Security Confidential S8 E3 Dr. Gerald Auger

Manoj Tandon
Hello everyone, this is your host, Manoj Tandon, and welcome to another episode of Dark Rhino Security Confidential. Today, we are honored to have Dr. Gerald Auger join us. Gerald has been in the cybersecurity field since 2006. He’s a real veteran. He has multiple degrees, holds a PhD in cyber operations, and he’s the chief content creator at Simply Cyber and the managing partner at Coastal Information Security Group. He’s literally written the book on cybersecurity and building your career. The title is Cybersecurity Career Master Plan. It’s a step-by-step guide for anyone who considers cybersecurity as a potential career field.

Thank you so much, Gerald, for joining us on the show. I appreciate it. Great to have you.

Gerald Auger
Yeah, thank you. I’m looking forward to this conversation, and I appreciate the opportunity to talk with you and to engage with your audience.

Manoj Tandon
Thank you. Oh, they’ll be very interested in a lot of things that you have to say because you’ve literally written the papers or the books on many of the topics that they’re quite interested in.

But before we get into the hardcore nitty-gritty, give us a little bit about your background. What’s driving this passion? You’re really passionate about cybersecurity; it comes across in all the content that you create.

Gerald Auger
Yeah, I am incredibly passionate about cybersecurity. If anyone has interacted with me in any capacity, they know that I just get up for it. I’m very, very fortunate that something that I love so much is something that is in such demand, and it enables me to provide for my family financially and be able to do what I would consider good for society—helping businesses, helping individuals, and helping organizations protect themselves and reduce risk. Helping people protect their own personal finances, photos, and all of that stuff. It’s really awesome.

I went and got a degree in computer science originally, way back in the day, like my bachelor’s degree, and went into the market as a software developer because that’s all I thought you could do with a computer science degree. Then, at some point early in my career, I got audited from a cybersecurity perspective. I was supporting the Marine Corps, and there are a bit of security audit requirements that no one had made apparent to me as a developer. I got audited, and I did horrible because I wasn’t putting security in like everybody else.

That was my first taste of, “Oh my gosh, there is actually something here. Let me dig in.” Then, because it is unbelievably wide—and like you said, I’ve been working in the industry for a long time, I have multiple degrees, and I contribute to the community—there are so many things that I know very little about in the industry. That’s how much opportunity there is. I’m a lifelong learner, so for me, the ability for it to be super dynamic, completely complicated, and constantly evolving is like an endless well that I can go fill buckets from and be personally satisfied, both from a continuing education perspective and also from a giving to a community perspective.

Manoj Tandon
I think that’s really, really important, what you just said to outline here: even though you have a PhD literally in the topic and you’ve done a great amount of work in the area, you’re still a lifelong learner. I think to be a master of your craft—whether that be in cybersecurity, or you’re a musician, or whatever you may be—if you don’t have that attitude of a lifelong learner, it’s very hard to achieve that master status, if you will.

Gerald Auger
Yeah, and I feel, especially in cybersecurity—I guess I can speak to that because that is my area of expertise—you need to be humble. You need to appreciate the fact that there are other people out there who are better at any particular thing that you may encounter in the field.

Again, because it’s changing so rapidly, something that you knew as a fact six months ago or two years ago may not be as factual or exactly the same. Just as a perfect example, Manoj, people who are experts at IT infrastructure, network engineering, or database administration—whatever—when we migrated from on-prem to cloud, this was a big paradigm shift in the industry over the last five years. Those skills aren’t a one-to-one mapping. I’m really good at security, but I’m not really good at cloud security because it’s a different paradigm.

So, you’ve got to be humble, you’ve got to be real, and appreciate that in order to deliver excellence and be valuable both personally and for an organization, you need to continue to develop and seek out new education.

Manoj Tandon
So what drove you to write the book about a career in cybersecurity, Cybersecurity Career Master Plan? What was the impetus behind it?

Gerald Auger
Yeah, so the book itself is basically that I wanted to originally call it the “Blueprint,” but it is a plan. I have gone up and down the mountain several times, and now I can act like a sherpa for any individual that wants to know how to go up the mountain. It’s easy to say, “Oh, just walk up the path,” but what supplies do you bring? What’s the weather going to be like? What kind of obstacles or hazards should you avoid?

These are the questions that people don’t know to ask, but if you can bring that knowledge to them and get them set up, they have a better chance of not just success, but more of an optimized path, which is more enjoyable.

So for me, Simply Cyber—the YouTube channel that I started at the end of 2019—it’s evolved over time, but originally I was getting a lot of questions and DMs on LinkedIn: “Hey Jerry, I see you’ve got a lot of experience. I want to get into cybersecurity. What do I do?” “Hey, I’m pivoting from the military into the private sector. How do I do it?” “Hey, I’m a red team player; I want to go blue. What do I do?”

I was answering questions one-on-one in DMs and stuff like that, and I don’t have the time to do one-on-one mentoring. I just don’t. So I was like, “Oh, let’s mentor at scale.” After a year or so of getting questions, making videos, and helping people, I basically had heard what the questions were in the industry. You get asked the same question over and over and over again, right? So you start understanding the mindset.

The book is basically a direct response to all the questions that I got, put in an organized way that can help people understand what they need to do, because a lot of times they don’t even know the right questions to ask. Manoj, you probably get this all the time. People will say, “Hey, I want to work in cybersecurity. What do I do?” The next question that I have to ask them is, “Well, what do you want to do? Do you want to be red team, blue team? Do you want to work in GRC? Are you technical? Do you want to be more on the operational side?” All of these questions are going to influence how I tell you to get into cybersecurity. It’s not a basic plan.

The book itself, I’m actually really proud of. It’s broken into three parts. Part one is, “Do you even want to work in this industry?” Because you might not. It’s not for everybody. I know it’s got big money and big sizzle on the front page of the news and stuff, but it’s not for everybody. And then, if you do want to work there, then go to section two. Section two is: “Here’s the whole landscape of the industry and how to get the job.” Then section three is: “Okay, you’ve got the job; now let’s really throttle it up, be excellent at the job, and start learning how to give back.”

Manoj Tandon
So give us the nickel tour here. We get a lot of people—we’ve hired a lot of military veterans, and we get a lot of folks that are transitioning from the military into civilian life, or we get people who are in really different careers and want to get into the cybersecurity field.

I mean, we know of a Disney Imagineer who’s now a killer cybersecurity engineer. We know of a nurse who’s gotten in and she is an awesome GRC person. Their paths were kind of unique, but if you were going to give us a nickel tour of this trip up the mountain, what are some big topic guidelines for those people who have no experience and they are reading job ads that say “20 years of experience,” “10 years of experience” in technologies that have only existed for three years, by the way, which is very interesting?

They look at that and get discouraged. How do they—what are your thoughts? How should they begin?

Gerald Auger
Yeah, so there’s really two key things that people need to understand. At least, I would say these are the secret sauce or the—this is like… pause the podcast, get a pen, hit play, and let’s do this. Okay?

Really, there’s a couple things. One, whether you’re going to be technical or non-technical, I would encourage people to get a little bit of exposure to networking and operating systems. Now, you don’t need to understand how file swaps, page swaps, writing to memory, and L2 caches work. You don’t need to know all that. You just need to understand basically how a computer works.

The second thing—and this is probably the most important from a technical perspective—is you need to understand how networking works. Like how your computer, when you go to google.com or when you pull up this podcast that you’re listening to right now—it came from a server somewhere, right? How did that data get from the server to your phone that you’re listening to or into your car?

Basic, basic, basic. You don’t need to understand all the protocols, flags, and all that stuff, but you just need to understand a little bit below the surface. Once you understand that, because this is how it works. This is how threat actors attack us. This is how data goes out. This is how you protect an organization. So if you don’t understand that, you won’t have any anchor to pin from to be able to then actually absorb actual cyber knowledge. That’s the first part as far as an absolute primer goes.

Manoj Tandon
Got it.

Gerald Auger
Okay, the second thing—and this is a little bit further on, but you can do this almost immediately, and I say this all the time—social networking. Perfect. Professional networking is unbelievably valuable. It may not seem obvious because you’re like, “Well, I just got into this industry. What value do I have to add to a conversation? How can I comment on someone’s post if I don’t even understand what they’re posting about?”

That’s what I’m talking about. There are a lot of Discord servers, including Simply Cyber, which I’m very proud of. So, if you’re quick—you can put this in the show notes—but simplycyber.io/discord is the URL. You go to that. There are well, there’s really thousands of people in there, but there are always hundreds and hundreds of active people who were where you are.

Everybody started from somewhere, right? People know the questions that they’re going to ask, like, “Oh, should I do this? Does anyone know about this? Is this class good?” People are sharing knowledge, people are being supportive, and people are being inclusive.

Because you’re right: that frustration, that overwhelming sense of dread that it’s just too hard, it’s just not going to work, and “I just can’t do it” is an absolute fallacy. There are people out there in the community that can help you get what you need in a much faster way.

I want to point out—and probably this is the biggest takeaway, the biggest secret, and it’s a sad truth but it’s a reality—is that I would say 50% of all jobs that people have in cybersecurity were never really posted. Or, if they were posted, the candidate had already been identified. That’s why, sometimes, when you apply to these jobs, you get ghosted. It’s because the job was actually never really open; it had already been hardwired for someone.

Now, how do you become that someone who gets it hardwired? Well, you have a professional network. People know what you’re interested in, and people know what kind of value you bring because you’re establishing who you are. You’re establishing that you’re a good communicator and you’re establishing that you’re putting in the work and effort.

When I personally—I’m a CISO, so I hire staff and stuff—when I need to hire someone, I need them as soon as possible because I have problems today. So I’m much more likely—like 100%—to ask my network if anyone knows anyone than I am to go to market, because I don’t have time to go through HR, honestly, and deal with an open call and all that. I will go there, but that’s my final backstop, not my first stop.

Manoj Tandon
So it sounds like you’re advocating that you have to create your own personal brand and do a little bit of marketing. Those are things that a lot of technical people are deeply uncomfortable with.

Gerald Auger
Yeah, but I think that there’s a lot of opportunity to do it in a way that resonates with the individual themselves. You’re deeply technical? Okay, so maybe you start doing a couple labs. Especially if you’re trying to get into the industry, chances are you’re doing practical labs in order to get the knowledge to understand.

Just take five minutes and document what you did and post it on a blog. Then take a link to the blog and post it on Twitter and say, “I’m working on this.” Then, when people reply and say, “Oh, that’s interesting” or whatever, tell them, “I’ll be working on this next.” Slowly start building it.

It doesn’t have to be standing on top of the podium at the front of the stage yelling out, “I’m working on this!” You can do it in a way that resonates with you. That’s part of the trick. And like I said, if you join a community like Simply Cyber’s or any Discord server—I’m not just advocating for mine—you’ll see the way that other people are sharing knowledge.

It’s very low barrier, and imposter syndrome can take a back seat. Where you feel uncomfortable that you’re about to say something stupid because, at least in my server, if someone starts blasting someone for asking a question or saying something that is a little bit more junior, the person who is being toxic will be removed from the server. There’s no room for that. We all started somewhere.

Manoj Tandon
Everyone’s at a different place in that journey. That’s fantastic and that is great advice. I hope the folks listening do rewind the podcast and listen to that little section again, because there are some real tidbits there that can make a material difference in your career.

Switching a little bit, you were in Vegas; you were at Black Hat, I assume?

Gerald Auger
Yes.

Manoj Tandon
Give us the highlights. What were your observations from Black Hat this year that are relevant to the community?

Gerald Auger
Yeah, so a couple interesting things, especially if you’re a business. This year was interesting in that I spent more time in the business hall than I did at the track talks. I haven’t gone to Black Hat or Def Con since 2019 because of the pandemic. Typically, I’m like a talk hound. I go—I have certain speakers that I really enjoy attending. This year was much more business-focused. I’m basically an executive now at a company, so I have a little bit more responsibility around business relationships and business management. I had a bunch of work in the business hall.

A couple interesting things: it definitely seemed that there were way more businesses shooting the moon on their marketing budget, and I have to suspect that it’s because they haven’t really been spending money on marketing, so it’s been kind of loading up. There were a lot of really interesting booths this year.

It was really cool. We saw Jen Easterly and CISA there giving talks. She was at Def Con as well. I really appreciate that there’s been this push from the federal government, post-Biden’s executive order, about threat intelligence sharing and Zero Trust and all this other stuff. The way that CISA has manifested this is by putting Jen Easterly as the director of CISA. She’s got a really chill vibe. They’ve been making an effort to engage the public and private sectors a lot more.

Typically, when you get a senior government official, they’re dressed not like the attendees, right? They’re very formal, very starchy. The talk they give is usually very bureaucratic and like, “Okay, this is interesting, but not really adding value.” Jen is approaching it in a much more “I’m a member of this community, let’s work together for the better of everyone” way. I think that really resonating well. I appreciated that.

I really liked Black Hat. I mean, Black Hat is wildly consistent in the way it delivers. I know some people compare it to RSA. I think RSA is much more vendor-focused and less practitioner and community-based. Almost like CIOs might be more likely to go to RSA, whereas at Black Hat, it’s like CISOs, senior practitioners, team leads, and stuff like that.

Plus, Manoj, I’ve been in this game for a while—it is such a great opportunity to meet certain people that you’ve only dealt with remotely. Over the last two years, I really have encountered a lot of people and I noticed a lot of relationship building, handshakes, and “good to see you.” I couldn’t walk 10 feet without bumping into somebody. It was a really good vibe this year.

Manoj Tandon
That’s fantastic. Rekindle some relationships, and of course, the knowledge sharing there is tremendous. I mean, it’s been a while since we gave a talk there way back in 2017. This pandemic has really messed up a lot of our marketing plans and budgets, and we’re just now getting back to the recovery side of it. It’s taken this long, if you will.

But, you mentioned Jen from CISA. I guess one thing that I’d love to ask her, and maybe you have: from a government policy perspective, do you see anything coming down the pike, or are there any thoughts you have on postures our federal government should be adopting or policy positions that can help with what’s going on there in the world of state actors and bad actors that are state-sponsored?

Gerald Auger
Yeah. So, looking at ransomware specifically, since that’s such a front-and-center attack—if you will—cyber attack, or impact, or whatever—for years, it’s been these kind of “private” sector criminals that have some type of state sponsorship, allegedly, where they can kind of operate with immunity.

We as a country haven’t been able to really retaliate in any meaningful way. I do appreciate that the US government has been moving in two parallel directions. One is with policy around hardening systems, providing education, and making threat intelligence available, allowing for interoperability so tooling can basically take in—using like TAXII or STIX or something like that—tooling can take in IOCs and be able to pivot really quickly.

At the same time, we’re beginning to see—we just saw this last week—where sanctions are being placed, not in a way that affects the threat actor, but on the financial systems that the threat actors leverage in order to cash out or get payments and stuff like that. If you de-incentivize the ability for threat actors to use certain platforms, like Tornado, this Bitcoin cash mixer I’m thinking of specifically, it kind of reduces the juice for them to want to do business.

Plus, for better or worse—I don’t know if there’s some black ops stuff going on or clandestine missions—but we’re seeing major groups like REvil broken down. Right before the Ukrainian war thing, we saw Conti. Conti was the—or Wizard Spider—they were the front-runner on how you do ransomware as an enterprise. They were running a total mastermind criminal organized crime operation there.

Manoj Tandon
Yeah, and even today, they—

Gerald Auger
Yeah. If you look at Krebs on Security, he did a really nice five-part series covering the Conti leaks, which was basically one of the members of the Conti group who was from Ukraine. They came out publicly and said they supported Russia in this war, and then that individual released a whole trove of documents. You can see that they have an HR department, over 100 employees, and they have benefits. It’s bananas what’s going on there.

But if you hit them in the pocketbook…

Manoj Tandon
Yeah.

Gerald Auger
If you hit them in the pocket—I don’t think it’s like a 401(k) matching program, Manoj, or anything like that. I think it’s more about access and stuff like that and percentages of money. But if you hit them in the pocketbook—at the end of the day, if you’re going to operate like a business, then bottom line and revenue and all this are the numbers that you measure success with, if you’re a legitimate business.

If you can impact the ability for the money to work, then you impact the business, right? So I do appreciate that I’m seeing the federal government move in these two directions. We are seeing a little bit of wiggle room, but there’s no doubt that cybersecurity, or the cyber-criminal industry, is still winning, for lack of a better term. I don’t know if we’ll ever beat them, honestly, because it’s a cat-and-mouse game. They quickly adapt to what we come up with for defenses.

Manoj Tandon
Sure, but at the same time, if we continually make it harder and make ourselves a moving target, it’ll be harder for them to do what they do.

And you look at—I mean, we were just talking about ransomware. Ransomware as a Service is a real thing, as is access as a service, right? I mean, you can go on the black market and you can buy access into an enterprise, if you have the money to go do it.

Do you see those models evolving, or how do you see that changing? Or do you see insider threats becoming a bigger thing?

Gerald Auger
Well, it’s interesting you say that. Twofold. One, access for sale and then what was the first one you just said? Because I had Ransomware as a Service. Oh yeah, Ransomware as a Service.

Actually, it’s kind of interesting. Ransomware as a Service, I think, is getting more and more dominant. In fact, just a couple weeks ago, there was a Ransomware as a Service that made it even easier for people who don’t understand what they’re doing in order to execute.

So, real quick: Ransomware as a Service—basically, the threat actor operates the entire back end and all you have to do is execute a payload in your environment. They have made it even easier for that whole process to happen now. So I think that’s going to continue to happen.

I do think that you’re going to get people who have moral compasses that are all the way in until they realize what they’re about to do, and then they’re like… because not only are you making a conscious decision to be a criminal, you’re also taking the risk of a felony, right? And if you don’t know what you’re doing, then you have no idea how to cover your tracks to prevent people from finding out what you’ve done.

To me, I wouldn’t want to step into that cesspool, you know what I mean? Because you’re basically hoping that they don’t find you and, spoiler alert, digital forensics investigators can find you very, very easily, especially with something as noisy as ransomware.

Now, the other thing about purchasing access: this morning, interestingly, I run a daily cyber threat briefing every morning at 8:00 AM, and this morning we actually covered a story that is showing statistically—based on data pulled from the dark web—that sales of compromised access… like, I basically siphoned up a bunch of access and I’m going to sell it because I’m not going to jump in. Which, by the way, is really, really interesting from a criminal ecosystem—that now everybody has their specialty and they barter access for payloads and stuff.

We’re actually seeing sales go down. Now, the story attributed that to an increase in multi-factor authentication usage and the fact that threat organizations that were really leveraging stolen access, like Conti, have gone by the wayside. I’m of the opinion that it is the major threat actors that were taking advantage of compromised access that have gone down, not multi-factor, because I feel like in 2022, if you don’t have multi-factor authentication, what are you doing right now?

Manoj Tandon
There are a ton of small businesses, and we’ll get to that in a second, that do not have multi-factor.

Gerald Auger
I need to rent Bigfoot and get one of those 30-foot flags off the back that just says “MFA for all” and just go up and down the strip.

Manoj Tandon
Yeah. You’d be surprised at how many people do not have MFA. But those selling access, you’re saying that their demand has gone down? Demand for their services?

Gerald Auger
Yeah. Absolutely. And I’ll provide you a link to the story—it’s statistically-backed evidence to support that claim.

Manoj Tandon
And this is—again for our listeners—now these security brokers as a… do you know what the mix there is in terms of access brokers, I should say, where they have actually stolen credentials versus someone willingly providing them their credentials in exchange for money? Do we have any kind of indication of what that might be?

Gerald Auger
I do not know. If I had to guess, though, I would think that it would be like 20/80, because a criminal can siphon up… if they steal one credential, they’re going to steal a bunch of credentials, right? The phishing page is going to collect a lot. If you crack a database, you’re going to get a lot. Whereas it’s the one individual who’s like, “Here’s my VPN creds.”

So I think that would be the case. Obviously, people who aren’t implementing best practices. It’s interesting—I think MFA is more rampant; you’re telling me it’s not, but I think it’s more rampant. I think one thing that is not rampant that really needs to be—and I think it’s the adoption barrier that’s the problem—is password vaults.

I think password vaults would help your typical end user substantially because, right now, unfortunately, everybody just reuses the same passwords. When a database breach happens and someone gets a password, these threat actors have scripts that just run through the top 500 websites: Facebook, LinkedIn, Chase.com, and try your username and password. If you’re reusing passwords—I get it, it’s easy to remember, but it’s such a bad practice. It’s terrible.

Manoj Tandon
Well, and the industry is moving to more passwordless authentication, right? And it’s also the policies that surround MFA that we… even when it’s adopted, a lot of times they say, “Well, we have MFA,” and then their second factor is not something that’s very secure, or you can reset it by “Who was your first girlfriend?” or “Where did you go to school?”—things that are so easily guessable. If I go on someone’s Facebook page or get their social data, I can reset their password, and I’m not a cybersecurity engineer.

Gerald Auger
Yeah, I agree 100%. MFA is not a silver bullet; it just raises the barrier of compromise. That’s all it is. I will say some of the foolish things I’ve heard in my day—like being told that they do… I’ve done audits and stuff, and being told that they are using multi-factor authentication because they have a username and a password. I’m like, “You’re really missing the boat on this.”

Manoj Tandon
Well, the insurance business is driving a lot of this now in 2022, where a lot of people can’t get their policies, or if they want renewals, they have to implement certain things. Those guys are wising up slightly. I’m not going to give them a lot of credit because I think they have a long way to go, but…

Gerald Auger
Well, there are no standards in the insurance industry. You could get a 45-page questionnaire or a three-question questionnaire. It’s really all over the map.

Manoj Tandon
It really is. I’m hoping that the three-page questionnaire has gone by the wayside; I don’t know. But I think these companies, when you look at the insurers, they don’t have masters of cybersecurity on their staff, which is what they really need to start looking at how these policies are being issued. But that’s a whole—we could do an entire show about that topic in itself.

Gerald Auger
Yeah, but I will say to your point—for anyone who is, I guess, in industry or looking for certain interesting tidbits—I have seen multiple times—and I’ve been affected by it—where you can’t get budget for your information security program for whatever reason, and then the insurance company comes in and they up-charge your policy, 4x or 6x, and immediately the CFO wants to know what the heck is going on here.

They say, “Well, you don’t have multi-factor authentication.” “Well, what’s that cost?” “40 grand.” So now it’s a very easy discussion, right? You can either pay another 250 for a policy, or you can pay 40 for MFA, which actually helps us and saves you money.

Manoj Tandon
The scenario you pointed to has been a bit of a personal gripe in healthcare. Since you’ve written the book on this, I’d love to get your feedback. Anecdotally, at least in some of my experience with the healthcare industry, cybersecurity is very much a cost center when it comes to investing. They’d rather buy an MRI machine, which makes a lot of sense because that’s what they do, or a new X-ray machine or whatever other piece of technology they need to better healthcare.

There’s been a degree of reluctance in spending on what really truly needs to be spent for cyber. What are your—heck, you wrote it, I think you had a paper or your dissertation, “Flashlight in the Dark Room” theory, right? What did you find?

Gerald Auger
Yeah. Well, twofold. My dissertation research, which was an 18-month project book I had to write in order to complete my PhD program, looked at small healthcare practices—meaning 10 physicians or less on staff—in the state of South Carolina to understand why they were terrible at information security.

Because if you look at the numbers, small and medium-sized businesses are traditionally not good at security and can suffer breaches and stuff like that. They typically like to put their heads in the ground and hide. But what you’re talking about with this big spend and seeing it as a cost center: it’s two different things, and I think it’s based on the size of the org.

My findings in my research actually discovered that many of these organizations, just like many small businesses, outsource their IT operations to an MSP. They’ve got a one-person shop who’s doing it if they’re really small, or they’ve got a local vendor who supports them and probably 30 other practices in the region, with a team of four or five people.

The key problem—and this is why it was called “Flashlight in a Dark Room,” that’s the grounded theory observation that I made—is that these individuals who are running the business are clinical people. They are not IT people; they’re certainly not InfoSec people. When they sign up for IT services, they assume that cybersecurity is part of that service offering.

When you talk to the MSP, they say, “No, we’re executing on the contract. The contract says network uptime availability—five nines, right? The classic IT service agreement.” We’re like, “Yeah, we’ll do some cybersecurity stuff, but it’s not like we’re delivering cybersecurity. If there’s an incident, that’s not on us to do SecOps work or anything like that.”

So, the Flashlight in a Dark Room is basically these clinical practices walk into a dark room, they turn on the flashlight, and all they see is the risk that the flashlight illuminates. There are all sorts of creepy-crawlies all over the place, but they’re just looking at that and saying, “Protect that.” Unfortunately, for better or worse, HIPAA is typically what gets illuminated by the flashlight, and they think, “Oh, privacy, patient data—that’s where I need to focus.”

In reality, you’re taking credit cards, you are allowing BYOD, you’re using cloud-based systems for your electronic health record, and you don’t have federated authentication. So when people quit, they continue to have access to all this data. There are a million things going on that are wrong, and it’s because it’s in the dark.

That was my findings with that. If you want to comment on that, Manoj, we could talk about it.

Manoj Tandon
Oh yeah. It’s been in the papers. Several years ago, there was a urology practice—it was a small, maybe 10-15 physician practice. We can Google it and look it up. They didn’t even know that their records had been compromised. They found out, I think, through the FBI, who came knocking on their door and said, “Hey, by the way, your records are out there on the web.”

And not good. Not good. Well, as it turned out, it’s really hard to shut down or really materially affect a major medical system for a host of obvious reasons. But if you’re a small practice like that, it’s very easy to make an example of you. That’s exactly what the federal government did, and they actually ended up shutting down their practice because they couldn’t financially afford to stay in business anymore.

Gerald Auger
Yeah, it’s kind of funny that that was the reason. I do find that HIPAA fines are typically adjusted to be painful for the organization’s revenue, but not be formulaic where it’s based on the amount of records, whether you’re a $5 billion industry or a $2 million business. But yeah, it is the case.

We’ve seen ransomware operators shut down small businesses because they literally can’t afford to pay the ransom, and then they don’t have any schedules so they don’t know who’s coming in or who’s going out. They can’t bill, and basically they just go out of business because they can’t sustain not having revenue for seven or eight days.

Manoj Tandon
You’re exactly right. So what should that small business be doing? What are the ABCs to people who are listening? We do get a lot of small business folks that listen to this show.

Gerald Auger
Yeah. Well, there are a couple things. You might not have the finances to hire a cybersecurity professional, and I wouldn’t expect a small business to have an on-staff cyber professional, but outsource one just for an audit to come in. It’s going to be tough to vet them if they’re qualified or not, but have an audit come in and just kind of do what we would call in the industry a risk assessment, right? What are my risks? What should I be doing, etc.

So that’s one. But if you are really strapped for cash and you just want to do what you need to do, talk to your managed service provider, your IT people. Tell them you want multi-factor authentication. Tell them that you want to understand how to use a password vault. You can buy them pretty cheap now; they’re cloud-based services for your whole business, and you can share—you can have your own account but then share if you have shared passwords for file servers or something like that.

Another thing that I see people make mistakes on—and it’s understood—but you really shouldn’t be doing this is having an Excel file with all the usernames and passwords for all the different systems and vendors and stuff like that. That is like a radioactive asset; you really don’t want that. That’s why you should have a password vault, but if you can’t have a password vault, then change the permissions on that file. Don’t have that file; save it locally.

Not having critical passwords… I mean, it’s just a million different things, but I see that quite a bit because, at the end of the day, you’re trying to deliver patient care, you’re trying to move as quickly as possible, and you’re trying to be frictionless. Basically, the password is slowing you down because you have to type it in. So, by reducing the friction by writing it down, you reduce the friction, but you make it so much easier for threat actors to get in there.

Nowadays, the final thing I’ll tell you is, whatever your email gateway is—like if you’re using Office 365—find out or confirm that you have some type of email filtering going on. O365 is good; some of the bigger ones like Proofpoint and Mimecast are pretty good. I don’t know the availability for small businesses, but if your MSP is just using an out-of-the-box, vanilla mail server, then that’s a problem, because phishing emails account for like 80% of the initial attack factor. They can get into your organization and compromise your billing coordinator.

Why would your billing coordinator know anything about phishing attacks? So, educate your staff as well.

Manoj Tandon
Well, and there are some… there’s a free tool that I’ll mention. There was a company called InfoSight—and I’m going to say “was” because they got bought up by Datto recently—but I think you can still go on their website and download and run an assessment of your Microsoft 365 environment. It’ll give you a lot of gaps and findings and compares it to the CISA standards.

If you’re a small business, it’s a great way to get a simple check—I won’t say it’s a pretty thorough thing—and then go back to your MSP and have them reconfigure it, or you’re going to have to outsource a security professional to do it. Those things need to get done. There are a lot of free resources out there for people.

Gerald Auger
Yeah, I’m actually dropping one in chat for you right now from a company that I am friends with that is in the same market as me called Soteria. They actually have an O365 PowerShell script. You just run it and it does a full audit on your O365 instance.

Manoj Tandon
That’s fantastic. We’ll actually put this in the show notes as well and put some links so that people can come back and refer to it and get at these tools.

Because those configurations—there’s a myth, and sorry for changing topics so rapidly, it’s just the timeframe that we have here, but you talked about securing the cloud, which is its own beast, but people assume that “I’m using Microsoft 365, so Microsoft has already done all my cybersecurity,” and we’ve talked about this a lot on the show: “Or we’re using Amazon, so we’re secure.”

Oh my god, I kid you not. I’ll let you comment on what you would say to those people, because I’ve kind of beat on them quite a bit, but please.

Gerald Auger
All right, so there are two things. If you’re listening to this, the TL;DR is: the cloud makes it so everything’s accessible no matter where you are. But that means that it’s accessible to the bad guys no matter where they are. It’s not that far a leap; it’s a simple step to understand.

Platforms like AWS, Azure, and Google Cloud are great, and yes, they handle—if you think of it as a cake, they handle the lower levels of the cake, and you’re responsible only for the top tier. You’re responsible for just putting the frosting on top, which is fine.

The problem you have to understand is: you are responsible for securing that top layer. You don’t just get to write off security. You don’t have to patch the underlying operating system, but you are responsible. Now, what am I responsible for? “Give me the juice, Jerry.”

Yeah, here’s the deal: This is where the term Zero Trust comes from essentially, but there are two things you’ve got to be mindful of. One is identity. People are logging in to these services. People are writing API scripts that interface with these services on their behalf. If you’re doing any of that, this is why it’s so critical for multi-factor authentication. You need to make sure that whoever’s logging into that account is, in fact, who they say they are, completely validated. That’s wicked important.

Now, I will point out that some of the services have gotten a bit better as far as, you know, if you log in from the same machine every day, it won’t challenge you for that second factor. If you’re logging in from a geo-location—like, I always log in from the East Coast, so if I log in from Taiwan, it requires multi-factor, but otherwise no. So there’s some adjustments for reducing friction. But not enabling multi-factor because the CEO says it’s inconvenient is not acceptable, and there are 300 stories that you can Google in like five seconds that will show why that’s a bad example and why you can tell the CEO, “We’re not going to do that.”

Okay, so that’s identity. Also, by the way, some of these platforms do have the ability to look at user logins and stuff like that, so you are responsible for audit review. Again, if you’re a clinic—to use your healthcare example—if you are the dermatologist, yeah, it sucks because you’re not going to be the one who wants to look at that or fully understand that. But it’s incumbent upon you, since it’s your data and your business, to make sure someone’s doing it. I don’t care if it’s the MSP, or if it’s your nephew and you hire him as an intern—whatever it is, someone’s got to look at that.

The other thing… Manoj, on my podcast I have a soundboard over here that I run, and I have one that says “Spicy.” I won’t play it on your stream, but when databases, file servers, etc., are misconfigured… the keyword that you would want to Google, listen to this, pause it, and Google it: “S3 bucket leak.”

S3 buckets are basically databases that Amazon provides through AWS, and there are different ones all over the place, but S3 bucket is an easy one to Google. They’re inherently secure; they hold data very nicely. But if they’re misconfigured, meaning that they’re open to anyone on the internet, which happens all the time, then anyone on the internet can get in.

A lot of times, like this urologist example you mentioned earlier, there’s a not unrealistic chance that their data was stored in an insecure S3 bucket. It doesn’t mean it was set up wrong; it doesn’t mean that it wasn’t doing what it was supposed to do. This is the conflict between IT and InfoSec. IT was doing what it was supposed to do; it was delivering the files, people could access it, people could edit it, whatever. But the problem is, it was also accessible by threat actors, and that’s the problem.

In short, user access needs to be controlled, and configuration needs to be done deliberately and not haphazardly.

Manoj Tandon
Well, those are basics, and I would be surprised at how many big businesses get that wrong. Small businesses are a problem—they just don’t have the resources. But we’ve known a major production house, whose movies you have seen, I guarantee you, that was taking the “final cut”—no pun intended—of their digital edits of a major motion picture and, if you knew where to look, it was publicly available.

Gerald Auger
Yeah, it’s no good. And something you just said, Manoj, that’s so true: I feel like people want it to be some elite, zero-day hack, something that’s made for Hollywood. Basic fundamentals are what you need to do. Basic fundamentals get you 80% secure. That’s why it’s the basics—because they work, and everybody should be doing them.

Manoj Tandon
Yeah, if you did the top five… Exactly. I’m not even going to the—I think they’re at 18 now, right? They collapsed to 18. But if we just go top five, and you did those well, I think you would be a tough target. It might be better to go shop elsewhere, if you’re a ransomware attacker.

And I guess that’s the other thing: I often get a lot of executives that come back and say, “I bought this technology, and that solves the problem. Now we’ve shored up our cybersecurity program.” But I think there’s a fundamental disconnect there in that they’re not understanding that the risk profile is a result of business operations, which isn’t going to be solved by one technology.

Gerald Auger
Yeah. Unfortunately, I see this all the time as well. Executives and the “business”—to group them together, the business—they will stroke a check for an appliance in a heartbeat, because they think that they can just cut a check, solve a problem, and move on to what is actually interesting to them.

That’s not the case, and I’ll tell you why. One, when you buy an appliance or whatever, you need to integrate it into your environment appropriately. More often than not—and this is usually the major fail—you need to put a resource on it to either maintain it or to actually operate it.

It ends up becoming a shared responsibility: “Oh, I’m already doing 110% of work because you bought some appliance three months ago that you’ve got me working on. Now you’re going to say Jerry will handle it? It’s an InfoSec tool, Jerry will handle it,” and I don’t have the cycles.

So what ends up happening is it gets spun up—usually a professional services company will help you deploy it—and then it kind of works for a week, and then it slowly starts degrading in value. Then it’s just there, and you’re not really realizing the value of it. That’s assuming that they didn’t buy an appliance that was duplicative of some service you already had. That happens all the time too.

Manoj Tandon
Well, I think… you’ve professionally worked as a CISO. You know how many companies actually go through a strategic mapping of their assets, of what they’re trying to protect, and then map the gaps that they have with their current infrastructure in that protection. Then, only then, do you make a technology decision.

So there’s a reason why cybersecurity vendors spend more on marketing than they do on the product, right?

Gerald Auger
Thank you for saying it—I didn’t want to piss anybody off, but that’s an absolutely correct statement.

Manoj Tandon
Yeah, exactly. It’s all about hitting the links and talking about how we are different and why you need us. But it’s never… unfortunately, it is work. It is a grind in order to do the assessment, to do the audit, to figure out really where your gaps are and what kind of solutions fill those gaps and how they map over your existing tech stack. It’s work, and you know what’s easy? Cutting a check. That’s really easy.

Well, okay, so then let me… this is my last question. How, when you cut that check, you have forgotten about your entire employee base, which is the biggest cybersecurity asset that you actually have. How do you bring them into the fold? Because you need to.

Gerald Auger
Yeah, absolutely. I mean, there are a couple technical controls, and those are easy for people to wrap their heads around because it’s almost boolean, like on or off. But, to me, security awareness is easily one of the most valuable risk-reducing controls you can implement.

By the way, it’s typically low budget. Yeah, you can go shop for one of these big vendors that sells complete solutions and stuff, but a lot of times, in my experience and in my opinion—I’m very passionate about this particular topic—those corporate solutions are so tone-deaf.

Because the staff—like, okay, I’m Carl, and I’m in research and development—when I have to do this annual training, it doesn’t feel like it’s applicable to my business. Maybe it’s like my industry or something like that, but it just feels like “click, click, click, click, click,” and you’re not really doing anything.

The point of security awareness is to modify behavior. That’s all it is. I know that might sound like the Manchurian Candidate, but it’s not. It’s literally—in my experience—most people want to do the right thing. In the absence of knowledge, they will make their own decision on what the right thing is.

So, you need to engage them. I am a huge advocate of not just the value of awareness training being risk reduction, but the way to do it. So, to me, I like to touch—this sounds funny, but I like to touch my end users once a week, or once every two weeks. Send out quick hits, like very, very specific things. “Hey, we’re not going to do a 60-minute talk about all these things. What I am going to tell you right now is that…”

Okay, so a perfect example happened a couple weeks ago. There was some Android malware that got installed by 10 million people, and it would sign you up for a $35-a-month premium service. A lot of people might not notice a $35 charge on their account, or they might think it was their kid, their spouse, or something like that. But this threat actor was making 30 million dollars a month.

Manoj Tandon
Great gig.

Gerald Auger
Yeah, exactly. But, okay, what do we do with that knowledge? Well, here’s a tightly packaged thing: “Hey end users, if you or someone you love is using Android and they installed one of these three apps, there’s a high probability they may have been compromised. Have them check their bank statements, have them uninstall the app, and just be aware that this is how malware can get on your Android phone.”

Now, you shape it a little bit for end-user consumption, but at the end of the day, I’ve given you something actionable and I’ve given you something personal. When I come at you later on about not being allowed to install a certain app on your mobile device, you’re way more invested in wanting to go with me on that journey than if I just sent you a blanket “This is policy now; do what I say and piss off.”

So to me, security awareness has to be short and concise. It needs to be constant; consistency is key. And then—this one a lot of people miss—it needs to be personally relatable.

I never tell my end users, “Hey, we need to do this for the business, we need to protect the business,” because in 2022, yeah, you can have some loyalty, but this isn’t General Motors in 1950 where I’m going to get a gold watch in 40 years. I’m a mercenary just like everyone else; I want to get paid.

So if I make it personally relatable: “Hey, you need to put MFA on your email because it’s trivial to reset your bank account if I get into your email. I don’t want you to get robbed. Tell your friends and family over Thanksgiving break.” People were like, “Yes!” And then, when you roll out MFA in Q1 of next year, they’ve already got the app on their phone. They’re already indoctrinated into best practices, and that’s the key.

Manoj Tandon
That’s a brilliant answer, and I can’t agree with it more. That’s fantastic. So in the last couple seconds here, Jerry, give us whatever you’d like to plug. It’s your platform, whatever you’d like to highlight here.

Gerald Auger
Well, thanks. Yeah, I’ve really enjoyed my time on the podcast and talking with you today, and I appreciate if you got to this part of the podcast—thank you for listening. I definitely enjoyed this experience.

If you are interested in getting information on a daily basis, every morning at 8:00 AM Eastern I go live. You can go to simplycyber.io/streams to see the Daily Cyber Threat Briefing. As I said, I cover the top cybersecurity news stories of the day every morning, and the important thing is after each story, I stop and tell you how you can operationalize it professionally.

Or, if you’re looking to get a job in the industry, you will be asked, “How do you stay current?” I guarantee you that’s a question. You can cite the Daily Cyber Threat Briefing, and if they ask you any scenario-based question, chances are we’ve talked about something on the channel and I’ve given you my analysis on what it means.

And to get back to the security awareness thing, too, I will regularly, if there’s a certain story, I’ll say, “Hey, this one is perfect for end users; here’s how I would shape the message.” All right, let’s go into the next story. So it’s really actionable intel, and there are about 100 people every morning in chat sharing ideas and being inclusive, getting back to that networking piece that we talked about in the beginning.

So, simplycyber.io/streams. I hope you can join us.

Manoj Tandon
Fantastic. We’ll also include that in the show notes as well. Jerry, we appreciate your time. You’ve been fantastic and, you know, whenever you have your next project, don’t be a stranger around here. Drop in, let us know, and I’d love to even do a 10-minute short with you and keep people abreast of what’s going on.

Gerald Auger
Yeah, absolutely. Just stay in contact, man. I definitely had a great time. Looking forward to the next one.

Manoj Tandon
As did we. Thank you so much.