Cybersecurity Essentials with Robert Scilliano

Hello and welcome back to the Owner Meeting Podcast. I'm Christian, your channel host today, joined by Robert Siciliano. Am I saying that correct?

That is correct.

Perfect. Robert Siciliano. Uh, he is a security expert. We're going to be talking about cybersecurity, how to protect your data. He'll say it better than I do, but this is so relevant to my companies and I've never spent time really focused on this niche that we really do need to pay attention to. So extremely excited to have you on the channel. I'm sure I'm going to have a ton of questions as will our audience. But Robert, tell us a little bit about you.

Sure. I am a, uh, Boston-based girl dad. I got a 17-year-old and a 20-year-old.

There we go.

With 58-year-old honey. And, uh, I, um, have been providing, uh, what is called security awareness training for 30-plus years professionally, engaged in security for 40 years. And, uh, I primarily spend most of my time, energy, and effort in changing hearts in order to change minds, to change behaviors, to get employees to care about managing risk.

Awesome.

Awesome.

So, managing risk, define that a little bit for us as far as your niche and your focus.

Sure. It's like every single time the phone rings, an email comes in, or you get a text message, is that— is the intention of that person on the other end of that communication legit? Are they trying to extract sensitive information, passwords, trying to get you to download or click something to infect your device? And most people don't look at these inbound communications like that other than if it's annoying them. But they're not looking at it for reasons of, you know, managing risk or security, which results in data breaches. You know, we have on average between 2,500 and 3,000 data breaches in the US alone every single year. Resulting in, at this point, probably 300 billion— with a B— records compromised of you and I and all of our information. And that adds up to about 15 or 20 billion passwords in the hands of criminals. And so, managing risk today is what to do with all that sensitive data that's out there on the dark web and how to, you know, react and respond every single time an inbound communication comes in. That—

okay, so I'm gonna, I'm gonna start this in, in backwards order 'cause I'm very interested in this. What do you do when the information's already out there? What, what options do you have? It's all your information's on the dark web, which I'm sure all of our stuff has been compromised at some point. Uh, what do you do after the fact?

So it's about making the data useless to the thief, right? So, um, I'll ask you, uh, if your password or passwords are in the hands of a criminal, what's like the cleanest, easiest way to make that password useless to a thief?

Uh, to change the password.

Change the password. That's the first step. And never using the same password twice. Mm-hmm. That's like really the most important part of that. Yes. Because most people are using the same passcode across multiple accounts, and that truly is the kiss of death, which with billions of passwords out there on the dark web, if you are using the same password across 20 different accounts, That means they have access to 20 different accounts. So it means changing the passcode for each and every of those 20 accounts, never using the same passcode twice. Another layer of protection on top of changing up your passcodes, never using the same passcode twice, is engaging in two-factor authentication. So most of us use two-factor authentication for one account or the other, usually for banking. It's like fundamental. You have to, you have no choice. But for other accounts, some cases email, some cases eBay or Amazon or whatever, you may not have to use two-factor authentication. But if the hacker has access to your Amazon password, another way to keep them out is to use two-factor authentication. That means they would need your mobile phone in their possession in order to get in. So between changing up your passcodes, never using never using the same passcode twice, and, and setting up two-factor authentication for every and all account. Use a password manager software. A password manager software generally is free to a small fee. I think I spend like $19 a year on mine. And, um, I've had it for 20 years and it's the most effective way to use and manage all those passwords you're gonna need. And also it assists in setting up passkeys for all your critical accounts.

Awesome. So in like the, uh, I know a lot of our companies, we use a lot of Apple products though, but you know, we have plenty of PC as well. Uh, like the Apple, uh, smart, what they do now, the strong password where it automatically creates a unique password and stores it in a wallet of passwords. Is that a, is that basically the same process?

Yeah. So you mentioned, you know, some people using Apple, some people using PCs, some people use both. And while the Apple password manager that from my experience has only been around for a few years, if that. Yeah.

It's relatively new.

Yeah. Which, which to me, that in and of itself isn't okay. And I don't find that the Apple Password Manager is entirely user-friendly. And the Apple Password Manager doesn't work on my Android, and it also doesn't work on my Windows machines.

Okay.

It works on my Mac and it works on my iPhone, but not really all that well. So once you engage in a true password manager that's ubiquitous across hardware, whether it's a Mac or it's a Dell operating systems, whether it's a, uh, Microsoft OS or, you know, iOS, or it's an Android for that matter. A third-party password manager works across all environments, which is truly what you want.

Perfect. That, that makes sense.

Okay.

So that's something that everyone in every company should just institute of like, hey, this is, this is something that we do. We have a password manager, we use this password manager, we use UniquePass. Codes, and we turn on two-factor authentication.

Exactly. And then what happens is, as a result of that, you become a tougher target, become a hard target. Right now, I would say probably, um, 90% of the general public, including many employees, aren't doing the basics. They're not— they're not changing up their passcodes, they're not using password managers, they're not using two-factor authentication. So if 90% of the population is engaged in poor cyber hygiene, And only 10% is secure. Well, that 10% is that tougher target. So to be in the top 10%, you don't really have to do much, but you gotta do it. The worst thing you could do is nothing.

Well, and I love this. This, so this actually ties very well into my niche. And you know, I, I, I do real estate, we do property management, we handle a lot of really secure data. But when you are trying to solve any crime problem at a property, all you need to do is make it marginally more inconvenient to be a criminal there than someone else. And magically what happens over the course of like 12 to 18 months, criminals start disappearing from the property and they go somewhere where it's easier to be a criminal. I assume that's pretty much true for cybercrime. If 90% of the internet's wide open, why would they bother trying to target the last 10%?

Yeah. Security is all about layers of protection. The more layers you have in place, the more security be— you're gonna be like in a physical environment, you might start with, of course, you know, locked doors. And then from there, various security systems that might include door and window break sensors, security cameras, and all of the signage to support all of the various technologies that you have in place. And so what you're doing there, adding all those various layers of physical security, you're making that an unattractive target for that criminal, whatever their motivation might be.

That makes sense to me. And it's something as little— and Like, it's one of the first things I'm guilty of. I hate the two-factor authentication. I turn that off on everything that's optional 'cause I'm like, oh, I don't wanna, I don't have to get in here and wait for a code and click a button. Or, but, but you're, you're right. It's the, it's the little things where it's like, okay, well, if they are, if we assume everyone already has some of your information, if you make that information more or less useless, you solve most of the problem right there.

Yeah. So, you know, cybersecurity itself is only about maybe 20, 30 years old. It's a relatively new thing based on, you know, how long we've had access to hardware and software and the internet in, in its entirety. And so it's not a, a very common experience for a lot of people because they don't wanna deal with it to begin with because of those inconveniences. Mm-hmm. But those inconveniences are no different than, you know, making better choices in regards to your diet, making better choices in regards to how you spend your money, making better choices in the relationships that you're in. And so forth. It's like these various facts of life, these choices that we have. Look, it's so much easier and simpler and sometimes even tastier just to get the fast food, but that isn't necessarily going to contribute to a long, healthy life. So you sometimes have to make decisions that aren't really conducive to making you entirely happy or satisfied, but ultimately are what's good for you. And security is, frankly, the best broccoli you can have. It's good for you. And so, when you engage in these basic one-on-one cyber practices and increase your digital literacy, you do become that tougher target and you make the bad guy's job that much harder.

Outside of the basics, the blocking and tackling, the two-factor authentication and so on, unique passwords, what are the most common traps that you see, especially in the corporate environment where you'll have employees that leak sensitive data? Is super relevant to me as, you know, we have a lot, we store Social Security numbers, we have applications, credit scores, job history, all this stuff happens with applications. We process a lot of sensitive data in my companies. What are the most common and fixable things that you see on the employee level in small and mid-sized companies?

So the main thing is the fact that most organizations aren't engaging in the basics. They're not engaging in the one-on-one stuff like we just talked about. That's one thing. The other thing is all companies at all levels are under the guise of both state and federal rules and regs in regards to compliance. And if you're not doing these basic things and there's a data breach, then you ultimately end up in a class action lawsuit. Okay? So if your organization, let's say, is infiltrated and you can't show due diligence You're looking at, you know, thousands of dollars per record compromised, which means essentially class action lawsuit. And that can bankrupt certain organizations. And so the basics generally include what's called phishing simulation training, at least as a form of awareness training. And beyond that, it's all the hardware and the software and bringing in what's called a penetration tester. Like an ethical hacker who runs, you know, vulnerability software across your network to determine, you know, where your vulnerabilities are, what hardware and software updates and upgrades can you engage in that ultimately make you compliant. And then from there, you engage in that security awareness training, which usually is phishing simulation training. And that by itself is necessary to essentially defend the organization from phishing. And it helps with the compliance aspect of things. However, what we see today is lots of what we call security fatigue caused by that compliance trap, essentially bombarding employees with these complex impersonal rules that trigger security aversion. Like, people really don't want to engage in security to begin with. And so when you engage in basic compliance training, you're just making it more and, or less attractive, so to speak.

Yeah.

And so that it, it leads to this false sense of security felt by meeting these various regulatory requirements while actual human behavior remains unchanged and vulnerable. And the employee still clicks the links and responds to the phone calls and the emails, right? Mm-hmm. And while the phishing simulation training is necessary, it's only really designed to fix the problem of phishing. And what it fails to do is address the human, the employee, where they're at in both their personal and professional lives. And it doesn't really make the employee care about security. And also, how do we fix that? Well, we fix that by changing up the dialogue. And changing up the dialogue means trying something different than you have been. So that once or twice a year of compliance-based training essentially is putting the cart before the horse. You're not actually talking to the employee where they're at in their personal lives. You're not making security personal to the employee. Like, the employee first and foremost cares about themselves. What's in it for me? That's human nature. That's how we are. Self-care is fundamental and primary to us. Self-ish or self-interested creatures is what we are. And so, when you engage in personal security, the core belief that people protect what they love, like, you know, securing their child's digital footprint, protecting their own identity, managing their own passwords, protecting their own money, right? You essentially create more secure employees at work, right? And this is really done by engaging in a dialogue to begin with. Like, I get in front of a live audience and I ask 100 people, you know, how many of you are using a different secure passcode across all your different accounts? If I get 10% of the room to raise their hand, that's a lot, you know? So 90% aren't, and I know this, right? And I ask the same question in regards to two-factor authentication. It just shows how many people aren't engaging in the basics. And once you start showing them, oh, and did you know there are about 20 billion of our passwords on the dark web? And then show them that, like, literally go to the dark web and show them the data. All of a sudden they're like, whoa, like, I didn't know that this program was gonna be about this. I thought it was gonna be you hitting us over the head with a hammer about our company and, and how we have to protect company data. And I could care less about that. But what you're saying is this is about me and how I protect myself and my family. I got questions. I wanna know now, what do I do?

Yeah.

Okay.

And so, and so just putting the context in like, hey, where is this relevant to you? And then why does this apply? It's making it relevant. Through the correct communication is essentially what it is.

Plain and simple. And we do this by talking about what I have developed over the past 30 years of doing this. It's called the Strategic Human Firewall, right? Mm-hmm. So if you're already paying attention, if you're already managing risk, if you're already like fully aware of the email and the text message and the phone call when it comes in and what its motivation is, and you see the BS behind it, then you already have a degree of what I call the strategic human firewall. If many of us don't, which is too many people, then you need to kind of update and upgrade your cyber hygiene and your digital literacy. And the strategic human firewall is all about blocking deception. It's like this proactive governance. It's a mindset that turns us employees, consumers from what I consider passive targets which is most people, into active detection layers. Like they're looking for it. You know?

Mm-hmm.

It's a shift from, like most people, they, they just fundamentally trust what they see. They want to need to trust by default, which is all of us. Yeah. But it's the shift from, I trust what I see by default to I verify everything. Like I'm really paying attention, like I'm looking for it. You know, I don't worry about these things. I just do something about it. And so that leads to what we call Security Appreciation. And Security Appreciation truly is the shift from basic awareness, which is like knowing, to appreciation, which is like in your heart, which is caring. You know, it's when employees appreciate how security protects their own lives. Like you said, we're just reframing it. And when that happens, behavior changes permanently. I call this the Security Appreciation Gap. It's that chasm between an employee's, like, intellectual understanding of risk which is awareness.

Yeah.

And the emotional commitment to act on that awareness, on that knowledge, which is truly appreciation. And that results in what we call the kitchen table effect, which ultimately is like this multiplier effect where successful training ends with the employee teaching the concepts to their family at home, cementing those lessons for life. You know, try that with like regulatory compliance training. It, it just doesn't happen.

Yeah. Oh, what a cool con. How did you get into this space? You're super passionate about this. Where did this start for you? Where did this passion— was it an individual event? Is it something that's just always been interesting? I'm curious on the backstory on this, 'cause you, you're very passionate about this.

So I, you know, when I get off the platform speaking in front of a live audience, 100% of the time somebody asks me, so how did you get into this?

Yeah.

Like, what are you like, former CIA, Secret Service, law enforcement? Where do you come from?

Yeah.

I'm like, brother, I come from the streets of Boston. Literally, that's where I got my chops. So at the age of 12, there's a few different things that happened that kind of shaped my understanding of the human condition. At the age of 12, I think I'm probably twice as old as you. I'm guessing I'm 57. And when we were growing up, our parents would open up the door at like 6, 7, 8 o'clock in the morning, let us outside. We wouldn't come back till it was dark. And when we did, we'd be filthy, bleeding, bruised, you name it. The fact that we are alive today is a small miracle. From what we did, what we consumed, how fast we drove, we should all be dead. But we survived. I don't know how we did it. That said, my dad gave us a very long leash and he let us do whatever we wanted. And so I remember at the age of 12 going into downtown Boston on the train and we get off the train, me and my little brother who was 8, and we got mugged and beat up by 5 kids who took all our money. And I didn't know that that was a thing. And so I go home all beaten and bloody and bruised and my dad's like, whoa. Today he explains to me, you were the rabbit and those boys were the wolves, right? And he went on to explain like lions are true predators and gazelles are true prey. And I was like, whoa, okay.

Yeah.

All right. I didn't quite fully understand what he was talking about, but it began to make sense over time. And about a year later, I was 13 and I met a girl at summer camp. She was like my first crush. And we liked each other and we're holding hands on the bus one day. We get off at her bus stop and we're sitting on her front stairs and mind you, like, this is like 45, 46 years ago. And she says to me, um, all kind of solemn, you know, emotional. And she says, my mother's boyfriend assaulted me. I just think you should know that. And I didn't quite understand what she was talking about. So I go home and I ask my father, dad, You know, what is sex? What is rape? Because I had no idea what she was talking about. Mind you, again, 40-something years ago, kids didn't know about that stuff. We didn't have porn. We didn't have VCRs. We didn't have VHS. We didn't, we didn't have any of that. If anything, you might have found a Playboy in the trash on the walk to school, you know, like, that's it, you know. And so when I learned about the birds and the bees and sexual assault and being a victim of a multiple attack situation a year earlier, all of that had a profound effect in the way I viewed the world. It just truly did. And so I gravitated towards professions revolving around personal security, and I started teaching self-defense and karate and stuff. And in my mid-20s, 1995, I got an IBM PS/1 consultant, which was the make and model of a Windows 3.0 machine that had 150-megabyte hard drive, and I had to buy an additional card to connect to AOL for the internet. And I had the ability to accept credit cards over my AOL connection. And within a month of connecting to the internet, I got hacked in '95 and I lost thousands of dollars in credit card fraud, like back in the day.

Yeah.

And I did not know that that was a thing. I didn't know that, that, that, that was even possible.

No, you may have been the first person to ever be credit card hacked.

It was like, it was a big deal to me because I lost thousands of dollars. And for me, that was like an overwhelming amount of money. But as, and, and my business at the time was personal security as it relates to violence prevention. Yeah. And so now this happens to me. And I'm like, and like violence prevention is also like personal security is, is, is theft in violence prevention in the physical world. Mm-hmm. And so now I'm stolen from over AOL. And so when that happened to me, as I investigated it, as upset as I was, I was just like enamored and amazed at what they did. Like what they did was awful, but it was kind of awesome. Like what they did was awesome. Like they stole thousands of dollars over a dial-up connection to AOL. Like, that's awesome. You know, how'd they do that? And so my thing has always been reverse engineering the bad actors' process, how they choose their victims, how they accomplish their goals. And so when I started to study that, I started to see this is gonna be huge. Because if they could do it to little old me, they could do it to anybody. And they started to in a big way. And around that same time, municipalities, cities and towns started to post Social Security numbers on the internet because they were posting all of their information on the internet to make it accessible to, you know, their constituents.

Yeah.

And so when that started to happen, identity theft started to become a real problem. Like when they get your social and open up new credit cards under your name and I started to see identity theft rising significantly. While I'm talking about this, it's like just blossoming all around me. And hackers used to hack for fun and fame, and around that time they started to hack for financial gain. And so I rolled out right along with that, was like right in it, like my feet were already wet and started to talk about it. And here we are, like, you know, 30-something years later. And I've written 5 books about it, and I've done every possible major media you can think about. Like, I've done The Howard Stern Show a couple of times, Good Morning America, Nightline, ABC World News Tonight, Russian and Chinese television. I mean, you name it. And because, like most organizations, media, they don't know who to call when it comes to this stuff. And I'm the guy they, they, they reach out to.

What is it funny how some of the best business models and it starts from something very, very simple and logical. So you went from physical self-defense, which makes sense, especially with your background to like, hey, this is new and this is a threat that is, it's interesting, terrible, but it's sincerely interesting. And I love the way that you've attacked this. So, so far my takeaways are most of the defense against this is just the basics. It's the blocking and tackling and it's the awareness more than anything. Are there any, especially with the, the rise of AI, are you seeing a material impact since AI has been a thing in the last 6 months to how we attack security and how, more importantly to me, how criminals are using it to obtain data?

Yeah. So AI is, as you know, I mean, it is awesome and its capacity, what it's capable of is amazing. And I've been saying for 30-something years, like at the end of every single one of my presentations, listen, like don't worry about any of the things I've just talked about. As long as you do something about it, you're gonna be fine. However, I am now officially worried and I'm worried because AI, deepfakes, voice cloning, at this point is pretty much perfect. You know, like you can't really tell real from fake anymore. You know, I mean, there was a day when like, you know, you could tell that it was like, you know, computer-generated imagery through like Pixar or something. Now it's just so perfect. And so AI has truly stripped away the clumsy red flags of traditional fraud is what it's done. You know, in the past, criminals relied on what we would call blunder force phishing, you know, mass blasting, uh, emails riddled with scammer grammar, right? Today, mm-hmm. AI allows for high precision impersonation at scale. Truly, uh, criminals now use what we call neural puppetry to create perfect lies. And by scraping just seconds of audio and a little bit of video from social media of you and I, uh, they're using voice cloning and full-blown deepfakes to impersonate a trusted source like a spouse, a CEO, an attorney, a politician with truly 100% accuracy. And what this does is, is it weaponizes, it truly weaponizes our, yours and mine biological default to trust, making the deception 100% human. And so we as humans have what I call the human blind spot. Mm-hmm. And the human blind spot truly is like the psychological instinct to trust what is familiar to us. It, it is that cognitive gap where biological trust overrides suspicion of any kind, including digital suspicion and AI deepfakes. And it leaves the door wide open for all kinds of deception. Think of it as like this biological default to trust in the psychological shortcuts or the heuristics that criminals use to bypass human logic, like biological impulse that we all possess versus intellectual understanding. It's like that internal conflict between our evolved survival instincts and our modern knowledge or lack of knowledge of digital risks. We are what is considered an interdependent species. We depend on each other for our survival. Man needs woman, woman needs man to procreate, to further the species. That requires that we trust each other by default. And so every time the phone rings, every time an email comes in, every time a text message comes in, we impulsively want to biologically need to trust that people are generally good, that they're not going to harm or hurt us. And so we go, we go throughout the day, week, month, year, lifetime. Trusting by default. And so criminals know this and they use our biology against us. They weaponize it and they know, like, if you make the story real enough, then they're gonna be able to get access to you in, in your behavior, in your biology, and make you do things that you wouldn't normally do. And 100% of the time, When people are scammed, when it's all said and done, 100% of the time they always say, how could I be so stupid? And the reality of it is, is you're not stupid at all. What you are is a loving, caring, empathetic human. And what the criminals do is they take advantage of that biology and they use it against you. And it's not that you're stupid. It's that they just understand what makes you choose and decide what makes you, you know, click that link. Because, because crime at this point, fraud, internet crime is a business and it's, and it's, it's, it's ran by organized criminals that use social psychology and our biology against us, which is, which is sensible.

So the things that you do is you go into this aware. And that does solve a lot of the problems. If you just go to, yes, you can be an empathetic person, but that is how people are going to be attacking you. And AI is, of course, it learns this and makes this easier for them to implement and to message. There's a lot that's going to be happening here, especially in the next few years as all this technology develops, where people just need to be more aware.

So the Strategic Human Firewall, that governance, that mindset utilizes a technique that I speak to, and it's called the AAA protocol. So if you wanna be safe, you wanna be secure, you wanna be aware, right? You wanna go forward, um, as that human firewall, engage in the AAA protocol, which is analyze, authenticate, and then act, right? Basically analyze means recognize, and you, you've seen this before, manufactured urgency. Every phone call, every text, every email is the click this link now, or else call this phone number or else your account's gonna be charged. You know, engage in this text message or you are gonna be fined and lose your driver's license. Whatever the BS might be, 100% of the time it revolves around manufactured urgency. So, yes, analyze it, recognize it. And the moment that manufactured urgency might request, you know, secrecy or immediate action. Stop. Just stop what you're doing. You know, your brain is moving into emotional reaction otherwise, right? Take a breath, move back into analytical thinking. So once you analyze it for what it actually is, what's the motivation of this? What's it doing to me? What's it trying to accomplish? Mm-hmm. Then you authenticate. So analyze, authenticate, act. Authenticate means identify, like, the digital mask, so to speak. You know, treat every digital communication as a potential breach. Right? Look for the technical and biological red flags of that deepfake. Okay? And then ultimately act. And act means generally, like, if you determine that, okay, this is just total BS, not gonna bother. It's not my state Registry of Motor Vehicles sending me a text message because I'm going to lose my driver's license if I don't pay a fine. It's just a known BS scam. It's not my employer telling me that I need to click this link in order to get paid this month otherwise, or this week otherwise, you know, I'm going to lose my job or something ridiculous. It's like, this is ridiculous. Yeah. And you, you, you act with what's called out of band verification, which essentially is never using the contact information built into that inbound phone call, email, text message. Don't use that phone number. Don't use that email address. Don't click that link. Like, use an out-of-band form of communication, like hang up and call the person back, or go to the website that you know is legit, or use a pre-validated number that you know is okay before you, you know, get hoodwinked.

So a perfect example that happens to me all the time. So I, I moved from Seattle to Texas for weather, for business, for a whole lot of reasons. And I get the same, it's about twice a year, I get the same scam text. That's first indicator, the area code is from the Philippines. Kind of weird that the Department of Licensing would text you from the Philippines. Well, they say, hey, your license about to be, You have unpaid parking fees. You need to click this link and pay them. Otherwise your license will be suspended and all. It has the urgency. Now they think that I live in Washington. I, that one's an easy one for me because I have no vehicles that I own that would be driving in Washington State for any reason. It's an easier one to spot, but it hits all the red flags like, oh, did I park somewhere that I wasn't supposed to? I'm not aware of a parking ticket. You immediately, if you don't give it critical thought, I could see someone being like, oh, I need to click this link and I need to test this, or I, what, where, where did I park is your first thought. Not why would they text me a link from the Philippines and why would I get my license suspended over a parking ticket the first time I'm ever hearing about it? It doesn't always need to make sense, but I see people get scammed all the time. Another quick example that I see all the time, identity theft. I, a bunch of the communities that I own, we have 80 units, 45 unit senior living. I see the identity theft there. It's multiple times a year, every year when you don't have the technological literacy, you didn't grow up with how we get attacked today. It's easy to be duped. And then like you said, it doesn't mean you're a bad person. Just, it happens. You need to be aware.

The main issue with that demographic that you speak of is that the baby boomers are the most moneyed, the least technically savvy. Uh, they're the most trusting generation left on the planet and they're being targeted, uh, by multiple, multiple scams. That generation has amassed about $120+ trillion in wealth, and that wealth is currently being transferred. It's the, it's called the greatest transfer of wealth in human history. It's happening right now over the next 10 to 15 years. That generation is transferring all of their wealth as they pass to, you know, Gen X, Gen Y, millennials, Gen Z, whatever, you know. And that money, that demographic is the target for a lot of the scams that we see today. And most of those, most of those people like my dad aren't engaging in, you know, effective password management or two-factor authentication. Um, they don't have what's called a credit freeze to protect their identity. And so forth. They're a huge target, but there's so many basic things that they can and should do that those of us who are somewhat responsible for that generation, like I pay attention to my mom and my dad to make sure that they're doing what they're supposed to do to manage and reduce risk. So I'm kind of on that on purpose because they're my loved ones and I gotta make sure that they're okay. And we collectively as a community should be doing that for them due to the fact that we are a bit more technically savvy than they are.

Yes, I absolutely agree. As you're going through all of them, you've been doing this for decades now. I'm gonna ask the stupid tax question a little different than I usually do because you've experienced so many other people's businesses and you can summarize, you don't need to drop any names on this. But highest stupid tax that you have seen someone pay for not doing the blocking and tackling and the basics in your career, what has been the most expensive mistake and how can others avoid it?

You know, the way that I understand or would answer that question is like, as a small business person, as a solopreneur, and I've been doing what I do virtually for over 30 years, is hiring vendors or consultants or pseudo experts to engage in business processes that I don't quite understand to do the jobs that I know need to be done in order to build or manage the business.

Yeah.

And ultimately money is wasted. Because I don't know enough about what it is their expertise is in order to determine if they're doing a good job or not. And so you end up, or I end up, uh, spending all this good hard-earned money on experts that suck at what they do. And because, because I don't know enough about what they do to begin with.

Yeah.

So I think with, with— before you hire anyone for anything, I think you have to have a pretty good working knowledge of what it is that that expertise is. And you should know enough about it that you could do it yourself, but you hire someone that you know has a certain talent to do it better. That's when you hire somebody, whether that's sales or marketing or social frigging accounting, it doesn't matter. You need to hire people that are excellent at what they do, but you need to be really good at it to begin with.

Love that. Now, if someone wants to learn more from you, they want to book you as a speaker, they want to ask questions, they want to engage, what is the easiest way to find you and where would they go?

Well, certainly I'm always providing updated content on my LinkedIn newsletter. I got tens of thousands of followers there. So just search me, Robert Siciliano, S-I-C-I-L-I-A-N-O on LinkedIn. LinkedIn or just on Google. And otherwise, my website is protectnowllc.com. Again, protectnowllc.com.

Oh, that's amazing. That'll be linked below in the show notes, or if you're watching on YouTube on Multifamily Strategy, you guys can check that out in the description below. As always, interviewing owners of businesses that do the things that you want to do or that directly complement your business so that you can learn this while you're on the road. Driving, uh, wherever you're at. Like, subscribe, listen for more, and we'll see you on the next episode.