What can the recent Astroworld Festival tragedy teach us about safety? #11

Welcome everybody to the Security Guy and the CIA Spy Show podcast, where we are keeping you on top of what is new and ahead of what is next at all times on all things security, tech, and digital literacy. Knowing that when good people like you want to make sure that their money, their family, and their business is safe and secure from attackers, hackers, and thieves, or you just want to make sure your tech is running smoothly, my name is Robert Siciliano. I am the Security Guy, and along with my co-host Peter Wormka, who is a real and retired United States CIA spy, we will give give you every single tool, tip, tactic, and skill that you need to fight the bad guy and keep your physical and digital life secure, worry less, and even make you happier. This podcast will help you breathe easier with less stress and a greater sense of well-being. So let's get at it, and welcome to The Security Guy and CIA Spy. I am Robert Siciliano, and this is Peter Wormka, broadcasting from Washington, DC., and I am in Boston, Massachusetts. How you doing there, Peter?

Oh, I'm doing well, but I tell you, I've been on the road here now for almost 4 weeks or almost 5 weeks, and I'm looking forward to finally getting home, but things are going well. Thank you.

Yourself? Yeah, business is good. You know, like, like I've said before, bad guys are good for business. And, um, today we're going to discuss what those bad guys are up to, along with another, of another issue, uh, that, uh, Peter and I had talked about briefly, you know, that whole, um, Astroworld, um, concert where 8 people were, uh, crushed and killed. I immediately saw that on my feeds at 6 AM. I think it was on, on the Saturday after it occurred on the Friday night. And, and, you know, CNN was one of the first to report it, and I immediately was upset by that, mainly because I go to a lot of concerts. I go to shows, at least 4, 5, 6 shows every single year, sometimes more, uh, all around the Boston area in New England. And I see a lot of concerts, and I've been to hundreds and hundreds over the years. And, um, I, I've always visualized something like this happening. I've always seen this in my mind as the potentiality to happen at every single venue that I've ever been to. And what has always concerned me is the, the, the lack of control that every single venue has over the mass amounts of people that are contained within that venue, whether it's an indoor venue or an outdoor venue, whether it's general admission or assigned seating, the sheer volume of people, and if there is any form of a disturbance, whether it be fire, something occurring on stage, where, you know, it might be like somebody jumps up on the stage from the audience, a fight in the crowd, and all the sporting events to all the concerts I've been to, I've always seen something occur that's always got my attention. This right here isn't— I'm surprised it hasn't happened more than it has. Peter, what were your thoughts on this?

Yeah, I agree with you, Robert. I mean, uh, these type of things, you do hear about them happening from time to time in other countries, you know, whether it's these massive crowds, uh, with people trampling over each other, or these fire— a lot of, a lot of incidences of fires in nightclubs. Uh, so we hear about them, but I think people tend not to think that this is going to happen in the United States, and they buy the tickets thinking, well, the venue is going to provide whatever security is necessary. I don't even have to worry about this, or I don't even think about this. I'm just looking forward to attending this conference, uh, this, this concert. And so people are going there with that mindset. It's the last thing they're thinking about really is their security.

And, and it's— I think from my point of view, it's the first thing they should be thinking about, you know, um The problem begins with the human being and the fact that— this is my observation— the fact that we are first and foremost, and it's important that we are selfish. That being said, being selfish is important, but there's connotations to that that are problematic. You have to take care of yourself first. Like, that is really important. Uh, if you don't take care of yourself first, then you can't possibly take care of others, right? I mean, you have to, um, what do they say, uh, at the airport, at the airplane, to, um, the oxygen mask? Uh, you know, it feels odd to hear flight attendants remind us to put your— on your own mask before helping others. It seems backwards, right? The theory is that if you can't breathe, it's probable that you are gonna have a hard time lending a hand. Like, that makes total sense, right? This is from Seth Godin. In our daily lives, the oxygen mask might be metaphorical and the insecurity threat might be invented, but it still feels real. It's worth remembering that the next time someone doesn't act in a way you expect, that it might be that they are having a little trouble of their own. Trouble you might not even be aware of. And that all makes sense to me. It's like, if you are not taking care of yourself properly, you become irritable, you become angry, you become short, um, and, uh, you— so you really have to take care of yourself first. That being said, many people go beyond the selfishness that it's required to take care of yourself, and they only think about themselves, and they don't think about others ever or often enough. And in this particular scenario, the way I view this, it's purely people being selfish, that they wanted to be closer to the stage and all they were thinking about their own selves. So there was a certain amount of people that just thought about themselves, they just started pushing, they didn't think of the consequences of what they were doing, they pushed forward, pushed forward, and then Beyond that, people followed the herd. We, we want to be— human beings want to be led as well. And so between being selfish and just wanting to be led and following the crowd, that's why this happened. I mean, it happened because human nature is just flawed.

I think it also depends on the kind of event. I mean, there are some venues you can go to where you are— you purchase a seat, and it's much easier to control these sorts of concerts, which can be really large, but you have, you have control, you have ownership for that period of time over that seat, and it's not where people are just going to be coming in there. I don't know how many people— there's like a massive amount of people to the point of, you know, it's— I agree with you, uh, there are people that were very selfish, but you also have individuals that were even promoters of this event who have a track record of sort of promoting, you know, you know, don't— you don't need to respect you know, uh, security, or you don't need to respect the rights of others, or, you know, just get closer to the stage, bypass all this, that's all that matters. So they were also kind of like, you know, promoting this, unfortunately promoting this sort of behavior.

That is what I heard. And so this article came out just a couple of days later in Security Magazine, which, you know, it just, it's just proof that it's, it's, it's in line with, with where we are coming from as security professionals. Uh, Astroworld deaths serve as a solemn duty of care reminder. And for those of you who don't know, the definition of duty of care stands for the principle that directors and officers of a corporation, or an event in this case, in making all decisions in their capacities as corporate fiduciaries, must act in the same manner as reasonably prudent person in their position would. So basically what they're saying is it's a legal term that In your role, your responsibilities are to really think through every potential possible outcome. Foreseeability equals liability. And if you can't foresee how things could possibly go wrong, then you reverse engineer that process to make sure that they don't by making things go right, by putting systems in place to prevent, you know, situations like this from occurring in the first place. So for example, like right now, if you look at, you know, this particular event and how it happened and what occurred going forward, you'll see, uh, those in a position to prevent this from happening, they will create certain pockets of, um, they'll, they'll, they'll begin to section out the venue in such a way where you don't have, say, 30,000 people in the same space. You might have maybe, um, 30 sections of 1,000 people each. See what I mean? Lessening the potential burden and maybe preventing something like that from happening, like sectioning off aspects of the venue to prevent a general admission event from a stampede. So you'll see that occur in future events as a result of this particular tragedy, because now with foreseeability, knowing that this can happen, we've known this for— we see this at religious events often, overseas, you know, um, and just different parts of the country, uh, and you just don't think that would happen here, but it does because people are just simply selfish. And so this particular article talks about how it was, you know, fully preventable. Tragedies like the one, uh, at Astroworld have been happening for decades, uh, the specific, uh, to people who have been killed in poor crowd control, stampede, decrustions. There are many measurable incidents that illustrate this duty of care, like what you're supposed to be doing ahead of time. It goes on to say that— and this is via Security Magazine— while most public events happen without casualties, the duty of care should always be applied from a worst-case scenario approach to planning, right? Which is, which is, which is all, um, safety of life and limb, which is all security really, right? You have to fully think through what could potentially go wrong reverse engineer that process to make it go right. This can be done by examining common traits among case studies specific to sporting events in this particular entertainment venue. It's also vital to remove any silos between safety, code compliance, and security, as they strongly are interconnected. So what are your thoughts on that, Peter?

You know, I agree. And to me, when I keep on going back to— when I think about this, this is, this is really a tragedy. But what really kind of impacted me too, that within 24— I mean, the news came out about this right away, right? It was being reported on, but within 24 hours, less than 24 hours, there was like already, I think, 12 different legal suits which were filed. I can't believe that people who have lost, you know, family members, that's the first thing they're thinking about is calling and, and trying to get a legal suit going. I think it's probably in many cases law firms that are reaching out to family members, but, you know, it's, it's, to me, it's just sad how these legal suits are You know, if that's— if that is what it's going to be needed to change the behavior of individuals who are responsible for safety, well, so be it. But to me, it's just sad that it has to go to where that has to be sort of the, the impetus, right, to make, to make changes where I'm concerned about a lawsuit, I'm concerned that this is going to cost me a lot of money rather than really doing what's right for the safety and well-being of people.

Yeah, in a litigious society in a litigious society, that is ultimately what we think of first. You know, what's interesting about that is, um, I speak to real estate agents a lot about their personal security, and one of the things I say to them is, you know, if you are in a situation where you're in a house and somebody means to do you harm, but you don't necessarily see a gun, you don't see a knife, they haven't actually attacked you, but your personal security is a concern because your intuition is jumping up and down saying something's wrong with this particular person, they might attack you, but you don't see anything going wrong. I say to— I say to the agents, you should just leave the house if you feel something is wrong. If you sense danger, leave the house. And their response is, well, but if I leave the house, what if they steal something? What if something happens? What if I get sued? Like, their first responsibility is like, they think their first responsibility is not to get sued, where their first responsibility should be to take care of themselves, to protect themselves. Like, don't worry about the house, you know, worry about your safety. And so, and that's where we are as a society, as a culture. And in this case, you know, it is also a motivator.— in being in a litigious society is a motivator to actually think things throughout to a point where, you know, you put systems in place to make sure it doesn't happen. Because if there— if they— if there wasn't repercussions, in this case legal financial repercussions, then, um, you would have situations where, like, uh, the Station Nightclub in Rhode Island, where, you know, the— unfortunately, I think 100 people died in that fire. Um, they didn't, uh, think through the pyrotechnics going on inside of that venue. Uh, the Coconut Nightclub, where doors would, uh, open inwards opposed to opening outwards. So they changed the laws, they changed the rules, made businesses liable, making sure the doors opened outwards opposed to inwards, because it trapped them in inwards, right? Because they couldn't go out, you know. So that— there is benefit to that, but at the same time, you know, um, it doesn't make humans look all that, you know, kind to one another.

Well, I'll add, I'll add something to that, Robert. I completely agree. And I think we take this one step further, whether it's in these type of incidences or any security instance to include data breaches. And this idea, well, there is risk, but I can offload this risk to insurance companies, then it's sort of like I don't have to worry about it anymore because I know if something happens to me, I got insurance to cover, uh, you know, my liability, which You know, it's sort of— yeah, I think it's good to have it be insured, and sometimes these insurance companies will ensure that we also adhere to certain standards, but I think it, it ends up being where individuals become a little bit, uh, lax and really evaluating these situations.

Yeah, as Benjamin Franklin once said, to be safe is never to be secure. And what that, what that means to me and how that applies here is that You know, if you want to be safe, if you want to be secure, you always have to be on your toes. You always have to be alert. You always have to be aware. You always have to be thinking like the bad guy in such a way where you're preventing, you know, theft and violence or whatever it might be, right? But not to a point where you're obsessed about it and you're paranoid about it, but just have it as part of your, you know, psyche, like, so that you are— so you recognize risk, uh, on a regular basis. You know, to be safe is never to be secure. And that means, like, even if you have, in this case, insurance, right? And even if, you know, you are covered, that doesn't mean that you should just, you know, think, okay, we're safe, we're secure, we have insurance, we have nothing else to be concerned about. Well, yes, you do. You have a lot to be concerned about. And in some cases, when it comes to insurance, if, um, you can't show due diligence, if you can't show that you met all the basic criteria, in order to actually be protected by insurance, then you won't be covered even though you think you're covered. So there, that, that boils down to duty of care. Like, if you haven't exercised basic duty of care in regards to if your network is breached and you have cybersecurity insurance, and then the cybersecurity insurance forensics experts come in and they look at your network and they go Well, you didn't even have antivirus on your computers. You had— you were riddled with malware and spyware. You haven't updated your operating system since Windows 7. Yeah, you have cybersecurity insurance, but we're not going to cover you because you didn't exercise basic duty of care. Like, you didn't even meet the criteria to even be insured. Yeah, we'll take your money every month, but that doesn't necessarily mean we're going to actually insure this particular incident because you are just completely irresponsible. That's how that works.

Yes.

So Peter, we have, uh, some data breaches to discuss here. Uh, I get an email from the, um, Identity Theft Resource Center, uh, and if you, uh, search the Identity Theft Resource Center's notified, um, newsletter, you can get it as well. Anybody can subscribe to it. I used to— I was on the board of directors for the Identity Theft Resource Center for 3 years. I Actually, was it 3 or was it 6? I think it was 3. Uh, great organization, by the way. So, uh, what they talk about is 140-ish, uh, data breaches that occurred in October. I think it says that, um, for the Neiman Marcus Group, they had 4.35 million customers, uh, breached. Uh, Twitch, um, a malicious third party had access to gaming service, and I believe it got, uh, usernames, email addresses, comments Public school systems. Um, I mean, it's, it's notable data breaches. What are they talking about? Neiman Marcus, uh, public school systems, Twitch. Uh, you know, the bleeding isn't going to stop anytime soon, Peter. And this particular one right here kind of bothers me, partially because I'm included in it. Uh, the Robinhood data breach exposes 7 million customers. Those of you who don't know who Robinhood is, and this is via CNET, um, they are a, uh, an app that basically is a stock trading platform. And they school you, they educate you, they provide you with, you know, content that will allow you to, you know, get up to speed in regards to investing in the stock market. And so really, for anybody who has a mobile phone and is of 18 years old and has access to a credit card or a bank account or whatever, you can begin to trade and invest in stocks, like, really easily. Um, and so they were breached in such a way where Um, you know, I think it says ultimately 7 million customers compromised. You know, Peter, like, I look at this and go, yeah, it seems about right. You know, what bothers me is, is that a company like this that has the most sensitive of sensitive information, like your financial data, right? They have access to like bank accounts, credit card accounts in some cases. Maybe they have access to possibly transferring funds from one account to another, your money. When this happens to a trading platform like this, everybody should be worried about their finances being out of their physical control.

I think in this particular case, they kind of downplayed the significance of it because, well, 500— no, 5 million customers had their email disclosed. And some other ones had this information or that information. And they say that was not enough information really to endanger any of their clients' financial information. But I guess I raise this question. I want to be the devil's advocate with you, Robert Siciliano. A normal company, if I were the head of a normal company, the last thing I would want to do is to make public a breach, a data breach that my company has encountered. I would— I wouldn't want to do that because it's going to cause damage to the reputation of my firm. I will lose clients. I will have difficulty getting new clients. It might even open me up to litigation. So I'm going to do everything possible. Probably the last thing I want to do is to publicly disclose. But I know there are certain legal requirements where companies have to by law disclose, and I understand it. A lot of that has to do with whether or not personal identify information is disclosed. But then, uh, many times that can even be a delay in the disclosure if there is an ongoing investigation. But I also wonder, what does public disclosure mean? Does that mean reporting it to the press, or just reaching out directly to the clients who may have been affected, whether it's 10 or 300 or 3,000 or 3 million, and advising them without making the overall public aware of the breach.

So, um, data breach notification laws have been around since the early 2000s, California being the first state in the nation to enact data breach notification law. Uh, Peter, you can see my screen where it says, uh, National Conference of State Legislators?

Yes.

Thank you. So, um, uh, it was actually, um, a company, uh, and I'm not sure where they were based, called ChoicePoint. Which was an information broker. They don't exist any longer. And they had a data breach of, I think at the time, I forget what the number was. It wasn't that many. It might have been like a quarter of a million people. I, I forget what the number was, and, uh, because it was so long ago. And, and they, they had this particular data breach. And when I say data breach, basically it was, I think it was Nigerian identity thieves who essentially logged into the website, set up accounts, and began to buy personal identifying information like names, addresses, and Social Security numbers. Like, it's not like they hacked in. I believe they walked in the front door, but they used that information essentially to open up new lines of credit and to commit fraud. So it wasn't necessarily a breach in this case. It was a breach of trust of their existing clients to use the information for ill-gotten purposes is what it boiled down to. As far as I remember. That being said, ChoicePoint notified 30,000 people in the state of California, and that's it, because California was the only state in the country that had a data breach notification law on the books. So they only told the people in California, and then the media picked up on it. And when they picked up on it, they were like, so wait a minute now, California, who else? Well, there were, you know, 5,000 from Massachusetts, 10,000 from New York. Well, well, did you tell, did you tell those states? And they're like, well, no, we didn't have to. We, we, it's not required by law. And they're like, so as a bad corporate citizen, you did not notify anybody else because you didn't have to? Well, we didn't have to, so why would we? Every single state's attorney general got involved. They passed data breach notification laws in all 50 states. Within a decade, maybe less. And those rules and regs revolve around notifying the people who are affected within a certain time frame, and that has evolved in regards to the certain time frame over the past 5 years, really. Um, and then, uh, in addition to that, there's like a press release. I believe a press release is supposed to be provided. You have to let the Attorney General know in each state, where I think they also do a press release. And you have to bring in forensics investigators to define exactly why. Like, there's all And it's all right here should you all want to know. Now, I do believe the press release— it, it's either as a blog and/or a press release. You have to provide something public-facing so that the general public will be made aware of the issue. It's kind of like if you as a homeowner want to, um you know, make a change on the zoning of your property, then not only do you have to appeal to the zoning board, but you've got to publish something in a local paper saying that you're going to be going to the zoning board in front of them to make this change. And the public needs to know that that's going to take place. And then you're also supposed to notify your neighbors via, via a physical letter to let them know that that's actually happening because you're making a change in in the rules and regs regarding the zoning. Well, that same concept and philosophy in how you make people aware of something occurring, it was adopted by the various states requiring notifying all those that could be affected by it. Does that all make sense?

Yeah, it does. And many times I see that, oh, they'll, as a means of compensating those affected, they will provide for 1 year credit monitoring, you know, identity theft, you know, protection. I don't know if that's just, uh, are they required to do that, or is it just like to make, make it show that they're trying to?

Usually it all depends on the nature of the breach. I think there are some laws that— so, so further breaking down the nature of what is considered a data breach, what information was actually breached, what risk is there as a result of that information being breached, and so forth. And then if it ultimately boils down to the, you know, the potentiality of new accounts being opened up under a person's name, etc., um, that would require identity theft protection depending on the nature or the definition of what identity theft is and isn't regarding the specific information that was compromised. Depends on what is required in response to that breached by the company. Like for example, if credit card numbers are compromised, identity theft protection really isn't necessary. It's not going to do anything. It can't help you in that regard. It's only if your Social Security number is compromised that identity theft protection would make sense in response to the breach. All that said, some states by default require the providing of identity theft protection services regardless. Which doesn't make any sense, but it's just more of a reason not to get breached for those who, you know, should make those necessary investments in their networks. Okay, so here's that resource for those of you who want to know more. Okay, and for those of you in your Robinhood accounts, the largest part of the breach leaked email addresses for about 5 million customers according to the company's press release, right? So they let the public know, with full names being leaked for a separate 2 million customers. That same press release indicated that 310 people may have had their names, birth dates, zip codes leaked, and more extensive accounts for nearly, uh, roughly 10 customers. No Social Security, bank account, or debit card information is believed to be exposed. So the company is in the process of contacting the people being breached. All that being said, the biggest risk here is what, Peter? What's the biggest risk? You tell everybody.

Well, going forward, I mean, this information, once, once it's out there, it doesn't mean necessarily that it's going to be acted upon within a month or within a year. That once that information is out there, it can be acted upon at any time in the future.

And how will they act upon it?

Uh, well, I mean, it's going to be the identity theft. I mean, a lot of cases, identity theft, because this is talking about potential attacks against specific individuals, right?

And so how will they use that information against those specific individuals? What will they do? What are the scenarios?

Well, I mean, it depends on whether or not they want to attack that individual and trying to, to open up, uh, you know, credit in the name of these individuals, steal money from their bank accounts, or can be even used leveraging that to use that individual to breach the security of organizations. That they are— that they may be members of or working for. So I mean, it can go either way. It can be the direct detriment of the individual or leveraging that individual to, to conduct another, another breach. That's what we see a lot of these breaches of smaller organizations where you think, well, and I, I've spoken with a lot of these companies that think, I don't understand why we are being subject to probes or for attempted social engineering or hacking, but we're so small. But they have information, they have information on people, they have information on other companies that can be used for larger attacks.

It's, it's the bad guys gathering intelligence, right?

Yeah.

And in this case scenario, one of the biggest concerns I've— I would have is as a Robinhood customer, the fact that 5 million email, uh, addresses were leaked I would be concerned of getting emails that look like they're coming from Robinhood but are in fact phishing emails designed to get me to update or change my credentials.

Yeah, good point. Very good point.

Yeah, that would be my first concern as somebody whose information was actually leaked. So, uh, that's what everybody should be on the lookout for. I'm sure those 310 people, uh, are going to be handled in a different way. Um, the, uh, those additionally 10 customers probably going to be contacted directly. Uh, but about— but those 5 million, including myself, going forward, you know, anything that I receive from anybody that says they're Robinhood, I am automatically suspect. Even, even if it is in fact Robinhood sending out an email letting me know, um, at the same time, I am not going to click on links in the body of that email. I'm going to go directly either to my app or to the website to find out what's going on, to retrieve my information. It is also entirely possible that if Robinhood does it right, they won't actually include any links in the body of their own email. Um, whereas, but that being said, not— I, I've seen in situations where the company that was breached would not do anything within their own communication to facilitate a potential, um, fraud that it could occur via clicking links such as spoofing. They wouldn't do that on their own email, but bad guys would do it in their own emails. So that's something to think about when you receive those communications.

I mean, like, you see a lot of— there's a number of companies now that will incorporate a certain, you know, a filter so that they won't accept any emails that have links attached to them. And it's very different, you know. You notice that you try to— you try to send an email to a company or an individual in the company and, and they don't get the email, and you think, why? It's because you had links or an attachment, you know, included with that email, and those are filtered out entirely, right?

Right.

Yeah.

All right, so, um, moving on. I thought this was kind of scary and cool all at the same time. Um, this, you know, I'm not on TikTok myself. I've just, um, don't have the time for it. Uh, so missing teen rescued after making a hand gesture she learned from TikTok to signal for help. So I was unaware of this. My kids don't spend, uh, any time, um, on social, and they're of this age. And, um, so they didn't tell me about it. That being said, I'm going to be asking them about it and further if they knew about it. And then, you know, I don't know what the origins of this are, but, um, a missing teenager from North Carolina was rescued by Kentucky police after she signaled for help by using a hand gesture known on TikTok to represent violence at home. According to police, a 16-year-old was reported missing by her parents. Uh, this is via CNN. And, um, on, uh, a motorist in Kentucky called 911 to report seeing a girl in distress in a vehicle on the interstate. Imagine being the person in that car, seeing a kid next door like doing this or whatever, you know, like using the various hand gestures, you know, and knowing what that is. And like, I can— I'm getting chills just thinking about that. Like, when you— when we talk about when you see something, say something, this is a person who is driving but not just looking ahead in a daze. They know what's going on around the perimeter of their vehicle, you know, 360 degrees, which is fantastic. And because of their awareness, they saw this girl and, and, and made the call and got her to safety. Like, that is awesome, you know. That, that is the type of person that, that we all should strive to be.

Yeah, this is pretty amazing, and I'm glad you brought this example because I was not aware of it. I mean, I I think I've seen a few of these videos, but not really understanding what they meant because no one ever actually explained it to me. And so most of us of our age, Jandra, we are not aware of this. Younger folks probably are, but bringing this out is something that now if we happen to see it, we know what it means.

I don't know this to be the case, but I wonder if— and I really should do my research here. If, if put palm to camera, tucking the thumb and/or trap thumb, I'm just curious if that has anything to do with, um, uh, people at, uh, uh, what is it, people who are deaf, um, uh, sign language.

It's related.

Yes, there must be a correlation there. So yeah, I encourage everybody to share this and to learn more about it and to pay more attention and to be just like that person who ultimately was responsible for getting this girl the help that she needed. It's a fantastic story. Awful and fantastic. All right, so this is— and we're just about to wrap up here, Peter. HelpNet Security discusses younger generations care little about cybersecurity. Corporate email usage for social media logins. Let me see. So according to a finding, 59% of all workers are using corporate email for personal use. Okay. Uh, but Gen Z is the biggest offender, 93%, with these numbers growing as the lines between work and home increasingly blur. Um, SailPoint settled to determine how users' behaviors when conducting these activities could put a target on any organization's back for a cyber attack or a breach. So for example, if you're using your, you know, corporate email to sign up for a rogue social media site in, you know, a foreign country, uh, or for white nationalists or whatever the case may be. You're providing your email address to people who might be a little less responsible than, say, um, you know, a major US-based corporation that, you know, it has a duty of care and they are liable and they have to pay attention to that stuff. And, and, you know, so kids in general, you know, they're putting their companies at risk because they're brought up with digital devices from the very beginning, watching the kids play with the iPhone at 2 years old in the airport, uh, and, um, they don't think about security like, uh, their, their parents or, um, uh, you know, others would of an older age.

This is something that, I mean, I can see easily how it happens why it happens. And unfortunately, it is, it is a big problem, and companies need to— I mean, I know probably a lot of companies are cognizant and maybe have a general policy, well, you really shouldn't log into your personal, you know, social media accounts while you're at work. Or maybe they let them use— they'll say, okay, don't do it while you're working, but you know, when you take a break, you're okay. To get in to log in. But this is a bigger, bigger problem where I think organizations need to better train and sensitize their employees, even to the sense of— I don't know, maybe I'm stepping out a little bit far, but I think employees at all levels would adhere better to those type of policies if there were serious ramifications that if they were able to subsequent to some sort of breach or something happening, be able to determine it was caused by this individual's using our IT network or our corporation's emails to log into something that led to this breach. And it was a, you know, a personal, a personal use of the IT system and have serious ramifications. In some cases, that's the only way to change behavior if there's serious ramifications, unfortunately.

And which, which boils down to hiring policies, firing policies, and ultimately, um, you know, it's, uh, the ultimate responsibility is on the organization itself to providing, uh, again, various policies and ongoing security awareness training, uh, in order to, you know, change the behavior of the user and to remind them of what they can and can't use their company email for. Social media is fueling malicious attacks, especially against Gen Z. In this day and age, an email is required to create any kind of online account, like I had said, including social media profiles, like I had said. While these sites are traditionally meant for personal use, the survey found that Gen Z, 77%, millennials, 55%, are using corporate email, uh, for their social media logins, compared with just 15% of Gen Xers, which is me, and 7% of boomers, which makes total sense. So you have your boomers are actually the most secure in that regard. And then right behind, the boomers are retired.

Some of them are.

A lot of them are, which is part of it. Yes, no question. Um, perfect point. So, uh, as a company IT manager, um, I believe that, um, uh, there is a way to, um, I believe there's a way for companies to purchase lists or to be able to filter out whether or not their email addresses are being used for certain sites. I'm not exactly sure about that, but I think there's a way to go about that. I think there is tech out there that will facilitate that process. I don't know, um, but, but if, if there isn't, there should be. That being said, it really does boil down to, um, uh, user awareness, knowing what they're— what is okay and what isn't okay, and really drilling that home with, um with corporate IT managers and HR and informing the employee that— Peter, you and I talked about this very, very briefly— that employees at some level can end up being personally and legally responsible for a breach should it occur as a result of their, um, you know, lack of security or following policy.

Yeah, exactly. And I think that we're going to see more of that coming going forward. I think we're going to have to, actually.

You know, it would be interesting to see if that actually takes place. Um, you know, employees, uh, certainly are fired. Uh, they, they, they lose their, uh, their, their, their, their role within the company. In some cases they're demoted. Uh, you see even company officers and, um, CEOs, uh, CIOs, and, you know, CFOs HR, all being fired as a result of a data breach. And then, um, in addition to that, uh, you know, some of them are actually getting, uh, their, their severance pay and they're gone. But they have— there's a black stain not only in that company but on the employee and their ability to get a job in the future, right?

I think that needs to be better known, you know, by— I mean, a lot of that stuff's kind of kept for obvious reasons, privacy, kind of kept hush-hush, you know, within the company or with the individuals. But some of that needs to come out a little bit more so that people realize, hey, there are many, many cases of these sort of ramifications, individuals suffering from these things. Um, I think more that needs to be shared for the benefit of all.

All right, Peter, so tell me, um, what do you have, uh, going on that we might want to be aware of?

Well, I always encourage individuals to, uh, to visit my website, counterintelligence-institute.com, because there's a lot— it's a lot more robust now. There's a media file. There's videos. There's podcast links. And there's a lot of articles that I have contributed to that are on there. We're going to be incorporating additional training there in the near future. So I encourage people to see the site, to learn more about our services, as well as to visit my LinkedIn, Peter Wormka on LinkedIn. They can see a lot of activities that I'm involved in.

Yeah, Peter has a very robust, uh, LinkedIn following and, um, lots of great activity there. I suggest you all, uh, check them out. Uh, and so, um, we are at protectnowllc.com. We are going to be launching an updated version of our e-learning over the next, uh, couple of weeks. Uh, you'll get links to that, uh, in our newsletter. Feel free to head to our website to sign up for our newsletter at protectnowllc.com. We really would love to stay in touch with you via email. Every couple of weeks we'll send you off a brief communication keeping you up to speed, up to date on all things InfoSec, personal security, and digital literacy. Peter, last words.

Stay safe and be very careful as we go into the holiday season because criminals also love the holiday season and, uh, they're very active. So we'll talk more about that, I think, in an upcoming podcast.

And be nice to each other. Have a great day, Peter.

You too. Thank you. Bye-bye.