Episode #20- Why is Cyber Security so important post-COVID? What must we do!

Computers now have primary control of critical vehicle functions.

Welcome to the IBM Keep It Simple Technology Podcast, where each episode we discuss technology but in a simple way. We keep the explanations simple, but what we spend our time on is emphasizing what this technology means to you and how you can best utilize this technology for you and your business.

Welcome to Welcome to the IBM Keep It Simple Technology Podcast. I'm your host, Thomas Anglero. Another great episode. Another fantastic, phenomenal, amazing, incredible guest. Today's guest is Shasti— oh my God, her last name. I've been practicing this forever. Stathopoulou. Shasti, did I get your last name right?

Okay, it was a nice try, Thomas.

Shasti is the head of cyber. She's a cyber expert at Deloitte. She is number one. She's probably the most wanted person in the Nordic countries when it comes to everything cyber. Shasti, welcome to the show and please pronounce your last name the right way.

Thank you, Thomas. It's Stafthupulo.

Stafthupulo. Okay.

Yes.

Welcome to the show. Every out there, please have a last name like Smith or Bob or something for my sake. Shasti, you know, we've been talking before the show and we're both already fired up. So let's just jump right into this thing. Right. We are living through the time of COVID And I just got to ask you, do you, do you think that we're going to go back to the way the life was before? Or what's, what's going to happen going forward?

For sure, we're never going to go back to what was before. It's a time that's going to be written about in the history books. For sure, there will be before and, and after COVID. There's no going back. Yeah.

And you being the cyber expert, and, and the cyber expert means you have a long history and everything on the internet, cyber, cyber attacks, security, everything like that. And to me, people have to understand you work for Deloitte. You're their experts. I mean, this is coming from somebody who's able to look in the future and say, that's it. This is the way it's going to be. What is it that companies should be thinking about now? And everybody out there, I'm sorry, I'm so emphatic. I got energy, but this is it, right? We're not going back. And we have these few minutes with one of the most intelligent, most knowledgeable people in the cyber world. What is it that companies should be thinking and doing? Should they be nervous? Should their leadership team pulling out their little gray hairs? Give us some advice.

Yeah, so the disruption that we're seeing now with COVID and it's moving so fast, right? We've never seen a change coming in terms of digitalization, You know, we moved workforce. Millions and millions of people are not going into the office anymore. They took their PC, they took it away from your secure network at the office, and they put their PC at their home office with their unsecure network. And you really, really need to start thinking about how do I include people, their home office into my company's security strategy and architecture. You see where I want to start.

But hold on a sec. So I'm gonna be— I'm gonna just keep on pushing my finger into you. So look, I'm a company, and I gave— I got everybody a Zoom account. Isn't that good enough?

Or—

and I also maybe invested in a VPN. I'm a digital business now. Isn't that good enough?

No, definitely not good enough.

That was a pathetic no. Okay.

Yeah, because, you know, if we think about culture, very, very simplified, It's what you know and what you do, right? And then you maybe you have been training these people in one way of behavior. You know, you go into the office, you swipe your card, you don't let anyone coming into the building if they don't have a card, you know, they need to get a guest card, et cetera, et cetera. But these things, you know, you haven't adjusted these processes in your way of working for people to actually sit at their home office or Starbucks. But at the same time, we've been talking about this for 10 years, right? That it doesn't matter anymore where people are working.

Exactly.

But we haven't actually done that change before now, before we were pushed to do it. Because before, it was kind of like if you weren't in the office, you weren't working.

Exactly. Exactly.

But that has changed. So you need to change also your knowledge and the behavior of yourself and of your employees.

What advice do you have for these leaders? I mean, because right now they have to do something now as we're talking about this. They have to do something now, you know, because the cyber threat is on. I was telling— I was speaking on some other show recently and they reminded me when they asked me a question, I went out to start up and I was putting my brand new server that had just been configured. I plugged the Cat5 cable into the port, into the server. I connected to the internet. Within 30 seconds of me turning that thing on and connected to the internet, a hacker was already banging at my server and trying to get in. 30 seconds.

Yeah. Yeah. We've seen it before as well on on laptops, for example, that has malware. We re-tank it, put it back online, takes a minute or two, and they're back. And this is reality. This is fact. It's not, you know, you need to realize that cybersecurity or cyber threats is not science fiction. It's not a unicorn. It exists, happens every day, and their playground just got bigger. Much, much bigger because they don't need to penetrate the office network anymore. They just need to penetrate your home office network.

Exactly.

You have never changed username and password on your home router, right?

You just nailed it, Shasi. So let me break that down and keep it really simple for everybody. Before, what you're saying, before when everybody went to work, we were all protected by the corporate firewall and corporate security. And therefore, the network was safe and all the users on network are safe. Now, everybody's working from home and now everybody's out in the open. People probably have a cheap consumer router, probably with absolutely no security built into that thing or something extremely embarrassing. They haven't updated their firmware probably since the thing was purchased, and they didn't even know they could probably update the firmware of their router, right? So all these hackers have seen I don't know, multitudes of 1,000 more different endpoints. And if they break into one of your employees' laptops, they then could actually access your internal network via that one employee. Did I get that?

Yep. Correct.

That should have everybody listening to this show absolutely shaking in their boots because once you had all your employees in one location at work and now you just had to protect their network, protect them, just keeping up your network secure, Now it's all out there. Holy crap. Keep going, Shasti. That's—

Yeah, and it's not the only point, right? So, you know, what should businesses look at right now? So this isn't just about cyber. It's about your people, your processes, your technology, and of course also regulation, right? Because you have to keep those, if you're under regulation, you're a financial industry, telecom, et cetera, you of course need to look at that as well. How do we comply to that? With our workforce working from home. But if you think about, you know, the cyber— some of the best hackers don't know programming, right? They put you under pressure. They call you up. You know, they stress you. And people— and maybe you feel it yourself. You know, we're starting to get some fatigue. We're getting tiredness. We're getting sloppy. Insider threats, you know, it's not about people wanting to do harmful stuff to your company. They just neglect the policies and the way of working because they're in a new setting. It's like if you're training— sorry for this one, okay, it might sound a little bit bad, but if you're training a dog to sit, you have a puppy, you train it to sit in your house, you have to do the same training when you go out. It needs to learn to sit again, but just in different places. So we need to learn to work again from another place because we're not used to this. So it's changing of behavior. And what is the company's responsibility is to give people that knowledge so that at least know what is going on and how they should behave in order to secure your business, your business data, your revenue, etc.

Okay, so I'm a corporation and I send an email to all my employees, say, follow these steps. And everything will be fine as you work from home. Is that good enough?

No, but it's a good start. It's a very, very good start. You need to start on the knowledge part of it, but of course, you also need to help people, look after your people, make sure that they are having balance in their life, learn how to— maybe you shouldn't do back-to-back meetings all day on on video. Maybe you should start running 45-minute length meetings instead, right? So people can actually grab a coffee and take their eyes off the screen. You know, it's simple things. Care for them, make sure they are okay. You know, keep contact, keep in touch with them because that is probably one of the biggest risks that you have.

You know, as you're talking, it reminds me of these phishing attacks.

Yeah.

And let's break down, what is a phishing attack, Shafiq?

Yeah. So a phishing attack is an email sent to you with some malicious, some code in it, and it can be in a photo, for example. It's not only links we're talking about, you know, clicking the wrong links, but what happens when you click that link is that you can get things downloaded on your PC, or you can be sent to, a fake Netflix site, for example, where you give away your username and password and credit card information, and they use this information to steal money from you, for example. But it's not only about clicking links. Be careful also of downloading pictures.

Yeah. And I'm just thinking now that what triggered my thoughts about phishing is that people or dogs, I love that story.

Sorry.

But what cute little French poodles. Okay, let's leave it there. I was going to say Chihuahua.

I don't see people as puppies, just to say that. Definitely not. More people I need to train.

Yeah. What I'm thinking is we're all at home, right? And like you said, we have back-to-back Zoom meetings. And after, well, we've all been doing this now a couple of months. You are tired at the end of the day. And maybe you do have a real puppy that's hungry now, or it peed on the carpet or something. The kids, the husband, the wife, all these things are going on. And you get an email, and the email looks 100% legitimate, right? Um, the pictures, the graphics, everything looks great. And you click on it. You're done. And your corporate network is done. But you're fatigued. You're fatigued from COVID you're fatigued from all the Zoom meetings. This is— what is the likelihood of this probably happening to companies all over the world?

Yeah, it's 100%.

There it is.

So, you know, and you're stressed and the phone is ringing and the emails keep coming in. You know, even us, the best of us, clicks on things that we probably shouldn't have clicked because you are in the, in a moment. And then, you know, it's back to this you know, stop, think, act. But there's not, you know, when you're under so much pressure and fatigue, that stop, think is a bit harder to recall. And you also have, you know, we're isolated, you're sitting alone, and you might also have lost some contact with your colleagues and your company as well. And there's a lot more into this story. It's also about, you know, your HR processes. How do you let people go now? How are they going to return their PC?

Interesting.

You know, because they're sitting there with the PC with all your information on it and you just let them go. And maybe they're not so happy about that. And a competitor calls up because they know that your company is, you know, in this process and they ask for information. So even though maybe you cut their accesses, they still have the PC with the, with everybody has stuff stored on their, yeah, locally. Everybody has that, you know? So the step for giving out information is also much, you know, how would I say it's easier to do that today also because you have lost the same loyalty and feelings for where you work. It's a paycheck for more and more people. So it's new. It's, it's not, um, and this is going to stay there. So you need to also look at your HR processes, especially when you think about insider threats, which is on the rise, not because, nor not because they're not, most of the times they're not spies, you know, getting paid from another state or nation, but they're giving out information easily.

I'm even more impressed with you now, Sassy, because you're actually challenging everybody. And the question you're saying is, how many of the people out there listening, do your HR department and your cyber and your IT group are working together to handle this? That is a— I don't— that number's got to be low.

Cyber is not an IT issue. Cyber is a business issue, and it goes into all your processes and all your technology, but technology is just part of it.

So, so now, as you said, is a business issue.

Yeah.

What is business now and where are we at? We're in the end of September 2020. And we're here in Norway, and last night the government announced that in Oslo, as of 12 o'clock today, which has already passed, so this, as of this very moment, there is no— at your private home, you're not allowed to have any more than 10 people. What is the effect this is going to do on businesses? I mean, everything. What did you just tell us? I mean, because like you said, cyber is business. Businesses being restricted. From your experience and everything you see in the world, what trend do you see that's coming that people should be aware of?

Yeah, business is— so it's time of disruption, like we started out, and nothing is going back to what it was. But actually, this, if you look at the Industrial Revolution, We've been talking about it for years, for years and years and years. And we've seen, you know, consumers changing their behavior. Now you might be buying some groceries online. We've been ordering stuff from, from out of Norway. And we knew that they were going to come, you know, American corporations into the Nordics and sell, you know, with a completely different business model. And we've seen that. And if you look to the largest companies today, they weren't even there 10, 15 years ago. So we knew this all the time. So there shouldn't be any shocking moment for us to see that now is, you know, these large corporations with other business models are successful. And we had the chance a long time way back to take that position ourselves. But we chose to not do it. So if you want to be in the game and you want to survive for the next years, we don't maybe necessarily agree on how many years that is, Thomas, you have to change and you need to look at your business model and how are you going to make an income in this new, I don't like this way, new normal kind of, you know, it's in the new world, in the digital digitalized world, you know, where your consumers or your buyers have changed their behavior. How are you going to change your business model to fit with your customers and of course also your employees and how you're going to deliver whatever you are delivering?

So what you're saying is, I mean, just the absolute foundation of almost every company, every corporation, all their business models, everything has to be redone.

Yeah. And then you can look at cybercriminality as a business competitor.

Elaborate on that. That's powerful. What do we— like, tell me more, please. What do you mean by that?

Yeah, because they are, most of them, if you look at it, it's organized crime, right? But they have the same business models that we have. And in some cases, they're better than us. As well, and they have had a good income coming in from ransomware, for example, because there are still a lot of companies and organizations out there paying ransom. So they're getting income, and they have, you know, they have innovation, they have a global workforce, they're 24/7, they have a very good business case, they have a lot of opportunities to penetrate the market, and they can bring your company down. Just as other— so you're not only fighting your business competitors, you know, in terms of getting a position in the market and getting the revenue, you're also fighting people who wants to shut you down from, um, criminality or, or takeout. Yeah.

As you were talking a moment ago, I actually got confused because you started describing a corporation where they have a business plan, they have strategy people, they, they probably got an HR department.

Yeah. They do, because, you know, cyber criminals are people. They wake up in the morning, they drink coffee, they deliver their children to the school. Forget this 17-year-old sitting in the basement with a hoodie. That's not who we are fighting. We're not fighting them. We're fighting organized criminality. The mafia has become digital and they're really, really good. Good at it. This is—

I apologize, my jaw is on the ground. You can't see it because the picture I just got was that companies today are letting go of a lot of people because of what's going on, right? So you let go of some really good IT people because you have to make that budget cut. Because as you were sharing with me when we were offline, you know, there are companies who make a— put in a CFO that's from the banking industry, you were saying, and that person only knows about Cut budget, cut the budget. And, um, what were you saying? Only share— increase shareholder value, right? Okay. And that probably goes out there for a lot of companies. So that means to cut the budget, IT department's got too many people, cut them off. Those guys and girls who are experts at IT, and like you said, they have a mortgage, they have kids they got to drop off at the kindergarten or school, they'll go back home and take their new job with this other corporation which is actually owned or backed by the mafia.

Yeah, that can happen. And they are recruiting. It doesn't take you— and you know, it's an internet as we know it, normal people, what we see when we, you know, Google or read news and visit web shops, etc., is maybe 10% of internet. The web or the web. The rest is office network. And then there's a huge amount called dark web and deep web. And they do exactly the same thing as we do on the good side, you know, buying stuff and selling stuff and communicating. They do that too, but with other intentions. And it's very, very easy. You know, you can order a DDoS attack, which means that you are You know, you can call it ping to death. You know, I want to shut down your website. So I just send, you know, a lot of requests or push data through to close down your website, for example. That costs about $5 on the dark web.

It costs $5 if I wanted to attack a specific website, a specific company, and shut down that company's website. It just cost me $5?

Yeah, it starts from $5, and then depending on how much power, the prices goes a little bit up. And you can see it on, for example, tests. You can see also, so you can get a test try. So then you can see that the attacks last for 5 minutes, for example. So you can even test drive it before you buy, you know. We're laughing.

This is, a moment ago you said, "Depends on the power." What do you mean by the power? Power?

How strong is the attack? You know, you can put, yeah. So how much, how much power do I need to take your website down? So I can increase with gigabytes, for example, just like what you have, like buying a PC, you know, how much power you need in your PC to run your applications. So it doesn't work the first time I can do. So, you know, we have kids at school, they do this all the time. Because they are, you know, playing these online games. So they order attacks against each other. What? Throw you out of the game. Yeah. Yeah.

What?

Yes.

They order a DDoS attack against— are you— they go— wait a minute.

Your kids are doing this, you know.

Okay. Wait a minute. My little brain just got blew up. You're saying some little kid is playing against somebody else on some game, some gaming.

Yeah.

That one kid is getting really upset.

Yeah.

So he goes on the dark web while playing simultaneously.

Yeah.

Spends $5 to launch a DDoS attack against the other kid to take him out.

Yeah.

Okay, so there's a lot of things behind that. Yeah. What that means is that I'm not laughing because You're saying that it's so simple a child can do it.

Yeah, exactly.

A child could take down a major corporation.

Yeah. And they have done. And if we talk about these 17-year-olds who are sitting in the basement, they will attack you not to earn money from it, some of them, but they will do it to get fame. So for example, a company who was taken down by, or it was a 17-year-old who found, this is a real story, found a vulnerability at an ISP's vendor's website or application. He put it on a forum on the dark web to get fame, to get known. And in the next 2 hours, that company had, was it 15,000 attacks? And was ultimately taken down. And they thought that it was, and they didn't deal with this incident well. So they didn't have their communication in place. So they were changing their story, you know, so they lost all their trust from there because, you know, everybody's gonna go through a cyber attack at some point. Most companies is gonna, this is gonna happen to them. It's not about getting the attack. It's about how you deal with it.

How you respond. Exactly.

Yeah. So if I were to give an advice, in this new, you know, digital world, minimum, minimum, minimum, know how to deal with an attack and get your communication plan in order. And of course, you need some capabilities in terms to, you know, you need to very quickly find out what is going on. It's really important that you get your facts in order because people will, you know, they're not gonna hang you up on a wall for getting, for being, you know, the victim of a cyberattack, because that happens all the time now. But what they will not forgive you for is if you don't deal with it in a good way. And the communication here is key to keep that trust from your customers.

And as we wrap up this podcast, and I want to go more because my voice is changing because you got me, Shasti. You got me. To reiterate, what is the chance that everyone listening out there, their company will be attacked by a hacker? What's the chance?

Well, probably they are already. They have been attacked already. Either they know it or they don't know it. But, you know, we deal with this every day. But probably your firewalls or, you know, your email filter, etc., have stopped to this or you have, you know, employees who understand what this is and haven't clicked those links. But what we see is that, you know, all businesses, small or big, have this. But then, of course, it's if you are a company under a targeted attack, that's not for everybody. So we need to differentiate on the level of security depending on the business, you know, who you are. And what you do. So a cyber risk depends on, you know, what, what threats, uh, do you have and what vulnerabilities do you have. And that together is a cyber risk. And then it comes down to what have you done with that risk. You can choose to do nothing.

A targeted attack is when somebody wants to harm you. So that back to the scenario of somebody goes on the dark web and paid some money. I mean, if I want to take down a corporation and I won't— and it only is going to cost me a couple hundred dollars, say $1,000.

Yeah.

And but I— but I want to make sure that corporation— let's do a scenario to make this clear.

Yeah.

A corporation is about to, um, make a huge announcement.

Yep.

At 12 o'clock in the afternoon. Yeah. And at 11:55, I want them to go crashing down. Yeah. Because I'm a competitor. You can order that for a couple of hundred dollars or maybe $15, $20.

Yeah.

Jesus Christ.

So, but if we talk about, you know, real, you know, organized crime in that sense, so that could be, for example, maybe it's a hacktivist or, you know, somebody who has a political reason also to take you down, doesn't need to be about money. But what we see is that they would probably they would like to get a, send you some phishing emails or, you know, inject some email conversation somewhere, get to your Active Directory, make some accounts there, you know, to get access to other systems and then to launch, for example, a ransomware attack from inside, which will spread with your network. Very, very simplified, of course. That is a targeted attack because they're going directly after you. But we have a lot of cases where you've just been, you know, taken on the road. Like, for example, I can say this because it's been all over the news, but for example, Maersk, that wasn't a targeted attack. Most likely they were just taken down on the road because they had vulnerabilities that they hadn't done anything with. So it wasn't targeted, but the consequences for them were huge, right?

Yeah. Yeah.

So it's not necessary, but it's about, you know, The threat is about your vulnerability. So you need to know where you're at, what you have. That's a risk. Now it's up to you to decide what do I want to do with this risk? Do I want to live with it? It's perfectly fine. You know, it's your decision, but to know at least that this risk is here, that my company might go down, and what do I then do?

Shasti, I think that was Perfectly well said and perfect place to end this episode because I think we can go for another 30 hours. And the thing is though, I think we should in many ways because this conversation is for every corporation, period. Whether you're, you're in the world, I don't care. Everyone's affected by this because of COVID Everybody's been pulled into a digital business. And as you said, well said, the hackers have— the number of targets they've had has quadrupled, logarithmically grown, right? And this is now business, this whole discussion. And people like you, uh, are needed. It's fantastic, Shasti. I am, I'm trying to summarize my mind being blown and try to piece it together. With the last few seconds, do you have any last advice or thoughts for everyone out there who you may be the first digital cyber expert that they've heard? What advice do you have for them going forward today?

You know, sit down and, uh, and reflect a little bit. Uh, should I sleep well at night or should I get my facts in order?

What a way to end it.

Yeah, because we have facts, right? You shouldn't feel in this sense, you should know. So, you know, know your risks. I don't say you have to do anything about it. I just say you need to know your risk, get your facts in order.

Thank you. Wow. And my little mind's blown again. Shasti, oh, your last name is going to kill me.

Yeah. Here we go.

Here, I'm gonna be professional. Shasti Stathopoulou. There we go.

Yes. Good. Practice makes perfect, Thomas.

I'm gonna ask your husband how he does with the last name. Listen, Shasti, you are amazing. And to everybody out there, Shasti is the cyber expert, as I said many times in this show, with Deloitte here in the Nordic countries. She's based in Oslo, Norway. Um, Shasti, it's been an absolute blessing having you on the show, and I think I'll welcome you back again in the future. Um, and to everybody out there, please, and I mean this from the bottom of my heart, please listen to what Shasti said. If you haven't yet taken an assessment of your company and its security risk, do it now. As a matter of fact, re-listen to this episode of the podcast and share it with the people in your IT department. And as Shasi said, share it most importantly with the people in the HR department. This is a business issue. I am Thomas Anglero. This is the IBM Keep It Simple podcast, and I thank you all for listening. Subscribe to the podcast on Spotify, iTunes, Google Play, and we're on Amazon Music now. Isn't that amazing? So to all you, thank you so much. Shasti, huge hug. Thank you so much, Shasti. You're amazing. Everybody have a great time. Take care. Until next episode, bye-bye everybody.