really valuable things for that. to step in there.

Is there any other myths around cybersecurity that we should be aware of? I mean, we just talked about passwords. Is there anything else like people getting hacked, getting their personal information? What else do they need to know? It's like small businesses. What do they need to know about cybersecurity that there's misinformation out there now that's driving bad decision-making?

There are a few things. And I think to jump back to a little more seriousness is, and it's a bit of a bugbear of mine, is listening to a lot of these vendors that are out there that are selling cybersecurity solutions. If I could recommend for folks to do something and a business owner to do something is really do your research, do your homework, and ask around. There are vendors that provide particular software packages or hardware packages like firewalls that will tell you that this is your silver bullet to solving privacy and cybersecurity in your business. It often is not the case. And the marketing engine turns a lot and it turns a lot on fear. So, you will have a lot of fear-based marketing out there. We call it FUD— fear, uncertainty, and doubt— that this runs on. So, if you get offered something to take a look at as a product, question it. Do your due diligence on it. Research it. Ask another provider what they think or ask an independent provider who don't sell particular products what they think. So, they'll often give you better advisory there or give you a more holistic view. Often in cybersecurity, it's not one tool that's going to fix things. It's multiple. And it's beneficial to do that homework. And Speaking to the fear as well, the other side of protecting yourself is if you do get an email or something that does try and instill a lot of fear in you, don't react immediately on it as to what the email is telling you to do. Contact someone. See if it is something to actually be worried about or if it's phishing. Because phishing attacks are the prime candidates out there right now and stealing people's credentials, their email addresses, passwords. to get into their systems. And they do that via fear as well. And if you can spot that it's an email trying to do that, that's first prize.

Yeah, it's— that's, I mean, right there, that's worth the price of admission, folks. Right there is something because we know we see it all the time. Yesterday, I just got one that says, here's your invoice. You have 30 days to pay it. Thank you. And there's an attachment.

And it's like, you're Well, I think what I'll do is I'll trump that with the price of admission just on one more point on that.

Sure.

One of the things that I think is very much undervalued is switching your email over to a service like Google Workspace or Microsoft Office 365. The cost of using those services is far, far less than the value of the protection that you get from them. Because there's something that is included called multi-factor authentication, which is where you get a code on your cell phone or you have to click yes on your cell phone when someone tries to log in with your password. So, even if your password does get compromised, there's that extra layer that can stop someone getting into your email. And your email is absolutely your identity. You have sent all your information for visas and for travel in your email. It's in your sent items. You have received bills and anything someone needs to build a profile of you in your email. So, if that email password is compromised, it's your life compromised there. So, put in that multi-factor authentication. Move from shared hosting to Microsoft or Google. They have teams looking after the security. It's so valuable.

Oh, that's so great. And It brings up more times than not, I find that people are looking for convenience, not security. And we need to shake that out, right? I remember when I was setting somebody up on a POS system and I said, I just need a 3-digit code. It's not highly secure. It was just in order to set them up, I needed something to give that to them. And then, they could change and make it more secure afterwards. And right away, he came up with his code. And I said, well, you just gave me your code to your banking information. He goes, how'd you know? I said, because you didn't stop and think about it.

Yeah, absolutely.

So, it's amazing. I'd like to talk a little bit about the culture of privacy. As leaders, we are privy to so much information. We've done a ton, ton, ton, ton of customer and employee data. What is a business liability What is the business's liability to protect things like employee files, customer records, and so on?

So, it's very interesting at the moment in that there are a lot of segmented laws around different provinces having different privacy legislation, as well as federal having PIPEDA for the private sector, Privacy Act for the public sector. There are different requirements under each of these. But what we're finding a lot and diverting outside of Canada for a moment is in Europe, you've got the GDPR, which is the General Data Protection Regulation, which has kind of become the global gold standard as to what a privacy legislation should look like. And Europe tied into that has something called an adequacy rating where they will rate other countries' privacy regulations. As to whether it's comparable or acceptable. Now, Canada is currently in that adequacy rating. It is seen as acceptable. But it is a much older legislation. So, revisions have needed to come. And that's what we're seeing now. So, just in the last week, there's been a new bill tabled for the CPPA, Bill C-27. That is a privacy reform federally for Canada. And that is going to bring in a lot of these European standards to Canada. With that said now, that brings in looking after employee data, making sure that only the people who should have access to certain data have access to it. Because a data breach is not just the hackers coming in to you. It is someone that you hire that perhaps is on the call desk or something like that that shouldn't have access to HR files. Suddenly, they get access to HR files. And when they leave, they're disgruntled or something like that. That could be a breach. It could be changing information that someone shouldn't be allowed to change. That can be seen as a breach. And in the eyes of a regulator, they would come down on you with that. And with the new federal regulation, if it comes in, there are significant fines and impacts there now. It used to be that you'd get perhaps a slap on the wrist. If this goes through and there's new laws in Quebec as well, which do have fines and things included, But if a new one goes through, you can get fined up to $10 million for doing the wrong thing on data. And it's a sliding scale, not to say that you're going to get a $10 million fine. But you have to be aware that there are these penalties now. And those penalties can shut you down. And that's not the only thing to worry about because there's a private right of action as well. So, if someone, the employee whose information gets breached decides to sue you, they can do that as well. So, it opens up this whole can of worms as to what could happen. Sure.

And I could see, I can absolutely see that people's eyes would kind of glaze over with all this new, all this information and what they need to do. I'd like to talk a little bit about how businesses can adapt to the changing landscape. And we'll get to that right after this. When the spotlight shines on your business, are customers applauding or yawning? In other words, how is your business performing? Make your business a star with a new book, Light Welcome back. I am speaking with privacy and security expert Ross It is really scary thinking about all the stuff that small businesses carry in their businesses. And I know of one leader who after receiving some information from a staff member about the behavior of another member went directly to that employee, the employee in question to report everything that was said and who said it.

Right.

I've also known managers who will publicly shame employees with the guise of, oh, if I give people heck in the open, then everybody else will know it's wrong. What comments do you have about this kind of leadership-driven behavior when it comes down to privacy?

It's an interesting thing. In the privacy space, one of the things that you don't want to do is make it that folks are scared to raise privacy issues. We briefly mentioned things like a privacy culture. In the past, I also worked with a number of companies where it's kind of a guilty until proven innocent. You've discovered this flaw that was a security breach. Therefore, you're the first suspect yet. And that would completely discourage people from reporting issues. And if someone doesn't report the issue, that's when the issue escalates. And quite literally in privacy and security, it'll fester. And then, by the end of it, you're sitting with this incredible challenge. One of the averages out there for a large company is it can take up to 7 months to discover you've been breached. So, there's a lot of damage that can be done in that time. You want to encourage people to report early. And you don't do that by making it a penalty for people reporting. Many of the companies I've worked with, we make it an anonymous procedure as far as possible to allow people to report. You know, we want to find out about this stuff. It's in everyone's best interest. And when you do find out about it, it's not a witch hunt. It's resolving the issue, stopping the hack, stopping everything. Worry about the witch hunt after that. But your first and primary prize is to actually stop what's happening currently.

Yeah.

And you need everyone involved for that. This is not a one-person job.

Right. So initially, it's stem the bleeding and then find the solution to why the person got cut in the first place.

Yeah, absolutely.

Yeah, yeah. For small businesses, that can be quite drastic. I mean, if you're in a small business, let's say under 25 employees, you have a storefront and you have these kinds of breaches. Businesses aren't trained We're not training business operators in the privacy legislation. How can people find more information out about this so that they can become more educated about what their responsibilities are and so on?

Absolutely. I actually want to like take what you've just said and dial it back one second just to what you were saying about people not knowing what to do in these instances and what their responsibilities are. One of the key things that you can implement in your business is a plan. We have business plans as to how we're going to do our business. We've got strategic plans as to how we're going to go ahead. Plan for the what-ifs and take some time aside with your team and or even yourself if you're a solo practitioner. But do this. Sit down and work out like, if a ransomware hack had to happen, what am I going to do? And actually plan that out and put that on paper. Who am I going to phone? What am I going to do? We work with breach coaches and things like that where they will work with your insurance companies and things like that to address these breaches. But you need to know how you're going to react. Where you've got storefronts, where you've got business-critical operations, you want to have a plan to address that really, really quickly if it goes down. It speaks to your business continuity planning, not even privacy. So, it's very important to look at that. When it comes to education on this, there are a lot of resources out there. There are a lot of companies publishing a lot of information. There are massive amounts of security posts and things on LinkedIn. If you just search for the hashtag privacy or hashtag PIPEDA for Canada provincial legislation or hashtag CCPA for California, You'll find loads and loads of information there on it. There are also organizations like the IAPP, International Association for Privacy Professionals. They have loads of information upfront to help you get things in place. And short of that, there's a lot of training that can be done. We do a lot of training to privacy officers, small businesses. We've trained through other organizations and bodies where we teach people, this is what your responsibilities are. You should have this in place. You should look at that. And it helps a lot.

Yeah, that's great. This is fantastic. Now that we're on that topic, how can people get a hold of you if they say, wow, this Ross guy really seems like he knows how to help me? How can they get in touch with you?

The easiest way to get us is on our website. So, it's bambudataconsulting.com. We've got a newsletter at the end of the site. If you scroll all the way to the bottom, you can sign up for the newsletter. We publish articles on a monthly basis as to new laws coming, new things you can do, practical things you can implement. Follow us there. You can also connect with me on LinkedIn. Just search for me, Ross Saunders. You'll find me there on the privacy side and gladly, we'll chat to anyone.

Terrific! Thanks for that. We were talking a little bit about new legislations that are coming up. So, what are you seeing? You mentioned like Quebec, things are starting to change now. You're seeing some. What other things are going on in the marketplace that you think business owners need to be aware of?

I think Quebec is a very big thing that folks need to be aware of because that is in place already. It's in a grace period and it's being implemented in a sort of tiered space over the next 3 years. So, this is Bill 64. It's a privacy act for Quebec. But it affects anyone processing data of individuals based in Quebec. whether they're in Quebec or not, you as the processor. So, if you're sitting in BC and you have employees in Quebec, there are privacy obligations you're going to have for those employees that you need to look at. So, that is where it's— you need to start looking at what data you have of people. Where is it stored? Is it stored in a safe place? Do you have contracts with your providers? So, it's very important to start looking at that space in Quebec. It is a grace period and a tiered approach. So, every year in September up until 2024, there are new things coming in. At the moment, you want to at the very least get someone appointed to look after your privacy. Even if it's you as the owner of the business, you need to be aware of looking into this because you don't want a fine or a risk coming out of nowhere and blindsiding you on this where it is actually legislation.

How does it work with jurisdiction? Because I imagine some people would hear that and go, I'm in North Carolina. Why do I care what's going on in Quebec? What do jurisdiction boundaries look like?

So, that's an interesting thing and it's something we're seeing changing in privacy on a regular basis and people pushing the boundaries of it. So, we had GDPR like I said in Europe that came in. And that was one of the first laws that brought in this concept of being extraterritorial. So, if you're dealing with a European resident state and not even citizen, resident data, suddenly this law in Europe applies to you whether you're in the U.S. or Canada or Africa or anywhere. And that was this first foray into extraterritorial side. Now, we're starting to see provincial legislation doing the same kind of thing with the courts getting involved and that side. So, where previously it would be the Information Commissioner and there would be an option to perhaps go to court. Now, there's starting to be enforcement directly with the So, there are cases that are coming out now. And I believe there was a case now where a Canadian regulator is in talks with the U.S. now about a data issue that happened with that.

Wow!

So, we're definitely starting to see that there are these cross-border things. And that makes quite a challenge in terms of privacy. But there are some fundamental things that you can do that will assist you for looking after California data, looking after Canadian data, looking after European data. So, you don't want to be redoing privacy for every region you're in. You want to look at doing something kind of at the strictest level that can trickle down over everything. And that's what we help a lot of companies do.

I can absolutely see it. So, you do create this umbrella that will apply to no matter what state you're doing business in, no matter what province you're doing in, you know that you're compliant across the board.

Yeah, or there's a minor tweak you have to do.

Sure. Like, I can't believe for a second that this is something that a layman like myself would have time to sit down and research. So, this idea, and we've talked about this on the show before, having a privacy coach. We talk about having business coaches, personal development coaches, and so on. Having a privacy coach is sounding like a really great idea. Yeah.

And I mean, we see it at different— you'll see that people will say you have to have a privacy officer. Small businesses don't have the resources to hire a privacy officer, nor is a full-time privacy officer necessary when you're not doing privacy at all times. So, there's nothing that says you can't outsource some of the responsibility for it to another organization. So, I mean, we've done work with companies where we will be on a retainer for 2 hours a month where it's just back and forth like, what do we need to do here? Oh, look at this. Look at that. Look at the other. Maybe approach an attorney here or lawyer where you need it there. But we give advice right up into the point where we will be someone's virtual privacy officer where we're spending 30, 40 hours a month working on your privacy, getting the policies out, getting everything in place for you. and helping your teams. So, it really is something you can do externally. You don't have to do it internally. There are some very good things you can do internally to prepare for it.

Yeah, I think that's such a good option. As you were talking about it, it's like I just know all these business owners who are so busy in their business. There's not a hope in heck that they're going to have time to be able to manage something of this scope. The one thing, it was interesting to see COVID-19 hit because it did accelerate a lot of things.

Yeah.

And I do know that when people all of a sudden now had to start working at home, people were— organizations were installing like monitoring software and all that sort of stuff. How has COVID-19 working from home changed how we manage data and the privacy component of being at home doing work versus being in the office?

Yeah, you've hit on a couple of things there that was very interesting through COVID. So, employee monitoring became really interesting. And people would go into this with the guise of that this is for security that we're monitoring people at home. But this is where the conflict with security and privacy can come in as well in that monitoring people at home is in contravention of privacy or can be depending on how you do it. So, COVID really kind of forced us to think in a way that I think we would only have been thinking about in 10 years' time. In that we didn't have people always working from home and we needed to find solutions. And speaking to what was mentioned right at the beginning of this, talking about small businesses thinking that this is just for enterprise, one of the huge benefits that came out of the pandemic and people working from home is that companies that handle security and antivirus and all these enterprise solutions that were previously very, very expensive had to become very, very affordable for companies to roll out into people's individual homes. So, you're now finding that a lot of the solutions that were previously only available to enterprises with massive budgets, if you're under 100 people, you can get a very affordable solution that gives you all those enterprise benefits at a very, very low cost for a small business. And that is incredibly valuable. And I don't think we would have seen that in a long time because it was big business to have people in the office.

Yeah, and it was interesting because I did see that there was a huge influx of people, of these software programs being bought up and kind of implemented. But then, I get a sense that over the because COVID lasted much longer than anybody anticipated, that it was kind of like if you go out and you buy security cameras and you could say, ah, I can watch my store from home. It's like, when was the last time you turned it on?

Yeah, the pendulum swings where I mean, there's the initial panic about we need to monitor everything and do everything. It's calmed down now as to a nice happy medium as to where we need to be. And I think it's It's in a better space now than it has been.

Yeah, yeah. I'd like to talk about some practical steps in implementing privacy compliance and some fundamental practices for cybersecurity. And we'll get to that after this. When the spotlight shines on your business, are customers applauding or yawning? In other words, how is your business performing? Make your business a star with a new book, Lights!

Camera!

Action!, Business Operational Excellence Through the lens of live theater by Marc Haine. Marc uses his business and acting experience to help you see your business like a live show so you can create a performance your customers will never forget. Buy Lights! Camera!

Action!

today at your favorite online retailer or directly at marchaine.com. Welcome back! I'm speaking with Ross Sanders. Before we get into some strategies, how secure You mentioned like Google services and Microsoft services. And you mentioned that they have really good services. But I know that there's a lot of data sharing like Dropbox and Google Drive, Google Docs, and so on. How secure is it if you have teamwork and you're using kind of these basically free services?

Generally, I would recommend to not use the free services. You get the free side of it generally for personal use. And you don't get the monitoring and the security tools with it. So, if we look at it and it can be almost any of them, the Google Drives, your Dropboxes, your OneDrive, your iCloud. Maybe let's take iCloud out of that because that's more consumer. But with the free options of those, yes, you can share. You can collaborate. But you can't track what's happening or who you've shared with easily. Whereas if you upgrade to the more corporate solutions, and this is where I say those corporate solutions do start paying for themselves because you're paying $6 to $12 a month per user. But you're getting file sharing. You're getting email. You're getting security. You're getting calendars. You're getting— what you get is huge. But once you're in those platforms, there are reports on the back end that you can go in and say, well, how many files are shared. Oh, I've got 300 files actually shared externally. Let me go lock those down quickly. And that speaks to the controls that you should have in place both for security and for privacy to show that you're managing what you're doing. So, you get a lot of value upgrading to those enterprise tools. And once you've upgraded there, it is an additional cost. But you get what you pay for and then some.

And if you use it to your advantage, So, does that include things like Dropbox that you pay for?

Yeah. So, Dropbox has an enterprise solution as well. So, most of these free services will have some form of enterprise edition on top of it. I would say as a small business, go and look what the big guys offer. Dropbox is convenient. But OneDrive from Microsoft is also the same kind of functions and features. And it's included in your subscription with your email. So, see what you can bundle together because that'll actually get you perhaps a cost saving. If you unbundle your sharing, your email, your hosting, all of that and try and get it in-house into one solution, you can often save quite a bit.

Oh, that's a good hint. For those people who might be, and I know that we're coming into the We're at 3/4 of an hour coming up right now. But for those people who have been hacked or they've become a victim, what should they do? What's the first step that they need to do to figure this out?

Unfortunately, the answer is it depends. It depends on the kind of hack that you've experienced. There are generally organizations that you can contact that will be nonprofits that will assist in these kinds of matters. There's generally fraud prevention, things like that. If it, for instance, happens with your banking account, I would say your first port of call should be the bank and see what the advice is from there. These large companies have fraud departments. Ask to speak to the fraud department. Someone at the teller at the bank branch may not know the answer to give you. But if you phone into the bank, speak to someone in fraud, there will be a lot more advisory. There are also bodies like the ACFE, Association of Certified Fraud Examiners. They would be able to also give advice. And members of them, you've got certified fraud examiners there, people with CFE qualifications. They would be able to assist you there as well. I was assisted by a CFE member when my identity was stolen. It was the most valuable thing I could have done was getting someone involved in that. And he knew that, no, you need to write these affidavits. You need to go to these credit bureaus. This is how you lodge a dispute with the credit bureau. It was wonderful. And I mean, I wouldn't wish that on anyone because it took me 18 months to recover my credit record. And that was with using someone who knew what they were doing. So, it's really— I wouldn't wish it on anyone.

Yeah. And please, please, please, people, if anybody says just go down to the Apple Store and buy Apple cards for something, there's something wrong. Apple cards are not a currency. I've been watching way too many scamming videos.

Yeah, Scammer Payback is a very good YouTube channel that talks a lot about this. It's very valuable to watch.

Yeah, and it's called Scammer Payback and it's hilarious as well. It's hilarious to see them work. To get started, fundamentals that people should— people watching this, they say, I have nothing going on right now. How do they get moving on this?

The biggest tip I can give from a privacy perspective is knowing where your data is. So, when we go in to help someone, the first thing we want to do is see what data you have where, what systems you use. So, you don't need a fancy tool. You don't need to go and buy this enterprise-level tool. As much as enterprise-level tools will tell you you need their tool to do it, If you've got a spreadsheet, you can put together your first data inventory. So, open up a spreadsheet. Go through your business. Look at all the different processes that you do on a day-to-day basis, on a quarterly basis, on a yearly basis. See what are these processes. List them out. What data do we have in these processes? Who do we share it with? How do we store it? How long do we keep it? Just those basics will help your privacy program immensely. I mean, your program is going to be bigger. It's going to be policies and things like that. But doing that exercise, you will also— I pretty much guarantee it. You will look at some part of your business and realize that that's either really inefficient and we can make a performance improvement there. Or you're going to realize we're collecting far more than we should be. And you can stop that at the get-go. Knowing what data you have gets you there. And Think of it as a business improvement exercise. Don't think of it as a grudge purchase privacy thing. It's really you can do this to improve your business efficiency and it really helps. And any privacy professional that goes in will appreciate it because we'll have a starting point as to where everything is stored.

Yeah, and I have a sneaking suspicion when they go through that, especially if they use— if on that spreadsheet, you also list the software that you're using.

Yes, absolutely.

Because I think we download and we use different types of And it's amazing the duplication that you find.

Yeah. And you start realizing who you're sharing information with. So, you've got your— there are so many services that you can sign up for on a whim in the cloud now where, oh, I need to take notes. Oh well, Evernote looks good. Sign up. Let me put data in there. Oh well, I need to share a file. This person's on Dropbox. They don't want to use OneDrive. Oh, I'll open a Dropbox account too. And then, you've got 2 file storage accounts. So, you want to actually really start mapping that out. And once you've mapped that out, it informs everything else. You'll look at it and be like, oh, we need a policy for that. That all comes into privacy. I think privacy is sometimes a word used to describe a good business practice because it's being transparent. It's having your policies in place. It's knowing your processes. It doesn't really need to be about the data. It's good business practice.

There might be some pushback from some small business operators who say, I only have 3 employees. Why do I— who's going to need a policy? What would you say to them?

So, the thing about the policies, and this is where a lot of the privacy legislation comes in, your policy needs to match your operation. And we've seen it before where folks have said, well, they don't need policies because no one reads them anyway. Your policies inform how you do things. And if something goes wrong, people are going to refer to your policies, especially in a privacy sense. So, if you are claiming from insurance for a cyber attack or anything like that, or you're claiming from insurance for privacy breaches where you've got someone suing you, or your professional indemnity insurance even, not even cyber insurance. If you don't have the policies in place, they may not pay out. So, that is a grudge drafting your first policies. Your policies don't have to be 48 pages long. Your policies need to just state according to your business what you do. It makes no sense to take a huge template or anything like that. Do your policy for you. If you only do 3 practices in your business, have a policy that's 2 pages long.

My argument.

Have a policy that's a one-pager.

My argument.

get the information across.

Yes, my argument for these small operators is you're only 3 employees today. But what's your business going to look like in 5 years? And if you can start that now when you only have 3 employees, when you have 20 employees, life is so much easier.

Yeah, and speaking to that, I mean, I come from the software space where there's something called technical debt, where you don't fix issues and the debt starts racking up. And then, it becomes impossible to fix all the issues later. The same applies in privacy. You get privacy debt. If you don't address privacy now, it's going to bite you for your scaling later.

Yes.

Because you have to go back. You have to retrofit things. You have to really battle with it. And the bigger your operations, the longer that retrofit takes.

Sounds like the Chinese philosophy of the best time to plant a tree was 20 years ago. The next best time is right now.

Yeah.

So, I'm having to do it now.

And you know, you don't have to do privacy in a big bang approach. It's not a destination. It's, you know, start with one policy. Start with one data map. And then, just do step by step by step. If you try and bite off everything, you're going to see this as being too big and you're never going to do it. Whereas, if you start with something small, much easier.

Great! Are there any other cautionaries?

You know, I think on the privacy side, a cautionary tale is if you've got an external privacy notice, a lot of folks go and copy that from their competitors or go and find an easy template and then just paste it up on their website. Again, that needs to match what your business is. So, if you've got a privacy policy that you're putting outwardly, make sure your business practice matches what's in your privacy policy and you're doing what you say you're doing. Because if someone investigates you, that's the first thing they're going to look at.

It's a promise statement.

Yes, absolutely. And I mean, on the security side, speak to your teams. Look at the way you do things. Security comes down to habit in a lot of cases. So, like I spoke about having multi-factor authentication where you get a code on your phone when you're logging into your email, that's already a fantastic move in the right direction for security. Look at choosing good passwords. That admin123 or things like that, the name of your dog. Don't have the password of Fluffy or something like that. Pick a password by using things on your desk every day where it could be headphones, pen, wallet. Put numbers in between it. Suddenly, you've got a 30-character-long password and you can remember it. So, there's a lot of this. And Have chats with your staff. This shouldn't be up at only the director's level or the C-suite or anything like that. Everyone should be talking about this. It takes the load off everyone as well because if you're handling this from the front lines, 100% better.

And they have a stake in it, right? They now have a stake in it. So, it's like it just makes perfect sense. Do you have any last thoughts about what we've been talking about today?

I think we've covered a lot of it. I would say, get started. It sounds rich. But start by writing one line of that data map today and it'll help you along your way. And then, as you start seeing anytime you add something into the business, it'll come into that and you can add it in there. Get it into those business as usual practices. And get some awareness in place. There are some really great webinars out there. There's really great reading content and things like that. There are great podcasts out there. And you can gain a lot of information as a business owner as to what you need to look out for there. And it's not that scary. I think a lot of the progress we've made in the last 3 years has made it that security and privacy is less scary. There are fundamentals that you can do that work really, really well.

And it's better to do something. The adage of do something. You don't have to be certain that it's absolutely right. If you get started doing something, you'll figure out if it's right as you move forward. But we have to take the step. We can always change the direction after.

Yeah, yeah. And I mean, you don't need lawyers for this. You can do it yourself. You don't need to pay a fortune. You don't need lawyers for it. If you get— you can even go and do a gap analysis and say, where do we have our gaps in the business? It's a much more affordable report. And then, you can choose how to address those things that come out of it. We do that all the time.

This has been brilliant. Could you remind everybody one more time how they can get a hold of you?

Sure. You can get a hold of me on the web, www.bambudataconsulting.com. Or find me on LinkedIn, Ross Saunders.

Love it! Ross, thank you so much for your time and your contribution today. It's been absolutely brilliant. And it's probably the fastest 50 minutes I've had on the show. So, this whole thing about privacy being, oh, not today, folks. This was exciting. This was a lot of fun. And Ross, I can't thank you enough.

Absolute pleasure. Thanks for having me here. It's been great.

Why don't you let me know if this was of value to you? As always, my offer stands. If you'd like 30 minutes of my time to help you brainstorm your business with you or your team, please feel free to book yourself on my online calendar. The link is in the show notes. It would be my honor to be of service. And if you haven't done so yet, why don't you go ahead subscribe to this show? And I invite you to join me next week when my guest will be the Fabulous Lori Guest. We will be talking about what to do about service fatigue in this new era. So, I hope you will join us. My name is Marc Haine. I hope you stay safe, stay healthy, and I hope that you dare to be the exception. Thanks for joining us today.