Security Confidential S9 E1 Justin Daniels

Manoj Tandon: This is your host, Manoj Tandon, and welcome to another episode of Dark Rhino Security Confidential. Today we are honored to have Justin Daniels join us.

Justin hails from Atlanta. He is a corporate M&A attorney who has a deep background in cybersecurity. In addition to those credentials, he’s a TEDx speaker. He does a podcast with his wife, Jody, called She Said, He Said, so check that out. We’ll put that in the show links.

He has a very unique skill set that he uses to collaborate with executives to create and implement a multi-layered set of strategies to better manage cybersecurity and data protection. He has also authored a book, which we’re going to get into. The book is titled Data Reimagined: Building Trust One Byte at a Time. We’ll put the links in the show notes for the listeners.

Welcome to the show, Justin. Thank you so much for being here. It’s an honor to have you.

Justin Daniels: Yeah, thanks. I’m happy to be here.

Manoj Tandon: Well, you got to be a little specific. That’s an open-ended question. In regards to what area is “what’s up” in cybersecurity? A lot of things.

In our world, we don’t know what the cat’s going to drag in today. It’s always something new, I can tell you that for sure.

Justin Daniels: That is absolutely true.

Manoj Tandon: Okay. So, an attorney who’s an expert in cybersecurity—that is, an M&A attorney who is an expert in cybersecurity—that’s a very interesting combination. We have to ask you a little bit about your origin here. How did you do this? What got you from M&A to being an expert in cybersecurity? How did that happen?

Justin Daniels: The bridge would be all of the work that I do in technology because I am an M&A corporate transactional attorney by training, but I almost exclusively work in the technology industry.

You can name any industry. I do work in Fintech and SaaS, and then I have the more exotic stuff that I do, which would be autonomous vehicles, drones, and I run my firm’s digital asset and blockchain practice.

But overlaying every single one of those technologies is, of course, cybersecurity risk. Unusually, I have also handled my fair share of ransomware cases as well as BEC compromise that leads to wire fraud. So I’ve got a broad background in how I’ve come across dealing with cyber risk.

Manoj Tandon: Yeah. You said two things there: ransomware and BEC compromise. So I have to ask, in your experience, what are some of the things that have gone wrong that cause these attacks to be successful?

I’ll even put a little context behind it. Data Breach had an article just yesterday, I think, on the fact that—and I think statistically they looked at the United Kingdom—over 90 percent of the ransomware attacks in the UK could have likely been prevented with some basic hygiene and good practices. So I’m curious what your experience has shown you.

Justin Daniels: The pivot from the office to remote work was a huge impetus to cause ransomware cases to go through the roof.

What I mean by that is, at many companies, the IT person is your de facto security person. So you have one person doing two roles that are inherently at odds with each other.

The reality is, when people pivoted so quickly to the remote workforce, the CEO and the management are like, “Hey, you’ve got to keep the computers running. If you don’t have computers up, we can’t run our business.” And so that’s what the focus was.

Then, “Oh, we need to implement multi-factor authentication for all our remote users.” Well, that got put on the checklist and never made its way to the top until, of course, that was the exact method that the threat actors would use to get into the network.

So number one issue is specific responsibility for cybersecurity that’s not the IT person, who reports directly to the business owner or the board. That’s number one.

Number two is some of the things I’m sure you’ve talked about or alluded to, which is multi-factor authentication, patching, and using the most up-to-date software. As you said, simple blocking and tackling. Things that, if you did, you would increase your cyber posture by more than 50 percent.

But companies are busy. They’re going to the marketplace, and spending money on your digital infrastructure is not the most exciting thing. It’s very analogous to some of the physical infrastructure issues we’ve had with bridges. Nobody is getting excited to spend four thousand dollars on windows in their house, right?

Cybersecurity is the exact same thing. And so the results, particularly with this pivot to remote work that we’ve had in the last couple years, are all but inevitable.

Manoj Tandon: Given the fact that—and this is just conjecture on my part or an opinion—I don’t think that this remote work is going away anytime soon. I think that genie is out of the bottle. So there’s a degree of permanence that’s going to likely continue into the distant future here.

Do you think that will have a change in corporate culture and their outlook towards cybersecurity? And for some of these conversations where before, as you said, it’s like changing your windows—who gets excited about that?

Justin Daniels: I don’t know that that alone will change corporate executives’ attitudes. What might start to change it is, for example, the SEC has put new rules out around cyber that are in the comment period.

Once those are finalized and those actually go live, maybe, depending on how much those things are enforced, you might start to see changes.

Manoj Tandon: And will they apply only to public companies?

Justin Daniels: They will, but here’s the trickle-down effect. They really, as you said, apply to public companies, but they really are targeting the third-party vendors of these public companies.

Because as we know, cyber risk isn’t just the risk that your company has. Your security hygiene is only as good as your crappiest vendor’s security.

If you are an enterprise company or other privately held company and you want to do business with these big companies, they’re going to start taking the requirements the SEC is imposing on them and impose them on you.

Manoj Tandon: Here’s the thing: we’ve had so many guests on this show where third-party risk has been a hot topic, and it is absolutely a hot topic. I don’t know that anyone’s really figured it out a hundred percent.

But when that kind of burden is placed on a third party, the big question always comes up: how is that going to get paid for? Because the vendor is like, “Fine, I’ll do it, but I’m going to jack up my prices because I just can’t afford to do this.” That’s usually not acceptable to the buyer in many cases. So there’s that tension that comes into play.

Is there an amiable solution here of being able to accept some of this risk and saying, “Given the nature of what that supplier does, maybe we don’t have to impose it”? It’s not a one-size-fits-all kind of scenario.

Justin Daniels: Really what you’re talking about now is your third-party risk management program.

As I like to say, if you’re an e-commerce company and they’re going to touch the website, then they may get what I like to call the cyber proctology exam—that’s very invasive.

However, if, like my law firm example, our website goes down, it’s a bad day; we’re maybe a little embarrassed, but it doesn’t impact operations. Now, if our document management system went down, that’s a wholly different story.

So you’re talking about putting together criteria to put vendors into different tiers that result in different levels of cyber hygiene being required.

Then I’m sure you and I can have a whole discussion over how you might transfer risk via insurance, because that market has changed significantly in the last 18 months. But I think the days of a company trying to say, “We can’t afford cyber anymore”—well, you’re in a digital 21st-century economy. It’s part of the cost of doing business, and there needs to be an educational component.

I’ll give you an example: when you leave today and get into your car, what do you now do when you turn your car on? You don’t even think about it anymore. What do you put on?

Manoj Tandon: The radio?

Justin Daniels: Besides the radio.

Manoj Tandon: Your seatbelt.

Justin Daniels: Yes. Okay, but when you and I grew up, did your parents really wear seatbelts?

Manoj Tandon: No. I don’t think you even had a shoulder belt in our car.

Justin Daniels: Well, in the ’60s, Ralph Nader was the one who really sounded the alarm. Of course, nowadays we’re ensconced in airbags and all kinds of other technologies.

But pursuing my metaphor a little further: what changed? Why are we now wearing seatbelts today and we don’t think about it? It’s just part of our daily routine. We have 24 hours in a day now; we get in a car, it’s part of our routine, we buckle up. Why?

One, we’ve had education. Mothers Against Drunk Driving really had a compelling, thoughtful campaign that made people aware that putting your seatbelt on saves lives and we should do that.

We also have laws now in almost every state, except for maybe Vermont, that require you to wear a seatbelt.

Your viewers are probably asking, “Why are we talking about seatbelts? I came to learn about cybersecurity.”

The answer is, how do we make cybersecurity the digital seatbelt of the 21st century and really get people to think, “Okay, when I’m developing my new product”—Zoom would be a great example—”I build security into the design of the product because that’s just what you do,” instead of what we do nowadays, which is: it’s an afterthought until, of course, we have the inevitable breach.

Manoj Tandon: Medical device market too, Justin.

Justin Daniels: Like I said, cybersecurity overlays every technology that you can pretty much think of nowadays. It just overlays it.

So how do we get to the point where, in development, the C-suite is like, “Show me the specs. How are we dealing with security? How are we dealing with privacy?”

But we don’t have that right now because most startups need to do two things: they need a Minimum Viable Product, the MVP, and they need customers.

I’m going to use Zoom as a great example. When Zoom came out, listeners, do you remember: did Zoom have any kind of requirement for a password? No. Why not?

Because the key to Zoom scaling and becoming what it’s become is it was convenient and easy to use. Even the installation of a password made it a little less convenient, and the product development people and the executives were like, “No, we don’t want a password because if this isn’t easy to use, people aren’t going to use it.”

But then what happened? It created the opportunity for the Zoom bomber, and then of course it came out that they gave information to Facebook. So they got sued under law, settled for 85 million, and then at that point it’s like, “Oh, let’s call in the security professionals.”

But at that point, it was just the cost of doing business. Why didn’t they just build that into the product at the inception? Because we’re not at the point yet where security is built in by design. It’s an afterthought. That’s why it needs to be a shift in our thinking and our laws, so that it is by design.

Manoj Tandon: That was actually a question later on down that I had for you, that you just jumped right ahead to.

With these companies, a lot of times these cyber breaches and the ensuing legal and financial jeopardies that followed are just viewed as a cost of business.

Justin Daniels: Right.

Manoj Tandon: I guess part of the education may be if the consumers—if we all decided, “You know what the cost is going to be? We’re just not going to support that organization anymore”—that might actually make a material change in people’s thought process.

I don’t know if there are other things that you deal in trust practice all the time. Can things be done to change that mindset of the company?

Justin Daniels: Part of how I’m trying to change that mindset is—and I know we’ll talk about it—the opening chapter of the book Data Reimagined. It’s a takeoff on Dickens. So instead of ghosts of the past, we use the Ghost of Data Collection Present.

What we do is think about, in a day, how much data gets collected. So if I get up in the morning and I say, “Hey, Alexa, turn on the sports radio station,” maybe they share that information with the local sporting goods store who wants to sell me something.

Then I drive out of my neighborhood; there might be a camera that notices when I’m leaving because it’s designed by the local municipality to find digital license plates. Then I go and park my car, but I don’t need a ticket anymore because the camera at the parking deck scans my license plate.

My point is, people don’t appreciate how much data is collected about them before they’ve even had a cup of coffee in the morning. If they appreciated that better, they may start to think, “Well, what are they doing with this data? Where does it go?”

Because when we collect data now, you’re creating the opportunity for someone to want to deny you access to it or to steal that data, because that data has now become valuable. It’s the new digital gold, so to speak.

I think if people start to be aware… there was a funny John Oliver show about Edward Snowden. Without getting too graphic, they were polling people and they’re like, “Well, what if people could go on the internet and get pictures of your private parts?” And that’s when people went nuts. They’re like, “No, I wouldn’t ever want to have that.”

But yet people don’t appreciate how much data is collected. My point in all this is, if you start to have more of an appreciation of what data is collected about you and what’s done with it, then people might start to have a different opinion.

Because if you think about it, we’re not far from being a surveillance state with all of the data collection that goes on. Your refrigerator is telling you what inventory you have in the fridge.

Manoj Tandon: That’s right.

Justin Daniels: But people aren’t connecting all of those dots, and that I think has to happen because every one of the CEOs you’re talking about is also a consumer. So how do they feel, wearing the dual hat of business person and consumer, about what happens to their data?

When they hacked into Jeff Bezos’s iPhone and they found pictures of him with his girlfriend or whatever, even a guy like that has issues there.

Manoj Tandon: But we’ve all traded resilience for convenience. It’s a thing that’s happened. We’ve made that choice. It might be unconscious, but the choice has been made.

Justin Daniels: Yes, we are a society that worships convenience, and we haven’t thought about what are some of the unanticipated costs.

Just like when we outsourced manufacturing because it was cheaper and made things cost less, the pandemic made it clear that there were costs. They were just hidden. When we had a black swan type event with the latest pandemic, those issues came home to roost.

So if you take the grid down for five or six days in a major city because of a cyber attack, you’d have riots.

Manoj Tandon: Oh, you’d have sanitation problems. Ted Koppel wrote a book on that, Lights Out.

Justin Daniels: Exactly right. That’s, to me, where the education part of this is so important, because people aren’t really thinking about this, and they should.

Manoj Tandon: That’s data privacy, which I guess the question is: is that an oxymoron? Can you have privacy of data in the way things are laid out right now?

Justin Daniels: Not really, but now you’re seeing it going too far and then the backlash.

I like to think of data privacy and cybersecurity like peanut butter and jelly. They aren’t exactly the same thing, but they’re very complementary. It’s kind of hard to talk about one without the other because normally, when you get into cyber issues, we’re talking about either sensitive or other kind of private type information.

So the two of them are very much interrelated. It’s hard to talk about security and not touch on privacy because that’s the kernel of what the concern is.

I don’t want unauthorized people to have access to all kinds of personal information about me. Or it could be the government’s latest plans for a nuclear submarine or something like that.

That’s the society we live in. We are wholly dependent upon computers, meaning cybersecurity is of national security importance and a strategic business enterprise risk.

But as you pointed out, there’s still a credibility gap. What CEOs say in the news because they know they have to, versus the actions they actually take—there’s a gap there. Hence the credibility gap.

Manoj Tandon: There are a couple thoughts on that now, but the first one that comes to mind is: is that credibility gap created simply because our colleagues in the cybersecurity industry—and I’m going to blame them a little bit here—are often speaking a language that the CEOs just don’t understand?

For the CEOs, the decision makers, it’s very hard for them to have the context of what the ask is going to result in, and how it will result in the reduction of risk, because most cybersecurity professionals do not speak that language.

Justin Daniels: It’s funny that you say that, because whenever I handle a ransomware engagement, that’s one of my main roles. I act as a filter to translate what the forensic people are saying so that the C-suite people, who have to make a business decision, can make a business decision.

That continues to be a problem, because you can be very smart, but if you can’t explain and articulate in a manner that the business people understand, you’re really speaking a different language. You’re right, that is one of the issues.

Whenever I’ve gone to speak to different forensic firms that have had me come and speak about how breach counsel can partner better with the forensic firms, that’s usually at the top of the discussion.

That’s something that has to be learned by really smart technical people: how to translate what they’re saying to business people. That continues to be a persistent problem.

If you want to exacerbate it, put people under time pressure with incomplete facts, with their business on the line, and tell them, “Yes, let’s make good decisions.”

Another funny joke I have is: think about it, and since you’re from Pittsburgh, this will be an easy analogy for you.

Manoj Tandon: Go for it.

Justin Daniels: Let’s say the Steelers finally make it back to the Super Bowl; this whole desert we’re going through ends. But a few days before the Super Bowl, Mike Tomlin comes out and he says, “You know what, we’re just going to show up on Sunday and play defense. We’re not going to have a defensive game plan. We’re not going to practice. We’re just going to show up.”

Can you imagine what would happen on Twitter? People would want his head examined, and most of them would want him fired.

Manoj Tandon: Yes.

Justin Daniels: But at the same time, most companies have no cybersecurity incident response plan. They never practice. They just figure when the ransomware or data breach happens, we’ll just show up and we’ll play. You can see what the inevitable results are.

Manoj Tandon: A lot of people are relying on their insurance company. I can’t tell you the number of people I’ve talked to about that where they’re like, “Well, you know, ultimately this is why we have insurance, and the insurance company is going to have to step in and make it right.”

Justin Daniels: Those days are over, because in the last 18 months, what’s happened in the cyber insurance industry is a convergence of three things due to the high claims: higher premiums, much higher, much tougher underwriting—

Manoj Tandon: I’ve had people call me with 150 to 200 percent increases.

Justin Daniels: So much higher premiums and tougher underwriting. Guess what you get for all that? You get less coverage.

Manoj Tandon: You can get much less coverage. Correct.

Justin Daniels: The days of saying, “Oh, I’ve got cyber insurance coverage for that,” and relying on that, those days are long over.

If you even want to get insurance and you don’t have multi-factor authentication and you’re not using it throughout your organization, good luck. You’re basically uninsurable by 80 percent or more of the industry.

So what we are seeing is: one, we have some market forces because of what’s going on in insurance; we are seeing some things around the law, like with the SEC regulations; and so we are starting to see certain things start to bring cyber into a sharper focus.

But we still have a long way to go, because every week on the blockchain there’s a big hack. Zoom is a recent great example of a big company in that industry where security was an afterthought.

Until those things change, unless we see some type of 9/11-style cyber breach, things are going to continue the same way.

I honestly think—and that’s what Jody and I wrote about in our book—that if you are proactively thinking about privacy and cybersecurity, that is an opportunity to build trust with your customers and really have a competitive advantage.

Manoj Tandon: That’s a very interesting concept. So you’re saying that you could, in the marketplace, gain market share from your competition.

Justin Daniels: Manoj, give me an example: what do you like to do for fun outside of podcasting and other stuff? Give me an example. Do you like to run?

Manoj Tandon: Okay, run. Great example.

Justin Daniels: Let’s use running as an example to flesh this concept out. Obviously, to run, the pair of shoes that you wear as well as your moisture-wicking shirt matter a lot to you. You want it comfortably.

Manoj Tandon: Yeah.

Justin Daniels: Let’s say, for example, you like Nike shoes. Fine, why not use Nike as an example?

If there’s something about Nike shoes—how they fit or what the brand stands for—if they have a relationship with you where they’re collecting your data and they can send you, “Hey, Manoj, we’re coming out with these new technology running shoes. You can really measure certain things about your run, your strides, and all this other stuff”—that’s cool to you.

Maybe you develop a relationship where you want to give Nike more information because you like what you’re getting from the brand. You’ve developed a relationship; you like wearing their shoes.

But let’s say there’s Reebok, using them as just an example. They collect your data, and then all of a sudden you get ads for shoes for toddlers. Why are they sending you ads for toddlers or stuff you didn’t ask for? Where are they getting that information?

Maybe they’ve bought data from other places that’s not respecting what you’re looking to get from the brand. So the data that you collect and how you interact with your customers… you know how many emails you probably get from brands you’ve never heard of?

Manoj Tandon: Oh man, yeah.

Justin Daniels: They’re trying to sell you all kinds of stuff for shoes or running. I’m like, “I’m not interested. How’d they even get this? Delete.”

Manoj Tandon: Yeah, it’s immense. I don’t even look at them anymore. It’s just: delete.

Justin Daniels: Think about how much of a higher target rate you would get if you’re thoughtful about the data collection and you look to establish a relationship with Manoj about how you’re using his data to send him things about something that he’s passionate about, which is running and fitness and whatnot.

But for too many companies, it’s just kind of a carpet bomb, when people are really looking for authentic, meaningful relationships. That’s what we have nowadays. The days of getting your Sears Roebuck catalog are over, so now we’re online. Companies are trying to figure out how to have a relationship with you, and data collection is a big part of that.

How they protect your data becomes important and could be a way to establish a meaningful relationship where you want to share and you want to give to that brand.

Manoj Tandon: Here’s the thing with that. You picked the running example. I’m going to say anything that we interact with, actually any product that we buy: are we genuinely giving informed consent? In tech, we’re not.

The consumer is really not able to give it. Let me further elaborate on what I mean by that.

In medicine, when you go to the physician and if you need something, you are always given a plethora of information to get informed consent from you.

In tech, when I buy an Alexa, I just get a EULA that’s 30 pages long that I will never read and I can’t wait to hit “accept.” I buy a Samsung TV whose EULA says they can turn the camera on at their discretion. I just hit “accept” because I want the TV to turn on. This goes on and on and on.

When you purchase tech, you are giving legal consent, but it’s really not informed consent. So first of all, how is that possible? How do they get away with it? I want to know from a legal mind’s aspect: how can companies get away with it when you can’t actually get away with that in medicine?

Justin Daniels: It’s the difference between HIPAA… well, let me step back. Let’s talk about the legal framework that we have for privacy and cybersecurity in this country.

First question: do we have an overarching privacy or cybersecurity federal law in this country?

Manoj Tandon: No.

Justin Daniels: No, we don’t. What do we have instead? We have a sector-based approach. You identified HIPAA. HIPAA governs healthcare. We have Gramm-Leach-Bliley to an extent for financial services.

But when you start talking to me about TVs, Alexas, and Teslas too, now we’re outside of certain sectors that have heightened concerns over privacy.

When we get down to privacy concerns, the way this country has handled it, in contrast to Europe for culturally different reasons, it’s: company first, government second, consumer third.

Manoj Tandon: I could agree with that completely. That’s not debatable.

Justin Daniels: But that’s the policy consideration. Now what you’re starting to see is California leading the way, trying to push back on that some with the California Consumer Protection Act (CCPA) and then the California Privacy Rights Act (CPRA) to try to change that balance.

Because now as a consumer you have the right to see your data, opt out, or have it transferred or deleted. We’re starting to see the pushback.

But you’re starting in this country from a policy perspective of “company, government, person.” Europe is fundamentally different. They view that privacy right as pretty fundamental, as codified by GDPR. That’s because during World War II they dealt with the Gestapo and all kinds of stuff during the Cold War. Their historical experience is very different than the one that we have in this country.

Our privacy laws, in my view, or policy considerations reflect the fact that people aren’t very aware of how invasive all of this data collection has become.

Manoj Tandon: That’s exactly right, and they’re agreeing to it.

Justin Daniels: So it’s not like any of the companies are doing anything illegal. I’m telling you, “I’m going to gather this data,” and you’re agreeing to give me consent because you want the TV, right? Because you want the TV, you want the Alexa.

What might happen in laws is requiring, instead of opting out, that you have to opt in. That’s kind of the European approach, where they don’t collect the data unless you opt in.

Our approach is now, under certain California laws, you might have the opportunity to opt out. But to your point, everybody wants convenience, back to what we said before. I’m going to click “OK” because I want my Alexa to turn on; I want to have my Samsung TV, and I don’t read the boilerplate in the privacy policy as to what they collect.

If you and your listeners want to have fun next time you go to a store—my wife and I actually did this—we were looking at a smart bed. The salesman’s touting about, “Oh, it’ll tell you how many times you turned over in your sleep.”

Because my wife’s a privacy professional and I’m involved in security, we said, “Well, who collects this data? Who do you share it with?”

And he’s like, “Oh, we’re a big company. Someone else has this handled.”

Oh, wrong. We went and got their privacy policy, and lo and behold, we read some articles where in the past this particular manufacturer had had issues and been called upon by certain consumer groups regarding what they were doing with that data.

It’s amazing to me, but if you have a tracker that’s collecting your data about how many steps you take and your heart rate, is that HIPAA data or not? It’s not.

I can backtrack a lot of things from that, but that kind of data is not protected under HIPAA, because HIPAA was passed in the late ’90s. It’s never been updated for what reasonable people would think is health data, because a healthcare provider didn’t collect that data; they weren’t involved in providing you a healthcare service.

So that’s why I’m saying you have the convergence of all these disparate puzzle pieces. That’s kind of where we stand right now. It seems kind of crazy, but that’s the reality.

Manoj Tandon: It sounds like, without consumer pushback and some policy changes, the consumer is going to have a very hard time connecting the dots and acting on it. But hopefully the listeners here get that, and they should try the little experiment you just suggested. I think that’d be a heck of a lot of fun.

Justin Daniels: It’s actually hilarious because you listen to the marketing people, and the key part of privacy is the intersection between privacy and marketing.

Marketing people hate privacy because they want to grab everyone’s email address. Market, market, market, market. But what they don’t appreciate is, if you want to Zoom bomb me with marketing stuff, what is Manoj going to do? And I’m doing it too. Delete, delete. “I hate this brand. All they do is harass me.”

As opposed to an approach where you’re more targeted and you’re thoughtful about the data collection because you found out Manoj loves to run. That’s what you’re dealing with. That’s the real intersection—between privacy and marketing—and then security obviously layers over the top of that.

Because what’s the key component of privacy? Preventing unauthorized access. But there’s the other part of privacy, which is what data are you collecting and what are you using it for?

To your point: what’s Alexa doing or the Samsung TV doing with that webcam while I’m watching whatever program I’m watching?

Manoj Tandon: People should read their agreements and they might be surprised what’s actually written in there. So they’re hiding it in plain sight under a barrage of legalese. And that to me is not informed consent, but I get it.

Justin Daniels: Informed consent from a pragmatic perspective versus a technically legal one… I see them all the time; I’ve written them.

The “I accept” button is a way to give consent, but the bottom line is what they’re telling you is: “Well, if you don’t want to consent to my terms here at Amazon, you don’t have to use Amazon.”

They’re giving you a choice, but most consumers don’t view that as a choice because they want to use Amazon.

Manoj Tandon: Yeah. It’s not a choice. Some of these things are getting stuck into our day-to-day lives at this point.

Justin Daniels: Sure. Well, I’m sure you’ve had somebody on the show to talk about, “Hey, I’ve got AWS, my security is great.”

Manoj Tandon: Oh, you know what, that’s a whole can of worms. There are probably five or six episodes on that topic that various very smart people have talked about.

So let’s talk about your book. I want to make sure we give some time to that.

Justin Daniels: Yeah, absolutely.

Manoj Tandon: Data Reimagined: Building Trust One Byte at a Time. What was the impetus behind the book? What sparked your wife and yourself, Justin, to do this?

Justin Daniels: She’s a privacy professional, and during the pandemic we started a podcast together: She Said Privacy, He Said Security. Both of us speak separately, but people asked us to speak together, so the Jody and Justin Show did that.

Then one day we’re sitting in Boulder last summer and Jody’s like, “What do you think? Should we write a book?” And I started thinking about it. I was like, “Yeah, we should do it.”

Then we came up with what would be something we could contribute that’s meaningful, and that’s where we came up with the idea of the thesis.

Manoj, using you again as an example—

Manoj Tandon: Please, go ahead.

Justin Daniels: The way that Nike treats your data is, by extension, the way that they treat you. Because this data collection has become so pervasive that, by extension, how do you want to treat your customer? Well, it’s how you treat their data.

We came up with the idea that we would write a book around how we get executives who are non-technical to understand that, “Hey, I should care proactively about privacy and security because it helps me create trust and build a relationship with my customer.”

Every business is trying to build a relationship with their customers so that they buy whatever that product or service may be. What they don’t appreciate is they’re implementing data privacy practices—or a lack thereof—and security practices that are ensuring they are eroding trust.

If you don’t believe me, think of Facebook, Google, or others where this has all become an issue.

So we said, “Okay, how can we write a book that is really accessible?” We tell stories: the digital seatbelt is one; the day in the life with Dickens is another. To make security and privacy accessible, because as you correctly pointed out, Manoj, there are so many really great professionals out there, but they sometimes find it difficult to communicate privacy and security concepts and ideas in a way that non-technical business people can understand.

So we tried to cut through that and make the book very entertaining and accessible. Plus, you get the husband and wife banter to boot.

Manoj Tandon: And that’s the bonus. That’s the icing on the cake.

Justin Daniels: Oh yeah. When people have Jody and I come speak, they get the entertaining husband and wife banter. So it’s educational, but there’s a degree of entertainment to it because of that.

Manoj Tandon: I was only able to skim the pages. I wasn’t able to read the book in all honesty. But I looked at some of the chapters, and they’re very intriguing to me; they could be a show in themselves.

One of the chapters is “Hacks and Hackers.” Tell us about that.

Justin Daniels: Oh, I bet the favorite part of that chapter for a lot of people is where we talk about… back when you and I went to high school, it was the jocks who were the rulers of the school.

Manoj Tandon: Sure.

Justin Daniels: Their literal muscle was street cred. Well, now we live in a society where it’s kind of flipped.

The person who’s sitting behind the computer screen, who doesn’t care about working out—with the touch of a button, they can wreak havoc.

Manoj Tandon: Yes, they can. They can shut down the stadium if they want.

Justin Daniels: That’s right. In that chapter, I write: those folks, they don’t respect the CEO. They think he or she is a complete idiot. They use hacking to basically demonstrate that they’re superior. That’s their version of street cred.

It’s not how many pushups they can do or how many yards they can run; it’s who can they hack.

Manoj Tandon: That’s a really good observation. There is absolutely a percentage of people that would fall into that category.

Justin Daniels: Yeah, look at Lapsus$ and some of the hacks that they’ve had, where these young kids go out and do this. To me, they’re burnishing their street cred to prove they can do it and basically laughing at these highfalutin CEOs. They basically think they’re idiots.

Manoj Tandon: That’s one thing that’s unique about the cybersecurity “cat and mouse” game, if you will, versus other types of crimes that take place.

These bad actors are very intelligent. They’re using their intelligence for what we may consider nefarious purposes. For them, it may be money, it’s street cred, or it may be a matter of national pride, depending on where you’re in the food chain.

A lot of people forget that these folks are very intelligent, and they are looking for vulnerabilities. They are looking for flaws in the process that are exploitable. That’s different from your run-of-the-mill criminal in many ways.

Justin Daniels: Very true. Now we have software as a service, but we also have ransomware as a service—customer service to help you with the decrypt after you pay, and if you get hit a second time, you get a discount, right?

You’re right. Technology is tools. It’s only as good as the person ultimately who is wielding it.

So when people talk about artificial intelligence as the solution to cyber risk and all this, I’m like, “Okay, well it depends on who’s using the AI.” Because AI could be used by threat actors to further galvanize and create harm, as opposed to the white hats who want to use it to protect.

It’s just an agnostic tool. It’s only dependent upon who’s using it.

Manoj Tandon: I’m so glad you said it; now maybe people will believe it.

Justin Daniels: It just goes back to the education part, and that’s why a podcast like yours is so great. You’re putting things out there so people can consume it.

The challenge we have is it’s harder than ever to find good sources of information. One of the unintended bad consequences of social media and other things is it gives a bullhorn to anybody who wants to say anything. So the amount of crapola that’s out there is exponentially higher.

Manoj Tandon: Well, yeah. A little bit of using some gray matter can do wonders to filter that out, but again, that’s not convenient and we’ve already traded for convenience. So there you have that.

Justin Daniels: And that’s the root problem of cybersecurity: we as a society worship convenience, and cybersecurity as yet is not very convenient.

Heck, even getting someone to use an SMS for digital text to do multi-factor, that’s too much.

Manoj Tandon: Oh my God, they complain about it. At the checkout counter at Rite Aid, you can bypass the PIN on your chipped card. So why have the chipped card?

Justin Daniels: Exactly. But in Europe, you actually can’t do that. There, they force us to put the PIN in every single time.

Manoj Tandon: Let’s talk a little bit about the last chapter in your book. We’re talking about “inconvenience,” and this is a big one: defense in depth.

Tell us about it. What is it? It’s a subject that’s near and dear to my heart. But as an attorney, what is it?

Justin Daniels: From my perspective, defense in depth is back in the Middle Ages: the gold was in the castle.

Manoj Tandon: Yes.

Justin Daniels: So the castle had a moat, a drawbridge, a relief army—all kinds of multiple layers to protect the gold.

Manoj Tandon: That’s right.

Justin Daniels: Now in the 21st century, all the gold is digital. So how are we then using defense in depth? Much like the castle, it’s just the same old idea being brought forward using new technology to have MFA, endpoint detection, awareness training in place, and incident responders in place.

The solutions are out there. It just comes down to the will to want to implement them and accept a level of inconvenience.

Think about it: one thing to get your money stolen, but let’s say people want you to start flying autonomous drones that replace a pilot, or an autonomous vehicle. If their cybersecurity is not good, people are literally putting their lives on the line.

It may not be as easy for those industries to get around cyber, because losing all your money is a horrible thing, but that’s not the same as crashing a drone or crashing an autonomous vehicle.

Why that chapter is there is to explain to the non-technical business reader—that’s what the book’s designed for—to help them think about that in terms that are understandable to them.

That to me is one of the key things we tried to do in the book: make it relatable.

Manoj Tandon: That’s what makes it so valuable. When you look at something like defense in depth, you’re absolutely correct in your description of it.

The trouble you see is, again, the IT professional a lot of times—and I’m generalizing, I know there are exceptions—a lot of times they’re going in saying, “We want Justin to buy a new firewall; we want to go in and buy this new DLP offering.”

The decision maker has no idea what’s the strategy behind defense in depth for his organization, and where this component-wise item is actually going to fit in, and what difference it will make in his landscape of risk.

Justin Daniels: I think that’s right.

Manoj Tandon: We never, therefore, a lot of times, get to defense in depth. A lot of times it becomes a thing of convenience.

I’ve seen, especially in small and medium businesses where we spend a lot of our time, they’re looking for—I hate to say it, but—a convenient solution. “I’ve got a vendor that… I’m going to buy one technology and it does it all and I’m done.”

That’s a disaster just waiting to happen. Not because the technology is bad, but the thought needed to make it all work properly and become part of the fabric of the company has really not been done. It hasn’t been put in.

Justin Daniels: Yes. So I’m actually coming home to Pittsburgh next week to speak at a conference at my alma mater, Duquesne, where I went to business and law school, to talk about vulnerabilities with smart contracts and digital wallets.

Here’s yet another industry, on top of drones and autonomous vehicles. Blockchain is making all the same mistakes, because phishing is even more of a devastating way to attack a smart contract or a digital wallet.

The moment they phished your private keys, they can steal whatever they want, anytime they want. And it happens like that.

The point is, the threats keep evolving. We keep evolving technology, but it all comes with what I call the handmaid: a new cyber threat that has to be managed.

To your point, you can buy a technology at a point in time, but as the threat evolves, you have to change with it. You can’t really keep your 2005 network 10 years later because, unlike a fine wine, that network doesn’t get more robust with time. It’s just a ticking time bomb.

I represented a private equity firm and handled a ransomware event for them. I’m like, “How old is this IT infrastructure when you invested 129 million dollars?” It was like 2002. I was like, “Well, you should have just hung a sign on it that said, ‘Please ransomware me.'”

Manoj Tandon: I’m sure that went over like Led Zeppelin.

Justin Daniels: Right. But you would think in this day and age, how did that not get addressed in due diligence? Yet it happens.

They were focused on buying stuff. That’s another issue in the context of M&A, which I do a lot of: people want the deal to get done. They don’t want to spend the time and the effort or delay it by getting into all this stuff around cybersecurity.

Manoj Tandon: Marriott and Target, Yahoo, Neiman Marcus… I can go down the list. A graveyard.

Justin Daniels: Yes, there’s a graveyard of M&A deals. I may have to borrow that from you. Thank you for that. But yeah, I see that all the time.

Manoj Tandon: On that note, I wanted to give the last couple minutes here for you to plug whatever you would like our listeners to know about things that you’re involved with that are coming up—book events, anything. Are you and your wife, Jody, making appearances? What’s going on that you’d like our listeners to know?

Justin Daniels: Our book made it to number four on The Wall Street Journal list of best new ebooks, so that was pretty exciting. That was validation in the marketplace that maybe our little book had some interesting thoughts.

Manoj Tandon: Congratulations.

Justin Daniels: We’re excited about that. As I said, next week I’m speaking in Pittsburgh at Duquesne University on security issues around smart wallets and smart contracts, digital wallets. We’re having a moment there, it’s okay.

Otherwise, it’s just the message to your viewers that we really need to start to think about the amount of data that gets collected and make people aware of that. Because if people start to realize that, then the things from privacy and data security, I think, flow from that.

Think about the next time you go to a restaurant and they say, “Hey, we’d like you to pay this way. We’d like your email address.” Then you might ask the person, “What are you doing with this email?” or “What are you sending me?” And then you might politely say, “You know what, I don’t want to give you that email.”

Start to be thoughtful about when you give that information out, because so much of marketing is about getting your email address. Start to thoughtfully decide, “Do I want to sign up for this app?” Because when they give you free stuff, they really just want your information.

Manoj Tandon: Yes.

Justin Daniels: I think that’s where people need to start thinking differently.

At the end of the day, we live in a society where we have to go buy stuff and they want to sell us stuff. Be a little bit more discerning about who you want to trust with your information and who you want to buy stuff from. At the end of the day, to some degree, you have a say in that.

But at the same time, you also want to be making your voice heard that the policy of “company, government, consumer last” is not to your liking.

Manoj Tandon: I couldn’t agree more. Couldn’t agree more.

Well, Justin, I know we’re at the hour here. It’s been a pleasure to have you. There are a thousand more questions. We were trying to cover everything, which we did as much as we could.

We’d love to have you, and hopefully you can have your lovely wife join us as well next time. Come back on the show and we can get even further deeper into some topics here.

Thank you for your time today. I had a great time.

Justin Daniels: Thank you so much, Manoj. Take care.