Phishing Training for Small Business Teams with Craig Taylor

**[00:00:00]** Hello everyone. My name is Armando Perez-Carreno and welcome to the Web Talk Show. Today with us is Craig Taylor from CyberHoot. How are you Craig? I'm good Armando. Great to be here. Thanks for having me. It's a pleasure. I This topic that we're going to talk about is super important and I'm very excited that we're going to get into it. But before we do, can you give our audience a little bit of a background of where you came from and how you got to build um CyberHoot? Sure. Sure, Armando. So I guess to understand the background and the genesis of what we built at CyberHoot, you have to go back about 35 years to my education. I have a degree in psychology, not computer science, not cyber security. Um, you might question, well, how does he do 30 years in cyber security without those degrees? There wasn't a degree program before the internet as we all know it today existed. I started in cyber security before there was a worldwide web. How how about that? There was no Google search. There was email with textbased email where you hit R to reply and F to forward. So I've been around a long long time but I've seen a lot of things and you know if you were to put a big shiny spotlight on all the experiences everything that happened all along the way has been cyclical. Uh we have found ourselves in the same cycles over and over and over again. uh not just from a cyber security but from a business development perspective from so many different aspects of life um things repeat themselves over and over again uh so if you fast forward to 12 years ago I founded CyberHoot because like the company CyberHoot it's a learning management system we teach people cyber literacy skills on how to avoid being breached both as a company or as an individual all of the skills we teach translate personally and professionally into knowledge And what's good about cyber security is it's not rocket science. It's a little bit of common sense and knowledge combined **[00:02:00]** and anyone can learn it. Um just about. So 12 years ago we founded Cyber Hoop because the industry itself was a little bit misdirected. I like to think of it as a ship that was sailing in the wrong direction off by not just a few degrees but pretty much almost going in the wrong direction entirely. And we founded Cyberhoot to follow a multi-disciplinary approach Armando to teaching people in ways that they actually learn from. They and they change their behaviors because at the end of the day outcomes is what matters and the outcome of not breaching your company because you understand how fishing works. P H Ish or you understand why password hygiene is so important these days. That's what dictates your internal behaviors. If you internalize it and think it through and discover how I need to behave or how I need to act in these certain situations and you've internalized it, you've learned it. You've come to understand the underlying reasons for it. you're much much more likely to be better protected both for yourself personally and professionally your business. So that's really what we did as a um as a company 14 years ago. We took a psychology and an education and a cyber security best practice approach. Those three circles think of a ven diagram. In the middle is what we've been trying to produce and build. And there's a lot of reasons behind that. But the fi primary difference between say our company CyberHoot and how we teach cyber literacy and the rest of the industry in most cases not always it's starting to change is this difference between shame fear punishment which is what the industry was misfocused on. How can we stop people from clicking? We **[00:04:00]** need bigger sticks to punish the clicks with our employees. And so the punishment approach really does not change behaviors. For about 75 years, Armando psychologists have said no punish behavior has ever been Doesn't stop the behaviors. It just tamps them down briefly and people don't internalize it. They put it as like, hey, if I speed when there's a cop, I'll get caught. But if there's no cops, I can speed. The behavior doesn't change. It's an external focus, right? Um, however, when you use positive reinforcement and rewards for doing the correct behaviors, then people internalize it as a behavior that makes sense to them and they repeat those behaviors. So, rewarded behaviors are repeated. And this is where psych cyber security has gone in one direction. Psychology and educators have said, "No, this is what a classroom should be like. You take your students, you reward them for little bits of engagement to then steamroll and snowball that engagement to even greater engagement, greater learning, greater outcomes, better changes, you know, uh, learning the materials. And that's really been the change in my life's work has been for the last 12 years to and and my company, our company, we have four founders. It's not just me. There's four three other great people behind us. uh is to reorient the cyber security industry away from punishment and shame towards positive reinforcement of good behaviors. And we're seeing great results. We really I I believe you, Craig, because there's the certifications. I went on the website and for for anyone who's listening if you go to their website uh which if I look cyberhoot.com cyberhoot.com they you have a bunch of very interesting um awards right **[00:06:00]** and it's not the typical like industry specific award which is why I want to mention it. You've got all these like G2, easiest to do business with, easiest setup, high performer, um, users love us kind of things, which not every company gets. So, how what do you think gives you the edge to be able to have these badges? Is it related to everything you're talking about and the adoption of people actually saying, "I'm I'm now really understanding this stuff and being able to put it in practice versus they just came and gave me a sermon on on something that's Uh, great question. Um, I would love to just plug one more statistic from G2. We have 4.9 out of five overall for all of the reviews we've ever had. Um, and I think the answer to that is that we try to lift people up and we try to reward and recognize our best performing clients, their employees. We gamify things. That's a whole another area of psychology around engage engagement and play versus work. I I like to tell people I hate working out, but I love playing and I play golf and hockey and and and mountain biking. The effects the same, but I just don't feel like I want to go work out at the gym because it's work. There's a reason they call it working out. It's painful. It's slow. It's boring. But playing is fun and the physical exercise is better. So, we've gified all the training and learning that we do. No different than video games and those sorts of things. So you level up and you do all the other things. But to answer your question in a very concrete way, imagine the best classroom environment, your favorite teacher of all time, if you're listening to this, did they become that person because **[00:08:00]** they punished the bad performers in your classroom. They were critical and and trying to figure out bigger punishments and sticks for the mistakes students made. or did they lift people up by their best qualities and did they encourage those qualities in the students and did they create lifelong learners of you and the people in the classroom? I would promise you it's the latter, not the former. And so in an industry that is much more like, you know, military boot camp for employees, they're yelling at you, screaming at you, make don't make mistakes and get up and give me 50 and whatever it else they do. the sticks for clicks approach. Absolutely no one likes that. And maybe if you're defending your country that's appropriate and you're hardening these people to do, you know, war activities, maybe that's the necessary evil in that scenario. But for the average everyday company and person, they much prefer that uplifting teach me what I need to know, explain why I need to know it, and I will probably do it approach. And that's probably why we have so many accolades on G2. That's amazing. It makes perfect sense. Every course that I've taken or workshop anything for that matter that you get not only the value, but maybe you get graded on or or you you grow on or you have milestones. When you have that positive reinforcement, you just enjoy it. It's just it's a good time. You're doing good. you're making progress. Whereas if it's the other way, like you're saying, you feel like it's a it's not a nice experience and also can even create some antagonism and and rebellion against the the actual person or institution that's giving you the training. That's exactly right. If you call it training, right? Um **[00:10:00]** you're absolutely right, Armando. And just to put a finer point on it, we see that in the industry and there's studies that have shown there becomes an adversarial relationship between your IT department or your managed service provider who are sending these um what's typically we call attack fish which are emails to your inbox to see if you click and make a mistake and then if you fail you get called out for it. You have a meeting with your boss and then if you fail twice you have a meeting with HR and if you fail three times in some companies you're fired. Right? This is an incredibly escalating negative consequence of making mistakes. And the reality is is many people at that point after their first mistake, they stop participating. I had a PhD person tell me one time, I failed two of these things, fake email fishing test, the attack fish, and honestly, no one's ever taught me what I needed to know. So now I abdicate all responsibility for these things. I forward everything and anything that I don't think I understand well enough to it. Not going to make any more mistakes, but I'm missing out on a number of emails I should do things with until I get that response back because I've given up trying to figure it out. And this is a PhD person. This is not rocket science. As I said, it's very simple common sense, you know, decision trees, uh, a rubric that we teach in what we have patented. We have a patented hootfish is what we call our fishing exercise and it walks you through an email as though it's an email and it prompts you with questions and answers. Do you is this a safe sender or is it typos squatted meaning a onelet change or twoletter changes? Is this uh language um urgent, emotional, authoritative or secrecy baked? Meaning those are four symptoms of a fishing email that you that hackers use to get you to do something without **[00:12:00]** reporting it, without questioning it, with uh quickly before you've had a chance to think about it. You know, I've done dozens of forensic investigations, Armando, and when it's tied back to an individual who made a mistake, I can't think of one person who said, you know, in retrospect, if I just stopped for a few minutes and thought about it some more instead of reacting to that, I wouldn't have clicked that link or I wouldn't have entered my credentials in that fake website. So that urgency, that emotionality, authority, secrecy, we teach you to look for those things in our emails, in your emails as subtleties around, you know, you hear about the CIA, the FBI, they have these little tells when they interview people to figure out if they're lying or if they're telling the truth or these sorts. That's what hackers have figured out and perfected. They've been able to create these emails now powered by AI, so there's no spelling mistakes, no grammar giveaways. uh the greetings are personalized, all that sort of thing. And they tell you, you need to act on this, but don't tell anyone because we don't want to delay getting this work done, right? And it's the CEO of your company saying, just do it. I'll take the consequences. Don't follow process. And new employees who are like scared to put their hand up and say, I have to follow process, you know, they do it and then they then the consequences are are crazy bad. Yeah, you you know you're you touched on a very good point just then about the whole negative feedback loop because there's so many times for people where they want to follow process and they get this flashback when it's a real thing like just in general like let's say someone says no I have to follow this process but the other person on the on the other line so they're they're like I don't care about your process just do this thing or whatever and they're like No, I want to find. So, they get enough of those, then it's it's more likely that eventually they might just skip **[00:14:00]** the process to to avoid that uncomfortable Mhm. Yeah. I I don't think most people realize the danger of a fishing email. It for some, this is one of the answers that I've heard when you talk about this and passwords. We'll talk about passwords later, but they say, "Well, it's just my email. I don't have anything important in it." Right. Um and and so they're not as concerned. So why should people be concerned really with with a fishing email and perhaps clicking on the wrong Well, the the simple truth of the matter is you as an individual at a company are sitting in a privileged position. Your computer is living on a network. It might not be directly in the company's headquarters, but it's connected to those headquarters. Maybe it's a VPN or maybe you are in a company headquarters and it's hackers are sending something directly into the bank vault where you might be operating your computer and when you click on it it's inviting the hacker into the bank vault and saying is my security good enough so that when I click you're not going to get in the answer is probably not right especially today with AI based uh delivery mechanis mechisms and attack methodologies. That's the difference. It's not that you have nothing of value in your email. It's the location of your computer. It's the access to which your computer has. It's the accounts and the data on the shared drive that you have access to which can be exfiltrated. What that means is stolen by the hackers and removed from or copied off that server. **[00:16:00]** uh encrypted by the hackers and then it's not accessible to you and you know hackers have many many methods of of extorting your company for those ransom attacks. Now you know 10 years ago Armando for your listeners many of you might already know this but 10 years ago most ransomware just encrypted your files and if you had good backups you could restore and say I'm not paying this ransom go away. Then they discovered how to delete those backups so that you couldn't get your files back and more people paid the ransom. Then they determined that, hey, maybe we can't delete all the backups. We can delete some of them, but they're going to have some offline backups to restore, which I don't we don't have access to. So, let's exfiltrate the data and embarrass the company by releasing some of the information to the public on these websites that have no other purpose than to share uh information that's been stolen to the public. And that was called double extortion. You have the encryption event, then you have the disclosure event. Uh nowadays, if you're in a regulated industry, they'll report you to the authorities. If you haven't reported that you've been breached and you've had potentially data exfiltrated by hackers, they'll report you to Home and Health and Human Services or the HIPPA, you know, HIPPO wall of shame compartment of health and human services. um or to the FTC for financial reporting. All of these have legislative controls that say you have to report these within certain time frame or you face regulatory fines. So, you're in this ransomware event and now you have a regulatory authority bear, you know, breathing down your neck over what happened, right? Uh and still there are other ways that they're extorting people. I don't like to share because I don't want to give bad guys more information, more ideas, but they have multiple methods. So, it is very very dangerous. Um, but the solution **[00:18:00]** is surprisingly simple, which is teaching people the rubrics around which these emails arrive in your inbox and what steps you can take to confidently identify this is a fishing email, right? Most of them are weeded out. It's only the really good ones that get through these days. Um, but those really good ones can be thought of. We had a term five or six years ago called spear fishing where a hacker would target one person, Armando, and they would social media you identify your profile, your likes, your dislikes, and your public persona uh listen to your podcasts. And then they would target you with very specific emails that only you would react to, that only you would find appealing. And now with AI, that's become the norm. That's what what what I was describing 5 years ago took hours and hours and hours to do one or two emails. Now they can do it on scale, on mass to everyone in their target, to everyone at a particular company. just give the domain away, identify all the email addresses, identify the people working under those email addresses, identify their socials, and then send spear fishing attack after one after another after another until they're successful. So, the odds are stacked against us in terms of the number of sophisticated spear fishing attacks, which I would just call them fishing attacks today with AI powered, you know, backends. And we have to be more cognizant of what we're doing and understand fishing. Uh there's an old saying, I'm not sure you probably have heard this, but if you feed a person a fish, f i sh you feed them for today. But if you teach them how to fish, f you feed them for a lifetime. That's what our company is so focused on is teaching you how to fish. P **[00:20:00]** H ISH. So you never click on a fishing email. You always know instantly or very quickly that it is a fishing email. And when you in those very strange edge cases where you cannot tell if it's a fish or not because some are business email compromised, some don't have the hallmarks, you know that the first instinct is pick up the phone and call the person to verify what they're asking for. Those things are what we're designed to teach at at Cyber Hoop. And we do it in a way that is fun. You know, if I had my full logo up, not just my our mascot, it would say laugh. Period. Learn period. Hoot up, right? We want you to have fun doing these things and educating That's amazing. I I have to say it's a feeling to have when you've being able to spot these things. So much so that because we can all fall prey to it depending on what's happening during your day. I don't know. There's many things that could trigger you having your defenses down and if you're not well prepared, something comes along that looks okay, but you have everything else going on that you fall for it. Even the most advanced professional and that's why there's other tools and things, right? But I recently had the situation many many people had the same exact situation at the same same moment which was very scary which is we all got not everyone but people who use Amazon AWS services um they they provide servers infrastructure all that stuff and um they had an issue where they accidentally pushed an update to their code where the sense the decimal got moved and So, nobody would notice unless you go to the billing portal. But everyone who had cost alerts **[00:22:00]** enabled like I did got an automatic email saying we owed an exorbitant amount of money. Oh man. And I was about to go on a 10-hour flight that we were barely going to make. And we're going into the airport. I get this email and it's from Amazon and it says you have a threshold of X dollars but we've ow your actual spend is 108 million or something like that and I'm there this must be a joke. So I start checking everything, the sender, the headers, all the possible things. I'm thinking this is a fishing attack, And and the problem was I couldn't log in because the 2FA, the two-factor authentication for our listeners, when you have, you know, a code in your phone and you have to verify it didn't work. I know the offset of the time, I don't know, it wasn't working. So I couldn't log in. I couldn't validate my account. And they, like you were saying, they hadn't disclosed yet that the issue had happened. And so thousands of people around the world are freaking out. Because of this error, which seemed like a fishing attack. In this case, it wasn't, but but it was it could very well have been. And at that state of mind, it would have been very easy for people to click on the link and try to log in and enter their credentials and then actually give the attacker access to the account. For those listening, that's because when you click the link in such an email, if it's a fishing email, it goes to a web page that mirrors identically the login to your AWS account or your Microsoft account or your Google account. It looks indistinguishable with the exception of the URL up in the address bar. And so, you know, if I'm being totally truthful and honest, Armando, I clicked on a fishing link once maybe about seven or eight years ago. Even me who has been doing this for 30 years. It it the short version of the **[00:24:00]** story was I was on vacation for 2 weeks, came back and I saw in my inbox a recommendation on LinkedIn from a friend of mine I hadn't spoken to in years. Somehow someone had identified a very distant connection on my LinkedIn account and they wrote this pretend recommendation and so without thinking I clicked on that link to say oh what did this John do write about me that was very kind of them I haven't thought about that person in so many years and as you said hundreds of emails waiting to go so I was rushing and my password manager because I've used a password manager for 20 years we'll get into password hygiene but a password manager is the single best thing you can do as an individual to protect your online identities today. Learn and adopt one. We'll talk about why later. It was sitting there dumb in the LinkedIn login page. I had the username, password, and I don't know my username. I don't know my password anymore. I don't remember all the usernames I have set up because that's the that's the job of a password manager. And it was refusing to log me in. And I wanted to see this recommendation and it took me about 2 or 3 seconds to look at the URL where I saw I was on LinkedIn da da da.it the ending domain was.it which for those of you that may or may not know you know Canada is.ca the US is us and it Italy I was on a server in Italy. Why? I could not say because I'm on linkedin.com and I finally realized, oh my gosh, I clicked on something. How stupid. Made a mistake. But it can happen, right? Fortunately, because of my other best practices of the password manager, it tried to see what website are you trying to log into. Oh, I have no knowledge of this. Server. What do you want me to do? I don't have a username and password to put on this page. So, I didn't give my credentials to LinkedIn away. And I was protected by my technology, thank goodness, **[00:26:00]** but I missed the hallmarks because I was rushing. And it can happen to anyone. Wow. additional issue that I think we sometimes don't realize is let's say you don't have anything of value in your email or you click a link and you log into your account. You're like, "This isn't I'm not important. I'm this low-level access person or whatever or it's just your personal like personal email still very valuable. but what we don't realize many times is how they escalate and how like you were talking about the spear fishing. They can get access to John in accounting which then gives them access to Sarah in HR which then gives them access to Bob in IT. Right? and they start they can do if they're clever they can go in and and escalate get different levels of access so that they have enough data to fool someone higher up in the chain much more easily because they have so much more information and and that that became very clear to me a long time ago I read this book by Kevin Mitnik the oh yes ex-hacker um turned cyber security person uh he had this book what was the art of deception I think it was called and it's all about how even before the ent before computers were it was bulletin boards and and I think they even started with with phone networks and things they would do this where they would hack By social engineering. And if if they could do it back then now with all these it's it's much more dangerous. Yep. Yep. Absolutely true. And they have they have other ways too as you said. Uh might be an email address. Uh if they hack into your personal email address that might **[00:28:00]** be relatively benign, but I would wager in the first 10 to 30 seconds of getting access to your email account. They're running a search routine that looks for your social security number, your driver's license, your identity credentials, your credit card information, your passwords that might have been reset and what they are set to now and they exfiltrate that back to the hacker immediately. So that if you've and and if they can't, but they know you have an account at Wells Fargo or Bank of America, you know, they can also issue password resets for different accounts. And where do those resets go? To your email. So then they can jump into other accounts and yes it's a snowball effect. It can be very dangerous and devastating. Can we talk a little bit about passwords managers and passwords in general? I I think many people who are listening don't have a password manager and they might think well I can't remember all these passwords so they end up using the same password for many things. So what are the dangers of people using the same password? Well, there are many, many dangers. And I'll start by just giving you a blanket statement. I've looked at every password management scheme that people are using, whether it's writing them down in a book or having a rotation that makes sense only to the person or a password manager. And other security researchers have looked at other routines. And to a person, the people that I know and trust from a cyber security perspective have said a password manager is the lesser of all evils. There are no other methods of managing passwords today that equate from a cyber security perspective to using a password manager. Now that said, putting all your eggs in one basket, what if the password manager has a risk? What if you know you're not wrong that is a risk? It's a real **[00:30:00]** one. Uh you need to set up strong authentication into your password manager. You shouldn't have a 10-digit password that you've reused elsewhere on a password manager. You need something unique and 15 to 20 characters long tied to MFA, multiffactor authentication. Um we say MFA is something you are, something you know, something you have. Uh, and those three things can be very helpful. When you log into your iPhone, you're probably using MFA, even if you don't know it. You might have a password that you enter when you reboot the phone. Most of the time, you look at the phone and it's got your fa visual to to log you in. Those combined are two factors, right? Something you are, your face, and something you know, your password. Passwords are really, really important. when a website is breached at some point and I have 5 6 700 accounts now probably across that many websites and different technologies online. Inevitably probably 50 of those have been breached over the last 10 years and inevitably 10 of those had unencrypted passwords or unhashed passwords. What does hashing mean? Hashing takes your password, turns it into a string of 50 to 100 characters, and says, "This is what we're going to authenticate Craig from." When he logs in, we when he puts his username and then his password into the login field, it uses the same hash that it used to encrypt my password in their database on the login password. And then it compares the hash to the hash and if they match, I get logged in. But if someone breaches that website, they steal a hash that cannot be reversed to a password. It's an it's a one-way hash. It only goes that direction from the web login to the hash. And then you can compare. Most websites 10 years ago didn't do that. 5 years ago, most did, but many still do not. So when a hacker gets your actual password **[00:32:00]** and they see that your favorite word and the month and year that you you created it on is combined into a password, they can predict what you're using elsewhere and they can find that one and they can find 10 others on different websites online. You can go to have I been pawned and put your email in to see all your data. You can put it in. We have a we at Cyber Hoot have two different data bases that we query and provide our users with their exposed accounts. Um dehashed which gives you the redacted password. So it can actually show you some of the password um that you used the last four or five characters. Uh and then have I been pawned gives us a combined total of I think 20 to 25 billion different accounts that have been exposed online. So there's a lot out there. Mhm. And hackers will then try those on all your accounts. They know where to try them and they know how to iterate on the hashed password with AI and other tools. They get in very very quickly. So if you're not using MFA on all your critical accounts, that multifactor having the phone, having the authenticator app or better in all worlds, the best today is pass keys. You should always always adopt pass keys because it is the best of all worlds. It's a username, password, and hack uh uh um multifactor in a single step. But better than all of that is it cannot be stolen by hackers when they break into your website and use it elsewhere. It only works from this computer to this website. These two places when they talk does the pass key work. if it's stolen and they go else over here, it's like, I don't know what that is. Doesn't work for me. It's not a password. It's not a username. It's not an MFA token. It doesn't work. So, password hygiene is one of the easiest problems to solve through a password manager. Um, and there's some **[00:34:00]** really interesting things. I I had the unfortunate experience of a dear friend passing away um about a month ago and his wife was very distraught and she was like, "How on earth am I going to deal with the finances and the billings and everything that he took care of?" And I asked a few questions and he was in the same industry as me, cyber security. I said, "Well, he probably set up a password manager, right?" And she goes, "Yeah, but I never learned how to use it. I don't know what it is. Have you looked in your email for the next ofkin notification? Because if you don't log into certain password managers for a period of say 2 to 3 weeks and the person has set up next ofkin that password manager will send an email to the person that's next of kin to say, I haven't seen John for 3 weeks. Did something tragic happen? You answer yes. It brings you to create your own access to all of those financial accounts. And you can lock in like this to your bank, to your investment account, your retirement account, your everything, credit union, savings account, everything everywhere. Even this MFAs are there. Even sometimes you can load that into the password manager. So, it's not a phone MFA. It's actually in the password manager. And so, fast forward a few days later, she calls me back. He says, "I've got access to everything. He had set me up." and an email was waiting for me. Thank you, Craig. So, these things solve so many problems and some we didn't even anticipate and some we don't want to think about. But most importantly is it allows you to operate your online identity with a unique long 15 20 character password that you don't even know what it is. So, when you go to that LinkedIn page, you can't even be tempted to go stupid password manager broken. Let me type it in manually. because you don't know it anymore and you're being protected in many many ways. And and this **[00:36:00]** is also because the password manager can sometimes fill in the password for you and it it just won't even suggest it if if the URL doesn't match. Exactly right. Its job is to live in the browser and when you visit whatever website you're going to if the website has been properly designed to label username, password, login, it will put those characters fields in. It simplifies your life. So I haven't talked about the efficiency savings, the time savings, the stress savings. You know, I remember I only booked travel like once every 3 months to go somewhere. And if I had to reset my password every time I wanted to go to the travel website because I didn't remember what password I used and I didn't have it, it just knows, hey, you were here. Here's the Travel Velocity. Here's the Expedia website. Here's the JetBlue website. Boom. You're logged in. And you know, I can even get my, you know, user account, whatever those frequent flyer, they're all in the password managers. You don't have to remember those either. And you put them in, you got your hotel thing, you got your flight thing. It's just a godsend to be able to do these things efficiently, confidently, securely, and not worry about it. And and this has been around for a while. I used a password manager since the Blackberry days. Oh, no. Since the Palm days. During the Blackberry days, my dad used to have the Palm and and I got one when I was a kid. Uh just because, you know, handoff devices, right? And and I used it since then. It's the same one. It's still going. I've got like 1,600 passwords or something, right? But it is it is super super helpful and and I keep telling people but I'm glad you're you're talking about from your industry expertise so that people listen and like oh maybe I should use a password manager and um and protect myself which is it's really really helpful for an individual. But if you're **[00:38:00]** a business owner out there and you haven't funded a password manager for your company employees, I highly, highly recommend you consider doing that because you're multiplying the potential for breach exponentially when you have 50 employees, 100 employees, and they're not all using password managers because you have a VPN and you have a cloud-based email system and you have a bank system and if any one of your employees is reusing accounts and they all will be if they aren't on a password manager then you're sitting a ticking time bomb to the breach happening from poor password hygiene. So that is one of the first things we look at when we do a risk assessment of a company. CyberHoot has a professional services arm too Armando where we do virtual or fractional CISO work for companies. So if you can't hire a full-time, you can hire us for a part-time to do a risk assessment and identify the administrative technical physical risks you face to your data and your business operations. And password manager is number one in the list many times because it's one of the simple easy things you can do and get real benefit in immediately alongside enrolling in cyber roots platform for training awareness fishing simulations all of those things. Hardening the human is our primary goal. I like that. No. Yeah. And and it's it's people don't realize that until they need it, unfortunately, like an event, but then also you might need it sooner than you think if you plan on getting any sort of compliance if you're trying to do a SOCK 2 or a HIPPA or a GDPR or something, right? you are going to be asked about your proper standards and uh security and if you're doing none of this then you're going to take a long time to get everyone **[00:40:00]** on board. So it's good to prepare with these sorts of things beforehand. 100% agree 100%. And we could probably talk about the benefits all day long but here's another one. Let's say John and accounting leaves your organization uh at the end of September and it's now or the end of August and it's September 1st. You have Fred or Susan who replaced John. They walk in the door and they're like, "How do I get access to all of our bank accounts?" Oh, John had him, but he's gone. Ah, what do we do? We have to reset every single account. Well, which what all banks did we use? What all investments? What all the websites did John use? Nobody knows. Where's his computer so we can go look at his history and his and his links and all that? Oh, it was wiped and it was refreshed. Oh my god. How are we gonna do this? Ah, guess what? We had a password manager and we transferred all of John's accounts to Susan's accounts. Now Susan has access to everything John had because it was tied to his email. We didn't shut that down and we can reset his account. Now Susan can look up everything John ever did. uh you know for transitioning responsibilities from person A to person B, right? And by the way, John used it personally. So all of his Gmail accounts, they can be pushed out with John. They can bifurcate that and say, "Okay, here's his work email and here's his personal email. Anything he used personally, push out to John personally and remove from the account. Anything Susan needs is in the work account. Good. Good to go." So you're not even losing your personal information by using it personally and professionally. There's that personal work email. Well, that's good. I you've mentioned a few things that I didn't know about these like at enterprise level organization level password managers which is which is great um and and I might ask you offline for some recommendations of some so we can put them on the links um **[00:42:00]** without necessarily plugging anyone but just just so people know h how to look for these because they're so good and and of course there's some good ones and some not so good ones. Yes, I would agree. You can go to my blog if you want and I did a whole research paper on this uh probably six or seven years ago. If you go to and you search for the oneword um last straw, those two words, last straw, you'll find my password manager research and recommendations for three different um password managers who went above and beyond to do third-party risk assessments of their architecture, to do code analysis by thirdparty security pen testers, to get multiple viewpoints on how secure their software was so that it wasn't just the engineers saying, "Yeah, we're pretty secure. We develop secure code." It was multiple companies giving their best effort to breach the software of the password manager and giving them either a clean bill of health eventually or initially, hey, you got to fix this, you got to fix that. Okay, let's go fix it now. Test again. Okay, now you have a clean bill of health to the best of our There are companies that have done that and done it well. They're in that blog article. There are others that have not and I won't say any names just to uh say protect the guilty and the and the well well uh prepared. That's great. I'll put the link to that blog article in the show notes so people can find some recommendations there. And speaking of recommendations, Craig, what would you recommend to people, anyone, either a business owner, a regular person to do next? It's like what's the thing that they must do today to protect themselves against fishing or or if it's posture related. What's the most important thing that someone can do that is simple? They don't have to necessarily pay for anything but just just get more protected now. Yeah. Well, I would sign up individually if you want to just evaluate **[00:44:00]** our platform. The gamification, the positive reinforcement that we talked about, it really changes behaviors. that if you want, you can sign up for free for life as an individual. cyberhoot.com/individuals with an s on the end of that. Register, we'll send you training. We'll send you the hootfish. We'll get you trained up. If you're a business owner, you might even jump and take a leap and say, "Sign up my company for that." And here's why. Cyber security is filled with things we didn't know we didn't know. You are clearly a cyber security professional, Armando, for many, many years now. uh from what the questions you're asking are but even I shared some things that you didn't know about next of kin and so on the knowledge that we share helps you justify spending money on things like we have to adopt a password manager cuz now I understand the risk if you don't understand the risk it's kind of like you're an ostrich with your head in the sand not that I'm saying that's a bad I'm not saying people are intentionally ignoring this it's just that cyber security is filled with things you don't know you don't know Mhm. And so educating yourself through the cyber literacy skills that we teach at Cyber Hoot helps you open your mind to the risk that you face, then you're like, "Oh my gosh, just like maybe we don't have life insurance or car insurance, but now we know the risk of having an accident and what it would cost us." Well, let's get some insurance on that. Well, cyber literacy skills is insurance on running a business, on life, on avoiding the biggest expenses and most costly mistakes that can happen, you know? So educating yourself is probably the first thing I would do. Then I guess you know as you learn these things a password manager would be really good. But more importantly I would think would be turning on multiffactor authentication on all critical accounts that you run your life with or you run your business with. So all financials those are pretty much guaranteed to be turned on already. The banks have said can't even log in anymore without it. But your email where it might be optional, turn that on on anything that is of **[00:46:00]** value to you. Turn on MFA or better yet, adopt those past keys. And my blog is filled with articles for the last 5 years on the future of passwords is past keys. Here's where it's heading. We're not there yet. We're not there. Oh my god, we're there. People are starting to use it. Adopt it. Those are really good Those are all excellent suggestions. Thank you so much, Craig. This has been enlightening. So much knowledge. I know we could talk for hours about each of these little things, but uh we got to wrap it up. I know you have another item to get to. Thank you so much for joining us. And for anyone who's listening, if you haven't liked and subscribe, please do so so that you can learn whenever we have new episodes like this amazing one with Craig Taylor from Cyber Hoot. Craig, it's been a true pleasure. If people want to try the platform out, where should they go and what should they know about before getting set up? So, you can sign up for a free 30-day trial uh which is no cost, no obligation at cyberhoot.com. Just click try me for three 30 days. Uh you can email uh and we'll have a meeting just to give you a demo of things to explain how it works, what those awards that you mentioned earlier are all about from a ease of use, supportability, um cost of implementation because of we're using a positive reward system instead of deceptionbased attack emails. Everything we do in Cyber Hoot is 100% automated. So you have almost nothing to do except enroll through synchronization of users out of Google or enter ID and it runs itself. You get the reports, you get the compliance. We reward people for doing well. We have high engagement. Your job is only to recognize the people that are doing the assignments well because that starts to drag the people who don't do their assignments along saying, "Oh my gosh, everybody's looking at this and they're doing well." So yes, **[00:48:00]** that's how you can reach us and why it would be a great idea to start here. That education is the first step. That's so great. Thanks a lot, Craig, and we'll see you in the next one. Thanks, Armando. Bye now.