Increase the Effectiveness of Security Awareness Training by Making It Personal

Eh, good afternoon. I am Robert Siciliano from ProtectNowLLC.com, and welcome to Increase the Effectiveness of Security Awareness Training by Making It Personal. So we've got a bunch of you on today, and thank you so much for, uh, signing up, signing in. Just so you know, uh, the video for this event will be available on YouTube, Twitter, LinkedIn, Facebook, uh, shortly afterwards. We will make sure to send links to everyone. So again, thank you so much for being here. Uh, this presentation really is designed for Security Awareness Managers. So those of you who are responsible for making sure that your people are on top of what is new and ahead of what is next at all times in regards to all things privacy, information security, personal security, and from my perspective, all of that really boils down to digital literacy at some level. And that's what we try to get across. So my experience in regards to providing security awareness training over 30-plus years is that it started off as being physical security and then information security as it pertains to identity theft protection and prevention. And then it evolved or morphed into phishing simulation training. And that's primarily what is being taught today. Uh, in most phishing simulation training, or most security awareness training, really is a form of check-the-box compliance. And while phishing simulation is good and necessary, and to a degree it's effective, certainly, it only really does cover one aspect of InfoSec or security awareness. And it doesn't really, from my perspective, uh, provide a holistic view of changing behavior in such a way where the user or the learner ultimately takes security to heart and they care about security in such a way that ultimately and fundamentally matters. That's a problem. And until users can effectively recognize risk in such a way where they see how security in their own personal life matters to them and it means something to them. And then from there, they're able to do their jobs that much more effectively. So in today's short presentation, I'm going to show you how we do that, how we express that, how we change hearts and change minds by by making security personal to the user. So I know we're supposed to go like 20 minutes and half an hour. I don't know how long we're gonna go. I don't have the ability to react or respond to questions or chat. So I'm just gonna kind of bang through this. And if you gotta drop off anytime, that's no problem because the whole presentation will be available via video. It's all being broadcast live right now as we speak. So yeah, don't worry about any of that. All right, so let me, uh, get into my PPT here. One second. And welcome to my comfort zone. All right, so what is personal to them, right? Our philosophy is— or my philosophy is all security is personal. Like, it boils down to the individual. It boils down to what their cares, concerns, what their fears are, you know, what they want to protect that is most important to them first. And from that perspective, once they recognize risk in such a way where they can protect themselves first and understand how it all works, then they begin to care about security in the workplace and how to protect the data in which they are entrusted with. So if you take them through on a journey, right, where you get them thinking about risk as it pertains to them, then they begin to understand why it's important to protect the data in which, you know, you want them to protect, which is ultimately, you know, client information, proprietary data. Humans fundamentally are selfish or self-interested creatures by default. That's not necessarily a bad thing. It's just the way it is. On Abraham Maslow's hierarchy of human needs, at the base of that triangle is our physiological needs, which means that eating, drinking, sleeping, like you can't function without nourishing your body, nourishing your mind. And then from there, right above that is safety, security, stability, structure, and protection. And so first and foremost, you know, we need to take care of ourselves and protect ourselves, right? And from there, then we could, we could begin to think about protecting others. Okay, we are selfish, self-interested creatures. That's just the way it goes. And security awareness training needs to follow that path. Okay, so in our presentations, what we generally do and what I suggest that you do as well, you security awareness managers, is talk about what security is and isn't, and we'll cover that today, right? It's not about paranoia, which is what too many people believe it is. Uh, we talk about identity. What is personal to them is their personal identifying information— their names, their addresses, their email address, their phone numbers, their mobile phone number, their Social Security numbers, right, their PII, their passwords, or really their password, because most people are using the same password across multiple accounts. You'd be amazed that that's still a thing. And then email is also very important to them, talking about their spam folder, talking about what is called auto-forwarding, which is a setting within their email that they may or may not— you may or may not know about. Also credit cards. You'd be amazed at, you know, giving a 3-hour presentation and people's biggest concern is 'How do I protect my credit cards?' And it's like, that is the least of your concerns. And it's not even identity theft. You know, credit card fraud is just credit card fraud. You might have a significant concern revolving around credit card fraud, and we'll talk about that. But, you know, but again, once you speak to that, you get that out of the way, then from there they can start to think about the big picture stuff. And then scam awareness and social engineering, like, obviously there's thousands of scams out there. There's probably like 100 scams and probably 10 variations to each of those scams, or 100 variations to each of those scams. And all those twists and turns, they need to be made aware of that stuff at a fundamental level so that they can recognize risk every time the phone rings, every time an email comes in, heck, every time somebody knocks on the door. And then hardware and software, they need to know how to protect their hardware or know when to update and upgrade their hardware and their software. And physical security, because all security does boil down to the individual. And so they need to know how to protect their homes from invasions and burglars. And personal protection, you know, you need to know how to deal with if you are ever physically attacked. And if you're ever physically attacked, like knowing what your options are, knowing how to physically defend yourself, knowing what your options are for weaponry in some cases, you know, understanding that your brain is your best defense weapon. And once they understand personal protection, then every other decision in life becomes relatively simple. And certainly we don't spend, you know, an entire presentation talking about self-defense, but we do cover personal protection in such a way where when you know what your options are regarding physical security for yourself and for your home and for your daughter who's going off to college, where 25% of young women going off to university are sexually assaulted. That's a thing. These uncomfortable conversations that you have with your family, which you should, you begin to understand and recognize risk at a whole nother level. Let me show you what I mean. All right, so our philosophy is that a lack of security appreciation contributes to what we call poor security awareness. Now, let's define the two. So from my vantage point, security awareness is from the head or the neck up, right? It is your understanding of what security is. It's knowing that you should lock your doors and have a home security system. It's knowing that you probably should consider identity theft protection and have antivirus and update your operating system. It's you should lock your doors, consider a home security system, and all that stuff, right? Whereas security appreciation is from the heart up. When you appreciate something, like the definition of appreciation is recognition and enjoyment of the good qualities of someone, right? A person in your life that you recognize and appreciate them for who they are, what they did or do, or something, you know, like in this case, security, right? Second part of the definition of appreciation is a full understanding of a situation. And that's where security appreciation comes in. The difference between security awareness fundamentally and security appreciation is with security awareness, you recognize it, you understand it somewhat, you get it to a degree, whereas with security appreciation, it means something to you, it matters to you, and you do something about security. You take it personally. You take it to heart. Okay? Nobody's speaking to that when it comes to security. Nobody. Except for me or Russ. So that's head versus heart. And then I ask the audience, like, how many of you believe you live in a safe neighborhood? And usually, like, half the audience raises their hand, which I find, you know, interesting. Because if you watch baseball, you'll find that, right, if you watch the umpire and you listen to the calls, you're either out or you're safe. Because the word safe is an absolute. And for you to say that you live in a safe neighborhood means that you believe that nothing has ever or is or will ever happen bad in your neighborhood because it's safe. But is it really? You might live in a safer neighborhood. Neighborhood, which is fine, and that's good. And I'm not saying this to, you know, create fear. I'm saying this because nobody lives in a safe neighborhood. You live in a safer neighborhood. And when you begin to put that in perspective and understand that, you know, if you read the police blotter, there's at least a burglary, let's say, at least once a year in your safe neighborhood, right? Home invasions, right? Robbery, thefts, whatever. Okay, stuff happens. And when I ask the question, how many of you actually have a home security system? And generally less than a third, maybe 20% of the audience raises their hand. And I ask, you know, why don't you have that home security system? Oh, you know, I don't want to live like that, they often say. And you ask, and I dig deeper into that, like, what does that mean? You know, I don't, I don't want to live like that. Well, I don't want to, I don't want to live in fear. Because when people equate locking their doors and having a home security system, they equate that with, well, I just want to be free, I don't want to have to worry. And they believe that if you have a home security system that you are going to worry, or that the, the, the thought or the implementation of it is that you have something to worry about. But the reality of it is, is that having a home security system fundamentally just gives you control. And when it gives you control, it gives you an edge. It's an added layer so that if the bad guy does decide to choose your house, then he kicks in a door, he breaks a window, glass break sensors, motion sensors, uh, door and window sensors, uh, the Alarm Central calls you, they call law enforcement. It gives you an edge. It gives you added protection when you're sleeping, when you're awake, when you're home, when you're not. But no one's ever really had that conversation with most people. The fact is, is that on average every year in the US, 1.5 to 2 million homes are burglarized. That means in the next decade, like 15 to 20 million homes are gonna be burglarized. And many of those are home invasions, which lead to violence. So understanding this basic concept of home security and knowing that you don't necessarily live in a safe neighborhood, maybe a safe our neighborhood, and that it can't happen to me, and I don't have a home security system because I don't want to live like that. These myths that have been perpetrated most of our lives, at least in the US, uh, is, is, is false. And as long as your people look at security like that, they're never going to appreciate phishing simulation training. They're never going to appreciate their role and responsibility in protecting the data in which they're entrusted with, ever. It's just not going to happen. I mean, if you look at Equifax— sorry, Equifax— you know, the CIO, the CSO, the CEO, I'm pretty sure they're all gone, right? Like, that didn't work out for them. And it is my opinion— and again, sorry if you're watching this today— is that if all of those company officers appreciated security at the level that they should have or needed to, that 150-something million Social Security numbers wouldn't have been leaked. You know, that those that are responsible for protecting the networks—CISOs, CSOs, CIOs, CTOs—if they looked at security as fundamental to everything—let me ask you, right? And I always ask my audiences, and I just did a presentation in front of 250 CISOs at a university in the Southeast. And I asked them, I said, and I said, you know, point blank, like, I'm a guy that, you know, I'm in the security business and I have 22 security cameras both inside and on the exterior of my property combined. And I said to them, like, what does that say about me? What does that say about my disposition? What does that say about the way I look at the world? And it was just so funny because collectively 250 men and women, CISOs, went, "Paranoid!" all at the same time. And as they collectively said, "Paranoid!" they all broke out into laughter because they all said the same thing out loud and just thought it was so funny that they said it all out loud. And it was funny. But what was even funnier about it is that here we are in a room of 251 security professionals, including me, looking at security and the guy who's talking about security as being mentally ill. Because that's what paranoia is. Paranoia is a dis-ease. It is a complete overwhelm with life in general, thinking that others are out to get you. And is that what security is? But that's what we have equated it to in our country, including those in the security profession. And that's a problem. It's a problem because as long as we look at security as paranoia, as it can't happen to me— and paranoia is awful, by the way, and it's something that we never want to be. Obviously. I know people who are afflicted by that disease, and it's very difficult to be around them. It's very difficult to be in their families, very, of course, very difficult to be them. And it's a very unfortunate way of dealing with the world. And security— and those people are out of control. And security is all about being in control. And so as long as we at some level support the myth that security is about paranoia, at a leadership level, there's no way your people are ever going to grasp phishing simulation training or holistically what security is and isn't. Okay, look at you, put your seatbelt on. I put my seatbelt on. 85% of people on the road put their seatbelt on. Do you put it on because you're paranoid? No, you put it on because you're smart. You put it on because you recognize risk. You put it on to reduce risk. You put it on to give you control, right? So these analogies, this basic understanding of what security is and isn't, is really designed to take people from security awareness to bring them baby steps into security appreciation, okay? And I ask the question with every audience, "How many of you use a password manager?" And generally about 5 to 10% of the room raises their hand. Right? And, and if you have 30 different websites and you're not using a password manager today, that generally means you're using one password across multiple accounts that may or may not have any variations to it. Further, I ask how many of you use two-step authentication or two-step verification for email? Usually about 30 to 40% of the room raises their hand. Generally, that's for private email. In a corporate setting, you know, usually most of them are. But for their private life, no, you know, because they don't want to deal with that. If they don't want— if they don't want to deal with it in their personal life, what kind of workarounds do you think they're going to engage in in their professional life, you know? Because they don't appreciate this basic rule of email that you should have a different passcode across multiple accounts and definitely two-factor authentication. Bad guys, as you know, they say if you own the email, you own the person. And in their personal life, if they're not— if they don't care enough to protect their own bank account, which has direct access to email and so on to reset the passcode, what makes you think they're going to care to protect company data or their own email on site, right? Okay. All right. So I get into, you know, the flaws in the system, the vulnerabilities, the statistics that we— that, you know, is in regards to data being compromised, such as 27 billion records exposed in the first half of 2020. Studies show that more than 40 billion records exposed in all of 2021. And right there is 70 billion records just in the past couple of years. In the past decade, I think we could collectively say that there's been about 100+ billion records stolen. Right? That's names, addresses, phone numbers, email addresses, mobile phone numbers. It's email addresses and passcodes. And when I say passcodes, they're like, what do you mean, the bad guys have my passcodes? And I'm like, yeah. You know, here, an astonishing 773 million records exposed in a monster data breach, including 21 million unique passwords in one data breach, right? Well, in a combination of data breaches, right? And so I show them this, right? This is stolen raw data for sale on the dark web. Okay, when you show your people, your frontline employees, raw stolen data, they go, whoa, because they see themselves in that information. So for example, that 21 million unique passwords posted to a hacking forum, well, there they are right there. Okay, that this index of combos is sitting on my desktop, my laptop. And I present this information. I show them that raw data. I show them the usernames, email addresses, and the associated passcodes. And I do searches on that data and show them how many people using 123456789 password and password1 as a passcode and so forth. And they're like, whoa. You know, they had no idea. How do you not have any idea? 70 billion records exposed in the past 2 years. What do you think that information is? And so when they see this raw data and they see themselves in that raw data, they begin to perk up, they begin to pay attention, they begin to realize and recognize that they need to start making some changes in the way in which they function digitally. That they realize that digital literacy is less than proficient and they need to upgrade and update the way they look at their digital lives. And that's personally. And then from there, they begin to see how it matters professionally. That's how that works. So what we have done is we've taken, you know, Have I Been Pwned? We've licensed their tool, and you can go to our website and you scroll down at protectnowllc.com, and right here where it says check if your email has been breached and check if your password has been breached, we do that live with our people on site. Where we show them, for example, I search an old email address I have based on the title of my first book, check if your email has been breached. We click search, we have access to almost 13 billion stolen records. And from here it shows your email and possibly a password has been stolen on the following breaches. And here Apollo in July of 2018, what was it, 126 million unique email addresses and associated PII. Here is 105 million, uh, records in a data dump. Uh, more data dumps, more data dumps, more data dumps. Epic in 2021, where they had 15 million unique email addresses and other PII. Evite back in 2019, uh, dates of birth, email addresses, passwords for my, you know, email address, which is a username. And if I am using the same password for eVite as I am for email— this is what I explained to the audience— then that means they can not only get into my eVite, they can get into my email as well. And they begin to understand and see how using the same passcode across multiple accounts is ineffective or is high risk, right? Uh, Exactis, uh, Gravatar, LinkedIn— and everybody knows with the LinkedIn breach where like 160-something email addresses and their associated passcodes were compromised And if you're using the same passcode as you are for LinkedIn, that you are for email, or Visa, MasterCard, American Express, or eBay, PayPal, uh, Best Buy, whatever, right? Bad guys can get access to all those accounts using credential stuffings, credential stuffing software. And so for you security awareness managers, you know all that stuff, but the general public definitely does not. Most front, frontline employees have no idea either. Okay. And so from there, uh, let me see what else I showed them and show you, right? So we show them how a password manager works. Password managers, of course, are the most effective ways to manage all the various passwords that you need to have for each account. Uh, they facilitate creating a new and different long and strong uppercase, lowercase, number— in numbers and characters passcode across all your various accounts. You train that password manager so that it effectively allows you to have a different passcode across every single account. And you use that password manager on all your various devices across operating systems, across browsers, and so on, making it very easy to, uh, change passwords where they go up to the password manager's cloud, down to each of your devices, and they're all in sync. And then the first question is, well, what if your password manager gets compromised? Well, I'm not so much worried about that because the password managers themselves, the companies, these are, you know, security companies with military-grade bank-level security and encryption, and our data is not on their servers in plain text. Really, the path of least resistance is those sitting in the chair, right, the user who has the same passcode across multiple accounts and/or they have their information on the dark web. The password manager really is the most effective way to manage all the various passwords that you need. I explain this to them, the benefits of it, which password managers do you use, and I take them to an article out in PC Magazine that shows them how to do it. This is all 101 stuff that makes it very easy for them, which fundamentally ups their digital literacy, making it ultimately easier for you to teach them what they need to know in regards to security awareness. Taking them to a level of security appreciation. Okay? Easy peasy. Talk about social engineering and how passwords are compromised via phishing and how you can't engage in password reuse and insecure weak passwords like 123456. Password managers being the most effective way to manage all those passcodes. Utilizing two-step verification. And if they have devices in their life with no passwords, they definitely have to have passwords on their mobile phones, 'cause if they're lost or stolen, What does the bad guy have access to? And they collectively say, everything. The whole audience says that every single time. Okay, I show them what two-factor authentication is, how it works. I mean, they pretty much know because there are a few various accounts that they have that already implement it, but they say, well, how do you implement it? How do you do it? And I take them to Google and I show them Gmail two-factor authentication. Again, 101, really easy to do. You You search it, and when you do, you see support.google.com. Turn on two-step verification for your account. You're in the dark ages, you're on AOL, you search AOL two-factor authentication and you see help.aol.com. You could do the same thing for P-A-Y, and automatically PayPal propagates, and you should have two-factor authentication for PayPal, where at paypal.com it shows you how do I turn on and off Hold their hand, walk them through it. They'll love you for it. And they begin to see, oh, this really isn't all that difficult at all. I can do this. I want to do this. I can't wait to go home and show my family. Ahas left and right from doing what? Showing them the basics. You're not going over their head with like crazy fishing simulation training that, you know, just scares them into submission and they don't want to click anything. They don't want to do anything because they're afraid now. They're afraid they're gonna get yelled at, chastised, you know, made an example of. No, you walk them through a gentle process of showing them how to protect them, their identities, their personal information, their families, their bank accounts, their email. Make it easy for them. Walk them through this process. They will really appreciate you for that. Okay. Okay, all right, hold on, uh, more stuff. And we're already at 20-something minutes, man. It just goes so fast. Okay, uh, I have so much to talk to you about, we could go forever. All right, so, um, I talk about identity, you know, the Equifax breach. Uh, man, this breach just did not need to happen. And look at you, you right now, you— how many of you have a credit freeze? How many of you have identity theft protection? You, security leader, right? What are you doing right now to protect your identity? A credit freeze has been around since February of 2008. I've had my credit frozen since February of 2008. As soon as it was available to me, I sent in paperwork. Now it's all done digitally, online, easy, easy, right? Um, it's been available for free since, I think, September of 2018 after the Equifax breach. And so I take them online right here and now, right? I'll show you, make things easy for you. You came here to learn something. I'll, I'll learn you this. So I take them right to the Google and I do a quick search on credit freeze TransUnion. And when you search credit freeze TransUnion, there are 3 major credit bureaus. Uh, there's TransUnion, Equifax, Experian, but there's also Innovis, and there's, uh, 2 or 3 more. There's LexisNexis. I show them all that stuff, and I show them how to freeze their credit at TransUnion, let's say. And when you search that, you go to the page on TransUnion website at transunion.com/creditfreeze, freeze my credit at TransUnion. That same search propagates credit freeze Equifax, Experian credit freeze, and so forth. So we're gonna go to TransUnion right now, and I walk them through this process, as you should too. How do you add a freeze? First, we just— we, we define credit freeze. A credit freeze is also known as a security freeze. It's the best way to help prevent new accounts from being opened in your name. It's absolutely free to freeze and unfreeze your credit, and it won't affect your credit scores. Any more questions and I answer them. From here, you click Add Freeze, and it walks you through a basic affidavit, an online registration form. And from here, right, you see first name, middle name, last name, address, city, state, and zip. They want your email, mobile number, date of birth, and last 4 of your Social Security number. And they go, "I don't want to give them my Social." Because, you know, they're afraid. And I say, "Listen, they already have your Social." All right? The risk here is slim to none. I mean, they already— it's a secure website to a degree. Right? You've got to provide your Social in order to get a credit freeze. And once you provide it, Once it's frozen, you now have control. And that means that going forward, anytime that a bad guy has your social, you've made your Social Security number useless to a thief in regards to new account fraud. It is going to be very difficult for them to open up a new line of credit under your name because you've frozen your credit. I've had bad guys email me my own Social Security number, and I'm like, okay, yeah, whatever, good for you. You know, what are you going to do with it? And I've made it effective in such a way where, you know, with the credit freeze, they can't open up any new lines of credit under my name. I've gone to the IRS and I've searched IRS identity theft affidavit, right, form number 14039. And I walk my audience through this as well so that they can basically get a PIN so that nobody can file taxes under their name and get that refund before they do. Now, there's not a whole lot you could do about medical identity theft, uh, but that's something that they don't necessarily need to worry about, uh, and as long as you have identity theft protection, you generally have a restoration agent or an expert that's there to watch your back should something go wrong, usually, right? So you walk them through all these various processes so that they understand that now their identity is protected, their Social Security number is protected, they can give up their social generally and not be so concerned about it. You show them when it's okay and not okay to give it out. You know, so you're hitting them where it matters most— themselves, right? What's in it for me? And once they understand how to recognize risk in their own personal life, right, they begin to understand how to protect and why they would want to protect the data in which they're entrusted with. Okay? What else do I have time for here, right? We are just out of or over. Time. Okay, so what else? All right, just be patient. Stop barking at me. Okay, right here. And, um, we talk about new account fraud and how a credit freeze protects you from that. We talk about account takeover, which generally revolves around password management and making sure that your hardware and your software is properly updated, uh, you have a different passcode across all your various accounts. And making sure that, you know, you have encryption and you pay for antivirus opposed to getting free antivirus, keeping in mind that, you know, Wells Fargo and Bank of America spend $1 billion a year on infosec, and here you are using free antivirus to protect your bank account. It's like, whoa, you know, why wouldn't you use a full suite that has antivirus and spyware and phishing and a firewall, you know, making an investment in yourself and your digital life and your— and protecting, you know, your information and understanding why that's important. Okay, talk about child identity theft, because if you have kids, if they have a social, right, they are at risk. And, you know, all parents— Mama Bear kicks in, you know, Security Dad kicks in— and they want to know how to protect their kids. We talk about a credit freeze and how it works and how you protect your kids from new account fraud and how even a baby can have their identity stolen because their system of credit, you know, doesn't understand that that child, that social is attached to a child. And as soon as a bad guy gets your kid's social, they just apply for credit, and a credit is— credit is established under that child's name, right? And again, you talk about tax identity theft. And, uh, what else? Um, credit card fraud, which they all want to talk about. And, you know, they want to resolve that. And I say, listen, you cannot protect yourself from credit card fraud, but what you can and should do is check your statements. You could do it online every day if you want. You can check it via your mobile app. But fundamentally, what you should be doing is set up push notifications and push alerts if you're not already doing this, so that every single time there's a charge, you get a notification via email and/or text. That way, in real time, you're aware of the charges that occur. You see the merchant's name, which doesn't always match up to the retailer or the restaurant you went to. And so you can see in real time all those various charges. If the math or the physics of that notification location don't add up to where you are, where you were, where you've been, or where your spouse might be in case you share credit cards, then you call the credit card company and refute that charge in real time. That really is the best way to go. And when they see that and they ask questions in regards to that, and I could show them online right there how to do it, how to go online to your bank and how to look for security settings and notification settings and all that, they love it. And you should too. All right, and then show them email security and spam folders and what those various phishing lures, L-U-R-E-S, look like, right? And, uh, how they're all very tasty and they could get hooked and they should stay out of their spam folder for various reasons. But if they do, I'm telling you, you can get in a lot of trouble. Many of us might know of the, of RSA security and how one of the employees went into a spam folder and opened up an Excel file and clicked it and macros and mess and compromised billions of devices or millions of devices, and it just got messy. And so using that as an example and talking about email forwarding and automatic forwarding in your settings menu, and how if, if you look in my settings menu right here, forwarding, disable forwarding is checked. But if I was to check forward a copy of incoming mail to, that if a bad guy gets access to your email, even if you change your passcode, they're going to see all of your incoming mail going forward, even if you set up two-factor authentication, because they're going to get a copy in perpetuity. And show them how that all works and making sure that that window, that dropdown, is always clear and clean. Okay, and then once they do so, change the passcodes and make sure they set up two-factor authentication. You too. We talk about social engineering and what it is how it's a confidence crime. We define it and how it pertains to phishing. And every time the phone rings, an email comes in, and we talk about all the various scams that go on out there— telephone scams, utility scams, invoice scams, gift card scams, wire fraud, bad USBs, keyloggers, scareware, ransomware, tech support scams, spyware, IRS scams, customer support scams, and romance scams if we have time, right? Because it's all personal to them and their family. Lots of senior citizens are victims to a lot of these various scams. Their parents make it personal to them. And we go over these various scams like a romance scam of an imposter claiming to be an astronaut wooed a Japanese woman into paying for a return ticket to Earth. I read that and everybody laughs and you hear people grumbling in the background, "Oh, so stupid." And I say, "No, so human." You know, she's a good person. She just wanted to help. And explain how their own employees just want to help. You know, we're just good people that— look, I, through my research, I've determined that about 97% of all people are trustworthy. You know what that means? It means that 3 to 4% are not. They come out of their mama bad. And I define that and what it looks like and what it means to be a hardcore narcissist or sociopath or psychopath. And how those personality disorders, those people don't feel empathy, sympathy, remorse, guilt, and it's natural and normal for them to behave that way. And how P.T. Barnum says there's a sucker born every minute, and I say no, we're all born suckers, every one of us, and explain how that works. So yeah, we talk about bad USBs and keyloggers and And you get down to wire fraud, and I'm running out of time. And we talk about hardware and software and security software and Wi-Fi security, VPNs and encryption, right? Mobile device tracking, backup, backing up your, your data and your devices, password management, two-factor authentication, social engineering. Yeah, cap it off with that, right? And there's so much more to discuss, and I've already taken up too much of your time. I'm almost at 40 minutes, so listen, You can learn more about us and what we do and how we do what we do. And, you know, I'm happy to like hang out with you guys and engage in any way you want. Uh, let me show you a couple things. Go to our website, go to protectnowllc.com. Uh, you can check us out and see our Google reviews. Uh, just, you know, Google protectnowllc.com. This is just Um, 23 hours ago, Gwen said, great presentations. I did two in a day yesterday. He gave me lots to think about. Highly recommend him. Hope to him to book him for our women's group. I'm going to like that. Thank you, Gwen. And then Janine Lambert, Robert gave the keynote address to our annual cybersecurity symposium to attorneys and cybersecurity professionals across the region. He was fantastic. I was fantastic. He was able to engage the audience no matter what level of tech or cyber or legal experience they had, which is really difficult to find. The audience described him as a pro, excellent, really engaging, and his words really hit home. Thank you, Janine. I just— I'm just seeing this one for the first time. I'm going to like that. All right, so I just tooted my horn. Check us out on Amazon. I've written a bunch of books, including a bestseller. Seller. And, uh, yeah, that's it. So stay in touch. You can see this video, um, on YouTube and LinkedIn and Twitter and Facebook. By all means, uh, spread it, share it, like it, thumbs up it. And, um, hey, you know, um, I care about y'all, and I want to make sure that you and your people— and that we change behavior, we update and upgrade people's, uh, digital literacy by keeping them on top of what is new and ahead of what is next at all times. Y'all be cool out there, be safe, and be nice to each other. Talk to you later.