The Security Guy and CIA Spy PodBroadcast

And welcome to the Security Guy and CIA Spy Pod broadcast. I am Robert Siciliano and this is Peter Warmka, live from Orlando, Florida.

How are you doing, Robert?

Um, freezing my behind off.

Well, we're just a few degrees warmer, not, but not by much. We're gonna be down, it's gonna be freezing, it's gonna hit the frost this, uh, this weekend.

Yeah, dude, it's 2 here. That's a few more than a few degrees. It's 2 degrees here. 2.

There's no sympathy from almost anybody here though. I think across the nation it's, it's pretty cold everywhere.

Yeah, my, my plow guy got stuck in my driveway. Like, that's how much snow I had.

Oh my gosh.

Yeah, where I live it's really windy. So, uh, you know, because I live right, right near the ocean, and so the wind comes off the ocean and there's parts of my backyard where there's actually green grass grass and other parts of my yard where there's like 4 feet of snow. And so when the plow guy showed up, because we got like a 100-yard driveway, it's like, you know, pretty big. And, uh, the, um, yeah, the guy gets stuck. I mean, he had to shovel him his plow out.

It reminds me, I mean, back in the late '70s, the year, the winter of '79, I was a university student in Milwaukee and we had— I mean, this was normal. We had some major storms. Uh, I think people have gotten a little bit, uh, accustomed to pretty mild winters. A lot of the— a lot of people don't— I mean, a lot of younger people don't even remember what these other winters were really like. But this was something we lived with on a regular basis.

Yeah, I've got like 6, 8 feet of snow piled high in the yard, and I'm pretty sure I'm going to see that until April. And you know, hey, it is what it is. We've— like you said, we've had some pretty mild winters, and it was about time we got walloped. So What are you gonna do? Hey, it's all good.

Yeah, enjoy the most, you know, enjoy it. Get your sled out there.

Yeah, yeah, yeah. So, you know, a lot's happened since the last time we got on, and, um, to be perfectly frank, I think I told you I have not been plugged in. I mean, although, like, you know, I stay on top of what is new and ahead of what is next regarding all things security, I've kind of unplugged for a little bit because, like, the world's kind of been on fire. And it, you know, that, like, that, like, ongoing consumption of world events and everything, you know, uh, some of you may feel like a little bit of stress and anxiety as a result of that. I do too, because guess what? I'm just like you. And, um, I kind of turned down the volume for a little bit, and I got to tell you, it, uh, not only gave me some clarity, uh, it calmed me down a little bit, slept a little bit better, and allowed me to focus on, on a lot of other priorities, you know, tasks that needed getting done. And, you know, I've always found that even in those mundane, you know, around the house, on the computer, in the business tasks, that by unplugging to a certain degree, it allowed me a greater focus on the task at hand versus, you know, world events kind of playing in my mind while I'm engaged in that task, kind of distracting me as I'm actually doing the task. So it allowed uh, essentially for myself, my brain, uh, for, for, for the, for the vibrations to kind of settle down a little bit. And, um, yeah, I highly recommend.

No, I, I agree with you. I mean, at the end of the day, I mean, my wife and I love watching the news. We like to keep informed. But there's times when there was like, she was getting so worked up and angry about it. I said, you need to take a few steps back. Don't listen to the news. You know, it's going to upset you, just don't listen to it. And I, and I step back sometimes too. You've got to realize you can— most of the, almost everything that's on that, that program, the news program, you're not going to be able to change, you know. Uh, you're not going to be able to make it, you know. And don't let it bring you, bring you down, you know. Don't let it affect your mental health.

Yeah, yeah, yeah. We, we cannot control what goes on out there. And look at— I, I am, I am someone who, you know, is a big fan and advocate and engage in, you know, various forms of social justice. And that being said, like I have created a lifestyle where I support those who are victimized and I champion the little guy. But, and at the same time, I still have to monitor my own engagement. And when it begins to affect my disposition, then you kind of have to step back a little bit, create a little bit of a space between you and all of it.

So I think, I think the way I look at our role is that, uh, we can't save everybody, you know, from, from, from financial fraud. All we can do is create that greater awareness amongst everybody, and hopefully everybody does their part with creating a little bit more, more awareness, right? And spreading the words to their family members and friends. And, and that's kind of like our— what, you know, ultimately I would like to do is be able to, to get more and more people involved in this mission, right? Of creating this awareness. Because, you know, even though we're away from— we just step away from the news, the fraudsters, the criminals are still out there, and they are, they are bringing in tremendous amount of, of, uh, money, whether it's in Bitcoin or gold bars or what have you. I mean, the, the amount of scams is just continuously, uh, growing. And now with AI it's just becoming even more of a challenge. You know, AI can be a great tool for helping investigators, but it's also a tremendous resource or tool for the bad guys and being able to, uh, you know, being able to target individuals more effectively.

Yeah, and you know, that brings us, uh, back to basics actually. Uh, this article from Bleeping Computer You got phished. Of course you're human. And, you know, I don't often see articles like this. Most of the information that I see in regards to phishing today, it's highly technical and it's geared towards your chief information security officers, and there's a lot of metrics that go on with it. Whereas, you know, this article is speaking to like me or you or like everybody, you know, and it's talking about the reality that You know, phishing is, uh, still a major problem, and it's getting back to the basics of here's why. So article begins with, you know, you may have heard this type of phishing story before: an ordinary, careful user who let their guard down for a moment. The victim may have been cautious by nature, frequently warned about scams by his or her tech-savvy spouse, and generally skeptical of unsolicited messages, yet a convincing test text message claiming an unpaid toll caught her at the wrong moment, right? We all get that stuff. We all see that stuff. Uh, the message felt routine, plausible, and urgent. She clicked the link, entered the credit card details on what appeared to be a legitimate site, and only later realized something was wrong. Okay, that is just so common. Why? Because the methodologies that the attackers are using today is essentially AI-driven deepfakes and voice cloning and just perfect text. It just— it's perfect. There's no scammer grammar. Um, but if you're always vigilant, it won't happen to you, or can it, right? The answer is yes, it can. Um, phishing really can happen to anyone. Uh, experts fall for it. Now, I will say that I, I don't know that I have fallen for a phish. I don't know if ever. But I do know that I have seen phishes and experienced phishes lately that were really, really good. Really good. Like, like pretty much perfect, uh, that looked like they were coming from DocuSign, looked like they were coming from clients, looked like they were coming from people that I may or may not be doing business with in my inbox, like showing up in the inbox, not ending up in the spam folder. And, and that really is a big part of the problem due to the fact that Google frankly has done a pretty good job of getting those phishing emails into the spam folder over the past, you know, 5, 10, 15 years. And we've come to rely on that to a significant degree. And certainly, you know, Google has put legitimate emails in that spam folder as a cost of, you know, security, right? Missing, you know, important emails that, you know, might have been business or, you know, necessary communications and so forth. But still, I mean, there's definitely some value there. But now again, they're ending up in the inbox. It goes on to say that here's where phishing becomes more unsettling. You know, what happens when the victim isn't an everyday user but a seasoned cybersecurity professional, right? People like you and I. In a candid account, a well-known security expert and author admitted that he repeatedly failed his own company's internal phishing simulations despite years of experience training, and awareness, right? These failures, he says, weren't due to ignorance but to timing, context, and again, human nature. His conclusion was blunt and humbling: anyone, including experts, can be phished if they're distracted, emotionally engaged, or operating on autopilot. That autopilot part, that's where a lot of people get bit, you know, routine, right? The lesson wasn't about shame And shame is a big part of the problem of phishing simulation training, you know, failing those, uh, tests in phishing simulation training. Um, shame is a big part of it, you know, you either pass or you fail, and if you fail, uh, there are repercussions. And I just met, you know, somebody this week, uh, who was fired as a result of phishing, uh, at work, phishing simulation training at work. Yeah, and she got fired because she just couldn't pass it. Like, she failed it over and over and over and over again.

Um, I think she got fired for not, not being able to pass the test.

Fired? Yep, you betcha. Yep, lost your job. You know, this is like a woman who has been a mortgage broker for all of her adult life. She's in a business where she's dealing with lots of sensitive information, and it— her brain could not process what was happening in front of her, and she failed. And I, I take issue with the type of training that's got her to that point. So I don't know that fishing simulation training works for everybody, and I think that with certain people, and maybe even the majority of people, that there's a— there's, there's, there's an additional way— not necessarily a more effective way, but an additional way on top of, in addition to phishing simulation training that is designed to get to the root of many of the issues that we all face. Like, we have what might be called, you know, or is what I call, you know, the human blind spot, right? It is that psychological instinct to trust what's familiar to us, right? That cognitive gap where biological trust overrides digital suspicion, and that leaves the door wide open for all kinds of fraud, you know. And I don't know that, um, I don't know that like all training, phishing simulation training, actually taps into all of that stuff.

I think a lot— I mean, correct me if I'm wrong, but I think a lot of the simulation training is sort of like, what is the flavor of the day? What's currently being seen out there? And being able to recognize those types of attempts at phishing and stopping, not just reporting it up the food chain, up the management chain without responding to it, but not getting really to the heart of what the manipulation that's being utilized. I mean, the whole flow of critical thinking is not learning a whole bunch of scenarios that are currently out there now. Today and recognizing that scenario, we have to go beyond the scenario. We have to understand how a threat actor is approaching the individual, the steps that are being taken, and what they're— basically, at the end of the day, they are playing on the emotions of the target, right? Whether it's creating that sense of fear, creating that sense of urgency, creating that sense of trust, affection, like romance scams. I mean, it's playing with those emotions, and those can— that those can come through so many different types of scenarios that I think we need to be training more toward the understanding of the art of manipulation and not so much scenario-based memorization of, oh yeah, that looks like something I just saw the other week in the training. I just don't think— I think, again, as you mentioned, we can go much further, much further than regular simulation training.

Yeah, and as we know, like, the goal isn't with phishing, you know, technical exploitation. It's human exploitation. Attackers don't break systems. They persuade people to open the door for them, as it says. All right, so most phishing, its psychological aspect, how it preys upon us, how it triggers us, starts with— and this is what we see the most— is a sense of urgency. The most powerful lever, it says. Messages are designed to trigger fear, curiosity, anxiety, as in, you know, your account will be suspended, payment failed, action required. Urgency suppresses rational analysis and pushes users into fast decisions, which is the worst thing.

Yeah, because you don't have— you don't sit back and try to think about or analyze it. You just respond immediately. This is the situation, and in order to get myself out of this situation, I need to take that action. I'm gonna take it right now, right?

This one, context switching, it says, is equally critical. Attacks often arrive when users are distracted between meetings, commuting, multitasking, or when they're emotionally preoccupied. Uh, in these moments, people rely on pattern recognition instead of scrutiny. So the message looks right, feels familiar, and fits into an expected workflow, which is usually enough. So what that's basically saying is, um, there's nothing about the communication that's urgent at all. It's just that the email itself, the, the requests that it's making— pay it, pay an invoice, um, you know, uh, send off, uh, the latest, uh, budgetary documentation, like whatever it is, like it just, it just It just, it's just a normal communication. You are just not in the right frame of mind to acknowledge that, you know, what, what are they really asking me here? Because it's just routine.

I would speculate, I would speculate that in many cases then it would be probably the best time to target somebody if you're looking at a simple, you know, text message or, uh, or I mean even a phone call or email would be toward the end of the working day when people are kind of, they want to get out of the office, they get to trying to get everything done quickly and and, you know, that's when they're a little bit different than maybe in the beginning of the day when they maybe have their cup of coffee and they're able to start slowly looking through some of the correspondence, the email, thinking about things. But at the end of the day, they want to get out of there. So that might be a good time, right, for someone to try to— he said timing, right? Or you find, you find out that somebody has recently had a, you know, death in the family, a significant other that passed, right? That makes people very vulnerable, uh, also. I mean, so it's part of the timing too.

That brings us to emotional timing. Window of vulnerability is an often overlooked lever. Many phishing attacks deliberately target people at emotionally charged moments: a new hire eager to impress, an employee, uh, under performance pressure, someone dealing with stress like a death, excitement, or fatigue. In these situations, victims are more compliant, less likely to question authority, and more motivated to act quickly and quietly. Uh, here's a story which is a textbook example. The attacker exploited the victim's desire to prove themselves in a new role, turning helpfulness into ambition and ambition into a weapon. Emotional investment narrows critical thinking, making even obvious red flags easier to overlook. One errand turns into multiple runs and escalating amounts until the victim has spent over $5,000 until they realize it's a scam. Oh, that's horrible. Yeah, there's science behind that. They've seen that work before, over and over and over again, and that, that lever, as they say, um, has worked and they continue to work that. They're getting people where they're at in their lives, and you don't necessarily know that the— when you're a scammer, when you're, when you're sending out phishing emails, you don't necessarily know that the person that you're reaching out to that their emotional timing or their window of vulnerability is peak. They don't know that, but when they're sending out, you know, millions of fraudulent emails on a regular basis, chances are, you know, even if it's only, you know, 1% of those responding to your phishing emails are in that emotional timing window of vulnerability.

Right, right. And then once the fraudster establishes contact with the individual, they can easily learn more. But, you know, if the individual unfortunately trusts, you know, to start sharing information, it's not long before the fraudster knows more, a lot more about those vulnerabilities, right? Where they can, you know, where they can push the buttons of the individual and go a lot further. But, you know, this, this, they talk about phishing, and I remember a few years ago everybody equated phishing with, with that email, right? Coming in, that email is going to come in, you got to be careful with that email. But now The terminology has evolved just because it's— we can't just put it in a, in a, in a square peg box here that, uh, it's just email. I mean, it's basically an attempt— phishing is an attempt to reach out and get an individual to respond by providing, first of all, usually providing information, right? Uh, so that could be an email that someone clicks on the link. It could be that text message that someone clicks on the link or responds to the text message. It could be a voice tele— a voice call, telephone call that comes in, but that person answers and then is manipulated by the caller to release, you know, to provide information about themselves or their company. Or it could be a face-to-face interaction. So really, it's, it's just a mechanism. The email is a communication mechanism, but phishing for the most part is trying to get that hook into an individual for them to provide you with information that can lead— that's, you know, lead into a scam right there, or it could be used later on The, you know, information is power. And whether it's through phishing or whether it's through these data breaches or whether it's, it's, you know, through somewhere else, all this information that's out there about us can easily be accessible and utilized by the scammers to, to approach us with a much finer-tuned, you know, pretext for the scam, make it even more challenging for us to, to think that, oh, this could be a scam, right? It looks It sounds so believable, sounds so real because it seems to be something that, that makes sense to us.

We tailored to— and often tailored towards me because of those 175 billion records that have been compromised in the past 15, 20 years. Uh, you know, they have access, uh, they meaning, you know, organized crime, have access to all of our names, addresses, phone numbers, uh, email addresses, 15 billion passwords. And many of our social media accounts, and, and, and that data, uh, all coupled together, uh, is who we are. It's our lives. It's what our interests— it's our, our wants and needs. It's, it's, it's what we purchase online. It's, it's the hobbies that we have. It's, um, the food that we eat. It's the places we visit. Like, it's all, uh, being, you know, part of the scam. You know, if you're somebody who, you know, enjoys equestrian activities, you love horses, and all of that data is out there and associated with you. And so the smartest way to target you specifically is through communications that look like it's coming from, you know, an organization that supports, you know, the adoption of, you know, horses, whatever the case might be. Right? Yeah. Yeah. And so, and now, uh, AI-powered content generation allows attackers to craft grammatically perfect, highly contextual messages at scale. Man. Tailored to language, geography, even individual behavior. PhishGPT is an emerging class of AI-assisted phishing tools that use generative models to target or craft highly personalized, context-aware scam messages while making phishing attacks more convincing, scalable, and difficult for users to defense— and defenses to detect. These AI capabilities allow attackers to automatically generate tailored lures. Perfect, right? Adapting real time to victims' responses so they can actually communicate with them in real time and mimic authentic communication styles is significantly lowering the barrier for launching sophisticated social engineering campaigns.

Oh yeah, it's, it's amazing these— how AI can be used. AI can be used as a great collection tool of this information too, right? Because just think about— I mean, not to say anything bad about services like ChatGPT, but think about, uh, any of these that are offering free especially free, um, free use of these platforms, uh, the amount of information that we give up and provide to these platforms. And how do we know who, who can gain access to that information, who might be using that information against us or against our companies in the future? I mean, it's, it's just, it's, it's just amazing the amount of information that we are, that we are, are giving up. I mean, anything that's free— nothing is free. Although it's free, we think it's free, but we're giving up everything when we subscribe to a platform that's free, and we're giving up our information.

Yeah, yeah. So it finishes off saying, you know, phishing targets humans. These stories aren't about careless or carelessness or stupidity. You know, we tend to, in this culture, we tend to blame the victim.

Yeah.

With so much, you know, we've been blaming the victim for thousands of years, you know. And like, I might go off the ranch a little bit here, but, you know, I got my bones in doing what I do— personal protection, personal security, teaching women self-defense, you know. And as long as I can remember, even back in the day and even still today, but, you know, not as much, you know, if a woman was a victim of sexual assault, you know, the first response would be, okay, what was she wearing? What was she wearing? Like, did you know, how much did she have to drink? You know, as if her clothing or behavior warranted an attack, you know. And, and that mentality still exists. Oh yeah, you know. And, and even like to this very day when— and, and the media is great for this, like you see all the time, a company is, you know, has a massive ransomware attack or a massive, you know, data breach. And the first question, you know, the public is like, oh, what did you do? Like, why didn't you protect my data? I was like, well, okay, we'll back up a little bit. Like, and like, I speak to this all the time because, you know, I'm called upon to talk about data breaches and what to do in response. And it's important that the public understands, like, that company was a victim of a crime, you know. Like, they, they were a victim of a crime, you know. If your house is broken into, uh, and you were burglarized, um, does, you know, law enforcement go, what did you not do? What did you do? Uh, they don't. I will say, while the victim is not responsible for what happens to them, the victim is in fact in the best position to prevent it. But not all crime is preventable. I mean, when a when an attacker is motivated, they're going to find a way. You know, that does not mean that we just throw our hands up in the air and give up and say, well, if they're going to find a way, they're going to find a way. Why should I bother? My point is that you should still put systems in place. You should still have layers of protection, whatever that might consist of. In a home environment, of course, that would be, you know, locking your doors and a home security system. Can they still get in? Potentially, yeah. But that doesn't mean you should do nothing. You want to become a hardened target. And when it comes to, you know, preventing phishing, corporations, hey, yes, definitely engage in phishing simulation training, engage in micro e-learning, you know, engage in ongoing awareness training. But don't just do it like once a year during, you know, Cybersecurity Month or even biannually and it be like, you know, watching an hour pre-recorded e-learning that is, you know, a talking head or animation and it's an LMS that has Q&A, like if that's all you're doing, okay. But like how is that really helping the human and where they're at in their lives and how they feel about security? You know, most people resist security to begin with. Most people, all people trust by default. You know, so if all you're engaging in is basic compliance-based training, then I don't know if you're actually going to solve the problem of phishing, never mind all the other risks that humans face both at work and in the real world.

Mm-hmm. I think over this last year, 2 years, I've seen an increase in at least articles that are starting to address the need for increasing the awareness amongst people because I think even a few years ago there wasn't even much about that. Well, it's a technological issue, we can deal with it, and not focusing on the fact that how humans are the gateway for the bad people to get into the systems. And I think we're starting to see that. But yeah, the second part of the problem is, yeah, awareness, but how best to train the individuals regarding this awareness. I think that there's there's still like a real big misunderstanding about what is effective as far as how the training is presented. That still needs to really evolve 'cause we're way behind in effective training.

This article finishes off saying, "These stories aren't about carelessness or stupidity. They remind us about that phishing succeeds not because users are foolish, but because attackers understand humans and increasingly they have the technology to scale that understanding. The uncomfortable truth is simple. If you're human, you're a target. The goal isn't perfection. It's awareness, friction, and slowing down just enough to think before you click. This is the first article that I've read in my life that I haven't written, frankly, that actually addresses that aspect of human behavior. And I think this is the first empathetic article that I've ever read in that regard. Which is a good sign that things are turning even ever so slightly, uh, adapting basically the philosophies that you and I have been dispelling for quite some time, you know. And, uh, maybe we'll see some, um, real true, you know, security appreciation training, uh, coming about in the few years that effectively you and I are providing already.

Yeah, let's hope it comes around because, uh, I want to retire eventually. I want to retire. But I think I still, I still believe that my expression that I've been using for the last years is really, if people abide by this, you know, um, social engineering would be almost eliminated. Successful social engineering going to verify before trusting. That's all we got to do. We just need to verify that incoming, whatever it is, and verify is this authentic or not, and then decide whether or not we're going to comply with what's being requested of us.

It says it right there at counterintelligence-institute.com. It says right up top, verify then trust.

I got my grandkids even saying that expression. They'll still, they say it, verify then trust.

And there he is, Peter Warmka, counterintelligence-institute.com. Security Awareness Training and Education. Peter, uh, anything you want to plug?

No, I recommend visiting that site also. I mean, I'm on other social media, but especially, uh, LinkedIn. I love to go out and give presentations and training courses. I do that both domestically as well as internationally. And you're going to see more now in the next few months. I'm going to be focusing more and more and more on elder fraud. Uh, so, so you're going to see— I'm going to launch a a, uh, series of videos specifically dealing with that. And in a future one, I'm gonna actually share the link and talk a little bit more about that. But this is one of my passions, uh, awesome. It's really to help the elderly and seniors like myself. I'm there. You're not there yet, Robert, but you're, you're following him behind me, not too far.

And, uh, y'all could see me at protectnowllc.com, uh, update. I updated the entire website over the holidays. Peter, you know what's an— what's a cool thing? Uh, you, you can use Google's Gemini, ChatGPT, and that— those tools will walk you through the entire process of orchestrating any and every update that you want to make to your own website. Like, while there are certainly experts out there that, that's their job and they do an excellent job at it, uh, if you just want to make some tweaks, make some copy changes change around a photo here and there, add some, you know, uh, code to do this, that, and the other thing, uh, utilizing an AI engine like Gemini or ChatGPT, like with screenshots and asking questions, they, they understand all the templates, they understand everything, every aspect of the back end of your website and can walk you through every aspect of it for those updates and changes. So I spent a little bit of time, and I'll tell you, man, like, I am capable of editing my own website going forward. It may not be the absolute prettiest thing in the world, but, uh, it's still fully functional and gets my messaging out there effectively. So yeah, protectnowllc.com, check out the updates. And, um, last words, Peter?

Stay warm and share your blanket with others.

That's a good one. Yeah, great, Pete, I appreciate you. All right, everybody, if you got questions, comments, feedback, reach out to Peter Rye. Uh, you guys are great. Thank you for your support. Talk to you later.

Take care.