Should hacked companies pay cybercriminals? #2

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to the, uh, Security Guy and the CIA Spy Podcast. I am Robert Siciliano, and this is Peter Warmka. How you doing today, Peter?

I'm doing fantastic. How about you?

I'm doing very well. I was just talking to Peter about, um, that my dog might decide to chime in at some point, uh, and I had said Platz, which is German for lay down. And, um, I was telling Peter that I have what's called a Belgian Malinois. So if you don't know anything about Belgian Malinois, I'll show you a picture of one in a minute. Uh, they are a— Peter knows what they are because he's, you know, uh, ex CIA, you know. And so, Peter, what type of interaction have you had with Belgian Malinois?

Well, very little. Usually it's through my conduit. I have a Yorkshire Terrier, so he can see— he has a different point of view when it comes to looking at this massive dog in front of him.

Yes. Okay, well, uh, they're— they can be anywhere from like 60 to 80 pounds. The males are obviously a little bit bigger. They're, they're, they're primarily a military law enforcement canine. And they really haven't been domesticated like the German Shepherd has. Most people have never even seen, or, you know, up close, or have a Belgian Malinois. They're really not for consumer use. They're really a working dog, and they require a level of attention that requires them to work, and a handler that works that animal. Ours is calming down a bit. They say after about 3 years, they begin to calm down. And she is beginning to calm down. Which means that she will lay down for more than 5 minutes a day. Otherwise, she wants to go, she wants to get something, get someone, you know, grab the ball, eat something. You know, she has high, high prey and food drive. So she's constantly on the go, on the hunt. If you don't keep these dogs busy, then they will tear up your house. So funny story, and it's not so funny, but it's funny enough. Tomorrow is the third week in a row I'll be going back to the vet with, with Minx. Her name is Minx, M-I-N-X. Minx means, um, uh, cunning and flirtatious, and that's what she is. Uh, tomorrow will be the third week in a row I'm going back to the vet. Do you know why?

Why?

Because the first week I brought her in and she would not be seen. The moment the doctor came near her, she would run away. She'd freak out. She didn't want, want anything to do with being touched, handled, uh, her, her vitals checked, needles, being weighed, nothing. So the doctor said, listen, if you want me to treat your dog, you're gonna have to medicate her before you bring her in here. You're gonna have to give her like, um, I think it was like Transadone, and there's another one that that basically take the edge off. It's like, it's like giving them like a, you know, uh, marijuana or something, and it just kind of calms them down. And so she prescribed it last, last week, and I gave it to her, and it kind of took the edge off, but she wasn't having anything to do with that doctor. And so the doctor says to me, listen, if you really want me to treat your dog, you're gonna have to double up on the medication. Mind you, last week When I took her to the vet, I had to pick her up off the floor before I put her in the car. Like, that's how sedated she was. That's your workout. And by the time she gets to the doctor's office, she's like all amped up. So she told me to double the medication, which is going to be, uh, what's today? Oh, actually tomorrow. Yeah. And, uh, I will let you know how that works.

Oh, good luck with that one.

Yeah, the vet is losing money on this animal because we're in there for like 20 minutes just trying to give her treats, trying to like calm her down, just She's just not having it. Yeah, Minx, cunning and flirtatious you are. All right, so, uh, what are we talking about? What's going on? Oh, there's so much going on. Um, I actually wanted to point out something. We talked about the Colonial Pipeline attack last time around where the bad guys had siphoned out almost $5 million in Bitcoin. Interestingly, the FBI, uh, got back about $2.5 or $3 million of that Bitcoin, something like that. They said that they paid like 75 coins and they got back like 65 coins, which sounds like more than, you know, um, 60— which sounds like more than $2.5 million either way. And the FBI wouldn't say how they got that back. One thing that I saw was something in the tradecraft of how the FBI does things, uh, they, they could not disclose that. Now, what would your definition, or what is your understanding as a former CIA spy, what might tradecraft mean?

Oh, it means that you want— you, you don't want to reveal to the bad guys how you undertook an operation to discover what they were doing or to, you know, sabotage what they were doing, because if you disclose the tradecraft, uh, you're going to decrease your ability to succeed in the future as an investigative or an intelligence agency, because the bad guys are gonna— they're already gonna know that, and they're gonna undertake initiatives that are going to make it more difficult for you to, uh, successfully utilize that methodology in the future.

So chances are bad guys around the world are trying to find out how, um, the FBI did that, and more than likely that tradecraft is going to leak out in some way, and the bad guys will change the methodology in the future so that, uh, they don't, uh, get that money, I guess, extracted from their wallet in this case, right?

This happens all the time when, whether it's the FBI or the CIA or, you know, special elements of the Department of Defense, that you kind of, they kind of like want to be able to put out the, hey, we're, we've, we scored, we, we victorious, we beat the bad guys this time. So, you know, PR is, is sort of a favorable thing that a government would like to do from time to time, show that we're victorious. But the downside is, is every time they reveal some of this methodology, this tradecraft, it really unfortunately reveals too much, right? And it works against us in the future.

Yeah, got it. So, uh, that brings us to, um, our ABC News talks about, um, energy chief cites risks of cyber attacks Crippling Power Grid. So, uh, any, uh, longtime listeners, uh, anybody who's been paying attention to anything that I write, and even, uh, the last podcast, uh, that Peter and I did, um, we talked about, you know, being a prepper. And, uh, the word prepper, uh, has somewhat of a negative connotation about somebody who, you know, is, uh, thinking of, you know, doomsday and this and that and always preparing for the apocalypse and so forth. And nothing could be further from the truth, you know. Prepping is really putting your seatbelt on. If you put your seatbelt on, you are a prepper. Um, if you buy extra food when you go to the grocery store just to throw in a freezer that you have, like an extra freezer, then you are a prepper. If you have extra water or a generator for that matter with extra gas, then you are a prepper. And there's levels of prepping that I would suggest that people evolve to, because when you see an article That is, you know, June of 2021. Energy chief cites risk of cyberattacks crippling power grid. Look it, if we are without power for any significant period of time, uh, that means no heat, air conditioning, hot water, potentially no cold or clean water. It means no gasoline. It means no food at the grocery store. Uh, it will not be good if the power grid is crippled for a day, never mind a week or even a month. If it's crippled for a month, then you will see the worst in humanity, I think. What do you think, Peter?

I agree with you 100%. I think that, uh, the public, the media doesn't understand this issue very well because There's been a number of foreign adversaries for some time that have done probes into our critical infrastructure to include the power grids. I'm going back already for a few years. There's no desire, I think, by some of our adversaries to actually shut something down now or even to allow criminals to maybe try to attack our power grid using ransomware. They would rather wait until there's a moment where maybe in the future someday, that there is really a cyber war going on. And then they can, they can utilize— after having done these probes, they know that they can shut these things down, not just one, they can shut down various ones for a prolonged period of time. Uh, so for them to go out now and to try to do some, you know, shut this power grid or that power grid down, once again, it will allow us to take, to learn more and to take maybe action, preventative, preventative actions, which will which will not go in the best interest of those that want to actually shut us down for a long period of time in the future. So I think right now it's just, you don't see very much of it. There's these probes, but when it happens in the future someday, it could be massive.

Energy Secretary Jennifer Granholm called for more public-private cooperation on cyber defenses and said, "US adversaries already are capable of using cyber intrusions to shut down the US power grid." I have not seen a federal official be that explicit yet until right now. I think that there are very malign actors who are trying— she said, she added, even as we speak, there are thousands of attacks on all aspects of the energy sector and the private sector generally. That I was well aware of and totally agree with. She says that without mentioning the company by name, that Colonial Pipeline was hit. Crippling, with a crippling cyber attack by ransomware. And she goes on to say that the bottom line is people, whether you are private sector or public sector, whatever, you shouldn't be paying ransomware attacks because it only encourages the bad guys. I agree with that. You know, if you're looking at profits over, um, you know, uh, uh, if you're looking at profits beyond critical infrastructure, uh, then you are encouraging the bad guys to dig even deeper. What do you think, Peter?

Well, maybe the devil's advocate in this. I mean, I'm, um, I agree with you. I mean, that paying a ransom, uh, you know, is always going to encourage the bad guys to continue doing this.

But incentive—

what's the, what's the alternative? If a company is hit and they don't pay that ransom, they're going to be down for an extended period of time. Their operations are going to be down and they're going to be paralyzed. And it's going to cost them at the end of the day a lot more. And a company could say, well, I've brought this information to the attention of government officials. And I know a lot of companies that have told me, I encountered these particular attacks, not necessarily electrical power grids, but other companies that have experienced attacks against them. And they bring it to the law enforcement authorities, and nothing happens. Nothing happens. So they're gonna think, how can we count on the government to do anything for us? We have to fend for ourselves. We have to make our own decision about what is the best interest for us to be able to maintain, uh, business continuity. So this is why a lot of them will end up paying despite the recommendation that they shouldn't.

Well, so that being said, and I agree with you to a point, right? She said that, uh, she spoke in favor of having a law that would ban paying such ransom. She said, "I don't know whether Congress or the president is at that point." Asked whether American adversaries have the capability of shutting down the US power grid, she said, "Yes, they do." So what I think, that if there was a law that prevented companies from paying the ransom, that they would have backup for the backup. They would have those contingency plans in place Now, see, you and I talk a lot about being proactive. You know, we talk about bad guys and predators and thieves and their motivations and how they do what they do. We are always reverse engineering all the various scenarios in which get people in hot water, get them hurt or killed or, you know, stolen from or whatever. And the Colonial Pipeline attack will likely not happen to Colonial Pipeline again, because now they know that they can't be messing around. And other energy suppliers that saw the Colonial Pipeline attack will further reverse engineer what had occurred, and they will also beef up their security infrastructure to prevent an attack like that in the future. And so, If we're relying on cybersecurity insurance to pay that ransom, which I think that everybody should have cybersecurity insurance, but if we're relying on that as the backstop, or we're relying on paying the ransom as the final solution, then it's gonna continue to give incentive to the bad guy, and I don't think that's a good idea. I think that they, I think that there should be a law to prevent paying the ransom. And if bad guys know that, if they know that there's no incentive, then they will go back to hacking for fun and fame opposed to financial gain.

Perhaps, Robert, but there's already a big problem between the level of sharing of information between the private sector and the US government when it comes to data breaches, whether it's ransomware or whatever the end goal is. But these security breaches Oftentimes the private sector is not sharing this information with the US government for fear of some reprisals or disclosure to the public or for fear of potentially more liability. The government's always asking, please, please provide us with more information. Many people in the private sector, many companies don't really fully trust the government, so they're reluctant to. I'm just being the devil's advocate here. If you're saying, okay, we're going to make it illegal for you to pay this ransom, even less of a reason for the private sector to even share information with the government, realizing that they could be potentially held liable to pay these fines.

Yeah, we talked recently about the Biden administration signing into policy strengthening private public partnerships. And every president, you know, since George W. Bush has had— signed something strengthening private-public policy, the connection between government and the private sector. And, you know, and Biden did it as well. So that will continue to evolve and we'll hopefully see something towards the end of the Biden administration that, that actually gives that teeth. So all that being said, uh, this is interesting. So for years— did you see this, Peter? Isn't this awesome? For years, the underworld thought its phones were safe. They fell for an encrypted app trap. Okay, Peter, this is awesome. Check this out, right? I have a couple of stories on this. So this is via CNN. It was supposed to be the underworld's impenetrable communication communication tool, a digital safe place to plot crimes ranging from drug trafficking to murder away from the prying eyes of the law. So think of like WhatsApp and think of other encrypted mobile applications that you might use to communicate with that you may not think the government is paying any attention. Well, in most cases they have some level of a backdoor, especially if those mobile apps are coming out of China, if they're coming out of Russia, And really, if they're coming out of the US, chances are they have some type of a backdoor. And frankly, I don't think that's the worst thing in the world. And I know that a lot of people are going to wince when I say that, especially privacy advocates. And there are those that say, if you've got nothing to hide, then you have nothing to worry about. And that is some type of a— some form of a cop-out. And sometimes I even feel that way. But that's all debatable. Argued or arguable. That being said, I do kind of like the idea that governments, or at least our government, has some type of— and no one's gonna like me saying this, I just know it— I do kind of like the idea that our government has some type of a backdoor to certain applications that might reveal larger plots against our nation. I do like that. Like, I do think that at the highest levels, they generally know what they're doing and they generally have our best interests in mind. Peter, what do you think about that?

You know, I, I agree with you. I mean, there are certain levels where, where security is more important than absolute privacy. I mean, when it comes to, when it comes to our, our national security interests and our, our lives, right? So I do agree with you. But this is sort of ironic though, when this story. Remember what you mentioned earlier about protecting, you know, about protecting tradecraft methodologies? We talked about that here once again. I mean, I'm all, I'm all for, you know, this is a fantastic success story, right? Yes. And I'm sure there's a lot of other stories that maybe don't come out to the view of the public, uh, but here's a, a great success story. But once again, it's divulged, and so The bad guys learned about how this is undertaken, how this took place, and the reason why this all of a sudden there was this, we want to call crackdown or conclusion of the operation, was because they wanted to act upon some of this information, which was very, very urgent. So the bad guys realized in the future something like this could happen. What might they do? They might realize, OK, let's test the system. Let's put some information out there that we know that if we're being monitored, the, you know, by, you know, there might be legal requirements for the FBI or any other agency. We need to take immediate action against this, uh, information. So, you know, bad guys can learn. They can learn how we operate, you know what I mean? So that's, once again, it's kind of, it's, it's too much information maybe that's being disclosed about this very successful app.

You know, you, uh, mentioning how the bad guys would say or do something that, you know, the government or whoever this monitoring would pick up on and maybe act upon that. And that, that process in which they're engaging in, you know, they're, they're putting out this false flag, right? Uh, is that what that's called?

Yes.

Yeah, I see that in film all the time. Yes. Uh, and you actually live that, like, you actually, you know, that's your world. That's pretty cool. So it goes on to say that, but for nearly 3 years, an encrypted app used by criminals was covertly monitored by the FBI and Australia's federal police, leading to hundreds of arrests and tens of millions of dollars in asset seizures, authorities released in a statement. AFP and the FBI had been reading the clandestine communications of criminals since 2018 on the Anom app, a black market product only accessible on specially prepared mobile phones. That is awesome. So this is also known as what's called the— well, it's sort of known as what's called the honey trap.

Yes, exactly.

Yeah, okay. So a honey trap, for, um, you know, anybody who doesn't know, um, like for example, uh, kind of a, uh, uh, uh, like a very basic version of a honey trap might be a female law enforcement officer that is working the streets as a prostitute attracting johns. She is a honey trap. She is, um, uh, solicit— she, she's walking the streets in maybe scantily clad clothing, uh, designed to specifically get men attracted to her in order to, uh, for law enforcement to come in and bust the john, correct? That, that is a basic form of a honey trap, right?

Right, absolutely. I mean, it's also in the intelligence world where, uh, intelligence service might, uh, utilize a— whether it's male or female, right? An individual who will start up a sexual, you know, relationship with the target. Uh, think of Red Sparrow. I mean, those— for those of you who saw that, uh, the movie, it really shows that. And it is a very successful means of, you know, uh, sucking in your target.

Yeah, yeah. And so a honey trap in the digital world, uh, would be, say, a server, a computer that serves up information that is set up online, designed with all kinds of sensitive information, even a forum of some kind, in such a way that, uh, it becomes open and accessible to anybody on the web that can find it, that's scanning for it. And they find this, this, this server serving up this data, and the information on it is attractive to whoever who then goes on it and extracts it. And in doing so, the, uh, whoever set the server up has access to the internet protocol addresses of anybody who visited that server, that honey trap, and is able to, uh, determine exactly where that physical device resides anywhere in the world should that uh, whoever was our hacker in this case, criminal hacker that went on that server, should they, should they have not utilized the VPN that scrambled their IP address? That's another version of a honey trap. So, um, yeah, this is a pretty cool story, and, uh, it kind of gives you a little bit of hope that our federal government does know what they're doing, you know, that they are actively engaged in thwarting the bad guy from doing their job and extorting companies like Colonial Pipeline of millions of dollars, which ultimately trickles down to you and I simply wanting to pump our gas and we can't because there's no gas because criminal hackers had shut the gas station down as a result.

You got to think about— I don't know— think about the timing of this article. Also could be, you know, we've had some attacks recently and people might begin, you know, the general public might say, whoa, you know, what can our government, what is our government doing against all these threats out there? And so this is a very timely, I think, release of a major news story that probably could have been released a long, long time ago, but released now, I think, just because of wanting to show that we are still having successful operations against these threats.

I, I appreciate that. Could, could, could that be loosely defined as a form of propaganda?

Loosely defined, yeah. Propaganda, sometimes, I mean, propaganda could be disinformation. Sure, right. But it can also be, you know, when, when you want to release information that is, you know, true, but for, to influence, to influence the public, right?

Yeah. Awesome. Okay, cool. So, um, Peter, uh, so I send Peter off, uh, story ideas, uh, to discuss in our podcast, and I sent this one to him: Bald eagle kills 54 lambs on Idaho farm, owner says. And Peter's like, where are we going with that?

Yeah, I have no idea. I'm looking forward to this one.

Okay, so, um, well, first off, you know, a bald eagle of course is a predator. Right? And we speak to predators, uh, is what we do, you know, uh, violence and theft from predators and thieves, right? And, um, you know, I'm obviously a fan of the bald eagle. I'm a fan of all, um, uh, birds for that matter, uh, and bald eagle for obvious reasons. And being that it is a predator and a protected species, uh, and the fact that it killed 54 lambs, right? I mean, it is really just doing its job, you know. It's— in this case, the bald eagle, as far as the farm owner— farm owner is concerned— as far as the farm owner is concerned, the eagle is a bad guy, right? Because the, the eagle is preying upon his stock, his livelihood, the way he feeds his family. And if the farm owner had his way, he would probably shoot the thing out of the sky for obvious reasons. And frankly, you couldn't blame him, you know. But the eagle is really just doing what it's supposed to do. It's its nature, it's its job, and it's natural and it's normal. And I've been saying for 25, 30 years that predators Uh, those often with what we call antisocial personality disorder generally come out of their mama just that way. Whether it's nature or nurture, that's just who they are. That's how they see the world. People like Jeffrey Dahmer and Ted Bundy, like, they murdered people and for pleasure. And Jeffrey Dahmer ate them. And that is his normal, natural state of being. The same way, uh, this eagle, that's its, its natural and normal way. What do you think, Peter?

Yeah, but this eagle has top cover. Yeah, it's protected by the federal government because of its symbolism. If Benjamin Franklin would have had his way, we would have had this turkey given protections, not the eagle.

But anyway, So, um, you know, and one of the reasons why I brought up the story is because, you know, I've been saying for many, many years that there always has been, there is, and there always will be a criminal predatory element out there. And it's natural and it's normal. It's the way it is that there are currently, uh, 859,000 registered sex offenders in the United States. These are everyday living, breathing predators, levels 1, 2, and 3, that function amongst us. That they are behind you in line checking out at the grocery store, they could be pumping your gas, it could be a co-worker. And they are designated as being predators, as registered sex offenders.

One of the things— I'm sorry, one of the things that I've mentioned before, I don't know if I mentioned it with you, but I tell people, you know, these predators— let's take an example of, you know, I compare some of these threat actors as wolves. The wolves are going to always prey upon the sheep, right? The wolves are always going to get their meal. It doesn't matter. They're always going to eat their meal. So are we going to be able to eliminate all the wolves? No. The wolves are always going to be there. But what we have to do, if we are the sheep, is that we have to, you know, how do we harden ourselves so that we don't get eaten by them? We make sure that that wolf moves on to those other more vulnerable sheep. That's, and that's how it is, you know. We have to harden ourselves. We have to be cautious so we can protect ourselves from the predators, uh, because the predators are always going to find somebody, but best not be us.

So that's a perfect segue into— do you see my screen, Peter, where it says what are you? Yes, perfect.

Hi.

Yes, so this is a, um, piece of literature that I pulled from, uh, I pulled and I adapted from two places, uh, from Lieutenant Colonel David Grossman in his book On Combat and the movie American Sniper with Chris Kyle. I've watched the movie American Sniper with Chris Kyle at least 10 times. I, I love watching movies more than once, especially the ones that I love. I've seen the movie The Town probably 30 times. I don't care about seeing a movie 10 times, I love it. That said, I pulled this piece from that movie when you saw Chris Kyle's dad, uh, around the dinner table with Chris and his brother, and his father took out his whip. He was ready to whip either Chris or his brother. Chris's— Chris had responded to his brother's bully by beating up his brother's bully at school, and he gave him a good whooping. And so the father told the story of the sheep and the wolf and the sheepdog, and he went on to say at the dinner table, there are 3 types of people in the world. And I'm embellishing a very little bit because I added and removed a little bit. There are 3 types of people in this world. They are sheep, wolves, and sheepdogs. I consider myself a sheepdog. Some people prefer to believe that evil doesn't exist in the world, and if it ever darkened their doorstep, they wouldn't know how to protect themselves. Those are the sheep, and often those are my audiences, right? And in some cases, I'm sure that those are your audiences as well.

Absolutely.

You know, the majority of the people out there are just that. You know, they are the sheep, they are the cattle, they are the lamb. And it doesn't make them bad. It doesn't make them naive. It doesn't make them, you know, sad or anything. It just makes them normal. Like, that's the majority of the people. Most people, like cattle, just want to be led, you know. Not everybody's a CEO, you know what I mean? Not everybody's a law enforcement officer. Not everybody is a security professional, right? Most people just want to be led, and there's nothing wrong with that. That's a normal thing, but it's not necessarily okay to just be the sheep. At some level, you need to have some sheepdog in you, the same way a mama has a little bit of mama bear in her when she sees her children at risk, you know. It goes on to say that then you've got predators who use violence and theft to prey on the weak. I stuck that in there. They're the wolves, who you've already spoken about, Peter. And then there are those blessed with the gift of situational awareness, maybe aggression, an overpowering need to protect the flock. Those are the rare breed who live to confront the wolf. They are the sheepdog. I consider myself a sheepdog, Peter. I consider you to be a sheepdog. And obviously there's so many more than 3 kinds of people in this world. There's all these like in the middle. And I don't think anybody wants to be referred to as being a sheep or wolf or a sheepdog for that matter. But all that being said, I'm fine with the whole sheepdog thing. And by the way, that dog right there you see at the bottom, that's my Belgian Malinois. That's actually my dog Minx. That's what she looks like. Yeah, that's Minx. So yeah, she's in all my presentations. So Peter, like, what do you, what do you think about this piece of literature?

No, I agree with you 100%. That's a good way of kind of like looking at the world. Uh, we need, I think, are more sheepdog because we're always going to have a lot of, a lot of sheep out there and they see the world a little bit differently, you know. Everything's kind of rosy, nothing bad's going to happen to me today. But we have to be, we have to have individuals, especially leaders, leaders within organizations that need to be, be, uh, taking that lead and, and being sheepdog, you know. Of looking at what potentially could go wrong, what are the threats out there, and trying to educate, you know, educate their flock. This is what you should be concerned about, this is how you, you need to, to do, and making sure that the flock is greater protected. But, but even the flock, you know, even the flock can also participate in that. We all need to improve our security awareness, our situational awareness, and I think this is a pretty good um, a pretty— it's really symbolic of exactly the issues that we're dealing with here.

Yeah. And, and look at— none of this is about being paranoid, right? None of this is about it can't happen to me. The fact of the matter is there's an eagle out there that slaughtered 50-something lambs because that's its job. There's a reason why, um, you have sheep herders who deploy sheepdogs in order to protect the flock from the wolf, because the wolf's natural prey is in fact the sheep and/or the lamb. And there are— it always has been, is, and always will be like that. And human predators simply exist in the world. They always have and they always will. And our job is to recognize risk at such a level that we know it's out there, we understand it can happen, We're not gonna worry about it, but we definitely know we should in do something about it. But we don't live in such a way where we're in fear. We live in such a way where we put systems in place and we maintain those systems, such as, say, locking the doors to your home, especially like at night and while you're sleeping. And throwing another layer of protection on there, like a home security system, because we know that there are 2 million homes that are burglarized every single year. If you didn't already know that, now you do. That makes it, um, 20 million homes in the past— in the next 10 years, you know. So we know these things happen, and to sit back and go, yeah, I know, the wolf will never choose me, is just functioning in a state of denial And I think that that is just being irresponsible, opposed to recognizing risk for what it actually is, taking a level of responsibility, doing something about it. Again, not worrying about it, but, you know, making it a part of who you are.

Yeah, we're in a world where the decisions that we make don't always just, just impact us, whether it's positive or negative. We're in a situation when it comes to security that if we are complacent and we don't see the, you know, we don't mitigate properly the risk, it can have dire consequences for our family. It can have consequences for our, our organization that we work for. I mean, it's not just about us only when something like this happens.

Yeah, like Colonial Pipeline getting hacked and paying the ransom right, affected millions and millions and millions of people from New York to Houston. So it matters. It all matters. Like, it, it, uh, it, it, it— every security vulnerability, every attack in the physical and/or virtual world has a ripple effect in some way. You know, um, a sexual assault on a very local level in a family will devastate not just the victim but everybody who loves him or her, you know. So it's important that we have this dialogue and in some cases those uncomfortable conversations so that we recognize our simple human vulnerabilities technical vulnerabilities, and we ultimately make decisions so that we tighten up, uh, add layers of protection, increase our own level of awareness, and ultimately, you know, do something about it.

Yeah, I completely agree. And we need to always keep up with, uh, everything's continuously evolving. The bad guys continuously get better. Security experts continuously, you know, improve their, you know, abilities to detect the bad guys and try to shut them down. But it's always evolving, and we also as a general public have to keep abreast of some of these changes because it's not, you know, we're not living in the 1950s or the 1960s or the '70s, '80s, or '90s. We're living in, you know, 2001 and And we're going to continuously see more and more threats, more and more advanced threats, because technology is a great resource for the bad guys as well. You know, utilizing technology to— I mean, a lot of these, these big, these big threats that are happening now, these attacks, it's because, you know, technology is a tool, a resource that's being utilized by the bad guys. And we have to have a better understanding of that also as a general public.

Both systems and people are all much more accessible today than they've ever been. And so yeah, those sheep need to evolve at a higher level of security appreciation so that they no longer are, you know, just getting plucked out of the sky by that Predator Eagle in that case, right? So Thank you, Peter. Uh, thank you, Robert. This is very good. So, um, uh, I am Robert Siciliano. This is Peter Warmka, and my company is, uh, Protect Now LLC. We provide security awareness training, identity theft protection services, uh, the CSI protection, um, certification designation to service professionals. Peter, uh, what does your— what do you and your team provide?

As Counterintelligence Institute, we focus a lot on security awareness training programs for organizations and their employees to better understand the type of threats that are out there, the threat actors, and how, uh, especially human hacking can be conducted against an organization, helping a better appreciation of how that takes place, how to prevent yourself from becoming a victim, and if you are targeted, what are some of the warning signs that you can, uh, be alert for and what actions you can, you can take. And also, I've recently published a book, Confessions of a CIA Spy: The Art of Human Hacking, which goes into a lot of detail. That's available to everybody in the general public, not only for my clients but for the general public.

I love it. Perfect. Beautiful. So everybody, um, stay safe out there, uh, pay attention, be aware. My dad used to say to me, be good Be, be good, be aware, and be careful out there. And, uh, don't worry about any of this stuff, but definitely do something about it. And thank you so much for your patronage, and please share this amongst your friends and family. Uh, the more you can get the word out there, I think the more safe and secure we will all be. Peter, you get the final word.

See you all next time.

Until next time, see you guys later.