Safety Talk –Identity theft & data security with Robert Siciliano from Safr Me

Welcome to Safety Talk. Personal safety expert Pete Canavan shares his insights and interviews experts who provide simple and effective tips, techniques, and technologies to keep you safe and secure both online and off. Here's Pete. Hello and welcome to Safety Talk. I am your host and personal safety expert Pete Canavan. I have over 25 years of personal safety and security experience as my role as the host of the show. Uh, today's guest is sure to produce a popular episode. Uh, he's someone who shares my passion for safety in both the digital world and the physical world. Uh, he's a security expert and private investigator who's fiercely committed to informing, educating, and empowering people so they can protect themselves and their loved ones from violence and crime in their everyday lives, both in their physical interactions with people and their virtual interactions with people. And this is something that I am passionate about and do as well, and it's going to be a really informative episode here today. So Robert Siciliano is the number one bestselling author of, and he's CEO of a company called SAFER.me, S-A-F-E-R.me, and he's also the architect of the CSI protection certification, which is a cyber, social, and identity Protection Security Awareness Training Program. It's a mouthful. So it's my pleasure to welcome Mr. Robert Siciliano to Safety Talk. Welcome, Robert. Thanks for being with us.

Thank you so much, Pete.

So glad you're here because, you know, improving safety and security is what we are all about here at Safety Talk. And now one of the things that I asked my guests to do is to sort of summarize everything that they do into sort of one sentence. That is, a, you know, that describes the problem that they solve in the world. And it's, and it's sort of, it's a big thing because, you know, someone like yourself, you do a lot of different things. A lot of the other guests we have on, you know, they may have a lot of different products that their company has, but it's a heavy question and it really requires, you know, that you summarize what it is that you do in a compact way. And in your case, you wrote that you work with both private and public businesses and you teach clients how to keep their money their privacy and their data secure, which is awesome, against acts of fraud, identity theft, corporate espionage, and purposeful or accidental exposure of private information. All, of course, things that cost companies billions of dollars nationwide and worldwide, of course. So I really love that statement and want to kind of get your thoughts on that before we dive in with some specifics here.

Yeah, well, certainly we know that bad guys are looking for their victims 24/7, 365. And most of the general public, moms and dads, soccer moms, NASCAR dads, families, they're relatively clueless when it comes to this stuff. They don't really have any formal training when it comes to protecting their home or if they're a small, medium, large business, or even protecting their business. And it's only when someone has a small business or large corporation to protect, that they are actually engaged in any type of security awareness training. And so what I do is I provide that security awareness training to basically anybody that will listen to me. And it's usually those that have something to lose, like, you know, corporations that hire me to come in and do, you know, 1 to 2 hour keynotes. Or say the real estate industry, continuing education training. I provide them with all the fundamentals so that if a bad guy was to choose them as their next victim, which really that's happening all day every day, that they'd know what their options are. They'd know how to protect themselves. They'd know what links to click or not to click. They'd know how to, you know, look to the right and to the left and knowing what's going on behind them when they're walking down the street. So I give them, you know, everything from protecting themselves in the physical to virtual world. So that going forward, they are a tougher target. And that's really all you can do. I mean, bad guys have always been, are, and always will be looking for the next victim. And all you can do is become a tougher target so they don't select you. And that really boils down to taking responsibility and recognizing risk and knowing how to avoid and remove yourself from a dangerous situation, whether it's online or in the physical world.

Absolutely. And it's stated so well. What I've found as well, and I'm sure you have, is that a lot of people think, maybe like a small business owner for example, "Well, you know, I only have a small company. I'm only doing whatever, half a million dollars a year in business, and so why would somebody want to target me? I'm not worth their time." But they don't understand necessarily that there are these automated systems that just look for vulnerabilities in networks, and they don't have any— necessary, you know, they're not necessarily targeting you specifically, but they are using automated systems to go out and find vulnerabilities. And so if your system at your particular business does not have the latest updates, the latest patches, the hardened firewall, a properly configured, you know, network setup, or is not using VPNs properly or whatever, if a hacker, an automated system finds that, it's going to flag it then it's going to go to, you know, whoever's, you know, monitoring and say, hey, I've, you know, we have a system here that has a vulnerability. And now they can do something like, you know, plant ransomware and take it to the next level. So even in your, you know, somebody has a small business, it could be completely detrimental and even put you out of business if you don't have a solid backup of your data and a ransomware attack gets in there, encrypts everything. And now, you know, they drop a note on the desktop that says, you know, you got to pay us $20,000 to get your data back. Well, that could be something that puts that company out of business if they don't have the policies, the procedures, the systems, the backups in place that are going to protect them. And so, the awareness part of it is so key and something that people need to understand. It could be an individual, you know, identity theft. Identity theft is something that you talk about a lot, and it's something that every single one of us has to be careful of, and we have to, as you said, be careful about what we're putting out there. We have to look around us. We have to be aware of what's possible from someone who is looking to do us harm, whether specifically by targeting the individual or just by going out and sort of shotgunning the approach and finding a way in. And now it's like, oh, I got into this person's account. Maybe they use the same password over here. Oh, haha, they did. And now you're in this account and this account and Money gets drained, and lives are ruined. And that's something that we're trying to stop and prevent from happening, right?

Without a doubt. When you began that, you said you talked to various businesses and individuals, and the first thing they say is, "Why would they target me?" Right? And that fundamentally is two different things. Number one, they're invoking on their own the failure of imagination. And that is a security axiom. You know, the 9/11 Commission invoked the failure of imagination, that we as a government, as a country, we didn't imagine that 9/11 could happen, and of course it did. I mean, there were some out there that had said, you know, it is just a matter of time till something happens, but nobody wanted to believe it. And because of that failure of imagination, We essentially function in a state of denial, right? Knowing that things can and often do happen. And you see it on its most basic level all the time. For example, if you're watching the 6 o'clock news and they talk about a home invasion, they talk about some type of a local tragedy, and they begin to interview the neighbors. And the neighbors are interviewed by the journalist or the producer or whoever, and what's the first thing that they say? They say, "Well, you just didn't think it was going to happen around here." Well, how do you not think it's going to happen around here? It always happens. It happens everywhere. And that's always the first thing that people say, because they don't want to think it can happen around here. It's not that they don't think it, it's because they don't want to think it, and maybe they just didn't imagine it. It's too painful.

I think what happens is it's too painful for people because they feel overwhelmed. It's like, well, why would somebody target me? Maybe they will target me, but what can I do about it? And they kind of leave it at that.

Yeah, and it's much more comfortable to not think about it, and it's much more comfortable to function in that state of denial, to put it completely out of your mind and say— I mean, and this is, you know, a fundamental— is that it can't happen to me. And when, when people, you know, think in those terms, they are setting themselves up to be the bad guy's next victim, and that's just not okay. First and foremost, recognize it can happen to me. It does happen around here, whether that's your data, your company's information, your home, and when you think that yes, it can happen to me, and then you put systems in place, you do the necessary steps, perform the necessary steps to make sure it doesn't, again, becoming a tougher target, you reduce that risk, and the bad guys are gonna go after somebody, like I said, they're just not gonna go after you, or if they do go after you, they approach too many layers of protection, Therefore, you divert them, they go after somebody else.

And every single victim always says the same thing, "I never thought it would happen to me." And it's so true, and it's because people don't think it's going to happen to them until it does. And every single victim says the same thing. So, like in my martial arts training with my students, I tell them that we're training not if something happens, we're training you for when something happens. And that simple little shift in mindset from an if to a when makes it more concrete, and it makes it more real. And the same thing has to be done in all sorts of training, like in the cybersecurity realm or in identity theft or in data loss or anything. It's not a matter of if, it's when. And it sort of becomes such a cliché, but when you look at it through that lens of knowing that it will happen, it's going to happen, and you need to be prepared for it when it does. And it changes the mindset and it lets people, I think, uh, it lets them digest it a little bit. Uh, you know, it's a tough pill to swallow, right? So it allows them to digest a little bit more easily, even if it is a little bit more uncomfortable. And, and that's really what it is. People caught up in their lives, you know, you're dealing with your kids running around, you're worrying about your job, you're worrying about bills, you're worrying about holidays, you're worrying about whatever the next thing is. Right. And it's like, well, I don't have time to think about like, is my, Is my data secure? Are all my accounts good? Do I have everything backed up that I need properly in my business? We all have a million things that distract us on a daily basis, but if we don't make the time to be proactive in protecting ourselves and taking that personal responsibility, like you said, right, Robert? It's all about personal responsibility because no one's going to protect you but you, right? Unless you got a bodyguard. In which case they're not going to be there all the time anyway, right? There could be certain times they won't. So we have to be personally responsible. And it's, it's something that it's so much easier to deny it and to ignore it until it happens and then it's too late. And our job is to let people know it's not too late. You can start learning today some of the things that you need to do, and you start out by assessing what those risks are to you personally, right? If you're a business owner or if you're an individual, or anybody in between, what is it that you're most concerned with? What is the greatest likelihood of something happening to you? Is it that you're going to be robbed? Is it going to be a home invasion? Is it something with a business that you're in or whatnot? Looking at those risks and then ticking them off, it's like, "Okay, have I done this? Yes?

Great.

Have I done this? No." Well, to get it on the list and figure out what those priorities are.

Yeah, and it fundamentally does boil down to personal responsibility. You and I know that. You start talking about all these various risks, right? And people say, well, I don't wanna live like that. I don't wanna be paranoid, right? And that's the funniest thing to me because if you understand what paranoia actually is and if you've ever actually met somebody who's paranoid, that's a disease, right? They are mentally ill. And security is the complete opposite of being paranoid. Security is about being in control, whereas paranoia is out of control. And so once you, once people like you and I provide this lens level of perspective, and we kind of slow down and back up a little bit and say, "Ian, just so you know, the chances of something bad happening to you are actually really slim. There's a slim chance that these things can happen to you, but there's a chance." And so the same way and the same reason why you put your seatbelt on is because you know there is a chance that these things can happen. You put your seatbelt on just to be smart, to be safe, and you're not being paranoid. You put your seatbelt on, you're being smart. And being smart is locking your doors, installing a home security system, investing in identity theft protection, engaging in a credit freeze, you know, understanding the fundamentals of information security and personal protection. Once you engage in these basic philosophies, these basic, you know, steps, uh, again, you reduce that risk. You don't have to worry about these things because now you've put these various systems in place. Benjamin Franklin once said that to be safe is never to be secure. What that basically means is like you always have to be on your toes. You always have to be aware. You can't think, okay, well, I am 100% safe. I have nothing to be concerned about. Therefore, we are cool. Well, yeah, you know, sure, yeah, but no. You really have to be on your toes, but that does not mean being paranoid. It does not mean that your head's on a swivel. It means that you are aware of your environment. You are aware of these various risks. You're doing the basic things to protect yourself, your business, your family, and so forth, and that you have become a tougher target.

And it's all about preparation, because when you're prepared and you know what to do in a bad situation, guess what? There's no more fear. There's no more uncertainty. In fact, the exact opposite holds true, right? You gain confidence because if there is a problem, you're like, for example, a cybersecurity program for a business. If you are hacked, okay, you will be hacked, chances are. In fact, a lot of businesses are and they don't even know it. So if that happens, when that happens, right, you have those procedures in place and so you know. So you can sort of rest easier knowing that when there's an event, you've already mapped out the procedures and the plans to deal with that. So it allows you to have the exact opposite effect on yourself and your business, your employees, etc., because people know there's a plan in place, right? It's no different than a fire drill or some— an evacuation, or being prepared with wearing a seatbelt or having car insurance in case you get in an accident. These are things that we do to make sure that we know we have a plan in place for when the unthinkable happens, right? And that could be a very bad physical altercation. It could be a very bad digital problem. But if you know what to do, the fear goes away, right? Because we know what fear stands for, right? False evidence appearing real. That's all it is. And when you take the fear away and you take the uncertainty away and you have awareness and a plan and you're prepared— and you can't be prepared, you know, that like one of my phrases is the time to prepare is before the need arises.

Proactive.

Yeah, you have to be proactive.

And as an expert in personal security, right, you teach people how to prevent assault, right? And once a person understands how to physically debilitate, or once you understand your own personal power and how if you were attacked from behind or the side or an attacker came up front, you go for the eyes, the throat, the groin, and you know how to physically debilitate another human being, you know how to be offensive, right, if necessary. Every other decision in life from that point on becomes, you know, relatively simple. You gain an enormous amount of perspective by understanding what your personal power is and how to physically debilitate another. It does definitely give you a heads up on everybody else going forward.

Sure, and that level of confidence exudes and is picked up by other people in other areas of your life. So it ends up actually improving your standing in your business, among your peers and your friends, because you're somebody that has the confidence that knows they can handle themselves if there's a problem. And it's interesting because, I mean, that happens to me sometimes where I walk in a room and people are like, "You look like you can handle yourself." And I'm like, "I do? I don't even know what I'm doing, but okay." You know, because it's an attitude, but it also comes from the preparation, right? And that only comes with practice and with learning things. So Good stuff. I want to ask you a question. What— a few questions, obviously, but how did you personally get started in this industry, in the personal safety and protection industry?

Yeah, so for me, you know, as a kid, right, you know, I was 12 years old, right? And my dad let my brother and I head into downtown Boston to do some shopping, right? My brother was like 6 or 7 at the time, and we got on the train. Like, back then, you know, this is what, 38 years ago, whatever, you could do stuff like that. And, you know, he let us go on the train into Boston. We get off the train, we're in Downtown Crossing, and immediately 5 kids surrounded us. And there were 5 kids who were older than us and bigger than us, and they demanded that I give them my money. I was not prepared for that at all. So I refused, right? And, you know, normally I'd tell people just throw the money in one direction, run screaming in the other. But I refused, and they proceeded to take my money from me, and they did it by, you know, beating me down on the ground and going through my pockets, and I made a mess of myself, literally. And, uh, we ended up having to get back in the train, go home, and I'm all beaten and bloody and bruised. And my father sees me, and, you know, he obviously had not prepared us for that at that point, and sat us down and taught us about predators and their prey, right? He explained to us, like, watching the wild world of animals, and you see the, the lions in the plains of the Serengeti, and they'd be stalking the antelope or the gazelles. And my father would say that those lions are Predators and the gazelle, natural prey. And today, you know, those boys were the lions and you were the gazelle. And so going forward, you know, you need to recognize that there's always gonna be predators stalking their prey, and you need to know how to defend yourself. And so I began to see the world very different from that point on. You know, being a victim of a multiple attack situation can certainly do that to you, right?

Sure.

But I didn't— I didn't consider myself a victim. I just, you know, started to understand Predators and Prey. And within about a year or so after that, I was in summer camp and I was, you know, 13 years old at the time, and I met a girl. She was 12. And one day after camp, you know, we were kind of holding hands and she liked me, I liked her, and I didn't really know about sex or anything like that because this is, you know, we're talking 37 or so years ago. And, uh, she confided in me. She said, I just think you should know that my mother's boyfriend raped me. Okay. And I didn't quite understand what that meant, but I felt her pain based on the way she explained it to me, or just based on what she was saying to me. And I went home after that and I said to my dad, "What is rape?" 'Cause I didn't even know what she was talking about. I just knew it wasn't good based on what she said. And my dad began to explain the birds and the bees and forcible rape in the exact same conversation, and then went back to the predators and their prey and the gazelles and the— The Lions, and that began to make sense to me. And so I started to see the world very, very different than kids my age. And so from that point on, I began to teach all those around me about bad guys and sexual assault and what to do and how to protect yourself and what to be aware of. And I used to buy pepper sprays and I used to give them away to all the girls that I would meet and say, "You need this stuff and here's why." And so that became a passion for me very early on. And so from that point on, I started to, you know, take martial arts and teach martial arts, and eventually got into personal bodyguarding and things like barroom bouncing. And by the age of 25, I had written a book on the topic, and I started to speak professionally on it. In like 1995 or 1996, I started to take Visa, American Express, you know, like merchant status via my small business for all the various products we sold. And I got hacked. I got hacked in the mid-'90s. And that was a brand new thing for me. Like, I didn't know you could steal like that. I don't know if anybody did at that point. And so I started to learn more about black hat hacking and fraud and credit card fraud and scams as a result of, again, being a victim of a crime. And by 2001, I had written another book talking about fraud and personal security as it relates to identity theft, which was not on anybody's radar at the time. At least not in the media or the general public. I mean, there'd been a couple of laws passed, you know, you had the Identity Theft Resource Center in San Diego talking about it, and a few others, but it wasn't a huge, huge thing at that point. And here we are, you know, we're 2020, I've been talking about this stuff now for 25 years. And personal security to me is violence and prevention, both in the physical and virtual world. And my focus from, you know, talking about women's self-defense and my own self-defense to my small business being hacked, has just all evolved with the times. And here we are today, and back in the day it would make national news if 600,000 records were stolen out of the University of California. Today, that doesn't even make news. It's gonna take billions and billions of records being stolen because of criminal hackers, and that's my story. And today, there's just no shortage of fraud or theft or violence. Just last night, all of our phones in my home all alerted us to an AMBER Alert of an 11-year-old girl in Western Massachusetts being stolen off the street. Fortunately, they found the guy, but my daughters are all freaked out, my wife is all freaked out, and that's the world we live in today.

It's a very scary world, and even like you learned from a young age, 12 years old, I have a similar story, actually it's pretty funny. Learning about it from a young age, it sort of hardened you to the world around you. And your dad sounds like he really gave you a great education at a young age in helping you understand that and knowing that, look, man, it's not just all happy, happy, joy, joy out there. There are people that are bent on doing you harm. There are people that are bent on stealing because they don't want to get a real job. They're interested in doing the least amount of effort for the greatest amount of gain, and they don't care how they're going to do that, whether it's financially or physically or sexually, right? They don't want to put any more time in than they need to to get what they want. And, and getting that awareness and that education component out to the masses is something that, uh, yeah, I could see why you became so passionate about it, because not one but two, you know, incidents at a young age really showed you that, "Hey, man, there's some things out there that I need to be aware of and know about." So that's— and that set you on this unbelievable path, and now you're changing a lot of lives because of the ability to educate. And so the— I'm gonna pull this up while I'm talking about it. People that are watching this YouTube, when they do this, will be able to see it, but the others that are listening won't be able to. However, I did just have your website pulled up here. Basically, the Smart Safer and Secure Me protect you and your company engaging in interactive security awareness training. So you've got, you know, all these different things that you do from keynotes to corporate training and workshops and seminars, and then there's this SAFE certification which I wanted to ask you about. So what exactly is this SAFE certification? Certify your people and share in revenue.

Sure, so we've actually, and I appreciate that, by the way, we've actually rebranded the SAFE certification. SAFE is Secure Agent for Everyone, so for real estate agents, or Secure Attorney for Everyone. We've actually rebranded that to the CSI certification, which is Cyber Social Identity and Personal Protection. So the rebranding of that occurred about 6 or so months ago, to place, you know, understood cyber, social identity, and personal protection more than just the SafeServe. Anyways, what that is, is we will go into basically any business, any industry. We work a lot in the real estate industry, a lot in the finance industry. You know, as you know, right now, um, manufacturing and automotive and construction are really, really high on hackers' radar right now due to the fact that they— all those industries wire a lot of money. And so what we'll do is we'll present at one of the industry conferences, at a company, and we will certify those on the inside of the organization on cyber, social, and any personal protection on essentially what it is that they need to make sure that the data in which they are entrusted with, whether it's theirs, their family's, their client's information, of course, that we educate them on the fundamentals. A lot of the stuff that both you and I talk to. Knowing that it begins with you as an individual. Like if you don't have a credit freeze, if you don't know what to look for in regards to a phishing email, if you are not engaged in things like identity theft protection and/or credit monitoring, right? If you're not paying for antivirus, like if you have just free antivirus, you don't have a full suite of protection. You're just hoping that everything's gonna be updated properly. If you are not updating your operating system and all of your various software, if you're not using a VPN when you're on free Wi-Fi, all the basic stuff. And of course, that's cyber, and social is online reputation management, right? Which is huge today. Huge. I mean, it's one thing to post that you are, you know, having ice cream with the family, but it's another thing to say you're in Acapulco and you've got your toes dug in the sand and you're having a margarita and you're, you know, a thousand miles from your house and you're opening your home up to burglars. And it's a whole nother thing when you are talking bad about the current administration, you're dropping F-bombs, you're saying bad things about the general public or whatever, you're swearing. That's reputation and that can damage you and your business and your family. Or if your kids are talking about stuff like that or they're posting that they're going to drop a bomb at school and this and that. There's all these things that people are just saying online that are so inappropriate, but are also putting their family and their businesses at risk. So cyber social identity and personal protection, obviously, you know, violence and theft prevention both in the physical and virtual world. So our certification usually is about a 5 or 6 hour full day course where we certify everybody. We give them everything that they need to know in the physical and virtual worlds to make sure that going forward they know, you know, how to protect themselves and how to protect the businesses in which whether they are the CEO or a company officer, a frontline employee. So it's essential today that people have this basic training that you and I provide. And if they're not getting that, if they're not getting just the basics, they're just keeping their— they're just crossing their fingers and hope it doesn't happen to them, or they're functioning in a state of denial. And we open their eyes up to what's going on out there, and we provide them perspective and say, listen, the chance of something bad happening to you The risk is slim, but there's a chance, and here are all the different things to do about it. And we go in every year and we give them a quick online test to make sure they have been paying attention, that they are alert, they know what their options are, and we make them part of our team, so to speak, right? So that they can communicate the same information that people like you and I are communicating to others.

Yeah, because you have these e-learning courses as well. On the site here. You have a cyber wellness and information security, which is all about data theft prevention. And some things that people don't even realize is, you know, they all talk about phishing attacks. Well, what about the phone call that precedes that, right? Where you get a phone call from somebody who's done their due diligence and they've looked at the company website and you've got your board of directors all listed on there and they call up the secretary and they say, hey, 'You know, Joe from the board just asked me to— we're working on this big project together and he needs some information right away. I'm going to send you an email. Can you please provide what I'm going to request as soon as possible?' Right? So now the person's thinking, 'Oh, okay, they're dropping names, a person on the board, they must know what they're talking about.' 5 minutes later they get an email from the criminal that's asking for whatever. It could be company financials, could be something, right?, and the person thinks really nothing of it unless they've been trained. They've taken a course or they've learned that, hey, there are more than one way that these criminals can get in there, and they don't have to use strictly high-tech electronic means. They can use that combination of, you know, a phone call with an email and some other methods in order to perpetrate, you know, crimes. And so it's something that has to be understood. And all— I mean, you know, we can't think of everything because the criminals are always, you know, trying to outsmart the security people, right? And our job is to keep figuring out ways to protect others from whatever the latest, you know, threat is, right? Phishing, spear phishing. It's like every time you turn around is a new term, right? But this is great because there's all these different classes and courses. You know, identity theft obviously is a huge one. We were just talking about social media security. And your online reputation management. And then here we go, right? Cyber scams, how to protect yourself from your business because what are the different things that you have to look for? And of course, I love it, the physical self-defense side of it. So very good, very comprehensive, and a lot of good stuff here. So you recommend— so these are courses that kind of supplement your speaking? So after somebody says, "Hey, what's the next step?" You can say, "Well, go have your people sign up for my courses," right?

Yeah, so we provide the on-site and online training. So, you know, obviously today people are consuming media in a number of different ways. I always suggest that if I'm gonna— if anyone's gonna engage in philosophy, you know, all the stuff that you and I speak to, that you want to have me live. You know, we need to flesh this thing out. We need to squash all the various cultural myths that people have developed or have consumed over the course of their lives, and it's always good to have an expert, again, people like you and I that understand how this stuff works in and out, and the audience can ask all the questions, get it all off their chest so that they really understand what's going on and they get a real live in-person perspective. And then from there, I always think it's important that you continue your education like anything else. You want to be good at something. You want to, you know, stay invested in it. And so I'm really proud of my courses, about 8 to 10 hours there that you can consume over the course of a year. And each course is like 1 to 2 hours. And then from there, we also offer phishing simulation training. So our organization will come in, we'll work with your IT people, we'll get all the email addresses of all your employees, and we will phish them over the course of a year, you know, once every month or two. And then if in fact somebody clicks the link in the body of the email, we follow up that, that, that breach, so to speak, with education to make sure that they know what to do next time. You know, you know, you don't embarrass anybody, you know, you just let them know suddenly, okay, yeah, you know what you did here, like, just so you're aware, next time along around, instead of clicking the link, pick up the phone and call somebody. Because like you said, spear phishing, they pick up the phone, they send off an email Most fraud today that is highly successful, that ends up in big dollars, the bad guys are doing all kinds of reconnaissance. They're gathering intelligence. They're going to your Facebook page, they're going to your LinkedIn page, they're looking at your website, they're finding out who's in accounting, who's a company officer, who's in HR, and they gather as much intelligence as they possibly can. They'll even create a LinkedIn profile based on the company that you are actually an employee of and they'll connect with you and they'll find, and they'll create a LinkedIn or a Facebook group about that company. And before you know it, you know, we, you know that we do business with those who we know, who we like, and who we trust. And so if somebody is just like you, if they're a fellow employee, while you may not necessarily know them, you don't have any reason not to like them, but you've got to trust them if they're a coworker, right? And so bad guys know this, and that's how they make big dollars. And once you understand human hacking and social engineering and how bad guys go about gathering and getting all this information and how we are making it so easy for them, you begin to understand what to look every time the phone rings and every time an email comes in. You don't become paranoid because that's unnecessary or unproductive, but you become aware. You're prepared. Yeah, you're prepared. You're aware, right? Yeah, and so, and I'm at the point where every single time the phone rings and every single time an email comes in, I'm skeptical, but I have a keen eye for what's okay and what's not okay much quicker than the average public. Most of us, they are basically sitting ducks, and as P.T. Barnum once said, that there's a sucker born every minute, right? I'm going to take it a step further. I think there's a sucker in every single one of us. I think everybody can, including me, right?

It just has to be the right thing, right, at the right time for you to go, "Ooh." Ooh. Next thing you know, you click it.

Yeah, like if I get an email or a phone call from somebody posing as my daughter, like if I get an email that looks like it's coming from my daughter, and let's just say my daughter's email gets hacked, and it's coming from her email address, Daddy, I'm in a situation, trouble, I need help. Like I'm automatically gonna believe that that's coming from my daughter because it's my daughter. Like as soon as my daughter says, I am in trouble, Daddy, I'm going to get emotional, I'm going to react, I'm going to be in a bit of a panic mode. But the smart person, instead of reacting and responding, would pick up the phone and make a call to my daughter, to my wife, to find out if in fact is my daughter in a situation or did her email get hacked. It's a matter of stepping back and not immediately responding and reacting and becoming emotional. Bad guys know if they truth just a little bit, they get you.

Yeah, that emotional knee-jerk reaction is what a lot of them depend on because they know that once they involve you emotionally, you stop thinking rationally, right? Like in your example, you know, if you think there's a problem with your child or your daughter, it's like, "Oh my God, what's going on?" And you immediately want to react and see and make sure everything's okay. Your first reaction is not, "Is it a scam?" No, it's your kid asking for help, right? It's that emotional sort of plea. And the same thing happens in business. It happens all over the place, and social media is huge, and people put so much information out. Like you said, it's easy for them to pick and choose different things out of your posts that they know are going to elicit that trigger, that emotional trigger that might cause you to act in a way that you normally wouldn't.

Right, you know, you and I, like, we work to get the word out there, right? We have to convince people that they need this information and why, because people don't want to believe something bad is going to happen until something bad happens. Like, you probably already know that most home security systems are installed after a house is broken into, right?

Right.

And because people react opposed to being proactive, and it's all about being proactive, you know. And so we spent all of our energy and effort doing this, and the bad guy do the exact same thing, but they're doing it nefariously. Like they are spending the same energy and effort to look for their victims, to convince them that to do, to socially engineer them, to con them, con them, right, using gathered intelligence in order to click that link, to provide that sensitive information over the phone. They'll walk up to your home and they'll jiggle the doorknob to see if in fact your door is, or they'll hit the doorbell first. They do all their intelligence. You and I work professionally to prevent these things from happening. And on the other end, we're fighting evil. The bad guys are trying to skirt all the different things that we talk about. And unless consumers have a basic understanding of basic how this stuff works, it's just a matter of time until they become a victim.

So let's look at, in terms of specifics, so in terms of identity theft, because that's a big one, and I think it's probably one that in my opinion, is probably one of the most dangerous and also one of the most common threats that exist because people are looking for easy victims, right? I mean, identity theft, we're all online, our lives are digital. What are some of the best practices in your experience that you've come across that you recommend to people that they should do when securing their identity? I know you have a book here, and I'm sure, you know, you've got some great stuff in there, but pick your brain a little bit on that.

So as you know, you know, identity theft, depending on what kind of identity talking about, depending on who's, you know, discussed, who's marketing whatever product, identity theft can mean a lot of different things, right? Fundamentally, what I consider identity theft is what's called new account fraud. And new account fraud is when bad guys open up new lines of credit under your name, when they use your Social Security number as that marker, as that, that's that 9-digit identifier to open up new lines of credit under your name. And that's been around since the '30s, but it's really primarily been abused since the late '80s, right? So, uh, with your Social Security number, people can pose as you. They open up credit cards, get loans, and so forth. So the best thing to do now to protect your identity from new account fraud, where, you know, a bad guy gets your social, they fill out an application for a loan, for a credit card, for a mobile phone account, online, in person, whatever, is to get a credit freeze. Like, a credit freeze has been around since May of 2008. It's been around for 12 years, and I have had my credit frozen since February of 2008. And a credit freeze is free. It's been free since September of 2018, and you can freeze your credit right now at TransUnion, Equifax, and Experian, and the fourth credit bureau is called Innovis. And once your credit is frozen, the bad guy cannot open up new lines of credit under your name. Your credit is frozen. Like, you have control now, and when you wanna get a line of credit, when you wanna apply for a loan, you go online and temporarily unfreeze your credit, which is easy enough to do. You have a dashboard, you have an account at the four credit bureaus, You log in, you log out, you have control over when it's frozen and when it's thawed temporarily. A credit freeze will protect you from new account fraud. And then there's account takeover, right? Account takeover, a credit freeze won't protect you from. So account takeover might be like your bank account or your existing credit cards. You have to monitor your credit cards, you have to monitor the transactions on your credit card statements. Either every month you pay close attention to each charge, or the best way is by using push alerts or push notifications. So every single time you have a charge in your card or your bank account, right, you get a text message or an email. So every single time— my wife and I, we share all of our cards— every single time she swipes the card, I get a text message, which I love.

Yes, I'm fine with—

she can buy whatever she wants, you know. But like, if I see a charge for, you know, um, $199 at Sally Beauty, right, I send my wife a text and say, hey, was that you? She's like, yes, it's me, leave me alone, I'm busy. I know it's her, which I'm fine with. I just want to know it was her. And we got a couple of notifications about a month and a half ago that there were two charges at Whole Foods. Now, they were small charges. They were only like $17 and $18, but it was at 7 o'clock in the morning and she was already in the car with the kids on the way to school. And I called her and said, "Listen, are you at Whole Foods?" She's like, "No." I'm like, "Did you buy anything online at Whole Foods?" She's like, "No." I go, "When was the last time we were at Whole Foods?" She's like, "2 months ago." I'm like, "Really?" So I called American Express and told them and they were like, "Well, this is fraud, so take the charges off of our card." Now I think, I'm pretty positive that if I did not get those push notifications and see those charges at 7 o'clock in the morning, that I don't know if I would have refuted those charges. I don't even know if I would have asked my wife about it because we go to Whole Foods. But the fact that it was at 7 AM was odd to me, so those push notifications are great. That's another way to protect yourself from identity theft, account takeover. And of course, as you know, you gotta have a different password for all of your accounts. You can't have the same password twice. Password reuse is so bad these days.

Probably the worst. It's probably the worst thing people do.

It's unbelievable to me, and people are so lazy. And less than 10% of the general population actually has what's called a password manager. So I'm sure you have a password manager. Manager, right? Or do you? Do you have a password manager?

I have used them. I typically keep all my passwords in a database on my computer, and when I need to go somewhere, I don't save any passwords online. Like in any website says, do you want to save your password? I never do. I bounce into my contact management program, I pull up the vendor, I copy and paste my password out of it, or I retype it in, and I get in that way. Because I won't leave any of that stuff, you know, saved. It's too easy if somebody were to hack in and just start going places and logging in, right? Changing addresses, changing accounts, buying stuff, whatever.

An encrypted Excel file like you have, or password manager. I know a lot of people are concerned about password manager security of them, and what if the password manager gets hacked? I'm not so worried about that because, you know, password manager companies are security companies. You know, they have military-grade bank-level security. The likelihood of a password manager getting hacked where the data is in plain text and so forth is unlikely. You know, the low-hanging fruit really is, you know, people using the same password across multiple accounts. And with billions and billions of records being stolen, like at this point we're like around 30 billion records stolen in the past 10 years. Like in the past 5 years, like 20+ billion records stolen. And that means usernames, often email addresses, and their associated passwords are in the hands of criminals. Like the bad guys have your usernames and they have your passwords. All they've gotta do is grab the data that's been stolen, just log into your accounts. And if you're using the same password across multiple accounts, they just use those credentials at the top, you know, 500 critical websites using a process called credential stuffing. And credential stuffing is when they use automated software to log into all those critical accounts, known information, usernames and passwords that are out there, you know, stolen, listed online. Protecting yourself from new account fraud, identity theft protection, credit freezes, account takeover, monitoring your statements, getting push notifications, and changing up your passwords. And of course, basic data security, you know, antivirus, anti-spyware, anti-phishing, a firewall, updating your software, and so forth. Those are the fundamentals. Not engaging in all of those things puts you at a higher risk. You are the low-hanging fruit.

Yeah, don't make yourself an easy target or an easy victim. You know, you got to change the passwords. I mean, I argue with clients because I have a lot of clients that they don't want to have long complicated passwords. And I said, look, the secret is not necessarily that it's really complicated. The secret is you got to make it long. Once you get beyond 10 or 12 characters, it doesn't have to be as complicated. It can be easy to remember because most of the companies that are out there trying to hack accounts, if they know the password is greater than 8 or 10 characters long, they're not even gonna waste their time trying to crack it 'cause the software would take too long. It's not viable for them from a time and a return standpoint. So I tell people, make them like at least 12 characters long, pick a phrase, right? It doesn't have to be like, you know, F dollar sign percent P zero, you know, you don't have to go crazy with it, but you can make a phrase, you know, like if you like the beach, you could make your password some variation of I love the beach, right? Without making it "I love the beach." You make it "beach I love" and then maybe a year, and you put a couple of characters in between the words. You can do things like that that make your passwords really long, 15 characters long. They're not going to get cracked. It would take too long. By the time that software gets out to about 8 or 9 or 10 characters, it's like, "Man, it's still going? Forget it." Boop, and it's going to go to the next one.

Yeah, I'm gonna take it up a level. I don't even know what my passwords are. Like, I don't know my passwords. My password manager knows my passwords, and my passwords are created by my password manager, which are often uppercase, lowercase, numbers, and characters, and they're usually anywhere from, you know, 12 to 18 characters, and the password manager automatically plugs them in. So I don't know my mother's phone number. I don't know my dad's phone number. Like, my dad's— if I pull mobile phone, my dad's phone number is dad, you know?

Right, dad.

I said my mother's phone number is mom. Like, I don't need to remember phone numbers anymore. I don't need to remember passwords anymore. So between, you know, the mobile phone and the contact manager and the password manager, remembering my passwords, you don't need to remember that stuff anymore. And uppercase, lowercase, numbers, characters, phrases, you know, with uppercase and lowercase, that's all great, but With the right tool like you have, you know, copying and pasting, you don't need to know this stuff any longer. And people understand that, that they don't have to even be burdened by creating a password. I think the easier you make security for people, that the more apt they are to adopt it. Absolutely. Yeah. And so, uh, you know, again, password manager, copying and pasting with secure passwords like that, really, you have to make things as easy as possible for the consumer. Are they It's going to run the opposite direction. People have given up on passwords. I have access to a tool that will tell me how many people are using 123456 as a password. There's like 25 million people out there using 123456 as a password. It's just ridiculous. That's ridiculous.

Yeah. That's scary. And you know, and that's where the hackers and the bad guys, they salivate. They go, sweet, I'm going to get into— 'X number of accounts today,' you know, and then they can parse through them and figure out which ones are worth going in and stealing the, you know, they have the decent bank account balances, right?

Exactly.

Yeah, it's, uh, you're right though. The simpler we make the technology behind safety and security, the more prone people are going to be to use it and the better secured they're going to be. I, uh, I was at the, uh, the ISC West ISC East security conferences this year. ISC East was just in November in New York, and ISC West was last April in Vegas. And I'll tell you, the changes and the advances in the safety and security industry with regard to technology are mind-blowing because so much stuff is becoming integrated. All of these systems now are talking together, and that's one of the big goals of the industry is how do we work together, how do we make things simple, how do we secure it, but how do we make it so that people don't have to have like, you know, 8 different dashboards, you know, one for their access control and one for their video and one for this and one, you know, and they have all of these different systems. When they become integrated, now you've got one main sort of interface that you can use to manage that stuff. And so it goes from the individual keeping things as simple as possible so that they're going to use the appropriate level of security, you know, for their situation, all the way up to the biggest corporation and how they can secure themselves utilizing the technology that's available and doing it in a way also that they don't have to spend hours and hours and hours learning how something works or Worse yet, figuring out multiple systems and now you're bouncing from one to another to another. What are you going to do? You're going to get lazy. You're not going to do your due diligence. You're not going to utilize the technology the way it's designed. You're going to find shortcuts because it's going to be cumbersome, and so it starts to fall apart. So I think what you said, Robert, about the simplicity of it is really— that really is key, and keeping it simple so that it gets used., and people are kept secure.

Yes, security fatigue is a real thing. It's a real problem. And, you know, for security managers and employees alike. And so if you teach people, make them aware of security on fundamental levels, and you don't instill any fear, and provide them with, you know, security appreciation training, where they begin to appreciate appreciate the value in which security provides in both their personal and professional lives, you make them much more, you know, understanding in, you know, where they will engage more comfortably and not be in fear of it or paranoid, which is useless.

Right. And as we discussed, it's— you're not paranoid when you're prepared.

You're—

it's the exact opposite. You are confident, you are informed, you are aware, and you don't fear things because, you know, you've taken the appropriate measures. You know, those measures are in place. You know, they're set up correctly, they're configured correctly. You understand them and you use them. And that's the name of the game because we have to do everything that we can to outsmart the bad guys and to make their job hard. Don't make their job easy. Easy for them like a 123456 password, right? You've got to make it so that you've got to really, I think, approach it as if your life depends on it because in many cases it does. Right? It may not be necessarily that you're going to die, but if your identity is stolen, somebody is going to screw up your life probably for the foreseeable future, maybe not forever, but for a heck of a long time because if you've talked to people that have had their identity stolen, and I'm sure you have, as have I, it's a nightmare. They work at it for years trying to get things resolved, and sometimes things are never resolved. It's very, very disheartening and sad to see that happen to someone.

Yeah, so if anybody is, you know, all those that are listening, watching, that if you don't have a minimum, a credit freeze, right? Within 72 hours of consuming this show, then you're just functioning in a state of denial. You just don't think it could happen to me. Like, that is, it is not okay to be lazy in this regard. Identity theft today is inevitable, and I saw a statistic very recently, talking InfoSec, and Forrester had interviewed, you know, several hundred companies, and 63% of IT managers believed that within the next year that their businesses were going to be hacked, right? And I thought about that and how scary that was. And what I didn't like about it is that, you know, 63% were already accepting the fact that they were going to be victims of some type of a hack. And if you sat back and 63 out of 100 people say, "Well, I think that my home is going to be broken into in the next year," I'd be out of my mind. Like, I would do anything and everything I could to make sure that that didn't happen to me. If 63 people out of 100 thought that my identity is going to be stolen in the next year, I would be doing something about it, you know. The fact that many people have just resigned to be victimized is just crazy to me. But, you know, because of security fatigue and because, you know, there's just so much fraud out there, people have just thrown their hands up in the air and given up, and that is not okay. Our critical infrastructures depend upon consumers and small businesses and corporations and governments doing their part. Look, if the grid goes down for a week, right, we will not know what to do as a culture, as a society. If there's no food, if there's no gas, if there's no electricity, that means there's no gas. If there's no gas, there's no water. If there's no electricity, there's no food. So, we have to engage, we have to know our options, we have to be informed. Not being so is not taking responsibility for your place in our culture or in our society.

No, absolutely, and it's— we live in a very fragile society because of our dependence on technology, and if that technology ceases to function in the way it was designed for any extended period of time, there is going to be a major, major problem anywhere that occurs. And if it happens in this country, as we all know, I mean, you and I both know, many other people do, the infrastructure that runs basically this country in terms of the electrical grid, of which, you know, all of our financial transactions, everything, right? Your money, your in your house in a box, it's in numbers in a bank account online. And when you're doing all—

Ones and zeros, it's cash.

Yeah, it's ones and zeros. And when these transactions all take place online, they have to do so with electricity. If electricity prevents you now because it's not working, you can't go to an ATM and withdraw cash, you can't pump gas out of the ground, you can't do all the things that you're used to doing, it falls apart. On a smaller level, that individual— and we kind of started with this, we've kind of come full circle— is the individual responsibility of each person to do as much as they can to protect not only themselves, but the people around them, the companies they work for, the other people that they interact with, and even the institutions they interact with, whether it's a financial institution or investing or utilities or what have you, it's our responsibility to make sure that we are doing as much as humanly possible to secure ourselves, our systems, our computers, our identities, our physical being from any sort of threat. And to do that, we make the whole more secure.

Yes.

And that is really what I think a lot of people have to understand that Don't think, "What is my little attempts doing to secure things?" Well, your attempt and my attempt and their attempt and everybody's attempt all elevates everyone's level of security and safety.

Yeah, you're either part of the problem or part of the solution. It's one or the other.

Right, exactly. So, yeah, we cranked through that hour there, Robert. I appreciate you coming on. If people are interested in learning more about you, our listeners can go to your website. I mentioned earlier, SAFR.me, S-A-F-R.me. You've got information on different education and services and information about you and where you've been in the media, including here. You can learn about you. You're also social media, right? Facebook and Twitter, they can just search for your name?

Yeah, just Google me. I'm all over the place. Robert Siciliano. I own the first, there's only like 5 or 6 of us and I own the first page of search and pretty much the first couple pages of search and I do a lot of news media, TV maybe 10, 12, 14 times a year at this point and I'm talking to journalists at least, you know, once or twice a week and so, you know, Google me, you'll find me. Feel free to touch base anytime. I'm here to help. I'm here to serve.

That's awesome. Do you have any last thoughts for our audience before I let you go?

Yeah, you know, this is great. I love what you're doing here. You know, the more people consume this type of information, the more aware they become. You know, being proactive— look, you either fail to plan or plan to fail, right? Or you either, you know, fail to plan or you plan to pay, right? So at this point, you're gonna pay if you don't plan, and that means paying with your time and your money. And even with your life, if you are not putting systems in place.

Yeah, so you have to prepare before you have a need for that. As I said before, you know, the time to prepare is before the need arises. It has to be in every aspect of your life and where you are both in the digital world and the physical world. Educate yourself, look up Robert Siciliano, see what he can do for you as an individual and for your business. And I really appreciate you coming on today. Thanks again. And, uh, until next time, everybody, uh, we'll, we'll see you soon. Listen in for other episodes. You can always visit safetytalkpodcast.com or look us up on YouTube. All of our links are on our website. Until next time, stay safe.