0173: Imminent Cyber Threats: How to secure your business and profit with Dr. Eric Cole

Ea interviews episode 173 inspiration, transformation, success stories and the imperfect action round seven days a week. Join Mario Ficcini for today's Expert Authority Effect interview. I am excited to bring to you Dr. Eric hold today. I don't know about you, but have you ever been concerned with cybersecurity? Whether it's your phone, your computer, your business is a very serious deal. Maybe you have a server and the last thing you want is for that server to be under attack. And I know we see stuff like in the Matrix and Neo and all these different movies and it's like we're going to blow everything up and all these crazy things, but the reality is all it really takes is a outdated password, an outdated database, just something really minute and it can lead to a ton of problems. And that is why I'm excited to have Dr. Eric Cole here today. He has been on CBS, CNN and a lot of media news outlets. He, he's worked with international banks and even the CIA. And he is a world renowned security expert, author, trainer, podcast host and CEO of Secure Anchor. And I am geeked to bring him to you because, well one, I am a geek and I know how to do some of this stuff. But he is by far the expert on the cybersecurity side of it and it has impacted my business over the years. And I want to ask him some things for you because I know you've asked me about them and you really, really, really should seriously. Because as much as I love marketing and everything and giving new ideas and helping people publish their books, it's like if you have an issue with cybersecurity, heaven forbid you're in the medical field or a financial practice or an attorney. I mean it doesn't really matter what the business is. But you need to take this. It's paramount and that's why I brought them to you. All right, Expert Authority World. Right after we thank our speaker, right after we thank our sponsor, I'm going to bring up Dr. Eric Kohl. How would you like to grow your wealth Easier than you think. With the change you probably don't notice anyhow automatically. That's why I started the compounding interest snowball investing with Acorns and advise you do too. Get started simply and easily today@eainterviews.com ACORNS Here he is, ladies and gentlemen, Dr. Eric Cole. How are you doing today?

I'm doing great. Thank you so much for having me.

I am excited for you to share because I know you're a wealth of Information and expertise in cybersecurity. And I want to ask, why did you choose this field to get into?

It's one of those. I don't know if I chose it or it sort of fell into my lap. But I've always, since I was very young, fascinated with how things work and how they operated. And I was majoring in computer science in the 80s. It wasn't sure if that's what I wanted to. So I go down to the co op office and lo and behold, the next day the CIA is interviewing on campus. So to make a long story short, I did well at the interview. They fly me down to Langley, I pass all the tests, and I'm asked where do I want to work? Networking, operating systems or security? And I'm like, security? I get to break things. And that basically began a journey where for eight years I was a professional hacker for the CIA, basically breaking it to anything connected to the Internet that was a computer.

That is fascinating. So I want to ask you, I want to ask you so much stuff, but I'm going to start with what's most important for expert authority world. Why should they take cybersecurity so seriously? And what are some things they could do to make sure their business is secure?

The reason why they need to take cybersecurity seriously is you need to recognize no matter who you are, what you do, what business you're in, you are a target. I hear from people all the time, Eric, no one's going to mess with me. I'm too small. I'm this, I'm that. I will tell you right now, everybody who has a computer and in business is going to be a target. And the second reason is cybersecurity is, is your responsibility. Vendors can give you software that has security built in, that has security controls, but ultimately it's your responsibility. And the two areas you got to be the most concerned with are browsers and email clients. Those are going to be the source of most attacks against you as an individual. Now, yes, attackers can break into servers, and you talked about keeping them up to date and unpatched and all those issues. But really today, it's about anytime you get an email, anytime you go to a website, you're one click away from a potential compromise. And one of the easiest tricks that I tell all my clients, and this is one of the tricks I give even Bill Gates, right? You might be surprised with this, but Windows is a very, very powerful operating system. And because it has such a Large install base, 90% of all malware is written for Windows operating systems. So while I use Windows for my business, when I check email, when I surf the web, I use a non Windows device. I either use a tablet, an iPad and iPhone because those devices are not going to be susceptible. That lets me surf the web safely, check email safely, and then once I verify and validate the emails or content is legit, then I could go to my desk computer and start getting down to business.

That's a really good point you make because I've heard for years, you know, Macs don't get bugs or anything and correct me if I'm wrong, but they still can. It's just like you said, most are written for Windows based. Is that correct?

That's correct. So if you look at the number of vulnerabilities year after year, they are the same per operating system. Mac is no more secure than Windows or Android or anything else. But the issue is this, if 90% of the world is running a Windows operating system and I'm somebody in Russia or other areas of the world and I want to break into as many people as possible, am I going to target a 90% operating system or a 5% operating system?

That makes total sense. And that's the same as business. It's why business people go to events and sponsor events and do this. Are you talking to your audience or do you just want to throw mud against the wall? So thank you for saying that because people have said for years, you know, all their malware proof, they're virus proof, and it's like, no, nothing is proof. Even waterproof subs, even submarines waterproof, at some point they're going to leak. It's just that, you know, how much more impenetrable are you on the different things? You brought up the email and I've seen these, you know, all throughout the years. You said you're one click away and you're referring to the emails where it's like, just click here to verify such and such. And it's really taking you to a malicious exploit. Correct.

Exactly. What we call phishing attacks. And what's interesting, attackers are always going to take advantage of us when we're emotional and we're not thinking straight. Which I will tell you we've seen over the last 90 days with the epidemic and Covid, the number of phishing attacks increased by 300%. Because I will tell you, if you got an email in your box that said seven of your coworkers tested positive for COVID 19, check here to find out the details. I don't care who you are, you're clicking that before you can think. And before you know it, you just by clicking on that attachment, boom, malware drops on your box and, and you're impacted.

I think I got no less than seven or eight emails from Financial Processing for credit cards and you know, for clients for my company and stuff. And it was, you know, like it seemed like every three days, click on this to verify that. Click on this to verify that. And I'm like, bro, you're not even using the right email extension that you know it's from the actual provider. It's like, but I see. But they may. Visually it looked like the credit card processing and I have multiple different things and it seemed like all of them were the same, the same thing. And if you just take a visual look, I know with ads and marketing most people aren't going to read the fine print. If you make a pretty image, click. And that's, you know, people are visual.

What would you say? It's all about the numbers game. Like you said, you get these every day and you weren't expecting them. So you sort of look closely and say, okay, this looks like a scam. But what they're hoping is that one of these come in right after you got off the phone with your bank and your bank said, listen, we're going to send you an updated link. You get off the phone, it comes in and now because you're expecting it, you click. And as you're clicking, you're probably at that inner voice going, no, right? But you click it anyway. And that's, it's they're playing the odds. They're going to send you 1000 emails with the hope that you only click one.

So what would you say? You said email isn't secure. Common things for businesses. What about business websites?

The best thing with business websites is twofold. One is unless you're a very, very large company, outsource it. Outsource it to somebody who that is their business. Because with my company running my web server is an overhead function. That means when my business is good, I'm going to invest in my business is bad. I'm going to pull back resources from overhead and I'm not going to put the time and energy that's needed if I outsource that to a third party provider where that's their business, they're going to patch it, they're going to update it, they're going to make sure it's locked down. Second, and this is probably the most important, never put critical Data or critical information on a public website. If you look at all the major breaches, whether it's Marriott, whether it's any of the other big ones you've seen out there, every one of those breaches, critical data was located on Internet facing servers. And that is just a big no no that you want to avoid.

Why is that? Why would you want a separate server altogether for critical data versus the public facing?

It's all about defense in depth and making it that much harder for the adversary. If you have a server that's accessible from the Internet, that's missing patches, that has a weak password, that has your critical data, somebody can get in and out very quick, compromise your data and you'll never notice it. But if you have your critical data on the back end and you're monitoring and watching it now, even if somebody breaks into the front end web server, which you have to recognize will happen because 100% security doesn't exist, then you have more time to react, more time to respond, and more time to protect and control your critical information.

Now the secure server, when you're saying for the critical data, would you say you want that connected to the Internet so it's easy and accessible, or would you air gap it and keep it completely offline?

You want to go in and not completely air gap because remember the information has to be accessible from the Internet. But you want to do what we call a three tier architecture where you have your Internet facing server that is directly accessible from the Internet. It then goes through a series of checks that we call middleware and then your back end database. So there's three levels of security that you have to go through in order for somebody to access that information.

So at the, like you said, there's no, no system that's 100% secure. This at least has a lot of checks and balances that they're not going to go in and out without you being notified at some point.

Exactly. The way I define security, it's about controlling damage and acceptable level of risk. So what you have to ask yourself is what is the risk you're willing to accept? And it's always funny because I'll work with an executive of say a bank or a healthcare organization and they say, oh, we have no tolerance, we can't have any records, nothing compromised, we have to be locked down. And I say, great, it's gonna cost you $50 million. And they go, okay, maybe we can tolerate a little risk. What can you give me for 5 million, right? So typically you gotta look at that that, okay, while you prefer not to have any records stolen, in most cases, if you have 30 or 40 records stolen before you detect it, that's gonna be acceptable when you look at what it's gonna cost versus what the risk is. But most people don't look at both sides, they only look at the functionality. But you wanna say, what is the functionality, what is the risk and what is that acceptable level of risk? And most importantly, what am I willing to pay to achieve that?

And I would also have to say you have to look at the impact on the organization because you can have.

Right.

When you said $50 million, I'm like, yeah, you could do the thing for mission impossible too with laser grids on the vent and fingerprint and a motion detection floor. But what kind of impact does it make on the organization or business? Like you said, it's got to be connected so the data is accessible. If you're making a three key nuclear bomb defense and you need to have all the senior staff just to retrieve an email, well, what's it costing you for speed of implementation? Just accessing the records. Right.

Exactly. And the point that you really bring up, which is critical is anytime you're building, designing a system or a network, security needs to be engaged from the beginning. That's probably the biggest mistake that companies, they talk about functionality, talk about how do we get it rolled out as quick as possible, as cheap as possible, and at the very, very end they're like, oh yeah, let's throw it behind a firewall and that will make it secure. And that's just not how it works. You have to, from the beginning, when you're designing out your systems or your applications or your business, you need to say, what is the security impact and what is the tolerable level of risk that we're willing to allow?

Excellent. Well, you've brought up many good points and it's why I wanted to start with those. Because I know there's, like you said, mainly outsource it for most companies. And maybe you have a server, maybe you don't, but everyone has email. Want to touch on something else? And if there's anything else you want to add in other areas that people should consider that apply to everyone, please let us know. I believe one of them is social media. In the apps, when you click on these, you know, oh, click here to see how many butterflies flew up a birthday cake when you were 16 or whatever. And it, you know, it sends you to one of these sites where it's like, just approve this whole list of permissions. What do you think about those?

Yeah. To me, one of the most dangerous words when it comes to cybersecurity is the F word. I can't stand the F word. I wish it was removed from the dictionary. And of course, the F word that I'm referring to is free. Right. Free is not free. So many people get in so much trouble because there's free apps and they act like a kid in a candy store. And they're just downloading all these apps and. And they don't pay attention that in order for you to access a free app, you have to allow it to access your microphone, your location, and your camera because they're using your data as part of the service. My general rule is if there's not a commercial app, I don't use it because I would rather pay 399 and keep my data safe than get it for free and exchange my data for this application.

I agree 100%. I almost always pay, unless the app is only a free one. I mean, the ads alone ruin the experience, the safety, the security. It's like, plus you're supporting the designer. It's like nothing's free in the world. So.

Is there anything else that expert Authority world should consider? We talked about emails. They may or may not have a server downloading apps. What is one more point that is probably in the top 10 list that things you should not do other than clicking on the link from the. The banking, you know, the overseas prince, who I don't even want to name a specific country, but, you know, those are pretty obvious, too. Or the Russian princess or whatever.

Yeah. So I would say probably the biggest one is most apps, most websites, most software that you utilize. The good news, it has security built in. The bad news is it's not turned on by default. Because banks and E Commerce, they recognize that consumers might want security, but they don't feel we're at the level where they want to inconvenience you. So the two features that I always recommend you turn on, and the first one you alluded to with passwords, is two factor authentication, where every time you authenticate, you want to get a unique code just to add that extra level of protection. The second one is account notification. Anytime somebody tries to access my bank account, tries to transfer money from my bank account, or do anything that could financially impact me, I get a text notification. I'm immediately notified that that's happening, and then I can take action. And I know a lot of listeners, and when I give keynotes, and this I Go. But Eric, that's an inconvenience. That's going to take me a few minutes. So here's your options. Option one, you could have a two to three second inconvenience several times a day where you get notified of things going on with your account. That's option one. Or option two, don't be inconvenienced. And then in seven months you have your entire bank account wiped out. Which option would you like? And the reality is, in today's world, it's that simple.

Yeah, I agree with you. And I did turn, turn on 2fa for a lot of stuff over the last year and it I probably get a third of my emails are just notifications between my software and bank stuff. And yeah, I'm glad I have it on, but it's probably a third to a half of my emails that I get. However.

How much bigger of a pain in the butt is it down the road when you might be dealing with it for four, five, six, seven, eight weeks, if not longer? Heaven forbid someone takes your identity.

Exactly. We live in a world where there's going to be a little bit of inconvenience. You just have to pick which one you prefer.

That's a good point. That's a very good point. So I have some more questions, but I want to ask you about your clients. What is your biggest success story of someone that obviously needed help, came to you, and then afterwards they were so much happier that they did.

I can almost hold up a deck of cards and say, pick one. So probably one is one that we recently worked on where this was an international organization based overseas and they thought they had pretty good security. They were spending about $35 million a year on security and it was really what we call checkbox security. They had all the traditional devices, all the traditional components, but they weren't focusing on their critical data and they weren't monitoring and looking at what was happening. And when we came in to do an assessment, we realized that six of their executives, laptops, including the CEO who travels to China on a regular basis, was infected with monitoring software that was watching and monitoring everything they were doing. And at least what we could confirm, it was probably higher. But 30% of their intellectual property was stolen over the last couple of years and they were completely missing it because they were doing good things but not the right thing and they were focused only on prevention. So we came in, did an assessment, revamped their security, now reconsolidating, limiting where their critical data is located, setting up monitoring, detection, alerting and all those components. And the interesting thing is their security has increased by 200% and we cut their budget in half by almost 50%. So now they're paying about 17 million with a much higher level of security. So I bring that up because security doesn't have to be expensive. If you focus on the right areas and you understand and think like the adversary.

Wow, that's fantastic. And what I also heard in there was increased profit. You have the higher security and you reduced in half. So you could say we have to, you know, 35 mil a year. We need a double sales. Everyone's always talking about getting more leads, getting more sales. It's like, be more effective with what you have. It's not how much you make, it's how much you keep. 50% is 100% increase.

Exactly. And that's one of my secrets of my company when I hire new employees and train them, is most people. When you think of security, you think of it as a business disabler. It limits the business. It makes it harder to do business, it makes it more difficult. What I tell them is, listen, these are companies where profit is critical. So our focus on cybersecurity is to become a business enabler. How can we increase your security and. And as you said, increase your productivity and profits at the same time? And it's an interesting perspective. Most technical folks and geeks don't look at it from a business perspective. And I think that's one of the reasons why we're so successful is because I've run businesses, I've sold businesses, and when I do cybersecurity, I always think of it from a business impact, not just implement Fort Knox and slow down functionality.

Yeah. And you and I are on the same page with that because I've talked to my team, I've talked to the hosting companies, I've talked with clients, and, you know, it's astonishing. It's like you said, if you have to walk up 10 flights of stairs just to get to the lobby, yeah, it's more secure, but it's not really conducive for business where you could just maybe put a fingerprint reader on the front door of a hotel or something, and that's more secure and not really that inconvenient. So you need to have that balance with it just like anything. And.

I found the last few years, really, if you slow down to speed up, it's really conducive because sometimes people are just going a million miles an hour forward and you're going forward, but Are you even going in the right direction?

That's spot on. And you've not only nailed my approach to cybersecurity, but also to my life and business. Every month I take three days where I do what I call thinking time, where I actually, I just go away somewhere. It could be a local hotel, it could be Miami. And I just, I step away from the business. My team knows this. They don't bother me unless there's an emergency. And I just slow down to really think about, okay, what are the top problems, and just brainstorm on creative solutions and just taking off for three days. When I come back, my productivity levels are just so much higher. It's not about working harder, it's about working smarter.

Absolutely. I very much do a similar practice and do what I can in two to three days of the week and enjoy the rest with friends and family. I want to ask you about movies because there are so many like the Matrix and Swordfish and just so many out there hackers.

How much of it is real and how much of it is just Hollywood stuff?

Every. I would say every year. But it's probably every month that passes, those movies become more and more realistic and more and more probable. Because here's the big problem. The general approach to security that we took when it comes to critical systems, hospital systems and nuclear reactors was always what you mentioned earlier, air gap, completely isolated and separated. So unless you physically breach the perimeter, you couldn't get access to it. What's happening now is for productivity reasons, they're starting to interconnect all these systems. So most systems, even critical devices, now have some interconnectivity to the network. So now the probability of somebody to hack or break in is much more likely. The movie, you didn't mention that. The more I watch it, the more it scares me. Is Live Free or Die Hard with Bruce Willis where they fire sale. Well, when I first saw that, I'm like, you gotta be kidding me. And now I'm looking at today, I'm going, that's probably more realistic than we'd like to believe or imagine. And the same thing with Swordfish where they break into the bank, steal the money. Once again, it's. It's not simple. But every day and every week that passes, the probability of attacks like that happening or occurring are increasing. And not to sort of be Doomsday Chicken Little, the sky is falling. But what worries me the most is those things are probably happening. And because most companies aren't looking in the right area, we're not detecting or even realizing that it is occurring.

Yeah, that's interesting because I think knowledge is. The knowledge is power and you need to put it into action. But so many people just don't even know. And like I said in the beginning, it's why I was thrilled to have you on. I was like, yeah, for sure we want him. Because the knowledge, you have an expertise, so many people just don't know it. They think that, you know, another one is Windows Defender. Is that good enough? Or should you have an antivirus? The whole Mac thing. Oh, I buy a Mac because it's impenetrable. No, it's not. No. That's like saying your car is completely waterproof because the leak. The roof don't leak. No, it's not. Drive it through a lake, I'll prove you right.

You know, it's just. It's just these common misconceptions. And.

That'S the thing. Most people just see the security from the movies and think, well, oh, shoot, they're going to come in with a helicopter and go over the wall of the bank or whatever. It's like you could just have an outdated password that you can just run a password sniffer on and wait a day or two.

Exactly. And like you said, most people, because of the Hollywood movies, think, oh, somebody's going to target a billionaire and steal $20 million from them. And in reality, that's not how it works. An easier, simpler method is, what if I stole a dollar from 20 million people? And that's what's happening today. Most people don't look at their credit card statements close enough that if somebody actually was charging an additional dollar, they were just adding it to an existing charge, like at a restaurant or a tip or a place like that. Most people wouldn't recognize it. And that happens more likely than we realize that. I did an experiment. This isn't fully scientific, but we took 30 people randomly and we reviewed their credit card statements for an entire year, and on 90% of them, we found fraudulent transactions. At least $100 in some of them, up to two or $3,000 that they completely and totally missed. Because today's attackers is all about a little bit from a lot of people than a lot from one person.

Yeah, and that brings up a good point too, because I know I've seen this even from a legit sources where you're dealing business with. You're doing business with company xyz, but their legal entity name is something different. So on the credit card statement, it shows up a different company name than you know what their DBA was. So unless those match, you might look and go, oh, that was that. You know that tip I left for 20 bucks, when really it wasn't. It was something that someone charged and the names were just different. Do you see that happen a lot?

Exactly. Because everyone has different tolerance levels. Some people, if it's three or four dollars on their card that they don't recognize, they might let it go. Some people might be 30 or 40, but everyone sort of has that number. And like you said, they. They don't recognize it. Exactly. But they charge enough that they say, yeah, let's let it go. Or the one we see a lot is you go to a restaurant. Well, when we were allowed to go to restaurants. Let's go back to before COVID But you go to a restaurant and you knew maybe the bill was 80 bucks and you left $15 tip. So it was $95 at the end of the month. You don't remember if it was 95, 97, or 98. So if somebody went in and added two additional dollars to that tip, charge you 97 bucks, you probably wouldn't recognize it because most people don't keep their receipts for 40 days and validate. But that goes back to my little text reminder. When I'm in a restaurant and I pay with my credit card and I give the tip, I get a text message that pops up right there that says 95 bucks. So if I know I did 93 and it pops up at 95, I catch it immediately. And it's just that real time data to be able to detect and control the damage is critical. If you ignore things, that's when they add up and can get you into trouble.

Yeah. And I think it's great that they have that. I remember when I opened another new Chase account some years ago and I celebrated by getting lunch. It was a couple slices of pizza or whatever. And I literally drove from there, three minutes down the road from where I was at, and then I get this text message. It's like, do you verify this $4.75 transaction? And I'm like, where did what? How does it even know that? Quick. I mean, it was a matter of four to five minutes of real life. And I was like, wow, this is super secure. And that's good. But it was just interesting that the first couple of weeks, it's like, was this really you? Yes. You know, but like you said, do you want that short term inconvenience or do you want all your business? You know, for me, personal and business bank accounts taken out.

And the way I look at it, we're sort of at a transition point where people just have to get used to the habits. I remember in the 70s when I was growing up in New York, nobody wanted to wear seatbelts. That's when seatbelts weren't legal and they were passing it and like people were crazy. I mean they were cutting seatbelts out of their cars and they're like, oh, they're wearing a seatbelt because they weren't used to doing it and it was just an inconvenience. Now we wear seatbelts without even thinking about it. It's a second nature. And we just put that seatbelt on and, and I think we're in that same spot where now in cybersecurity we're starting to tell people, hey, you weren't being safe, you need to start putting on some of these safety measures. And they don't like it and they're fighting it. But in three to five years it's just going to become second nature. We're just, when we go and use our credit card, we take out our phone, we verify the transaction, it's just going to become part of business. But right now we're just in that discomfort of transitioning over to a safer world.

Well, I think it's a good thing and I also know that it's always going to be back and forth because I remember when CDs were a thing in DVDs and they had digital rights management and all these different things. And then there was an article that was like you, you know Sony spends millions of dollars to make it so you can't copy them and all it took was a Sharpie around the edge to fool the laser or whatever. And it's like if you increase security someone's going to be fighting it. So I'm glad there's great people like you out there educating so you know we can stay on par and ahead of the malicious people because they're always going to be there.

Exactly. And I'm so glad you said CD and not eight track tapes because that would have made me really, really feel old there. But, but yeah, you bring up the point that I tell folks cybersecurity is not hard if you accept the fact that you're a target and it's your responsibility and if you're just a little aware and you're set up the alerting and you add the two factor authentication, you're careful about emails, use a non Windows device and just have that awareness level that you are going to be a target and you have to make sure you're secure a little bit goes a long way in just building those good cyber habits.

Well, I appreciate you for sharing them with us.

I'm going to jump to the fun question now with the.

Wheel of whatever. We're going to pretend that I put your question on here, give it a little spin. And I know exactly what I'm going to ask you because it ended on the one I wanted it to right here. So the question is. Oh, it was a good one. Oh, social media. Here's been a long standing debate with the Prism project and Facebook and Apple and Google. They all have our information. And do you think they're really selling it and giving it away or do you really think it is legit secure? And they'd never do that because it would totally kill their business.

Can I choose option C?

What's that?

Option C is a little bit of both. So these companies are absolutely utilizing our data for financial gain. Just think about it. How is a company like Facebook that doesn't charge for their product and doesn't have any actual products that they sell worth billions and billions of dollars? And it's because they're using our data to build profiles, to be able to do target marketing. So they are absolutely gathering, using our information. When you have Alexa in your house, when you have your phone with Siri on it, it's listening, it's gathering, it's correlating your data. Our lives are being recorded.

We.

All that information is being stored. However, while they're using it in order to do target marketing, they're not actually selling it or giving it the third parties because that would kill their business. So it's sort of a fine line where Facebook is getting everything they want to know about me, but then instead of selling the data, they're going to McDonald's and saying, listen, if you give us $10 million of your advertising budget, instead of doing commercials, whenever somebody comes within 300ft of a McDonald's, we'll hit them with a discount code for a dollar off a cheeseburger. Is that worth it to you to find that level of targeted marketing? And they say, absolutely. And that's what they do. They go to the Ford dealership and say, listen, anytime somebody talks about a Ford or goes to the Ford website or says they want to buy a new truck, we'll go and take your ad and we'll push it onto their email, their browser, and everywhere they go. So you're now Visible. Is that worth $20 million? So they're absolutely using it, but they're not directly selling it. They're indirectly selling it to marketers.

Yeah. And I knew they were doing that. I think everyone knows about Google Ads and Facebook ads. And with a marketing background, I run ads. I love paying for ads. And it's great to get information when you have a legit service and you're trying to help someone. But I've heard this debate for 20 some years, and it's like, are they taking or are they doing this? And I'm like, use some common sense. Would you? If you spent a decade or two building up a company, would you do something to destroy it? It's kind of like a kid. Would you purposely go, say, go walk in the street at night? I wouldn't, but.

I mean, I think it's just common sense. But not everyone has that, so.

But exactly. But just playing that forward. The bigger concern is not that Facebook is selling my data, but we know anybody that has data, 100% security doesn't exist. What if they get hacked? What if they get compromised? And we're even seeing this now where cyber blackmailing becoming really, really big business, where they're going in and saying, eric, we noticed that you surf these inappropriate sites or your geolocation was at a hotel at the same exact time of somebody else who might be in a questionable line of business. Right. And you were both there for three hours. What if your spouse knew about that? If you pay US$500, nobody will know. That's my bigger concern is what happens not if, but when these companies that have all of our data get hacked and get compromised, then we start having major problems very, very quickly.

Yeah. It's astonishing to think what, you know, we had the industrial age, and a lot of people, I still think, believe we're in it, But I feel we've been in the information age for conservatively, 15, 20, maybe even arguably 30 years. And that's all it is. It's just data and spreadsheets and databases and all kinds of stuff. And, you know, people make it look prettier online, but at the end of the day, if you have the data, you have everything.

Exactly. And the thing that always astonishes me is we spend a large percent of our lives online. Yet for some reason, in the physical world, people have a lot of common sense. But when it comes to cyberspace, common sense is a train that leaves the station and never, ever comes back. And I'll give you a simple example. If you were Just physically walking down the street today and somebody walks up to you and says, what's your name? Where do you live? What's your phone number? What's your mother's maiden name? You'd be like, get away from me. I mean, I'm not telling you. I mean, you might think of calling the cops. You look around you, there's no way you would give that information to a complete and total stranger. However, not saying you, but somebody else tonight, they're just going through Facebook and they're just clicking on things and go, ah, free ebook. And they click on it and a little pop up appears, says, please enter your name, please enter your phone number, please enter your address. And we're like, absolutely. And we hit enter. That's the same exact scenario. So I always tell people, if you won't do it in the physical world, don't do it in cyberspace.

That's a great analogy. And I've told people for years with marketing when they're trying to advertise something on Facebook, it's like it's a social platform. You know, if you were to picture, would you ever go to a backyard barbecue with a trench coat and be like, hey, I'm selling watches or whatever. It's like, Facebook is not a billboard. Don't just plaster stuff on it. You have to. You know what I mean? It's that same thing. How would this be in real life? And it's just, it's hilarious. I just, I put a lot of stuff in what I call bucket C and these are like movie scripts and stand up comedy routines. It's like, hey, I'm not even gonna entertain this as like an actual thing. This is so ridiculous to begin with. We're just gonna, it's going in bucket C over here. So I'm glad you made that point. Also.

I'm going to thank the sponsor and we're going to come back for the imperfect action round. Invest automatically, save for later, and spend today. That's why I love Acorns. I used to think spare change didn't make a difference and saving and investing was an old fashioned manual process. It's not. And it's a game changer. If you're not leveraging compounding interest in your business and life automatically, you're missing out. Acorns not only makes saving and investing easy and automatic, it makes it even more valuable. By investing with diversified portfolios, spare change, extra cash, and rounding up everyday transactions, you can even set recurring monthly investments in the amount you desire to make good, great There is also a debit card option that will continue to help you save and invest even further when you spend. Plus no minimum balance and overdraft fees. Now the cherry on top. They have partnered with 250 plus companies and brands and growing with their found Money program to invest back a percentage into your account with the everyday purchases when you shop, two of which you're probably listening to this right now through an Amazon or Apple device. Get started profiting from your everyday life and business simply and easily today@eainterviews.com Acorns once again, that's eainterviews.com for acorns. And we are back with the imperfect action round. Are you ready to take imperfect action?

Let's do it.

All right, first question. What is the fastest path to the cash?

Fastest path to the cash is be visible and be out there. One of the things I tell folks is every single day you should be putting content out on social media. You should be putting videos, should be content. You don't know what your audience really wants. You don't know who would be interested in your services. And I'll give you a perfect example. I'm now crushing it in a new service where I'm training people how to be virtual chief information security officers. And it was all because I started posting some videos and I got 30 people in an hour reply back saying, will you train us? Will you coach us? Do you have any services? And I'm like, well, I guess I do now, if that many people ask. So be out there, be visible and listen to the market.

That's fantastic. Number two, what is the. Nope, just ask that one. Just kidding. What is the biggest problem you see your prospects making in the fastest way? They can fix it.

Biggest problem is they want to go in and make it perfect. So I just had this with one of my clients and he's like, eric, I'm working on my plan. I'm working on my plan and I'm tuning my message and I'm policing my message. And I'm like, dude, execute. Start doing something. I said, you can plan a little bit and it's good to sort of have an idea where you're going. But if you've spent the last three, four or five months planning, planning, planning, and you're not actually taking action, then stop. Jump off the cliff, get cut up, get bruised, see what happens. But execute on the plan. Stop trying to make the plan perfect.

That's powerful. And that's why I call this the imperfect action round. Because I'VE told my clients for years, you know, we're going to be doing imperfect action. We can't make it perfect, but it's going to get done. And truthfully, some of the passwords to my membership sites are take daily imperfect action. So you might tell me to change them now.

Yeah. All right. One of my philosophies is that at any moment, the best thing you could possibly do is the right thing. The second best possible thing you could do is the wrong thing. The third worst possible thing you could do is nothing. So I'm a big fan. It's better to do the wrong thing and figure it out than do nothing and never recognize what the real solution was.

Yeah, because you, you can fail today, tomorrow, the next day, and figure out within three to five days, maybe a week, or you can think about it for three months and you're no further along.

Boom.

I needed to hear part of that, too. So thanks. But everyone needs reminders. And, you know, no one's perfect. Don't beat yourself up for it. Number three, what is the best way to maximize customer lifetime value?

That one, to me is probably the easiest. Treat your existing customers better than your new customers. Everybody wants to invest money in new customers. New customers, new customers. And they think once they get a customer, they don't have to take care of them anymore. But to me, my philosophy with my company is customers for life. Once we get a customer, I want to treat them so good, I want to take care of them that they never, ever think of going anywhere else. If I'm going to give specials and deals to anybody, it's going to be my existing customers. And a great example of this is in my area, for my home, we have cable mode. We have high speed Internet with our cable provider. And they just came out with a deal that will give you $200 off for new customers. So I call them up and I said, hey, I've been your Customer loyal for four years. Will you give me $200 off? And they said, absolutely not. It's only for new customers. I said, so let me get this straight. If I go in and I drop you and I go to somebody else for three months and then I become a new customer, you'll then get me the $200 off? And they said, yes. I said, but what if I switch to another provider and they do a better job and I never come back? And you just heard silence on the line. Right? So so many companies are so focused on giving better deals to new customers. And I'm like, that's crazy. The best deal should be to your existing customer because reoccurring revenue is the way that you grow.

I'm so glad you mentioned that. I've, I've said the same similar things to phone companies and it's astonishing. It's like, you know, I've been with you for 14 years and you can't help me with this, but this other dude you're gonna give a thousand dollars to to switch. Really?

Thank you for bringing that up. That, that, that's a good one. That's a real good one. That hits home.

Books. What are some great books you could recommend to Expert Authority World?

That sort of depends on any given day. I mean, of course I'm a huge fan of Napoleon Hill, except I'm going to mix it up a little bit. I actually don't like his Think or Grow Rich. I know that's his famous, famous one. The one that I like because it really gets you thinking is Interview with the Devil. It's one that's not as well known, but it's a really good, well written book that I highly, highly recommend. The two others because I'm really now in the stage of elevating my business to the next level is I would say, Blue Ocean strategy about finding that blue ocean. And then the second one is play Bigger where they talk about being a category king. So if you can find the blue Ocean, become a category king, then even when the competition comes in, you'll still be able to own that space. So those would definitely be Blue Ocean and Clay Bigaro are my two favorite books right now.

Excellent. Well, thank you for those recommendations. I have enjoyed this so much. I know everyone's going to want to learn more about you. Where would you like them to go.

To learn more.

If they'd like to find out more about cybersecurity and from a business standpoint, go to my company website, secure-anchor.com secure-anchor.com if you want to just find out more about my thoughts, my videos go to any of my social media platforms. Dr. Eric C O L E Dr. Eric Cole. I post videos every day. I do live where I give my thoughts on business.

Life and random thoughts. So either Dr. Eric Cole or Secure Anchor.com are the two best resources.

Excellent. Well, thank you so much. Dr. Eric Kohl. I have got a lot out of this and I know Expert Authority World has also.

Well, my pleasure and thank you so much for having me.

All right, Expert Authority World. We have another good episode here today. I'll see you tomorrow make it a great day and God bless you.

Why Every Business Needs a book including yours Would you like to save five plus hours with every prospect? Generate more leads and profit in your business now? Visit businessbookchecklist.com and learn how you can implement this in your business today. Spare Change? How's that going to make a difference? I know that's what I thought before I started investing with Acorns. Throwing change in a jar is not very leverage and time consuming. But what about all the transactions you don't use? Cash Cash for you know, like majority, Acorns not only invest your spare change automatically with roundups, it also lets you add a preset amount to each transaction. Regardless, it's pretty inspiring to see how quickly and easily you can end up with a pile of cash instead. A pile of receipts. Get started simply and easily today@eainterviews.com Acorns Once again, that's eainterviews.com Acorns hey, thanks for listening to today's episode. I hope you got a lot out of it. I know I sure did. If you haven't done so already, I invite you to subscribe to the show. And also be sure to check out eainterviews.com for complete show notes, the full interview video experience, links to the resources we mentioned, and more. Have a blessed day and I'll see you tomorrow.