The One Mistake That Could Cripple Your Business with Shayne Kawalilak

Imagine spending years building your business only to have it all vanish because someone on your team reused a password from 2008. Cybersecurity isn't just an IT problem anymore. It's a business survival problem. And that's what we're talking about today on Experience Leadership.

Welcome to Experience Leadership, A podcast that challenges small business owners and entrepreneurs just like you to dare to be the exception. Join our host, customer experience expert Marc Haine, as he uncovers relevant and timely content to help you script and direct your business and teams to create jaw-dropping experiences your customers and staff deserve. Here is the host of Experience Leadership, author of Lights! Camera! Action!, customer experience expert Marc Haine.

Welcome to this episode of Experience Leadership. I am your host, Customer and Employee Experience Strategist Marc Haine. And I'm really glad that you're here with me today because my guest is Shane Kawalilik. And today, we are putting a spotlight on the everyday cybersecurity risks that could quietly be crippling your business. And we're going to be discussing what you can do about it right now to stop being the weakest link. My one ask is that if you know somebody who could use this information, please make sure you go ahead and share this episode because knowledge is power but only if we share it. And of course, please make sure you're subscribed to this podcast. That way you'll get notifications when I bring you fresh new content each and every week. You know, I know you. I know you because you are a human being. You lock your front door at night, you check IDs at the bar, but when it comes to digital security, are you really protected? The truth is cyber threats don't just target giant corporations anymore. Small and mid-sized businesses are prime targets because We're too busy running our businesses to even think about how vulnerable we truly are. And the most surprising fact is that most business-crippling attacks, they don't come from hackers. They come from inside our own organizations from innocent mistakes made by our team. And that brings us to our Question of the Day. So, if one click could take down your entire operation. How confident are you that your team would know not to click it? Hmm. Think about that for a second. I'd love for you to be part of this conversation. Why don't you go ahead and share this episode on your favorite social media platform? Hashtag it #ExperienceLeadership. Put down your comments. I'd love to hear. Have you been privy to any kind of issue Because an employee clicked a link they shouldn't have clicked. My guest today is the professional geek himself, Shane Kawalilik. Shane has been elbow-deep in technology for over 25 years. He's the author of Don't Be the Weakest Link: How to Protect Your Personal Information in a Digital World. And he's on a mission to educate everyday people and business owners on how to think differently about cybersecurity. When he's not writing, presenting, or digging into new tech, he's homeschooling his 9th, yes, 9th child and spending quality time with his now remarried ex-wife. Shane's as real as they come, and today he's here to help us all level up our security game without the jargon, the fear, or the paywall. Haine, welcome to the show. It's brilliant to have you.

Thank you very much, Marc. It's great to be here.

So, before we get too deep into today's topic, could you tell us a little bit about who your clients are and how you go about serving them?

My clients are mostly small-medium businesses, and I offer live presentations, virtual presentations online like this, and workshop training sessions where I go in and teach their employees how to be safer online, how to protect their personal information. And as you're teaching someone how to protect their personal information, all those lessons they learn transfer right over to the business. And hopefully, business owners are happy with the result.

The issue, of course, is that we're all so privy to the big hacks and all that sort of stuff. We all have data management that we have to be sure of. We trust our suppliers, like, you know, when we use Interact machines and that sort of thing, that they're going to be taking care of our guests as well. But really, the biggest issues, I think, come from the myriad of emails that we get that says, hey, you have to, you know, we need this bill paid right away. And it forces people to click on links and stuff. So why are small businesses today so vulnerable to cyber threats?

Small businesses are more vulnerable for a couple reasons. The most important one today, right now, study was just released yesterday, the day before, and small businesses, the percentage of compromises that they represent doubled last year. That's a significant jump for mom-and-pop shops, companies with 10 or 15 employees. Those people aren't used to getting attacked like this. Those emails you're talking about, those are phishing attacks where someone's pretending to be someone that they're not to convince you to do something you would never do if you knew who they were.

Right.

And those, those come email, phone, texting, and video. Now with AI, video's becoming more and more common where you'll have a live video where you and I'd be talking, but that's not really you. And it's a problem for people if they're not trained. Small businesses don't train people as much. It's an expense.

Yeah.

So, just make sure that if you're watching this, don't tell my wife it's not really me. It's true though, right? Because now, data is out there, right? And so, a lot of times like I've seen where somebody— we just had one with a nonprofit and it was addressed to the president and it was sent from the treasurer. under the treasurer's name and she's like, you need to e-transfer this right away. Or no, actually the reason why we figured it out was because they said, hey, Anne-Marie, could you please get some gift cards and send me the codes right away? And so of course, that was the only tip-off was we knew that our treasurer, me, would never ask for gift cards. But to that point, there are ones that are really kind of challenging to identify. What challenges do we have now as small business owners to be able to kind of put up those antenna?

If you go to my website, I have cut sheets, and one of them, the by far probably 80% of the downloads are one cut sheet, and it's called Red Flags. And it's just a bunch of little bullet points that everyone should be looking at. If you see an email or a communication that says urgent, if you don't usually have past due bills and final notices, that should be a red flag. There's the capitals. Capitals, grammar, and typos, I don't understand. I mean, we've had spell check for 20 years, for crying out loud, and I still see emails with typos. I had a guy— oh, this was years ago, actually told the story in the book— but the email, you click the link and it takes you to a government site, the nice bilingual page and stuff. And I'm like, well, that's not legit. And the person sitting at the desk said, oh, it had some red flags, but how do you know? And I'm like, well, you're in Canada, and in Canada we're English and French, and that's English and German. So I don't know what kind of research this hacker did, but this is a horrible webpage for a Canadian. But this Canadian sitting beside asking me—

Yeah.

Did not speak French and thought that was French. How do you mistake German for French? Don't you have cereal boxes at home? Everything is bilingual.

Yeah.

Yet this person legitimately thought that was an official Canadian government website.

Funny, eh? So, so what does it really mean? I know you called your book The Weakest Link. What does it really mean these days to be the weakest link in an organization?

It used to be hardware, and there's still a percentage of the game where we as IT professionals, we have to install secure hardware. And we have to patch it and we have to update it so that hackers don't get in. But today, over 75% of breaches are through people.

Yeah.

You know, I was just talking to somebody on LinkedIn yesterday and I said, people don't have to worry about hardware as much anymore because people aren't hacking. They're not compromising. They're not brute forcing their way into a network. They're just logging in. They stole login credentials from someone. You know, the stuff with the Chinese government now, you know, almost daily some 3-letter organization in the United States is finding a login that has been active for over a year. Some of these things, 10 years, and they've had full admin access to this network. What have they done in the last 10 years? They're just sitting there waiting.

It's interesting because I've heard about that. I've heard that, you know, when an organization gets breached, it's not because they suddenly got somebody's information. They've been mining information for ages so that they can go deeper and get more out of it. And they could have been sitting on it for 6 months, 10 months, a year, 18 months. They can be very, very patient.

Yeah, one of the things I tell people all the time, every presentation I've ever done, I show someone how to go online and find out which information has been breached and where it came from. So if you lost your information in the MGM hack recently this year, My personal information was breached from WestJet. So it's not to say that I did anything wrong. WestJet gave away my information.

Yep.

And very personal information. I've lost my passport, a picture of my driver's license. You know, these are things that aren't— they're not abundant out there on the internet. I can count on one hand the number of people that know my passport number. I mean, before this hack. Now it's millions. But how do you protect That kind of information, you need to know what's been taken. And so, I send people to the website, see what's been taken, and then you can go about trying to rectify it. You can't secure what you don't know is being missing. Right.

But a lot of what we do comes out of habits. Like, I know that a municipality in Alberta here was hacked because an employee walked into the building, saw a thumb drive on the ground, Picked it up, put it in their computer to see what was on it. And because of that, they introduced a virus onto a closed network, right? And it was devastating to them, right? So how do we become intentional in our behavior so that we're not opening ourselves up to it?

Well, one of the guys I like to follow on LinkedIn has this thing he says all the time, we have to have a cyber secure mindset. And Kudos to Scott for coming up with the line, 'cause I can't come up with a better one. We need to change the way we think. You need to not just assume, but you need to know that there are people out there that want your information. And it's not always a password. It's actually rarely a password. A password gets me into that one website that you put that password in.

Right.

But if I have your email address, and if I have your physical address, if I have your— you know, somebody has your physical address and your mobile phone number, That's worth way more than a password, because now I can phone you, I can email you, and if I say, hi, is this Marc Haine? And you'd say yes, but your defenses are up because I don't know this guy's voice. And it says, is this Marc Haine from your address, and this is your cell phone, and this is your email? Oh yeah. Now your defenses are down because clearly this is official business. This guy knows me. And that's not the case. We have to always be— we have to be aware. If we're not, if we don't have those antenna up, we'll miss those red flags.

Are there any kind of digital blind spots that are a sure sign that a business is operating really dangerously? Oh, by the way, I forgot to tell you, Shane, I only ask small questions.

This is— I've lost money because of what I say about financial institutions.

Okay.

But some of the things that we as IT professionals promote as secure are actually some of the least secure things we can do out there. And I warn people when they— when I start talking, I'm like, you're going to hear something today that might be new to you. You're probably going to hear something today that is actually 180 degrees from what you've been taught From another IT professional. So, you know, things I've been promoting since 2002, Microsoft was pushing hard this automatic password reset every 90 days, and I pushed hard against it. I'm like, no, that is bad. As soon as we did that, suddenly in an office of 50 people, and I'd never seen anyone's password, the second time that we made people change, I started seeing sticky notes everywhere on monitors, under keyboards. And I'm like, Oh, no. What is going on? I'm forcing these people to remember a new password. So it's been over 20 years I've been saying pick a great password and never change it. If you ever get an expiration email from a network I run, I tell people right up front you'll never see it. When you get an email saying, oh, your Office 365 password's expired, oh, your Google password's expired, I want to train the users I'm hired to protect, that that email is a red flag. They've never seen one before. They should never see one. I've told them they never will. But if you get one every 2 or 3 months for the last 5 years, when you get one, you— there's no red flags. This is, oh, my monthly or my bimonthly thing, you know, and you click a link and you give away your information.

Yep.

So these are the things that banks do. Banks are all about security questions. Security questions, those little, what's your mother's maiden name? What was your first car? Your childhood superhero? We've all seen them. If you think those things are protecting you, the banks do, credit card companies do. They don't protect you.

Right.

They're the opposite, 'cause they make you feel protected. They give you a false sense of security. But the questions aren't random. There's only 6 or maybe 20 on the website. That's not random. That's, that's a 5% chance at best.

Yeah.

And then your answer, This is why I tell people the most important thing you can do is go out there and find the data. Go to the website, click the link, see what data has been taken from you. Because if someone has taken your security questions and your security question on every site you've ever picked is my mother's maiden name, not only is that not random, it's a published known entity about you that the whole world knows now.

Yeah. And you need to know what It's interesting because I, to that point, I got on Monday, I ended up getting a password request, um, renewal from my IT guy to redo my password. And for me, it was an instant red flag because I don't have an IT guy, but it looked official.

I know.

It came from my server, so it came from Essential Hospitality Solutions, and It said IT@. When you click on the actual email, it didn't come from there at all. It came from something in India, right?

Surprised.

But it was like, you know, it was knowing I was coming up to this call with you today. It was like, boy, this is timely because how many people will click it? How many people will click that link and follow through with whatever the question is? And then, what liability does that open up to the organization?

Yeah. Like I tell people, the password's the foundation of your security. I don't want to see good passwords. I want great passwords.

Yeah.

I mean, how many times have you heard or seen on a website your password has to be a minimum of 8 characters?

Yep.

8 characters? I've been in this business for 30 years. I've never said 8 characters. That's insane. 8 characters? I could guess 8 characters myself. I don't even need a computer. So your minimum should be 12 to 15.

Yeah.

You have to use all 4 character types. You can't use upper, lowercase, and a number. That's horrible, you know?

Upper, lower, number, and sign.

And a symbol, special character. Yeah. People don't realize on a standard English keyboard, there's 30 special characters.

Yeah.

That's— there's more of those than letters. So in my presentation, I show you a password that takes 1 year to hack. I change the number for a symbol, And it jumps to 45 years. And they're like, they do that? They exactly— wow, that's, that's a huge difference. And then I say, this password still sucks. 45 years is not an acceptable hacking time because with AI, with, you know, new quantum computing, computers might be 1,000 times better tomorrow. Yeah.

So are there any other myths about cybersecurity that we should be aware of?

I thought we only had an hour.

Let's talk about what lulls us into security.

Biometrics is a big one. People tout biometrics as, that's my fingerprint, this is my face. You know, if I use my face to unlock my phone, nobody else can. That's not true. You know, that application inside the phone is measuring the distance from your eyes, the length of your nose, the point from your chin to the tip of your nose, the distance from your ears. And as unlikely as it would be, I have 2 sons, 34 and 21. They can open one of those phones. They don't look— you, you look at the pictures, you wouldn't even know they were brothers.

Right.

But the numbers are the same. And I have to believe there's a lot of those out there, you know. And then biometrics isn't just face, it's fingerprint, it's voice. Who would use a voice or a face in a world where That book that I wrote was published this year. In the book, I said, in the future, not too far away, but in the future, you are going to be able to have live calls like this with someone impersonating someone else.

With a bot, right?

Well, in June, I was on a live call. There was probably 100 of us on here, and the guy hosting the call clicked a button and turned into Nicolas Cage.

Wow.

Just like that. His voice, His face. I was stunned. He turned sideways, he ran his hands through his hair, and I'm like, man, that's amazing. And then boom, click of a button, he turned into John Travolta. And he said this happens because there's so much available data about their voices, their faces, that it's easy. But in the future— that's all he said was the future— it's not going to take as much.

Wow.

And we just did a demo with the same software 2 weeks ago. And with 30 seconds of audio— and who hasn't put 30 seconds of audio on Facebook or Instagram, right?

Right.

30 seconds of audio and one front face picture, he did the same thing. So it doesn't have to be Nicolas Cage now. And I know somebody in Toronto just lost $5,000. Some lady's at home, she gets a FaceTime call from her husband, she answers it, and there's a picture of her husband All beaten up, a gun to his head, and he's reading a letter saying she has 15 minutes to transfer $5,000 to this account. And she's scrambling for a pen. She writes it down. She transfers a number. She hangs up. She dials 911. The police are freaking out with her. She phones her husband and he answers the phone. Hey, hon, what's up? She's like, what do you mean, what's up? Where are you? I'm at work sitting at my desk. Why? What's up? And she was completely fooled. Yeah, the man, the man she married. And this is a common thing now. It's— I mean, police all over are seeing spikes in this fake ransom thing. And I was shocked. That's a bold move for a cybercriminal that can't spell words properly in an email. So it's true.

So I'd like to get into some steps that we could take to start protecting ourselves and our businesses, and we'll get to that right after this.

When the spotlight shines on your business, are customers applauding or yawning? In other words, how is Your business performing?

Make your business a star with the new book Lights!

Camera! Action!, business operational excellence through the lens of live theater by Marc Haine. Marc uses his business and acting experience to help you see your business like a live show so you can create a performance your customers will never forget.

Buy Lights!

Camera!

Action!

today at your favorite online retailer or directly at marchaine.com.

Welcome back. I am speaking to the master geek himself, Shane Cowherlillek. Shane, why don't you tell us a little bit about your book? You've alluded to it several times. Talk to us a little bit about what your book's about, what people can expect if they buy it.

I gotta interrupt for a second before I talk to my book. I always listen to your podcast. I never watch it. That was actually the first time I've actually seen the little clip that you play about your book and stuff. Oh, and I gotta say, I don't know if I've told you this, but your book Thank you. I actually had just put it back in the van so I could read through it again because I was just talking to someone 2 weekends ago and I said, yes, and, and they thought— they laughed at me and said, you meant but. And I'm like, no, I don't use yes, but anymore. And they just thought I was freaking. So we talked for half an hour about your book and it was just hilarious how it got into sitting on a boat in a lake.

That's awesome. Well, thank you very much for saying that. That's a true endorsement. I appreciate it. So now tell us about your book.

So Don't Be the Weakest Link. It was funny because when we started it, it was actually called The Weakest Link, but there is no way to put The Weakest Link into a search engine and not get that crazy British chick on that game show. So we got talking, we were talking about different names, and then I said the whole purpose of the book is to tell people how to not be the weakest link. And Charles, the co-writer, who actually never wrote a single word in the book. But he said, yeah, it's about helping people so, you know, they don't be the weakest link. And I'm like, yes, don't be the weakest link. Let's use that. And now it's searched. But that book took 4 and a half years to write. The technology, the problems we had— I knew what we wanted in there, but every time we used a real-world example, technology changed so fast we had to rewrite things. The word never and always was reduced by like 95% because we just can't use absolutes in a book about technology. And then we had issues with links. You know, we would make a comment about a Forbes article, and a month later we go back to the Forbes article, and not only have they changed the thing we talked about because they were wrong and we were pointing it out, someone else pointed it out, and now they've changed the article. So we had to go back to the original articles. But then we had another problem. What if something changed? So we tried really hard to try to make the book more relevant. If we were having a problem writing something to stay relevant, how long would it be relevant to a reader?

Right.

So what we've done is every footnote in the book, if I say, here's the number one best web browser right now, here's the most popular search engine right now. I send those footnote links to a link from our website, and then I forward that. So in 2029, if you look at that link, it's going to go to the current number one browser, the current whatever for that time. And we're going to update those links every year. The plan is between Christmas and New Year's We're going to take a few days and just run through every statement and every link in the book and just say, is this the most current information we have? Change the website, change the book.

The whole idea around cybersecurity, though, how much of it is philosophical and principles versus policy or techniques?

I would say probably, you know, if I had to put a number on it, 20% policy, 20% the plan. There's probably a full 60% that is the recognition. It's the end user knowing what the policy is. It's, you know, you get a policy at work, you sign it, you initial it, and it goes in a desk and you never look at it again.

Right.

I promote very strongly every member. If you have an IT department with 1 or 2 people in it, what I want you to know is that every single user in that company is part of the IT team. Make them feel like they're part of the team because if your firewall is one access point, well, those 50 people are 50 more access points. Where do you spend all your time? On 1/50th of the network, you know, and it's that weakest link.

That intentionality around, you know, clicking on emails, stopping and thinking before you do anything, You know, people will say, oh, but you just don't understand how busy I am. I'm just so busy all the time. And then something comes across and I just clicked on it. It's like, that would kind of sort of like being saying, you know, that contract came across my desk. I know it was 85 pages, but you know what? I just signed. I didn't bother reading it. I just signed it. And it's like, you wouldn't do that.

Yeah.

And so this being intentional and present, I think, is even more important now when we're talking technology.

Yeah. In the book, we actually created And this is what got me excited. I wrote the book for almost 2 years before we created what we call the Weakest Link Scale. And that scale has 2 factors, a knowledge rank and a response rank. So, Charles and I, both A's on an A to F scale. We both have the knowledge. This is what we've been doing for a quarter century each. But on the response ranking, We're a little different. So if a 1 is you wanting to live in a cabin in the woods and nobody knows your real name except the CRA, Charles is close. And it was funny, in one of the conversations we were talking about, could we implement something like this in there? Because more and more as we're talking, I'm saying, you know, I thought we were brothers from a different mother, but you're like a distant cousin here. How can you say that? And he just responds different. And when we were talking about this, living in the woods, he's nodding and he's like, yeah, that's me. Dude, you wouldn't do that. And he's like, oh yeah, 100%. I'm, I'm that close. Like, give me a reason, I'm gone. That's crazy. Well, if a 5 is someone who has to change their Netflix password 3, 4 times a year because someone keeps hacking it, okay, I'm probably a solid 4. I'm not willing to give up my access to things. Like social media. Social media forces you to put blinders on, and you've got to know those red flags like the back of your hand. You have to be aware all the time. And I have 4 Facebook accounts, but I'm writing. I'm— I've got 3 businesses. I have to— I, I do stuff like this. My name's out there. In the book, I talk about searching for Charles. The guy doesn't exist on the internet. It's crazy how hard he's worked to not have the same response rank that I do. And I think people just reading the story about, you know, we're the same for knowledge. We— it's hard for us to learn new things except when hackers come up with new things. But when we look at how we respond and react to the knowledge that we have, yeah, it's like we're different people. And I think people seeing that hopefully puts them more at ease. It's not all about you being hacked. It's about you being able to do the things you want to do online without getting hacked.

For people tuning in right now, how can they get in touch with you if this is resonating with them and they need some help?

So my website, redflagit.com. They go there, they can find out anything about me. I'm on A whole bunch of social media platforms, but RedFlagIT is just going to direct you to myname.com. But how do I convince people to go to shane cowell.com? They spell my first name wrong. They've got no hope with the last name. So RedFlagIT it is.

Sounds good. Hey, so we talked about a little bit about how you will go into organizations and you'll do things like lunch and learns for them to bring, be able to bring up their kind of, I mean, there might be an IT quotient. Awareness quotient, right? That they need to bump up for their own personal security, but at the same token, by bringing up that sensitivity for their personal use, it also kind of helps the business side be able to start rounding that out. What's your philosophy on education around cybersecurity versus kind of fear-based messaging?

Yeah, I'm not a big fan of fear. It's basically knowledge. I don't want you to fear these people hacking you. They're out there.

Right.

I don't want you to be that one out in the woods unless that's what you want. But I want to give people the knowledge that they make that choice on how they respond to the stuff. So I tell people, here's what you need to look out for. See the red flags everywhere. And everyone who has seen me talk about that has come back and told me countless times a story about How they almost— I mean, you were talking about being breached and how it can happen to anyone. In my presentations, I tell everyone it almost happened to me. I mean, this is— and this wasn't a targeted phishing. This wasn't what they call spear phishing. This was just some stupid random email. Your password's expired. It happens once in a while. I've got well over 1,000 passwords in my password manager. And I see this password email come in and I'm like, it's, it's after 2 in the morning. I've got an early call in the morning and I'm like, this is crazy. How did I miss this email that the password's expired? Like, I checked that off on everything. It's what I teach people. But I'm tired, I'm busy. I'm going to just reset this password. I'll deal with it in the morning so that it never asks me again. I click the link, I go to log into it. And my password manager is not filling in my email or password. And so I typed my email in. I'm stupid password manager. I typed my email in. I hit tab and waited for the password manager to catch up, and it wasn't. And I clicked the little thing to make sure I was logged in. I'm like, what is going on? I looked over at the address bar. I was not on MicrosoftOnline.com. I was on MicrosoftPasswordReset.com or something .India. And I'm like, if I would have known that password, which I don't, it's 30-some characters long, I haven't known it in years. But if I would have known it in that moment of frustration, I may have given it away to somebody and I wouldn't have known.

It's interesting because you had the tech to kind of spew a something's wrong with this picture component, like a moment. All you needed was that just a split second to pull you back into intentionality. So is there some really good software that people should be looking for to help them with those, that something would be like, this doesn't make sense because this didn't happen?

Yeah. I tell everybody, you know, we have a little piece of our presentation that's about password managers. And the thing you have to learn about password managers is you need one. You know, I mean, the average person has 80 passwords to know. Nobody can remember 80 passwords. If you can, you should dump them out of your head and use that memory space for something that can make you money, because memorizing 80 passwords is insane.

Yes.

So what people do is they memorize 4 passwords and use each of them 20 times.

Yes.

That's not helping you. So a password manager— and people always ask, you're probably thinking about this, what's the best password manager? And honestly, if you go to the website or in the book, I can't rank password managers. I can tell you what their different features are, what their different price points are. If you're looking for something that's offline, that funnels you to these ones. If you're looking for something that's available cloud everywhere, well, the majority of them are. If you're looking for something for you and your whole family, you know, there's some great deals with family accounts on a couple of them. So it depends what you're looking for, but you have to have a password manager. Yeah.

You know, I rely on my password. In fact, I went to change because my credit card got hacked through the RBC. And so I had to go in and choose new login information, everything else. And the lady behind the counter said, I get really nervous when somebody's able to fill in their new password so easily. And I said, it's because I have a password manager. I just, I didn't generate it. The password manager generated it for me. And right. So now I know that cross-platform, I have access to my passwords wherever I need them, and I don't have to memorize them. I do have to have faith that the password manager company is going to stay secure, right?

Well, look at LastPass has been breached twice. Once pretty insignificant. Everybody gets breached once, whatever. Yeah. But they got breached a second time and they actually lost the databases of their customers. So, my database of 1,400 passwords, gone. It's out there. And so, in the examples I use on how long it takes to hack passwords, that clock started clicking.

Yeah.

Because someone is out there with some supercomputer just pounding my LastPass database.

Yeah.

I'm not worried. My password was crazy long. It was not getting breached.

Yeah.

But I still went on there and it took me 2 months to change 1,400 passwords.

Yeah.

Would it be fair to say it's not if you get breached, it's when?

So here's the problem. I absolutely agree with you, but the problem is 99% of the breaches out there where your credentials have been taken aren't from you, right? You've been compromised. Someone stole your information from Home Depot or from MGM or from verification.io. But have you been breached? You've been compromised. So the wording gets really tricky. Most people haven't been breached, but they have been compromised. And that's how they get nailed in these phishing attacks, because the email looks so authentic. They've got so much information on me because they got it from all these other people that have been breached.

And so knowing that, then, using the word breach as opposed to compromised, Is it fair to say then that we should just assume that we're being breached all the time?

Your data is out there.

The data is out there.

You should 100% realize it's out there. And like I said, reading the book is important because even if you know the data is out there, you need to know how unsecure some of it is. Like we talked about biometrics, you know, in the book we have a story every chapter and story time in the biometric chapter. Actually, there's 2 stories in there, but one of them is a wonderful couple going on a vacation from somewhere in the Middle East to Bali, and somewhere over the Indian Ocean, he falls asleep. Now, I don't promote promiscuism at all. I remarried my ex-wife, so I'm a big fan of love and romance.

And second chances.

My wife might not agree on the romance thing, but he falls asleep, passes out, whatever. His phone uses biometrics. Now, I'm okay with it being used to open the phone so she could find out that he'd been cheating on her. She starts beating him. Not only are they divorced, he had to spend $50,000 to land that plane in India. That's a big fine. I would miss $50,000 very much. So I don't think you should depend on biometrics for anything that you don't want the world to see. It's okay to use biometrics if you're using that MFA, so multi-factor authentication, my face and a PIN or something else. But if you're just using a finger or a face and someone steals it, it's gone. You can't change your face. If someone steals my password, I log in and I change it. What's going to happen when someone logs into that website to see what's been stolen and they see biometric data?

Yeah.

I haven't seen it yet.

Yeah.

But it's been breached. You know, the US government lost hundreds of thousands of federal employees' fingerprints.

Yeah.

And so, what do they do? Send out an email to everybody and say, don't ever use that same finger again. Now, we're using other hands.

Thumbs up. I mean, in Canada, we're elbows up.

Yeah. How many times can you change your finger before—

Well, you only have 10 chances.

Changing biometrics.

Then you go to toes.

We were talking about how bad financial institutions are. I was just talking to a credit card company, and in the call there, the recording's like, we use your voice recognition to verify you. And so I, I hit 2, and the girl comes on and she said, oh, I noticed that you declined to use the voice verification. I'm like, yes, can I ask why? I'm like, 'cause there's a million comedians out there who make a living sounding like other people. And now with AI, it's a stupid thing to allow to use to verify me.

Yeah.

It is lunacy to use my voice.

Yeah.

It doesn't make any sense. You're not even looking at my face, you know? And anyone, there's enough of me out there on YouTube right now. There's enough in this podcast.

Absolutely.

To have an AI agent replicate my voice.

And it's so easy. I've done it for my presentations.

Yep. Right?

So, for people tuning in, where should leaders kind of start if they want to start improving their team's cyber awareness, their cyber IQ? Oh, maybe it's CIQ or CQ cyber. Hmm, we're coming up to something, Shane.

We are. I'll have to give you credit for the first 3 times anyway.

So, because it is about intelligence. It's about having a semblance of intelligence, awareness, intentionality, Presentness. So, what can leaders do now to start to improve all that within their teams?

I hate to say it but they should start by reading the book. Check out the website. Go through the things that you didn't know. But just click through each chapter and say, wow, there is a lot of information here that I wasn't aware of. Once you realize you're not an A on the knowledge scale, it makes it a lot easier to turn around and say, let's pay this cybersecurity expert to come in here and talk to our team. And once the team knows that— I know you're from accounting, but you are part of the IT team. You might not be part of the department, which is fine. You're part of the accounting department, but you are part of the IT team, and these are the roles that you play, and we need you to know this information. Once people get to that point, I find a lot of business owners, as soon as they realize that they're not treating all of their team members as part of the IT team, I think it triggers something. They're like, well, we've never done that before. If we should, then something has to change because that's not operandus modus.

It's interesting because when we think about corporate culture and we think about the fact that we're in this community, We tell people customer service is everybody's responsibility. Safety is everybody's responsibility. We've had these talks. IT is everybody's responsibility. We just add it to the whole bundle that we're all in this together.

Yeah. And we don't have that talk. You're right. You know, we— you had a couple lines in your book that just floored me. There was that one, if you don't serve— Yeah.

If you're not taking care of a customer, you damn well better be taking care of somebody who is.

Someone who is, yes. And I love that line. It's actually on a sign up in my living room. And I just, I think we need to start having that conversation about IT.

Yeah.

You don't need a degree. You don't need 13 letters behind your name. You need to be an employee at this company. And as soon as you realize that, then we can take the next step and say, now we need to introduce other IT team members. From outside the company. Once the whole team is on board, well, how many companies have been breached from a third party, from a vendor, from, you know, I mean, look at all the Salesforce. They just, and I mean, we saw this coming, but they've had dozens of breaches in the last 30 days. And it's all because a part of Salesforce is not as secure as it should have been for third-party companies. So, Salesforce wasn't breached, but it gives an open access point to a third party that's adding something to your Salesforce and boom, the whole Salesforce data is gone. And the whole purpose of that database is holding all your customer information.

Yeah.

So, you don't want that stuff leaving, you know?

It's amazing. It's amazing because there's so many different components to it. As you said that, I was thinking back to Star Wars when they had to hack the location. And the only way that they can hack, the only thing they could hack was they could hack the garbage disposal system. Because it had no security on it because who would hack garbage disposals? And because of that, they were able to get in. Yeah.

And hey, I was well into my career doing this and I thought I had it down. And then, I don't know how many, 15, 20 years ago, Home Depot got hacked from a thermostat.

Amazing.

I'm like, a thermostat? But if the thermostat has no protection and it's on the network with the server holding your credit card information, Say goodbye to that information. Amazing.

Hey, when we come back, I'd like to talk some more about pitfalls and cautionaries. For the people tuning in, my fear is that it becomes a band-aid solution of the moment. This is going to be our policy for this month. But I'd really like to think about what the pitfalls and cautionaries should be as we try to put in systems, try to create that awareness. And we'll get to that right after this.

Attention meeting and event planners! Is your company or association planning a live or virtual conference? Seminar, staff retreat? Are you looking for a fresh, energetic perspective on what it takes to put on a jaw-dropping experience for your customers or staff? Book customer experience expert Marc Haine for your next group event. Past participants have said, Marc kept us in stitches while teaching us how important and powerful actually designing our customer experience can be. Read more testimonials and find out how Marc can serve you and your group at marchaine.com. That's M-A-R-C-H-A-I-N-E.com.

Welcome back. As you can tell, Shayna and I are committed to serving businesses just like yours. So, if you would like to explore how we could be of benefit, especially if you're planning something like a leadership retreat, Or a conference, a franchise conference where you're bringing all your franchisees together. Like any of this stuff, our contacts are in the show notes. It would be a pleasure to be of service to you and your team to help you and your leaders build capacity. So Shane, if people take one step today to protect their data, one thing that they must do as they're logging off to this show, what's the very next thing they should do?

They should go to dontbetheweakestlink.com. Or dbtwl.com for short. And they should click on Tools and click the first link under Hacked. Type their email address in, type each of their email addresses in, and see what data's been gone. And when they see some of that information, you know, like I said, you know, people are all worried about their password, but theoretically your password is only used once.

Yeah.

It's not the most important thing. If you see secure hints on there, well, that's significant. You need to go make sure every place you've ever typed a secure hint has a different entry for your mother's username or your mother's main name.

Yeah.

And that's, that's why when I'm doing the presentation about the password managers, I said the password manager has a little place for notes. Every one of them does. In that notes thing, put your secure hint. So, you know, when you start a new bank account or you log into a new email provider and you say, oh, what's my favorite? What's my first car? I don't even care what the questions are because the question is going to be, you know, the answer is big bowl of popcorn.

It doesn't have to be.

Yeah, big bowl of popcorn. What's your mother's maiden name? Big bowl of popcorn. And it's something physical right from here that I've never typed before.

Right.

And now that website has 3 random questions, more random because that's one of the 20. I don't even know what the question was. You know, when I go to reset my password, I hit forgot password, which I never have to do because I have a password manager. But it says, who, who was the, your high school or grade 1 teacher?

Big bowl of popcorn.

Big bowl of popcorn. But I have to look it up. But if I have to look it up, The hackers aren't getting it from another website. So know what's missing. That's the number one thing. Go find it. That's why it's the first chapter of the book. Lovely.

So people want to take the steps. They want to secure. They want to create the intentionality and the awareness. What are some cautionaries we should be aware of? Like, what are some of the things out there that might be lulling us? We talked about biometrics lulling us into a false sense of security. What should we be aware of as we try to bring in new policies, new procedures, New levels of intentionality among our team, whatever?

Well, the most important thing that they should be aware of is that everybody's part of the IT team. We don't say, don't be the weakest link for IT departments. You know, I don't even recommend IT guys read my book. When I speak to other geeks, my presentation changes a lot. Mostly, I'm hammering them on the things that we think are secure. We tell people, Never write a password down. I've had an IT guy, there is no reason to ever write a password down. And I'm like, well, there are reasons. If you have a parent or a relative who have a bank password or a Facebook password that's stronger than their memory, you should absolutely be promoting that they write these things down because the password manager is going to be beyond them. They're not fans of technology to start with. Get that stuff written down. I see this all the time, and I was guilty in the book. Charles and I hammered this back and forth, and he's like, we need to stop using absolutes. Always and never, they don't belong in technology because someone out there hears never and says, oh, I bet you I could do something about that, and suddenly never is tomorrow. Right.

Gosh, this has been such a great discussion, Shane. Do you have any last thoughts about what we've been talking about today? We covered so much. It really felt a little bit like drinking out of a fire hose, but any last thoughts about what we've been talking about today?

You know what? I really enjoyed this.

I'm so glad.

I think knowledge and recovery are the most critical aspects of cybersecurity. So you have to know what's missing. You have to know what can get breached. You have to know what you can do about it. And then you need to go and recover those things. So I think just knowing the steps, implore people, go to the website, download this. I mean, just flip through the chapters, and each book has homework in it at the end of every chapter. That homework's on the website. So as much as I'd love to make money off books, it's way more important that people get the information. Yes, I would like— I just like the world to be a safer place online, and we can't keep up to the cybersecurity threats.

So could you remind everybody one more time how to get a hold of you?

Absolutely. They can go to redflagit.com or dbtwl.com or dontbetheweakestlink.com if they really like typing. Or yeah, any social media. I don't get on as often as I'd like, but I'm trying to spend more time on LinkedIn and Facebook because this is where people are getting breached. You know, I just talked to someone yesterday and they were talking about— someone that I thought Was an A on the knowledge scale? Not an A. You know those little things you get on social media with a little picture and it's like, oh, what's your, you know, whatever name and like your birth month? What is this? Then your birthday. What is this? What's the color of your shirt? And then put those 3 things together. And one of my friends just did this.

Oh my goodness.

His response was funny, but I told him, I said, I show this screenshot in my presentations. And I'm like, you know that you didn't just tell all your friends that this funny thing happened. You know that the person who made that picture is scraping social media for responses. And your response didn't say all that other stuff. It said, I was born in December, my birthdate was the 23rd, and my favorite color is purple. These are the secure answers, the security hints that banks think are super secure. And you just gave them away on Facebook. What were you thinking? Oh, it was a funny response. Yeah, I agree. It's gonna be funny when they steal your email.

Yeah. Haine, this has been a brilliant conversation. Thank you so much for being here today.

Well, thank you very much for having me. This was awesome.

I loved having you. Thanks again. Hey, why don't you let me know if this was of value to you? As always, my offer stands. If you would like 30 minutes of my time to brainstorm your business with you and your team, feel free to book yourself on my online calendar. The link is down below in the show notes. It's the one that's marked meetwith.marchaine.com. Convenient, isn't it? It would be my absolute honor to be of service to you. So, why don't you go ahead and book some time on my calendar? I'd love to hobnob with you and figure out what it is that I can serve you with. And while you're at it, why don't you go ahead and leave a comment or a review you about this episode. I'd love to get your feedback. Was this of value to you? And of course, if you haven't done so yet, please make sure you subscribe. That way you get the notification. I'd love to get up to 2,000 subscribers. I just got a notification that I've had 250,000 downloads from less than 2,000 subscribers. I mean, that's really, really good, but I'd love to get to 2,000. Thank you so much. And thank you for investing your time with me here I appreciate you being here. My name is Marc Haine. I hope you stay safe, stay healthy, and I hope you dare to be the exception. Bye for now.

Thank you for joining us this week on Experience Leadership. Make sure you visit marchaine.com for a full directory of available episodes. While you're at If you found today's content valuable, please share it and tell your friends about the show. As Marc says, knowledge is power, but only if you share it. Be sure to tune in each week for the newest episode. Please stay safe, stay healthy, and dare to be the exception.