Security Confidential S16 E5 Sandra Estok

Manoj Tandon (00:01.262)
Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. Today we have another great guest. Before I tell you who she is, although you can see her on the screen, I wanna remind you to hit the like and subscribe button because we depend on that to keep bringing you this great content and hope you folks show us a little bit of love. So please smash that like and subscribe button.

So today joining us is going to be Sandra Estok. Sandra has been in IT, in cybersecurity, in data privacy for 25 years. She’s got a ton of experience. She has her own story about identity theft. And that was kind of the impetus by which she really embarked on this remarkable journey. She’s been a TEDx speaker.

She is a bestselling author of the book, Happily Ever Cyber. We’ll talk about that during this conversation. But in the end, she’s all about empowering people to better cyber safety. And we could all use a little bit of that. So Sandra, welcome to the show. Thank you for being here.

Sandra Estok (01:22.951)
Thank you so much for this, Manoj. This is an amazing opportunity to have a wonderful discussion and thank you for everyone listening to us. And of course, smash that button, remember.

Manoj Tandon (01:34.596)
You know, one of these days that algorithm is going to figure it out and we won’t have to say that anymore. But until then, we are where we’re at. So, Sandra, one of the things we always start with the origin story because people love those. You people always want to know how did people, how did someone get here? So tell us how you started. Are you a computer science person by?

Sandra Estok (01:42.513)
Sure.

Yes.

Manoj Tandon (02:03.374)
training or IT person or where did you originate from?

Sandra Estok (02:05.863)
Yeah, you know, I have stories. do. Yeah, so I will say, know, origin stories are also a great way to connect and to everyone. You all have a story, right? So mine, I’m going to start with a story that is not necessarily

Manoj Tandon (02:11.874)
Wheeze! We love stories.

Sandra Estok (02:31.483)
cyber related, but I want you to have the context because I want that to be anyone that is listening to us, that there are no limits on the things that we can achieve. So I’m going to start with that. So I was born and raised in Venezuela, know, in South America. And when I was 11, my mom and I were evicted.

The only place my mom could afford to pay rent was the shack. There was no running water. There was no bathroom, nothing. And that shack was in the middle of a neighborhood that had nice houses. So at an early age, I became very integrated into a cyber bullying

Not cyber because cyber wasn’t there, but into a bullying situation and because my house was the way it was. you know, now that I think about that story and what changed my life at that moment, in one occasion, I was bullied, I was beat up, I was in the ground. And Manoj, instead of crying, I remember

the words that changed my life. And those words were from my teacher, my fifth grade teacher. And she said, happiness is a choice and you are the architect of your own life. Now I’m 11 and living how I’m living. And I lean to those words and I believe those words. And I said, you know what, I’m gonna create a life. At the time, of course, I could dream of having a toilet, having a faucet.

Manoj Tandon (04:04.631)
Okay.

Sandra Estok (04:27.047)
And little did I know that was like the beginning and, my life started to shift and one thing led to another. eventually I end my way into an IT career. And there are just many stories how I got there, but I don’t want to take the whole show just to talk about that. you know, why I’m sharing this particular story is because

We all have one and it’s on those moments of desperation, those moments where we feel that we’re not good enough or we’re this or we’re that, that someone’s words can change our lives. So what I expect or what I hope from our conversation today is that someone that is listening to us right now that might be experiencing, whether it something related to cyber or unrelated to cyber, that they can find a word.

or two that might give them a different perspective of their situation, whatever that situation is, whatever that is hopefully helps.

Manoj Tandon (05:39.46)
Thank you for sharing that story. listening to you, you know, it’s hard, it’s easy to think, I should say, that, you know, it would have been very easy to play the victim, right? And said, you know, I’m the victim, always me, bad luck. You know, it’s really easy to get into those negative emotions.

What is your secret to staying positive so that you could actually listen to that advice?

Sandra Estok (06:12.791)
I think that those words from my teacher, because when you feel that or when you believe that you are the architect of your own life, that you get to choose, and when you embrace that and you choose to be happy, happiness, sometimes people think happiness is about jumping or drinking or dancing. No, happiness to me is a state of mind where you feeling

a life where you’re feeling calm, where you’re feeling at peace, where you’re enjoying the moment. So for me, every single situation in my life, I embrace it with the words of that teacher that taught me that I’m empowered and I can do it. And as long as I believe that I can, that that’s all that matters. you know, there are so many examples that I can, we can be talking

over and over where I have witnessed the power of believing in yourself, the power of believing into something. And when you embrace that, whether it’s in a career in cybersecurity, a career in technology, anything that relates to what you love, believing that you can do it makes the whole difference.

Manoj Tandon (07:36.46)
Yeah, I mean, if you fundamentally don’t believe in what you’re architecting, you won’t be successful at architecting it. mean, that’s a self-fulfilling prophecy, right?

Sandra Estok (07:40.059)
Yes.

Sandra Estok (07:44.773)
Yeah, exactly. Yeah. I always love those wise words from Henry Ford. And he said, if you believe that you can do it or you cannot, you’re right. Exactly.

Manoj Tandon (07:59.712)
Either way, you’re correct. Right? He’s got a lot of them. He’s got a lot of quotes, actually. You know, I think one of my favorites was, if I really wanted your opinion, I’ll ask for it. But that’s perfect. I think there’s, I’m paraphrasing, but it kind of, somewhere along the lines, it went with him. But when…

Sandra Estok (08:06.533)
Yes, he does.

Sandra Estok (08:16.376)
Like that one.

Manoj Tandon (08:27.234)
So I know you said you didn’t wanna take the whole show on the background, but I have to ask, was getting into IT accidental or was it by design?

Sandra Estok (08:37.433)
Hmm, beautiful. was, I will say…

Sandra Estok (08:45.701)
by design accidentally.

And what I say by design, it’s because I believe there is a greater power than you have that somehow has that and you get the wisdom. I can tell. So I think it will be helpful because it gives you the context. So I’m 16 years old. I’m a victim again from that shack with my mom. So we moved with relatives and I graduated from high school.

Manoj Tandon (08:52.132)
Okay.

Sandra Estok (09:22.059)
You know, after my graduation, really wanted to continue education. I, you know, that was something I always loved to go to school. I loved learning, but I couldn’t afford that. So I decided to join a program to become a secretary, like an admin. Right. And that program included an internship that was going to happen in a major company. The company at

Manoj Tandon (09:41.42)
Okay.

Sandra Estok (09:52.237)
I was assigned to work was Heinz, you know, the ketchup company, right? Exactly. Pittsburgh. Yes. And I was in Venezuela and in one, in, know, one of the, factories or the factory there. So I’m doing my internship. I’m almost 18 and I get an assignment to run an errand from one of the admins.

Manoj Tandon (09:56.34)
Yeah, they’re based out of here in Pittsburgh where I live.

Sandra Estok (10:21.911)
And she said, Hey, Sandra, go to a hotel. You know, here is an envelope package. You need to deliver this to someone that is waiting for it. So Manoj, I go to this hotel. I never been in a hotel before. mean, not even a, I’ve never seen, let alone a five-star hotel. And I get there and I was like, Whoa, I thought these places existed just in movies. Right. And I’m, I’m like,

mesmerized and I’m walking and someone takes me to the restaurant area where the man waiting for the envelope, where the package is. I get there, I don’t even know. Today I think I was, my face said it all. So I handed the envelope and he looked at me and he said, Sandra, take a sit, have breakfast.

Manoj Tandon (10:59.052)
Okay.

Sandra Estok (11:19.065)
I it to my room and he walks away. And I’m like, there, Manoj. I never seen a buffet in my life. I never seen that much food in my entire life. And I get my plate, finally. And of course, I put everything I could in that plate. And I started eating. And as I’m eating, people started to show up for breakfast.

And I see people walking, like, you know, dress well and people, to me, they were having like intelligent conversations, like, my God, they look so cool. And in a corner, there was a woman in a table and she had a small computer. And I’m looking at this picture and it’s somehow my mind started to see myself wearing, you know, a nice

clothing, know, nice clothing, traveling with a computer. saw that computer. was like, my God, I never seen that. And I saw myself having an impact. And I said in that moment, I’m going to become a business woman. I don’t know how. I don’t know, but I know my mom and my little brother at the time were counting on me. And that was enough for me to say that’s what I want. And you know,

from there, the how show up. So you asked me, you know, was it by design or a decision? No, every single thing started to reveal. And I was a very action taker. So every single clue, I will go for it and I will be like, okay. And I don’t know what the next step is, but I just know that it’s in that direction and everything.

You know, when I, when I, course, like Steve Jobs says, it’s so much easier to connect the dots looking backwards, right? When you see your life and you’re like, I met that person and I went through this and I did that and that, that, that, and you connect the dots. It’s easy. You’ll see how your life just unfolded and how every decision and every situation and every circumstance put you.

Sandra Estok (13:45.295)
in the place for the next best thing to happen, even if that was a tough situation.

Manoj Tandon (13:52.558)
So you’re in the business of making your own good luck. That’s, which actually is in contradiction to the next question I’m gonna ask you then, is how did you go from having all this good luck to then having your identity stolen? What’s the story behind that? Is that’s not good luck? Well, maybe it is, because it ended up you were writing books and you got involved with everything, but please.

Sandra Estok (14:12.25)
Yeah, so.

It is.

Sandra Estok (14:18.907)
Yes, exactly. it’s is exactly that point Manoj because when we see every situation in our life as an opportunity for the next step, for the next thing, know, having my identity stolen and taking out of a plane by Homeland Security was nerve wracking.

Manoj Tandon (14:40.58)
Okay, you gotta tell us this story. So what happened?

Sandra Estok (14:44.453)
Okay. I, so Venice, I’m still in Venezuela, right? So I went to school, I worked during the day, I became a system engineer and multiple jobs. And my last job was at a company, an American company that relocated my family and I in 2005 to their headquarters. So now my family and I moved to the U S I, you know,

Manoj Tandon (14:56.205)
Okay.

Manoj Tandon (15:07.395)
Okay.

Sandra Estok (15:14.643)
You know that phrase, I made it. That was me in 2005 because from where I was to getting into an American company, being relocated, like that was my dream. Like I couldn’t even dream that much. And I made it, right. And a year later, I’m in that plane. I’m landing in Miami when the captain announces that Homeland Security is boarding the plane. And that’s when I had my passport.

Manoj Tandon (15:41.068)
Okay?

Sandra Estok (15:44.335)
And all of a sudden I’m the only passenger squirted out of the plane by Homeland Security, two Homeland Security officers. And, you know, I get to that room, right, that scary room, and I had no idea. My husband is in Chicago. I don’t know what’s happening. I don’t know where my luggage is. I just remember I was just thinking, am I going to be deported? I don’t want to go back to Venezuela. I was like,

That was freaking me out because I love my life in the US. Like this is my country. I love this country. I love everything. And just the fear that I have to go back and that I will lose everything that I have here. It was that moment. And I spent 10 hours in that room, Manoj. 10 hours.

Manoj Tandon (16:35.62)
What was their reasoning for taking you off the plate?

Sandra Estok (16:39.277)
they didn’t tell you, they don’t say anything. They just, you have to sit, you have to wait, can’t call, you cannot talk to anyone. And after 10 hours, they call my name, I go, and I see my passport with a big red stamp, and it’s being revoked. So, and they say, okay, you can go home, talk to your employer, and you have to leave the country right away.

I was no explanation. I go, I get to go to, to, to, Chicago and go to the company and talk to them and talk to the attorneys. And I have to leave the country with my husband. So we, we go back to Venezuela and they arranged, you know, everyone is working, trying to help me out. And the company was amazing, you know, hiring attorneys and hiring people to, to help me.

So we are scheduled for a new interview at the United States Embassy in Caracas, right, in Venezuela. So we go to the embassy, I’m there, and I’m taken to another room, and in that room, they start asking me, why were you in China? Who do you know in China? Who’s your contact in China? I’m like.

Manoj Tandon (17:42.081)
Okay.

Sandra Estok (18:01.007)
It felt like a movie, like a nightmare. Like, I don’t know how to tell you what I felt in that moment. And I started asking the officer that was interrogating me. said, you know, I’ve never been to China. I don’t know anyone in China. What’s happening? Please tell me like why somebody, you know, what’s happening? Like, why was I taken from that plane? And finally he said, hey, you know,

someone in China stole your identity to smuggle women into the US. That’s why you were taking off that plane.

Manoj Tandon (18:38.67)
So did they get another fake passport or what did they do?

Sandra Estok (18:42.745)
Yeah, so when you, so every time that there is a flight, international flight coming in, right? There is a plane manifesto that comes with all the passengers. Of course, when my name was there, they validate and multiple people were trying to come into the country, like pretending to be me. So I was impersonated. I don’t know the details because again, it’s not like they give you a lot of information.

But I can tell you is for six years, I have to prove I was the real me over and over and over. And it almost broke my marriage, my career and my mental health.

Manoj Tandon (19:26.158)
So did you continue to work for the company in Chicago?

Sandra Estok (19:29.507)
Yes, continue to. Yeah, it was in the Midwest. It was actually in Wisconsin. Yes.

Manoj Tandon (19:34.808)
Okay.

And so how did you, so they told you your identity was stolen. How did you have to, what was the process of unwinding that? So you said six years. How did they ultimately end up proving that you’re you or did you have to sue the government or what happened?

Sandra Estok (19:48.785)
Six years.

Sandra Estok (19:58.309)
No, I became a US citizen and I changed my name and then everything went away. But, but, know, through the process, I tried different things, but once you are flagged in the system, imagine every single time you travel, you come to TSA, right? And you hand your passport. And usually the TSA agent was really friendly until they scan my passport because they will be, there will be an alert.

place on me, on my identity. I will, you sometimes they’ll, you know, they have sometimes these red lights in each of the TSA counters. They’ll flash the light and the police will come and escort me and take me to the room. Sometimes they’ll escort me. I mean, it was very different, but that had to happen every single time for six years. So I had to prove I was me. So I have to carry a thick folder.

Manoj Tandon (20:38.713)
Mm-hmm.

Sandra Estok (20:56.707)
and letters and lawyers, I mean, we built the whole case that proved my identity. And have to be every single time that I travel, I have to go to that room. So I could be in the room for an hour or for five. So I couldn’t have normal connections that I had to always work to travel. have to count for…

10 hours or whatever time it will take me to prove that I’m me. And I can tell you by now, nobody wanted to travel with me. No one, not even my husband.

Manoj Tandon (21:34.539)
I can only imagine.

Manoj Tandon (21:39.988)
I can imagine that seems like a real hell to deal with because you don’t know how long you’ll be stuck there.

Sandra Estok (21:47.297)
No. Yeah. But again, through that experience, I was not in cybersecurity, so I knew nothing about cyber. I was in IT. I actually had an IT career and I was more system engineered and I was managing all the hosting, Unix, Linux, SAP, all these different systems. I had no idea.

that, you know, that was 2006. It wasn’t like you’ll see it in the news like now, you know, identity theft is so common or so discussed and in the media, right? At the time it wasn’t. So one of the, you asked at the beginning, you know, the victim mentality, you know, feeling like a victim.

It could be very easy to say, you know what, for me, it happened to me, the government is this, da da da. But I remember once I resolved my situation and became a US citizen, I decided to shift my career. And that’s when I moved into cybersecurity. And it felt like somebody turned the light on in my brain because finally I understood what happens.

Manoj Tandon (23:08.26)
So what did they do? Did they, yeah, go ahead. I can think of multiple ways this might’ve gone down, but I’m curious.

Sandra Estok (23:10.276)
So.

Sandra Estok (23:16.987)
Now, in a way that I understood that identity theft happens every two seconds here in the US. Children becomes victims of identity theft. Identity theft is this thing that until it happens to you, you don’t think it will happen. You think it’s just for famous people, for rich people, for people that…

have a lot of money and that’s not the case. It can happen to anyone and it doesn’t have to happen to like I was an immigrant but it happens to people from here. It happens to anyone and I think learning that that’s how I started my career and learning cyber security and getting certifications and going through multiple functions within cyber.

When I realized that the power of sharing my story could change the perception of someone seeing cyber, that really sparked me to open my own company and eventually obviously do all the things that I do today to focus on training, education, empowerment. Because when you feel that you can do it, when you feel that there’s not just about being a technical person.

There are so many things we can do to protect our information, our children, our family, our businesses, that is not only about installing an antivirus, it’s beyond that, or a firewall.

Manoj Tandon (25:00.526)
Tell us more. What is it about then? So if you’re, you wrote the book on it, right? So what are things that people should be looking out for? What should they be doing so that they don’t, or minimize the chance? You can still become a victim of identity theft, but.

Sandra Estok (25:05.775)
Yeah.

Sandra Estok (25:19.045)
Yeah, of course, or cyber crime. mean, yes, it can happen.

I will say in my journey, what I learned and not just in my journey, but in the industry, right? We know that about 80 % of the cyber attacks happen because of the human factor, right? So it’s actually IBM is saying now it’s 95 % of cyber attacks involve the human. So what does that mean? It means that there are people out there that want to exploit our

human-ness and they will find ways to trick someone to play you, whether it’s social engineering, pretending to be somebody else or with an email that is not real. And how many people that is listening to us, you that is listening right now, got a text message about a package you never order or something you never… It’s a daily thing, right?

Manoj Tandon (26:20.782)
It’s a daily accru-

Sandra Estok (26:23.843)
So, when you, and that was my connection. What I realized is when I was distracted, when I was not paying attention, right? I could be more prone to click into something, to disclose information, to give away, to answer. You know, I remember.

One of the questions that I have been asked the most is how my identity got stolen, who stole it, how it happened. And I don’t know exactly when, how, but I know what I know now is the state of mind that I had at the time. I was a very busy person. I was always in a hurry. I was always thinking about the present, the future, always, like never in the moment.

And I remember going to hotels where someone asked for my passport and they might go to the back to make a copy of my passport or my driver license or my, like, never occurred to me that, you know, that is something I shouldn’t be allowing that someone takes my passport or someone asked me for my information without me validating they are really a real person. So.

Manoj Tandon (27:42.722)
What do you do in that situation? Because what you’re describing there happens to anybody that travels internationally, right? They’re gonna ask when you check into a hotel, they ask for your passport.

Sandra Estok (27:52.763)
You know, I get to, I negotiate all the time now with the hotels and I’m like, okay, tell me before, when they asked for my passport, say, okay, show me how do you protect data? Show me how my passport information won’t be stolen. So, and there was a hotel that they, we promised you your information is safe here. And they, they took a box with all these.

copies of passports, like they have that right there in the lobby. And they were like, here, we put it in this box and it’s safe. Nobody ever comes. I was like, so I negotiate, I rather give, instead of my passport, my driver license, because internationally might not be as useful for someone.

Manoj Tandon (28:27.268)
Right there, it’s not safe. That’s

Sandra Estok (28:50.415)
So I always negotiate and I always find a way not to give my passport anymore. So it’s a conversation and you can ask and you can say, hey, what else can I give you to prove my identity? What else can, you know, how else can we do it? And usually the hotel will work with you if you have, if you inquire. I think we’re just, I was so used to, if someone asked me something, here you go.

Manoj Tandon (29:17.794)
Yeah, most people do it. You think of how many times in life people ask you for your social security number and they have no business in doing that, right? Unless they’re a financial institution or they are your employer, they really don’t have any legal basis to ask for that document.

Sandra Estok (29:26.972)
Yeah.

Sandra Estok (29:38.595)
Exactly. Yeah. And I remember myself, how many times was I in a doctor office writing down, you know, the history and it will ask you for your social security. And I put it there and it didn’t occur to me. Like that piece of paper, how many hands it’s going to take, you know, it’s going to have that piece of paper. Yeah.

Manoj Tandon (29:57.792)
It’s one of the most insecure, a medical facility, and we’re seeing this, is one of the most insecure environments. And there’s a lot of reasons why it is, but it just is.

Sandra Estok (30:09.349)
Yeah. Yeah. So you asked me how people can protect that, right? There is no technology involved. It involves you as a human to be really present when someone asks you for something and take two seconds before you react. So that is a practice that you can incorporate without any technology knowledge, without nothing, but really just pause.

and think about who asked you or what it was asked and before you answer or before you give it away, just let that sink into your system.

Manoj Tandon (30:53.988)
You know, Sandra, the one thing is that at this time, would say almost.

I’m just, this just gonna be a guess on my part, but probably 95 % of the US population, their address, their age.

you know, the date of birth, social security number, driver’s license numbers have all been compromised, right? And if you’re really determined and you know who you’re looking for, you can absolutely for cheap find that data. It doesn’t cost much, right?

Sandra Estok (31:22.469)
Yeah, true.

Sandra Estok (31:31.471)
Of course. Yep. I agree.

Manoj Tandon (31:38.27)
I can then take that data and I can create another person. Because you think about it, who really double checks? So I would make a bet that we could randomly call so many brokerage houses and say, hi, I’m Sandra, even though I don’t sound like a Sandra. And here’s my date of birth, here’s my social security number, here’s my address.

And I want you to create a new account for me.

Sandra Estok (32:11.195)
Yep.

Manoj Tandon (32:15.126)
I guarantee you, will be successful at some point in getting someone to open that totally fake account that’s actually registered to your social security number.

Sandra Estok (32:22.407)
Mm-hmm.

Sandra Estok (32:26.201)
Yep, exactly. Yeah, absolutely.

Manoj Tandon (32:29.228)
Right? And you would have no way about knowing about it. The only way you may find out is if the IRS sends you an audit letter that says you got $10 million sitting in the bank.

Where did it come from? And you’ll be like, what are you talking about?

Sandra Estok (32:41.115)
Well, are ways to know. One of the things that I always do, I have alerts for everything that I can have an alert. So every bank account, every transaction, whether it’s in my business or in my personal life, if it happens, when it happens, it comes to me. So that way I can go to my bank account and I can

I don’t even have to go to my bank account. If I spend a dollar and I know we can set limits and sometimes we did like a hundred. No, I do like even one cent transaction. And yes, it might be annoying, but when I spend something, I know I expect a text message right away. So when a text message comes, I’m not in the store. I know right away, something happened in my account. So I’m the one calling the bank and saying, Hey,

This is happening, da da da, cancel that transaction. This is not me, I’m here. So I’m a proactive. Say, the example you gave with someone opening an account or a credit card, if you have alerts in your credit history, right? If you have a freeze in your credit scores, if you put a freeze for experience, Equifax and all the different bureaus.

and you have that freeze in place, there is an obligation if someone tried to open an account and there is that freeze and it’s not lifted, then you have grounds to go up and fight a better case. Also checking your history, checking your information, ensuring that what is there reflects your reality.

Manoj Tandon (34:35.894)
Yeah, I don’t think very few people do that. And a lot of things happen where it’s not in their control, where their doctor’s office gets breached or their bank got breached or somebody got breached, right? their Amazon account got breached and…

Sandra Estok (34:51.271)
Yep, absolutely.

Manoj Tandon (34:58.508)
Now that data is out there and you can create all kinds of false identities. mean, if you think of how society is structured, it’s based on a principle of trust, but it’s not verified trust, right? Because verification requires human interaction. And what we’re seeing now is a lot of the online establishments

Sandra Estok (35:03.974)
Of course.

Sandra Estok (35:11.591)
Yeah.

Yeah, true.

Manoj Tandon (35:27.908)
don’t want even a 800 customer service number. There’s nobody to talk to. There’s no verification. It’s just a bunch of robots that are going through the process. And a robot doesn’t know any better. So once I create an account in your name, and now I have a address envelope from an official financial institution, now I can go to and get a fake driver’s license. Because now that serves as my proof of address, my…

Right? Now I have a driver’s license with my picture on it that says, am Mickey Mouse’s second cousin. And, and it’s completely legit. Right? Now you can go and start doing all kinds of things. And as you’re saying, you’re negotiating.

Sandra Estok (36:01.872)
Definitely.

Sandra Estok (36:09.797)
It is.

Manoj Tandon (36:19.992)
when people are asking for that critical information. I think that’s a part of the process that companies themselves do not follow. And do you have any advice to these organizations where they just open an account or provide an order or place an order or do they really are not interested in verifying whether this person is correct or legit or not?

Sandra Estok (36:48.583)
Yeah, you’re so right. that happens whether you are a large corporation or small business or you as an individual. what I will say, for me, yes, I know all of that happens. I know that that’s the situation, right? All this information is breached. So what can I do? I could be in a position of reaction.

being every active person and wait for someone to compromise my identity, for someone to open an account, for someone to do something and of course feel how victimized and how not fair this is. So I could take that or I could say, you know what, if I see in the news that these companies,

has been breached. There is a data breach and I know that a hundred million records have been compromised. I can go to my account and change my password. I can go to my account that I have with that service and ensure that it’s not the same password that I use for anything else. I have control over that. And that’s going back to, you know, the first conversation empowerment.

When I see there is a choice I can make, yes, somebody else is compromised, somebody else’s information should have been protecting that information on my behalf, but that didn’t happen. But I can choose how, you know, not to repeat my password in multiple places. I can choose to have a strong password. I can choose not to share it. You know, those are things that will make me

some less likely to become that victim. Because you and I know that cyber criminals want easy things. They don’t want to spend a lot of time with someone who has two-factor authentication, unless they really want you, of course. But if you have some security measures, they’re just going to go to the next person that has nothing. That is repeating the passwords or the passwords are one, two, three, four, five.

Manoj Tandon (38:53.283)
Yes.

Manoj Tandon (39:05.761)
Right.

Manoj Tandon (39:10.948)
There’s a ton of that. Well, even in IT, how many IT systems have their factory original passwords?

Sandra Estok (39:12.388)
Yes, so.

Sandra Estok (39:17.751)
Exactly. So what I encourage everyone is don’t become that easy prey. Don’t be that long, low hanging fruit for cyber criminals.

Manoj Tandon (39:32.736)
You’ve given us a couple examples here. One, you’re saying negotiate. That’s what you do. If sensitive information is being asked, negotiate before giving that away. Freeze your credit history. Right? Turn on notifications wherever you can. Right?

Sandra Estok (39:41.903)
Yep. Yeah.

Sandra Estok (39:53.905)
Yep. Yes.

Manoj Tandon (39:57.826)
Don’t repeat your passwords. That’s great advice, right? Nobody follows it, but I can tell you that is very, very good advice to have strong. And now in this day and age with password managers, there’s really not an excuse. And you can even do it for free if you’re on Android or Apple. You don’t even have to spend any money on that, but people still don’t do it, right?

Manoj Tandon (40:25.482)
Implement security features, so like 2FA, so on your Google account, on your whatever, you know, if it’s available, take advantage of it. What are other things? I just listed five that I heard you speak about during our brief discussion here, but other items you would recommend.

Sandra Estok (40:31.399)
Any yep

Sandra Estok (40:45.819)
Yeah, you know, I love the first one that you said, negotiate. And I will say, besides negotiate, ask. Ask how people protect your information. You have that right. Yeah, if someone is handling your data, you can ask them, what are you doing to protect it? So if there is something, like if I go to a…

to a place that is asking me for that sensitive information, like the example we just had. I think becoming inquiring, becoming an inquirer, becoming someone curious of how my information is being protected, who is managing what. I think the more us as individuals and community and society start asking those questions, we can put more pressure.

in organizations to handle our information better.

Manoj Tandon (41:44.576)
Yeah, you’re absolutely right. But now what is going to happen? I would have said if we didn’t have AI, what you’re saying is absolutely correct. But now with AI, I think it changes. Because what if I use your information to train my model? Now there’s no delete. There’s no longer, it’s not like the, you mentioned SAP, right? That was typically running on an Oracle database.

Sandra Estok (41:46.236)
Right.

Sandra Estok (41:59.355)
Mm-hmm.

Sandra Estok (42:07.45)
You

Sandra Estok (42:12.423)
Hmm.

Manoj Tandon (42:12.636)
Well, you could delete the row or the column and the data is gone and you can forget about person A, B or C or whatever it is that you want to forget about. When you train a neural engine, there is no delete the data.

Sandra Estok (42:24.935)
Yep. Yep. I agree.

Manoj Tandon (42:31.47)
So.

Sandra Estok (42:32.417)
So, in that case, so you’re assuming, so let’s use AI perfect example. So AI is being used so much to create phishing emails, to create social engineering attacks that are more sophisticated, deep fakes. Now someone can call you or even you can see them in a screen and they can tell you, it’s me, give me the money. I need you to wire me that money. Right?

So how do we defend against that?

It goes back to the first principle and that first principle is cultivating those human traits, cultivating that pause, you know, take a moment, don’t action right away. Because I think, you know, right now with…

You’re so right. There’s so much information about AI. We’re training models. We’re doing this. We’re doing that. If something asks me for my information, if I answer it right away, I am just giving more fire or more wood to the fire, right? I’m putting more out there. So this is the work that I do. And this is the work that I love.

to continue educating because yes, cybersecurity tools are useful, password manager, antivirus, firewalls, all these different things are helpful. But if we can internalize that we also are a tool, we have an inner cyber tool, that’s how I call it, that can be so much powerful.

Sandra Estok (44:29.145)
against anything that is happening because it’s about me reacting. It’s about me taking action. And if I can do that, if I can learn to do that, if I can teach kids, very early age kids that will be in iPads, iPods, or not iPods, but iPads or tablets, I mean.

Manoj Tandon (44:51.032)
Yeah.

Sandra Estok (44:53.773)
that, you know, the basics, it’s like somebody teach you how to cross the street and you look both ways. It’s ingrained into your system. So I think cybersecurity has to become something that is so ingrained into you that even though something fake with AI comes to you, there are things that you can recognize because let me ask you this Manoj.

Manoj Tandon (45:22.798)
Yeah.

Sandra Estok (45:24.835)
If it’s 10 o’clock in the middle of the night and you are walking through a dark alley and there is a car parked and there is someone there and that person comes and say, hey, come to my truck. I gotta ask you a question. Would you go? No, why? Because every single signal in your body will be like screaming, run, danger.

Manoj Tandon (45:32.004)
Okay.

Manoj Tandon (45:43.352)
Heck no.

Manoj Tandon (45:49.822)
Yeah, get out of there. This is a bad idea.

Sandra Estok (45:52.675)
Exactly. So we need to cultivate that online. That same sense of awareness, same, you know, that just something is not right. there is just, we know, there’s a glimpse and, you know, I’ve done, I want to do a research on this. How many people get a phone call from the IRS, right?

or the social security and they get this pressure by someone that really knows how to pressure them by a social engineer, attacker.

Manoj Tandon (46:32.669)
Yeah, but typically the people on the other end of that phone line have some kind of very strange accent and you’re like, yeah, sure.

Sandra Estok (46:40.173)
Exactly, but so many people also fall for it.

Manoj Tandon (46:44.098)
Yeah, they do. Well, and the IRS on their website says, we will never call you. Every piece of communication they send is we will never call you.

Sandra Estok (46:48.656)
Yes.

Sandra Estok (46:52.333)
Exactly. So why is that? Because the pressure is so intense that you override your own system. Like you let that fear take control over you.

Manoj Tandon (47:09.176)
That’s very true. And what you’re asking is a very difficult thing to do, because most people will be very, and it’s not just cyber, in general people react. That’s what people do. It’s a human nature thing, right? If it wasn’t for that, we wouldn’t have such a large consumer economy because most buys are impulse buys, right? You really don’t need that t-shirt, but yeah, you know.

Sandra Estok (47:36.593)
Yep.

Manoj Tandon (47:38.444)
It’s a deal and I’m gonna get it, right? It’s an impulse buy. There’s that interrupt factor that you’re talking about is put a pause in the program.

Sandra Estok (47:51.715)
Exactly. And you know, that’s a great example with a teacher, right? You’re buying, it’s a great deal. You take a pause and you say, you know what? Yeah, that teacher will make me happy. I really like it. I love the color. It’s a great price. I can do this. And then you buy it and you don’t have buyer remorse.

But if you click in the same way, if there is something that you can take a few seconds to reflect on it, and you’re like, I don’t even have a bank account at that bank that is asking for my password. You have no idea how many times people come to me and say, wow, when I started to practice this, and this is not just something I…

I do it for myself. I teach this. And what I’ve seen the change is when you become aware, when you become that person that just activates their curiosity, their questioning, the inquiring mind, you start seeing things. And I bet every single person here listening to us,

When you go to your email or when you go to your phone, you’re not gonna see your phone in the same way. You’re gonna see a text message. You’re like, that was, and what I want you to start doing with those messages is I want you to celebrate every single time you discover someone is trying to trick you. Because the more you can see when those patterns are happening,

the more your mind will get used to recognize them.

Manoj Tandon (49:39.256)
Developing muscle memory for cybersecurity.

Sandra Estok (49:41.965)
Exactly. Yeah, cybercognition, you know, absolutely.

Manoj Tandon (49:49.226)
What is way to protect?

Sandra Estok (49:51.729)
So Way to Protect is my company and I love it. I love it because it allowed me to do what I love the most, which is not just share my story, but share a perspective of cyber that can truly transform you in many different ways. So we are a woman-owned, minority-owned small business and we get to do cool things.

Manoj Tandon (50:23.244)
Yeah, you’ve done Ted Talks, you do corporate training, right? Have you gotten involved with children?

Sandra Estok (50:25.679)
Yeah. Yes. Yes.

Sandra Estok (50:31.623)
I have a book series for children actually. Yes, it’s called the Cyber Literacy Series. what I was inspired to take fairy tale stories that are in the public domain, right? And make them cyber stories. So I have like the three little pigs and the power of a strong password. Or Little Red Riding Hood and the dangers of impersonation or

Manoj Tandon (50:35.1)
yeah?

Sandra Estok (51:02.503)
Hansel and Gretel. Yeah, and you know, it’s been amazing because I get so many comments from parents who grandparents, and that give the way, that give the books to their children. First of all, they are learning, but most importantly, the kids already know the stories, so they can relate to the wolf pretending to be grandma.

Manoj Tandon (51:02.584)
That’s an interesting impersonation.

Sandra Estok (51:30.041)
And if they are kids playing in Roblox, right? They now can understand somebody trying to pretend to be who they are not. And it’s so much easier to explain. So it’s an amazing tool for parents, for teachers, for everyone to start incorporating cyber safety mindset into kids.

Manoj Tandon (51:52.526)
Where do grandparents, parents, anyone interested, find your books?

Sandra Estok (51:58.939)
All my books are available in Amazon, but you also can go to my website, sandraestock.com. And, you know, we have free resources. have free checklists. If someone wants to like identities, we talk about children identity. So I have a free checklist where you can start taking steps. You know, am I doing this? Am I doing this? And you cross the list. Easy.

Manoj Tandon (52:06.564)
Okay.

Sandra Estok (52:26.199)
easy, actionable things you can start doing to protect you, your family, or your business, or your company.

Manoj Tandon (52:36.068)
Sandra, we are at the hour. Is there anything? I want to give you a couple minutes to plug whatever you’d like to. Are you doing any, are you making any appearances anywhere?

Sandra Estok (52:43.238)
Yeah.

Yeah, right. Well, right now, actually, my travel schedule is being revised this year. I’m being very mindful of conferences. I’m focusing a lot in some internal projects and new AI projects and new things that will allow this to be easier to implement. So I don’t have any conference right now.

But I will just say, I want to end with this message. know, you that is sitting, having headphones, or maybe enjoying this show while you’re driving, whatever you are, however you’re doing this, just know that even if you are a very cyber savvy person, you are super technical, you love, you you understand all of this. My…

for you is to go and teach one person today what you learned in this show. Share it with someone, share it with your mom, share it with your grandma, share it with your neighbor, share it with someone because there is nothing that gives you more pleasure and more gratification than knowing that maybe you stop the next victim.

Manoj Tandon (54:11.768)
That is fantastic, Sandra. I appreciate what you did. Thanks for coming on the show. And as your projects progress, you know, don’t be a stranger around here. You’re welcome back. Come back. Tell us about what’s going on.

Sandra Estok (54:20.017)
Thank you.

Thank you. I will definitely thank you so much for having me. It was a wonderful conversation. You’re an amazing host. This is an amazing podcast and you have incredible listeners. So thank you.

Manoj Tandon (54:37.112)
Thank you so much. You’re very kind. I agree with you about the listeners. I don’t know about the rest of it. Well, take care, Sandra. Appreciate you. Hope to talk to you again soon.

Sandra Estok (54:43.559)
Thank you.

Sandra Estok (54:51.313)
Thank you.