0250: How To Keep Your Company Safe & Secure While Exceeding Compliance, Security, & Privacy Goals with Alfizo Security Solutions President Gary Chan

My name is Gary Chan. You can find me@alfezo.com and you're listening to EA interviews.

EA interviews episode 250 inspiration, transformation, success stories and the imperfect action round. Seven days a week. Join Mario Ficcini for today's expert authority effect interview. Cybersecurity data, people hacking into stuff, stealing what you have built up. These are not good things if they're stealing it. But that's why we're going to be talking about protecting it. I have none other than Gary Chan with Alfizo here today. And we're going to be talking about having cybersecurity like a big company even if you're a small or mid size, why it's important and why you shouldn't wait another day to do something about it. I'm going to bring them up right after we thank our sponsor. Every business needs a book, including yours. Visit freebusinessbook publishingcourse.com today to learn the seven steps to publish and promote your nonfiction lead and profit generating a business book in eight weeks. Once again that's free businessbook publishingcourse.com Ladies and gentlemen, Gary Chan. Gary, how are you feeling today?

I'm doing awesome. It's a pleasure to chat with you today. I love your show, Mario.

Well, I appreciate that. I'm excited for you to share with Expert Authority world because cybersecurity is something that I've thought about. We see it in movies, we see it in the news, we see it here and there. But the reality is does everyone have, I'd even argue the companies who are implementing it. Is theirs even secure? I think it's one of those things where it's like we know it's important but it's not the highest priority in a day to day for the average business. And I want you to tell us why that's the exact wrong thinking.

Yeah, well you're actually quite spot on. Most organizations call me after they have a problem, not before. And let me tell you, it's way cheaper to sort of do it up front. But yeah, I mean most companies that what they're interested in is they're interested in getting to that next contract, making that next big, you know, whatever product announcement and they're really not thinking about you know, what am I, am I protecting it? They just want to be looking at it from a revenue perspective and security is normally a sort of a cost and so that's, it just never rises to the level of, you know, prioritization. I'm assuming that's, that's the bottom line of it until they have a problem.

Do you think it's because it's one of those things kind of like going to the doctor or laundry where it's just not fun or sexy or something?

I really think it's just, just profitability. So whenever I go into organizations, they're, you know, they really are more interested in buying. So I guess, let me put it this way, right? When you go into a business and the owner has the choice between investing, say $10,000 in something that might possibly get them more revenue, whether it's marketing and sales or maybe a new product feature, or investing $10,000 in security, most of them are going to say, well, I'm going to spend the $10,000 to potentially earn more money. It's not going to be, I'm going to spend $10,000 in order to keep what I have because so far no one's stolen from me. Or at least they don't know that something's been stolen from them. And so they don't just don't prioritize it. And that's really a very, very common conversation that I have.

So let's talk about that because here on EA interviews, we talk about profit, we talk about business specifically growing both. And what does it, you know, what's the cost of not doing it? And you know, oh, no one's done anything yet, but, you know, I don't really want to spend the ten grand. What does it typically look like when someone does get hacked, something does get breached? What is the real cost of it? Not just the, hey, come fix it, but what is the real cost of that?

So the real cost, really? I, you know, I hate saying it depends. It sort of depends. But let me, let me explain that a little bit more, right? So for really small shops, it could put them basically out of business, right? So if you're holding on to customer data and depending upon what that data is, or even just your employee Social Security number and all the other stuff, you are on the hook potentially to pay a lot of different things to compensate the people for whatever may have happened after you lost their data. And so it could put company under. I know there are a lot of statistics out there. Some of them even say, like, half of small businesses go out of business within six months after.

A breach. But there's just so many different factors that can go into it. And a lot of the larger companies, right, like if they have a little bit of security and they've only lost a little bit of data, you can do Some sort of calculation to figure out, you know, how much money that they've lost and things like that. If you think about how much this data costs, you know, it's a really, really hard calculation to make. And so I think the easier thing for businesses to do is to just assume it's zero and then ignore it.

Yeah. And you can have two different mindsets through it. I mean, if you're going, oh, we lost a terabyte of data, it's like. It's like, what, 50 bucks worth of hard drives. Well, maybe you have some enterprise class with helium inside of them, and they're 500 bucks a hard drive. But that's not what you're, you know, that's not the correct comparison, if you ask me. It's really, you know, what is the relationship? What is the reputation? I mean, whether you have 10, 10 clients, 10,000 or 10 million.

It doesn't really matter about specifically those bits of data, but the years that they represent in the relationships and all of that, that maybe you didn't lose anything, maybe think nothing was stolen. But the fact that it's even breached, what does that do with the trust of your customers?

I completely agree. And I think it's actually easier to look at it in terms of, you know, what. In terms of, you know, past breaches and kind of what happened. Right? So, like, for example, target. I mean, everybody knows about that one where they got breached. And then basically they, you know, some people lost their jobs, but then they also had to pay all these legal suits millions of dollars. And then they also, basically, they gave, like a 10% off coupon to everybody, Right? So that's a lot of money that they lost. Some of these other companies, when they get breached, they're down for days at a time or maybe even weeks at a time. Right. So can you put a measure against that? So there is this one company that's kind of down the road to where I am, and basically.

They called me after.

They had a breach, right? And so they're like, hey, Gary.

We'Re down. We just turned everything off because we think that there's a breach, and so on and so forth. So I went in there, and in about 10 minutes, I showed them exactly what went wrong. It wasn't actually a breach in that particular case, and I could prove it. And then they could go back to work, but they lost an entire day's worth of work for all of their employees. Right? So in terms of the total cost, it's just so different for every business. It could Be whatever the cost is for a day to whatever the cost is for a week's worth of work or maybe it's a reputational damage. Where now are you going to trust them? Right. So with Equifax, when they lost a lot of data years ago, where basically all of our Social Security numbers and credit information so and so forth, that was a pretty big deal. And then of course, whenever the government loses our data, like they lost a lot of the people who got the government security clearances, they lost a lot of that data. What's the cost of that? Even if you don't put money against it, you know, whenever you try, whenever those people travel to a foreign country and if that foreign country has a lot of that data, they now have a lot of data that they can use to blackmail that person. Right. So I really don't like putting things in just the, you know, what's the monetary cost? Which I think is the problem whenever we try to sell security. But really looking at it from all of these other angles too that are really, really important for a lot of businesses, but it just isn't front and center all the time.

What's the first thing that someone should be doing to protect themselves in situations like this? Because I realize that maybe you've got a staff of 10, maybe you've got a team of 10,000. And those are two different scenarios. And again dependent on industry. And I feel for the smaller to mid size because I know of situations where it wasn't like someone was hacking them like in Swordfish, it was just someone put the wrong thing in the wrong place, it got uploaded in the wrong spot, this, that, the other thing and it just turned into a mess. It could have easily been prevented, but it really is more detrimental to the smaller companies because.

Could be everything to them. And I'm not saying if you're a big company, by all means lose half the data, it's fine. But they're just two different situations that, you know, all of it starts with someone. The machines didn't do it, it's a person somewhere. Where, where would do you recommend the first place that someone starts to go, hey, we're going to take this seriously. What's the first step?

So I think you kind of alluded to it, right, which is employee training. So I think that they're. Actually there are usually a couple of things that I would recommend. One is employee training and two is just to understand the law and regulations that apply to you. And I'll just sort of talk a little bit about Those two things. So in terms of training, I think everyone at this point has heard, let's make sure that you don't click on phishing links and let's make sure that you go to websites and only download from trusted things and your phone and all these other things. Let me tell you, in my years of experience, everyone believes they're doing it, but very few people are. People will cancel that update. They're going to click on those links. I'll tell you a little story for this one organization. They asked me to just help them because I actually opened with almost exactly what you said, which is, we think our people may be the greatest risk here and we just want you to look at their email. That's all we want you to do. Okay, that's fine. So, sent out the emails to thousands of employees and tried to get them to click and give me their password. And basically at the briefing, or rather at the debriefing, I said, you guys think that you're pretty good. About 20 to 25% of you, I forget exactly a number actually clicked on it. And actually a large number, you know, more than half of those who clicked on it also gave me their username and password. So, you know, you need some training, right? And so they're like, yeah, yeah, let's get some training, right? So everybody was required to watch this 30 minute video on what not to click. And then we did the exercise again. And so we did the exercise again and I said, hey, you know, how many of you in the room right now think that you are much better prepared for phishing? And basically everybody raised their hand, right? Because nobody wanted to say the training was useless. And I said, well, let me tell you, 50% of you gave me, you know, clicked on it. And even more people, you know, you know, percentage wise of that than the last time gave me their username and password. So, you know, I think the problem is, is that I, that you took some training and you thought you were better, you were more confident and you didn't actually learn. I looked at what you did. I learned because, you know, I was spending the time to understand and then I crafted something that everybody would want to click on. So, you know, this is just the stuff that when we say training, I don't mean a 30 minute video, I mean something a little bit better than that. And then just the second thing, very briefly from a legal and regulatory perspective. And first off, I'm not a lawyer, so I'm not giving legal advice. But a lot of companies really don't look at what are the things that they have to do. And it actually surprises me when I talk with some of them, they say, hey, you know, we had some people knocking our doors and their auditors asking about security stuff, and we don't have any. And I'm like, well, how can you possibly be doing that? You know.

You didn't have a lawyer. That kind of walked you through some of the stuff that you need to do. And so that's just one of the things that I learned is those two things are really, really important. One is training your employees on some very basic security measures. And then secondly, just understanding, you know, if the environment that you're in and what types of laws and regulations may apply to you.

Yeah, it's interesting because I've seen emails even recently. Usually it's from banking places or things where you're checking out stuff or processing things because it's so easy. Hey, we're doing an update the terms and service, yada, yada, yada, click here to consent to the thing. And some of them, you know, when they're coming from XYZ.com.

Maybe you shouldn't click it if it's supposed to be a certified, whatever. But they're like you were saying, you can be so good at it and masking them over. I remember of an instance on ebay, I was trying to buy it, go figure, a video camera years ago. And I lost thousands of dollars because it looked like a legit link and everything. And.

Come to find out, send the money, Western Union, this, that, the other thing. And I felt. Felt horrible. I mean, I took everything I had to invest in this for my company. You know, it seems like decades ago, but it was just like they had faked the site so good. And, you know, again, to your point, I'd like to think I know what I'm doing and I'm familiar with this stuff, but I just remember sending the final email that's like, I'm in college. I hope you feel good about yourself. You're stealing from a college kid that's trying to do something this, that, that. If you have a heart, please send it back. Or the camera. I didn't really care which one it was. I just, I really actually would have preferred the camera because it was awesome.

But it was just like, wow, you know what I mean? The people that are out there, it's like, I'm not advocating be Robin Hood and steal from the rich to give to the poor because there's a lot of rich people doing good stuff. And it's not like all big companies are bad, but you got to be a special kind of stupid to be, like, stealing from college kids and people just. You know what I mean?

Yeah, no, that. That. That's a very sad story. Oh, my gosh. This stuff, I really don't. I don't really don't know what motivates. And I think everyone has a different motivation, but just the things that people do, it's just not right. Yeah.

And it's why now I like helping people going, hey, here's things to consider. Whether it's business or not. Hey, I get, you know, family, friends, relatives going, hey, what do you think about this? And I'm like, it's not always phishing stuff. It's just anything dealing with business or marketing or advanced tech or whatever. And I'm like, yeah, I wouldn't do that. Or, you know, call the company, ask for this. He ask these specific questions. Because sometimes why I love marketing is because some companies are really legit, and they're good. They just don't know how to communicate this message. Like, you're doing very eloquently right now, I must add. And some people just can't communicate it. That's not. Doesn't mean they're a bad person or a bad business. They just literally can't communicate it. And there's other people that are so effective at the communication. They use it manipulatively. And it hurts me because I know that's the breaking point for most of them. I think there's more good people out there than bad. But that's why I think it's so important to be getting this out there to be go, hey, here's things to consider before you do it. It's not just if it sounds too good to be true. It's probably not.

Matter of fact, I got something last week. It wasn't the Nigerian scam or whatever, but it was like, Mary, you know, merry Christmas. May God save your soul. I'm an old lady on my deathbed. I want to help more people. I only had, you know, I Unfortunately only have $5.5 million, but I'd like to donate it to you and your cause. And I'm like, is this a viewer of the show listener? Where's this coming from? Like, but at the end of the day, you know, what is it? Filter it through a brain cell and that.

And that's almost certainly a scam. I. What I really don't like is during this Covid, the amount of scams that have gone up with, you know, job related scams or it's a lot. So like the people will post fake jobs on there hoping people will apply. And one of two things happens. One is they apply and then they never hear from them because they took all of their personal information. They asked for Social Security number, they asked for all this. That and the other, during the application process and the applicant gave it. The other is that they offered them the job and they say, look, in order for you to start the job, we need you to put down a deposit of $4,000. That's typically the rate, $4,000 to pay for the training and the computer, but you'll get the money back within the first month.

And then they, you know, then they just take their money. Right. You know, and they're taking it from people who just lost their jobs because of COVID And that's just horrible. Yeah.

And it reminds me of like, oh, for your uniform and shoes. It's like, what are these Dolce Gabbana shoes that you're buying? What do you need? You know, and what company makes the employees pay? I remember having to deal with that and I'm like, you're making me pay to like, this isn't even a cool outfit. I don't want to wear it. Like.

Yeah, there's like zero incentive. Like I don't even really want to work here. I haven't even got a paycheck. And you know, so I'm glad we're talking about this. So you're talking about the training.

Do you do any follow up with training or advise it to your point of don't watch, don't just watch a 30 minute video. But do you go, hey, we're going to do a 30 day or anything where it's like this comprehensive. Okay. We're going to do stage one and then you engineer stuff on weeks two and three to see if anything's changed. Because what I'm hearing is you need to create the habit, a good habit of protection. Because most of this is just people don't think twice about it.

Yeah. So quick quiz for you and then I'll answer your question.

Which department in a company do you think is most targeted by hackers, you know, via email? Right. Sending them, sending them fake emails, emails with, you know, malware, whatever it is. Which department?

I'm not going to search Google over here or ask my friend with starts with A over there. But I am going to see if I can get some qualifying info. What niche? What industry?

There's a lot of on average. So a big company, you know, with say thousands of employees, they're all going to have.

So there would be an accounting. Hr, sales, marketing.

Yes.

It's not marketing, I would naturally think, and it's probably not accounting because I would think they're a little bit hip, more to the money side. But let me ask you, are they trying to steal the money or are they just trying to get info?

I say hr, they're just trying to get in, which doesn't. Which could be anything. Hr, that is. Ding, ding, ding. That's actually correct. Very good.

Oh, thank God. We're gonna do a quiz. I'm like, wait a second, I need, I need some stuff here. But you know, because marketing and sales, they might not have the info, they'd have the sales numbers, but they don't. They're probably not gonna have the mission critical accounts. Accounting, literally. I think they'd be a more aware just because they're dealing with that stuff and could sniff it out. Hr, I think would be a happy balance of they know enough, but not so much that it would protect them, but they still have enough access to the records that it could do damage.

So I think all of that thinking makes a ton of sense. I would add that HR is used to getting external emails from applicants. And so they're saying, open this email, it's my resume. And that's their entry point for malware to steal or whatever. So you're right on all accounts. And I would just add that one minor thing. Yeah.

Because I've seen those other ones where it's like, this is not an internal email and I forgot about that. Where they don't even allow external emails. But HR would be vulnerable to that.

Yep, yep. But in terms of your answering question of training, so I'll first caveat with.

There'S a very limited amount of training that executives are generally amenable to. One they don't really want to spend the time or money on it. And so what I'll tell you is pretty much the maximum that I guess that companies will ever do, but it's certainly not.

Even 10% of what I would suggest. So what they'll typically do is do phishing emails, you know, something like that. So sending out every month, just a fake email. See if you click, maybe ask you for your username and password, you know, something like that. So I think at the next level that some organizations will do is they'll actually have it the same thing, but a little bit more specific. So if you're in the finance department. So, like what you're saying, right? You got to pay bills and things. So send over a fraudulent invoice and just see if they pay it. So there's stuff that you can do, very specific to departments, but of course, there's a ton more that you can do beyond that. From a training perspective, just looking at the sites they go to, I mean, one of the reasons companies don't like you looking at porn is not necessarily because of the porn, although that is an issue. The second it's really the malware. If you try to go to a porn site, a lot of times they make money because they're installing malware in your computer at the same time. So, yeah, there's a lot of training that you can do, like, you know, blocking that stuff and then throwing up a page to say, hey, you know, here's why you shouldn't be doing these things. Although a very funny story, I'll just tell you. There was. There was a guy, so. And he was looking at porn, like, on his computer, on his work computer. And so, you know, you know, I called him up, I said, look, hey, you know, you know, it's against policy. You shouldn't be looking at porn on the computer.

You know, but, you know, just. Just don't do it anymore. Yeah, I don't really don't. I really don't. Not going to worry about it. I'm not going to report you. Just don't do it. He's like, hey, this is awesome. And I was like, wait, what? And he's like, you gave me a call? And I'm like, okay. And he's like, well, now I know that you're actually monitoring my computer for malware. You see, I know that porn sites usually have a lot of malware on it, and that's why I didn't want to use my personal computer. And now that I know that you're monitoring it, I'm just going to use my work computer.

People think in very different ways.

Wow.

That logic is.

Interesting.

Yes, it is. I've had a lot of very interesting conversations with people. If you go up to people and you say, hey, I caught you doing this. Don't do this. Or if you just say, hey, you know, I saw that you kind of did this. What were you thinking? If you take that second approach, sometimes you'd be really surprised at what you hear.

I think I just figured out what I'm going to ask you in the next segment.

Okay.

You seem like you have all kinds of funny stories you could Share?

Oh, yeah, that's what I do kind of every day. So there's. There's serious stuff, which. And then there's the. I don't understand why you were thinking this.

Let me ask you this, because I remember, wow, it's been a few years, but I remember dial up. And you know, people were always, don't give your credit card online. People can steal it this and that. And my argument was always, you think it's any safer giving it to some random Joe Bob at a restaurant when it's not encrypted and they have all the time in the world in the back room to copy it, take a picture of it and do whatever? I mean, I literally writing down the numbers. This is before camera phones, but I see it two ways. You could say the Internet was smaller and less protected then and there was less traffic on it and people were less educated. And I believe that's true. And you could say now it's harder to do some of that stuff. But what do you think? Do you think that the attacks and the scams and all this stuff has increased or do you think it's more protected now because just it's been around long enough? I mean, when you got a Windows 95 PC, no one was like, oh, gee, does this, you know, you know, you might say, oh, it comes with McAfee virus scan and it's included in the bundle and it's no extra cost. But people weren't really thinking and there was no big stories of, you know what I mean? There's just less out there.

This is an easy, easy answer. The attack surface has increased over time, which means that you have just so many more different ways of doing things. And people, they're creative. So today is way harder than it was 10 years ago. And 10 years from now is going to be way harder than it is today. So it's only going to become more.

It's harder to hack now?

No, no. Easier to, easier to steal, Easier to do all these things. It's much harder to protect.

Oh, I see.

Yeah, really Much, much easier because there are just so many different ways to steal nowadays. Think of all the, all the different software that you have on your computer. You probably have more software and applications now than you did like 10 years ago and more than 10 years before that. And so just even those.

It'S just immeasurable.

Today. Or rather I think it was like December 13th or something, there was a hack out, the Solarwinds, what they're calling the Solarwinds Sunburst hack and you. That was when they basically hacked one IT company, create some IT software and that gets used by a large number of organizations, including government entities. And because they hacked that, basically they now have an entry point to all of the other organizations too. So if you're an organization, you have to protect yourself and every other company who sells you products. I mean, that's crazy.

Do you think that there's any system short of being air gapped.

That is truly safe?

No, I don't. I don't think so. At least not inherently. Now that doesn't mean you can't be relatively safe, right? It's just a risk calculation. So what you need to do in any organization is to figure out what are your most important things and then protect those at the highest level. You're not going to protect everything at the highest level because it's just too expensive, right? You're not going to have guard dogs and 24 by 7 security with like cameras and everything. You're not going to do that for everything. So you just pick the four or five really important things. You put it there. Maybe if it's your Coca Cola formula, that's your one thing, you do that and then you've got your next tier that you have. And then you have just, you just have. Depending upon how many things you have, you just have different layers, different tiers and you protect them at different levels. So that's the most cost effective way of doing things. And typically what happens is a criminal, they're going to start at the lowest level, right? I mean, they're going to try to break into the place that has the fewest locks on the doors or the ones that have broken locks or whatever. Then maybe they'll pick the ones with a lot of windows on the first floor. So they're going to start out easy. And once you start seeing that you're starting to get stuff broken on the first, your first floor windows are always broken. Then you know that you really need to either beef that up or just accept the risk that you're going to lose that data. But then you need to strengthen it at all the other levels accordingly.

Is there anything you can share with Expert Authority World? In a short briefish answer, I'm sure it's pretty elaborate, but how can you protect it and segment it like that, but still have it in a way where you can communicate? Cause I realize I'm thinking of the original Mission impossible from the 90s when it was like they broke in and there's a sensor on the floor and the lasers and a retinal scan and only that machine that wasn't connected to anything. It's like, okay, that's probably pretty secure. Especially if it's a military base that has radar all over the plane and RPGs and all kinds of stuff might not be for the common business or it might just be such a pain to access it, you lose all productivity. How do you find that? Happy medium?

Yeah, so it's, it's, I, I think it's pretty straightforward. Network segmentation is probably the first thing that I would say. Right. So if you have, let's just say, you know, high level security, low level security, keep it simple. Right. So if you have a high level of security, then everything in there has, you know, the latest and greatest software for security. You've got your 24 by 7 monitoring, you know, whatever that is. But then everything within that segment can talk to each other. Then you have the lower level segment where maybe you don't have as much security and they can all talk to each other. But as you said, the low level still needs to talk to the high level at some point. So you need to basically identify just the one or two very specific things at each of those two levels that can talk to each other. You have a middleman or like some sort of gateway between that. Where now you say, okay, even though you're in the low level, we're actually going to give you a higher level of security just for you. And then you can be that middleman to sort of send data into the high level stuff. And at the high level you say, okay, I've got stuff coming in from the low level and I'm going to actually check everything that comes in from this guy because even though he has some security on it, I don't still don't trust it. So I need to review that. And so you do some, what's often called a V and V, I forget what that's called, something validation, you know, whenever you go between the two levels. And so that's how you would sort of address the concern that you've brought up.

Okay, well, I appreciate the insight on that because there's so, it's so voluminous. There's so much out there with, you know, how crazy you can go with it. And I know at some point, and I don't think a lot of people realize that it can get to be more than just software or more than just a specific box or a server. I mean, you could always have different boxes, different networks, different, all kinds of stuff. But there's a point where it comes into real life in the physical realm where you might have the critical mission critical stuff literally on a military site somewhere. And the other stuff, it's just in the other room next door that someone can break into the building, steal the whole server. And you don't need to hack it at that point. You just plug it in at a new location.

Yeah, and that's exactly what a lot of hackers do is, is because usually you have what's called a development test and production environment. And what that means is, you know, if you go to bankofamerica.com or, you know, whatever, google.com, those are all production environments, which means that it's, you know, people are using it for real there, it's live. And then what you have is you have these other environments, because software developers, they're not going to develop in the live environment. Right. Imagine if you were doing. Imagine if the developer all of a sudden was like testing out stuff, try different colors, and it started changing on your computer screen as you're doing things like that wouldn't work. So they have what are called development environments where they sort of do stuff, and then there are test environments where they test, like the stuff that they did. And those oftentimes will have actually the identical data from the production from the live site because they want to be testing it on real data. That's actually a really bad practice from a security perspective, but it's a very good practice if you're just trying to do customer service, because now you can totally test everything. Well, all the hackers, they know this, so they just hack those.

Because those are usually in a lower level of security. If you go back to what we earlier talked about, and so I can totally break into that and steal the same information. Why wouldn't I do that as a hacker?

It's a good point. You got me thinking about a few things with my team. And thank you for that. I mean, it's something. Yeah, it's like, let's put the highest security over here. But if you're still taking all the data, you know, you got encrypted thumb drives and hard drives and all kinds of stuff, and you got to escort at the airport and all these things, but then you get in the cab and you just throw it on the seat next to you.

Yeah. You know, the funniest thing is, is that. And this is why it kind of goes back to when we were talking earlier about training, is that I can sort of map out, you know exactly what people are going to do, because people think the same way, especially people in companies. And so, like, you know, you know, whenever you do, like, passwords, as in just as a very basic example, right. You know, whatever you have to. When you, when you add a policy that says you need to have.

A special character, what do people do? They add an exclamation point at the end of whatever the password was supposed to be.

That's just what they do. And if there's a letter and numbers are required, the numbers are at the end of that. So it's a number and followed by an exclamation point. And then you're like, okay, well, let me change this up. You have to have all of these things and you have to change it every 90 days. Well, what do we know? That's 90 days? It's the seasons. So a lot of people will do like summer 2020, exclamation point. And then when they change it, It'll be winter 2020, exclamation point.

Seriously.

So, yeah, no, this is extremely common.

You piqued my interest with the first part of what you said, but I don't think I've ever in my life use the seasons.

That's okay. Then you're not one of those people. But people will do that. Or they come up with the mnemonics or they come up with like, you know, their favorite things. So if you know that they like Batman movies and you know that for one particular thing they use Batman, well, the probability of them having a password somewhere else is like, you know, to have like Joker in there is pretty high. So you can do these sorts of things. So, you know, it's just, it's just pretty funny what people do because you can predict kind of what it is. I used to work with a lot of DMVs to look for, to look for fraud. And what some people would do and the reason why they take the photo ahead of time now versus do it, you know, because you. It used to be that they would ask you for all of your documentation and say, you know, where do you live? And all this stuff. And then they would say, let me take your photo. Well, what they found was that people would like, show them the fraudulent documents because they're trying to get a fake id, and then they'd be like, we can't accept this. Fraudulent. We can't accept this because we, you know, it doesn't pass. Whatever, right? They wouldn't actually tell them that they thought it was fraud. They would just say we can't accept this. And, and then what would would happen is the guy would just like, you know, bail on them. Right. I mean, because they're not going to take, I mean, they're not going to be like, well, we're not accepting your documents, but we would like to take your photo anyway. I mean, if you're committing fraud, you're going to leave. Right? So now what they, what they're doing is they're taking, you know, the photos first. So that way, you know, they, at least they have a picture of you even if they don't go after you. But the point is, is that, you know, those people who go in, a lot of times they would steal, you know, if they had a, if they had like a twin, you would always, you know, they would be taking their twins information, you know, or if they don't have a twin and they're in college, they're going to be taking their roommate's information. So you knew exactly based on the demo, based on the demographic or based on a little bit of that person, you know exactly what they're going to do. And if they got caught, like, I could tell you, and I won't tell you on this show because they still use these checks what they're going to do the following week. And then they're also going to go to like the next location, not that location. Right. And so you can actually, you actually know exactly what they're going to do and they're just going to show up there and you can like predict it like clockwork. It's pretty interesting.

Wow. And you're just, you're just talking about stuff that people will do just from thinking and stuff. You're not even talking about password or port sniffers or anything where you can be going through tons and tons of data automatically. I mean, this is just. What's the term for it? It's just like, I've seen it, like where someone just calls on the phone and then they pull up YouTube videos of a baby crying. Like psychological hacking or behavioral.

I don't really know what it's called, but I guess it's behavioral understanding.

It's a type of phishing. But there's people who will call, like customer service that if they don't have your info, they have like a baby crying over on this screen. They have the husband yelling over here.

Engineering.

That's it.

Yes. Yeah. No, they do all sorts of thing. And all the other stuff that you mentioned, looking through logs and all. Yeah, totally do that as well. Right. But it's just like, the point is, is like there are just so many things that hackers know. They know how you're going to act. They know what you're going to do because that is what they're doing. They're thinking about what you're going to do, whereas you're doing other things and you're not thinking about it. And then they come up with all these other things. So then you now need somebody else to go and look through it and make sure that you weren't hacked, whether it was social engineering or whether it was some sort of technical thing that they did see.

And the crazy thing about this, just like with most criminals, they're not stupid people. They're some of the smartest people on the planet and they could be using all their power powers for good. They're not. But you're no slouch if you're doing this.

I agree that that's, it's. And, and on the. If you're the bad guy, you know, granted, a lot of them, they're not in the U.S. so, you know, it's the, the laws and the rules, they, they're different in whatever country that they're in. But like, you know, they have different.

How do you say.

I lost my train of thought?

Cultures, beliefs.

Yeah, cultures, beliefs. But the thing is, like, they're going to be. This is like their livelihood. You know, maybe they didn't have the opportunity to be doing defense for whatever, you know, because that's just not what. They don't have any companies that they're there that are doing that. Right. So this is. And they don't want to get caught. They've got completely different incentives. So imagine if I told you that you had no choice, that there was no real quote unquote job that would pay you to go do the marketing things or being on the air, you have to basically go steal. And by the way, if you don't do this properly, you might get caught and go to jail or get your.

Hand chopped off or something.

Yeah, right. So, like, wouldn't you do a really, really good job?

I, I don't, I don't like those options. Can I phone a friend?

Right.

Or better yet, ask the audience.

Right.

No, I get what you're saying. It's, it's just, that's the thing. The human potential is so unlimited. It's just really. It always comes down to what people are using it for. It's not that it's not possible. That's why I was asking you, is it ever 100% secure. And it's like if someone's determined enough, they'll take a bulldozer or steal a tank, drive into the building and find the room that they need to, to get access to the key card or whatever.

Yep.

It's crazy. How did you get into this?

So I basically one of my, I guess my earlier jobs was in security and it was basically just because I saw a pretty cool job description that, that somebody wrote and I applied for it, you know, that was it. It was just a good job description. You know, I like technology. I like just sort of thinking through things. And the way it was written, I don't remember what it was, I just remember I liked the job description.

And what have you found? Been from being in the industry so far, you're still liking it?

Oh, I love it. I think that this is the only industry where you have actually people who are trying actively to stop you from doing your job. So like in any other job, like you can get really, really good at say physics, right? But you don't have somebody who's like trying to stop you from figuring out that theorem in security. Like you are trying to do something that's pretty hard already. And then people are actively trying to subvert you, get work around you and sometimes lie to you. Right? So like if I'm working a case and I find that, you know, so and so, you know, did something, you know, then you know, that person is not going to just be like, yep, you got me. Just not. They're not going to do that. Right. Because from their perspective, if you catch them and you were hired to investigate and that person was the culprit, if they admit to it, they lose their job. So like, no, they're not going to admit to it. It's just not going. They're just not going to do that. So, yeah, no other job do you have actually people who are actually trying to not work with you.

So I never really thought about it like that because I mean, most industries there's a challenge and people like that. But to the degree of, you know, you do all this cool stuff today, got a great episode and tomorrow they're like, hey, we took everything, screw you. Like what?

Right again, don't like that too much.

So it's an ever changing Rubik's cube of a challenge. It's not linear.

It is. And you know, I would say that, you know, we talk a lot about, you know, investigations where people get caught and you know, so, so. But I also always want to point out that security does way more than just finding the bad guy. Like, it helps in many, many other ways. So I'll just give this other example. There was a guy who was going to be let go. You know, normally I think that the security guy is the guy who's doing the firing. But I actually tried really hard to not ever make a recommendation to fire somebody. It's, you know, this guy basically, you know, he had two people complain that he was looking at porn while on their computer. Some while on the computer, while on the work premise. And basically they sent it over to it, it pulled up the pictures.

And they said, yeah, he was looking at these nude photos. And so they were. HR was going to go fire them. And then for whatever reason, I don't remember why, I heard about it and then I talked to the guy and I was like, I talked to this guy. He seem like somebody who would do something like that. It just doesn't seem right. So let me, you know, I'll just do it for free my own time. Just, you know, I just want to take a look. Just let me take a look. Right? You know, so I looked at it and it turned out that this guy basically was not looking at porn. What had happened was he went to a news website that had a pop up that was, that happened to have nude, you know, image in it. And the people that walked by who complained about him happened to be walking by, right? When that pop up came up, he clicked it away. He wasn't even thinking about it, right? He just clicked it away. And I could prove that it was an ad that was pushed to him that he didn't even know about. And that's why he was really confused. Like I never looked at anything. Right. And so your security guy can actually help you actually get out of jail, so to speak. So there's a, you know, that's one example. Another example that a lot of people call me about is like, you know, they, they send emails out and their newsletters or whatever, they go to spam and you know, you know, you can, you know, marketing guys can do all they want to try to optimize the time that they send it, you know, what words they use. But the bottom line is it goes to spam. It's kind of useless. And who actually filters stuff? Security guys filter out the emails. So, you know, knowing that you can actually improve and optimize how you send out the emails to like get through like three times as many into people's inboxes, right. Just by simply configuring your email better so you can use security to do pretty much anything. And then of course, if I sort of, you know, help a company do that, I can turn around, go to another company and say, hey, hey, I'll help you filter out those guys newsletters.

You know, how do you do that? I'm interested. From a marketing perspective, how do you get higher opt in and conversion rates?

Oh, well, there's a large number of different. So when the way these spam filters work is they actually will look at a lot of different attributes in the emails, there isn't enough time to talk about all of them. But just at a highest level, imagine that your email comes with a lot of attributes. Like, you know, did you send it from an email address that you own? You know, was it from a particular domain? Are you also mixing it with other emails that you know that previously were flagged as spam? You know, like when people click on the, you know, this is spam button, are you sending out 500 emails an hour or are you sending out more like two or three emails an hour versus, you know, whatever. Right. You know, so there's your IP address, the country that you're sending it from. They're like, they're like a hundred different things that these spam filters look at. And then when you reach a certain number of points, so you get so many points for everything that you do. When you reach a certain number of points, then you're probably spam. And so then you end up basically in the spam box or if the.

Message has 15 click here to buy buttons on it with not much content.

Yeah, that would probably trigger it as well. So anyway, there's stuff that you can do that's not just on that, that's not just content related, but that's also with your email and stuff like that. So that you can then increase the probability that actually lands in particular inboxes. And if you get really detailed, you can say, well, Gmail does these specific types of filters. Microsoft Office has these particular types of filters. And you actually want to send different newsletters to each of them because the spam filters handle the different differently. I don't know that anybody cares that much. But you know, you, you could actually get to that level of detail and then actually, you know, and then, and then actually you'll get a much higher level of delivery from that.

Wow, that's kind of. I knew some of when you started talking about the score and the points. I know, I've seen spam index and it's like you don't want it above, like you said so many points, but I didn't know there was that many. I, I know if you literally, if you put like a dozen. Click here to buy links, that's not a good thing. Like, you can get away with, you know, 1, 2, 3, maybe even up to 5. But I've seen, I've received somewhere. It's just like you've got a dozen links in three sentences in between them. Got, you know, it's, it's got to have that balance and the weight and everything, so. But I appreciate you bringing that up. We're going to do the fun wheel of whatever now and thank our sponsor and come back for the imperfect action round. So now I get to ask you a question. Not like I haven't been doing it this whole time. Come on. There we go.

I've got two questions I want to ask you. One of them's kind of softball. Let's see where it lands. Is it going to land on black or yellow?

What is it on? Oh, right on the border of both.

One of them was going to be softball with Mac or PC. But the real one I want to ask you is.

Are you willing to go there?

You know, we can talk about it, whatever you want. I do have my, I do have my biases, though.

One of, one of them is the argument of Mac or PC. I've been hearing that for decades. The other one is dealing with, like, government facilities and anything electronic and all the, you've touched on the government stuff a lot. I'd actually rather go there because, you know.

Can you go there? Are you willing?

Yeah, I mean, you know, I, I, I don't know what the question is, so it sounds good.

So with all the stuff, the government and all the bank servers and all of that stuff, how protected do you really think it is? Do you think that has the highest level of security, or do you think it's more of anything that's ever been breached has been willfully just given away? It's not so much it's a breach, it's just, you know, is it more hackers or is it more just bad people doing stupid stuff they shouldn't be?

So that's a really tough question. What I can say is, in general, I think most people are more concerned about compliance than they are about security. So what are the laws? What are the regulations? What's the bare minimum that I have to do in order to not get fined? And if I were to get breached, what is the bare minimum that I can do so that I can go to the judge and say that I did my due diligence. Which again, just goes back to compliance, which is, you know, did I meet the minimum requirements that are required by law and by regulations? So that is generally what I see. You know, I would say that there are some, you know, that, you know, whenever companies are breached, there are sometimes it's because the hackers got in, other times it's because some an employee just didn't take security seriously or maybe he just had a bad day. Right. So I don't want to put mal intent in there, but it could be anything. Or maybe someone who's just, you know, someone got lucky. Right. You know, they, you know, the door happened to be open for 20 seconds because they opened the door because you know something, they were connecting up a new vendor and then the hacker just happened to find it at that moment. Right. So there's just so many different possibilities. I think it's really hard to ascribe it to one or two. What I would say is that most organizations don't spend enough on security to be totally secure, but they may be spending enough on security if they're accepting the risk. Most organizations don't accept the risk.

They will blame somebody and then fire somebody if something bad happens. But that was actually a conscious decision initially to just say, hey, I'm not even going to bottle putting in security here. So it's kind of one of those things when you're in charge over there and you do get breached, you want to point the finger at somebody. But whenever things are going well, you're not going to want to spend the money and it comes down to meeting compliance.

I gotcha. So it might cost you a million dollars to fix it. And Bob's only making a quarter of a mil. It's cheaper to fire him and fix the problem and just hope it doesn't happen for another five or eight years potentially.

But yeah, I mean, I think most people just discount it as this is not going to happen to us. And so it goes to zero. Because when you get to the bigger companies, especially because you talked about government, like small businesses work completely differently. But when you are talking about big businesses or government, usually what happens is in order to get funded for the project, you have to prove and by that it's worthwhile by writing a business case for it. So I actually help a lot of people who actually write business cases to say, look, this is why it's actually worth something. But the one line item that I really have difficulty Changing on my own because it really is up to the client to determine is the probability of it happening. I can bring all the statistics in the world and say, you know what? 70% of organizations, you know, have this problem. But that guy's going to say, you know what? I really think it's only 10%.

So that they put 10%, you multiply there, your value has just gone down to 1/7. And so then of course you're going to have to charge less. So it makes it less lucrative for you. But it also decreased the entire value of the entire project. And so they're not going to want to fund it. So there are two problems with that. One from the buyer perspective and one from the seller perspective. Because risk is really just one of those is very, very subjective. And that is a what happens at the bigger companies.

One quick follow up before we go to the sponsor. Have you ever given someone a proposal with two price points that says if you do this now, before anything happens, it's xyz and after the fact, it's this.

You must be stealing my notes. Because that is exactly what I do now is I didn't see them.

I was just legit asking because it's like when you made the comment about, well, I think it's 10%. It's like, okay, Bob, what's your background and credentials for security? Okay, cool. Well, it's going to cost you seven times more when you do have a problem. Is it next week or next month? I don't know this, but when you call me, here's the super Batman number, here's what it's going to cost you.

Yeah, I was kidding. I don't actually have any notes on that, but that is what I do. So either way, you're correct. I do, I do actually do a couple of different things. One is, look, this is the light version. If you just want some basic security so you don't look stupid. This is the I don't want to look stupid number. Then this is the I want to do kind of, you know, what's okay, you know, you know, I want to do, I want to do better than that. I want to, I want to at least meet, you know, some compliance. I want to do, I want to do some good balance between, you know, not spending the farm to protect this and then the sort of the higher end, which is I want the kitchen sink. I want everything because this is my business, this is super important. And I think basically I've always found that people either fall in the first or the Third bucket. I have the middle bucket there. I actually don't know why. I just sort of have it there. No one ever picked.

If you didn't, they would ask for.

It probably, but it's always one or the other. And then what sort of pushes them over the line is that is the. What happens if I do nothing? Then I'll say, well, on average, that.

Was the best deal.

This, you know, if you do nothing, you'll call me later and then I'm going to charge you 10 times as much money, you know, to be able to do it. And you would have lost it because by the time you call me, you would have already lost it. So the only thing I'm doing is sort of giving you peace of mind that whatever the issue was is now fixed. You still lost it. And then kind of really, I'm just going to then do the same thing again after that. So, you know, it's just going to cost more. So you just, you should just do it now. So that's sort of the thing that, you know, I don't want to look stupid. I want to have something in between and I want the whole thing because this is super important. And what pushes them over the line is, you know, hey, it's actually going to cost way more. And there actually are reasons why it costs more. It's not just because, you know, I want to charge. It actually is a lot harder once somebody's in.

Oh yeah, it's more work and everything. I was completely talking about a premium pricing though, because I know it would be more work and everything just off the bat. But there I would have zero qualms about saying, here's our basically rush delivery thing. It's like you willingly chose not to listen to me after you consulted me. Have you ever considered using the higher point package? Because you were saying some people don't value it and they don't want to invest the money. Have you ever considered using it as a selling point to say you can actually use this in your marketing and sales material? Material to. Because that's a differentiating factor where if you go company A, B and C, well, what's the difference between them? They're all the same price. They're all okay, they're all going to get the job done. They're all relatively. But if company C has the, you know, this governmental cloud package on it for security, well, I would go with them because I know it's more secure. And not everyone can say that.

Yeah, no, that's, that's perfect. That's actually the number that's actually. So if you look on my website.

So alfizo.com, there are actually three things that I always bring to people's attention on why they should be in general, right. Buying security. The first is to enable their sales. So that's exactly what you were talking about. It's a business differentiator. But I'll go a little further than that. If you're a small business and you're trying to sell to a big business, especially if it's like a Fortune 100 or whatever, and you really want to get that sale, and this is actually where I get most of the people who ask for the kitchen sink is they actually will hand you a security questionnaire and say, fill this out. And so if you can't fill it out, and I've seen so many of these, I've seen like hundreds of these things. Like, you probably don't, even if you're a small business and haven't done it, first off, you're not going to win that contract. But secondly, like, you probably don't even understand half the words that are on there. And even if you do, you probably don't understand how they're evaluating it. Because if you just answer it straight up, even if you think that you can answer yes to everything, you're not going to pass it because you don't understand what they're actually looking for and how they're evaluating you. It is a business differentiator if you can do that. Whenever I talk to customers who call me up to say, look, Acme Inc. Just asked me to fill out the security questionnaire. What do I do? My response is, look, you can keep calling around and you will probably find a sales guy who will tell you that he will make sure that you can win this bid. But I'm going to tell you right now that if you didn't understand even what it was asking for, it's too late. You've already lost the contract. What you can do now is if you want to ever sell to that company or a different one downstream, like a year from now, then let's go into business and let's help you do that. Because it does take time to do. And so enable, your returns are so much bigger, right? Like, once you start talking about those are millions of dollars of contracts, right? So it's not like 100,000 or, you know, or less or whatever, it's going to be millions. And so it's worth the investment. It's worth doing so enabling a Sales business differentiator. That is definitely one of the top three reasons that they should be doing it.

Excellent. Well, I'm glad we touched upon that because that crossed my mind because you can really assign money to anything, especially time. I just feel like a lot of people don't, especially with sales and marketing. And regardless of the product, it's like you said it early on, you know, they see it as a cost. Well, you're already running uphill at that point and it could be Everest. But when you start going, hey, it's costing you $1,000 a day, the investment is 10 or 20 grand. You'll have this paid off in a month to break even and you'll be cash flow positive on day 21 from out. It's going to enable you to get $6.8 million over the next five years annualized. It's like, huh, this isn't a bad deal. We should have done this five years ago.

Yeah, no, it makes total sense. And not to extend it too far, but there was this one company that asked me how they could actually use security as a new business line for them. And so I went through, did market analysis for them and showed how basically they could augment what they were doing to then just charge a extra line item for whatever it is that they were selling. Well. And it was basically a security line item that they had customers that were willing to pay for it. So, you know, you can use it for revenue. It's just not usually the first thing that people think of.

It's usually a, we have a problem, we need to fix it.

That's right. It's usually, it's usually a detected problem which is usually at that point very bad.

All right, expert authority world, we're going to thank our sponsor, but let's give a thanks to Gary here. And if you're taking notes, get it fixed first and make money with it before you have a problem. Don't wait until you do and you can't even think straight. We'll be right back after we thank our sponsor. You've heard me say every business needs a book, including yours. And it's true. And that's why you should visit freebusinessbook publishingcourse.com today to learn the seven steps to publish and promote your your nonfiction lead and profit generating business book in eight weeks. But you know what? Don't take my word for it. Take it from a few of my authors like Lori, I went from having.

An idea and a possibility to actually getting my book published.

Or Catherine, thank you for making my.

Mom number one best selling author or.

Mary Alice what he got done for me in three days regarding my book launch.

Unmanageable. John Cody I've worked with Mario over the phone and online and he's been very helpful in getting me where I needed to go with promoting my books.

Rocio there's no way in the world I would have been able to do this with somebody else again. I've attempted it in the past. It didn't serve me. As a matter of fact, I ended up more frustrated than anything. So this has been a very seamless process. Adele if you're looking for an amazing business coach, I highly recommend Mario Ficcini or Bill Benner. I can't make a higher recommendation than to work with Mario Ficini. He has been great for me and right now I won't work with anybody else except for Mario.

Hey, their words, not mine. Visit freebusinessbookpublishingcourse.com to get started now and I look forward to hearing your transformation as the next video success story. Once again, that's freebusinessbookpublishingcourse.com and we are back with the imperfect action round. Gary, are you ready to take imperfect action?

I'm ready for it.

All right, three rapid fire questions, 60 second or less answers. The first one is what is the fastest path to the profits?

The fastest path to the to the profits?

I would say read the news. So come up with. So read it, read the news and understand how that could apply to your business and sell that. So for example, right now everybody's probably heard of this virus called COVID 19. So one of the things that's most common nowadays is to do working from home. And security has changed significantly as a result of working from home, for example. So that's something that I can sell and I think that that general concept of read the news, understand how it applies to your business can be applied pretty much anywhere.

Very good. Number two, what is the biggest problem you see your prospects making and the fastest way for them to fix it?

So I think that was the whole conversation we had today, which is they're reactive rather than proactive. So.

Thinking about what they can do for the future of their business from from a security perspective or from any other perspective and doing a lot of planning rather than just reacting to whatever happens, the one who's best planned is going to win.

Excellent. Number three, what is the best way to maximize customer lifetime value?

So that one I think would be understanding your customer, understanding what it is that they're looking for. So in my case, for example, are they looking to increase their revenue or are they looking to protect what they have? And by understanding what the customer is really trying to do, then you can really tailor whatever it is that you're trying to do to, you know, to what they're looking for.

Very good. Well, appreciate all your thoughts on all the stuff you've covered in some ones I even threw in there. I have just a few more and it's what books would you recommend to Expert Authority World?

So if it's just for fun, I really love the book Sandworm. So I believe that there is an author from Wired that wrote just a really incredible hacking story about what Russia did with Ukraine. It's just a very, very interesting read.

Thank you for that. And where would you like people to learn more?

So if they would like to learn more about Alfaizo, they could go to the website a l fizo.com just take a look there. And if you'd like to contact me, just use the form at the bottom.

Excellent. Well, thank you so much Gary. It's been a pleasure and I thank you for your time.

Thank you very much. It was a real pleasure to be on the show.

All right, Expert Authority World, we have another great one here today. I'll see you tomorrow. Have a great day. God bless.

You're already the expert, but have you transformed your expertise into a tangible asset that will generate and qualify leads while increasing profit for you 24 7? And if so, how well are you promoting it? With the Expert Authority Effect publishing method, it's easier and faster than ever. Visit freebusinessbookpublishingcourse.com today to learn the seven steps to publish and promote your nonfiction, lead and profit generating business book in eight weeks. Visit freebusinessbookpublishingcourse.com to get started. Now once again, that's free businessbook publishingcourse.com hey, thanks for listening to today's episode. I hope you got a lot out of it. I know I sure did. If you haven't done so already, I invite you to subscribe to the show. If you and also be sure to check out eainterviews.com for complete show notes, the full interview, video experience, links to the resources we mentioned, and more. Have a blessed day and I'll see you tomorrow.