Cyber Security Expert Reveals How To Protect Your Assets w/Rick Jordan

Welcome to another episode of the Main Street Business podcast where I have the honor and the pleasure of interviewing Rick Jordan, a leading authority in cybersecurity and digital protection. As a consultant to the White House and the founder of Reach Out Technology, Rick has dedicated his career to safeguarding Americans and business owners against cybercrime. Rick also has a best selling book, two compelling documentaries, a national speaking platform, and a top rated podcast. All in. Join us as we dive into the world of cyber security with Rick Jordan. Well, Rick, thanks for being here. It is an honor and I know my guests are going to benefit from this. I'm taking notes myself. Excited to have you here.

Awesome. What's shaking? I'm very grateful to be here. This is going to be a good combo today.

Well, people don't realize how valuable your information. I mean, I'm a tax guy, I'm saving money, protecting assets. But you're, dude, you're on the front line. Cybersecurity. So cool.

Yeah, it's. As we were talking backstage, you were even talking about enrolled agents. You know, that's something that I know coming up here soon. This is like the grace year I see for enrolled agents because now I believe it's. I can't remember the form, but there's a self certification that you have specific cybersecurity controls in place for enrolled agents. The form escapes me. I was just talking about this with my team the other day. As an enrolled agent now you have to self certify that you have specific cybersecurity metrics that are in place and every single year, because there's a form, correct me if I'm wrong, there's a form you file with the IRS every single year as an enrolled agent. And now it's, it's going to be a little checkbox that says, yes, I'm protected.

Well, we've got to talk because I'm, I'm talking to hundreds if not thousands of enrolled agents on a regular basis who want to be on the cutting edge. And we're going to have to talk about that. Well, one of my first questions, if I may, just as we get going here, is how did you get into cybersecurity? Like what, what, what was your background and how did you get led to this? You're passionate about it. We love what you're doing in that area. How did that happen?

Well, it goes back to when I was a teenager and I wanted to be a cop for real. I was, that was kind of the, the route I was going to take as a career Choice. It's funny. I was on somebody else's show the other day, and they're like, well, you had that cop vibe to you. I'm like, what is it? Like, is it the hair or something? Like, yeah, it's kind of the hair. I'm like, but now I'm a cool tech CEO of a public company. I'm a speaker. You know, I go on TV all the time. And it's like, I do this really one because it's modern and hip, but also it eliminates the grays. So nobody sees the grays. You Look.

You look 10 years younger.

Thank you. Thank you very much. Yeah, I know that's. That's how it rolls. But when I was going to join the Marines, that was my thought. And the Marines was. I wanted to, yes, do something awesome for my country because I value everybody who serves in their military. I also saw it as a. As a milestone, kind of like a jumping off point, because you could do that for four years on a tour, maybe military police, then you'd have your ticket into any state law enforcement agency. And when I was going through that, they declined me because of a medical history of asthma. But I had already been a police cadet. You know, I didn't want to go to college and wanted to. I actually went for two weeks, and then I was like, screw this, I'm out. And that was my route in order to get into the judicial system, you know, criminal justice without having to have a degree. And my buddy who was a Marine, I. I love going back to this. He was like a family friend, like big brother, big sister kind of thing. And he had said, you wouldn't have made a good Marine. And he was a Marine, retired Marine. And I'm like, why is that, dude? And he's like, because you always ask the question, why? He's like, if somebody tells you to go attack that hill, you know, you're not going to just go up there and do what you need to do as a good soldier. It'd be like, why isn't there a better method? I can already think of, like five or six different strategies that are better than yours. Lieutenants, you know.

Yeah, that's not going to fly.

Exactly. Right on. But I still carry that today because, I mean, that's. I like that. I like the. What happens after, what happens next. It's something I've always taken on. So security kind of falls into that, you know, And I think back to 2014 when I. When I really realized, damn, I'm in cybersecurity. Now, you know, because it goes back before that. I mean, I did servers and, and computer rollouts to Merrill lynch and I would find security flaws in their network back in like 1999, 2000, as a very green 18 year old just learning the industry. But even before then, dude, it was business because I was a store manager at a Radio Shack when I was 18 years old. I credit to this day because now it's a public company and I'm doing roll ups, right? All these little companies making it one big nationwide brand. I learned how to read a P and L when I was in Radio Shack as a store manager because 18 years old, they would train you like, this is your store. I was the youngest store manager at Rad Shack at the time. Three days after my birthday, they promoted me, gave me a million dollar store and said, you've been trained, you could control everything. I mean, all the way from, you know, obviously top line. But then you get, you controlled your cost of goods, you controlled your expenses because you controlled your inventory, your ordering, your payroll, the rent you could negotiate. It was almost like even though it was corporate owned, you ran it like a franchise. And all that you were bonus on was profitability. So you could run it any way you wanted to. And as long as it was profitable, you got extra cash. It was all the way back to then, man. People are like, how are you so good? You're a tech, you're an engineer. I'm like, really? I was business first. And even before then I was sales because I worked at McDonald's. It's like, hey, do you want fries with that? That's the best upsell question in the world. So now it's getting into security. After I got out of Radio Shack, you know, I had an aptitude. I was good at tech, I could do it. But it's something like, who was it? I think it was like Mike Rowe, right? Dirty jobs. I heard him speak one time, he's like, I found something I was good at, then I learned to love it and I got rich. Like that resonates with me because it's a. I was good at tech, but it was more. So what can tech do for people? What's the outcome? Because if you talk to engineers, you know, the geek out. And rightfully so. I'm glad I have these people in my company, dude. You know, because it's like the, the shiny object, the coding, the scripting, the all the different rules in a firewall, you know, it's awesome that they just like dive in and they get off on those things. For me, it's like I'm sitting. It's like, well, what's that going to do for me? If that's going to put this protection around me so nobody can come in and siphon 200k out of my bank account? That's really my outcome, right? If I can do some kind of risk mitigation. Because that's really what cybersecurity is. I mean, for all the CPAs that are listening, risk mitigation is one of the biggest primary responsibilities of a cfo. So cyber really falls underneath that. And then, of course, that translates into the financials. How do we protect what the company has from a financial perspective, Assets. It all ties together, man. So 2014 is when I first realized, you know, because I could build the servers, I could build. Build the networks, program the firewalls. And then I got a call New Year's Eve. I actually have this today because I'm getting over a cold. So I've got scotch right here. Clears my throat a bit while I'm talking like this. I'm a big McAllen fan, brother. Big. I love it. I love it. Yeah. It was a lawyer, actually, who got me into single malts about 11 years ago.

Leave it to a lawyer to get you, you know, some sort of substance

abuse going, for sure. It was great. I was. I was. It was a sales engagement with him, right? I'm in there and I'm like, company's only three years old now. It's 14 years old, you know, and it's a big deal selling, you know, for me, it was like, at that time, it was like 100k a year, which was a big deal at that time. And I'm like, yeah. And then. Then when we do this, I'm going to bring in a bottle of Johnny Walker Blue. I was just pulling something out of my ass when I said that, because I knew that that was quote, unquote, good scotch, you know, whatever. And he looks at me, he's like, oh, no, we're not doing that. And then in that moment, I mean, what was that? Yeah. So 11 years ago. I'm only 33 at that time. And here's a seasoned attorney in his 60s, you know, a very commanding gentleman. I mean, the guy takes on amazing personal injury cases, you know, Still a client to this day, by the way. And it's because of this moment, for real. And he's like, oh, no, no, we're not there. I'm like, what do you mean? He's like, there's no blended scotch here. We don't allow that crap into our office. Like, what? He's like, only single malts. And at that point, I felt so green and so. So much of a noob. Like, what is he talking about? You know? So I go out and look at it, and it's like, well, sure enough, it's like. Then I dove into it. I had Glenn Liv at 18 as my first one. You know, I still like Glenn livit, dude. But McAllen's the best. I know I'm chasing a squirrel on this, but it's a. It's a good story, especially for lawyers and CPAs. Right. Like, this is why he said no blended scotch now. I mean, it's. It's great because It's. This is McAllen. This is McAllen 15 I've got in front of me. It's a good every day. But, yeah, I was having these. I was having a couple drinks on New Year's Eve. And my number two, who actually is still with us, he's been here 13 years now. He was employee number two in the company. Name's Ryan. He calls me up, and he's like, I think there's some bad actors in one of our client systems right now. I'm like, what do you mean? He's like, we're getting a lot of weird traffic in 2014. You know, that's 10 years ago. Cybersecurity is still not a big thing. Yeah. In 2014. I'm like, okay, well, let's go look. And sure enough, we're. This is the strategy stuff, right, that I was talking about that I love to see. Like, I can always see what happens after, what happens next. And I'm looking at where this is coming from, and sure enough, we're seeing traffic coming from China. And it's like, we shut it down because this client of ours has 14 international patents. You know, so they were after intellectual property. It was a legit attack. And, I mean, tens of millions of dollars to him. You really like his lifelong work that was at risk on this. We shut that down, you know, from. From that IP segment, that IP address segment for people who aren't. Who are listening. And IP address is really kind of like your street address on the Internet. It shows that I'm in Chicago right now, Right. If it comes from here, you know, it just locates where your system is on this big wide web. Think of it as, like, a neighborhood. We shut that down, and then it bounces to, like, Syria. And now there's an attack from There I'm like, what is happening here? So I, you know, like right in the thick of it. And then understanding the strategy from years ago with Merrill Lynch, I'm talking like 14 years ago and seeing how the networks were designed because I had certifications on top of certifications at this point. And I start to think it's like, where are they going to go next? Because you could see that they were just bouncing around different points in the world and we had to stay at least two steps ahead of them and start to think where they were going to next to block these connections, you know. So it's probably about 45 minutes, you know, six drinks in, because it was New Year's Eve and we're fighting hackers in China for one of our clients. And it's like, there's gotta be a freaking better way. There's gotta be a way to automate this stuff, you know. So then we started to figure out, you know, after that, put procedures in place, you know, before these systems were automated, it's like, what countries do we need to block by default for all of our customers, you know, because we don't want to go through this again. And it's always been that, that proactive step to continue to provide that protection because it's a, it's a push and pull, man, when it comes to, to hackers, to bad actors, you know, and that was a real scenario. Nowadays there's different motives, right. Because nowadays it's more like E crime groups that'll do something like this and try to get, get cash, ransomware, all of that. But back then it's like we talk about it being the stack in our industry, like this list of tools that will do these things from an automated stance. When it's like back then I like to speak on stage, I'm like, in 2014, I was the.

Well, you and I have similar missions. You're there trying to help so many small, small business owners, Main Street America. What is the number one risk for that small business owner? They may not be doing tens of millions of dollars in transactions and be exposed to China, but there still is exposure. I know that cybersecurity is important for everyone. What do you see? The biggest risk for the, the average small business owner is with a website, you know, trying to do some E Commerce. Maybe what's out there.

E commerce is fairly safe. Yeah. Because most of those systems have place as they need to already, especially if they're hosting with like Shopify or whatever else. When you get into the big set, when they're doing tens of millions. It's a different scenario. But the small ones are mostly protected. For E Comm. What you have to look out for is the human aspect because the, the biggest risk still to this day is phishing. And that's when you know if, even if you're doing a million dollars, I mean, as a CPA firm, you probably have a couple of people on staff, you know, so we'll just call him Bob. If there's a Bob listening. Sorry, Bob. I always pick on Bob. There's always a Bob in every company, no matter how big or small.

That's true.

That will click on anything.

Yes.

And so when it comes in and they'll see this, like, this is a real example that I've seen before. Chick Fil A sends a marketing email, or at least it looks like Chick Fil A because we've got our new spring lemonade coming around. It's like strawberry pink or something like that, you know, and like, cool, I need to go there. So then you click on the link to get this coupon. I'm doing air quotes if people aren't watching this on video to get this coupon and it says, hey, sign in with Google or sign in with Microsoft to get this. And they'll do that. And it looks like a Microsoft page. It's not though. It's a fictitious page that now just captured your real email address and password. And most of the time when these come in at work on a work computer or work assets, they're using their work email address to get that password. And if it's somebody who has privileged access to systems, to files, to data, now those hackers have the keys to the kingdom. They don't have to spend a lot of money. So like the same legitimate emails, you get to like raise your testosterone, right? That's what these hackers are using. They're using social engineering methods to get people to just straight up give them, without delay, willingly, their usernames and passwords. They save that, like all the, all the research and development for E crime, you know, it's legit to where they're trying to brute force their way into a system. They save that stuff, man, for like Putin's laptop for real, because there's a much bigger payoff. But they can have these swaths over and then when they get in, they have a foothold. They stay there for a while. They monitor emails and be like, oh, this person's, you know, as a CPA firm, they just invoice 10 grand to a Steel company that's a client, they'll send out an email from that person's email account saying, hey, we have new wiring information or new ach payment information. And that's how money gets diverted to a different account rather to that small business owner. What do you do? You throw up your hands. Customer saying, I sent it to you. You're saying, I never received it. And they can provide transaction proof from their bank that they actually did pay it. Where do you go from there? Because now it makes you look like the dummy that you got hacked as a cpa.

So the takeaway is obviously. And we've done some trainings in our firms.

Yeah.

Where we go through it over and over again every year, every six months, we have that reminder in a staff meeting. Don't open anything, don't click on anything. And what phishing emails are about. But if business owners don't realize what they're really trying to do is access your customer information, credit card information, anything they can do to divert funds. And it doesn't have to be like a national secret or anything.

No, just trying to get credit cards. Yeah. Because a lot of this stuff is automated. So these crime groups, I mean, with AI as well, they're getting better at writing these emails so they look more real. It's. I used to think it's like, if anything starts with please kindly. This was part of our training. If the, if the. If the word the copy starts with please, kindly relay, you know, or the word kindly, I'm like, that's Indian. Because that's. That's overseas. That's how. That's how they speak. Like, when it comes to we'll type anyways, you know, and then you start to see some other grammar errors and all that. I'm sure you remember that from years ago. You could tell just from the grammar errors. A lot of people would still skip over that. But now with AI linguistic language models like ChatGPT and others that are out there, like Bard and Gemini, it's writing it for them in perfect grammar. So it's a little more difficult to spot these things. And they can do it in mass. Wow.

So what are you doing at Reach Out Technology, the company that is impacting so so many small business owners. What are some of the services you're providing? And. And this isn't to be an infomercial. Like, I literally am like, what does your company do to help that small business owner other than educate your employees not to be dumb and on things.

Yeah, that's a bit. That is a Big part of it. But then tech comes into play. You know, we call it layers. I mean, if you want to look at it as a cake. And for anyone that, that's listening, that works with an MSP is what they're called Managed Service Providers. You want to make sure that they have some basics in place. You know, if they're not offering things like two factor authentication, you know, which a lot of us use these days. But if they're not offering that for your business systems, go somewhere else. If they're not offering something that's called edr, which is endpoint detection and response, and then mdr, which is managed detection and response, that's next generation antivirus that uses behavioral analysis, artificial intelligence, to examine what's happening with someone who might try to get on your network. Can I give you an example? It's a. It's very simple this way. Before, you used to open a PDF, right? And I'm sure you don't deal with PDFs or Word docs at all, being a lawyer.

Oh, not at all.

Yeah, I was joking with one of mine the other day. He's our, he's our securities attorney. And I'm like, dude, I sent him a Google Doc. And he's like, did you send it to me in Word? I love him. His name's Matt, right? And I like, what are you talking about? Because he's working through our filings, right? Our certific, some designation for the shares we just went public. All of these, these funny things. And he's like, I don't really know Google too well. I'm like, what do you tell? He's like, it's us lawyers, man. I'm like, legit, like, because the red lines, you know, and everything, it's like, I get it. It's actually more difficult to do in Google than it is in Microsoft. I understand. But it's.

And Rick, last year I was working with an attorney that said, catch this. Can you send that to me in Word? Perfect. I was like, what do I need to go to Ask Jeeves?

Yeah.

For real.

That's great.

Unbelievable.

That's fantastic.

Epson Word documents.

Exactly. Before viruses, right? Or they used to. It was a fingerprint, right? And your fingerprint, I mean, unless you burn your finger off, it's the same. It's always the same. That's. That's how you identify yourself. That used to be how viruses and all these things existed, where it was a fingerprint base. So if it was on your computer. It was on my computer. That Virus that was in that PDF or that Word Doc, it looked the same all across the board. They'd scan it, see, okay, well, this is a virus. This is a. Not, not a virus. The fingerprint matches. Now it differs from computer to computer. It mutates very similar to like a pathogen in your body. But now the behavioral analysis is what the artificial intelligence takes over. So if you open a PDF or a Word Doc and now all of a sudden that PDF starts to contact Russia, you know, or starts to look for other computers on the, on the network that you have inside your eyes. Exactly. And it doesn't do it immediately because this is machine learning. Sometimes it can take a look at like the contents of that and be like, okay, maybe this is normal, you know, but a lot of times it'll look at those behaviors and be like, this is abnormal. I need to shut it down. And then it raises a flag for a human being to look at because there might be legitimacy to what that file is trying to do. That's the, that's the EDR point is the artificial intelligence looks at the, the detection and response within that PDF to see what it's doing. Then the managed detection response is when a human from reach out jumps in and analyzes what happened, you know, to see if that's legitimate or not.

So if I can restate the first line of defense that your company is constantly teaching is the human response of good practical skills.

And don't click on bad email and

sending documents and all that. The second level is based on the complexity of your client. You'll add some layers of this virus software like you said. Next level, that's using AI to kind of just see what's coming into your emails, what's being opened, what's being used and sent. And seeing if there's this mutated type of hack that can evolve in your software is trying to stay one step ahead of them and alert you when there's a bad document in your small business.

You got it?

Now you summarize that probably.

Yeah, that's a great way to, to talk about that layer. And I can zoom out a little bit too, because there's over 30 different layers that we use. I gave you just one. You know, so other things like manage firewall. And that's when it's like, when I speak on stage, it's like, how many layers are you guys using in the industry? And it's like, keep your hand up. If you've got five, you know, almost every hand in the, like, keep your hand up. If you have 10, half the room goes down. Keep your hand up. If you got 15, you know, now there's like 10 people. I'm like, how about 20 in a room full? About 500 people in my industry, for real, about 20. And now it's like, no hands are up. And I'm like, I'll keep mine up. About 25. How about 30, you know, and at the time, it was like, how about 34? That's what reach out has. And the reason is, is because there's so many different ways that these bad actors can get in. You have to cover all of these angles. So it's. How protected do you want to be? I like to make the joke. It's like, do you want to be the condom of cybersecurity? You know, only 70% effective. Something can still get through while nothing's completely protected. We want to make sure that, yeah, we have the protective nature in place for anything that might happen. And if something still gets through, we still have the humans on the back end to take action, because most will be like, yeah, we'll throw the software on. But then what we're really, really good at is making sure that it doesn't go far, you know, so if something happens, it's like the longest any of our clients have been down has been two hours. And that's the difference. If you have only a couple of those layers, right, you're only covering a few of those holes. We've taken on CL that have been down for two weeks. A month, Two months. Look at the municipality of Dallas, right? A few months ago, it was sometime last year, that was down for so long from ransomware. It's because they didn't have the reactivity put in place to where they could recover fast. So it's still. There's still stuff on both sides of the spectrum, proactive and reactive, that have to exist.

Well, where does a small business owner start with a cost benefit analysis even? What should they expect to. To at least start with and spend or then ratchet it up based on the level of information they're protecting?

I love how you look at it that way because it's one of the salespeople in my company. We're launching a new bundle, you know, coming up soon to where it's kind of the basics, you know, we might call it the fast track or something. I don't know the branding yet, but it's. It's the essentials. And it really fits kind of kind of two segments. It'll fit the companies that have internal IT because it's the white elephant in the room. It's a competency that they don't have. They don't have the cybersecurity competency. They can fix printers all day long, servers, whatever, but they don't know how to protect anything. So we give them this nice little box full of stuff in a bow to say, here you go, you know, and then we'll monitor, we'll feed back information to them. It also fits the micro business segments because it allows them to obtain or check off the boxes for cyber liability insurance. You know, at a, at a price point that's more of like a commodity. Once you reach about 20 people, maybe 15 in your company, then you have to look at the full solutions that I've been talking about, you know, to where it covers everything. Because let's be be real, this shit's expensive. And that's one reason why, you know, if you're not big. And that's one reason I went public, man. It's like the financial accessibility to this stuff, the bar set really, really high. That's why enterprises have budgets and they can afford it. You know, even for other IT providers are like, this stuff's too expensive for me to buy, to resell to my customers and then not to even mention the skill set to use it. We've figured that out. We've invested time and money into this. We've grown big, which is why we can utilize all this stuff. So for the small business, there's a list of, you know, five or six things and I'm happy to share that with the listeners and the viewers too. These are the basics that you need. This will actually even allow you to be underwritten for cyber liability, which by the way is now becoming part of general liability. So a lot of, I'm starting to see a lot of insurance carriers that won't even underwrite a policy, just in general liability. If you don't have these controls in place because they see it as a risk.

I'm going to write these down, these five things every small business owner should begin with. And then we've got to talk about this essentials that you're going to be rolling out.

Yeah, it's inexpensive. It starts with like 60 or 70 bucks a month per person. You know, because it's a bundle of these, it's, it's affordable, you know, versus is like our full blown reach out. One is like 600 bucks a person. And that's everything. That's all those layers that I was talking about, you Know, but when it comes to a company that's doing $10 million in business, you know, you have to. You absolutely have to. Or, you know, even beyond that is compliance. Like a steel fabricator, you think, okay, it's manufacturing, but if they're making aircraft carrier parts or the Department of Defense now, they have to, it's, it's a different level of compliance they have to have for cyber security, you know, and that ends up being like 800 bucks a seat, you know, but for 35 million in revenue spend getting that, I think it's, you know, around 600k a year or something like that. For that amount, you know, it becomes an expense that you need in order to continue to have the revenue you have. It's just a requirements, but. Yeah, I'll pull it up. And I'm actually pulling up a Google sheet right now.

Oh, I love it.

Google, Microsoft. But it's. This is in the works right now. So I'm giving you, I'm giving you good information, right?

No, I'd love it.

Yeah. The very, very basics are this is in order to have the capability being underwritten with most carriers now, dark web scanning and monitoring to make sure if your stuff's out there or not. You know, usernames, passwords, bank accounts. If it's on the dark web. Training, you know, which is phishing training. Yeah. And it's. When I say training, it's also simulations. Okay, so what happens is that this, these apps will actually send out emails, fake emails, to your entire company, even if it's five people. It'll, it'll grade people, people you know, on their likelihood to be the person. It's pretty bad. Like, like, here's your weakest link, you know, here's your. Bob, I love it. But then you can, you can hone in on a couple people to be like, okay, you need a little more education here, here's why, you know, and it's quite literally your job and everybody else's jobs depend on it. Then also there's email protection. Right? The, the usual stuff, spam, viruses, all of that. The stuff that's been around for years. Then there has to be. This one's interesting, whether it monitors Google or Microsoft, this detects fictitious logins from different countries, you know, so it alerts you. I don't have a name to call this yet. But what it'll do is it monitors the logs of either Microsoft, which is Outlook. Right. Your email, or Google and will alert you if there's somebody trying to log in from a country where they shouldn't be. So it's monitoring for the, for these bad actor logins from different places to make sure that it's legitimate or not. Because you might have people that are traveling, you know, in Canada or Mexico or even overseas from your company. You know. So it's like is this legitimate? And warns you of that because most of these. Now it'll also come from specific IP address within the United States because now they've gotten smart. Remember my story? I was bouncing around to different countries. Well now they're smart because they'll VPN into the United States into a data center and it'll look like that traffic's coming right from Texas or California. And that's where this, this login attempt is from. From. But this maintains a list of things to see if that's bad. You know, it kind of traces it back to the source.

All right, so we've got dark web scanning and monitoring.

Bingo.

Then the phishing training.

Got it.

Email protection. And then software for fictitious logins.

And number five, and the last is EDR that we talked about already. Endpoint detection and response, which is the AI. Wow.

I love this. We'll make sure we have a link down in the description everyone for you to check out this service and package and everything. It's just the reason why again and I think this is so important to share is so many small business owners don't know where to turn.

Yeah.

And they. It's. It's almost like a scam to try to get help with cybersecurity security. Get out there. Think they're buying good cybersecurity protection and they really aren't.

You can get these from. I had a fun real. Anybody who's an msp, as long as they can afford to buy this stuff and resell it. You know, that's, that's the, that's a downside because it's like the small shops, man. Like the one and two man shops. Which I know it because I started there. It was literally just me when I started the company for 14 years ago. And times have changed. It's like this stuff is expensive, you know, especially when you do it in mass. And unfortunately consumers or businesses cannot go direct to the source on these things. Yeah. And which is also a reason for the difficult financial accessibility. Like the EDR. If you go straight to the source. Sentinel 1 is A. They're a public company. You can look them up. Right. They're. They're one of the biggest providers and they're one of the best. Same With Carbon Black, we use sentinel 1 in our stack because they are one of the best. The minimum license count to buy directly from them is 2500. 2,500 licenses. Yeah. So it's like obviously a small business can't do that. A small MSP won't even do that.

Well, one other thing I've heard, and I wanted you to confirm for me if you, if you don't mind. And it kind of, it goes back to the, the TV show, Mr. Robot with Elliot. Crazy show because it seemed so far fetched. But I've heard that one of the biggest enemies are ourselves. Like we, we may implement some cybersecurity protocol, maybe not. But then we go to Starbucks the next day, sit down, get on an open network and, and start playing around.

Yeah.

And, and we just blew out all of our cyber security protection jumping on WI Fi. Is that true? What's your recommendations in that? Should you ever get on open WI fi or not?

I will say it's not a complicated answer, but I kind of put a dividing line because I will go to Starbucks and get on an open network. But when I go to Starbucks to get on an open network, I might be booking myself a flight somewhere. What I won't do is I won't open up Chase bank or bank of America America because that, and I'll use different passwords, different randomized passwords for different things using a password manager. You know, I actually have a pretty basic one for Netflix, you know, because I don't care if my Netflix account gets hacked. Who cares? Somebody's gonna watch, I don't know, Breaking Bad or whatever on me. You know, go for it, have a good time. Yeah, yeah, exactly. I use basic generic passwords for those because my kids share it, you know, everything else, whatever, but don't access information that you don't want out there. Sensitive information. When you're on a public WI FI network, an open network, what you can do is you can either hot spot from your phone is this is secure or you can use a vpn, one of those two things.

And do you have that? I'm sure as a cybersecurity specialist you have to know your enemy and their techniques. I mean, theoretically, if I jumped on an open WiFi network, could you pop up right next to me like Mr. Robot and go boom. I'm just going to look right into your computer and look at whatever. Is it that easy for a hacker to do?

It is there's a device that you need that, that, that, that happens at a lot of Starbucks and coffee shops these days. It's interestingly called a pineapple. I don't know why they've ever named it that way. Huh? Yeah, but it acts as an intermediary device. So if you go to, I think Starbucks is still provided by Google, right? The, the WI fi there, and it'll say Google Starbucks in the, in the WI fi name. You program the Pineapple to act as a, as a bridge which it'll connect to the real Starbucks. Open WI fi and it'll broadcast under the same name. But when you open up your laptop, laptop mark, and you, you connect to Google Starbucks, you're actually connecting to the Pineapple. So every single bit of your password, every password you type, every website you go to filters through this pineapple device for it to be recorded. You can't tell a difference because it also passes it on to the real fi, the real WI fi and then sends the website back. So it just looks like as it normally would if that bad actor wasn't sitting there drinking a latte. Yeah, but if you use a phone, your hotspot on here, or use a vpn, it puts a protective tunnel around on that where they can't see inside.

What just. What happened to the good old days where I just leave Starbucks and someone just holds me up by knife point?

Yeah, I know, right?

I've learned my Krav Maga. You know, I'm doing a little Liam Neeson training.

Well, I hear that still happens in Elgin, right?

Yeah, no, it's like all complex. I gotta like, you know, fight tech to tech, you know, I'm. Yeah, I'd rather get in the ring. Let's get in the ring.

I know. I feel you. I feel you. It's funny. Wow. Wow. Yeah.

Well, one last. If you could, if you had what you do, you've got thousands of small business owners watching this interview. If there's one thing you could tell them, just please do this. You don't know how dangerous it is out there. If this is your warning shot, there's one thing you want them to hear. What would it be?

Yep, two things really. Multi factor authentication. You can enable it on almost everything. Your bank accounts, Google, Microsoft.

I hate multifactor.

Everybody hates it. I get it. I hate it too. I ate it too. But it's a, it's one of the best things to protect yourself because nobody else has this in their possession. You know, it's something, you know, plus something you have. You know, it's very difficult for somebody to steal your phone and your password. At the same time, unless they're a

teenager living in your house.

Very true. Yeah. Oh, man. The second is freeze your credit reports. It's stupid simple, you know, that protects you against identity theft. And if you need to go buy a new Mercedes or something like that, you can just easily tap and unfreeze from an app on your phone. That way, nobody can.

I want to get number one, you said use multifactor actor authentication wherever you can. And then number two, freeze your credit report.

Bingo. You got it. Huh?

Okay.

Makes it very difficult for bad actors to get into everything that you have. And also keeps that layer of protection so nobody can open up an account in your name.

And then for business owners, what one third tip there, like the business owner with employees and data? I guess it's implement something. Some training at least.

Training is a big one. I mean, the six things that I gave you, that's kind of the baseline these days. There's a. There's no one thing that's going to protect you. You know, it used to be you could go down to Best Buy and pick up Norton. You know that. That's not the days of protection anymore.

You know, I just want an easy button.

Yeah, I do, too. You know, Rick, come on.

Everybody else move. Mark, what's the one thing to save taxes?

Well, yeah, Right on. Yep, My easy button. As I say, easy. Let me buy you. Oh, my gosh.

Well, Rick, this has been a pleasure. I. I'm so grateful for what you're doing out there in.

Thank you, brother.

Main Street. America, America. We need people like you. And I want to continue to share your information with my followers because we don't have many places to turn for this that's reliable and trustworthy. And thank you so much for sharing these tips.

My pleasure. Thanks for having me on.

Well, we're going to send more people your way, too. Everyone please get down below. Look at the description and all the links and the things that Rick has to offer. See if there's something that fits your small business. And you just cannot throw caution to the wind. Get on board, protect yourself, and keep living the dream. Thanks again, again, Rick.