Cybersecurity Resolutions for 2023. #31

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being.

So let's get at it, and welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano, and this is Peter Wormka, the Spy. The Spy. He is the Spy and I am the security guy. And Happy New Year to you, Peter, and Happy New Year to all of you.

Yes, Happy New Year. Let's sure hope that 2003 is better than 2002, and I think it will be.

Yeah, 2000, uh, Peter, it's 2023.

What have I lost? I lost 20 years. Oh my gosh, like Rip Van Winkle.

Yeah, you're retired. You have no You, you have no commitments to anything, so as far as you're concerned, it doesn't really matter what, what year it is.

Every year in some way, every year in some way gets better because we learn, right? We're always learning new things, even, you know, whether we're reading or learning from other people or we're experiencing life, we're learning things of how we can, uh, help improve our lives and help others.

We learn, we grow, and as we grow, we need to learn more as our body and our environment and everybody around us changes. And, uh, the beginning of the year— end of the year, beginning of the year— is when all of that often comes into play, especially in my environment when I have a, you know, 14-year-old and a 17-year-old, and I have a 55-year-old you know, honey that is constantly changing.

Uh, and so yeah, that's why we start out the new year with, uh, resolutions. I don't know if you have any yourself. Some people, I mean, talk about them. I, myself, I mean, I used to, I used to every year have resolutions, but unfortunately they don't last very long. And so what I decided, instead of focusing on January 1st being my day that I'm going to launch my resolutions Um, I find myself doing it multiple times during the year. I'm not going to wait until the first of the year to start new. I'm going to try to start every day new, right? And however I can improve something.

Well, we definitely have resolutions for y'all today, and they revolve around, in this case, um, resolutions to fight fraud, and from our friends over at fraud.org. We have 10 New Year's resolutions to in fact fight fraud. So we all know the traditional New Year's resolutions: saving money, going to the gym, eating more greens, which, you know, I do all that. And fraud.org wanted to offer some novel resolutions to ring in the new year. So first one I thoroughly agree with, and I'm fully engaged with already, and I know you are too, Peter. Is resolve to use multi-factor authentication. And for those of you who don't know what that is, and if you're a subscriber to this pod broadcast, you should, uh, it's essentially when you are required to provide an additional code, uh, you're prompted via, uh, after entering your username and your passcode in your browser, and then you might possess a key fob and/or your mobile device, and you get a text message with a one-time passcode. You enter that one-time passcode, and that gets you access. That is the, the phone in this case, the— your text message is that multi-factor, that second-factor authentication.

Doing that increases your security. It's amazingly— I mean, it really does. It's a, it's a simple thing But it really enhances the security tremendously.

Tenfold. I tell everyone that, you know, all of your critical accounts, obviously banking, it's by default. All your social media has to have it. Twitter, Facebook, LinkedIn. And then for me in my life, you know, Amazon, PayPal, eBay, any and all accounts that allow two-factor authentication, I immediately deploy it. And how do you set that up? Well, it's real easy to do. You do a quick Google search for, say, Gmail, right? And then two-factor, and I even spelled it improperly, and look at it, already pops up showing results for Gmail two-factor. And right there, turn on two-step verification at Google, uh, support.google.com. And you know, there it is for myaccount.google.com and so forth. You can do the same thing if you search, say, for all you dinosaurs, AOL and help.aol.com, add two-step verification. You could do it for PayPal, eBay, Amazon, you name it. It's an absolute no-brainer. And even if your password is in the hands of a criminal, they can't access your account if you have two-factor authentication set up.

The only exception to that would be if they had cloned— I mean, it can happen, right?

But if they clone your phone, and SIM swapping is not easy to do, although it is doable, um, but really for 99.9% of the population, that's nothing to be concerned about right now as long as you have two-factor authentication set up for your mobile account, right? Then you should be pretty good there because that will generally keep the bad guys out. I've had two-factor authentication set on my mobile account for over a decade now, and that keeps the bad guys out. And then all of your knowledge-based authentication questions you might have built into that mobile account to reset the passcode, take care of those as well. Update them, make sure that they're all working functionally and so forth. And then make sure to take data breach notifications seriously. While they may seem like a nuisance, carefully reading Any email or letter stating that your sensitive information appeared in a data breach may be critical to safeguarding your identity against financial harm. So very recently, just this week, I think Dark Reading talked about how 200 million Twitter email addresses, basically, you know, part of your username, were compromised. Which means that 200 million Twitter users are likely to be getting emails posing as Twitter. So if Twitter sends you out a notification that there's been a breach, then you should read through it so you understand what the risk is in regards to that particular breach. In this case, your email is compromised in such a way where bad guys will pose as Twitter, email you and say, hey, it's time to reset your you know, passcode in Twitter because of this particular breach. But again, it's the bad guy sending you this email, and when they do, you're going to go to a spoofed website that looks like Twitter.

Yeah, they're, they're leveraging the trust that you have with, uh, you know, with any— with whatever brand it is, right? In this case, it's Twitter. It's a brand you have trust in it, and you think it's a message automatically from them when, uh, they're leveraging that trust Yeah, it's just a matter of, you know, reading any breach notification that you receive and abiding by it to whatever degree.

If it asks you to click links in the body of the email, I would not. I would go to your browser and do a quick search and/or go to your favorites menu and/or go to your password manager.

Okay. Uh, any, uh, Robert, do you have any feel or information regarding what percentage of the population, when they do receive some sort of, uh, you know, notification from a provider regarding a breach, what percentage do you think actually take some sort of measures to better protect themselves against what could happen? I would say it's less than 50%. It might be less than 30%.

Peter, you're very optimistic. I would say it's less than 10%.

Wow.

And the reason why is because I know that a lot of this stuff goes over people's heads. I know that only 9% of the general population actually use a password manager. Okay. And if only 9% are using a password manager, which is like one of the most basic 101 fundamental easy ways in which— low-cost ways in which to ensure your infosec, uh, and only less than 9% are using a password manager, then that tells me that, you know, 91% of the population is doing minimal to protect themselves, never mind read through a breach notification and go over what they should be doing to protect themselves.

Because the majority of people don't believe that they're going to be impacted by it. Either it's not going to happen to them, or if it happens to them, like in the case of a credit card, I'm covered, right? The credit card's going to cover this, uh, this erroneous, uh, or, you know, this charge. So at the end of the day, I don't, I don't have to worry about it, when actually that's not true at all, because there could be some huge fallout from these type of things.

Yeah. And that, that go— you mentioning, you know, credit cards, right? So 3 out of 4, 75% of consumers don't actually check their credit card statements. Think about that. 75% aren't actually looking at all of their charges. Should there be an unauthorized charge, uh, they're not refuting it because they're not paying attention to their statements. They think that, oh, it's not going to happen to me, and/or the credit card company is going to protect them, and/or they're going to get notified if there is a fraudulent charge, which isn't always the case at all. So, you know, that's further proof that most, most of the people aren't paying attention to these emails when they come in.

So that was why, you know, you mentioned a few, uh, podcasts before that the— you can set up these notifications when there's— every time there's a charge to your account. It's kind of like, it's just a— it's an easy way just to keep track of what's being charged and ensure that if there's something fraudulent, you can say, hey, that wasn't me.

So that's called push notifications, and, uh, credit card. So, uh, Bankrate— what are mobile credit card alerts? The mobile credit card alerts are push notifications designed to keep you informed about the state of your credit card account. These notifications can appear as lock screen notifications, banner, or badge depending on the settings you choose. It could also be an email or a text message that you receive notifying you of a recent charge.

Okay, strongly encourage people to do this.

Totally, totally. All right, uh, next on our resolution list for 2023: keep personal information private. Sharing seemingly harmless pieces of information about yourself online, such as where you grew up and details about your family history, may inadvertently provide scammers with the information they need to defraud you. These anecdotes may be used to guess answers to your account's security questions, or they may be used to put together a convincing imposter scam. So like the Facebook game or whatever it is, the 25 things that people don't know about me, I would never ever, I would never do that, you know. You know, for people like you and I, Peter, like our birth date is out there because, you know, we're somewhat public, you know, figures. Um, you know, I've done what I can to make my birth date being public, that information relatively innocuous or useless to a thief. Here. But regardless, you know, telling people where you are and where you aren't on social media is never a really good idea, because of burglaries and stuff like that. So yeah, it's important to kind of stay on the DL in regards to putting information out there.

Absolutely.

Yeah. Be sure to report incidents of fraud. Many incidents of fraud go unreported as the victims may feel embarrassed, as they may not think the scam was a crime worth reporting. So if you are a victim of fraud, or if someone attempts to defraud you, don't hesitate to report the incident. You can report the incident to fraud.org, the US Federal Trade Commission, and in some cases, local law enforcement. So yeah, if there is fraud, like in my case, I was— I had credit card fraud a couple of times over the past couple of years. I didn't actually report that to local law enforcement or to fraud.org. I just reported it to local— to my credit card company. You know, every time an email comes in, that's a fraud or a scam or a phish, I don't report that. I don't have the time. And, you know, I know that 100 other people are going to do that. But yeah, if you are actually defrauded and, you know, in the case where you lose money, you should definitely file a police report because in many cases you're going to be required to have that police report in order to get that money back.

And I would even take it one step further, even though, you know, the article here mentions that many people are sort of embarrassed, and I can understand that. But I think the more and more we change that culture of embarrassment and sharing information is that we're actually, you know, what happened to us and sharing that with others on social media. I mean, if you religiously go on to Facebook, whatever your social media channel is, share it with others. This is what happened to me. And I think A lot of people, when they realize, hey, a close family member or a close friend, that happened to them, is more likely to think, oh, that could happen to me. Yeah.

Only send sensitive data over trusted internet networks. Unsecured Wi-Fi networks like at the airport, the hotel, uh, the resort, uh, internet cafes, uh, transmitting sensitive information over unsecured Wi-Fi can get you into trouble. So only use secure Wi-Fi and/or only when you see HTTPS in the URL before you broadcast that data. So utilizing a VPN, virtual private network software, can usually solve that problem. Making sure, of course, it says HTTPS in the URL will solve that problem. You know, I will broadcast sensitive information over unsecured networks all the time. Because I travel a lot. But again, I'm using a VPN, or I'm looking for HTTPS in the URL.

So Robert, what happens if, let's say, you're traveling, and it could be any hotel, you get, you know, you check into the Hilton or whatever, and they're all going to have, you know, they're all going to have Wi-Fi. And when you're, you know, all of a sudden you click your link to the Wi-Fi to see what, what are the ones that are, you know, available. And it so happens that the bad guys have set one up in practically the same name as that name of that hotel. How do you know then, you know, that it, you know, what should you do? Is it looking for that, making sure that that's secure before automatically clicking it on, or how do you differentiate that from maybe the authentic, the valid Wi-Fi account?

What's called an evil twin is what that term is called when the bad guys set up a Wi-Fi that looks like, say, Hilton.com or whatever. And if in fact you do click on that and connect to it, couple things. Number one, it's not easy to set up an evil twin. When you— if and when you do, or the bad guy does, your device connected to it, it doesn't always work as the bad guy would like it to. But let's just say they are successful. If you have— if you're running a VPN, that generally should solve your problem. Knowing if it's an evil twin versus not may be impossible. But again, running that VPN should solve that issue. So as long as you do that, it doesn't matter if it's an evil twin or not.

Okay, okay.

So regularly monitor your financial statements. That's a no-brainer. So I get, you know, alerts and notifications for all of my charges. I get an electronic statement via email once a month for all of my accounts. I can log into my bank or credit card company, financial institution, whatever, daily if I want to. I can check the information on all the apps for all those accounts, PayPal, whatever, as much as I want via those apps or online access. So if you're regularly monitoring your statements is generally, you know, once a month, but you could do it as often as you want, and you should at a minimum once a month. Push notifications generally solve that problem. Okay, learn about who you are doing business with. Knowing the refund policies and guarantees of the business you're shopping with can help make informed decisions. This is especially important for digital marketplaces that facilitate the purchase of third-party products. So, um, you know, Main Street America retailers are not going to appreciate what I have to say here. I do business primarily with Amazon. I'm sorry, Main Street. Um, I mean, at this point, like, I'm— my wife and, and, and family, we do business at, you know, Target and Costco. And I'm even spending more time on Amazon to buy stuff that I might normally buy at Costco and Target now, because sometimes Target doesn't have it and sometimes Costco doesn't have it. So I'm buying it on Amazon or eBay. Otherwise, third-party retailers that I might do business with, if I do business with them, I will do a search for that particular company to find out if they've had any refund issues, return policy issues, fraud issues in the past. So I still do my due diligence with organizations that might be new to me.

It's— that's a good practice. It's also good, I mean, to be aware of, uh, what, what is the policy of the credit cards that you're using as far as these types of, uh, you know, when you're making purchase. Some of them, you know, as you're aware, they might even provide an additional guarantee of the product for a year beyond what the manufacturer's warranty is. There's a lot of other benefits that people aren't really aware of unless they look for them.

Agreed. Always trust your gut if something seems off. If something seems wrong, if something is wrong, That should be an easy one for most of us, but not all of us are paying attention to our gut. My sense has always been if you make decisions based on your gut, when the hair on the back of your neck stands on end, if your gut starts to turn, right? And that's a real thing. The more in tune you are with your intuition, uh, I think you make better decisions in life in general. Better financial decisions, better relationship decisions, better choices in the school you go to, the car you drive, the mate you choose, heck, the names you choose for your kids. I mean, it all matters, right? So the more you pay attention to your gut, I think the more conscious you are and the better off you're going to be with everything, including your security.

I agree with you 100%. Uh, decisions made using your gut. But also, I would say where a lot of people fall into this trap of, you know, scarcity, like, oh, this, this opportunity is only available first come, first serve, and there's only like two, uh, you know, like an Expedia, you see only two flights left at this price, like, you know, and every single one has only two, only two, only two. Sitting back and saying, putting it down, sitting back and thinking, you know, do I really need to get it now, or let me check a few other, other, other things that I should be checking. Never fall into this trap of if I don't do this right now, I'm going to lose that opportunity. Never do that.

Scarcity is a, is a, is a buying principle that sales and marketers use. Yeah. So remember to treat fraud victims with compassion. Too often fraud is discussed within the context of blaming the victim. How could you be so stupid? So I get it, you know, because I speak to— or I'm a victim advocate and I speak to victimization all the time, every day. And even major corporations that are victimized are victims of crimes. You know, even in the case of Target, who has a data breach, certainly could the CISO have done a better job? Could the CTO have done a better job? Could the CIO have done a better job? Probably. But they are still a victim of a crime. You know, a house is burglarized and they didn't lock their doors. Could that homeowner have done a better job? Yes. So do we blame the victim? Well, you know, you say, could you have done a better job? Yes. Are you stupid?

No.

But you could have done a better job. In some cases, you could do the best job and still be victimized. So people who fall for scams like romance scams, they are swindled and they wire thousands of dollars. Are they stupid? Are they gullible? Are they vulnerable? They vulnerable? Not necessarily. You know, they are just human. You know, they have a heart and they're lonely. So I think if we look at victims of scams and then look at ourselves and say, you know, how might I be vulnerable to this particular or any scam for that matter, we put our defenses up. We pay that much more attention every time an email comes in, a phone call is received, a text message comes in, every time we, uh, are solicited via a chat or an instant message on Facebook, Plenty of Fish, Match.com, whatever it might be, you know.

No, it's a very good point. We're all— I mean, we all to a certain extent are vulnerable, and we just got to try to make sure that we reduce our vulnerabilities. And in fact, you know, if people— if nobody would report any of these scams or things that have happened to them, then we wouldn't have any information at all. I mean, we wouldn't even— Robert and I wouldn't even be on this podcast because there would be nothing to talk about, because, right? So it's really important that people do try to keep, you know, each other informed, even if they feel a little bit of embarrassed. They shouldn't feel embarrassed. It's a means of really trying to help all of us learn about what's the latest type of scam that's out there and what we should be looking for.

Yeah. So Peter, generally we hit upon like 3 to 5 topics during the pod broadcast. Today we spent a lot of time talking about New Year's resolutions, but I wanted to finish off by talking about jugging. Okay.

Ah, oh, that's something else.

Yeah, this is nuts. New crime trend: jugging. And this is awful. So it's targeting distracted— the distracted and elderly, with the police warning about it from Alabama to California. Okay, the big picture: jugging involves thieves staking out unsuspecting victims at banks or retail stores before following and robbing them while they're jugging— juggling smartphones and car keys and packages and bags. In parking lots or at home. Jugging is creating anxiety in some cities amid rising violent crime, and certainly as many police departments fail to report the crime to the FBI via Axios. So suspected juggers also walk malls and computer stores to scout for large purchases. Jugging can occur in a parking lot after being followed home. Jugging can also take place if the victim leaves the car for a bit or for a bite to eat, and the jugglers steal the money or a new laptop by breaking the windows in the vehicle. Okay. So basically, jugging is a smash and grab that often involves violence, whether the victim is involved in the crime itself, like they themselves are being accosted or assaulted or robbed., or their vehicle is. So Peter, check this out. This is, in my opinion, as awful as it gets. So this is Houston Police, right? They have some security cameras. Robbery by force, jugging in front of a convenience store. I do believe that this particular victim was taking money out of the ATM. Now watch this, right? Watch this video. Hold on. Bad guys getting out of the car, right?

Boom!

Wow, look at it. Look at this. Oh man, that is awful. This is the convenience store guy coming out, going after them, right? Look at— look at this. Oh man. They're both fighting, no weapon involved as far as I can see. Guys coming back, scooping up the money. Look at that. Oh my God, look at that.

Look at them.

They have masks on, don't they?

Yeah, look at that. Both getting into the back seat of the car. Convenience store guy wasn't taking any of it. To get back in the car, man.

How bold.

How bold. They're in a 2021, um, Chevy Tahoe or GMC Yukon. Look at the money floating around.

It looked like they, they took him down before he got— I mean, he had this money before he got to an ATM, or he had a bag of money he was bringing into the convenience store.

At the gas station.

I'm like, maybe to make a transfer, wire transfer or something.

Maybe they were probably following him.

I don't know.

Yeah, so apparently like they had some understanding that he had a bag of money in his hand. Like they had to have known, right? Like, Peter, like that is a serious, serious crime. Now look at you walking around with a bag of money. You need to have your head on a swivel. Um, the fact that this guy had that bag of money, it's likely that they might have been following him from an ATM to the convenience store. I don't know. Um, the fact that, you know, uh, they had masks on, that they were prepared for him, that they were waiting for him, tells me that they probably had an eye on him already. It's probably not the first time that, that he's walked around with a bag of cash for whatever reason. Like you said, he might have been buying a money order, like some type of a Western Union. Uh, maybe people— maybe that particular gas station has a Western Union portal depot. And, uh, yeah, like, that's a thing, you know. Any check cashing place is a place where jugging might happen. So wherever you are, knowing that you have cash on you, um, you're buying a computer, you're buying a laptop, uh, you know, there's definitely strength in numbers, but always pay attention to your surroundings. And in this case, you know, they fought the bad guys off. I don't necessarily recommend that due to the fact that if they had a weapon, that could have been fatal. Over what? Cash?

I mean, just think about it, you know, it, it's easy to stay— to set up on someone and watch them take out money from, uh, an ATM. You can tell if someone is taking out money or maybe depositing checks, or, or even if you're going into a bank and you're sitting in the teller line I mean, there can be people that can be watching what you're doing. So as your point being, it's probably in this case and a lot of other cases, people can be followed to an area where it's going to be easier to intercept them and do something to steal from them if they, if they're already suspected of having something like money or jewelry or something on them that could make them a target.

Yeah. So, you know, going forward, just pay attention to surroundings. You know, you just don't want something like this to happen to you. So Peter, uh, tell the peeps what you're up to, where you're going to be, what value you provide the planet.

Well, over the next few days I'm going to be closer to home because I'm going to be working on updating some of my training courses and programs and getting, getting ready for the rest of the year, where it's going to be— things are going to pick up a little by little during, during the, uh, during the spring months. But yeah, focusing on, on educational products predominantly, giving presentations as well as even full-day workshops for clients, for trade associations and their members about how to recognize, how to understand how they can be human hacked and who are the threat actors, what are their objectives, what's the methodology they're using, how to be safer on social media where a lot of these particular hacks come through and look at the best practices that from an organizational standpoint as well as the employees what they should be focusing on. I'm going to be working on another book here, hopefully to, uh, put out by the end of the year, but I'm not going to provide any information on what that is going to be until we're closer to the date.

All right, and where can they learn more about you?

Counterintelligence-institute.com or on LinkedIn, Peter Wormka. There's a lot of information there.

All right, and y'all can check out me and my peeps at protectnowllc.com. Check out our security awareness training, both pre-recorded e-learning and our CSI certification designation for service professionals such as lawyers and accountants and realtors and others that handle sensitive client information. So Peter, last words.

Stay safe out there, stay warm wherever you are, and watch out for yourself and for each other.

And be nice to each other. Thank you, Peter.

Thank you, Robert Siciliano.