Simplifying Cyber Safety for Everyone with Sandra Estok

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about the importance of simplifying cybersecurity for, well, for the benefit of everyone. And I get the absolute pleasure in talking with Sandra Estik. And Sandra is the founder and CEO of Way2Protect, She's an author, cybersecurity expert, board member, and TEDx speaker. Welcome, Sandra. Thank you for coming and talking with us today.

Thank you so, so much. I'm just delighted to be with you, Matthew. It's just been a while.

Well, it's an important topic. I mean, cybersecurity is not just a technical endeavor, right? I mean, attackers often pursue people to either gain access to valuable systems or to to directly victimize them. And this includes companies, of course, adults, but also children. Social engineering attacks target people as that weakest link. And our industry is realizing that people are safer when they're properly trained and handled, trained to handle such online attacks. So it's a pleasure having a conversation with you because I know, and And I've got your books. You are just neck deep into all of this and what the industry is doing well and where we still need to grow. So my first question for you is really what drives you to focus on behavioral and cognitive security issues?

Oh, I love this question because This is the difference between seeing cybersecurity as a one-time, I have to do this, I'm dragging to change my password, updating my phone or any, you know, anything technology related, to seeing cybersecurity as a way of living. And I think so for me, it happened in 2005 when I relocated, my company relocated me from Venezuela to the United States. And I, you know, I made it to the US. I, you know, I grew up in Venezuela with a challenging childhood and making it, you know, to the US and having a company to relocate me and my family was like a, you know, my dream coming true. And I moved to Milwaukee, Wisconsin. So from Venezuela.

Okay. Out of all the places, Milwaukee. All right.

So yeah, a place where, um, Yeah, the weather is kind of something. So I, after literally surviving my first winter, Matthew, and the key word there, surviving.

Yeah. Yeah. It's the only place Minnesotans can make fun of. Exactly.

Exactly. Exactly. And, um, so I went back to South America and I visiting my family and I'm returning home. Landing in Miami when the captain announces that Homeland Security is boarding the plane. I don't think of anything, Matthew. I'm like, sure. And I hand my passport to the two Homeland Security officers, and all of a sudden I'm the only passenger march off that plane, march off that plane. And, you know, my life literally flip upside down because a criminal stole my identity to smuggle women into the US. And just like that, for 6 years, I have to live that nightmare that almost broke my marriage, my career, my mental health. Now you ask me the question, then, you know, what drives me? It's— I did— I didn't know anything about cyber. I was in technology, I was in IT, I had a background. I— my whole life was, uh, an infrastructure person. I always, you know, behind the curtain. Um, so I had no idea about any of this, and it happens to me, and I navigated that experience pretty much, you know, so afraid, feeling powerless. Like, you know, there were feelings I never experienced before. And, you know, just every time you— I crossed through a TSA agent, I have to prove I was the real me. And that happened. My job required me to travel. I mean, you know, when I Googled my name, everything was in Chinese. It was a very, very, very difficult time for me and my family. And 6 years later, I became a US citizen and I shifted my career to cyber. So to me, it was the moment where like somebody turned the lights on in my brain and I could understand what happens. And what drives me is I don't want anyone to go to what I went through, or worse, because today it's even— I mean, in that, at that time, 2006, we were not seeing the type of attacks or the type of, um, devastating consequences that we see now with children, with families, with, you know, with everything. And that drives me every day, you know, that connection, deeply connection to cyber safety and cybersecurity that, that allows me that when I share my story, it's not just my story, it's everyone's story. You know, how many of us don't get a text message with a package notification you never asked for? I get those off-job offers every single day. I want this rise that I never play. I mean, over and over, and we're exposed. And I think, to me, everything that I experienced and everything that I overcame now has a purpose, and it drives me to, to be in the two recipient sides of the industry, whether as a victim but also as a, as an expert that can speak to What can we do? And what can we do in a way that is not overwhelming, that is not going to— you don't have to become a technical person, or you don't have to be a geek. You don't have to. There are things we all can do. And you mentioned something, Matthew, that I wanted to just to talk about, because we have seen humans as the weakest link. And in the industry, sometimes we talk about that. And I always say, you know, it's the opposite. You know, humans are the highest opportunity that we have in the industry to prevent cybercrime. Like, you know, the human side of us can definitely become that difference in a company that If an employee sees an email and it's weird and it's like they can really, really see this maybe even faster than some of the systems and they can notify, they can report it. And when, you know, you have so many limiting resources in an organization, in cybersecurity teams, but when your workforce becomes that other layer, like that first layer, now you have an entire organization. If you have 20,000 employees, now you have 20,000 employees is caring for your cyber safety or your cybersecurity. So that's why I see, you know, the shift that we need to make in the industry to see people not as the weakest link, but they are the largest attack surface.

Yeah, and there's a tremendous opportunity. And just as you said, I mean, employees or workers, anyone that you're trusting, and that could be suppliers or vendors, they can be your weakest link or they can be your most powerful asset as well. Not only to prevent but also detect, alert, contain, respond, recover. If they're all part of that capability of the cyber team, it helps and it makes a massive difference. I've always said I would rather have a security-savvy workforce than a stack of firewalls because it can make such a difference on so many levels.

So true.

And it sounds like your background, you know, the experiences that you had, you got to feel, not just learn, but feel what it's like to be a victim and the swirls and the other complications that it potentially can bring. And I know in your career you have written books, you've got your company. I mean, you've pivoted from that IT expertise and expanded it out to really drive cyber. I mean, what are some of the biggest challenges now in this space? And do you think it's the attackers and their innovation? Do you think it's new technologies like AI? Do you think it's just a lack of understanding on behalf of us security people or companies that this is an opportunity? What do you think? What are the big challenges here?

You know, I think it's a combination of all of them. I think You know, when I love new technologies and I, I'm, I love AI.

I am like, I was playing with it earlier today, you know, all sorts of stuff.

I like, you know, it's like you have a cell phone. We all have a cell phone. And now we like, I cannot think about leaving my house without my cell phone. It's like, oh my God, I can't. So, but when I was growing up, there were no cell phones and I, you know, I made it. So I remember the phone booth.

I remember rotary dial phones. Yes.

Yeah, I remember they call, like, do you know, they, they do have to put a coin and you have to dial it. I, I, that was me.

It used to be a dime when I first saw them. It was a dime to make a call.

So, oh my goodness, you're dating us, Matthew.

Oh yeah, yeah, we should cut this from the, yeah, we don't want people to know that.

But my point is, um, Technology is this fascinating tool, and it's another way to make us more human. So one of the challenges that I see in the, you know, sometimes if you see technology as the enemy, if you see technology as something that you have to drag and you have to do things, it's boring, or is this, or it's that. I think that's one of the biggest challenges, seeing technology just as a tool that can allow me to be more human, as a tool that can allow me to be more productive, more, to learn more, to do more. And I think the challenge that I see is the disconnection sometimes that we have in the way that we consume technology, that we consume social media, that we consume you know, how we interact online. So in the industry, you know, you have a lot of people that are very technical, that are amazing, that have incredible skills, but when they try to communicate, it's so complicated that it's overwhelming to someone that has no idea about technology. And, you know, the biggest challenge that I see right now is how do I How do I engage someone with technology or with cybersecurity, with cybersafety, with anything and make it relevant to them and make it something that I actually want to do, that I don't have to drag, that I— it's not a compliance base. It's not that if I don't do this, my employer is going to, you know, I'll be in trouble. You know, one of the things that I see we do in the industry, and it's a trend that, you know, it makes me think so so much because you— we do these phishing exercises, right? We, we fish people and we, you know, and some people see that, are you tricking them? Yeah, we want to train them, but how we're positioning training is when you click that link, what do we do if you click so many times? If we don't do this, you have to do more training. So you are positioned— we are positioning training as a punishment tool. Like, if you don't do this, I'm gonna give you more training.

So, or it's gonna go in your employee record, or your manager is going to be notified, or we're going to put your name on the ugly board.

Uh, exactly. You know, so I think that, you know, that's a challenge that we in the industry have to see the difference and start using language, start using techniques that allow anyone, not just technical people, you know, to relate to technology and to want to do the right things. And, you know, every single time I'm speaking, I was doing a speaking engagement recently and I wanted to do something memorable, something that people will remember, relate. And I took, you know, that you can buy fake money, right? You can buy these hundreds of hundred, you know, $100 bill prop money. And I put that large amount of money in one side, and then I put 1, 2, 3, 4, 5, 6 in the front of that money. And then I wrote password, and I wrote these Simple words. And I say, you know, here is your savings, here is what you have to— like, every month you have money that goes to your bank account. Is 1, 2, 3, 4, 5, 6, or password, or, you know, my, my, my dog's name strong enough to, to hold, right? An attacker, a criminal, so my money still there. Is that strong enough? And you give a visual when you're like, oh my God, yeah, that's the password that I use.

Or when you say it's way too easy, it's not secure. No, no, I don't want that stack of money of mine to disappear. Which goes back to the relevance, right? You're saying you have to have relevance Yes. I love the creativeness as well, right? It's the visual. It's the very visceral understanding. You also mentioned kind of the positive aspects, not just focusing on the negative.

Yes, absolutely.

Also the positive.

Absolutely. Because we are, you know, we either are running from pain or we are going towards enjoyment, right? You want to have something that makes you feel good. Like, who doesn't want to be happy? Who doesn't want to be Feeling smart, feeling confident, like those are good feelings. And cybercriminals, I call them cyber monsters, by the way, but cyber monsters have created an incredible ecosystem where they play emotions.

Oh yeah.

They are experts in humans and their hot buttons. You know how, do you know how That human manipulation. Yes, you remember that, um, easy button that was, um, uh, from Staples? It was red. Oh, the easy, but the red easy button. Remember that? So that's, you know, it's easy. So they have mastered how to manipulate, and it becomes easier for them. And then train, and they have staff, and they have, you know, they are an organized entity that focuses on emotions and how to play those emotions. So I think in the industry we use— we don't use the same tactics in the, in the same effective way. We scare— we want to scare them. Well, we want to tell them, don't do this, like, don't go fish, like, we, we want to emphasize the badness that happens, you know, with cybercrime, rather than if I use your emotions and I use emotions that are pleasant, emotions that makes you feel good, emotions that have something nice that you can get home and that you cannot wait to share with your family. If we start seeing cybersecurity that way and embed messages and embed, you know, the content in a way that is beautiful, that is appealing, that it speaks to that person and how that person can relate to it, then now we are in the even field because the emotions that are being played or used by cybercriminals, we can use them to to highlight more cybersecurity, you know, training, behavior, skills, et cetera. So I'm, you know, I am fascinated by this. And this is an area where I focus a lot.

Well, basic psychology tells us that negative reinforcement or punishment is less powerful than positive reinforcement.

Absolutely.

And yet our industry, cybersecurity, very quickly has gone down the path of, "I'm going to punish you. I'm going to give you negative reinforcement. You are breaking the rules. You are breaking the policy. There are consequences. Don't you know you're putting people at risk? You should feel ashamed. You should be embarrassed." And we are lessening the message, unfortunately. We have an opportunity to encapsulate it in a positive way for a greater overall impact and effect. And the attackers are doing this, right? Because you've just won the lottery. Yeah. You've just got a new package that you didn't expect. You've got all these things and they're leveraging that positive emotion to get people to click on things, to respond, to share sensitive information, whatever it is. So we are either knowingly or unknowingly, you know, not maximizing our opportunity to shift behavior in a more constructive and secure way.

Absolutely. Yeah, I couldn't agree more. Beautiful set.

So what kind of— I mean, because you're mentioning tapping into people's emotions and all sorts of people, right? What kinds of personal harms are you seeing come about nowadays with these successful attacks? And you had a phrase, right? You didn't call them cybercriminals, right? You called them cyber monsters because some of those attackers aren't even necessarily going after money.

No.

Right? You may have cyberbullying or something like that. I mean, what are you seeing and has there been a shift over time for better or for worse?

Yeah. You know, I think you asked early, you know, what is the biggest challenge? You know, the biggest challenge that I see that aligns with this question is the adoption of technology. Cybercriminals don't have to comply with company policies. They don't have to— they don't have to—

Only.

They don't have to do anything. Like, they can just— there is this new tool available. I can use it. Boom. Right? The adoption in that criminal sphere is so much faster of new technology. And we are seeing with AI incredible technology technologies, like, you know, deepfakes are so close to reality. Now you could see so many things that, you know, you have to be very, very, very intentional, very present right there to recognize that it's not true, that it's not real. Because, you know, the AI has become such an amazing tool and technology that can mimic reality you know, very close, you know, and you see scenery, you see pictures, you see incredible art being created. So criminals are exploiting that so that if someone is not aware, someone is not aware that, you know, that's AI or it can be done with AI, they could easily think that, you know, that phone call It's my aunt or my son or my grandpa, you know, someone I care. And now I'm hearing their voice and I could even see their picture. You know, even in the dating side, you know, romance scam. Before we always told—

Huge.

Yeah.

Big butchering. It's a major industry.

Yeah. And we used to say, hey, you know, people are like the disconnection. They are not going to be on you know, on camera, they are gonna be like horrible. Now they don't have to do that. They can— and someone really nice, the lips are almost perfect. They can see someone that is not the same person that is actually in the background. So, you know, it's harder. And then you, you can script, and you can now have social media, and you have so much information about you that you can even customize all these different things to things that are relevant to each individual. So, you know, I see that those are the things that I'm seeing a lot. You know, I'm seeing more attacks and I see them on myself. Like I see, I get a lot of phishing, a lot of spear phishing.

I mean— Lucky you.

Oh yeah, exactly. And I'm like, you know, playing to my ego. Like I'm always nominated to be the best whatever in the world. 'You know, the best entrepreneur, the best woman, the best this, the best that. You just should click here and see how amazing you're doing.' And, you know, whether it's that, whether it's your book if you're an author, if you, if you are a business owner, it's about your business. You know, it's something about you that obviously it's available outside and it's publicly available, and that that message is being crafted to you specifically. And, and sometimes, you know, I'm like, man, this is so good. Like, I— if I didn't know anything, I would click on this.

If I knew that level of personalization is powerful, and you need new technology like AI to be able to do it well and do it at scale.

Yes.

So yeah, that is definitely one of their advantages. And, you know, they don't have to go through a full QA cycle or meet some regulatory requirements. They can take a new tool when it's fresh, not even out of beta, and go, "Let's try this. If it breaks, whatever," right? So they definitely have that advantage.

Yeah.

So what can adults and what can children do to become more security savvy, to understand how these new innovative technologies may impact them? Because again, if, you know, you trained your parents and told them, you know, be wary of the emails that have misspellings in them and don't look right. Modern AI will make it perfect and sound perfect and create perfect logos. You can't use that as a benchmark anymore. So exactly how can adults and children be more savvy?

You know, I always, I love this question, Matthew, because I ponder in this. And the more and more I see technology advancing, the more I think it's going back to basics. It's going back to being humans. It's going back to being you and cultivating your inner, and I call it inner cyber, your inner cyber wisdom, your inner cyber flow, your inner cyber knowledge. And, and you know how many times— let me, let me ask you before I answer that question fully— you know how many times have you answered the phone or seen something and you're— there was like a, a voice inside of you that told you like, no, that is not true, or that is not this, or that is not that, and you shut that voice. You're like, shh, like, no, like, they're either the fear because the other person that is doing the social engineering is so good that it's overpowering that inner voice, or it's you because you're so excited about, oh my, no, it has to be true, I really won the lottery, I really won the lottery, it has to be, it has to be true, or this is exactly the job. So I think, you know, when So when we learn, relearn, or remember how to recognize that voice and how to cultivate that and how to lean more on, you know, being present. Like if you are right here right now and I tell you, hey, you know, give me your Social Security and you are right there, you're like, why am I going to give you that?. But if you are distracted, you're texting, your kids are running around, you're cooking, something is burning, and somebody asks you to click, you're more likely to do that.

Yeah.

What, right? So I think it's going back to that and how do we teach that and how do we, you know, create a new way of seeing cybersecurity as a way of living. And that's what I said at the beginning, you know, you cannot do it one time and be done. This is a way of living. It's like, you know, a diet. You know, if you do a particular diet— and I've done so many— and then lose the weight, and then you gain the weight, and then you lose again, you know, and you're like always in that game, right? Until you realize, you know what, I'm done with playing the game. I'm just gonna eat healthy. I'm just gonna do this for my, my life, and I'm gonna choose wisely what I'm eating, what I'm drinking, whatever. And then you have that different perspective, and now you're choiceful about what you're eating, right? In the same way with technology, you have to become choiceful. What am I gonna do online? Am I, you know, I'm gonna spend, you know, 20 minutes and I time myself If I'm going to social media, I'm like, I'm gonna put the timer and I have 10 minutes to catch up with what's going on. And because time, you know, you get— and then it's like an hour pass and you're like, whoa. Um, you could do, you know, simple things like you, you could have conversations as a family and you can, you know, create dialogues that are more on they just don't do this or don't do that, don't click here, da da da, but more about make it a trivia night, you know, have your family and, you know, get together and see who can bring the most creative or the most funny phishing email that they got and take a screenshot and they can talk about that. You know, there's so many things like I always do with my husband that I'm like, oh my God, can you believe this one? Like, "Look, da da da," and we laugh and we make it something that I celebrate every single time that I recognize a phishing email because—

That's awesome. I mean, those kinds of thoughts. And so, let me recap, right? One, you know, you had mentioned listen to that little voice in the back of your head because it's there for a reason. If you're walking in the parking lot and you look down a dark alley and that little voice is saying, "Don't walk down the alley," There's probably a reason for it. That same little voice eventually also gets trained for our digital world. So, listen to the voice. The other thing you mentioned was be present in what you're doing, right? Don't be distracted when somebody's asking you those. And the very best con artists are going to try and get you distracted or excited or not thinking about the consequences. So, you have to be present. And lastly, you brought up, you know, be disciplined, be purposeful in how you engage with our global digital ecosystem and everybody that's out there. And applying these can help us better understand and realize, hey, wait, wait, that's dangerous, right? We can't do that or we shouldn't do that or we should take it to somebody else. You know, let me go call Sandra and see what she thinks. And that's okay, too, right? Bring in experts to take a look. I get plenty of calls from family and friends and everything, and they're like, hey, I saw this. I'm like, yeah, don't touch that. Don't do that. And it's great when my employees across the company or my executives, I even have board members send me a message and go, I got this. I'm like, yeah, don't respond. Don't click. Don't.

Yep. Yep.

Bad. Just bad. I'll tell you more later. Let's get on the phone, but don't do it. So, you know, I think these are all, you know, great coping mechanisms to help us.

Yeah.

But my last question for you is not for the individuals, right? And you covered some of the challenges that we all have, but this is for the cybersecurity leaders out there, right? What, what are the best opportunity right now for them? Because I guarantee every company, every organization, it probably can get better, most a lot better. But what do you think is the one thing that a cybersecurity leader, after listening to us, that they can go do in a tangible way to help their organization be more resistant to these types of manipulations, attacks, and victimizations?

I love that. You know, I think make it personal. And I go back to the beginning and I will say, you know, as a CISO, you have a big job. Obviously, you have, you know, your team, you have your, your the responsibilities, the budget, the projects, obviously risk management, all these different aspects. And sometimes when you see a cybersecurity organization and the CISO, you see them like, oh my God, this, even in the IT world, because I was in both sides. I have been working in the IT and the OT and the cyber. So I kind of see from all different angles. And I remember how I used to I see cybersecurity people, you know, from that perspective, and I see them like they are the people that stop my projects if I am in IT, right? They are the people that always say no. They are the people that, um, oh my God, I don't want cybersecurity people because they always try to become a block, a roadblock to my project, my whatever, my idea. So that's sometimes in IT how you see them. In OT even more, because IT and OT don't sometimes are on the same page. And then you have the end users, right, that don't even understand IT or T or cyber because they are like, I'm just in marketing, I'm finance, I just want to do my job and I just want to go home. That's it. So what I will say to any CISO and to any cybersecurity leader is when you make yourself available at a personal level. And I did this with a company, um, and I'd done it with a few, but this one was really successful because the CISO was willing to put also himself as a vulnerable person. And, and we did a, a webinar for, uh, I think there were about 5,000 people online watching. And he— I share my story, you know, I didn't give you the whole details of my story. There's so many juicy moments on that story, but I gave you the highlights, right? Um, and then he shared a story, and then everyone in that chat started to share their own story. And it was like so— like for an hour, people were getting together, they were talking, they were like interacting. And after that session, the engagement, you know, now I want to know more, Lao, tell me, you know, how can I do, you know, what can I do for my family? What can I do for that? That's what I say, make it personal, because the first thing that we want to protect is our, you know, closest, you know, things that matter to us. And our family will be there, you know, you have want to protect your children, you want to protect your family, you want to protect your spouse, yourself. And when you learn to do that, you are protecting the company. So, when you make cybersecurity personal, right, and you put yourself as a human and you share, you know, from your perspective as a, not as a CISO, as a cyber, but as a dad, as a mom, as a sister, as a daughter, as a you know, anything, and you relate to that, suddenly changes the conversation. So it doesn't cost you anything. It does not increase your budget, because I know that we are always worried about, oh my God, it's gonna cost me more. No, it doesn't. So if you do something, if you do, you know, whether it's a breakfast, whether it's a company, you know, communication something, but you make that message relatable. You make that message something that people can care and that can connect to. I think that that will be the first advice or the first action that I will encourage CISOs to start taking, because we can get overwhelmed and it can be very busy and we can get into metrics and dashboards and all these different things. But at the end of the day, if only take a person to click in a link or to put a USB, and even if you have a lot of protection and a lot of tools, there are things that can compromise the network in a very easy way. And instead of seeing that human as that weakest link or as that person that could risk put at risk the entire organization. See it as a person that can actually be your eyes and multiply your eyes and the eyes of your team.

I think that's fantastic advice, right? Building that relationship in a positive way and reinforcing the relevance among your employees and contractors and even suppliers and vendors, right? Because they do have that some level of access. Truly outstanding. Thank you so much. Sandra is the founder and CEO of Way2Protect. She's an author, an expert speaker. She's also written several cybersecurity books for children and adults. I'll put the links in the description, and it's really about communicating safe practices in easy-to-understand ways. So be sure to check them out. And again, Sandra, thank you so much for sharing your cybersecurity insights today.

Thank you, Matthew. I'm delighted. And to everyone that is listening, just remember, you know, it doesn't supposed to be stressful. It's supposed to be a journey. And even if you take a simple step, just tiny, tiny, tiny step today, a tiny, tiny step tomorrow, and then at the end of the year, at the end of the month, you're not going to be in the same place that you are right now.

So, and thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.