0359 | Jon Schram

Hi, this is John Schramm with The Purple Guys www.purpleguys.com and you're listening to.

EA Interviews, EA Interviews, episode 359, inspiration, transformation, success stories and the Imperfect Action Round. Seven days a week. Join Mario Ficcini for today's Expert Authority effect interview. Expert Authority World. I'm excited to have John Schramm on today's show. He's the author of how to Hire an IT Services Company and the founder of the Purple Guys. And if you didn't guess, but we're going to be talking about it, why it's important to you, why you should have it for your company, and why, whether you're starting off mid size or a large company, you should have IT support and not just think it's for those big guys out there. Because the reality is this is being done with a computer. You need it. If you have lights, if you have cameras, if you have microphones, if you've ever typed anything. It all goes to the technical side of stuff. And it's very important for businesses nowadays. And I'm sure you've never ran into any issues ever in the face of life with your phone or chargers or IT or software or hardware ever.

But if you have, you're going to want to pay attention. So I'm excited to bring John up right after we thank our sponsor. Every business needs a book, including yours. And that's why I'm launching my new book to help you, regardless of where you think your current writing abilities are. Visit eapublishingmethodbook.com today to learn the seven steps to publish and promote your nonfiction, lead and profit generating business book in eight weeks. Once again, that's EA publishingmethodbook.com Here he is, ladies and gentlemen, John Schramm. John, how are you feeling today?

I'm great. Excited to be here.

I want to ask you about IT services. Why are they so important to companies nowadays and what do you find are the biggest problems most people have with them?

Well, the reason for IT support, you kind of hit on it earlier. You can't get away from it. It's everywhere. It became even more hypercritical when we all went remote with the pandemic and now that's kind of the norm. So making sure you're both connected, you're productive and you're safe and secure wherever you are. Working across the Internet is critical to whether you're a solopreneur or a big business. And it's critical who you partner with. So just making sure you've got access to good quality support to keep all that tech stuff up and running. Is is very important to every business now.

Now how do you work it with your company? Can you help someone fix their computer? Whether it's a software issue with Windows or Apple or is it only computers? Do you ever go into cell phones? Because a lot of people don't realize your phone is a computer now. And I and I know a lot of the same rules apply. You can have a defective OS on it or an update, all that give us a scope of what your focus is and who you can help.

The scope for us and so our typical customer we're shooting for is the small, small business owner. Typically between 20 and 200 employees. We've got a few that are the five or 10 employees and a few that are more than 200 employees but generally that 20 employee to 200 employees and we take care of everything. When an on off switch, most of them have screens. But like in the technology stack, there's the device that the end user uses. So that's typically a PC, a laptop or phone or tablet. So all of those end user devices we support, we make sure they have antivirus on them, they are maintained and updated and they run well. And then all the rest of the infrastructure. So the Internet connectivity, the security that is their firewall, wherever their data happens to live, if it's on premise inside of four walls or if it's out there in the cloud, making sure that it is backed up and secure. So we are that technical layer, all of the support around the end users, making sure the infrastructure stays up and it stays safe and secure from the bad guys. And there's a crazy number of bad guys out there now.

Have you noticed an increase in cyber threats and just security issues in the last couple years?

It has grown exponentially.

Why do you think that is?

I will tell you why. Five, six years ago, in order to be a bad guy in the technology space, you had to be a technology expert. You had to know what you were doing. You had to be able to actually hack things. It is now malware as a service. You can buy a phishing campaign, you can buy a crypto campaign. It's off the shelf, almost shrink wrapped software.

Do you know what sites you can get that at?

That is if you've heard of the Dark Web. That's the stuff you buy on the Dark Web. Oh okay. It's where you buy hacked credit cards and credentials and all that kind of stuff. And you can buy that kind of software and it's as a service.

I'll give you a very quick story. Small manufacturing company, family owned, second generation business, 40 person company based in Kansas, the Kansas City area. Didn't think they were a target. They got hacked. Bad actors got in, sat dormant on their network for about six months. Waited for, you know, the right time. So they sat there just kind of lurking in the background. And then they used administrative credentials to do something on the computer that happened to be infected. That's when they knew they had the keys to the entire system. That was a Thursday. On Thursday night they started actually encrypting things. Nobody noticed it. They took Friday and the whole weekend. When everybody came in on Monday, a hundred percent of their computers were all encrypted. They could do nothing. Luckily they had cyber liability insurance. They got the insurance company on the phone. The insurance company contacted the bad actors. They happen to be Chinese sponsored state bad actors. So this was a real deal. The original ransom was $850,000. And for a small business that's catastrophic. But luckily they had insurance. Took them about a week to negotiate the ransom. They got the decryption keys. They started decrypting the laptops and the desktops. They ran into some issues with the keys. So they called the help desk. They actually have a help desk. The bad guys do. And they're like, so sorry, here's some new keys. The new keys worked. The crazy part is once they got all their data back and it took, you know, a couple weeks to get everything back in order, they actually wanted them to give them a customer service review, like to say, hey, we did what we said we were going to do. When you paid the ransom, can you please essentially fill out this customer service?

They had to pay. Oh, the insurance company paid the 850?

Yeah, the insurance company wound up paying a discount. They, I think they discounted it down to about 650. So they got a couple hundred grand knocked off. But they did pay the fine. They sent them the decryption keys. A couple of the keys didn't work. So they called the help desk. There's, there's actually a help desk at the bad guys. They sent them new keys.

Sounds like a movie.

It, you wouldn't believe it.

If I like a spy thriller hacker comedy, I don't want to laugh because it is horrible, but at the same time, like really, you're gonna send me what was your customer support?

Uh huh, yeah. Would you, would you give us basically a five star rating for doing what we said we were gonna do? Yeah, we hacked you, we got all your data, but we gave it all back when you.

What, are they in partnership with Uber or something?

Well, if you think about it, it reinforces that, well, people should just pay the ransom.

Yeah, I get it from a social proof and a marketing standpoint, like props for them for having the audacity to.

Oh, yeah, it's.

But shame on them for being in that line of business.

But yeah.

So let me ask you, what if you were like, screw this, I don't want to pay. If you don't have insurance and you don't want to pay, or if you do have insurance and you're just like, you know what? We don't want you to pay either. What options do you have to decrypt it?

Yeah, well, there's two things you're running into, so you, you basically can't decrypt it. Like the, the level of encryption that gets used, it's. I mean, good and bad. It's actually already baked into the software you own. If you own Windows 10, there's encryption software baked in, and that's actually the encryption they use. They use the software that's already on the machines to encrypt and they just hold the keys. It's about impossible to decrypt. If you've got a good backup, you can restore from backup, and that is typically how you avoid paying the ransom. So you have a good backup that's actually off premise. When they, if they hit you, they can't touch the backup, so you just basically restore from backup, which is a pain, but you can restore. The issue that comes with that is if they actually were able to break into your network and encrypt all of your data, it means they had access to all of your data.

They can infect the backups too.

Well, they could potentially infect the backups, but what it means is they had access to all of your data. So if you're in the financial services industry or the healthcare, it doesn't matter.

If you get it back or not, you're already exposed.

They have basically taken your data and now they can say, well, we're just going to publish your data. So they've got two things to essentially blackmail you with. One is, do you want your data back? And two, do you want to keep us from publishing this? Because we will.

That's the issue. So you want to try to keep the people out if you can. There is no perfect security. There's literally no one on the planet that can guarantee you it won't get hacked. The only way to do that is unplug and don't be connected. So it, it is, it is a new world because there, the number of bad actors has grown exponentially. Because it's essentially, it's. It's a service you can subscribe to and point it at whoever you want to point.

Yeah. When you said the encryption, I didn't know it was baked into everything. I thought you were going to mention something like Ion Cube.

Yeah.

And. Or even something different with that third. I mean, that's incredible.

Yeah, it's, it's. It's the encryption software that's on. It comes with the Windows operating system. So you can actually encrypt your hard drive yourself. Don't forget the password if you do it, because it really is encrypted. And we manage that for our customers. So that's one of the things we also manage is, especially if they've got laptops that have critical data.

Yeah. All the work machines.

Yeah. So you want to make sure. If it's portable and can be taken out of somebody's car and stolen, you want to make sure it's got an encrypted hard drive, because otherwise you can take the hard drive out, plug it into another device, essentially hang it off as an external hard drive and read all the data. So you want to make sure that those are always encrypted. If they're portable and move around and have anything, any of the protected information, financial information, the HIPAA information, all of that stuff should always be protected. And there's a lot of companies that don't know that. And they walk around with a. There's a huge liability exposure there.

Yeah. Because, I mean, you touched on something, and I want to reiterate it for anyone listening. You said, pull out that hard drive and plug it in as an external drive. You don't even need.

To put it back in an internal computer bay to be able to read it. Now there's adapters. I have a couple of them. 20 to 50 bucks. You just. I was doing it to.

What.

Why did I get it years ago? Oh, the hard drive crash. I was trying to restore it or something, and it wouldn't read from the computer. So I was bypassing the OS and the motherboard and all that stuff and trying to get it to read off a laptop. I was like, really? For less than 50 bucks, you can.

Yeah.

You can even get the external enclosures and make your own external drive.

Correct. Yeah. That's all those external drives are. It's just A physical hard drive stuck in a fancy container with an adapter stuck to it. That's it.

Yeah.

So yeah, that and a lot of people don't realize that the laptop ones are just smaller. That's it. So it is.

Now what about the solid state drives and everything that are gum sticks now? And not even solid state, the nvme.

Any of those can still be read from unless they're encrypted. Unless you have a key and you encrypt the data that's on them, it's just data. So there's going to be an adapter and a plugin because that's how data gets to and from it, from the device in the first place.

So let me ask you this. With everything you're sharing on the cybersecurity, which I appreciate, would you say it's safer to have physical backup or cloud backup for cybersecurity?

I would tell you in most cases your cloud backup actually is going to be protected more than your on premise backup. And the reason is the cloud provider generally has way deeper pockets for the firewalls and the other layers of security that sit between the outside world and your data. A small business is going to buy a good firewall but not a great firewall and they're going to generally have one layer. If you're out in the cloud, yes, it's in the cloud and in theory other people can see the cloud. But if you're thinking other people can't see your network, they can still see your network and they're pinging it. If you have a website address you are getting pinged with 100% certain.

Now what about for a basic site like a WordPress site, would you recommend something like wordfence or sucuri?

We just make sure you've got the security certificate attached to site and that's actually one of the things that just was in the news. You know you that HTTPs.

It means you've got a secure certificate attached to that web address. One of the things that was just in the news is one of the places that issued those certificates and I think it was more than one, but at least one of them was based in China. So it made the certificates suspect. And there was a bunch of articles on it recently and it's like, all right, these have been blacklisted, they need to stay blacklisted because they're not. Yes, they're a security certificate, but we can't guarantee there's not a backdoor through that certificate. So making sure you buy security, security certificate from essentially an accredited place is important as well. But that, that's something you got to have if you've got a web presence. If you do commerce on the web, typically you're shifting that commerce and the data related to the transactions back and forth to that third party transaction company. So the credit card processor, the data processor, the PayPal's of the world that are business focused, they'll take on that liability, that security layer for you, but you've still got that front end that needs to be secure as well.

Yeah, there's a lot of stuff that people will just think, hey, I got a website, it's fine, or I got a phone, it's fine. But what goes into making it work and all the stuff behind it is just amazing. And I appreciate you for sharing this with us because there's not a lot of people talking about it. I find I know it to a degree because it's part of what we've offered and I have experience with it. I developed a Software to build WordPress websites automatically. I license it to enterprise companies. So having software as a service. Yeah, I'm absolutely thinking about all of these things because it's not just, you know, eainterviews.com for the show here, it's dozens and dozens in my portfolio of assets for my own company, let alone hundreds and thousands of websites for other people's companies.

Yeah.

And it's just kind of nuts. It's like these people have nothing better to do than, you know, hold you at ransom. But.

I mean, it sounded like a movie plot.

Yeah, they actually don't have anything better to do. That's all they're doing is trying to find stuff that they can encrypt the other piece. That's kind of the, you need to have a good backup. And anybody that's not already using two factor authentication for all of their critical stuff, it's a no brainer. Yes, it's a pain. Anything security related is a pain.

I turned it on about a year and a half ago or two years ago on a lot of things. And even when I was calling customer support, they're like, we're gonna text you. I'm like, oh my God, this again. Can we just turn it off? It's cool. But yeah, whatever.

But it's, I will tell you one of the biggest waves that caused a lot of hacks to be possible. And it's the double edged sword of the cloud and standardization is when everybody started shifting and especially in the small business world, they shifted to the Microsoft Exchange Online, which originally was just Office 365, now it's Microsoft 365. But it's basically still the email platform and a whole bunch of stuff wrapped around it. What that did is it standardized the email and all of the setup and infrastructure across 80% of the business marketplace. Whatever. It was just a ton. So if an attack worked on one.

It'S going to work on the others.

So it made them all universal. It also made the methods of hacking easier because the naming conventions all started to follow the exact same process. And that's when we really, you know, it is a pain and you know the way if you set it up right, it's like once every 14 days you have to re authenticate the second factor. But the good part about it is it will prevent that. Oh, I got your user ID and password. Now I'm going to log in as you from Russia or China or the Philippines or wherever. And when you try to log in it says, well, type in your code. Well, if you don't have the code, you actually can't. It actually works and it will keep them from logging in as you.

Do you know of any ways that exist around it?

Oh, there are ways to exist around it, but this is back to the. You actually have to be technical.

And it's you, you would spoof. You would actually have to sort of social engineer their cell phone number and actually just essentially get a duplicate.

I was going to ask you about that. Clone the cell phone first, just so you're getting correct.

So if you really want to hack some, you can't. There's nothing attack proof. I mean, NASA gets hacked, Google's been hacked. They essentially have unlimited budgets. I mean, to think that you can have a perfectly secure environment is foolish. You just can't. So you want to put the right layers in place. You want to buy insurance, that's first. You want to put the right layers in place. And a lot of the insurance companies now are asking, do you have two factor? If you don't, we're not going to sell it to you or your premium is going to be unaffordable. Do you have good backups that you actually test? If you're not, it's going to affect your premium. Do you do cybersecurity awareness training with your staff? Which again, it's not perfect. People don't really pay attention. But enough of them do that they care and they want you to be doing training on it. All of those things are just bits and pieces of having really good security policy and practice in place at a small business. And every business, unfortunately, needs to do it. You just have to. It is the reality of the world we're living in now. You have to know that you're a target. Doesn't matter how small you are. Because, because of insurance getting into the space, most of the hackers now know that, all right, they're going to have cyber liability coverage, probably at a minimum, they're going to have 100 grand. So I'm probably going to get 100 grand every time I'm able to hack somebody and truly lock up their data. So it's a jackpot. You know, prior to insurance, you were running the risk of I might have, I might hack somebody that actually doesn't have any money or, or doesn't care. Now with insurance being involved in most cases, they know they're going to get a paycheck. So.

Yeah, because it's no longer just, hey, your site's down. It's all the data you've collected over the years and the records and financial like you're talking about. It's not, oh, someone can't see my photo, which is detrimental to business. I'm not going to, I don't want to downplay it, but in the grand scheme of like when the I think was target and the credit, you know, it was all the financial debt of all the credit cards of all of its customers versus okay, someone can't access your about page.

Yeah, yeah, it was. That was the Experian hack. I mean, I think that touched almost every adult in the United States. That hack, like your, your Social Security number got exposed. Most of your credit history got exposed when that hack happened. It was. That's scary.

Have you ever set up an air gap system for one of your clients or had to put a honeypot trap to deal with the hackers? Or do most of them have the insurance where you're just dealing with them?

Where we get. We are not specifically a.

A cyber security company. We are mostly the end user support, infrastructure support. So what we have in place is like the services we sell. It comes with a SoC, so it really is security operations center. So it comes with people that actually have eyes on screens 24 7. They're watching for the particular alerts that are coming through the firewalls. And so we're looking for just weird anomalies. One happened actually just two weeks ago. So we had a company based in Kansas City. We saw through our monitoring that they logged on from Portugal. Well, they're probably not in Portugal. So that set off an alarm. They call, you know, and the soc is a third party we actually outsource to. But they called us. They're like, hey, this looks bad. We're like, absolutely. We tried to call a customer. They didn't answer the phone. We shut the account down, so logged it off, locked it out. Then the customer called, said, hey, I can get into my email. Like, good, you called us. I'm assuming you're not in Portugal. No, I'm not in Portugal. Here's what happened. They're like, oh, great, that's awesome. That's why we pay you. We made them, had them change their password, and they weren't using two Factor because people don't always follow our advice. They're now using two Factor because that was a narrow escape. And that's the difference between outsourcing to a company that is actually monitoring things. And a few years ago, we didn't have that. We didn't have the real 247 eyes on screens looking for that kind of stuff. We were sending out automatic alerts. But unless somebody's watching and is prepared to take action, that could have been a real hack. They get into the system and the bad guys are now very sophisticated. They realize, all right, this one PC is not gonna. They're not gonna pay 100 grand for it. They're just not. So.

So they fish out the whole network.

Yeah, they will just start. They will just go dormant and try to hide until they. They just watch traffic, they watch the email. They try to get somebody else. They try to get three to four PCs infected before they really branch out, they want to know that, all right, we're ready to go. We've got this company locked down. There's no way they're not going to pay.

And that's the scary part, that if you don't have that monitoring going on, they can lay in the background. You really don't know they're there. They're not causing anything that's going to create performance issues.

So do you.

When you.

With what you're doing and having people watch it, can you see that they're setting stuff. Stuff up? Or is it until they trip something?

What. What will. What will cause us to get an alert? And there's a whole bunch of things, but some of the big ones, activity like I just described an impossible login. All right, Geographically, there's literally no way you could be logged in. In Kansas City, Kansas and Portugal at the same time. So something's wrong. So that's relatively easy to understand. It's alert on. The other stuff is things that are, if we see it phoning home. So we see outbound traffic going to a foreign country and you don't have foreign operations. We do have a lot of companies that actually do business overseas and in Asia, Mexico.

So for them it's normal.

Yeah, so for some of them it's normal. For most of our customers it's not. So that's the kind of traffic we're alerting on and time of day. So we know their normal business hours are 8 to 5, Monday to Friday central time. Most of the time. If we see a spike in activity at 2 o' clock in the morning, something's wrong. Like it's just, it shouldn't happen. So those are the things that we get alerted on is. And there's a whole bunch of other stuff that gets alerted on, but those are kind of some of the big ones that we're watching out. Because it's got a phone, the communication has to be there in order for the bad guys to kind of gather their data and organize things inside the network. We also watch for installs of software. So if there's an unauthorized install of something on a particular workstation and I will tell you that that's also a double edged sword from a security lockdown perspective because you want to make your phone ring from a support perspective, take away people's local administrator rights. Like I really want to have this weather app on my laptop. Do you really need it? So that there's a lot of our clients, they still have administrative access so they can do those installs on their own. But then again it's harder for us to watch for what's bad. But if we're watching and we see that happen at 3 o' clock in the morning, it's probably not them, it's probably somebody else doing something on the network. So again, it's tailoring what we do for each particular client and making sure we've got the right eyes on the screen, the right things being alerted. And ultimately we want to make sure they've got a good backup because again, nothing's perfect. Stuff's still going to get through us, just like it's going to get through anything. And if they do wind up hitting the network, you want to spot it as fast as possible so that, all right, they started an encryption, we caught the encryption, we blocked it and we restore from backup and then we reassess our security policies, find out where we can tweak things and move on. But you want to be able to recover from backup as opposed to paying rent.

So with the backups we're talking about that, do you suggest on site, cloud or off site, or use all three of them?

We do both. We do an on premise and we do an off site. Now if they're 100% in the cloud, we generally pick a different cloud.

And we take the individual laptops. So if they're 100% cloud, all their data is basically, it's usually a combination of cloud providers and local central storage for the company itself. They're, they're typically not having their own servers in the cloud. It's usually spread out across their application stack. So each application provider is probably got its own type of a backup and then it's that core data like their, their word, Excel, PowerPoint, those types of documents that are kind of central to the business and that might live in SharePoint, might live in OneDrive. They're using the Microsoft stack. And what a lot of people don't know, at least they didn't originally, is that stuff's not backed up, there's a retention policy. It's not a backup. Like Microsoft does not bake a backup into that platform. I think it's on purpose because they don't want the liability. So you actually have to bolt on a third party tool in order to have a backup of both your Microsoft email in the cloud and your Microsoft data. So everything that's on SharePoint, everything that's.

In your email, do you recommend something like Carbonite or Backblaze?

We use Barracuda, is the one we primarily use, but there's a host of them out there. You just want to make sure that you actually have a backup and it's somewhere else other than the platform itself.

Can I ask you one last thing about that? Because I heard this years ago and the rule was, you know, people don't realize even with your home, local computer, if something happens, you know, I, it's not just disaster recovery, but you can have the drive backed up and everything. But if something physically happens or there's a power outage or there's something that destroys the area, they were, I heard, like put it in a lockbox at the bank. Like if it's something you don't need to access a ton, but you back it up once a year with all the new data put in a lockbox at the bank or at the very least like the trunk of your car. Because even that can be somewhere different if you drive to work versus being, you know, what are your thoughts on some of those things that are a little bit more proactive and out there. It's not a cloud backup.

But yeah, I will tell you, the lockbox was the thing we used to do about five or six years ago consistently when we had on premise. Almost always we would do at least annually just buy the biggest external hard drive that was available, do a one time snapshot and go throw it in the safety deposit box because it's cheap and it's not going anywhere and it is just that extra layer of that insurance protection. You know, your data is there and it might be a little bit outdated. And that's the question is how outdated can that, can that get before you need to refresh it? So do you do that once a quarter? Do you once a month, do it once a year? It's a business decision. It's super expensive to do. Most people want more of a real time backup and cloud storage has gotten way cheaper than it was a long time years ago.

Yeah, I've been using Carbonite for some time. But I do know one of the downsides to the cloud is when you start moving like terabytes, it gets expensive. Well, not just that, but the time if you need real time, not just real time data, but if, if it's gone today and you need it by tomorrow, you're not backing up over a terabyte. I have a super computer with a fast connection and a ton of videos from the show. They're all in 4K. And I remember when we switched machines and set the stuff up, it was like, this will be done in eight days. I'm like, well, I'm glad I planned for it and I have it. I even had to bump up the Internet bandwidth because the unlimited Internet. Yeah, it's got cap.

Oh it does, yes. And Microsoft will cap you too. If you're doing a cloud to cloud migration just from Microsoft within Microsoft, they'll cap the data.

Oh, no kidding. Yeah, because so I like on site and cloud. But the reality is if you have a physical one you could like we were talking about, you can just plug it into a different machine. Even temporarily. I mean you're not going to be backing up 10 terabytes of data within.

Any time. That would be reasonable for a business. I would say probably in 10. 10 terabytes might not even be a for. It might, you might have 100 terabytes. What's the most you've seen for a company?

The most any single company have. I think it's an architecture firm we deal with. Right now they've got about 20 terabytes, which is a lot of data. I mean, that's kind of a crazy. At least in the world we play in. So we don't. I would say if you're doing video capture like you're doing.

I know I have somewheres around 15 to 16 last I checked. And it's probably more now because that was last year.

Even, even the, in cad, the CAD files are really the ones that eat up the most space in our world. We actually don't have anybody that has a major amount of video.

So that those tend to be the largest files. And a lot of that stuff typically doesn't have to be archived in the cloud. That's where it makes sense to, you know, you want those drawings from the last 15 years archived and available, but they don't need to be real time available. Those can sit.

Unless you're working on it, you don't necessarily need it. Yeah, yeah, but I have hundreds of clients from over the years and it's like, yeah, if I still. We can still pull it out of the archive and it's zipped and it's stored in like five different locations and stuff. But you know, especially if they're not current, you know, a lot of people come back. But even, even episodes of the show, the first hundred episodes, it's like, even if they're coming back and I have someone on a second time as a guest, it's new footage. But we do have. I'm kind of nuts with some of this stuff, but I'm always looking to learn more. And I thank you because not a lot of people talk about it. And it's like this, this is real serious stuff. It's. You have a bad day if your email is down for 10 minutes, let alone your whole company, and you have no clue how to get it back.

Yeah. And, and it's not cost prohibitive. I mean, it is not crazy expensive to do it. Right. The biggest pushback we get is it's the pain in the butt factor. Yeah, I got to have my phone with me to log into, whatever, because I got to get that second factor. I'm like, yeah, you do. Because that's how you make it secure. You just, you just do. You got to deal with it. And it's usually the people with a C in front of their title that are going to complain the most. But if you. And I hate to say it, but usually if they've never had any pain, they've never had a close call or a scare, they're the hardest to convince. They're like, it ain't gonna happen, it's gonna happen.

Wait until something does go wrong. And now it's no problem. They want everything under the sun, right?

Oh, yeah. And then cost is no object. Let's make it happen. Like, yeah, cost is no object because you just got a million dollar ransom. I mean, you don't want that to be when cost is no object.

Yeah. Well, you're sharing a lot of great insight and I want to ask you why you wanted to make a book.

We had put together a whole bunch of different blog stories basically on what it means to outsource your it. And you know, part of it's clearly self serving because we're in the outsourced IT space. But just like any profession, there's people that do it well, so there's really good competitors and there's people that don't do it very well. And it was frustrating to me when we would, you know, go into a new prospect. Like, you guys are all the same. Basically you all suck. You say you do one thing, you don't do it. You, you come to fix one thing, you break three others. When I really need you to call and call me back, it takes you two days to call me back. So I was, it was frustrating hearing that, you know, and all those complaints. Basically the industry I was in was getting a bad rap of there's nobody quality in your space. So we did a bunch of blog stories on it and then we realized, well, we can probably turn this into a book. So we filled it out, put some more content around it and it really is a laundry list of what you should ask questions about, from how long is the contract to what's included to how do they do your backups, but how do they do internal security? Because it's one thing for me to tell you how to do it as a provider, but am I doing it? I mean, you should know that if you're going to hire me, know that I'm using two factor because I've got the keys to your data. That's what you hired me for. So if I get hacked, it's a really bad day. There's literally 600 companies that would get touched if we got hacked. So we are hypersensitive about security and how we keep track of data and passwords. A two factor and changing it on a regular basis. But a lot of people don't ask those questions. It always shocks me. It is less than 1 out of 10. It's probably 1 out of 20 that if I'm in a business development call, they ask me if I carry insurance at my company. It's extremely rare that people ask that question.

Is it one of the first things you always ask?

Well, I always ask it of a prospect. Do you have cyber liability coverage? Because if you don't, you absolutely need to. And a couple of years ago was pennies. It was nothing. It's gotten more expensive because they pay a lot more ransoms now. But it's also. It's a. It's a necessity of doing business. It's just like having professional liability coverage. You've got to have cyber liability coverage now because you just don't know. And most business.

And how do you base that insurance? How do you base the cyber liability coverage? Is it based on the number of machines, the number of people, the type of business?

It's really all of the above.

And the insurance companies have evolved really over the last couple of years in terms of the premiums they're charging based on the industry you're in, and then what are they requiring you to do in order to qualify for the coverage?

So they are asking way more sophisticated questions now than they did two years ago. They're asking about, do you have a cyber liability training program or cyber security awareness program in place at your company? And prove it to me. Show me what kind of content you're delivering on a monthly, quarterly, annual basis.

Yeah, if you're not educating them, I mean, I think that's the first line of defense is just, you know, I know with phishing emails and phishing emails and stuff like that, most people don't realize if it looks weird, don't click the link.

Yes, I would. I'm always surprised at the number of people who think their boss wants them to go out and buy gift cards. Really. But I know personally, people like the admin assistant has fallen for that. I mean, I've made it quite clear if you ever get an email from me to go buy gift cards, it didn't come from me, like never. Like never ever will I ask you to do that.

My favorite. And this happened recently.

To my personal inbox. And I'm sure they've somehow found the company and it's like, successful payment. And I'm like, oh, let's see what this is for that I didn't order because it was over the weekend and I wasn't in the office. And it's like, here's their bill, here's the invoice. All we need to do is. And I'M like, delete, delete. But I mean, it looks legitimate. I got screwed 20 years ago getting something on ebay. It was a camera when I was starting off video production. And it was this beautiful camera. I just really wish I would have got it. But I was in college and it was like two grand for a four or five grand camera. And I'm like, I don't typically buy stuff online, especially stuff like that 20 years ago. But it sounded plausible, like if you had it for your business. You know, we've had it for a couple years. It's gently used. We just don't need. We're upgrading. Or I'm like, this sounds good. You know, I'm not. I'm not slow. But they faked the entire ebay page. Because when I went out to reach on ebay, they were like.

We don't. This. This never went through. They, like copied everything, cloned it, redirected it. And I remembered, the last thing I remember was, I don't know who you are, what you're doing, but just so you know, I'm in college. If you. I would like if you could return the money, but if you don't, I hope you know you're stealing from a college kid. So I hope that makes you feel better. God bless. I'm gonna achieve my dreams either way. This sucks, but thanks for the experience and the story for the future. So.

I was just like, you know, what am I gonna do about it? But at the same time, it's like, really? That's the type of person you are. It's like, I'm not saying steal, be Robin Hood and steal from the rich and give to the poor, like, it's still wrong, but really going after college kids who are buying stuff like.

Yeah, it is. It is the world we live in. You know, the. The ones that get me is when they go after retirees.

That too. I've heard of stories even.

Yeah, and it's. Yeah, it's. There's tons of scams. Some of them are phishing scams. Some of them are just flat out social engineering. They're just trying to trick you into doing something. They didn't even use any software to do it. They just got your email address, got a hold of you, and there's people that will combine it. They'll call the company on the phone, and then they'll start sending emails and they'll go. They will legitimize themselves just by becoming familiar.

Just wanted to see you got the email that we sent over. Hey, could you Verify, you know, your social number or your passwords. Hey, we're testing all the emails on the system. If you could just let us know your most recent password, we'll verify our records against it.

Well, and it's also, they'll pretend to be the IT company. They'll call in and say, hey, actually we got this weird thing. Can you, you know, I'm with so and so.

You gotta be skeptical of everything. Oh, shoot. You're with Bob.

Well, now it's official.

Yeah, yeah.

Yeah. It is a. Interesting world. Interesting times. Wow.

While you're sharing so many great details, let me ask you a couple more things. One of them is what is your biggest. Who is your biggest success customer success story?

Our biggest customer success story, just as a pure business.

One of the businesses we deal with in Kansas City is called KBP Foods. They are the largest Kentucky fries, Kentucky Fried Chicken franchise in the country. And we were with them when they were small and they are now Giant and they are expanding. They're now Kentucky Fried Chicken and Taco Bell's and they actually just recently expanded to an Arby's franchise. But it's, it's super fun to work with companies that are growing and expanding and kind of that success story. So being able to grow alongside with them has been super fun. So they're probably, I guess from a success story perspective, one of the, one of the biggest that's grown the biggest.

How many locations are they up to now?

They have just on the KFC brand. It is like 800 KFC stores. Yeah, it's, it's a lot.

And then I believe their Taco bell footprint is 200 in some stores. And I think the Arby's that they just bought into is around 200 some stores. It's huge. They've got a really big footprint and continuing to grow. And it's.

So with a company that size and their it, what are, are you doing? A lot of what we were talking about. Is there anything additional?

You're just making sure they're all set up for all the locations because to my knowledge, they don't have a lot of rep stre driving around with laptops, but it's more. All the computers within each store.

It's the computers in each store. And I'll tell you, when you deal with a franchise like Kentucky Fried Chicken is Yum brands.

Yeah.

So Yum has its own, like there's, there's essentially a firewall in those stores and we don't get to go past it. And we're the IT company.

So they throw data over that firewall. We, we help them with the centralized systems that, that are outside of the franchise, as well as their staff that. That goes around, the coaches that are there and the general managers for the different districts. That's the, that's the, the folks that we support, we don't actually support inside the four walls of the store in most cases. Now, when you get outside of the Yum brands, then that's a little bit different story. Okay. But in most.

So you're like, we're talking about, you're taking the educational approach along with the hardware and software approach because, I mean, you could put all the things in place and someone just replies back to that email and you just infected the whole company because they don't know any different and you never trained them.

Yes. And what you want to do is because again, people are going to make mistakes because they're people. But like you said it earlier, your people are both your first line of defense and your last line of defense. So you want them to be as educated as possible. They're still going to make a mistake. What you want to have happen is if they accidentally click that as soon as weird traffic starts to happen, alarms go off and somebody reacts. Yeah, so that's the part that you.

Don'T wait a week and go, oh, this is what happened, because it's over at that point.

Yeah. Well, in that example, I told you, they literally sat in the network for almost six months. Nobody noticed it at all because there was no monitoring going on. None. And they weren't really doing anything. So they sat there until the time was right and the time was finally right and they got everything.

Yeah, that's the thing. I mean, whether it's the movies or real life, people are like, oh, yeah, the machines are much more sophisticated. We can do all this stuff. Yeah, they're faster and they got more memory, but at the end of the day, there's people touching them. That's the problem with them.

Yes. And there's real people on the other end actually looking to figure out a way into the network.

I mean, if you were to take that IBM Chess computer, Deep Blue or whatever, and program it to like, never get hacked, I'm sure it would actually might be able to pull it off because it's a machine. But you get someone that's having a bad day and just running late for work, spills their coffee on them and it's like, click, click, click. Even if they were trained, they might not be thinking straight. Like you're saying, I mean, that one's perfect.

Yep. Nobody's perfect. They're going to make a mistake. Which is why there's no perfect security. You just want to have all the layers in place as much as you can and know that you can recover if something bad happens.

That's awesome. I'm so glad you're sharing that. I got two questions for you. I've corrected myself now. I used to say I have one, but it's actually two because the first one is yellow or black.

I'm gonna go with yellow. Wow.

You're like the sixth or seventh in a row. No one likes the black one. It's okay. I like both because it's my brand.

University of Michigan grad.

Yeah, not bad. So we got the yellow right here. And my question for you is, who is a company you'd love to work with that you haven't yet?

A company I would love to work with. It's actually headquartered in Kansas City. Is H and R block.

Oh, yeah.

I've never been able to work with him. Mostly because they're on the higher. They're clearly bigger than our typical standard because we tend to. Tend to cap out at 200 employees. But their business model is it's tremendously labor intensive around taxis. So we would be a perfect complement to tax season because we can scale and help support all those offices that basically get spun up and then shut back down. But that's a company that I would love to work with that we have not ever had a chance to work with.

I'm going to throw an audible and add one more in here because I want to know the answer. So that's a cool company. I have family members who have worked for them for 20 years. Great company. And you're mentioning Yum Brand Foods. I knew it's a conglomerate. I love looking into the business of businesses, you know, like with Con Agra and Berkshire Hathaway. And like, a lot of people don't realize there's 40 different companies under their vertical or whatever. But my question for you is, how do you get in with these companies? Do they just seek you out, grab your book, call you and say, hey, we heard about you? Or are you doing something proactively to go, okay, we're gonna get into the. How are you getting in with all these big companies that are serious?

We get in with really all of our companies one of two ways. We're very visible and we do a lot online. So, yes, we pay Google and we've worked on our SEO and we do Blog posts. And we just try to be as visible as possible on the Internet. But we also do snail mail marketing. I still love sending stuff in the mail because most people don't and we sell send silly little things in the mail. Something that's always in an envelope is this. We have, we have purple pens that write with purple ink. And I call it a bumpy mailer. If you get a bubble wrapped envelope and there's something inside, you can't throw it away. You have to open it up to find out what's in there. So we put pens in there. We actually put a pen like this in there and we'll put a pencil in with it with a little eraser on top that looks like a bunch of grapes. It smells like grape. Hubba Bubba. And we'll put some silly little note on there. So if there was like a 40 under 40 award or a top 100, whatever, we'll send them a grape job note that says grape job on whatever. So it smells like grapes. It's in the envelope. They kind of have to open it up so we get a smell and the color and to get them to associate purple with technology support and if it's the right person, the decision maker the next time it comes around that they're frustrated with technology, which is going to happen because it's technology.

We'Re top of mind and all I want is a chance at that.

How long do you usually see it takes for them to follow back up? 1 to 3 months, 6 to 12 plus.

It is all across the board. It has been the day they got it in the mail. My longest sales cycle was actually seven years. Okay. Which was. I mean that's a total anomaly. But it's typically in that three to six month range is when I mean there's nothing that's instantaneous.

Yeah. I was gonna say if you can go three, four years without any computer issues, let me know what you're doing. But yeah, that's fantastic. Yeah. Direct mail is huge. I love it. I've trained people on it too before as far as marketing and stuff. And it's one reason I like, you know, like with our authors.

Yeah.

You can set, you know, a book is another thing.

The trash cans that pop up, the pens, the bumpy mail.

Yeah.

So you just find whoever the decision maker is or the highest level up you can and just reach out to them.

That is essentially what we do. We will try to find their email. We will try to. It's fairly easy to mail stuff to those folks because they Actually typically still have an office and a mailing address, but getting their email if we can, and then just kind of periodically staying in touch. I mean, it's that drip marketing concept of just, you know, once a quarter, twice a year, send them something. And we try to send quality content. It's not just an advertisement. Every time it goes out, it's like, here's the top 10 things to do about cybersecurity. And that's. We've been doing a bunch of that this month because this is cybersecurity awareness month. So. So we try to put good quality content out into the marketplace. And you get followers that way.

Well, I love everything you're sharing. One more quick question I'm looking at behind you. You mentioned the pen. You mentioned Chris Grape. How did you get the name for your company?

The name for the company is accidental. We did have. This actually is. My. My idea was a purple pen that wrote in purple ink. But it wasn't actually for this company. It was for my last company. We had a purple logo. And just for something fun, I'm like, I'm gonna get pens that write the company color. So I got purple pens. When I started this business, it was not called the Purple Guys. But what I knew was I didn't care what we called it, but I wanted to have a purple logo. So I keep my purple pen. So we had purple logo. This was 20 years ago. So this was October of 2001 is when we started the business. Different name to the company. So we've got embroidered shirts in a bunch of different colors because I wanted to have a nice clean cut look in a uniform, but they're all different colors. My wife was part of the company at the time. And we sat in a meeting and there were six of us from the company, three or four people from the client. We all had a different colored company shirt on. And as we left the meeting, my wife was like, this is silly. We'll pick a bunch of Skittles. Pick a color. So we didn't have any purple shirts, but I thought, well, if I'm going to standardize on a color, I'm going to standardize on the company color. So I took all the shirts back. I got everybody purple shirts and within a week, our customers independent of each other, we would walk in the door, two or three of us to do on site support back then, and they're like, hey, the Purple guys are here. So it was utterly accidental. Our customers started calling us the Purple Guys. But I was smart enough to realize all right. You can remember purple. You came up with a name and we ran with it. It has been a really fun brand.

Wow. I love hearing the story behind the story.

I mean.

I find most things are just like that. There doesn't have to be a rhyme or reason. If you have the heart and you want to serve someone, go for it. The name is relevant in most cases.

Yep. Yeah, we've had a lot of fun and we added the characters a couple years ago and so you can do a lot of fun things with little cartoon monsters. So that's, that's been fun too.

Well, thank you for sharing all of that. We're going to thank our sponsor and come back for the imperfect action round. You've heard me say every business needs a book, including yours, and it's true. And that's why I'm launching my new book@eapublishingmethodbook.com so you can learn the seven steps to publish and promote promote your nonfiction lead and profit generating business book in eight weeks. But you know what, don't take my word for it. Take it from a few of my authors like Lori, I went from having.

An idea and a possibility to actually getting my book published.

Or Catherine, thank you for making my.

Mom number one best selling author.

Or Mary Alice, what he got done.

For me in three days of the regarding my book launch.

Unmanageable.

John Cody.

I've worked with Mario over the phone and online and he's been very helpful in getting me where I needed to go with promoting my books. Rocio, there's no way in the world I would have been able to do this with somebody else again. I've attempted it in the past. It didn't serve me. As a matter of fact, I ended up more frustrated than anything. So this has been a very seamless process.

Adele, if you're looking for an amazing.

Business coach, I highly recommend Mario Ficini or Bill Benner make a higher recommendation than to work with Mario Ficini. He has been great for me and right now I won't work with anybody else except for Mario.

Hey, their words, not mine. Visit eapublishingmethodbook.com to get your copy and I look forward to hearing your transformation as our next video success story. Once again, that's eapublishingmethodbook.com and we are back with the imperfect action round. John, are you ready to take imperfect action?

Absolutely.

I got three questions for you. Rapid fire answers and the first one is what is the fastest path to the cash?

Fastest path to the cash is providing good customer service.

Excellent. Number two, what is the biggest problem you see your prospects making in the fastest way for them to fix it?

The biggest problem, the biggest mistake.

I would say the biggest thing I see people avoiding is turning on two factor authentication. It's a total no brainer. Turn it off. I mean, I see it. I saw it last week.

I guess I'm going to leave mine on now. I figured you were going to say that or clicking the links they get for the gift card. Something to that effect.

Yeah, the free IRS refund also doesn't happen.

What about the overseas prints?

I actually got an overseas prints email a month ago. I almost printed it out and framed it because I'm like, no way. It's a throwback. I almost wanted to click just to see what would happen. It was. It was a Nairobi Prince email. Like, I'm not kidding. It was. I did.

You already deleted it though.

I did save the next one. Wow.

Save the next one.

Yeah. That was. I mean that's a classic.

I could go on so many tangents. What's the third question? Some. Oh, yep. It's the best one. It's one of the best ones. What's the best way to maximize customer lifetime value?

Ooh.

Again, it's keeping them the longer they stay a customer. So it's providing more than they. Greater value than. More value than they're paying for is really what you have to continue to provide that ongoing and they'll stick with you. And the biggest part is they'll tell their friends.

Yes. Referrals. What books would you recommend to Expert Authority World?

I love Donald Miller and Storybrand. Coming from a little bit of the marketing bent, I think that is a brilliant book. I love Almost Everything by Seth Godin. Seth Godin. I actually gave his book Purple Cow as a gift many years ago which just fit with our brand at the time.

I like Vern Harnish and the Rockefeller Habits. Most recently Geno Wickman and Traction. Yeah, I think that is a phenomenal operating system essentially for a small business.

Those are some of the ones that just come top of mind.

All right, well, thank you for those. Where would you like everyone to learn more?

Check us out www.purpleguys.com or on all the social platforms as purple guys. But the www.purpleguys.com you can find us there.

Excellent. Well, thank you very much. It's been a pleasure and I had a lot of fun.

I appreciate it. It was great to meet you.

All right, Expert Authority World. We have another great episode here today. I'll see you tomorrow. Have a great day. God bless.

You're already the expert, but have you transformed your expertise into a tangible asset that will generate qualified leads while increasing profit for you 24? 7 and if so, how well are you promoting it? With my new book, the Expert Authority Effect Publishing Method, I take you through my process step by step. Visit eapublishingmethodbook.com today to learn the seven steps to publish and promote your nonfiction, lead and profit generating business book in eight weeks. Visit eapublishingmethodbook.com to get started. Now. Once again, that's eapublishing method book.com thanks for listening to today's episode. I would love to know what you enjoyed most from it if you haven't done so already. I invite you to connect with me on my new LinkedIn. You can go to it directly at eainterviews.com LinkedIn Once again, that's eainterviews.com LinkedIn. Lastly, check out the full eainterviews.com site for complete show notes, the full interview video experience, links to the resources we mentioned, and more. Have a blessed day and I'll see you on the next one.