Close the Cybersecurity Backdoors Hackers Use to Target Your Business | Entrepreneurship | Abed Hamdan | Presented by Bitdefender

Entrepreneurs often assume hackers only target big companies, but small businesses can be easier targets than they realize. A weak password, compromised vendor, or poorly managed access point can expose customer data, disrupt revenue, and damage trust. In this episode, presented by Bitdefender, cybersecurity consultant, Abed Hamdan explains why your business might be an attractive target to hackers and how entrepreneurs can protect their business from today's cyber threats without needing a full-time security team. In this episode, Hala and Abed will discuss: (00:00) Introduction (00:00) Why Small Businesses Attract Hackers (07:55) How Hackers Target Small Businesses (14:40) How Abed Entered the Cybersecurity World (18:22) Non-Negotiable Cybersecurity Habits for Businesses (28:57) How Cyberattacks Can Destroy a Business (30:29) Cybersecurity Protection on a Small Budget (32:41) Defense in Depth for Small Businesses (40:30) AI, Deepfakes, and New Cyber Risks (54:27) Insider Threats and Employee Access Risks (57:42) Finding the Backdoor in Your Business (1:03:04) What to Do After a Cyberattack (1:05:17) From Cybersecurity Content to Entrepreneurship Abed Hamdan is a cybersecurity consultant, content creator, and founder of GRC Mastery. He has more than two decades of experience helping organizations strengthen their security, manage risk, and navigate complex cyber threats. His expertise spans cyber defense, governance, risk and compliance (GRC), and security strategy. Known online as UnixGuy, Abed has built a global cybersecurity community of more than 600,000 followers by making complex security topics practical and accessible. Sponsored By: Keep your small business safe with Bitdefender Ultimate Small Business Security. Save 30% when you go to bitdefender.com/profiting Resources Mentioned: Bitdefender: bitdefender.com/profiting Abed's Training Platform, GRC Mastery: grcmastery.com Abed's YouTube: youtube.com/@UnixGuy/about Abed's LinkedIn: au.linkedin.com/in/abedhamdan Active Deals - youngandprofiting.com/deals Key YAP Links Reviews - ratethispodcast.com/yap YouTube - youtube.com/c/YoungandProfiting Newsletter - youngandprofiting.co/newsletter LinkedIn - linkedin.com/in/htaha/ Instagram - instagram.com/yapwithhala/ Social + Podcast Services: yapmedia.com Transcripts - youngandprofiting.com/episodes-new Disclaimer: This episode is a paid partnership with Bitdefender. Sponsored content helps support our podcast and continue bringing valuable insights to our audience. Entrepreneurship, Entrepreneurship Podcast, Business, Business Podcast, Self Improvement, Self-Improvement, Personal Development, Starting a Business, Strategy, Investing, Sales, Selling, Psychology, Productivity, Entrepreneurs, AI, Artificial Intelligence, Technology, Marketing, Negotiation, Money, Finance, Side Hustle, Startup, Mental Health, Career, Leadership, Mindset, Health, Growth Mindset, Passive Income, Online Business, Solopreneur, Networking

• 0:00Speaker 00

  There's a really famous story on the news. They created a dating app for women's safety. But then turned out that app, they took their passport details and all their information. Turned out this app was valedicated with zero security. It got hacked and it put women's safety in danger.

• 0:15Speaker 01

  Wow.

• 0:15Speaker 00

  Usually women get targeted, like someone leaks explicit videos of an individual. And well, that video is completely deep fake and it has been happening. They always target the vulnerable, they always target the young. It is a problem and we need some kind of a strict regulation.

• 0:30Speaker 01

  We're joined today by Abed Hamdan, founder of GRC Mastery and content creator, who's known as the Unix guy online. He brings more than two decades of experience in cybersecurity and risk.

• 0:42Speaker 00

  So we want to use AI. We want to be on top of the new technology. But we also need to stop and think, what is it that we're using AI for? What does the AI have access to? And more importantly, where's my data going?

• 0:54Speaker 01

  What's one thing that entrepreneurs are doing where a hacker is going to say, this is just way too easy?

• 0:59Speaker 00

  Something I see frequently is a founder says, oh my God, we went live last week. You wouldn't believe it. We expected 200 clients and now we have 2,000. This tells me that this team is extremely busy. They can barely keep up. This is a really quick telltale. There are other things that.

• 1:15Speaker 01

  How worried do we have to be about AI agents and their ability to hack our companies or their cybersecurity threats?

• 1:22Speaker 00

  There are many issues with AI agents. The first one is.

• 1:27Speaker 01

  This episode is brought to you by Bitdefender, a global leader in cybersecurity. Have you ever received an email that looked like it came from a bank or a trusted vendor, asking you to wire money immediately? Small business owners get hit by scams like this all the time. And one click can cost your business everything. Bitdefender Ultimate Small Business Security keeps your devices, passwords and team safe, even if you don't have an IT team. Protect your business with Bitdefender Ultimate Small Business Security. Save 30% when you go to bitdefender.com/proffiting. That's B I T defender.com/proffiting. Now to help us better understand the business of cybercrime and how organizations can protect themselves, we're joined today by Abed Hamdan.

• 2:10Speaker 01

  Abed, welcome to Young and Profiting Podcast.

• 2:13Speaker 00

  Hi, Hala. Thanks for having me.

• 2:15Speaker 01

  I am really looking forward to having this conversation about cybersecurity. I feel like all business owners need to protect their businesses. And with AI, cybersecurity is becoming more important than ever. But let's start at the very basics. For the entrepreneurs tuning in, what is something that you think they fundamentally don't understand about cybersecurity?

• 2:38Speaker 00

  Entrepreneurs usually make, I think, a couple of assumptions about cybersecurity. I think first, the first assumption they make is about the attacker. So they think the hacker is this person in a hoodie in some basement. Or they go the other extreme and they think the attacker is some really sophisticated sort of spy agency or foreign government. And as a result of these two assumptions, they usually think, well, I'm an entrepreneur. I run a small agency or I run a small business. Why would anyone attack me? And unfortunately of the businesses that I help, it's usually after the fact. So they get attacked and they really sometimes underestimate the consequences of some cyber attacks.

• 3:21Speaker 00

  Some of them unfortunately can be business ending or it can have such a large cost that it may even be cheaper to just shut the business down. And this is huge everywhere across from like small business to even medium sized and in some instances even large businesses.

• 3:37Speaker 01

  Yeah, I always think of like really big companies like Meta getting hacked or Big of America or something like this. But small businesses actually can be attractive targets. Why is that?

• 3:49Speaker 00

  Hundred percent. In fact, think about it, if you were a hacker, Hala, if let's say you've just learned how to hack and you want to start, you know, legally hack, you naturally wouldn't go after Meta because that's such a difficult target. They invest so much in cybersecurity. They are at the forefront of everything technology. However, when it comes to small businesses and entrepreneurs, usually they're just focused on getting their product out. They are overworked and most instances also underfunded. So they can be quote unquote easier targets, but they also hold something really valuable. They hold what we refer to as privately identifiable information. So that's something that we classify as a critical asset.

• 4:34Speaker 00

  For example, a lot of entrepreneurs will have something like a customer database where they have the names and last names and phone numbers and sometimes the addresses. This is extremely valuable because what attackers can do, they can get that information and sell it on the dark web. It's actually extremely valuable. So that's a really key critical asset that lots of small businesses have. And unfortunately, sometimes they don't have the knowledge or the resources to protect that. The other thing, and probably the more important thing that small businesses have is that, well, like I said earlier, it may be a lot harder to hack something like a big bank or something like Meta, as you alluded to. However, the way to get into those companies is usually you hack their suppliers.

• 5:19Speaker 00

  So if that small business is a supplier for a bigger business, usually it's a lot easier to attack that small business and use it to pivot or use it to trust. So if you can compromise the email account of a small business, well, you can start sending malicious stuff using their email address. In fact, that's how most big businesses get compromised through their suppliers and they're usually on the smaller side.

• 5:42Speaker 01

  So interesting. I never thought about that. So we not only have to worry about our own security, we have to worry about the security that our vendors are doing for their own companies, which is just so crazy to think about. What are the main ways that small businesses are compromised? So we just talked about vendors for bigger enterprise businesses. How about small businesses? What are the main ways that they're compromised?

• 6:05Speaker 00

  So look, the way sort of hacking or compromise happen, there are actually so, so many ways. Most of them aren't even known to the public. They tend to be complicated. But the most common ways for let's say an attacker to gain foothold and tend to be the easiest way, it's what we refer to as social engineering. This is where the attacker pretends to be someone that the business owner knows or pretends to to give them something that they trust. So we really use the old age sort of trust relationship that we humans rely on. For example, as a small business, I could pretend to be one of their employees and send an email urgently say, hey, I've lost my account urgent. Please click on that link and help me out. So we apply time pressure.

• 6:49Speaker 00

  So we call that social engineering or phishing, which falls under social engineering. There are other sinister ways as well, but it all goes, it all comes back to really pretending to be someone else. So fellow entrepreneurs and YouTubers, a really common recent one is actually pretending to be a brand and offering a brand deal.

• 7:10Speaker 01

  Yes, I get so many of those.

• 7:12Speaker 00

  I've even helped like cybersecurity professionals who got hacked this way. And that's not, no shade on them. This is, this is just a testament on how good some of those attacks are. They can really pretend to be a legitimate brand and the website look exactly the same. There might be just a slight variation on the URL and sometimes it's something that your eye cannot see. So some of the alphabets, we can replace it with special characters and it's really hard to detect. So that's a really common way. There are more and more ways. For example, if you have physical access to the business, there are things you can install, but that's a whole other story. But when it comes to sort of the most common ones, it tends to be hundred percent social engineering.

• 7:54Speaker 01

  So let's really unpack this with a real example. If you could really just walk us through, let's say there's a company that has like 20, 30 employees, they're using the typical things Slack, cloud storage, Zoom. They might have vendors, different SaaS tools. Walk us through how they could get attacked and some of the things that could happen and how it could escalate.

• 8:18Speaker 00

  Yeah, I mean, just before I say anything, just disclaimer, hacking is illegal. What I'm about to say is for educational purposes, so please don't do it. But hypothetically, if I was to attack this imaginary business, the first step I would do is always reconnaissance. So I'll try to collect as many information as I can about that business. This includes their LinkedIn posts, how many people work there. I'll even draw like an org chart, see who's who, who's the employee, go on Instagram. They usually share everything. So I'll get a list of the individuals who work there, but more importantly, I'll get a list of the technologies that they use and also the product that they have.

• 8:59Speaker 00

  So once I get a list of that, the next step would be I'll start to craft things that they trust. I'm trying to social engineer my way there because it's a lot easier for me, like I said, to get an employee to do something for me as opposed to me trying to hack Microsoft and get inside their email. So what I will do is I'll try to mimic what their email looks like. And now that's really easy. I can literally vibe code that in like five minutes. It used to take a lot more time. The second thing is I'll see what vendors they use. So if they use so many SaaS applications, well, I could hypothetically go to the dark web and see if there is any information about those services. If there is a new vulnerability, it may not be patched. So I can, I could directly go and hack one of their SaaS services

• 9:44Speaker 00

  and get into their network. But let's say everything they use is secure. Well, I'll try to then attack, sort of target the employees individually. I'll usually target who may appear to be more vulnerable. Usually it's very busy individuals, very busy founders. They are more likely to click on something really fast. Sometimes I'll even, not I, but the hypothetical attacker may look at elderly parents and try to tell them they've won something. Because what happened, Hala, is if the elderly parent gets their email compromised, well, I can use their email to send stuff to sort of their kids. And they're more likely to click on them than if it comes from an unknown individual.

• 10:30Speaker 00

  Now, the final one that is very, very effective with entrepreneurs and all the startups that I don't recommend anyone to do, but I could simply purchase the product that they have and be a legitimate customer and just give their customer support hell. I'm like, it's not working. Help me. Hop on a Zoom call, do this, do. So the customer support individuals are very likely to say, well, I tell them my Zoom is not working. Please click on this so I can get them to click on something. And unfortunately, support individuals usually have a lot of access. So as soon as they click on something, I'm in. And I can continue pretending to be a legitimate customer, which I am, close everything so they don't suspect that something is happening. And then I'm in the network.

• 11:14Speaker 00

  Then I'll start to slowly and surely take over everything. But that's more or less how I guess a lot of hackers would actually approach it.

• 11:22Speaker 01

  That's so frightening. It's so frightening that this could be happening. And I guarantee you that so many entrepreneurs tuning in are now realizing how big of a deal this is and how little they're probably protected. So what is one thing that with our cybersecurity, when you're looking at small businesses, what's one thing that entrepreneurs are doing where a hacker is going to say this is just way too easy?

• 11:45Speaker 00

  I mean, there are a number of things and I'm gonna start with the big business and then go down to the small one. A really big telltale, even for me as a consultant, if a company is hiring me to check their security, the first thing I go on LinkedIn and I just see who works there. If that organization is sort of midsize to large size and I see that they have like one person that's called quote unquote IT person that's doing everything, this is a sure sign that this person is overworked, probably doesn't have enough time to do everything security wise. So I know there is a high chance that they may not be doing everything they need to do. So that's a quick telltale for me. The other one would be, I'll, believe it or not, I'll go on Instagram and

• 12:29Speaker 00

  something I see frequently is a founder says, oh my God, we went live last week. You wouldn't believe it. We expected 200 clients and now we have 2,000. This tells me that this team is extremely busy. They can barely keep up. And it's a lot easier to do things with them that, you know, I'll put a time pressure. Hey, I'm a customer. The app's down. Help me. Log into my computer, do something for me. This is a really quick telltale. Now, more than that, there are other things that I wouldn't say small business owners sort of do, used to be more common in the past. So things like not having two factor authentication or like old practices that they still exist, but not so much nowadays. So systems have gotten better, thankfully.

• 13:12Speaker 00

  But as a result, because we have better systems, better IT setups, we can produce a lot faster. And with speed comes compromise. And not just in cybersecurity. You probably have seen it, Hala, where organizations or entrepreneurs or small businesses, they release something, but they haven't done their due diligence from a legal point of view. They haven't gotten everything reviewed and they say, well, we'll do it after the fact. So these kind of things may have large impact and in some cases, large consequences.

• 13:40Speaker 01

  This episode is sponsored by Bitdefender, a global leader in cybersecurity. Many small business owners lack dedicated IT support, making them easy targets for cyber criminals who steal data, money, or sensitive information. Bitdefender Ultimate Small Business Security is built specifically for business owners like you. It protects all of your team's devices, scans for phishing and scams, manages passwords, and even checks the dark web for leaked info. Unlimited VPN allows your team to work securely from anywhere. The dashboard is super simple. I set it up in just minutes. I add my whole team. And now everybody is covered, whether they're in the office or the studio or working remotely.

• 14:21Speaker 01

  Bitdefender makes cybersecurity easy so you can focus on what really matters, growing your business and serving your customers. Protect your business today with Bitdefender Ultimate Small Business Security. Save 30% when you go to bitdefender.com/profting. That's B I T defender.com/profting for 30% off. Bitdefender.com/profting. I want to understand how you know so much about cybersecurity and hacking. And I learned from studying you that you got into this when you were like a teenager. And you were really exploring, you know, how does hacking work? And I'm curious to understand, like, where did this all begin? Tell us the story.

• 15:00Speaker 00

  Yeah, I mean, not to show my age, but I'd say I started perhaps late 90s, early 2000s. And at that time, and especially where I was living, internet was new. It was a novelty. It's the new thing. Internet, for those my age, internet cafes were a thing. So you'd go to an internet cafe, you pay per hour and you start exploring and there wasn't much to explore. So it really started with chat rooms called the IRC chat rooms. And within that I discovered, well, people were sharing files you can download. There is a music file that was new to me. And then there was this thing called hacking. It coincided with me watching a movie called Hackers.

• 15:43Speaker 00

  It was an early Angelina Jolie movie. It is fiction, but it really opened my eye. Like, hold on. This is a thing. Like, you can actually do that. So as a teenager, and as you do as a teenager, you start imagining things. Oh my God, I could hack an airplane and fly myself everywhere. These imaginary scenarios that are not real, but like as a 15 years old, this is everything. Then as I sort of quote unquote do research, sort of find movies, I find another movie about someone called Kevin Mitnick. Late Kevin Mitnick, he is the most famous hacker in the world. At that time, there was movie, not just one, I think more than one movie. One was in German, one was in English. Of course, I'll watch with subtitles. He, the things he did were incredible.

• 16:28Speaker 00

  He would hack phone lines. He would jam radio signals. He was on the run by the FBI. And the movies, of course, made it so glamorous. So all I could think of like, oh my God. And that was a time when we would call people on phone line. So I'm like, oh, I could hack my friend's phone line. I could do these pranks. So I wanted to learn everything. I'd go to these chat rooms and at the time, Hala, things were a bit different in the sense, if you ask for help, people start swearing at you. It was not a friendly time, unlike today. So I had to learn certain things the hard way. I got myself hacked multiple times, but long story short, I sort of went into the right direction, started learning an operating system called Unix, hence where my nickname came.

• 17:13Speaker 00

  And actually, a fun sort of useful anecdote, my website, unixsky.com is few months older than google.com. So I go way back. Yeah. So that's where it all started. Then I got my first job, started, studied things at university that were completely useless. Got my first job, but I continued learning and I still do that to this day, even after consulting for so many years. I enjoy it. I like to learn. I stay curious and experienced, of course. I've done this so many times. So much so that sometimes I can look at something and like have an educated guess that, oh, maybe you can look here.

• 17:53Speaker 00

  Let's just start this way and take it from there. But yeah, it's been a continuous learning and experimenting journey and it's a lot of fun.

• 18:01Speaker 01

  Your entrepreneurship journey is like really interesting. So we're going to spend time at the end of the conversation and really just unpack. How you turned educational content into this entire career and business? And you've done such a great job, like really owning this niche and this lane and helping so many people in their IT careers, especially in Australia. So since we have this incredible consultant in front of us, a lot of the people tuning in are entrepreneurs. We're small business owners. We don't have endless budgets. We have a lot of information that might be vulnerable, but you know, we're not this huge company. But like you said, that makes us actually pretty attractive.

• 18:39Speaker 01

  So what are the few things, let's say three things that we should absolutely not compromise on when it comes to our security? What should we be investing in and where do we begin?

• 18:50Speaker 00

  This is challenging because it may slightly vary between businesses. But I'd say the first one, non-negotiable is always two-factor authentication. Luckily, we live in a day and age, everyone knows what that is. So when you log into your email, sometimes you get an SMS, says, is that you? Enter a code. The preference is always to use something like a Paski or the Authenticator app. Even few years ago, this wasn't rolled out to everyone. We had to have difficult conversations. It tends to really, really reduce the risk of cyber attacks, not to zero, but it's really important. And within that, no exceptions. So if you have a busy executive or someone precious in the team that says, I hate that, tough luck. This is a non-negotiable.

• 19:35Speaker 00

  This is like, this is like having a building and having a fire exit. It's not a conversation that businesses should have. So this should be there, rolled out for everyone. That's number one.

• 19:45Speaker 01

  For every single platform that we're using or just email?

• 19:49Speaker 00

  Excellent point. It is meant to be for every single platform. However, with platforms now, as you log in, Hala, you notice that it tells you, use your Gmail to like, use the same credit. Like if you log in, use it. So this is called single sign-on, which is essentially you've already logged into your email. Your email is trusted. So we use that as a trusted token to get into apps. So that is, that's perfectly fine. You still consider that as someone who used that. As long as the app is not asking you for username and password and you're just entering and getting in. If it's asking you to use the email that you've already logged in, that is, this is the same thing. So single sign-on have made that a lot easier. So instead of having an Authenticator app for everything, some of them will use your email.

• 20:33Speaker 00

  However, like even for me, my Authenticator app is really large. So it happens, I have it with everything, unless I can reuse my email, which is fine. It's just to get it out, to get us out of just username and password. Because if the hacker have the username and password, it's game over. So we just make it a lot harder. The second one, which is also related to credentials, is a password manager. So having a password manager is really, really important. No matter how complicated we make our passwords, the human tendency is for us to reuse the password everywhere. And that's extremely dangerous because your company may be secure, not hacked, but the local cinema might get hacked. And guess what?

• 21:17Speaker 00

  People use their work email and work password to log into the cinema. So hackers usually, when we do the reconnaissance step, when we try to collect information, we actually see if your password is out there. Doesn't matter if someone have the same name. We try to first use that and see if we can get in. So a password manager, really essential as a business, have some sort of enterprise solution with these passwords, where you have a complex password everywhere. And they're really convenient because you can have it as part of your browser. So you're literally just copying a password that, that you want to reuse. This is the second one. The third one, if we just narrow it down to three, is our key critical assets. We need to understand this could be customer information. It could be intellectual property.

• 22:02Speaker 00

  For example, you're on a podcast. I'm sure you have the same a method to make an amazing podcast. So that's intellectual property. Let's say it's in a Word document. I would restrict access to that. And that even includes employees. Make it on a need-to-know basis. If someone needs to access it, we ask why. You get a time restricted access, but that's it. It shouldn't be free access to everyone. And that could get more complicated. Like I worked with a beverages organization here in Australia and some of their intellectual property was recipes for their drinks. And those recipes needed to be in a secure vault with encryption and with really secure passwords.

• 22:42Speaker 00

  But also, once you log in and get access to that, you shouldn't have that login indefinitely. It should be time restricted. So those would be the three things. And if you allow me a bonus one, like I said.

• 22:54Speaker 01

  Yeah, give me, I was gonna say, what's the four and five? Because clearly I can tell it's not just three things we need to worry about.

• 23:01Speaker 00

  The fourth one is similar to, it's just get a professional opinion. For example, small businesses, when they draft a contract, they get legal advice, right? So you get someone to review it, a solicitor. Likewise, with cybersecurity, it doesn't have to be something massive. Get a small company, preferably something local where you can reach out to them if things go bad and say, I just, like guys, a couple of hours, whatever, $2,000 or it could be less, could be more. Check, make sure we're doing everything right. Give us a recommendation. And sometimes all they do is just check that you're doing everything. You may miss something. So they just give you professional advice. Say, you know what? You're doing 99%. That's perfectly fine. And as the business grow, that sort of consultation or that assessment can grow with you.

• 23:44Speaker 00

  If you have a software application you're releasing to the market, obviously that needs more scrutiny. But if someone is just, let's say, an Instagram content creator and they just share advice, they may not need that. I hope that gives small business owners a thing to talk towards.

• 24:00Speaker 01

  It does. And I think, because one of the most important things, like you said, is password safety. And there's some really, I know Bitdefender, I believe, has like a password feature that you can get. And it's really cost effective. But, but you mentioned this thing, this concept, concept of least privilege. And I'd love to understand, like, what is this concept of least privilege? Help, help break it down for the people that aren't in cybersecurity.

• 24:28Speaker 00

  Yeah, the concept of least privileges or least privilege is, falls under the umbrella of what we refer to as identity and access management. It really is, you have a resource that could be an application. It could be intellectual property. You want to, you want to restrict access to that and make it so that the individual or the system or the software that have access to that, they just have access to the minimum amount of resource required for them to do their job with a time restriction. For example, we go back to, let's say, a customer database. You have a customer database, you have all your clients' details. And let's say you have a marketing officer.

• 25:11Speaker 00

  Marketing officer needs to run a campaign for some of those individuals. So what I do is the marketing officer will only get access to that database for like 30 minutes. So they get a temporary password and they will only get access to those individuals. And then the access will get revoked. This reduces the impact of a cyber attack. For example, if two weeks later, this marketing officer gets hacked, well, the hacker wouldn't have access because the access has been revoked. And you, you mentioned Bitdefender, they have this, their enterprise suite solution. So they will have that password manager where you can provide a temporary password access. So it can definitely assist with that. But that's more or less the principle of least privilege.

• 25:54Speaker 00

  We always assume that for cybersecurity, it needs to be this complex, expensive piece of technology. But no, it's really people, process and technology. So we start with the process. We just define this is how we access things from now on. And then we enforce it with technology if it's possible. If not, can even do it manual.

• 26:11Speaker 01

  When it comes to customer data, like, for example, my business, we don't collect that much data. Like we have everyone's email, but that's pretty much it. So like, is that really sensitive customer data? Or does it get more sensitive when you're collecting people's like addresses and their social security and like that kind of stuff? So it's like, what customer data is the most desirable?

• 26:33Speaker 00

  Yeah, this is where there is a fine line between cybersecurity and the legal profession. Because here we're going into the territory of privacy, or some people say privacy. Depends on how you pronounce it. But this is where we sort of even sometimes consult with a legal professional or a solicitor. Email address on its own is not really what we refer to as PII or privately identifiable information. It really is not. Why? Privately identifiable information is something that can uniquely identify you. This would be your full name, home address, date of birth, but also things we don't think about, such as sexual orientation, political views, these things, because it can be used against you to target you. Okay?

• 27:18Speaker 00

  And within that, there comes a whole lot of laws and regulations. A simple one that many people don't know is, your business is based in the United States, so you're in the US. However, if some of your customers are EU citizens, so they're Europeans and their country is part of the EU citizens and they sort of trade with you, you actually need to comply with a standard called the GDPR, which is the privacy standards for European citizens. So you need to do certain activities to make sure that you're not breaking their privacy laws, even though you're not really a European Union. Organization likewise, there is the California Privacy Act and there is the China Act. So there is all of these things.

• 28:02Speaker 00

  And this is where as cybersecurity professional, we provide advice, but then we we consult with a solicitor sometimes could be just, just please review this, make sure our policy is is up to scratch. So as far as emails, I would treat it with absolute care because like I said, it may not be a huge legal liability, but it's very attractive. People on the dark web, they purchase email addresses, they use it for spam campaigns, they use it to scam people. It's a very attractive thing. And even I'm not sure if you like have an interest in say paid ads. Email addresses are really attractive to use for paid ads. So there is commercial value for them. And as a result, we encrypt them.

• 28:45Speaker 00

  We make sure that our newsletter provider is doing their due diligence when it comes to security, which the majority of the big ones are.

• 28:53Speaker 01

  So helpful. You are just like a wealth of information. So for the entrepreneurs tuning in who still don't feel like there is much of a risk with cybersecurity or still aren't scared enough, talk to us about what could go wrong, like reputation wise, revenue wise. You mentioned earlier that sometimes cyber attacks can be so bad that the business actually has to shut down. I'd love to hear some examples of the way that these types of attacks can actually impact businesses.

• 29:25Speaker 00

  Yeah, we tread the fine line here, Hala, of being an alarmist versus just encouraging individuals and entrepreneurs to really, really do their due diligence and just do what needs to be done when it comes to security. It can definitely be career ending in the sense, the biggest one we've just alluded to, which is breaking privacy laws. There are hefty fines. So the European Union is really strict with fines when it comes to the privacy of their citizens. So a company in the U. S. That's providing services globally and somehow they get hacked and European citizens get their data out there, there might be a big fine and it can be in the seven figures and that can have huge like direct financial impact.

• 30:09Speaker 00

  The other one is, let's say you have an application and subscribers and that application gets hacked. Now what subscribers are paying, they need their money back and you really don't know what to do, your revenue stopped. So all of these things can and do have significant financial impacts, which is a good segue to also make sure you have the cyber insurance or talk to your insurance organization and make sure that insurance against cyber attacks is there. It's a sort of controversial topic. It may or may not help, but it's best to have it than not to have it. So those are things that are important.

• 30:47Speaker 01

  I've never heard of cybersecurity insurance and then nobody talks about this stuff. Cybersecurity insurance?

• 30:54Speaker 00

  Yes, I think it really is important. And look, the good news is you may already have it as an example. So if you have insurance for your business, depends on your provider, you can talk to them and say is cyber attacks are included under that and within that there is a threshold and there is a limit. And however, I've had mixed experiences with cyber insurance, but to summarize, it's better to have it than not to have it. And the good insurance providers, usually it's there in the fine print. So it's worthwhile just checking that that it's already there. The other thing is also, like I said, if the organization or the business, like you had a consultation with a cybersecurity company that's preferably local also, if things go

• 31:38Speaker 00

  bad, you have them on speed dial, you can call them and get them in. So having that relationship also is really help and they can also give you an advice when it comes to cyber insurance as well. So these things helpful, but when it comes to just things going wrong for small businesses, Hala, like I said, it does go a bit more sinister and there are things that most of us don't hear about because it's sort of bad news and with really bad news, we don't want to hear about it for the most part, but there are cases of extortion. There are cases and this is really, really common. So as a small business owner, someone could target one of your employees and you're kind of responsible for them because your business got hacked and it's really complicated.

• 32:20Speaker 00

  And the implications are sometimes your employees could be the target or your customers could be the target. And as you mentioned earlier, it could also be your brand reputation and we call it brand equity. All of people signed up to your application, it's hot stuff, but the next day everything is hacked and everyone's complaining and that can be career ending, unfortunately.

• 32:41Speaker 01

  So let's go back to the entrepreneur who has no budget. Now you mentioned the three to four things that we should pay attention to, but what if I literally had just $1,000 to invest in cybersecurity? And let's say, I don't know, maybe this isn't just not enough. I guess a thousand dollars for the year or do we want to say a thousand dollars for the month? Like what is the bare minimum that we can be spending on cybersecurity?

• 33:06Speaker 00

  Let's say we just have a thousand dollars. Let's just say the business has just started and look, and there is good news here is that it's not always like that amount of money. I think as humans, when we see a problem, like I'm going to throw money at the problem and make it disappear, it doesn't always work that way, especially with entrepreneurship. The good news is a lot of the services that we use, Hala, are really built in a solid way. So let's say if someone is using the G, like all their email and everything is from Google, for example, using the G suite, that is an inherently really secure platform if it's used properly. So if I just have $1,000 and which tells me I'm early in business, I'm a, let's say,

• 33:51Speaker 00

  content creator or I have a small agency, this also, I will guess that we're not building an email system from scratch, we're not building, we're just using popular services, whether it's from Google, Microsoft, et cetera, et cetera. This can be good news. I would honestly get that thousand dollars and like I said, reach out to a local trusted company and say, hey, this is our budget. Can you just give us advice? What can we do? And they can literally just have one hour, look at your stuff and just tell you, you know what, you're doing everything right, maybe do this one thing that's, you know, will give you 80% of the value. So I would, yeah, I would get a professional opinion, like similar to, I think the example of getting legal advice. You may not have the budget to hire a lawyer that works full time, but all you need is

• 34:35Speaker 00

  someone to review employment contract. That $1,000 can do it, may not do it all the time, but it's better than doing what a lot of businesses do now, which is chat G P T things and A I is telling you, yep, you're doing a great job, you're fantastic, you're the best thing since sliced bread. So I think just getting a human who know what they're doing is a lot better.

• 34:55Speaker 01

  I didn't think you were going to go that way. I didn't think you were going to say get like a consultation and have somebody tell you what you need to be doing. How about a solution like Bitdefender? It's super affordable. I just went on their website and it's like less than 200 bucks a month to get all these different tools. It'll like scan your Slack and or like your messages for anything that looks like phishing your emails, it will send warnings if it looks suspicious. So I feel like that's also like just a great layer to be adding on.

• 35:27Speaker 00

  A hundred percent. And like I said, that could be also the outcome of that consultation. They said, hey, you're doing everything right now. You're ready for an enterprise solution, which like the one you mentioned from Bitdefender. And the good news is these things, Hala, they weren't available for us a few years ago. So we are living in a good time where like a company like Bitdefender have something targeted for the enterprise, small businesses to medium sized businesses where yes, they do scan your emails, so you get rid of the spam headaches, they offer you some kind of password manager and monitoring. It's always better to have these things in place. It also like from a, I hate to go that way, but from a legal perspective, if you know

• 36:08Speaker 00

  things go south, it's also proof that as a founder or as a business owner, you're doing your due diligence. They can't say, well, you've done everything, but you still got hacked. That can still happen, even massive organizations. But in this case, you will be a victim of criminals who really know what they're doing. They're, you know. Criminals do criminal things and sometimes we're just victims of that. But that's a different story than someone who, you know, they've done nothing. There's a really famous story on the news of those company that they created a dating app for women to protect women's, it's for women's safety. But then turned out that that app, because it needed to verify women, they took their passport details and all their information. Turned out this app was valedated with zero security.

• 36:53Speaker 00

  It got hacked and it put women's in safety and in danger.

• 36:57Speaker 01

  Oh my gosh.

• 36:58Speaker 00

  But that was an example of an organization that didn't do their due diligence. Whereas a small organization, like we said, okay, they've got the consultation, they've got the defender enterprise security, they're doing stuff while you do what you can, right? It's like having a building, you have your fire exits, you have everything. Sure, disasters can happen, but you've done what you can do with what you have.

• 37:19Speaker 01

  You've described cybersecurity as defense in depth. I'd love for you to walk us through what that actually looks like for a normal small business. How can we practice that?

• 37:31Speaker 00

  Yeah, defense in depth is a concept that surprisingly even cybersecurity professionals can and frequently do get wrong. Defense isn't in depth is in a nutshell, having more than one layer of defense stacked one on top of the other. So if one layer of defense fails, the other one can sustain. So it just makes it a lot harder, a lot more expensive to get to what we call the crown jewel or the important asset. I'll walk you through an example. Let's say, let's say you have your customer database. That's the most important thing that we have, we want to protect that. And then we have our attacker and the first thing they do, they send a phishing email. Okay, so the phishing email comes, but you have your anti-spam filters, so the spam filter blocked that.

• 38:16Speaker 00

  So that's layer one of defense. So you didn't even see the email that attack failed. Now, let's say a more sophisticated attacker, they crafted their email in such a way that it's even past that spam filter and it went into your inbox. So you looked at it and you said, well, you know what? This looks like spam, sorry, you're both spam. So the second layer of defense here was your awareness. So that's another strong layer of defense, right? Let's say they were, you know, the email came from a trusted supplier. So they hacked the supplier, they came to you, so like, oh, this is a legitimate email, I need to do something. You click on that link and, but when you click on that link, well, your anti-malware solution, your endpoint security system blocked it from being executed. So that's another layer, so it failed here.

• 38:59Speaker 00

  And that can, you know, go on, go on like for longer and, but you get the concept, right? So we have multiple layers of security. And in the, in the like late nineties and in even early, up to the two thousand and, let's say, two thousand and five, two thousand and ten, there were organizations that didn't have firewall, so they have nothing. So the fact that we put one layer was a huge thing, but nowadays you'll find these layers work in tandem. This, and it's controversial, I keep saying defense in depth because when it comes to marketing of, the marketing of cybersecurity, people say, human is the weakest link. I can have all the defenses, but if a human makes a mistake and click on something, it's game over.

• 39:41Speaker 00

  Well, it's not, as we explained earlier, there are multiple layers of defense. And I say that in defense of the human, in defense of the employee that's overworked, like clicked on something. Sorry, if someone clicked on something and it's game over, then your security were fundamentally wrong. So yes, the way cybersecurity is approached nowadays, how it should be, multiple layers of defenses.

• 40:03Speaker 01

  Let's move on to AI because I feel like AI is such a hot topic in cybersecurity. How has AI changed the landscape? What is new now that AI is here?

• 40:14Speaker 00

  Yeah, everyone's topic and I've been labeled sort of anti-AI, which is not true. AI has definitely made cybersecurity professionals a lot busier because every business now have an AI and they call us and say, hey, is this okay, is this not okay? And then we need to go and look, look, it definitely has changed things and it's here to stay. But also it's not the sort of doom and gloom and the movie Hollywood things that we read on the news of these AIs escaping and hacking things that, this is just marketing. Look, the truth is always a bit more nuanced. AI, I mean, the most obvious one that we all need to be careful and be aware of is the deep fakes. So deep fakes is a huge, huge problem.

• 40:59Speaker 00

  And I know we talk about entrepreneurs and small businesses, but even for children and in schools, it's, it's been an absolute nightmare and law enforcement deals with that all the time. So deep fakes, faking voice, faking video is something we need to be really careful of. But even as I said earlier, you can, I can really create a website really quickly that looks exactly like a replica of a real one. Now, that wasn't overly difficult before AI, but now it's even faster, if that makes sense. So in the hands of a skilled hacker, AI can make certain aspects faster. Now, is AI this really advanced thing that's gonna do, go and hack things? That's not true.

• 41:38Speaker 00

  And the big AI companies have actually sort of safeguards against making AI do these things, ways around it. But let's say if someone is completely unskilled and they're trying to do something, it's just not happening. So that's one aspect of it. The second aspect, which is what keeps us busy, is businesses are really quick to sort of want to use AI. And this is where things get a bit more complicated because when we say AI, so what are we really using? Are we just prompting chat GPT? Or are we giving AI access to everything and making it talk to customers and do finance for us? Or, or are we even not even using AI, but we have this SaaS service or this product?

• 42:21Speaker 00

  And then all of a sudden, this product on their website says we're AI-enabled or AI-powered. Well, what does that mean? Do you feed our information to your AI? Is it going to, you know, the AI company, which is really a private company if you think about it? So all these things are making life a bit more interesting for cybersecurity professionals and small business owners. So we want to use AI, we want to be on top of the new technology. But we also need to stop and think, what is it that we're using AI for? What does the AI have access to? And more importantly, where's my data going? Is it going to a private company? Why do I trust that private company? This private company could get hacked or they could do something like sell my data somewhere.

• 43:03Speaker 00

  Big tech companies have done that and we love to see news. And this big tech company got sued for selling election information. Well, they don't care. The hundreds of millions of dollars fine that they pay, this is just, you know, one week's earnings. So these things, I think we need to keep in mind when we, when we use something like AI. Just why we use it and how we're using it is fundamental.

• 43:26Speaker 01

  Yeah, are we getting to a point where we literally just can't trust anybody's face or voice digitally?

• 43:32Speaker 00

  Unfortunately, yes. It, it happened to me, I thought I was this great AI detector up until someone, I'm in Melbourne, Australia. And yeah, I thought I was like this, you know, a great video guy that I know, I can detect it. And one of my fellow YouTubers, he visited me in Australia and he was just showing me what he does. I'm like, oh, this actually was AI. So what he does, he records himself talking and then for his Instagrams, it's him, but it's really an AI of him that looks exactly, I couldn't tell. And nobody could tell up until he pointed it out. It looks like him talking, it's his voice, but the video is entirely fabricated and it looked real. And with the, like the short form videos, because the resolution is low, I couldn't tell.

• 44:14Speaker 00

  Like a few months ago, AI would give you, I don't know, a few more fingers or things will be obvious. Not anymore. And to the human eye, my eye at least, it's not always detectable. So absolutely. And strange enough, I got an email from Microsoft saying yesterday that they want to rely on pass keys, which is the most secure way of authentication. So no longer, you know, the voice authentication and all of these things are going, are no longer secure. So absolutely seeing a video and, and usually women get targeted like with explicit, like if someone leaks, quote unquote, leaks explicit videos of an individual. And well, that video is completely deep fake and it has been happening. And yeah, it's, it's something I actually had to deal with, with law enforcement where they target,

• 44:58Speaker 00

  they always target the vulnerable, they always target the young and it is a, it is a problem. And we need some kind of a strict regulation on, you know, putting someone's face on a body that doesn't belong to them or do these things.

• 45:11Speaker 01

  It's crazy because as a creator, you actually see a lot of opportunity in this. Like my team is actually creating an AI avatar for me. I just did like the whole turning my head a million ways and walking towards the camera and turning my body every which way so that they can create an AI avatar for me. Is there risk in having an AI avatar that you actually create for yourself and for your content?

• 45:40Speaker 00

  Um, look, this is a difficult thing to sort of answer and guess because like, let's think about it. Like what, what could go wrong? Because you and I are content creators. So if someone wants to impersonate me, there is thousands of footage of me speaking and like, it's, it's really straightforward. And, and exactly for yourself as well. And we could say, well, it's illegal. Well, the hacker is doing something illegal. I don't think they're gonna stop and say, oh, hold a second, I'm not gonna do that because it's illegal. They'll still do it. So for me, I, I don't think there is any risk from a content creator. We are out there and you know, like, I always say, I, I tell people, if someone wants to hack me, you know what? Just go and hack me, my phone is full of food pictures and so like, it's completely useless.

• 46:24Speaker 00

  But like I'm aware, as I said, my, my stuff could be used to harm someone else. I don't think there is a risk from a content creation perspective, which is not really a cybersecurity thing. For me, I actually went the complete opposite of that. I do everything physical and analog now. Even a photo has to be photographer. I'm strictly not a fan of, of AI. However, it's a technology, it's a new thing. There is a viral Mr. Beast dance video that people thought it was AI, but then it was real. But it is the world we live in and as an entrepreneur, there's no reason why you shouldn't jump onto these technologies. Like we said in the conversation, as long as you know, you know, your critical assets or private information or stuff or financial information, don't feed that into AI, you should be fine.

• 47:07Speaker 00

  If it's avatar, if it's fun stuff, it's, why not?

• 47:11Speaker 01

  I think one of the the new things coming up in AI and cybersecurity is is for a couple of years, AI was mostly like chatting, chatting to ChatGPT, getting help writing emails. But now we've got AI agents that are jumping from tools to tools that are kind of like AI digital employees. How worried do we have to be about AI agents and their ability to hack our companies or their cybersecurity threats?

• 47:39Speaker 00

  AI, I mean, agentic AI or AI agent is exactly what you described, where you have the AI, but instead of it just being a prompt or a chatbot, you're actually giving it access to stuff and it can do things for you. For example, you can program the AI to send an email from your email or have given access to your calendar, or in some instances, it can be a chatbot on your website. AI agent is something that needs to be treated with absolute care. It shouldn't be just just because it exists doesn't mean we need to use it. There are many issues with AI agents. The first one is, the obvious one is is access. Well, you're giving a piece of software access to things, so we need to assess that access. We'll go back to the principle of least privilege.

• 48:22Speaker 00

  Does the AI really need access to everything in my email? Or does it need access to a copy of certain emails? Does it need access to calendars of everyone? Or perhaps you can create a dummy calendar for certain things and that can access that? So this is the the first one is, you know, don't don't be too generous with access. Treat it like, you know, it's just another piece of software. I don't want to say it's another employee. It's an employee or it's it's just really a software. So we don't really give software access to everything just because we can. I think that the the craze or or the hysteria that we we face now is is, oh, AI can do this, therefore I need to do, I need to use it. No. As a business, do you really need that? And if not, then why? And that could be also costly in terms of tokens.

• 49:03Speaker 00

  And and we've heard lots of stories of companies paying so much on AI tokens. A famous one of the fan companies, they laid off so many employees just so they can afford paying for the tokens. And it's it's not always a smart business decision. This is one. And the the most important one as well is, well, accountability. So as a founder, just because the AI is doing something doesn't mean the AI is accountable for it. I'm still accountable. So if I get the AI to review my legal contract, great. The review may be accurate or may not be accurate. Who's accountable? If I get into legal trouble, I can't say, oh, well, oops, AI did it. No, it's still me. So we need to really stop and and think, well, I'm still accountable.

• 49:46Speaker 00

  AI is just a software, it's doing something, I'm still accountable, just like a normal employee. Yes, the employee can make a mistake or so, but ultimately the accountability falls on leadership or on the CEO or on the board of directors. So these are the things we need to really be careful about.

• 50:01Speaker 01

  So I do think one of the things that we need to be worried about with our employees in AI is actually, we might be rolling out specific company AI tools, but because AI is kind of popping up everywhere, employees are probably using all these like disparate AI tools or like whatever tool they think is fun. And they're probably using their company computer and thinking it's harmless. Is there a risk in people just using like not approved AI tools?

• 50:29Speaker 00

  Absolutely. And this is not a new problem. We used to call, we still call this shadow IT or unsanctioned software, which is really what AI is, what you just described. We had this problem even before AI would have, let's say, the marketing team, they just found this online tool and they start using it, they didn't tell everyone, and they put customer data in it without sort of the cybersecurity team doing an assessment and saying, hey, this is approved, we can monitor, we can do that. Same thing with AI. If we have an employee opening their own personal ChatGPT, putting company information in it, yeah, we haven't, we didn't really approve that. So they did something that a business didn't approve of.

• 51:08Speaker 00

  It is really hard and it's it's something that we need to, like I said, do our due diligence. We need to have clear policies that say, do not put company information into AI tools. Also, the other thing I saw, even in big tech companies where they're really skilled, so they have built different agents to do different tasks, they always have someone sort of verifying and validating the output of AI. So really skilled programmers, they do this Claude code, they, the AI is producing code. Before it goes to production, it needs to be reviewed, it needs to be tested by a vetted senior programmer. So this way, we have safeguards against what goes into AI, but what comes out of AI.

• 51:52Speaker 00

  That is really essential. There is the other thing, of course, like I said, in terms of privacy and stuff, there is a setting in in all these AI chatbots that says something along the lines of, don't use my data to train AI. I think we should all toggle that. And this way, allegedly, our data doesn't go in there. So that's something that we need to do. But there has been instances, a really famous one, early days ChatGPT, the source code, some Samsung employees really leaked the source code, not leaked, they just posted it to ChatGPT. And it's a huge problem because ChatGPT will use it to learn, but that source code is massively, massively pricey and important intellectual property that should not have gone there. So these things happened. Yeah.

• 52:37Speaker 00

  So we do need safeguards against who uses AI, what do we use it for? And exactly like any other piece of software, an employee shouldn't be just using random softwares and use it for business purposes on business laptop.

• 52:49Speaker 01

  If we have like a company version of ChatGPT and Claude, is it safe to upload certain financial information or code or whatever it is? Is it safe to upload those types of things or is it still not safe?

• 53:01Speaker 00

  So when we say a company version, there is like a RAG, which is a local AI that you can have, absolutely where the data is not going elsewhere. And also, if, depends on the solution that you use, there are against safeguards that just doesn't doesn't get that your data leaving the organization. And then the word safe, we need to also really put it under the microscope. Safe in the sense, okay, so the data is not leaving, but is it safe from mistakes?

• 53:30Speaker 01

  It can still get hacked or, yeah.

• 53:31Speaker 00

  Sure. But also, is it safe from mistakes? If I'm doing financial data and I I get the AI to be my finance officer, I'm still accountable. When when a mistake happens, and and this is the problem, the inherent problem with AI, Hala, is it makes mistakes. You know, humans make mistakes, but they're accountable. AI is a software, it will make mistakes. And that's a problem. So if it's doing financial data, financial analysis for me, I need to validate that. So if I can validate that, no worries. It can really save time. If I have a finance officer, they use AI in some sort of way, but then they review everything, that is fine. It's just, it's just us validating and verifying that things are fine.

• 54:11Speaker 00

  Also, like I said, like need to know basis or least privileges, meaning I'll use AI. Just because AI can do certain things and I'm giving it certain amount of data, doesn't mean I need to give them access to everything. Just give it access to what needs to happen and then revoke that access.

• 54:26Speaker 01

  So I'd like to talk about, aside from the technology and AI, the people who actually have keys to your business. Like, a lot of us think that the only way that our business is vulnerable is through a stranger. A hacker is going to come hack our company. But it turns out that our employees can actually be a really big risk, especially employees, maybe disgruntled employees who have left the business. Is that right?

• 54:51Speaker 00

  Absolutely. That that technical name we use for it is insider threat. Although some people don't like the word insider threats, like humans aren't threat, it's, it could be exactly what you said. So one scenario is a disgruntled employee. They know all the business secrets, everything, and they leave. And six months later, they decide, hold on a second, I'm not happy with that business, let's do some damage. And the way we reduce the attack surface, we reduce the impact is back to basics. They shouldn't have access to everything. So when they hold the key to the business, well, they need to hold the key to certain aspect that they need for their job. And this way, if they do damage, well, that damage is restricted. That's that's one. Two, a common mistake that happens even with large businesses, in fact, probably more

• 55:36Speaker 00

  with large businesses than smaller ones, is when someone leaves, we call it the offboarding process, they don't take all of their access out, so they may still have access to certain applications or certain things that they log into. So that's a problem. So we need to have a process of, just like we onboard employees, we need to know how we offboard them, and that includes revoking access. The third one is also in our contract legally. And we need to say that, you know, if you leave, please don't go on social media and just spill out all our secrets. That's illegal, but having it in the contract doesn't hurt. There's been many instances of that happening. A really popular one, a big tech Australian organization that has laid off people, and

• 56:20Speaker 00

  they laid off one of their very senior software engineers. And the next day, he creates, I think, on our YouTube video, explaining everything he's done for them, everything he's built. It's online, it got millions of views. So, yeah, that that's really valuable information that the employees spill out. And you know how awkward it is for an organization to legally go after someone. So these things we need to be careful of. The insider threat, there is other aspect that we forget when it comes to insider threat is the employees are humans, they make mistakes. So I, even early in my career, as an example, I made a mistake early, early in my career. As I was going, working faster and faster, I ended up deleting stuff that were really important files.

• 57:03Speaker 00

  And I did that by mistake, and I had to go find backups and restore backups. So mistakes can happen. It could be a really genuine unintended mistake, which again, goes back to why did I even have access to that stuff? Why was I able to delete without someone looking over my shoulder, without a chain of approvals? All of these things that sometimes we may think of as tedious or unnecessary, we want to be fast, we want to be lean, well, there is a cost that comes with that.

• 57:29Speaker 01

  This has been such a valuable session. Like, I feel like I've got to like do so much work and make this like a core initiative for my business. If you're a hacker, please leave me alone. But um, I wanna play a game with you. It's called find the back door. So I want you to find the back door. I want you to break it down and then close the back door. So basically, how can somebody hack this company? I'll give you a scenario. And then how do we actually fix that? What is the solution to that? Okay, so the first one is

• 58:04Speaker 01

  the media company. The company works with freelancers around the world. Some use personal laptops and personal email accounts to access company files. Where's the back door?

• 58:17Speaker 00

  There are about three back doors in here. Um, the first one is offshore employees. Um, you need to vet those employees, especially if they have access. So have some kind of vetting process. And that could be something as simple as use an agency that does the vetting for you. So make sure they're not hiring criminals. That's as a, a, a, as a basic sanity check. Um, the second one, of course, um, if you can't give them laptops, uh, then restrict what they can access. Absolutely restrict what they can access. Don't give them what we call as a right. So read access may be um, less damaging, but right access, which gives you the ability to delete stuff that, that should absolutely be restricted

• 59:03Speaker 00

  on a need to know basis with strict approval processes. The fourth one is a personal email address. This is a huge no-no because when they leave the company, um, they own the data. That's just on their email. So if there's anything sensitive, they'll take it with them. And that's precisely why organizations have emails on the company domain. Because the company owns that as soon as they're using personal emails, well, they own the data. So you're really handing over their data and you're as vulnerable as any one of them. One of them could be criminal, one of them could be hacked or you, you just really don't know. So you're overly exposed. If you wanna use offshore employees or contractors, really restrict them to a very specific task.

• 59:46Speaker 00

  And have in mind that if that person gets compromised, what's the impact? And do I accept the impact and consequences? If no, then find alternatives.

• 59:56Speaker 01

  The fast finance team, this is the next scenario. The founder and the finance team approve urgent payment requests through Slack because it's faster and more convenient.

• 1:00:07Speaker 00

  Yep, so any, anything that we do fast, it's, it just means we're gonna make more mistakes. So with speed, the compromise is more mistakes. Um, yeah, a big, a big really um, red flag here is approving things over Slack. Should not happen this way. We need to have a chain of approval that's really clear. Because um, the strong use case is if one of your employees gets hacked and they have, um, their account gets hacked. So the hacker is using their, your employee's account. And well, everyone have access to Slack. They're gonna ask you to approve something and fast means you're just gonna approve it. Um, so that's a call for disaster. You, you will, you will lose money. So that's what you're compromising. So you need to have the fix for that is have a proper approval process.

• 1:00:49Speaker 00

  Um, and that approval process may just mean you, it will take an extra five minutes. It's not really, uh, uh, it's not really war on peace. It's, it's literally just a proper approval process that will save you a lot of headache and will save you time in the long run.

• 1:01:03Speaker 01

  Yeah, potentially a lot of money.

• 1:01:05Speaker 00

  Exactly.

• 1:01:06Speaker 01

  Okay, the last scenario. The SaaS-heavy e-commerce brand. The company uses dozens of third-party applications connected to customer and payment information.

• 1:01:17Speaker 00

  That is, it, it, it, everything is wrong with this. Uh, this is a dangerous one. Surprisingly very common, Hala. Okay, the first one is, uh, when, when they use so many SaaS applications, um, but you need to know who owns that SaaS service. Because there has been cases where it's foreign government operating from a different country, having this amazing SaaS application that does amazing things and it's surprisingly cheap. Well, the purpose of the application was to collect information. So you need to really vet and know who you're dealing with. So the first thing is we call it supply chain management. Supply chain meaning your suppliers, in this case is your SaaS providers. Just make sure you know who you're doing business with. Instead of just randomly signing up for things because they are quote unquote cheap and fast and they, they do their job.

• 1:02:01Speaker 00

  So, uh, uh, because it's a legal liability. If you're leaking customer information to somewhere that shouldn't go, it's a huge problem. This is one. Um, two, again, know who you're dealing with. A small SaaS app, what if one of your providers get hacked? And they have access to all your customers. So, and therefore, once you know who you're dealing with, the second one is manage access. Why do all of them have access to everything? Really common in the real world sadly, but manage your access. Again, need to know basis, least privilege, all these really timeless principles, meaning you restrict access. I'm pretty sure that business, whatever it is, doesn't require everyone to have access to everything.

• 1:02:41Speaker 00

  The only reason why businesses usually do that, where they give everyone access to everything is just lazy. They just, it's easier, they just take everything on and, and that's a call for disaster. So that, these are the two fixes. Manage your supplier is number one. Number two, manage your access.

• 1:02:57Speaker 01

  I love those principles. I'm sure everybody tuning in is learning so much and getting so many ideas of like where they need to start first. Let's say unfortunately, our company gets hacked. What is something that we shouldn't do? We get hacked, somebody just stole a bunch of money from our bank accounts. What shouldn't we do in that moment?

• 1:03:18Speaker 00

  Uh, really difficult because the first reaction that happened to all of us, myself included, we panic. And to tell someone not to panic, it's unreasonable. So I'd say panic, but don't act. It's just like, you, you know, when, I'm, I'm sure as an, as a business owner and even as someone on the internet, um, sometimes we get angry and um, the advice is just don't reply to an email when you're angry or don't, don't take action, just slack, just sit back. It happened, it's a problem, we're gonna deal with it in a, in a systematic way. So I'd say the first thing is, um, don't interact with the hackers, don't reply to emails, leave everything as it is. And in some instances, I'd say, don't actually close the laptop or don't disconnect, leave everything as it is.

• 1:04:02Speaker 00

  Reach out to an expert right away. And there is levels to that. So reach out to law enforcement. Um, that, that, it's a sort of contested thing to do because usually enforcement are, um, sort of overworked, underfunded. They may not be always be able to help, but you'd be surprised, law enforcement can help. Um, having that consulting company, sort of you have them on speed dial, you have their number. Get an expert right away to do it. Um, that's the, the, that's the most important thing. But the biggest one is what we said earlier. Do not interact with the hackers because the first thing they will do is try to get more access. So they'll say, ah, sorry mistake, I'll just do this one more thing because they're trying to get as much foothold as possible. So don't interact with them. They're really skilled at getting you to do what they want you to do.

• 1:04:47Speaker 00

  And they're gonna use the fact that you're panicking um, to their advantage. So yeah, disconnect, completely disconnect, get an expert to deal with it right away. But don't take actions. And the worst thing that businesses do is they'll have like an IT support person who's really, they don't have the expertise. I'm like, okay, go deal with it. And that person end up being, um, ends up making things a lot worse. So I think this is the big no-no. Get some, get an expert to deal with it right away.

• 1:05:13Speaker 01

  Such great advice. Abed, this has been such an awesome interview. Before we go, I do wanna talk to you about your entrepreneurship journey, your business. So you actually started creating content. And you've created a business out of educating people. And it all started because people would just ask you questions, your colleagues would ask you questions, and you just wanted a way to not have to answer the same thing over and over again. So just talk to us about your story, how you ended up growing this content business, uh, how you make money today? And hopefully you can inspire somebody else who's a thought leader in their space to become a content creator and start their own business too.

• 1:05:50Speaker 00

  Yeah, absolutely. I mean, it's, it's funny, I still don't think of myself as a business or even a content creator. But uh, the story started, it was during the lockdowns. And um, I was working at PWC, which is a consulting firm. And as a senior manager, part of our job is to coach consultants and senior consultants. So I'd have these um, one-on-one calls with them. And I'm, I really don't like um, Zoom or online meetings, so I prefer it to be in person. And I remember one day I had like three or four back-to-back calls with junior consultants and they were asking exactly the same question over and over. So I got this idea where I'm like, you know what? I'm just gonna film myself answering those questions and I'm just gonna send it to them so they watch it.

• 1:06:34Speaker 00

  And I just put it on YouTube as somewhere to upload the video on, like not as a sort of discoverability platform. So I thought, I thought no one would find it. I thought it's, um, like I, I watch YouTube, but it didn't occur to me that the video that I'll put, strangers will, uh, will watch it. So I send them, I told them, before you do the meeting, just watch this video and then you can ask your questions. And I left it and then I think months later, so I saw there was comments and likes and there's strangers watching it. I'm like, oh, well, let's just answer more questions, I guess. And I started answering them and it wasn't, like it wasn't a sort of a business or I had no idea that YouTube pays me money. And while it's, it's a small amount, but I didn't, I didn't know that was a thing. And when I got the first paycheck from YouTube, it was like 50 bucks.

• 1:07:19Speaker 00

  I'm like, was that a mistake or like how? I didn't put two and two together. It's not the universe that I'm a part of, I had no idea. So that was YouTube. But then I started getting messages from people and individuals like from all over the world. And the first one was, like I could see in the picture, it was a dad and kids and it's like, Commenting on my videos, he was somewhere in an African country. And then it's like, actually, I got a job. And for him, a job is, they changed their life. So got a full-time job, completely new field, highly paid, so it improved their life. And then it started to spiral. I started getting these success stories, either in a comment, sometimes in an email saying, I actually followed your advice. I got a job that changed my life. Thank you so much. And the more I posted, the more I get nowadays.

• 1:08:04Speaker 00

  Every time I look in my inbox, there's at least one message a day from someone somewhere in the world says, actually followed your advice. Which my advice is really just do these practical things, learn and apply yourself and you'll get a job. It will take time. It's challenging, but it's possible. So this really gave me the drive to continue. I felt that I was making a difference and I felt that, I just felt responsible. I felt responsible that people watch my stuff now. I need to give really the most accurate advice. I need to do, do what I can. Time management became really difficult. My job is really, really demanding as a consultant, but I enjoy it. And because I do it, I've been doing it for so long.

• 1:08:47Speaker 00

  Like it doesn't require a lot of thinking from my end. So I was able to manage, but then I've always wanted to do consulting on my own. So I started a cybersecurity consulting company and I have long-term clients. So I'm active in the field. I do that, but at the same time, I create YouTube videos. I'm not very good at like creating a lot of content. So I will create one video a month. Really, that's my average. So in 12 months, I'll have like 13, maybe 15 videos of YouTube. That's all I can, I can do. Within my advice, because cybersecurity is a range of jobs. It's not just one job. There was one nation cybersecurity called Governance Risk and Compliance. At the time, I didn't feel comfortable recommending what was on the market. So I thought, I'm going to take three months and just try to create something.

• 1:09:31Speaker 00

  It took me a year and a half and I created my certification, got it accredited and I just put it out there and thank God it's been, been really successful in the sense of people started to recommend.

• 1:09:44Speaker 01

  And that's the GRC mastery, right?

• 1:09:46Speaker 00

  Yeah, yeah. And people started recommending it to each other through word of mouth. So every time I go to a conference and someone says, hey, someone did it in the team, then all of us did it in the team. So it, it's, it became that. So really my time now is like between consulting. I help usually large organizations. I've got long-term relationships with them. I do have some consultants that work under me. And yeah, the occasional YouTube video where I talk about what's happening in cybersecurity and how to land a job.

• 1:10:15Speaker 01

  You got a full plate of clients, you have a team, and then you're able to create content and give back. I mean, that's an incredible career that you have. So, okay, let's bring you back to cybersecurity and wrap this up. So if you're a young and profiter listening right now, what are the three things that we should do tomorrow morning to protect our company?

• 1:10:36Speaker 00

  Number one, two-factor authentication. Use your authenticator app or a pass key. This is a non-negotiable, no exception. This includes all of your employees. Number two, a password manager. I know it will take you some time to get used to using a password manager. I can promise you, it's a lot more convenient for you and your team to use a trusted password manager. It will save you time in the long run. It will save you so much headache. And number three is, we talked about it a lot, is manage your access. Just because someone works for you, doesn't mean they need to have access to everything in your company. Provide this access, give them access only to the things they need and know more and have fun as an entrepreneur.

• 1:11:20Speaker 01

  Amazing. Beautiful recap. Thank you so much, Abed, for spending time with us on Young and Profiting Podcast.

• 1:11:26Speaker 00

  Thanks for having me and thank you so much for your time. This has been an absolute pleasure.

• 1:11:30Speaker 01

  Big thanks to Bitdefender for sponsoring this episode and for keeping small businesses safe. Protect your team, your data and your business from scams, ransomware and phishing. Get 30% off bitdefender.com/proffiting. That's bitdefender.com/proffiting. And if you enjoyed this episode and learned something valuable, we'd greatly appreciate a five-star review on Apple Podcasts or Spotify. Reviews help us reach more listeners and continue bringing you these conversations that educate, inspire and empower. You can also connect with me on Instagram, TikTok or X at @yapwithhala or find me on LinkedIn by searching Hala Taha. This is your host, Hala Taha, AKA The Podcast Princess, signing off.