Cybersecurity with Craig Taylor: Building Safer Habits Through Positive Reinforcement

SPEAKER_01 0:00

Welcome to the Living the Dream Podcast with Curveball. If you believe, you can achieve. Welcome to the Living the Dream with Curveball Podcast, a show where I interview guests that teach, motivate, and inspire. Today, we're going to be talking about cybersecurity, as I am joined by Cybersecurity professional Craig Taylor. Craig is the co-founder of Cyberhoop, where they teach cybersecurity in a positive and educational manner and a hundred percent automated way. He has been a V CISO for 35 companies in his career. And he has founded a V CISO peer group that has grown to 20 members where they share ideas and best practices. He is a leader that wants to see the field grow and mature. And Craig is also a golfer, a hockey, a rotarian, and he is a avid mountain biker, and him and his son have raised $100,000 for cancer research. So we're going to be talking to Craig about Cyberhoop and his company and cybersecurity and his cancer research and what a Rotarian is. So Craig, welcome to the show.

SPEAKER_00 1:38

So good to be here, Curtis. Thank you for having me.

SPEAKER_01 1:41

Why don't you start off by telling everybody a little bit about yourself?

SPEAKER_00 1:45

So I'll talk about my personal life and then we'll get into my public professional perspective. Um, yeah, my son and I have ridden in the Panmass Challenge uh for the last 12 years. We took this year off, my father passed away uh this spring, and my fundraising uh was a little bit uh the the my fundraiser was canceled because of repairs to the hockey rink where I hosted it. But for the previous 12 years, we've ridden 192 miles on a road bike on the first weekend in August uh to raise funds for cancer research at the Dana Farber Cancer Institute. It's a world-renowned cancer research facility. These are unrestricted funds. And uh since 1980, the Pamass Challenge has raised over a billion dollars. Uh, it's one of the largest sports-related um fundraising activities or platforms in the world. So really proud to be a part of that over the last 12 years and uh contribute what I can to something that touches so many people. Uh, I'm sure people listening to this know a family member who's been touched by cancer and maybe beat it, um, maybe is fighting it right now. So that's why we do that because we're healthy and we can. The other things that I like to do is community focus through Rotary. Um, I'm about to receive a Paul Harris Fellow, which is one of the recognition awards at Rotary for continuing service above self. I am a Toastmaster. I've done public speaking on cybersecurity topics before, and that's about it. I do like my sports, and uh I use a lot of analogies when I talk about cybersecurity, I talk about sports as well. Um, professionally, I have a degree probably 35 years ago in psychology, uh, where I studied what motivates people to change behaviors, positive reinforcement, operant conditioning, internal locus of control on your behaviors versus external locus of control. Um, and so that's played heavily into my company, Cyberhoot, that's above my head here. And Cyberhoot is a learning management system that is designed to bring positive reinforcement and rewards to the cybersecurity journey we're all on. We all use a computer for work and home, home life to run our lives. But unfortunately, most of us have never been taught how to do it safely and securely and confidently from a cybersecurity perspective or cyber literacy, cyber smarts, whatever you want to call it. And so my company gives our product away free for individuals listening to this. You can go to cyberhoot.com forward slash individuals and sign up there for a free uh training service that teaches you all the same things we teach our corporate clients who pay a paid subscription. Our hope is if you like it, you'll bring it to your IT team or your managed service provider and suggest they use it for your company. Does that enough of an introduction there, Curtis?

SPEAKER_01 4:56

Yeah, that's that's uh perfect. Uh tell us what a Rotary game is.

SPEAKER_00 5:02

Well, Rotary is a hundred-plus-year-old service organization, uh, one of my favorites. They really are all over the world in every country of the world. They have some major uh there's an uh an arm of rotary called Rotary International, and it has set some objectives for things like eliminating polio in the world by vaccinating all the children of the world in the most remote areas of the world where it might still flare up once in a blue moon. You know, we've had a vaccine for 75 years, but it's still out there and it could it could be eliminated so that it it never impacts someone in the future. Uh that's one of their global objectives. Uh, but rotary is also very focused on the neighborhood you live in, your community. Uh, there's a I'm a member of the Portsmouth Rotary Club here in New Hampshire, and I have been a Rotarian since 1997, off and on. It's a service organization that tries to bring uh support, financial, and other community action-oriented tasks and activities to support the local community in different ways. It could be supporting the soup kitchen where my children and I have volunteered in the past. It could be bringing Thanksgiving dinners to people who couldn't afford it or maybe can't get out to uh enjoy a Thanksgiving meal uh that's coming up in November. So lots of different opportunities to support the community, but that's what Rotary's primarily focused on.

SPEAKER_01 6:47

Absolutely. Well, we definitely appreciate your community involvement. So let's uh jump in and talk about cybersecurity. If I could do one, two, three, or five things to protect myself, what would that be?

SPEAKER_00 7:04

Great question, Curtis. And I get asked this question a lot, and probably the simple answer if you could only do one thing today, it would be to turn on something called multi-factor authentication on all of your critical accounts, your email account, your banking accounts, your investment accounts, anything that matters to you if they have support for multi-factor authentication, or even better than that is pass keys, P-A-S-S-K-E-Y-S, pass keys, they're even better than MFA because they do it in one step and they can't be stolen and reused anywhere else. So if I had one thing for you to do today, it would be to examine your critical accounts and turn on this extra step of multi-factor authentication. That's where you have to have a code put in after you've provided your username and password and successfully authenticated. It adds a second step that says provide a multi-factor authentication code. It could be from your phone, an authenticator app, a hardware token, uh, a text message, that sort of thing. Now, that's usually not enough. If you had one more thing, this is where it starts to cost a little bit. Although there are free tools on the market. The second most important and probably more impactful thing you could do is adopt and learn how to use a password manager. This is a utility software package that you can buy. I like one password, Bitwarden, Keeper. Those are three excellent tools, but there are many others out there: Dashlane and RoboForm and Passkeep, and you can name, there's just so many. But a password manager helps you identify where you're reusing passwords and set them to long and strong and unique passwords. There's two things you have to remember about password hygiene. One is length is so much more important than complexity. You could have a nine character uppercase, lowercase special character password, and that can still be cracked by a computer, a powerful computer, fairly quickly. But if you double that to 18 characters, it's nearly impossible to crack that or guess what those 18 characters are with a computer through a brute force attack. So length is strength, is a mantra I like to repeat to people. But in addition to that, you have to have them be unique everywhere you go. And the human brain was never designed for password management. So you might have five of your favorite passwords that you cycle through on all the different accounts that you have online today. And if you're not using a password manager, I guarantee you're reusing passwords and you're trying to be smart about it, but any other system other than a password manager is full of flaws, is less secure, more time consuming, more difficult, more stress and anxiety provoking with password resets. And what password did I use? And it's breached over here, so now I have to change it where I don't even remember all the places I used it. So the second thing I suggest that all your listeners do is learn and adopt a password manager this week. It's going to take you two to three weeks. Give it a good college try for two to three weeks. Watch the YouTube videos that explain how to install it, how to operate it, how to update it, how to create passwords, how to change passwords, how to check for reused or exposed passwords, all of that stuff comes with it. You will probably swear about that my name in vain for the first week. The second week you'll begrudge me. You'll be complaining to yourself, that Craig, why did I ever listen to him? And the third week, you'll say, I can't believe I lived my adult life without a password manager. Thank the Lord for Craig for telling me and teaching me to do this. Because to a person that's been an that's been the experience, it is a little difficult at first, but it gets easier over time. And as you become more proficient, you become much more confident, much more efficient, and absolutely much more secure. So that's the second thing. Third thing would be to sign your company up for Cyberhoot to do awareness training. Uh, that makes all of these other things like turning on MFA everywhere you go and adopting a password manager even easier for your staff because they now know why, by virtue of the videos and the training we deliver, we explain just how companies are breached and why all these different measures are so important. And what we find is when people understand the why, they're much more likely to do the work and to adopt these practices. Because let's face it, cybersecurity is not taught in any school, it's not taught to any person. And if you don't know what you don't know, it's hard to fix it, isn't it? So with our Cyberhoot training platform, we deliver one video a month, a Hoot Fish, which is a non-deception-based fishing simulation that teaches you how to fish. And I don't mean F-I-S-H, I mean P-H-I-S-H. And that might confuse some of your listeners. So let me explain. If you've ever gotten an email in your inbox and you scratch your head about it, like this doesn't make any sense. I don't know why someone would send me an invoice. I never deal with these people. And you look at the sender, maybe it's someone you know, maybe it's not. Uh, but it it just gives you a bad feeling. That's probably a phishing email. It might have links to malicious software, or if you click a link in it, it takes you to a login page that is impersonating a vendor you use, like Microsoft or Google, and it's going to steal your credentials if you type them into that field, which by the way is another reason for the password manager because it won't fill in your credentials on a fake phishing website you land on if you make a if you make that mistake. But teaching you how to fish is so important in today's world because it's one of the number one ways companies and individuals are breached for the past 25 years. So there's three things for your listeners, Curtis. The first is turn on MFA or adopt pass keys, which often requires item two, a password manager. That passkey gets managed inside the password manager, and then train and teach yourself by signing up for the free platform at Cyberhoot or paying your company to register with Cyberhoot and train all your staff on all the emerging threats we face.

SPEAKER_01 15:22

Well, let's talk about the uh in your 25-year career. What what um is one of the biggest cybersecurity incidents that you've had to handle?

SPEAKER_00 15:34

Oh my goodness. So in my 25 years, one of the biggest remorse, one of the ones that you can learn from the most is one that happened this summer. Uh, we had a uh we consult at Cyberhoot with our virtual CISOs for many companies, and one of them that happens to be a client of ours brought us in for a forensic investigation on an emergency basis. They said, We've had a breach of a computer at our at our computer at our at our workplace. Can you come and make sure that everything is safe and recovered properly? Our managed service provider, we think has contained it, but you're the incident command that we always call in for anything that goes awry. So here's the backstory. It was a CPA firm right after tax season, right around the 1st of May, they got an email from their website from a potential client saying, I missed filing my taxes. I was sick, I couldn't get to them. I need your help. Can we meet for you to help me figure out what I need to do to file my US taxes? So, of course, the CPA firm says, sure, that's our expertise. We'd be happy to do that. Let's jump on a Zoom meeting, like we are now, um, on Friday at one o'clock. And so everybody's in the boardroom, a conference room, they've got Zoom up on the computer for everybody in the room to hear out this person's uh trials and tribulations about filing taxes late. And she doesn't or he doesn't show. Five minutes goes by. Uh, about 10 minutes goes by, they're about to get up when an email comes in and says, I'm so sorry, but my computer seems to be trying to update Zoom or something's wrong. I can't join your meeting. I am a Teams uh holder, I an account holder, and uh here's a link to my Teams account, which is working. If you don't mind, would you join my Teams meeting so we can sort through my taxes? So the people in the room, what do you think they do? They clicked the link. It said http teams.microsoft, and then it scrolled off the screen. They had a relationship with this person, they've been talking to him or her for a few weeks. But nothing happened at first. No Teams popped up. Now it's a Microsoft Windows workstation, Teams is installed, it should jump right up and they should connect. But nothing happened, and they're like scratching their head, they click it again, and now suddenly the mouse starts moving without the mouse moving on the computer, and they're like, Oh my goodness, I remember this. Craig and Cyberhoot told me not to click without verifying things. So they look at it, and there's a whole bunch of other commands after the Microsoft.teams, and it didn't go to Microsoft.com, it went somewhere else. And so what did they do? Well, this was a positive reinforcement account using Cyberhoot where we don't punish mistakes, we reward good behaviors. And one of the good behaviors we like to reward is if you see something, say something quickly. If you make a mistake, don't hide it, report it. And so they called their MSP, their managed service provider, a local New Hampshire businesses business, and they immediately logged into the machine remotely, and all the red lights were going off. Oh my goodness, there's a remote access piece of software that's been installed. Uh, Python scripts are being installed. We see an active remote attacker on this conference room computer. We're going to shut it off the network, we're going to contain it, eradicate it, and then help you recover from this breach of this one machine. And we got called right around that time to see if we could follow up to make sure no bad things had happened, no forensics were needed, that no data was stolen in this short period of time. So, fast forward a couple of weeks, and here's the summary of what happened. They were socially engineered through their website to join a malicious link meeting under the wrong pretext. It was a phishing email. It led to the installation of a bunch of software on this one machine, but because they were aware of their mistake and they saw the mouse move, they reported it within 30 minutes of clicking. They averted a disaster, there was no data exfiltration, no ransomware installed, and they were able to go back to business the same day without any harm. That's because they had a culture of positive reinforcement of cyber literacy skills. In many companies, for too long, cybersecurity has been focused on bigger sticks for clicks. When you click on something, we're going to punish you for doing that because you're not supposed to click on those things. You made a mistake, and that's gall darn it, that's the worst thing you could do. Three clicks, three failures, you're fired, kind of thing. What that does in other companies is it prevents reporting and it prevents a response, a rapid response to a security incident. And we've seen it in other cases where that ransomware attack actually transpired, where data was stolen from the company and brought out of their servers to the hacker's own website, and it was used to threaten them, to pay a ransom. And the key message here is that you want to train your employees to spot these things and avoid clicking at all costs, but you don't want to do it with fear and threats and uh shaming them. You want to have a positive reinforcement of good behaviors, of hovering over the sender to see that URL that you might be clicking on or who sent you the message and expanding it so that you know exactly what you're about to do. And when in doubt, you pick up the phone and call the person to verify they wanted you to do what's being asked in that email. Um, how does that sound to you, Curtis? Does that sound like a lesson well learned for your for your listeners?

SPEAKER_01 22:14

Absolutely, and I like the way that your company goes about teaching that.

SPEAKER_00 22:19

Thank you. Thank you.

SPEAKER_01 22:21

So you know cybersecurity has a whole lot of avenues that a person can go down. So for someone getting started off in cybersecurity, what where do they start?

SPEAKER_00 22:33

That's a great question. Well, when I started 30 years ago, there was no cybersecurity programs in college. Uh, today there are many, many great programs there that teach you uh cybersecurity from one of the subdisciplines, right? You can go into dozens of degree programs today to become forensic investigator, uh cyber program developer, a cybersecurity coding expert, uh, lots of different educational paths into cybersecurity. Uh, if you are already out in the workforce and you want to pivot to cybersecurity, well, I would say there's a few entry level jobs around monitoring roles uh in What's called a SOC or a NOC, a security operations center or a network operations center. I would get some books from O'Reilly. They still make these books on learning the internet protocols of the of the world. So TCPIP, that's transmission control protocol. It's really how the internet works underneath in the wires and from computer to computer communication, how the three-way handshake of two computers talking to one another actually happens, those kinds of things. I would learn that stuff. I would go to YouTube and watch some videos on uh what you need to learn. I would ask an AI bot, hey, this is my, you know me, you've been chatting with me a lot, you know my proclivities and my interests and all those sorts of things. How would create a plan for me to segue into cybersecurity as a field of study or a career? Give me some, you know, easy first steps to get familiar with things, and AI will generate a beautiful plan for you on the first five things you ought to do. You can try those and see if you like them. If you do like them and it fits your personality, then keep going and learn more. I I think we're really running short of competent, really experienced cybersecurity professionals. They're in high, high demand. So it's a lot of job security and cybersecurity today. Does that answer your point?

SPEAKER_01 24:50

Absolutely. They can also take the network and the security plus, and Professor Messer has free courses on YouTube that they could take, and then they could go get some practice tests maybe from CompTIA and take the uh exams as well.

SPEAKER_00 25:05

Right. That's excellent resources, Comptia. Um, absolutely.

SPEAKER_01 25:11

So what are the pros and cons of having a cybersecurity career?

SPEAKER_00 25:17

Uh pros and cons. Well, I'll say this. I'm happy that I'm nearing the end of my career at 55 years of age uh because there's so much change today with AI and the different threats and vulnerabilities that we face there. It's um so it can be a little overwhelming for professionals in the field. So I guess, you know, for me, I think uh cybersecurity's pros are that it's in high demand, it's hard to outsource, it's going to be around, you'll have some job security. Um, the the cons are almost no one has great cyber literacy skills. So when you're telling people and trying to explain to people why they have to behave in certain ways, a psychology degree can be very helpful to meet the person where they're at. You can't sort of be Moses on high coming down with the cybersecurity 10 commandments. You shall do this and you shall do that, uh, because people don't care and aren't paying attention and won't listen and won't follow you. You have to find them on common ground. You have to say, what's in it for you is you're going to be able to be more efficient, like the password manager. I focused on you're going to have less frustration, you're going to have less inefficiency in the work that you want to do online, going into your accounts, and you're going to be more confident that you know how to stay safe online just by adopting a password manager. So it's all the you things that I said. I stayed away from because it's what cybersecurity professionals say you have to do, because we told you to, because it's our requirement or it's our policy. Nothing about that matters to another person. What matters is what's in it for them. So there's a good life lesson for your listeners that no matter what the topic is, it doesn't have to be cybersecurity, it could be anything. Try to meet the people where they're at and find some common ground so that you can bring something of value to that relationship, to that person in ways that they understand the benefits. That's probably one of the biggest things I've learned in cybersecurity in my career, Curtis, is um that provides the best uh opportunity for successful outcomes.

SPEAKER_01 27:36

We'll talk to the listeners about deep fakes. Uh, explain what a deep fake is and how it's impacting our lives.

SPEAKER_00 27:43

Okay. Yep. Um, well, if you're asking me, I first saw my first deep fake on American Idol about three or four years ago. Uh, we had Elvis Presley singing on screen, and it sounded like Elvis Presley, but it was a voice actor who was in the back on a green screen, and everything was computer generated off of his facial expressions and his voice from a recording they had from Elvis Presley. So you could hear Elvis singing, but it wasn't Elvis. It sounded and looked like him. Um, that was my first experience. And and it was a little bit crude. It was wasn't it was pretty good at the time, but a lot has happened since then. And what deep fakes are is they take a little recording like me today on this Zoom meeting, the my voice and my facial expressions, and a computer can then generate my image and my voice on a phone call or even a Zoom or video conference meeting and pretend to be me. And the person behind the screen is saying, Hey, I want to go have Chinese food for dinner, and my voice will say those words and my face will say those words, uh, but it's the person totally different uh speaking into the phone or into the video conference. So it's called deep fakes, and um, it's only becoming a bigger and bigger problem. There's simple ways to fix or to avoid uh making financial mistakes when someone calls you up if you're a financial person and you have to wire money in your job at your business. You know, the CEO calls you up and it might be a deep fake. It's simple. You just hang up the phone and call them back on their number. Or if there's no opportunity to do that, you just say, What's the what's the safe word or the financial um password that we use to authenticate each other uh before any of these financial transactions are done? And you'll see the line will go dead, the zoom call will end because they don't know the passcode from Adam. Uh, and it's a very effective way to safeguard your financial transactions. But I'll tell you the reason I bring up the financial is because almost all deepfakes today are after your money. They're trying to extort money out of you or your company. Uh, and in family situations, you know, elderly, elder financial fraud is rampant. We see time and again, a hacker will convince some grandma or grandpa that their grandson has been injured. And please don't tell my mom, but could you wire me $5,000 from your bank today so I can get out of jail, so I can uh have this operation at the hospital or whatever. And it's a deep fake. And grandparents aren't really used to that kind of thing, so they often fall for it. Um, but a family safe word can help in those situations, like, hey little Johnny, thank you for asking. I'm so sorry that you're in the hospital or you've had this been arrested, but what's our family safe word? Click, off they go. They know they've gotten a cyber literate person on the call, and they're gonna go and spend their time trying to social engineer someone else.

SPEAKER_01 30:54

So I know earlier you spoke about fishing. So talk about the most dangerous fishing attack you're seeing today, and what can businesses do to try to combat it?

SPEAKER_00 31:04

Well, one of the more growing threats that we face is something that has a very uh strange name called Click Fix. If you haven't heard about it, it's where you visit a website and you think you're on some vendor's website, it's probably a spoofed version of it, and it says, Oh, before you can log in, we need to prove you're human. And it asks you to click the button that says, I am human. That copies some malicious commands into your computer's memory. It's called your clipboard. But the moment you click that button, it says, Ah, just almost good enough. But we really need to prove you're human. So we want you to press Windows R and then Control V. What that does is it opens uh a special terminal on your computer. The Windows R is a run function, and then the control V is a paste function. What you don't know is that when you click the button to prove you're human at the very first screen, it copied the malicious software into memory. And when you open Windows R and control V, you're pasting their hacking command to download a remote access tool, to download encryption software, to encrypt your hard drive, to ransom you for money. It's a it's called clickfix C L-I-C-K hyphen F I X. And all I will say to your listeners out there, this is the most common social engineering attack on websites we're seeing today. It's rampant, it's grown thousands of percent this year. No website will ever ask you to press Windows R and Ctrl V and run commands on your computer to prove you're human. In the Mac world, it's Command L, I think. I could be wrong about that, but there's an equivalent Mac where you hit the command button and something to open up a run dialogue and then command V to paste the information that was copied in the first step. So don't fall victim. Don't fall victim to this click fix attack. It's a social engineering attack. No website will ever ask you to run commands on your computer to prove you're human. So just shut the browser down, walk away, come back, and do do it from the real website by typing the vendor into your browser window by hand.

SPEAKER_01 33:38

Absolutely. Well, let's talk about the Hippocratic oath of cybersecurity. Does cybersecurity have one? And if so, what what is it?

SPEAKER_00 33:48

Right. When I in 2001, I applied and took the exam for my CISSP, Certified Information Systems Security Professional. It's the de facto standard. It's about a four and a half hour exam back then it was. And one of the things you had to sign off on or attest to, uh, well, two things to get it. You had to find someone who would vouch for you who said, who said, I know this person to be a fine, upstanding, community-oriented individual. I will vouch for them to take the CISSP exam. And then as you sign your paperwork to get your certificate, it says you must put the benefit of the people you support ahead of any financial gain, any nefariousness in your business transactions. As a CISSP, this is our Hippocratic oath. And it defined a bunch of other things. I could look it up for you. Um, but that's part of being a CISSP is doing what's best in the best interest of your client, your employees, the people you're there to protect. And it's really designed to uh keep it front and center that all we are out there to do is to enable others to get their jobs done, to do it safely, securely, and to uh be devoid of these breaches that you hear about in the news every day and how to protect people from making those critical mistakes. Uh, but that's part of that Hippocratic uh or or oath for the CISSP. I could I should probably have it memorized, but I don't.

SPEAKER_01 35:32

Well, let's talk about your V CISO peer group that you founded, you know, kind of tell us about that group.

SPEAKER_00 35:40

Sure. So a lot of virtual CISOs, a lot of CISOs, in fact, are N of one. There's only one on staff at a company. You don't ever have like five CISOs working at a company unless you're an enterprise-sized company, and then they're very specific to their jobs. Oh, I do have the oath uh for uh for the CISSP. It says protect society, the common good, necessary public trust and confidence, and the infrastructure. Act honorably, honestly, justly, responsibly, and legally. Provide diligent and competent service to principals, advance and protect the profession. So there you have it. That's that one. Um, the v SISO Peer Group was my attempt to get help. I didn't have all the questions, answers to all the questions that were facing me. And I needed to ask other smart people, what do they do in this situation, in that situation? And so we got a couple of people together once a month, and we said, okay, what's working for you? What vendors do you like? What problems are you solving? How can I help you and how can you help me? And through word of mouth and over time, through my company, Cyberhoop, where we meet with tons and tons of people, I would pay attention to those that were cybersecurity focused and then invite them to this peer group, or they would invite their friends. And we grew the peer group to 25, 30 people now, where we get together and we talk. These days, it's all about AI that we're talking about, artificial intelligence, but it's just designed to provide, you know, a sounding board, best practices, get help, give help, and support each other in this challenging world we live in where the breaches are happening so fast and the AI developments are even faster. Um, that's what what I founded. And we we meet once a month, and it's uh just a great experience for everybody, I think.

SPEAKER_01 37:36

Well, we're almost out of time here, but uh I kind of want you to give the listeners a brief history of ransomware um from your perspective.

SPEAKER_00 37:46

Well, ransomware has evolved multiple times over the last 10 years. In the 10 years ago, in the beginning of time, 20 years ago, maybe, uh, you would click on a link or download a file and it would encrypt all your data on your computer. And then it would, when it encrypted it, it would present a big red screen that says, You've been hacked, and you need to pay us a one-bit coin to unlock all of your files. And it basically ran an encryption routine that would they had the key and you couldn't get your data back. But if you were a good network administrator or you backed up your files somewhere else, you could ignore the threats and just rebuild the computer, restore the data and from backup, and you'd be good to go. Well, that was happening more and more, say 15 years ago. So the hackers decided to change their tactics and they began to exfiltrate data from your computer and your network, so that when they encrypted it, they also had a copy over in the cloud or in on the internet where they could threaten to embarrass you by releasing your private and sensitive information, whether that's healthcare records, legal briefs, financial records, uhything to do with your business, and releasing it publicly would embarrass you from a reputational damage perspective. So that was their double uh double um extortion. First was encrypting the files, second was threatening to release them online. Well, that's been the norm for the last 10 years or so. However, more recently, they're doing other things too. With AI uh backing the attacks, they're now able sometimes to break into your backups and delete them. So you can't restore your data. The only option is to pay the ransom and get the encryption decryption key to get your data back. Uh, they say they will delete the data uh if you pay the ransom. And, you know, I'm 50-50 on whether they follow their if there's a code of honor in hackers that they follow their promises once you pay the ransom. I don't necessarily believe that. And the FBI and others would say we need to stop paying these ransoms. But if it's your business and you can't operate without your data, you're kind of stuck between a rock and a hard place. Uh, more recently still, there's a third form of extortion where they, if you're in a regulated industry, let's say you're in healthcare and they manage to steal more than 500 records, um, the hackers will say to you, pay the ransom, or we're gonna report you to the health and human services division of the US government, because you have an obligation within 72 or 92 hours to report a breach in which you think health patient records have been stolen. And we have all the records we want. We've stolen them from you. So you're gonna get fined by the FC by the uh Department of Homeland Security or DHS. Uh, you're going to be embarrassed because your patient files will be released to the internet and we've already deleted your backups. So you you really have no hope of recovering from this unless you pay the ransom. So it's triple extortion, it's deletion of backups, it's encryption of the files, it's exfiltration of the data, and it's a threat to uh report you to the government authorities to fine you. So all sorts of different things have happened, all with the goal of extorting you for money. And the proof that it works is in the increase that we see year over year over year of more and more successful ransomware attacks. With AI powering the breaches, they're getting in in more different ways. Some are just breaking into computers the old-fashioned way by finding a bug with AI in the software you run. Uh, in the last 24 hours, there's been a major announcement around PHP. That's a programming scripting language that's used in almost all the WordPress sites of the world where you visit websites. It's usually it's hosted on WordPress. And uh there's a major vulnerability in it until you patch your WordPress uh site or your PHP specifically, and it's allowing hackers to break into companies right, left, and center. So that's the uh history of ransomware for you, Curtis.

SPEAKER_01 42:17

Well, tell us about any upcoming projects that you're working on that listeners need to be aware of.

SPEAKER_00 42:23

Well, Cyberhood has some exciting times in front of us. We've um we've just received a patent on our positive reinforcement non-deception-based phishing simulations. I don't know if I remember telling you this in the beginning, but most of the industry has tried to punish clicks for the last 25 years. And we say that doesn't change behaviors. Psychology and education says the way to change behaviors is to reward the good behaviors you want to see more of. So hovering over the sender in an email, um, looking at and inspecting the full URL of any links that you have, uh, watching out for urgency, emotionality, authority, or secrecy as a context of an email to get you to react to things. We like to reward those behaviors that we love to see you do rather than punish the clicks. And so the patent focuses on that, and the US patent office says, yeah, you know, that is a unique approach and we'll patent it for you. So that's what we've gotten a patent on. Now we're looking at adaptive security at Cyberhoot, where we're going to start to measure each individual user that's being trained in our platform for what their strengths and weaknesses are around cybersecurity topics and what their role in the company is. So if they're in finance, they're gonna face more phishing emails and wire fraud attack attempts and things around changing their, you know, update my deposit on my direct deposit to this bank instead of that bank. So there's different forms of attack and knowledge that we want to impart on individual people that's adaptive to their skills and their needs. That's coming out in the next few months at Cyberhoot. So it's really important. I think it's where the whole industry is going to go uh outside of our focus on positive reinforcement rewards-driven training. Um, that's the uh exciting news for Cyberhoot.com if you want to sign up for that individual training course. Yeah, it's cyberhoot.com forward slash individuals with an S on the end. If you would like to book a meeting to demo our platform, we're happy to do that with you. You can either email sales at cyberhoot.com or you can even sign up for a meeting on our website, or you can even sign up directly just to start a free 30-day trial, and we'll email you for a free onboarding to bring you up to speed in the platform.

SPEAKER_01 45:02

And also sign up for their newsletter. All these links will be in the show notes. So close us out with some final thoughts, maybe if that was something I forgot to talk about that you would like to touch on, or any final thoughts you have for the listeners.

SPEAKER_00 45:14

No, I would go back to the three things that we talked about. Every listener should do. First, they should adopt multi-factor authentication and pass keys. Second, they should find and learn how to use a password manager. Third, they should educate themselves for free at cyberhoot.com/slash individuals or pay for a subscription for their whole company to learn these cyber literacy skills because frankly, no one else has taught them that. And it's so important personally and professionally. So those are the things that I think are actionable for your users today to do. You could sign up for our newsletter at cyberhoot.com forward slash newsletters and put your email in. We'll send you updates on emerging threats like clickfix and other things throughout the year once a month.

SPEAKER_01 46:05

I feel like cybersecurity is not just for businesses, it is for personal too, because you can get caught up in these fishing or social engineering attacks just like you can in the business. So follow rate with you, share this episode to everybody that has and uses a computer that you know. Also to keep up with all things, live in the dream, and see every time we drop an episode, visit www.curveball337.com, share the website of the show to everybody that you know. Thank you for listening and supporting the show. And Craig, thank you for all that you do, and thank you for joining me.

SPEAKER_00 46:46

My pleasure, Curtis. It's been a great interview. Thank you for for having me on today.

SPEAKER_01 46:51

For more information on the Living the Dream with Curveball Podcast, visit www.curveball337.com. Until next time, keep living the dream.