Cybersecurity Issues That Will Keep You Up at Night

Phishing attacks, using email or malicious websites to infect a computer with malware and viruses in order to get personal and financial information is on the uptick. These cybercriminals are finding ways to lure people in to their networks in order to do a lot of damage and take systems for ransom. On the podcast today, I am speaking with Mark Hoffman, who's a senior crisis management and business continuity here consultant. He is an expert in cyber security response. So if you are someone that needs to learn a little bit more about cybersecurity, my hand is raised. Then you will want to listen to this week's edition of the Confident Communications podcast.

Foreign.

Hello, Mark Hoffman, and welcome to the podcast.

Thanks, Molly. This is a real pleasure. You know, I'm a big fan of the podcast, so it's nice to be here.

You got caught up on the word there. Pleasure. Were you going to say honor and you just wanted to reel that back and just say pleasure?

I didn't. I didn't want to get too mushy, too early.

Too mushy, too early. I understand. Well, I should say Happy Cyber Awareness Month. That's how I'll start off.

I think that they've picked October to be Cyber Awareness Month because it coincides with Halloween and they tried to find something as scary as possible.

Is that true? Is that true?

I think it's true. I just made that up. But it's what I think.

I don't think. Well, I don't know. And the reason why I'm speaking to you is I don't think a lot of people think about cybersecurity until it happens. But it did make me think, you know, why October. But heck, I'll go along with it. Someone at some staff meeting said, what's the scariest time of year? Let's just do it in Halloween, during Halloween.

I think you're right. I think you're also right that too many people aren't thinking of it until it happens. And spoiler alert, that's too late.

It does happen. And the first time that I can say that this was probably a big news story. Where I noticed it the most is when John Podesta, who was the chairman of Hillary Clinton's campaign back in 2016, is when he opened up a phishing email in his Google account. That really started the whole Russian problem. And one could say, why we are where we are today all came from that email. Now, Mark, were you in the business then when all of that was happening? I assume it was recent, but do you remember that Happening?

Oh, sure, yeah. No, I was in the business. I remember it happening. And you're right. And if you look at, it's a perfect example really, because if you think about the, the downstream ramifications of a single click, it, it's, it's, it's lingering. Right. It's something that can affect you for a long time.

Okay, so then let's talk about this. First of all, tell us what your experience is when it comes to cybersecurity and why you are where you're today. So tell us a bit about yourself.

Well, I started in it. I come from an IBM background and from there I sort of moved into the area of disaster recovery, where we spend time planning for the recovery of key systems and making sure they can get stood up, you know, in, in a reasonable time frame. And then from there that sort of expanded out into the world of business continuity, which is more focused on the end user and what their critical functions are and what things they need to do in order to keep the business running. The natural progression from that is into the world of crisis management. And you can't do crisis management without considering cybersecurity.

So many, and you and I know this, so many people lay claim to a crisis management consultant or I work in crisis communications. There's so many people that do that. But the success I find in people that specialize in it is when they can hon specific problem and then that business becomes their niche or their niche. Since I'm speaking to you in Canada, where you can, you will specialize in an area and when it comes to crisis and crisis management, where there is a critical need and, and, and this, and the idea of cybersecurity, again as a, as a big category, I think it scares people, but they don't really know how to dive in. But when you bring it down to that consumer level and you realize how all it takes is just one person that could, you know, bring down or really stop an organization or a business cold because of a cybersecurity breach. That's why they need a good plan in place, correct?

No, that's exactly right. And it comes down to training and awareness. Make sure your people are aware. You know, phishing business email compromise is one of the main areas right now where the, the way that people are gaining access to systems and to networks and you know, you see something that looks intriguing, you click on it and the next thing you know, it's too late.

Now, I, I started with John Podesta when he opened up that email and when we Think of a big business or in the case of the campaign, that was a huge machine. But is cybersecurity, is that something just a big business needs to worry about or should like a small or medium sized business be concerned about it as well?

It's, it's something that we all need to, to be worried about. I read a report just last week that said that almost two thirds of all of the successful major attacks were laid against small and medium sized businesses. So you know, if you think about that, when I, when I hear small, medium sized business, I think anything from 5 to 10 employees up to 2 or 300 employees. And if you, if you think about companies of that size, they're just not going to have the same resources. They're going to be a little bit more limited when it comes to the number of people that they can throw at a problem. And also a lot of times the skill set, they won't have the expertise that they need. But the scary piece of this is that of those companies that were attacked, the ones that did not have cyber insurance, 60% of them did not survive the attack. I mean, that's a scary number. You want to talk about Halloween spooky stories? That's a scary number. And when you think about, you know, a smaller company, they also have a smaller margin of error. The average insurance claim of a business email compromise, according to one study I read in a company that I work with, is around $70,000. So you know, a $70,000 hit against a multi billion dollar company is just going to be a drop in the bucket. But a $70,000 hit against a smaller company, you know, maybe their revenue is in the half million dollar range or something like that? That's a significant impact?

Oh, of course. And would you say that most companies already have insurance for that or are many vulnerable that they don't?

There's vulnerabilities from a couple of different standpoints. Some companies still don't have cyber insurance or they have it and they don't understand it, or they don't understand the limitations of it. So I like to tell people there's four things that they really need to think about when it comes to cyber insurance. And the first is to understand the scope of the coverage. What's covered? Is it data just in your main data center? Is it data that's stored on mobile devices like phones and laptops? You know, is it, is it data that comes from, you know, other satellite locations and things like that? So I want people to really understand the scope of their coverage. But then the other side of that is I want them to understand the exclusions of the policy. I was doing a review of a cyber policy for a client just last week and I came across an exclusion that said that any vulnerabilities that were the result of a mobile device, like a phone or a laptop, that was not encrypted, any breach as a result of that, would not be covered by the policy. So I sent a note off to the head of IT and I said, hey, first of all, were you aware of this exclusion? And second of all, are you encrypting your devices? And it was no and no, he wasn't aware of it and they were not encrypting their devices. So there's a major vulnerability to their company. Somebody left their laptop somewhere or dropped their phone or whatever and it got picked up and there was a breach as a result of it, they wouldn't have been covered. It's also good for companies to understand, you know, what added value that the insurer might bring to the table. So, for example, a lot of times an insurance company will offer you additional services, like a breech coach, somebody like me who can come in and help you navigate through whatever the incident is, or external legal counsel or privacy counsel, or communication specialists and things like that. So it's really, really good to, you know, understand what kind of services they're going to offer you. And then the final thing, and this is really important, is we really need to understand who has ultimate decision making authority. So if we come down to it's a ransomware situation and the company and the insurer differ on whether we're going to pay ransom or not, whose decision is it? Ultimately, I understand that the cost of that, of paying that ransom could come out of the insurance policy, but the effects from a reputation standpoint against the company also matter. So it's really important to understand these things. So cyber insurance is really important. I think it's very, very, very critical to have somebody on your crisis management team who is very aware of the ins and outs of the policy and somebody who can liaise with the insurer at time of crisis.

Okay. So in terms of that's preparation and that's preparing for any type of attack. And when you had mentioned the mobile phone, when I think of cybersecurity breaches, I'm always thinking about someone sitting at a comp. But of course, people are opening email more and more now on a phone. So is there a different type of breach that you would see in a laptop over a phone? And is that why the insurance companies recognize that and they separate the two technologies?

It's a similar threat. So yesterday on the train coming home, I got a message from someone who included a YouTube video in the message that says, hey, this looks like you. And my first thought was, okay, first of all, I don't even know this person. And second, you know, secondly, there's no way I'm clicking on a link that I have no idea what it was. But let's just suppose for a moment that that was a malicious link and some type of malicious code could have been downloaded into my phone and it could have locked my phone. And so, I mean, that's no different than whether it's somebody sitting at a laptop opening malicious code in an email or somebody sitting at a desktop computer. It's the same approach, but the vulnerability of the device matters because these mobile devices can be left behind and it can open up a different kind of vulnerability. Right? You could leave it accidentally drop it out of your pocket or whatever.

Okay, so now to let's bring it down to a real basic level for listeners who aren't as familiar with the vernacular of phishing and what it means. And let's go to the why people are now becoming wise to what in a phishing email looks like. And I do want to go over what some of those indicators are with you, but just separate why someone, why there would be a breach? Because many people you know are spam filters. If you look in your spam filter, you're going to see these phishing types of emails and some are to have a virus that comes into your computer to infect your computer. But what are some of the reasons and are they different for just the day to day user compared to someone on their business account?

So, you know, phishing is an attempt by an external party to get you to click on something that's going to cause harm to your computer or to expose data. So the vulnerabilities vary, but they can be anything from locking down the system and that would turn into a ransomware attack. They like to use the term, they turn it into a brick. So that means your computer is really worthless. The only thing it's good for would be maybe as a doorstop or a paperweight and you just can't use it because it's locked up.

Okay, Mark, so let me ask you right there again, because you are well versed in all of this and, and, and I'm not. I think a lot of my listeners probably have this come at it the same way That I do. So there's. When the map. When the malware of the virus comes into a computer and turn it into a brick, there are just some. Some viruses out there that. That is the sole reason why they're doing it is just to shut down a computer, or would you say that most of it, most of those. The viruses coming in is because they want to collect personal or financial information.

I would say it's a split. But remember, it's not just so that they can lock up your computer. The end goal here is to get paid so that they'll release the computer back to you.

Okay, so there really. Because there is a distinction there. Because when people worry about a virus coming in and I've had a computer that's been infected. Is the lesson here that most types of viruses or malware, eventually there is a cyber criminal behind it, like they're trying to get to your personal information? Correct?

Yeah, that's a good assumption. As a matter of fact, there's services available on the dark Web where it's ransomware as a service, literally, where you can hire it out and have someone infect a target's computer for the purposes of getting paid for it.

Okay, so then for a user like me, if we hear or see a suspicious email and we worry that there is some type of phishing involved, it's safe then to assume that someone is trying to collect your information. And that's why you should take it seriously. It's not just some virus that will shut. That will. That will clog up your computer for a couple days. Just go ahead and assume that someone is trying to collect your information. Correct.

Well, I would think that you would want to take the most cautious approach possible. Yeah, I mean, it's possible that it's a nuisance virus or something like that, but, you know, I have a client that received an email from someone who was posing as an executive in the company, and they said, I'm sorry, I'm having trouble opening this file. Can you open it for me? And when she opened it, the. The next message that came up was, please enter your user credentials in order to continue. So she thought that she was logging back into the network and needed to provide the credentials. And next thing you know, she has now given the hacker her username and password to the network, and, you know, a significant vulnerability existed and a breach occurred.

Oh, now, just that example that you gave me is what happened locally? I'll say semi locally. I don't want to pinpoint it. But where it. Someone got into the School district. And when I heard about this, my. My immediate thought was, why would someone want to get into a school district? It's not like there's a lot of money there, but is this shows that vulnerability where it's not just a. A bank, for instance, or someone that has a lot of funds. So you can hold content. Ransom. Ransom. It really could be anyone, correct?

Oh, it can be anyone. As a matter of fact, right now, there's a huge sort of threat to municipalities, city governments, and I could rattle off a whole bunch of them. But there's one here locally that was. It's a small municipality, and it was a $35,000 ransom, which isn't a huge sum. But the way it was handled kind of makes you aware of the fact that they weren't prepared from a crisis management standpoint on how they were going to respond to it. And I'll give you an example. I'll use this as a case study at a group I'm speaking to next week. So they ended up with a severe ransomware attack. All of their key servers were locked. Many of their systems were down for as long as seven weeks, and they finally ended up paying the ransom. So the fact that it took seven weeks is the first clue that they weren't quite as prepared as they should have been. But the next clue for me was what the city official told the media after they got their systems back. They said that the ransom seemed like a small price to pay. Does anything in the communications consultant, in you kind of tingle when you hear that?

Yes.

And also they said it would have been a lot more if they had to rebuild their systems from scratch, because they were in that position. So there's a lot of, you know, preparation that needs to go into how we're going to respond to a cyber attack. And one of the things that we like to build is a good communication strategy. And when you do the communication strategy, there are certain things you don't want to say, and. Like that, you know. Yeah, like. Like that. That would be a good example of.

What not to say.

Yeah. But then before you go on, there's one other. Like the city of Baltimore. The city of Baltimore was hit with a ransomware attack somewhere in the range of $100,000. They chose not to pay it. And at last count, they're somewhere in the neighborhood of $18 million of internal and external costs trying to rebuild their system. So, once again, have a plan. You can't make this stuff up as you go, because if you do, it is not going to Go.

Well, okay, Mark, so now tell us about a plan then. What should something, what should an organization do? Like, what can they do to be more effective when it comes to responding to a cyber attack?

So I had posted something on LinkedIn a couple of weeks ago that talked about the need for a two phase approach to cyber response. The first is what you always think of when you think of cybersecurity, and that's the technology stuff, the firewalls and the intrusion detection and all of that technical stuff that those guys do. Critical, absolutely necessary still needs to be in place. But the thing that's missing is a predefined crisis response plan with a focus on cyber. So what you want to do here is you want to make sure that you've identified your roles and responsibilities. Who are we going to bring to the table? What's their, you know, their primary focus going to be? And make sure that it's, you know, covering all of the key aspects that you need. So you're going to have a cybersecurity expert at the table. You want to make sure that you have your legal and privacy people there as well, somebody to liaise with the insurance company. You'll bring your insurer to the table, which is a little bit different. When you tend to think of crisis management, we tend to think of huddling up, you know, internally. But there are, you know, a lot of benefits to making sure that you have a seat at the table for the insurance company. You need to think about, you know, what your communication strategy is going to be. And that includes things like how are we going to handle notification, what things are we going to offer people who are breached? It could be credit monitoring and things like that. What kind of regulatory requirements do we have as far as notifying a privacy commissioner or data protection officer and things like that. But the thing that seems to be missing the most, and one of the things that I really enjoy doing with, with clients is getting them to think about some decisions that they're likely going to have to make. In a cyber incident, for example, the elephant in the room, are you going to pay a ransom? Well, I don't want you to think about it for the first time when you're staring at the screen that says your systems are locked and, you know, a hacker is demanding, you know, $200,000. I want people to think about what their default position is going to be when it comes to paying ransom and base it on your company's core values, your principles, your risk appetite, your reputation of how it's going to be perceived if you do or if you don't pay the ransom. But give consideration to things that could move you off of that default position. So for example, you might say, no, you know what our default is, we're not going to pay ransom. And then you run into a situation like this one municipality who had no choice because there's no way they could recover, and you say, okay, well that could move us off of that default position. But there are default key decisions that need to be, you know, given consideration to ahead of time around paying the ransom, engaging law enforcement communication strategies and things of that nature. And most important, once you build the plan, practice the plan, because the plan will document what to do. But if you don't know how to do it, you're not really that much better off.

Now, Mark, you're making my head whirl and spin because you are connecting all of these pieces about this idea of phishing and malware ransomware and you're finally connecting the dots for me, at least in my head, and why organization organizations and small, medium sized businesses should be concerned about it. Now, where your job intersects with mine and my work, you know, I'm, I work a lot in reputation management for organizations and I'm telling them be more transparent. You know, put information out there, your customers, your members, they want to be able to reach you. And so many conversations I've had where I tell them you need to put emails online on your website so your customers know how they can reach you. Now is the reason why you have someone will have difficulty finding someone's email as at an organization, is this one of the reasons is because of anti phishing efforts so people don't target employees?

Yeah, I think that's exactly right. You certainly don't want to advertise, you know, opportunities or areas where people could reach somebody, you know, in your organization. As a matter of fact, there's a way to work around that though. Instead of just posting somebody's email address and opening it that way, if you want to be transparent with that communication, you can have their tools that you can use on websites that contact us and things like that, where it's handled through the browser rather than coming in through somebody's email. And that could mitigate that vulnerability a little bit.

As long as there is some type of email on there where it could be a general email where it will go into a system that someone could contact someone online. But we don't want to put like for instance, teachers or a director from a board of directors. We don't want to put like a so and so at Gmail on a website. Correct. Because then there's a vulnerability there.

Yeah, I would stay away from that practice.

So now we've heard from you the why. You know, you've scared everyone into why they should be prepared for for any type of cyber attack and who is at risk. Now when something happens, how should an organization be prepared? What should they have in place to be concerned and to prepare for any type of ransomware attack?

I think the main thing to take away from this is you can't make this stuff up as you go. You have to have a documented response plan. You need to know who you're going to bring to the table with clearly identified roles and responsibilities. You need to develop a communication strategy ahead of time, making sure you know who's responsible for drafting the communications, who you need to reach out to, what your notification procedures look like. And then I want you to give some consideration to what decisions you probably are going to have to make during a cyber attack. The one everybody thinks about is are we going to pay the ransom or not? Well, you know what, that's up to you, but you need to give some consideration to that. Pick a default position on it to say whether you're inclined to pay or to not pay a ransom. But don't do it emotionally. Make it based on your company's core values and principles and your risk appetite and your thoughts around reputation and you know, go through a list of things that you think you're going to have to make decisions on and establish a default position for each of those. And the biggest thing is to practice the plan. A well rehearsed plan will save you money in the long run when it comes to being more efficient, having better communications, it'll protect your reputation better.

I like that you brought in the idea of removing the emotion from any type of tack because of course when someone's being threatened, it's obviously going to touch a nerve and it's going to touch, you know, emotional feelings and what in your like you need to find out and you need to decide what is your value, what is your value system at your organization and your core value about an attack? Now would you say, and maybe I'm reading into this, but should most organizations, if they are under attack, should they just give in? And since they, if they have insurance and should their core value be to protect the customer at the end the.

That's a great question.

It's hard to answer correct. Like you can't tell someone how to think or how to react. But is there a more risk averse if you take the emotion out of it? What really should if you want to automate the process, what is the best plan of action just to get us up and running as quickly as possible and protect our customer?

Well, the, the objective is to mitigate the impact to the, to your company. Yes, get them up and running as quickly as possible, but to do it in the right way now. And that's going to vary based on the attack and based on the circumstances and based on the company and the industry and so forth. So one of the things that's happening right now is with the advent of cyber insurance, more and more companies are moving towards paying the ransom. Why? Well, because it doesn't come off of their bottom line. The insurance companies cover is covering it.

Ah, there we go. Okay, that's interesting. Yes.

But the FBI just this week has put out a request to people to say look, stop doing it that way. Because when companies are more inclined to pay ransom, it's just more encouraging for the hackers and it becomes a business model that says well we might as well attack because we know they're going to pay the ransom.

Uh oh, I spy a problem. So what is an organization to do?

Well, be prepared. Make decisions based on your core principles, practice them, be aware of what you want to do and put yourself in a position to be able to make quality decisions at the time of, based on, you know, your, your company's core values and the facts at hand. So that's why it's critical to have a response plan in place that gathers the proper information, brings the right people to the table and has given consideration ahead of time to what these decisions are going to look like.

And that person needs to have crisis management experience, business continuity experience. And that person, Mark Hoffman, sounds like you.

It looks a lot like me. Yeah, I think so. This is what I absolutely love to do. I'm a bit of a, of a nerd when it comes to this stuff. So even though it's my job, I, you know, I'm always reading about it and doing all kinds of things. I absolutely love doing this.

Well, you were going with nerd. I was thinking you would be more like a superhero because you're coming into to save the day.

Not all superheroes wear capes. Is that what they say?

Yes, some are crisis consultants. Well Mark, you honestly, I'm sure listeners got so much out of this because I mean you and I have spoken before but you are triggering so many thoughts in my head and Also reconfiguring how I am looking at just this idea of transparency because this is a very serious issue for organizations so small, medium or large. And so if you want more information on Mark Hoffman, you did mention it briefly, but you are on LinkedIn and you have a crisis management minute, which is a video which I've watched, which I think is incredibly helpful. Correct. You're still doing that?

I'm still doing it, yeah. And I'm getting better at it. Right. We're not all communication experts like you, Molly.

No, but you're drawing people in. You, you talk about real valuable tips about. In terms of this entire idea of, you know, anti, you know, phishing and just malware and ransomware and cybersecurity. I mean, no offense, cyber security as a name is kind of dry and boring. Like people just like their eyes, you know, go at half mask. However, if they listen to the stories and the risks that are out there and the vulnerabilities and how these vulnerabilities can just start with one employee at an organization and it can bring down the whole system. So, Mark, you've offered so much valuable advice on the podcast, but you are also offering even more advice by. You gave me a don't be too quick to click document on some of the tips, anti phishing tips to prevent these types of breaches in your organization. Can you tell me a little bit about it?

Yeah. The idea of don't be too quick to click, which is more of a tongue twister than I would have thought, is just basically, look, business email compromise is on the rise. It happens when we open up something in an email that looks intriguing and we click on it and the next thing you know, we're either on a website that's got malicious code or we've downloaded something into our computer. So, you know, the 10 tips there, anti phishing tips are meant to just put these things front of mind. It's all part of training and awareness to help close the vulnerability and just make us a little bit smarter about the things we do when it comes to our email.

Yeah. And the first one on your list, if John Podesta read your list, it was check the sender's email address. That would be the first thing that you would want to do. That's usually the tell when, if you know that the email is legit or not. Correct.

That's the quick part. Right. Because a lot of times we'll look at it and we'll say, oh, this looks interesting. And you click it without even really evaluating it. And you know, in the tips, it talks about looking for things like spelling errors or grammar errors and things like that. But the main thing is if you see a link and it's supposed to be to a bank's website, for example, and then you hover over the link and it's taking you to some other site somewhere else, do not trust it.

All Appearances says this looks like an official email, when in fact it's not. It's quite dangerous.

That's right. Sure. The example I shared a few minutes ago was a client. The email looked like it came from her boss. Right. You have to be very careful.

Yes. I mean, yeah, that's scary. That's scary. Well, Mark, thank you for spending the time to share the wisdom and just these concerns and risks that are out there and why organizations should be compared. Mark, do you want to tell us how people can reach you?

One of the things I absolutely love doing is building relationships with people. So if you've listened and you've listened this long to the. To the podcast, thank you. Feel free to reach out to me on LinkedIn and connect and I'll definitely connect with you. And if you feel like you need some help in this area, you know, absolutely, reach out. I'd be thrilled to help you.

Oh, that's wonderful. Well, thanks so much, Mark. And yeah, happy Cyber Awareness Month, Mark.

Molly, I was honored to be a guest on the podcast.

There you go. Now you're a true PR professional. Thanks a lot, Mark.

You're welcome. Thank you, Molly.

I want to thank Mark Hoffman for joining me on the podcast today and for shining a light on cyber security. I had him join me today because this month is National Cyber security awareness month. BCybersmart. Now, if you want more information about anti phishing tips, Mark had mentioned a cheat sheet that I'm going to have a link to in the show notes as well as the website. So if you go over to Molly mcpherson.com Episode 51 with Mark Hoffman, you can download his free cheat sheet. Don't be too quick to click. And it comes with a great list of anti phishing tips that you can share to your staff on how to prevent any type of cybersecurity breach at your business or organization. Thanks for listening.