Ransomware Survival for Small Business: The Recovery-First Cybersecurity Playbook (Backups, MFA)

Welcome back. Today, we're dealing with a threat that can wipe cash flow, destroy operations, and wreck trust overnight. It's ransomware. And here's the question that frames this episode: if ransomware hit your business tomorrow, would you recover fast or never recover at all? The truth is, some companies bounce back in days, others don't make it, and it's not always about size. It's about readiness. Today I have Sean Kowalidik with us, and Sean is the author of a book. Sean, tell them your book title.

The book title is Don't Be the Weakest Link: How to Protect Your Personal Information in a Digital World. And it's funny, you practice my last name so hard. My first name is Shane.

And see, this is. This is— and I, and I said Shane 5 times this morning. 5 times. It's Shane, not Sean. Got the last name right, messed up the first name. And this is live when you do this stuff.

And, and you got the last name better than any other podcast host I've met. So, hey.

Well, Shane, I appreciate that. Listen, Shane's book is gonna be in the show notes. I'll have a link there for you. It's a free digital copy. And I suggest every, every listener download a copy of his book. Ransomware is real. So we're gonna go through a couple of things and just talk about ransomware, and we're gonna listen to this expert here tell us some of the things that we need. So Shane, welcome to the Small Business Credit Minute.

Well, it's a pleasure to be here, man.

Thank you. Thank you. So let's set the frame. What does surviving ransomware really mean?

I suppose the best definition would be being able to shrug it off like any other issue in the company. You know, when something happens to the price of fuel, does it ground your fleet or do you just pay for the extra fuel? If it's something that you shrug off and say, all right, well, that was a problem. We resolved it. You know, garbage men are on strike. The bin's overflowing. Can you shrug it off and survive? No big deal. If ransomware comes in and the IT guy comes in and says, listen, someone clicked on an email. It didn't go so well. We're not going to have computers for the next 12 hours.

Yeah.

Dude, if that's the solution, you did great. You know? So, some guys, it doesn't turn out so well. You know, I know.

And what we're hearing, I mean, we hear it every, almost every other evening on the evening news. Some hospital in California has been struck by it. Some pharmacy has been hit by ransomware. And later on, we're going to talk about paying, paying the ransomware or not paying it. And what are the results? So, here's one of the core questions, if you will. What's the biggest difference in fast recovery or never recovering at all?

Oh, the biggest difference?

Yeah.

A lot of people say, oh, big companies, they survive because they've got all this money. But it's really, it's got nothing to do with the preparation with Finances. It's the preparation with the business. So, if the business is prepared, if they've put whatever money was feasible for that solution and they've put in the time to test their solution, then that's where the difference is. You know, ransomware doesn't destroy businesses. Unpreparedness destroys businesses.

Got it.

And you mentioned hospitals. St. Mary's in Illinois, Gone. This is a big health center, and it's not like they were down for a month or two. They don't exist anymore. And for a small community to lose a health center, and now people have to drive an hour or two to the nearest hospital, that's, that's a problem for everybody. And so—

Let's talk about that just a little. I didn't know that. I didn't know they were gone. So, so your, your company is attacked by ransomware. Even if you pay the money, I guess we can't wait on this. Even when you pay the money, what's the benefit or what's the risk?

The risk is, and the numbers change all the time, but yeah, it was last I saw, like 30% of the people pay the money. Just get asked for more money.

Of course, because I know you can pay now, so I'm going to keep coming after you. It's like a hostage, right? I got you. Give me more.

Give me more.

Huh. So now this hospital that went away because their system was attacked, they had no more access to it, correct?

Their biggest problem was they lost access to the systems that managed federal billing. So how much money comes from Medicaid and Medicare? The pipeline's cut off until you fix your stuff. And I think they were down for the government billing for 6 months.

And right, and the government is saying, we're not paying if your system is corrupt or compromised. It's just that simple.

So, yep.

Geez.

Wow.

Okay, so now let's get into the meat of some of this stuff. How can, how can Small businesses, if you will, how can they make themselves resilient and, and be able to mitigate a storm like this, right? So what, what can they do to create proof that they are surviving or able to survive?

That's a tough one because there's a lot of There's a lot of belief out there in the IT world that we could take a checklist, check off all these boxes. Did you do this? Did you do this? And it's like everybody's divided. Some guys are like, oh, the checklist isn't enough. It doesn't work. And some guys over here, without the checklist, you have nothing. And I think the checklist is a great place to start.

Okay.

Whether you could run a business with a checklist, you know, I have a lot of checklists that say, do your backup. That's crazy important.

Right.

But then you've got to have a check item that says, we tested it. We restored a file from that backup. If you haven't restored a backup, it's not a backup. It's a dream. You told a piece of software, back up all my email over here. And then Microsoft or Google deletes your email, you know, you need to go to that backup and restore it to your computer. If you haven't done that restore, you don't have a backup. You've got—

All right, that's information that you just told me because I need to do that this morning after this interview. I'm gonna back up my system because I get a notification, right? I'm on the Apple system and I have the backup and it'll be like, you know, Like, it's time for me to back up. And I'm like, I'm doing something right now. I'm doing something. I'm going to back up because I can't afford to go down. I can't.

Yeah. And email, people don't think about email lots. They say, oh, we pay Microsoft 365 or we pay Google. Neither of those companies guarantees your email. They guarantee access to your account. But tens of thousands of people Have, oh, Google had a glitch and they just deleted your email. Well, if you don't have a backup to restore that email, they say, oh, your email's working again. I'm like, yeah, but where's the last 5 years of emails? Where's all my sent items? Oh yeah, sorry, we lost those. You'll have to restore them from your backup.

Wow. And if you don't have a backup—

Well, that's what people say. I get that all the time. It's like, well, Google was my backup. And I'm like, right, no. Google provided redundancy. They don't provide backup. And that's a huge difference. Redundancy is having your OneDrive or your Google Drive. If my computer dies, I put up a new computer, log in, re-download all my files. That's redundancy. If Microsoft disappears, that's my backup. Where's my backup?

Got it. Got it. So Shane, what are some habits? What are some habits that small business owners can jump into to ensure their business can survive a ransomware landscape? What should they be doing?

All right. So, I'm going to give you my top 3. Okay.

All right.

I love those. I love those Letterman top 3. old enough to remember who Letterman is.

Oh geez, you talk like that, we're old enough to remember Johnny Carson. Stop it, stop it, Shane, stop it. Okay.

My wife would be like, Johnny who? I think, oh yeah, the white-haired guy, I remember him.

Exactly. Yeah, yeah.

So you know what, top 3. Number 3, I would say, to survive ransomware, you want to limit your blast radius.

Okay. Break that down now. Break that down to us.

If you assume something's going to eventually break, okay, you want to limit the permissions of everything. I can't tell you how many times I see, you know, remember the Home Depot hack? You know, the Home Depot hack, they gave away umpteen numbers of users' credit card information. Yeah. And that came from an HVAC, a thermostat.

Wow.

So, they gave permissions to the thermostat to be on the same network as the server that managed credit card data. Not only is that illegal, right? But if you say, oh yeah, the credit card data is safe and you just use the checkbox and you don't check to make sure everybody has the least amount of permissions on the network as they need, the HVAC system did not need access to that server. But it had it. That's not good. Second, you got to practice that recovery. Don't just practice prevention, you know, oh, here's the good habits. You need to practice. I say every year someone has to run a full practice. Pretend you got hit with ransomware.

Okay.

IT guys come in on a Saturday morning, and they take a computer, a system, whatever. And they say, if this system died, Restore the files.

Right.

Turn someone's email back on from nothing. Restore it without having access to Google or Microsoft. Third thing, or the first thing I'd say, training. And I know guys say this all the time and I'm like, don't just use those checkboxes. Put your people through the tests. Run them through anti-phishing training. Pay someone like me. There are so many guys like me that come out and we'll do a workshop. And show your team what not to click on. You know, if you go to my website, there are little cut sheets like this. And there's 9 of them now. There's actually another one coming out.

Passworditis, huh?

People don't know how to set passwords. It's such a basic thing. And right, you know, the federal government in the U.S., their NIST, the organization that's supposed to be Yeah. The gurus, the guys that plan all this stuff.

Yep.

They went so against that second most important thing. They say, complexity doesn't matter. You don't need all 4 character types. And I'm reading this thinking, is someone on crack today? You should not be typing this. This is crazy. Oh, make sure it's long. It should be long, but it should also be complex. And then, as you're reading down, out of the blue, they say, oh, if a third party has access to your system, like Home Depot's HVAC system, they have to have a minimum of 8-character passwords. And I'm like, dude, that hasn't been allowed this whole century. Like, in the 1990s, I'd say 8 characters. I haven't said less than 12 characters since 2000.

Yeah.

And here these guys are saying, Other parties that have access, they only need 8. And I'm like, man, you guys are horrible.

And see, I used to work for the federal government, and I know ours were a minimum 15 characters. But the same thing, in that same breath, you say like NIST would put out their recommendations, right? You're telling us in the government to use 15 minimum, And then you're recommending 8. It's crazy. So how does the— and I'll tell you, I'll mention this and it really gets on my nerve because it's irritating, but I know it's necessary— multifactor authentication. Okay.

Don't let it get on your nerves. In the book, I said using MFA, yes, it'll drive you nuts. You got to jump through all these hoops. But every hoop you have to jump through, so does a hacker. Make them jump through those hoops. Yeah.

And I think about that. I think about that, but I'm like, oh my God, man, I'm trying to log in. I need something real quick. Now I got to go to my cell phone or go pull up an email to get the code off. This is so irritating. But you're right. If it's irritating me, imagine what it would do to a hacker who's trying to do something quick. Ass in a hurry and get out.

Yeah. And one of my big problems now is I push password managers really hard on people. And password managers now, a lot of them have this amazing, cool little feature that allows the password manager to remember your MFA code. So, one click and you're into your email. And I beg people, do not use this. The whole point of MFA is it's multi-factor authentication.

Right.

If you click one button in a password manager, if someone gets a hold of your password manager, MFA is supposed to save the day.

Right.

And it's useless if it's in the password manager.

You're right.

It's the same thing when someone's telling me, yes, I'm using MFA. And yes, I'm using a password manager, but I don't have a password on my laptop. You've exposed the fundamental security level of all the tools you're signing up for. And it just doesn't make sense. People need to build habits.

Yeah.

And with those top 3, the basis of what those do, You know, training people and testing redundancy. This is helping companies survive ransomware because they build habits that expect failure. They reduce panic and they recover fast.

Okay.

That's what your tests should do. They should create the habits so that when something hits the fan, your IT department And it's not just IT. IT has a role. But when ransomware hits, it's all hands on deck. And if you're running your tests just with IT and not bringing in HR, not bringing in the C-suite, not bringing in legal, when this thing happens, if the first time legal's ever been involved in this testing is when it's happening, you're going to have your legal department saying, whoa, we have to stop and slow down. I need to think about the repercussions.

Right.

That's what our testing was for. So don't just do the testing with the IT department. It should be done with everyone. Everyone's a member.

So is one of the common failures that you normally see with ransomware, is it through email?

That's by far the biggest right now. Right now, we're probably looking at 70% to 80% of all breaches come through an email.

Okay, okay, that's still the common system. Now, like, what I do is, because my name and number is out there, right, the business that I'm in, I get a lot of text messages with, with links in them, you know, hey, we'd like to do this. Or, and I look at the number, and when I see a +63, I know that it's not an American number.

Yeah.

But you're telling me that you are Amazon or you are Google and you're sending me with a +63 number, I just totally ignore it because that's a whole nother country. And you, you have me a link, you want me to click on it. So with that, what would you say to a business owner? What should they look for in an email or a link that they receive to make sure that it's either authentic or it just screams scam? What should they look for?

So that's one of the cut sheets. One of those little pages is just— it's, I think it's called red flag something, but it's, you know, and because that's so serious, you know, I had everybody for years. You want to know something about me? You want to book me for a speech or presentation? Go to shanekeulelek.com.

Yeah.

You know how fun my name is. You know, when they get the last name finally right, they skip the Y in Shane and suddenly, they're not on my website. So, I actually— my company name is Red Flag IT. So, you can go to redflagit.com. And everything is there. They can go, they can click links to the book site and everything. They can download those. And so, there's 9 red flags that I have listed in that thing, I think. And the simple ones, think about something that looks different.

Okay.

If it's the timing, If it's timing, timing, I think has 2 things I said. If it's urgent, if you don't get urgent emails every day.

Yeah.

And you're not used to final payments.

Yeah.

Then when you get an email that says, hey, overdue, urgent, all capital letters, you should be like, why would this one have slipped through our payment system?

Right, right.

And if you, if you work with me, you are so used to getting emails at 2 o'clock in the morning. That's just the way I roll. That's my catch-up on all the stuff I missed today. But if your boss, if your accounting department, if they have never sent you an email on the weekend ever in their life, and now you get an email on a Saturday afternoon saying, oh, urgent, we forgot this, that should be a red flag. That's not something standard. And a lot of people look at the red flags and say, oh, well, Well, you know, she's working on the weekend.

Right.

This is— hackers use this social networking where they'll go into your social media accounts. They'll— if they can breach your email, you know, my hometown had someone where they were reading someone's email. They found out a lot about a company. They had a big contractor and a university got an email one day and it said, hey, Or before you pay the last invoice we sent, could you please change our banking information? We forgot to let you. And this girl thought she was saving the day. She changed the banking information. She replied to the email. All good to go. And the university lost. They only ended up losing like $400 grand in cash. It cost another $400 grand in legal fees to get the money back.

Yes.

Because yeah, they stole $12 million and it disappeared to another continent in 5 minutes.

Wow.

That's a big hit for—

That's a big hit.

Yeah. And these guys are living off public money. That's— and I used to tell people, you should all be upset about this. This is your— this is where your taxes went to some other country in another continent. $12 million. And the girl justified it by saying it had to be them because their logo was in their email.

Yeah.

I'm like, what? That's your justification?

Right. But that comes from training. You think the low-level person that's doing accounting and billing, that person might not be an executive, that may just be a staffer, but that person handles the keys to your system and you just gave away money. So, Shane, what in your line of work What are some of the most serious concerns with ransomware attack? Man, that's a because you know we do encryption, those things. But when somebody is is is you know does ransomware, like you said, I pay you want more money. If I don't pay, you shut down the system. And to the ransom, for the person that's committing the ransom, it means nothing to them. If you don't pay, then you don't get your information back.

So different companies are going to have different priorities. And everyone needs to figure out, what are you willing or prepared to lose? I'll tell you from my experience, money is rarely the deciding factor in a company's survival of ransomware. Some companies just— Pay the ransom. They don't care. And ransom payments can all be negotiated. I just saw a guy 3, 4 months ago here, you know, oh, we want $100,000.

Right?

He's like, do you know who you're blackmailing? Like, that's— we don't, we don't have that kind of money. And the guy said, all right, give me $5,000. I'm like, what? Just give me something.

Give me something. I don't care.

And the guy said, he said, for $5,000, is it, you know, it's going to cost us more than $5,000 to restore the backups to all these systems. If these guys could give us the code, that's way worth 5 grand. And I told him, I said, it might be. It might be the only $5,000 you could ask for. You pay it really quick. They might say, well, let's go $10,000.

Yeah.

Now you're in this loop. And 1% of companies will pay the ransom, will pay a second ransom, and still never get their unlocked data back.

Exactly.

You don't want to be that 1%. And my biggest problem with it, I get you as a business decision. This is you.

Right.

But as an IT person, if everybody would stop paying ransoms, they'd stop doing it.

But I agree. I agree. And the problem— so you want the problems that I see? I told you, I've worked with the government and I was with the government when the Office of Personnel Management got hit. 22.1 million records on employees, federal retirees. And, you know, Shane, you and I can talk more about this offline, but I've actually written a white paper. to Congress because I have a law degree in cybersecurity.

Nice.

Master's of Law in cybersecurity. And on the white paper, what I noted was it's about triangulation. If I hit this system here, if I hit this system here, if I hit this system, I'm trying to verify that this information is correct. So I hit you over here on the credit card company, I hit you here in the Office of Personnel Management, And then I hit this medical, let's say Kaiser, a company like that. Now, once I verify this information here that this is truly Shane, now I have this person's address, I have their employment, I have their social, I have everything I need. And because we are so data heavy, um, internet heavy, I can actually change— I can open a company, I can set up a company never having gone to a Secretary of State, start to build out credit for that company. I can actually buy property with that company online, never even seen the person, and then I can turn around and sell this property, right? All of this is false information that I've built up And the problem is it can create an economic shutdown for our economy. Because when you talk about, let's say, you know, we love to throw Russia in there, but let's say some kid over in Russia that's sitting in a room that's done this triangulation, found out what they need to know, build a company using my information, right? And now you start to sell millions of dollars, millions of dollars worth of property and they all default, that could shut down our economy. And it's just like our politicians aren't getting it. They are not.

Yeah.

First of all, they, you know, they need to retire and start all over again. But that's a whole nother story. But they're not getting this concept of why what you're talking about from an IT perspective is so important to our business community and to our everyday users.

Yeah. And it starts at the small stuff. Talk about that poor accountant that changed that bank information.

Yeah.

You don't change anything that affects your finances or your customers' finances without talking to somebody.

Exactly.

What happened to picking up the phone and calling and just saying, hey, I'm just clarifying. You wanted this banking info changed before the— what bank info? For your new account. What new account? You know, just that phone call could have saved so much heartache. You know?

I agree. I agree.

So, and I got one more thing. That last question. So, yes, I begged you not to pay the ransom.

But, right.

But this is a business decision, not an IT decision. And that business, that business has 3 things they have to look at. Number one, data loss. If you don't, if I tell you don't do it, I go to restore the backup and I've never tested them, backups aren't working.

Right.

Well, now the only copy of your data in the world belongs in the hands of some hacker in some other country.

Yeah.

That's not good. And you can say you didn't have backups or stuff didn't work. And, you know, a lot of your audience would understand. The CRA or the IRS, they don't care. You're going to file taxes. Oh, but we don't have any records from last year. Well, you better get it squared away. Pull out the paper. Yep. You need to pay up. On top of losing the data, you have to talk about exposure. And you just said it, health records. You don't want stuff like that going out.

No.

So, you know, I mean, Can your company survive if your customer or your employee or all your client data is exposed on the internet? Maybe you don't care if you have to start from scratch again, but you'll pay a ransom to prevent someone to just posting that stuff on the internet.

Right.

And maybe it's not the data per se. Maybe it's the third problem is reputation. I mean, if you're an IT security company or LastPass, The largest password manager in the world. You could have added up every other password manager in the world. They wouldn't have been the number of users that LastPass had. And LastPass was breached twice in 2 years. And once, nothing happened. Second time, they took the databases.

Wow.

These guys, they're— and I, Now, in the book, I was really nice to them because honestly, they tested something they introduced. They introduced something called zero trust with the password. If you call LastPass and say, hey, I forgot my password. I can't do this. Can you log me in? No, we don't have your password.

Wow!

There's— for a billion dollars, I couldn't give it to you because we don't store it. It's stored in one place on your system. Wow. So, if you forgot what it was, you need to start over. You can't get in.

You're done.

And what better test is there for that than hackers took my database and it's over in Europe being hammered by some university server.

Yeah.

And they're guessing a trillion passwords a second.

Wow.

On my database and they never got in. So, you know, when LastPass says we encrypt it so it's unhackable, we use a password that no one's going to be able to breach because the only place that exists is in your head or your sticky note on your wall. It's foolproof. And then they give away my database. And for what, it's been almost 3 years now. No one's taken any of my passwords. Now, if my password was password123 with an exclamation mark, Yeah. Man, those 1,400 passwords would have been used within a weekend.

They got you. Okay, Shea. So now that we've scared everybody, what are some actions? What are some actions that small businesses can do today? Let's talk about, let's talk about systems and how those small business owners can start to protect themselves.

The first thing I would do, like if I had to pick one immediate step, it wouldn't be buying another security product or buying tools or hiring consultants. I mean, if you want to hire a consultant, here I am.

Right.

But number one, remove false confidence. Prove you can recover. Don't assume anything. Test your systems. If you don't have a system, build it and test it. That's number one. You have to be able to, you know, and it's simple. Just pick one critical system and ask a brutally simple question. If this was encrypted tomorrow, could we restore it over here? And how long will it take? And if you can't answer that question, that's not a checkbox. That's not a report. That's an actual restoration of your data. If you can't do that, Yeah. that's not good. And this is why this matters because ransomware doesn't end a business because files got encrypted.

Right.

It ends a business because leaders discover at the worst possible moment that nobody can test their backups properly, that the recovery plan that they've lived off of forever is in someone's head and no one who's allowed to make decisions should be in a position where they're finding out things aren't going to go well when they really need it.

Like, so that leads into, like, who should have access? When you talk about admin rights, who should have access to your systems?

So, you know, what we typically recommend is the IT department would have access to the systems in stages.

Okay.

So, and there's a lot of good best IT practices that I really like, like using the least amount of permissions to get access to something is where you should be. You should never log into a worker's desktop as a domain administrator if you're not 100% confident that computer hasn't been breached. The last thing you want to do is give that computer access to something it shouldn't access.

So— Got it.

Got it. Yeah, you know, you've got to ask those hard questions before you're under pressure.

Yeah.

You know, what matters most? Who decides? What can wait till later? What absolutely can't? What has to be done today?

Got it.

And like I said, everybody has a role. And it's when I say IT department, you'll hear me talk in my speeches where I'll say the IT team. Everybody is part of the IT team. You might not be part of the IT department, but if you're in accounting, if you're in HR, if you're in legal, if you're the C-suite, you know, I just want a quarterly report from you. That's all. That's my involvement with IT. Right. No. That, that's your involvement until you click that link in an email and bring me to your house on a Sunday afternoon saying we need to have a conversation.

Right. And if you're a small business owner, I mean, you know, where you don't have all of those departments in your company, you may be the one that's doing all of this. And you got to be well-versed and well-rounded when it comes to protecting your systems.

Yeah, yeah. And you know, when you're using the multiple accounts to do multiple things, we had a client that was breached last year and they thought it was the end of the world because the guys destroyed one little piece of the business. And he says, but he's logging in as an administrator. We have to kill all this. And I'm like, well, the guy he logged in and did that with only had access to that, so he can't spread anywhere. Now, we reset all the passwords just to be sure because I didn't know how he got in. But at the end of the day, you know, by, by making those guys jump through hoops all year, you know, oh, I gotta log in as this, then I gotta log in as this, and then I gotta, you know, oh, I have to go to that computer because only that computer can log in as this thing. And I'm like, that's the same thing that the hacker has to go through, right? You want them to have to jump through the hoops, you know?

So let me ask you this before we wrap up. How often should a small business owner or anybody revisit their passwords?

Okay. So, I'm going to say something that I don't have to think about it. I know the answer and it has cost me tens of thousands of dollars in speaking gigs because one of the things I'm going to say, and I just had a client. This was a $30,000 contract to do training and workshops with all their employees. And at the end of the day, I have a couple requirements that I need your IT department to agree with me. If you don't agree with me, that's fine. It's your company. But I can't talk to your people.

Got it.

And the guy's like, oh, but look at all this money. And I'm like, yeah, yeah. But one of the things is You cannot force password changes. I've been saying this for over 20 years. This is the number one, not even close. Number 2 is so far down below. If I had to list the most insecure habits that IT does, it's forcing password resets. And it's—

Wow.

It's not that changing your password every month is a bad thing. I don't care if you do it. If your password's 20 characters long, And I beg people, use password phrases. Read that passworditis thing, okay?

Yeah.

Or there's a whole chapter in this book on how to write a password. Pick a great one. You know, I've got a couple of 2-minute videos on TikTok, YouTube. You know, just watch the video for 2 minutes. Tells you how to set a password, okay?

Got it. Got it.

But if you are forcing someone to reset the password, Yeah. I mean, we both agree 70% to 80% of breaches come from email. My clients have never received an email that says, your password's expired. Click here to reset it. Never. So, when they get that email, red flags, alarms going off everywhere because this is new. And I get emails, hey, you told me I'd never be asked to reset a password. What's this thing? And I'm like, that's a hacker.

Yeah.

And he's like, oh, it's not you. The guy totally believed that I was asking to reset a password. And it bothered him that I promised him he'd never see that email. Now he's seeing it. And I'm like, that's why I tell you to never reset a password. You've got a good— once you've set a great password, leave it. I've had passwords for a decade, you know.

Because you know it's strong enough that it's going to be hard for someone to break into. That's very good. That is very good advice. And people, change your passwords from password123, please.

Never. Yeah, no, use a passphrase. Use something that's 15 characters long. You know, when I do my presentations, I tell people, you know, my, my old password, you know, was something about my kids, you know.

Yeah.

And, you know, I love I love my 7 children.

Yeah.

And I had that password well into my wife's 9th pregnancy.

Wow.

And my kids are like, Dad, you can't have that password anymore. And I'm like, why? Nobody, nobody outside of this room knows that password on this planet.

Exactly.

It's a good password. And they're like, but there's 8 of us. And I'm like, and which one don't you love? And I'm like, You pick, you know. Well, it changes every day.

You're hearing it from an expert. So listen, let's, let's do a nice little recap. So you want to have resilience. You want to have a resilience checklist that you can, you know, act on immediately, right? You want to do some multi-factor authentication on your emails and your admin accounts. Back up your data.

And every login. Every login.

Every login. It may get tedious, it may be annoying, but think about it from a hacker standpoint. Would they want to keep pursuing this? Back up your systems, people, please. Least privileges and remove daily admin rights, right? Weekly patch rhythm. That's something we didn't really get into, Shane. about the patching.

Yep.

But have some basic employee training. I mean, I know it sounds redundant, and I tell you, again, I worked for the federal government, and every year we had to do a certification of training, basic training. Now, it was the same training over and over, but the whole point was to get you in the rhythm Of understanding what ransomware is, how phishing, expedition, how attackers can get into your system, and what you needed to do to protect it and who you needed to call. So, you know, create a simple incident plan, who to call, what to shut down, what to restore first. Shane, you have any closing words for us? And thank you for bringing this clarity on a system and on a topic that we just don't discuss every day.

Yeah, you know what? The one thing I'd like to add just because I harp so bad, never change your password. There are times when it's imperative that you change your password. Your password could be great if it's been stolen, not by you, okay? If it got stolen from Home Depot or LinkedIn or pick a company, I mean, the breaches are— it's insane. You need to go. You need to know if your password, what's been stolen from you, and if they go to the book's website or my website, they can link to the book. But it's just don't be the weakest link dot com or www.dbtwl.com.

Yeah, if you're short lazy like me, then well, I'll have a link in the show notes where people can just click on the link and take you right to it.

And yeah, go there. Go to the tools and there's a little tool to check on what's been stolen.

Yeah.

Click on that, type your email in, and just see. It's not a reflection of you. I've got, I think, 19 things listed on that site now where my email has been breached 19 times but never by me. So, it's not a reflection of me. But if I've got a 28-character password with all 4 character types and it's never been used on another site, it's a great password. But if some company gave it away, it's useless.

It's useless now.

You know, I mean, some guy changed my Netflix password. I'm like, what were you thinking, man? You have free Netflix for life. Why would you change the password? You know?

Same here.

It's a crappy way to find out your Netflix has been hacked when some other idiot changes everything to Italian. And I'm like, why is this in Italian? And the next day, I got no Netflix, you know? There's some stupid hackers out there.

They are, they are. No one said they were smart, okay? They just, they just make you— they know how to irritate the hell out of us, okay?

And, and they also know how to take $100 billion a year from us.

Absolutely, absolutely. Shane, thanks again. I'll make sure your information is in the show notes where everybody can reach out to you. Um, and hey, this is the Small Business Credit Minute. If you want a simple roadmap to start building business credit the right way, Grab my free business credit starter kit also. That'll be listed in the show notes. Pull that up. It'll walk you through the first steps of getting your business lender ready, and you can start doing that today. And remember, your business credit isn't a score. It's your company's future. Always, always qualify first, apply second. And again, thank you for tuning in. If you found enjoyment in today's episode on surviving ransomware, How to Recover Fast Instead of Becoming a Statistic. Download the podcast, share it with fellow business owners, uh, so we can all learn to grow faster and smarter. Until the next episode, your dreams deserve a chance to grow just like your business. Thanks.