Robert Siciliano and David Raviv NY InfoSecurity

Robert Siciliano is a best-selling author of 5 books. In the '90s, he appeared on the Montel Williams Show posing as a water company worker, conning his way into unsuspecting homeowners' residences. Then he inappropriately used a stun gun on The Howard Stern Show. Recently, he appeared on Dr. Oz where he successfully fished Dr. Oz employees, then brought a hacked ATM on Anderson Cooper's show, exposing thousands of credit and debit cards. Recently on CNN, he stabbed a melon in the eye in response to a murdered college-aged woman to demonstrate rideshare safety. He has presented over 1,000 security awareness training events as the architect of the CSI Protection Certification and Designation, a cyber, social, and identity protection security awareness training program. He also coined the phrase, "Security is good for you, just like broccoli." I hope you enjoy this conversation. So Robert Siciliano, right? Is that how you pronounce it? I tried my best Italian. Pronunciation. So it's a great pleasure to host you for the, you know, for the weekly New York Information Security Meetup slash Cyber Guild event. And, you know, I looked into your background and it's really truly remarkable. You've done so much. You know, just some of the stuff from, from, you know, from the Wikipedia page, Um, you basically showed up on every major news broadcast— CNN, Anderson Cooper, MSNBC, Fox News, CNBC, Inside Edition, Today Show. It's, it's, it's amazing. Forbes, uh, Cosmopolitan, Good Housekeeping— I guess it's like the magazines— The New York Times, uh, Los Angeles Times, Washington Times. How does somebody, um I mean, you've built like a major brand for yourself. I mean, in this, you know, the cyberspace, um, you know, so, so maybe you can kind of walk me like through, you know, inception, like, you know, how, how you started. Um, I think you were doing some private investigation or like you're doing some, some, you know, physical security stuff, and then you kind of venture into the, into the cyberspace. Why don't we kind of walk us through, you know, like maybe like, you know, high school graduation, and then what happens then? How do you— how did you kind of advance from there?

Do you really want to go back that far?

Yeah, maybe a little bit. Like, I mean, you've accomplished a lot. I mean, it's pretty remarkable. Like I said, I think, uh, I think some people, even some of the young, young folks today, I, I tell them that people that are trying to get into cybersecurity, I say, hey, you know what you should do is you should market yourself. You should build some, some brand, you know, right? Start writing some— writing blogs, some you know, post some stuff on LinkedIn or whatever. But you're the king of that. You've managed to really establish a major presence online and offline. So yeah, walk us kind of through that process. That'd be great.

Sure. I'll try to make it as condensed as possible. So I didn't know what I wanted to be when I grew up out of high school. And my dad was a union pipefitter. And so when I was about to graduate, I said, "Dad, what am I gonna do when I get out of high school?" He said, "You're gonna be a pipefitter." I'm like, "What the hell's a pipefitter?" He's like, "It's what I do, HVAC." I'm like, "Okay, I'll be a pipefitter." And so I went to trade school, went to union school, and I spent my first 5 years as an apprentice making my father miserable because I didn't wanna be there and serving under him. And all the while, I had been building a business revolving around personal security as it relates to violence and theft prevention in the physical world. So this is in the late '80s, early '90s. So my passion was teaching people security awareness training, women personal protection, uh, rape prevention due to— I had met a lot of young women in my teens that had been sexually assaulted. I myself was a victim of a multiple attack situation at the age of 12 in downtown Boston, and it kind of woke me up to bad guys, right?

In downtown Boston back in— what was this, the '90s? It was a very different place than there is today, right?

Early '80s.

Yeah.

Um, and so walking the streets of Boston, the combat zone in Boston was where we hung out as kids. And, uh, you know, prostitutes and adult bookstores and just a lot of nasty people. And so, um, you know, I got into this multiple attack situation with my little brother, and my dad pulls us aside and explained predators and their prey by making us watch like the Mutual of Omaha's Wild World of Animals on PBS. And, um, and he— and I understood the lion being the predator and the gazelle being the prey My dad would say, "You're the gazelle." And it woke me up to not everybody's as nice as mommy and daddy. And so over the years as a victim of that multiple attack situation and being concerned for women's personal security and hearing of all these women being raped, it set the tone for the direction of my focus and for my life. And so I started this business on personal security doing seminars like Tupperware parties on Safety for Women selling pepper sprays and stun guns back in the late '80s and early '90s. And then around '94, '95, I was online. Like, I had a website before anybody that I knew had a website. So early that I was online early enough that I owned LedZeppelin.com. That's how long I've been online for. And that didn't go over well, by the way.

I was about to ask you about that.

Yeah, well, I'll tell you that later. So, um, in 1995 I had the ability— I had an online, uh, ordering, and I had a mail order catalog as well, and I had merchant status. So getting merchant status was not easy to do back in the mid-'90s because there was a lot of fraud, which I didn't quite understand. But within a week of having the ability to accept Visa, MasterCard, American Express, I got hacked in the mid-'90s. Thousands of dollars in credit card fraud, and I lost all that. And as a very small business, this is just me, uh, I was devastated. Like, I lost a lot of money, a lot of product. I had paid all that money back to the merchants, to Visa, MasterCard, American Express. And as upset as I was, I was fascinated by how they did it. I, I was like, I reverse engineered their process and I saw how they did it., and I actually found a lot of people that did what they did to me, but more so I realized that this is going to be the biggest thing ever. Like, if they could do this to me, they could do this to anybody. And I saw what internet fraud was before internet fraud was internet fraud. This is before even Kevin Mitnick was hacking the Pentagon. I was being victimized as a small business. I started to follow that. There were very few nonprofits in the country that were talking about identity theft and privacy. It just wasn't a thing yet. And then the Identity Theft Deterrence Act of 1998 was passed, and all of a sudden it was real. So I started to write about it. I didn't have much of a blog, but I had written a book on personal security in '95, and when you're an author, that establishes you as an expert, or it's one of the things that establishes you as an expert. And right off the bat, I got on the Montel Williams Show, the Sally The Jesse Raphael Show. There's a guy named Gordon Elliott. I got on The Howard Stern Show. So I started doing all these local, regional, and national talk shows and TV shows back in the mid-'90s. And that established my base as a source for journalists, both print and online and television early on. And like business begets business, PR begets PR. Part of your ability to do PR means you have to speak pithy soundbites. I say all the time, this might sound odd to people, but I am the only person that I know that has spoken to every major media naked, naked, because I answer the phone in the shower, which matters because when the media calls, if you don't answer the phone, they're calling somebody else immediately. So I secured a tremendous amount of media because they answered the phone immediately.

Did they turn the water off? You still have it on when it's— when it's your call, or you have like a noise-canceling headset?

Yeah, yeah, turn it off. And, and I'm immediately responding to a media query, and with the media, they either want to comment right there and then, or they want to book you for TV within a couple of hours for breaking news. So that all occurred in the mid-'90s, and By 2001, my small business was doing okay. I was still a pipefitter at the time, and then 9/11 hit. And so when 9/11 hit, I had already established myself as a voice in the industry, as a source for media, for journalists, as a speaker, as a trainer. And when 9/11 hit, what I was saying for, at this point, probably 8 years mattered. People wanted to hear more. And so, uh, I basically quit my job and went full-time and immediately, you know, began to make a living, uh, speaking full-time. And, um, here we are today. Like, identity theft back then was the easiest crime to commit and the hardest crime to get caught for, and it still is. Now we have organized web mobs, and here we are, right?

So you've seen the industry really change. And not even that, like, you know, September 11th was a milestone I think COVID-19 is a milestone, right? You know, each one had its own kind of pivot structure for, you know, how people perceive cybersecurity, both on the corporate side as well as individually. So tell me about what the kind of the highlights of, you know, your message, because you're very— obviously you're very passionate about the industry and you're passionate about helping people, individuals, and companies as well. So, for example, I noticed you came out with a kind of list of things that companies can do to protect themselves, right? You know, maybe we can kind of jump right into some, some current events. If you've seen right now, you know, like the kind of the phishing scams and work from home scams that are happening right now through, you know, through the situation and potentially what do you recommend for companies to do, you know, which also I'm assuming also include like, you know, cybersecurity awareness training and so on.

Yeah, so you know, in all the years that I've been doing this, what has changed and what's not changed is obviously there are so many resources for small, medium, large businesses to shore up their networks. You know, managed security service providers, phishing simulation training, there's so much, virtual CISOs, in-house IT people, anything and everything that you need as an organization to protect your networks is there for you. It's just a matter of making that investment, knowing what your options are and making those investments. And the problem is that security still isn't embraced as it should be. You know, as a society, as a culture, as a species for that matter, we don't look at security as a necessity. We look at it as a pain in the ass, as an investment we'd rather not make. And because of that, our focus isn't there. And you know, you might have heard somewhere along the lines, "We become what we think about," right? Well, if you don't think about security, you're not going to be secure. If you think about McDonald's all day, you're going to get fat and heart disease. So we become what we think about, and security just isn't high on our list of priorities. And it begins with the individual. It begins not necessarily with the employee. It begins with the CEO. It begins with the company officers. And if those company officers, like the ones at Equifax, don't care or don't necessarily do their job effectively, or security isn't a priority for them, then it's a matter of time until they're breached. And we see that across the board with corporations small, medium, and large. If the CEO's password is princess or password1 and he's using or she's using that same password across multiple accounts, by example, everybody in the company is going to fail. The company will eventually get breached because that CEO just doesn't care. And that CEO ultimately is a NASCAR dad or a security dad who may not necessarily be thinking in terms of security and just be thinking about racing cars and soccer and this and that or football or beer. And unless your head is wrapped around the fundamental principles of what security is and isn't, like it's not paranoia, you know, it is something that will happen to you if you have your guard down. It does require diligence and it requires a bit of focus like all the time. Benjamin Franklin once said that to be safe is never to be secure. I live by that, and that does not mean that I live in paranoia. It does not mean that— what it basically means is security is 24/7, 365, always. And the moment that you drop your guard, the moment that you stop thinking securely, that's when the bad guy gets you. And most people are simply sitting ducks And they just don't think it's going to happen to them, and they don't want to believe it's going to happen to them, and they function in a state of denial. And it's that denial that makes it really easy for the bad guys to do their job.

I thought that there was more awareness now. Like, I thought at the— as you mentioned, at the board level, you know, in the past several years, it looks like that, you know, the CISO now is starting to report to the CEOs, and it seems like there is movement towards being more aware and more cognizant about, you know, security controls and so on. In your opinion, it's not enough, or why haven't we seen like a major change in the security stance? And we keep seeing, you know, these security breaches happen on a daily basis. It's almost now it's almost old news, right? You know, a few more millions, you know, like accounts got breached and it's like it's no more news anymore because it happens so frequently.

Back in the early 2000s, 2004 and '05, it would make national news when a university in California had 600,000 records compromised. It would make national news when ChoicePoint, an information broker, was breached and 250,000 records were compromised because they let Nigerians in the back door, or actually in the front door for that matter, and they lied about it. And there wasn't data breach notification laws from state to state at that time, only California. Had that requirement. And so, and then there was the Target breach, right? TJX. And so, it was breaches like that that began to gain attention, and then companies providing all the various products and services to protect those networks, and then the companies providing security awareness training began to do a really good job of penetrating the Fortune 1000, the Fortune 500, and so forth. So there is a lot being done. But there isn't enough being done due to the fact that like I think like 60% of small businesses haven't even, don't even provide any form of security training awareness, awareness training at all or phishing simulation training for that matter. It's really only like the major corporations like the UPSs of the world and so forth that have millions of dollars to spend on InfoSec and on the training that's necessary, whereas the rest of them They just don't think that they're a big enough target for that type of fraud, but they are. And it usually— think of it like this, most home security systems are installed when the— after the house is broken into. That's most people's general mindset when it comes to security is like when something bad happens, that's when they do something about it. And you've heard a thousand times, If you fail to plan, then you plan to fail. When it comes to cybersecurity, if you fail to plan, you plan to pay. And you're paying lawyers, the government, hackers, and ransomware. Um, that is going to continue to get worse until, uh, all of these smaller businesses begin to shore up because they are the low-hanging fruit right now. Only like 25% of the public or less uses a password manager. When you think about that, 75% of the digital public does not use a password manager. And as long as we have passwords, you're going to need a password manager. Otherwise, you would have to have the same password across all of your accounts in order to remember them. How otherwise would you function? Using an Excel file? A Word doc?

Well, yeah, they reuse the same password, make some changes, very minor. Minor changes to the password. So, you know, this is an interesting question, but Josh says, how do security pros cross those business lines to create or build upon a company culture of security? What are some practical approaches to get this done internally? You know, how do you advocate for that internally?

I love that question. And that really begins with— so we are a selfish, self-interested, selfish creature. We have to be like Being selfish is not necessarily a bad thing. You know, in order for you to function, you got to get some sleep. You got to eat properly. You know, you got to take care of yourself, and that means you have to be selfish. You have to take care of yourself. You get all grumpy if you don't sleep. You get all grumpy and sick if you don't eat. So fundamentally, you got to take care of yourself. And security-wise, fundamentally, you have to take care of yourself. And I think that all corporate security begins with the individual. In their person, in their personal security. So I think that the way to get the dollars for your budgets to invest in security is by making it personal to the people who, uh, are responsible for those budgets. And the first question you ask is, do you lock your doors? Okay, good. Do you have a home security system? Well, why don't you have a home security system? Well, because they live in a safe neighborhood. Really? So find that, that person's address, find their police blotter, and find all the burglaries, and find all the home invasions in and around where they live, and show them you're really not in a safe neighborhood. You might be in a safer neighborhood, but your understanding of what safe is and safe isn't is wrong. Because in baseball, you're either out or you're safe. Safe is an absolute. And most people live under the illusion that they are safe, and they're really not. They are— they just haven't been chosen yet, you know. So when, and when you begin to make security more personal to them and their family and their lifestyles, they begin to understand more about the bigger picture. Ask them questions like, do you have identity theft protection? Well, did you know that like 17 million people are affected by identity theft every single year? Do you have something called a credit freeze, right? A credit freeze locks down your identity and prevents new account fraud. If you don't have identity theft protection, if you don't have a home security system, if you don't have a credit freeze, then you really aren't even qualified to be making decisions on my budget as a security professional because you know nothing about it. You know, uh, have you had the uncomfortable conversations with your family about sexual assault, both with your sons and your daughters? You know, this is an uncomfortable conversation you and I are having right now that I'm suggesting that your audience have with the decision makers because that's the reality of this. You know, if they don't have these uncomfortable conversations that I have with my audiences all day, every day, I get in front of my audiences like this and have uncomfortable conversations about the reality of what's going on out there. I'll pull up the Sex Offender Locator app in the, in the zip code that I'm in where I'm speaking, and I'll show on the screen all the little red dots of all the sex offenders that live all around the hotel and the convention center. Hundreds to thousands of them. There are 859,000 registered sex offenders in the U.S. That's predators all around us. Just understanding how security is personally, right, we begin to see the bigger picture. And that security isn't about paranoia. Most people, when they talk about, well, I don't want a home security system because I don't want to be— I don't want to live like that. What the hell does that even mean? To most people, that means I don't want to lock my doors because I don't want to live in fear. Really? So you think that security is about fear? Is that what you think? Now, when you put your seatbelt on, are you in fear or are you being smart? You're being smart. Well, so people don't understand that security is about taking control. A seatbelt is about taking control. It's about giving you control of the vehicle. So if a deer does run out in front of you, right, and you start to swerve, you're stuck in that seat really tight. You can hold on to that steering wheel and your feet are right at the gas and you're not rolling into the passenger seat. So when you begin to explain security as a benefit, as a plus, as it's good for you, like broccoli, then you have a much better chance of selling them on the budget. But it takes a real deep understanding of the human psyche and how we reject security as being paranoia and fear, especially in the US culture. Now I understand that you from abroad, you're from— you spent what, half your life in Israel, right?

Yeah, in Israel, Canada.

Yep. Okay, well, the Israelis, they know about security. So you are under no illusion as to risks that you face every single day. So I'm guessing that you are in tune with everything that I'm saying here and have all those various systems in place, right?

Yeah, I mean, it's, it's part of the culture. Yeah, I completely agree. Yeah. And I love, I love the, uh, you know, I think that this— I can make a t-shirt for the group, you know, security is good for you like broccoli.

You know, look, when you see all those people in the swimming pool drinking, uh, with pee all around them, and there's COVID floating in the air. Those people do not care about security, right? They are in denial that there is a virus out there that's killing people, and they think, well, it's not going to happen to me, I am perfectly fine. And that unknown, unseen enemy, it will kill people, and it is killing people, and people are functioning in a form of denial when they're out and about thinking that, "Well, I'm young. I'm strong. I'm not worried about it. It's not going to happen to me." These bad guys are on every corner. The internet's a bad neighborhood, and unless you fundamentally understand security at its granular level, you can't possibly communicate it in regards to getting it for your budget.

Right. So interesting. So what you're saying is that security has to be at the core foundation of individuals that are combining the company. And it has to be a kind of mantra for everyone who is in the company, not just from the CEO all the way down to, you know, the employee and people that are, you know, receptionists, whatever else. It has to be in the core culture of the company, I think. And you're right. I think it's— you can't distinguish physical security from, you know, from cybersecurity. It's all, you know, it's all security, right? And same goes for health, right? It's about the same concept. So tell me about it. You touched upon a really interesting comment. You made an interesting comment about the fact SMBs, you know, seems to not think that they're going to get hacked, that they're not a target. What do you think that is? Why is that they feel that they're— because they do have assets, you know, they do have. And I've seen cases where you know, a small factory making tires for 25 years got hacked because they were, you know, it was nation-state. They were looking specifically at the process of how they, you know, perfected the manufacturing of tires. And that because we're a knowledge-based economy and they were hacked eventually, and that, that knowledge got stolen, you know, despite the fact that we're, you know, essentially a low-tech company, a very small one.

Yeah, it is fundamentally because the people that were in charge of the organization, those that were responsible for the creation and the invention of those ideas and the run and the operation of the company, that security was just not something that was of interest to them. Like they just wanted to build out their business and make some money and get paid and provide value to the marketplace, and security is an afterthought. Look, if security is an afterthought in the building out of a software or an application, What happens to that software and that application once it's deployed? It gets hacked. You know, there are holes the size of London town, you know, it's vulnerable, right. You cannot build out an operating system or software program without engaging in the application security process from the very beginning. And it's the same thing with a business, and today we all have the ability to bring in professionals that know about what that organization's options are in regards to managed security service providers that can look at the bigger picture. And you might be spending a grand, 3 grand, 5 grand, 10 grand a month, a quarter, a year, depending on the size and scope of your organization and what needs protecting. That is an investment a lot of organizations do not think or want to spend, and they will find reasons to justify that they are not a target based on whatever.

And you also raised the really interesting descriptive of car security, where they say, OK, you have to wear a seat belt. What your thoughts are on compliance and— the cars were going 60 miles an hour way before they were mandated to wear seat belts in the car. People died because they were thrown out of vehicles. And then the government said, OK, you have to have a seat belt in the car starting from this year. So what's your thought about putting together some sort of regulatory— and I think there is already a regulatory environment where it forces organizations to comply. I know New York State has some, you know, Mass has some. I mean, what are your thoughts about forcing these organizations to really put security in place?

So there are a number of regulations, both state and federal, throughout the country. Of course, you know, there's data breach notification laws, but that's just one level. Having those existing systems in place. Massachusetts, New York, California, they all have lots of strict rules and regs in the books. California usually does the best, and it rolls out from the West Coast to the East Coast. But again, New York has done a fabulous job, and so has Massachusetts. That being said, the only time it's ever actually enforced is when there's a problem. So there's no reporting mechanism currently in place to show that you actually have a level of security required to make sure that— other than if you accept credit cards, then you have to have some type of remote access to make sure that your system is up to snuff in order to maintain merchant status. Other than that, and that's all self-regulated. That being said, getting back to the seatbelt, you know, The seat belts have been around since the '50s. The seat belts have been required to be installed in US vehicles since 1968. My dad cut the seat belt out of our cars in the mid-'70s because he didn't want them and need them. He's like, what do you need these things for? In the United States, we— not all states require that you wear seat belts. I think only 24 states require by law that you wear seat belts. And the other 23, I think that they will only fine you if they pull you over for another moving violation. Right? And there's one state in the country that you don't have to wear a seatbelt at all. And that is New Hampshire. And New Hampshire's motto on their license plate is "Live Free or Die." Okay? So the seatbelt law most people have only started to click it over the past maybe 10, maybe 15 years because they've been forced to because of the laws. And it's really only because of regulation when you clamp down on an organization or an individual in this case that makes them accountable when there is a breach or when there is some form of vulnerability. But I don't think that the pain of being accountable has matched up to how vulnerable it's made our citizens. I think there's like 30 to 40 billion records currently in the hands of companies.

Oh, it's amazing. You go to have I Been Pwned, and I personally have been, you know, my email address has been, you know, in numerous breaches. It's got to be like 20 to 25. It's remarkable. So, what would it take, and when you say pain, I'm assuming that that would translate to fines? I mean, that's typically what we're looking at. What do you think will cause, you know, painful, you know, results? And, and I mean, they're already spending— it looks like some organization— there's a good question here by a theme. It says security professionals and leadership do not take security seriously, as you're suggesting, or the system and the tools are not designed to work properly to enable turnkey solutions. Says many millions are spent on software and appliances, consultants, but the result is largely the same. The same, you know, like in terms of these breaches happening. It seems like they're, despite the, at least for the larger organizations, they do spend some serious money on security.

Yeah, look, there's no such thing as 100% security. There's no perfect security. There's always going to be vulnerabilities out there, but the low-hanging fruit are those organizations that don't necessarily have those systems in place to constantly monitor their networks for anything going in and out of their ports, any traffic that they detect that is an anomaly. There's a lot that isn't being done that could be done, and it's all those organizations that are that low-hanging fruit that don't have those MSSPs deployed to penetrate their networks to look for those vulnerabilities, to make sure that all of their hardware and software is properly up to date. I mean, heck, we still have in this country, there's ATMs using Windows XP, right. So you know, when an organization looks at all of their security holistically from the top down and the bottom up, penetrating it from the inside and from the outside, legacy systems, when they take a holistic approach, they have a much better chance of thwarting fraud. Look at Wells Fargo, spends like, I think it's like $100 million a month, like this ridiculous amount of money on security every single month, you know, but it's not your Wells Fargo that's going to be breached. It's, you know, Harry Homeowner sitting in front of his device that has the same password across 37 different accounts that his information is already out there on Pastebin, and the hacker just logs into his email and just changes his Wells Fargo passcode, and he's already inside of his email, so he's there to receive that change of password request. Uh, it's stuff like that, and two-factor authentication should be deployed across every single critical account. Of course it is on banks, but it's not widely deployed enough. As far as the grandmother test goes at this point, everybody needs to be up to snuff on the most basic level of security. And if all you're using is a username and a password to access critical accounts, you are not secure. You are vulnerable. You are running naked in the woods, and eventually you're going to get pricked, and it's just a matter of time. Until you're breached.

Right. And we see now that the move, the rapid move to digital transformation due to the COVID-19 create like even additional entry points to most organizations. What have you seen that— I'm assuming that you've seen a lot of companies scrambling to provide VPN access to employees and allow them to work remotely, you know, almost overnight. You know, in terms of recommendation, what would you recommend for companies like even SMBs and medium-sized businesses? You know, what are the kind of the low-hanging fruit that they can kind of take the steps to secure their perimeter? Or there is no perimeter, right? It's all zero trust, right? So it's people logging in from their home machines and the kids can be playing, you know, online games on the same laptop, this work laptop. This is something that's happening all the time. So what would you recommend for these companies to do?

Well, at a minimum, of course, MDM, you know, mobile device management, you know, whatever devices that employee is using offsite need to be in somewhat control by the organization. And that means such control that it eliminates the ability, it eliminates administrative access to be able to even install anything. It also eliminates the ability to, you know, go to YouTube for that matter. So those work-at-home, those BYODs or work-at-home devices I think need to be locked down. If the organization isn't deploying their own devices, which they probably should, it would be in their best interest to spend a grand on a laptop or a desktop and a monitor. And that device itself be locked down and the only way that the information can be accessed on the corporate network is with that locked-down device. Look, if you are a financial advisor, you really can't do much with your clients in regards to the exchange of client funds, the exchange of communications. If you work within a bank, a financial institution, It's very difficult for you to do anything on your mobile device, on your laptop or desktop, mobile phone without oversight. It's pretty tight. The MDM that's deployed through, say, Merrill Lynch or Fidelity makes it very difficult for these financial advisors, financial professionals, wealth managers to make mistakes, right? The organization protects that individual from themselves and from making any mistakes. And I would say that no matter what the nature of your business is, if in any way, shape, or form you're engaging in sensitive data, personal information, proprietary information, anything that could get the organization in trouble in any way, shape, or form—ransomware, proprietary secrets—then there should be an uncomfortable conversation in regards to next steps, what investments need to be made to make sure that that employee does not make the mistakes that they easily could if their kids are gaming or downloading pirated software or, you know, on BitTorrent downloading, you know, hacked movies.

Yeah, I mean, that's definitely a concern. One other thing that you mentioned recently is that some of the privacy concerns around COVID-19 and collection of data. I think there's always been a fine line between data collection and, I guess, benefit to the consumer, the users, or being used by the companies. What's your take on it, and how can companies kind of protect themselves, you know, individual protect themselves from, from that data collection? And where do you think that line, uh, should be set?

Yeah, you mean like, like contact tracing? Yep, exactly. So there's a fine line between security and privacy, right? Uh, and I am of the mindset that I am okay giving up a certain level of privacy for a little more security. I've always been, uh, in that regard. Like, for example, I have I have wireless cameras that I know ADT monitors, okay. Whether or not there's somebody at ADT watching my cameras, my guess is they can, I mean I know they can. That said, I prefer to have the cameras than not have the cameras, right. There's no cameras in the kids' bedrooms, there's no cameras in my bedroom. All that being said, I'm okay to give up a little bit of privacy for that opportunity to be able to remotely monitor my home. And yeah, I could, and I also do have systems where, you know, they're isolated from anybody but me and everything's under a VPN and so forth. That said, you know, Google, Apple, they all have their flaws. They have all of our best interests in mind in regards to the contact tracing. Will there be some, uh, risk by putting information out there? Absolutely. How will that ultimately affect the quality of your life? How will that ultimately blow back on you in such a way that could potentially affect your ability to be insured, health insurance? How might it affect, um, your ability to get a job or your reputation? Uh, how might it affect your ability to feel safe or secure or private in your own home? What kind of blowback could there be? You know, I've read enough sci-fi and seen enough things happen in real life that I know there could very well be blowback. How big of a problem might it be? Well, you've got organizations like EFF and others where there's some level of checks and balances. You have all your watchdogs. That look at all of these various systems in place and how and what can go possibly wrong. And these organizations, while they are for-profit, I think in the end, you know, they also want to make sure that their employees are safe from COVID right, that their families are safe from COVID Will there be some greedy people that might use and abuse that information like Cambridge Analytica did? Absolutely. But will that type of information be used in such a way that Cambridge Analytica did? I don't think so, right? You would hope not, right? So there is definitely a give and take. Am I going to give my name, address, phone number, and Social Security number for instant credit for 10% off of a shoe store? No. But might I give some basic information for contact tracing? Yeah, I feel okay about that. You know, I want this thing to go away and we may never actually have a cure for it. You know, there isn't a cure for the common cold, there isn't a cure for AIDS, you know, so I'd like to see there be a cure for this one. It killed what, 40% of the people in old age homes, senior centers, and you know, my mom, my dad, my mother-in-law, you know, they're in that demographic. Mm-hmm.

And, you know, we've seen after September 11th, there are a lot of, like, regulatory and, you know, things that were put in place right after September 11th that were never actually taken off. Do you see, you know, some measures that are going to be put in place right now, you know, due to the COVID-19 that will stay even after we're going to pass through it?

Yeah, well, after 9/11, there's the Patriot Act. You know, and there was some good and some bad that came out of that, right? There's all additional levels of authentication as a result of the Patriot Act, which is a good thing, actually. You know, I honestly, I don't know. I don't know the answer to that. I don't know if I'm qualified to answer that. There's going to be some give and take. There's going to be some negatives, but I think overall there'll be some positives.

Which kind of leads me to the next question. So what, um, you know, I try to keep like, you know, and these are in positive notes, you know, since we're, um, you know, there's all kinds of things going on and every, you know, I stopped watching the news because it's just like, you know, it's like more of the same. Um, and, uh, you know, I always mentioned that, you know, there are some positive aspects of what's happening, uh, due to the pandemic is, uh, um, Collaboration on the healthcare side, you know, there seems to be some countries helping each other and so on, and seem to be solidarity, right? I think I've heard from people that they walk down the street and people say hi to each other again, right? From your perspective, like, and maybe you can do like just some personal note or just, you know, related to what you do, what are some of the, you know, positive aspects that what you've seen so far, aside from having more time to catch up on some reading?

You mean regarding COVID-19 as a whole? You know, I don't want another person to die, but, um, uh, that said, our— the entire world needed to chill the hell out. You know, we really needed to like just chill out and take a step back. Most people I talk to, they have not slept this good in, in their entire life. Um, most people that I talk to, um have not had as much bonding with their family in their entire lives. Most people that I'm talking to are getting more done in and around their home, and their ability to work from home has increased exponentially. Obviously, there has been the positive effects in the environment. So I think there has been a lot of good that has come out of this. I do think it has required us to, to look deeper at everything and make smarter, better decisions. I've heard something going on around social that we're all in the same boat. Well, we're not all in the same boat, we're all in the same storm and everybody's boat is a little bit different. Yours might be rocking a little bit more than mine and this and that. We are all in the same storm and not everybody is handling it the same way. I am a security professional, and so I've been preparing for this my entire adult life. You know, and any of you watching, if you didn't have enough toilet paper up till COVID-19 and you scrambled for toilet paper, shame on you. You know, and honestly, I don't even know how you can consider yourself a security professional if you didn't have enough toilet paper or food or water or a backup generator. This is all stuff that you should be thinking of. If you fail to plan, you plan to fail. That goes with everything, medicine, everything. I think that the introspective aspect of the entire COVID-19 is a really good thing for humanity in general. I still think we are destroying the planet. We may never recover from it, but I think we have certainly done a really good job of looking at ourselves. I mean, I know the relationship with my wife is a lot better. She's a lot calmer. She doesn't have to drive 45 minutes to the kids' school every day. And I'm loving the fact that the kids can do homeschooling. You know, it's more time together. So, and I think as far as security goes, I think that this is an opportunity for all the small, medium businesses to take a hard look at their expenses And I've seen that as much as 70%— and this is a stat you might be able to research— as much as 70% of businesses, you know, since COVID-19 are making more investments in security as a result of this, which I think is a really good thing. I think security in and of itself is becoming more consumable both for consumers and small to medium businesses, which is a really good thing. It is in some level passing the grandmother test. In many aspects. That's good.

That, and as you mentioned, I think that garages across America are getting organized. You know, this is— So Robert, it's been a real pleasure. You know, where can people find you? I mean, I'm going to share some of the contact information for you, and you publish 5 books, right? So maybe we can do is can share those links afterwards, but where can people find you? What's your website?

So I am, uh, at, um, uh, safar.me. So safer, safar.me. So safer me. Uh, and I'm also at protectnowllc.com. So protectnowllc.com. Or just Google Robert Siciliano. If you Google Robert Siciliano, you will find me.

I own this. You've been, you've been on, uh, you know, since, uh, 2006, right? Is that what you mentioned?

I've been online since '94. Yeah, right, right, right. So the whole Led Zeppelin thing did not go well.

Maybe we can, uh, so here's what we're gonna do, uh, once we go back to normal and we do this physical events in New York City, I invite you over to do like a physical, uh, you know, session. And then maybe we can start then and in the story of, uh, you know, how, how he came to own LedZeppelin.com and what was the story behind that. And then maybe I'll even play some some songs in the background to, uh, to tag it up, you know. So best— yeah, absolutely, I could— I concur. Thank you very much, it's been a real pleasure. Thanks for everybody for, uh, you know, for joining this session, and, uh, looking forward to, uh, you know, to, uh, potentially seeing you in New York and in person.