Same Scams, Cleaner Wrapper: Cybersecurity Awareness Month in the AI Era with Erich Kron

Hi, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s a pleasure to be with you all again with another amazing topic, another awesome guest, and I’m really excited.

I mean, every year we go through a lot and there’s lots of incidents, lots of reports, but one of the important months of the year is Cyber Security Awareness Month, which is the month of October.

And that’s what we all get to.

We want to look back in the past year and find out how we’ve done, think about what things we can do just to remind people to be a little bit secure.

So this important month, I always, you know, sometimes it’s like repeat.

We hear it over and over and over again.

But sometimes this is just as good to take a pause and think about how your strategy is, what to do and where to go from that and to go through that theme.

I’ve got an awesome guest, somebody who I’d really admire, somebody who does a lot of traveling like I do and speaks at lots of events.

So, Eric, welcome to the podcast.

Since this is your first time on, if you can give the audience, you know, what’s your origin story, what’s your background, how did you get into the industry and a little bit about yourself.

Yeah, sounds good.

And thanks for having me, Joe.

I really appreciate it.

Right.

My first network was Windows 3.1 with Lantastic.

So if that tells you anything like it.

Long time ago.

Right.

This was pre aol.

Okay.

I did earn the gray hair, I promise.

You spent a lot of time in the trenches back then.

A lot of things started to become security was part of it, and then it kind of turned into other things over time.

So I started off mostly IT and all that.

Well, I’ve worked in healthcare, I’ve worked in manufacturing, and I spent about 10 years with the U.S. department of Defense where I was the security manager for what’s called the second Regional Cyber Center.

I was the kind of like top security contractor guy and we helped deploy the Army’s active directory.

Actually, I was part of the deployment.

I was an ad domain admin there and we also did all of the network infrastructure across North America.

So a lot of like in the seat there.

And then I went to work for isc squared or isc2 now for a little while.

Right?

Yeah, I was a director over there.

And after that fun little stint, I went to work for know before where I’VE been now for over 10 years, which is.

Whoa.

It’s mind blowing to me.

Right?

Like 10 years in the same place,.

Not taking a break in this industry.

That’s, that’s a pretty impressive because, you know, lots of people change and to be a company for that long is, is impressive and just shows kind of, you know, um, good people kind of like to work with good people.

That’s helps me what it comes down to.

Yeah.

And I love our mission, so that’s really kind of what it comes down to.

I’ve always loved security and cyber for the mission and I really like working for, not for profits and things like that as much as anything else.

Or at least something that I know can make a difference.

Absolutely no.

And just, you know, telling you how long you’ve been in the industry.

I was just laughing earlier because I was literally looking through a bunch of old DOS boot up disks and startup disks.

Oh man.

That’s all.

And I do, I think I do have a copy of Windows 3 one somewhere even, even 3 one one with a plug and play, which was a lot of fun.

And I used to hate networking those things.

That was not a fun thing to do.

Yeah, you’re from the days of IRQs and conflicts.

I was just laughing because I was at a conference the weekend.

We were literally talking about, you know, what some of the, you know, the complicated things.

I remember even back when installing windframe, which was, you know, which today we know is Citrix, it was like, you know, that’s where you did virtualization of desktops.

A lot of fun.

So was.

Yeah, but a lot’s changed.

So one of the things is we’re here to talk about Cybersecurity Awareness Month, which is an important month of the year.

And it’s a lot, we hear a lot of best practices.

CISA has come out with their, you know, reduce the risk approach with the same typically themes of each every week.

EU also has their kind of reminder of cyber security awareness and how important it is to stop and think, think about, you know, do you have the right resiliency in place?

Do you have the right protections in place?

What, what does you know for you?

What does Cybersecurity Awareness Month mean for you?

What, what, what is, what is the things that you prepare for?

What’s the types of activities you’re doing?

Is it, is it a busy time?

You know, we have conference seasons throughout the year.

Is it a busy time of the year for you?

Yeah, this is pretty much my time of pain, if you will.

Like it, it is absolutely ridiculous.

Has spilled over now into September and it’s spilled over into November and it’s.

I mean, it just, it goes crazy every year.

This year has been even crazier than others.

So for me, it means traveling around quite a bit, plus doing webinars, plus doing that kind of stuff.

And a lot of what I do during this month is actually employee education.

So I do talks for organizations, employees and stuff like that.

Customers I know before and sometimes it’s leadership, but every once in a while throw in some chats with technical teams and things like that as well.

For us, just because of what we do, the target is mostly like social engineering and how to prepare for that through training.

I talk a lot about how to kind of make training and education programs a lot better than a lot of people make them and how October is a great time to be able to use the fact that it’s National Cybersecurity Awareness Month to be able to do stuff that we might not be able to do the rest of the year because we can go to leadership and go.

But there’s a whole month for it and it’s global and you know, all of those things.

It’s a pain in the butt to go to them in February and be like, I want to do this big thing for the whole month.

Yeah, absolutely.

I do find it bleeds over as well into, you know, definitely September is when I do a lot of the preparation, a lot of the videos, the blogs, the content, and also trying to find room in my calendar to fit all of those events, which is still a bit.

I’m still working through some of the logistics side of things.

But yes, I agree it does get to be a busy month and I think it’s good because a lot of what I find as well is similar is going to a lot of organizations and giving them.

Looking at their awareness program and looking at their strategies and their security controls and just thinking about, let’s stop and let’s look at how you’re measuring things and let’s figure out what’s working, what’s not working, and what’s your strategies and priorities for the next year ahead.

So therefore we can again, when we get to next October, next year, we can measure and see, you know, how far you’ve come, have you been able to get the things you want to get done.

And I always kind of think it’s important to use this time to target the wider organization and not just the IT security team.

It’s a good way opportunity to kind of involve other parts of the business, whether being in finance, whether being in HR or whether being in the sales team and the executive team as well.

So it’s also a great time to do tabletop exercises, I find.

Yeah.

Which also allows you to practice and simulate late.

So what’s what, what’s what types of things do you know?

You said you get a busy schedule, is a lot of it in person and webinars.

Do you do tabletop exercises?

Well, in order to practice people, in order to get their cognitive mind working and get ready.

Yeah, unfortunately most of especially this time of year is nailed down to just doing talks presentations, moving on to the next.

So I think like I have, I want to say five or six in person talks in October and probably 20 something webinars also, which is crazy because you’re on the road, you know how it is.

Like one week is back to back and then you get back and then you’re on the road for a little bit and then you come back and then it’s like days just loaded with webinars.

It’s a very interesting time, like I said.

And it’s important though.

And to me that’s the thing.

This is important because this is really critical for those organizations that the security folks may not get all the time in the world to do things or.

One of the biggest problems I see in this security awareness industry is the people that get assigned to do the training and education are in charge of that program are a lot of times very technical people, which is awesome.

But the last thing they want to do is train people, deal with people.

Right.

I know my happiest days have been in a server room in a data center.

You know, fans going crazy, can’t hear myself.

But I’m a alone and that’s fun for me.

I know it’s hard for some of these other folks.

I like to try to help them out by taking some of that burden off them, giving them an outside person that maybe reinforces some of the things they’re saying to their people already.

And funny enough, that makes a big difference.

It’s like as a parent you’re like, don’t do this, don’t do this, don’t do this.

And then someone that they kind of go, oh, this is a real person goes don’t do this.

And they’re like, okay, absolutely.

It’s bringing that external know validation in, you know, because hearing it from your, your peers kind of like, oh, okay, I’ve hear you’ve said this many times and it’s you know, it creates the, the friction side of things.

But having somebody else coming in and saying, here’s, here’s how it’s been successful, here’s how it has been not been successful in other organizations and let’s prevent those.

And it provides that external validation which people then, you know, become more comfortable with and tend to listen more, pay attention more.

So absolutely.

I think it’s really, really important with Athema, it’s, I mean, it’s been the same things every year, which is all about strong passwords and it’s about, you know, better, you know, resilience against social engineering and phishing.

It’s been about user password manager, multi factor authentication and also, you know, security patches and updates, staying up to date with all the latest software and so forth.

Do you think, I mean, are they still relevant today or, you know, do we need.

Because it’s been similar message for a long time.

That’s been the fourth weak theme for quite a few years.

Are they still relevant today or do we need to kind of evolve them a little bit further?

Well, it’s a little depressing because those things are still very relevant, right?

Like people still reuse passwords without understanding what it means to have reused passwords across everything and just how bad that is.

Right?

Phishing still the number one way to get in, which frustrates the hell out of me, man.

I figure probably the second email to ever go out was probably a phishing email, right?

You know, it immediately follows like hello world sort of thing.

And yet we, we fight with it.

And part of that is because we’re wired a certain way and we have made big steps in this, but so have the attackers.

So it kind of, it’s a wash on some of that stuff, but the core fundamentals are still really the same.

One of the things that people really want to talk about this year for me is about AI and how it’s impacting things and some of these other communication apps.

Okay?

So like AI, there’s this, it’s fud.

There’s a lot of FUD out there.

Fear, uncertainty and doubt around AI, right?

And so rightfully so, people don’t know what to listen to, they don’t know what to see.

End users get freaked out because they’re like, how am I going to fight back against this?

And so one of my core messages has kind of shifted when it comes to those, and that is ignore the things like the video or the misspelled text or all that.

It’s not even going to be there, right?

Even if it’s someone that sounds like someone, you know, that doesn’t matter.

Focus on a your emotions.

Because we’re really good at intuition.

Right.

I don’t know about you, Joe.

So many times in my career I’ve gone to somebody that something’s gone wrong and I’m like, why did this happen?

And they’re like, well, I kind of thought it was a bad idea, but you know, and so there goes your weekend.

Right.

Because of that.

But so, so I talked to him a lot about focusing on that.

And look, whatever the communication is asking you to do, is it looking you to send money to, you know, send, I don’t know, go get gift cards or send important stuff or open a document, is there urgency?

Like we gotta look at that.

Cause the deep fake stuff.

Yeah, it’s real and it makes all that other garbage kind of go away.

So that’s a key thing for me is trying to help people walk em back from the ledge and be like, look, it’s not all over with.

These are the same scams, just a little bit cleaner wrapper than we’ve had in the past.

Yeah.

And I think that’s a very important thing to do.

So that just letting people know that it’s not hopeless is really important.

Yeah.

So that’s asking yourself the question, was I expecting this?

Is this something that surprises you or was it expected?

You know, is it based on an action that you’re actively working on?

And you know, when we look at those, you know, normal.

I always go back and I think some of my best phishing campaigns in the past was always that, you know, the fear of urgency, of doing, you need to do this immediately.

The other thing is that you know that if you don’t do it, there’s going to be some financial impact as a result of it.

And also kind of, you know, you don’t want to be the person doing something wrong.

So they make, you know, the person feel like, you know, if they don’t do it, it’s going to impact themselves and all of those things when you put all those ingredients in place, you know.

Plus, also, was this something you’re expecting?

I always find that the best organizations is the ones who talk a lot with their peers because then they get chatty and they go, oh, hey, I’ve got this, you know, did you get it?

Or is this something, you know, that I should be worried about?

So the ones that have a good, you know, social communication within your organization, they tend to be really chatty and be able to detect things very, very quickly, which is also a good thing as well.

Yeah.

The other trick that we’re having to deal with now, though, is it’s not just phishing, but we’re seeing it in teams.

We’re seeing it in WhatsApp.

We’re seeing the text messages, the phone calls, all that other kind of side channel stuff that we don’t monitor nearly as close as we do.

Email, for obvious reasons, has now become a problem because they’ll try to pivot people over to something like WhatsApp if they can.

That’s end to end encrypted.

And even if people understand it’s end to end encrypted, they don’t really understand what that means.

It doesn’t confirm or validate the person on the other end.

Or we’re seeing a lot of attacks coming through, teams of which are from compromised accounts within the organization.

So there’s that level of trust there.

And they just go, okay, that’s cool.

I trust this person came in for real.

It’s asking me to do something stupid that I’ve never done before.

And so.

But it looks legit, right?

And then finally, like multimodal attacks or, you know, these attacks that combine something like an email that drops in your inbox.

It says, hey, need you to take care of this thing right away.

And the person’s going, ah, this feels weird.

But then they get a text message, looks like it’s from the same person, says, I just sent you this highly, you know, you gotta do this now sort of thing.

Check it out, it’s in your inbox.

And they go, oh, okay, I got it from two places.

Clearly that means it’s legitimate.

So I mean, it’s tricky, it’s smooth, it, it works.

Absolutely, yeah.

So, yeah, I’ve seen, I’ve seen recently a couple of pretty decent campaigns in the summer there, late summer, was a lot of email bombing.

So, you know, targeting users with tons of emails like spam, and they get lots of different messages and then all of a sudden they get a message through teams or another text messaging saying, hey, I’m fmit.

And we see that you’re getting lots of spam emails.

Let me fix that for you.

So it’s that kind of multi kind of channel, you know, where they’re actually causing the problem.

And then using the expectations is that, you know, knowing that the user is getting frustrated with it is that they will help them solve it.

And that’s sometimes something, you know, users kind of get expected, you know, is that, oh, you know, yeah, it must be something somebody who’s legitimate because they know that I’m getting all these emails but don’t realize it’s the actually person that’s actually sending them to them.

Yeah, it’s like the MFA fatigue where they do that too and just start nailing people with the MFA codes over and over again and then contact them and be like, hey, we know this thing’s happening.

Just need you to confirm the code I just sent you.

Right.

And they’re so tired of hitting that at 2 o’ clock in the morning, like, shut up, shut up, shut up, shut up.

That they’re just like, fine, if it’ll go away.

Boom.

There you got it.

And yeah, especially because it’s also intrusive as well.

So if you get a person who’s working on their phone or on their tablet or whatever, and all of a sudden right in the center, they keep getting these pop ups, pop up, pop.

Or you know, the notifications coming down and they’re trying to click in an email, they’re trying to click in a message, and all of a sudden they’re getting drifted to these MFA kind of, you know, push notifications.

It just becomes frustrating.

And eventually, you know, at some point in time, they do want it to go away, and they want it to go away quickly and unknowingly, they’re trusting somebody who’s not really actually working for the company.

Yeah.

And it is, it’s super distracting.

Like, have you ever been on stage, Joe?

I know this happened to me and somebody starts bombing my phone, even though it’s on like vibrate, it’s going in your pocke or your watch is going off the whole time.

And you know, I have a quote unquote friends that we like to do stuff like that to each other.

Right.

But yeah, it’s incredibly distracting.

Like, okay, okay, okay.

And you just want to like, make it stop.

So I totally get that.

You know, depending or regardless of the job you’re doing, it can really just be annoying.

So, yeah, I get that.

Yeah.

Both annoying and also preventing productivity as well, because you’re trying to get something done and that’s just constantly in the middle of the screen.

So, so, so those are the things that, you know.

But so people just, they want to do their job to can I get things done?

And you know, anything that impacts them, they will unknowingly trust somebody who’s, who knows, has knowledge that it’s happening and you know, not.

Maybe they don’t realize that it’s coming from an external Source, you know, they’re not paying attention and you know, they, they fall for those types of, of scams and could, could be damaging.

You know, some organizations are quite lucky that if they have a good SoC that can detect them early before it starts spreading, some of those, you know, you know, can be very, very import for organizations as well to have that visibility.

So what are other things that, you know, what about staying up to date and patch management side of things?

And what about other tools?

Multi factor authentication along with password management side, how effective do you tell your customers to use those as well?

Yeah, so multi factor authentication is an absolute must in my book.

But one of the things I try to make sure they understand is that’s not a replacement for a secure password.

Okay.

Because a lot of times, especially the end users, they go, oh, well, I have this MFA thing now, I can use the same password because there’s this other thing and they don’t really realize that that’s not the ticket to everything.

Right?

So making sure that everyone understands that’s not the fix for everything is one of my very important things.

I think it’s incredibly important reminding people to patch like you mentioned, especially browsers.

So, you know, on the employee side or the user side, a lot of times you have like that Chrome update show up in the corner.

It’s like, I do not want to close my 247 tabs that I have open, which I generally do, right?

You’re like, what if this thing doesn’t come back?

So you just put it off.

You kick the can down the road and put it off, put it off, put it off.

But the way that vulnerabilities are being not only discovered but exploited these days doesn’t leave that as an option anymore.

Right?

We can’t wait for weeks to apply some of these patches, especially in a browser.

That’s a problem there.

And then on the other side, for techs and the folks that are securing things, when I talk about patch management and vulnerability management, one of the biggest things I’m really talking strongly right now about is also understanding mitigation as opposed to just patching, because patches take time to come out from the vendors.

And the way that we’re having these things exploited now, like almost immediately, there’s so many more o days out than there used to be that’s going to be hard to keep up.

By trying to apply patches, the vendor gets a patch, then you got to test it, then you got it, da da da da da.

By the time you’re there, you’re a couple weeks down the road, which is very bad.

But the vendors will oftentimes do mitigations also say this is a registry key you flip or this is something else you do to keep this from being a problem until the patch comes around.

And so rather than just concentrating on patching, I think it’s really important to start paying attention to what mitigations are possible before the patches come out.

And like we fought with this for years, knowing what’s on your network along with the OS and the applications.

Right.

We’ve always fought with that and we’re like, yay, I have all the like systems, devices in there.

Yay.

But that’s like a third of the battle.

Absolutely.

Inventory, asset inventory is one of the crucial things that you know that you must know what’s been deployed.

And that’s, you know, ever since we moved to BYOD and allowing employees to kind of make their own software decisions now also employees are turning into their own vibe developers, you know, creating code and agents on their systems.

That visibility is getting more tougher.

But it’s one of the fundamental, crucial things that you need to have.

And if you don’t have, you know, a good solid control of what’s on your secure or managed network, you need to start segmentating things.

You need to start moving a lot of those, you know, unknown systems, you know, into the wild west that goes out into the Internet or managed by users.

Then you had to have good segmentation and good control separation between those because one user who becomes victim in their home network, that can simply just be a pivot quickly from their home machine or BYOD machine into your corporate network.

If you don’t have good segmentation.

Yeah, absolutely.

And you mentioned agents, which I’m a huge fan of.

Agentic.

Right.

I really love agentic.

I’ve played with a lot of stuff here.

I’ve got some N8N agents running.

I love that stuff.

And it also just scares me at the same time, right?

Like these agents are being pumped out so quickly, thrown out on the network.

Like everybody’s in this race to get agents there.

They’re connecting it to their email without even thinking about permissions.

They’re trying to do all that stuff.

And then we have all these agents floating around and we’ve historically also not been very good at nhis, right.

Like non human identities has been a challenge for people since forever, right.

And now we’re all of a sudden tripling, quadrupling or even more the number of nhis that are running around out there and Trying to manage those permissions and keep those secure and monitor those.

And they’re running 24, 7, 365.

Right.

Like it’s crazy what’s happening with that.

And then, you know, if you look at, every time you start rolling those out, you’re generating more logs, you’re having to parse that store that, you know, you’ve got all this stuff going on.

That’s absolutely madness.

But also very helpful sometimes.

Absolutely.

I mean, I’ve got my own agents doing some of my work for me, especially in the podcast as well.

So I’ve got a podcast agent helping me in a lot of post production.

But you’re absolutely right, is that if you’re delegating your credentials to an agent to work on your behalf without the proper guardrails and controls in place, a lot of things.

We even talked about good patch management, strong passwords, multifactor authentication.

If you’re just delegating and that is an extension of you.

And agents can be compromised, they can be influenced to do bad things as well.

So these are some of the challenges that we’re having.

What else are you seeing in the world of AI?

We’ve seen a lot of deep fakes and we’re seeing a lot of growth.

There’s a big, an acceleration of autonomous as well.

What do you kind of predict where are we going in this path in AI in the future?

Basically we’re going to where we can’t trust anything, which we’re kind of already there, to be honest with you.

It was insane.

And so much work and running these batch files and pulling this out and I mean, it was just insane.

And now you do the same thing with 10 minutes in an online thing or you can generate an entire avatar.

So when you generate an entire avatar, it makes it a whole lot easier for you to be able to do things like, hey, wave your hand in front of your face.

And it doesn’t, doesn’t do weird crap.

Right.

Like, like those tells are out the window.

So I, I think it’s going really interesting and I actually really kind of like some of the things you can do with it.

And you know, not to plug the company, but one of the things we’re doing is we’re actually partnering with a company called Synthesia and you can create your own training courses using someone in the team.

Maybe even as an avatar.

Okay.

So they can do that.

And we’re not shy.

Like, yes, this is AI.

It’s going to say that on there.

But it also builds that rapport with somebody.

You recognize their face.

And so my hope is sometimes maybe that’ll make people more comfortable picking up the phone and going, I did something stupid or something went wrong.

So I see that happening.

I also see, like, in the outside world, outside of all this, I know there are big questions throughout the courts here about evidence and how do you deal with evidence.

I talked to a couple of statewide judicial councils, actually, and their big question is, how do I know if this is real or not?

Like, somebody brings me a receipt and says, I’m at this place on this time.

And I’m like, you don’t.

Right.

We have to have corroborating stuff with that as well.

Or the only way you’re going to check out these pictures or videos is, unfortunately, to have it checked by a forensics expert.

And that’s going to be costly and it’s going to delay things.

And you’re not going to do that for a $500 small claims court sort of thing.

Right.

So it’s really hard to be able to tell what’s going on there.

But it’s being used that way already.

We know that.

So.

So we have a problem around the world, outside also to deal with what’s real and what’s not.

Absolutely.

What I’ve seen some of those images are receipts and documents and stuff.

And it’s quite scary that how accurate and how realistic they look.

And it really gets into the point is that just having an image or video or an audio as evidence I don’t think is enough by itself.

And it means that you have to combine it with something else.

You have to have some additional content, context.

I do.

I think the great thing, and one of you, you know, you.

You mentioned it really well, is how fast AI mixes go.

It makes, you know, it’s an accelerant.

I always say it’s like the.

The mushroom in Super Mario Kart that, you know, when you get that mushroom, it helps you really go super fast, but it doesn’t make you a better driver.

So, you know, you still have to be good at using the tools and technology in order to get the most out of it.

But it goes super fast.

It’s.

It allows me to do things, or it used to take me a day, things done in an hour or two now, which is.

Which is amazing, how fast it allows us to go.

But it seems.

Don’t tell the boss that though.

Well, the thing is, you know, they get quite surprised.

Oh my goodness, he’s so much more productive.

How is he doing all this stuff?

And it’s like, you know, but absolutely, it’s, it’s, it really allows you to spend more time doing the things that helps you learn and be contextable, you know, and think about things that are more challenging or, you know, strategic for the future.

If you can get a lot of those day to day operations of automate IT and autonomous, but it does introduce lots of risks, the attackers can do that as well.

To your point, if we’re not patching, we’re not even going through that hardening process.

It means that the attackers are able to find those vulnerabilities much faster and create attack and exploits and payloads much faster.

So if you’re the gap of, you may have thought that, okay, a 14 day patch period was sufficient in the past, and you’ve spent years going from 90 days to 15, then you really got to think about what’s between 0 and 15, how do you harden that even more further because more sophisticated attackers will be able to take advantage of that much faster than they have in the past.

Yeah.

And OSINT tools, I see a lot of things going from, you know, you used to have the spearfishing or the whaling being way up at the top of the food chain.

Right.

But now it’s sliding down a little bit because OSINT collection is so much faster.

So they’re becoming more targeted even at the mid level range because, you know, back then it wasn’t worth putting five hours into something to go attack some receptionist.

Right.

It just wasn’t worth that.

If you wanted to do something, you go for the big fish.

But now it’s all happening in the background.

It’s putting together these dossiers on people that are amazing, all based on OSINT and making those much more effective.

But again, it’s sliding down the org chart as to who’s being attacked and seeing those good ones.

Yeah.

And the size of organization as well.

So I mean it’s not just these large enterprises.

It’s every, every organization of all sizes that they owe since out there.

And they’re able to get it really quickly.

And also in the flip side of that as well is they do be able to exfiltrate, you know, data from organizations.

They can analyze that data much faster and understand about what types of information’s in there, you know, passwords, credit card information, personal information that they can use to monetize or, you know, they do find illegal activities.

They can also use it to threaten the organization that they would disclose it in the Internet as well.

So there’s multiple ways of, you know, attackers are leverag extortion and ransomware these days in many different factors.

Yeah, it’s not just encryption.

The data is 100% the real value these days when it happens.

But the big money comes in the data extortion side.

Absolutely.

I believe even at one point we look at the Verizon data breach investigations, extortion overtook ransomware, encryption based ransomware as the top method because an extortion is less noisy.

You know, systems aren’t down, you know, devices are still working and it’s literally the attackers are using, you know, they’re able to do it much quieter with the organization kind of having, you know, you know, to no notify public and investors and customers.

Those types of data breaches go a little bit less, you know, hidden in the background.

So I would say, yeah, I remember.

The first time I saw something kind of related to that.

It was in San Francisco, the Bay Area Rapid Transit kind of group there they got taken down by ransomware.

And you know, people were having to, they were getting on free because the signs were up.

You know, all the screens had the ransomware flag on it.

But they, they weren’t going to pay.

And the, the attackers realized that.

So they came back and they said, well, we also stole your data.

Data, okay.

And they called their bluff on it.

They went, yeah, it’s a bunch of crap.

And sure enough, they hadn’t stolen any data.

But I remember thinking at the time, ooh, that could get super ugly.

Right?

And this was probably eight years ago, seven years ago, something like that.

I’m like, that could get super ugly in a hurry if they really did do that.

And then all of a sudden you got like maze coming out.

And like now it’s just a function of the tools, not something specific.

And even some are skipping the whole encryption side and just going for the data.

Absolutely.

I always remember the Vastamo case, the one in fin of the psychiatrist and health record information that was stolen and made public, which is quite scary.

You know, we move at a very Fast pace, everything’s moving and we have to stay up to date.

How do you stay up to date?

What’s your method of learning?

Do you have your own awareness month that you spend to become aware and is there any things that you’re reading or learning that’s quite fun and interesting?

Yeah, I’m not great at like non fiction books, so reading and to me they’re always kind of outdated.

So I keep an eye a lot on like social media, LinkedIn.

I talk to people all over the place.

Hey, what are you seeing?

What’s going on here?

Like a lot of that communication with people that are in the field and seeing stuff that’s incredibly helpful with that too.

There’s a lot of good info even going out still on X formerly known as Twitter, you know, there’s still a lot of good information there and what’s happening through LinkedIn too, like I said.

And then there’s news, you know, there’s things that you can spot on that.

But I, I see a lot of those attacks coming through social, to be honest with you.

I saw one this morning, I think it was where some bad actors had hit a, one of those digital billboards in one of the local Florida cities and they put the George Costanza on the couch thing across this giant billboard for like the city, you know.

So I’ve run across things like that just even out of the blue that I’m like, oh, okay.

And then I’ll look into it a little bit more and go, okay, how did this happen?

What’s going on there?

I also talked to some of our inside threat analysis guys, this guy, Jack Chapman, super smart out of the uk, I talked to him a lot about what are we seeing here when we’re catching the stuff because we do an email gateway filter thing also.

But it’s like what do you see, seeing what are you.

What’s going on?

And so we’ll catch up like that as well.

Absolutely.

I find it even my.

One of my favorites is HallwayCon.

You know, just recent conferences is just walking through the hallway and meeting awesome people.

I’ve met so many amazing people just queuing for, for you know, different talks or events and activities and it’s became, it’s became awesome.

So even one of the recent events last, last weekend it was just fantastic doing the whole Waycon and I, I learned lots of interesting things which is like for me it’s always a lot of the value even I think it was not this year, but last year when I was queuing.

I remember there was a kid standing next to me in line.

There’s a couple of friends who were all looking around and he had created this awesome badge which was a Star Trek communicator badge.

And it was really amazing.

And this kid was Bryce and he was like, now for the defcon this year he also created another badge which again was way awesome.

And this is a 16 year old who’s just seeing the creativity coming into the industry.

For me, was.

Is always fantastic.

And when you get lining cues, you get to meet really awesome people.

Yeah, I love that part more than going to the sessions most of the time.

Honestly, like I find myself talking to people a lot more.

Even at Black Hat and defcon, I find myself doing that way more than I end up in the sessions just sitting there watching one person talk.

It’s.

Yeah, absolutely.

I do have to thank you as well for getting me into the whole Dungeon crawler Carl now.

So.

So.

It’s been a journey.

Yep, yep, it’s been, it’s been a journey and I’m really enjoying it.

So.

And I’m looking at.

Oh my goodness, there’s so many books that I’ve got a long way to go.

Yeah, yeah, yeah.

So.

But I think I do thank you for that.

Now for the audience, Dungeon crawler Carl, if you haven’t read it, get into it.

And if you do see Eric at the conferences, try to point out if he does have any Dungeon crawler Carl kind of ease and swag chastiser stuff.

Yeah, absolutely.

Yeah.

And I will say this about it though real quick, Joe.

The audiobooks I think are actually better than the written books.

Okay.

Through the narration and they have two,.

They have two versions, two versions of that, of the audio.

There’s the immersive one which adds all the effects and stuff in.

So it’s pretty impressive as well.

So if the audience does have any questions to follow up on, what’s the easiest way for them to reach out to you and contact you if they want to learn more or if they want to learn about what conferences or what you’re gonna be talking at are hard to get to some of the sessions you’re doing, what’s the easiest way for the audience to follow up with you?

Easiest way for me is LinkedIn.

That’s the one that I’m on the most, but I’m honestly not on it that often either.

So my apologies, I will check it out eventually.

But yeah, LinkedIn is by far the easiest way to get a hold of me and I accept almost any connection requests.

On LinkedIn.

But I’ll say this.

If you’re a salesperson and the first thing you do is try to go, hey, let me tell you about.

I just immediate drop that connection and we’re done.

Right?

So if you’re a salesperson, just don’t, please don’t waste my time and yours doing that, okay?

No, absolutely.

I completely agree that, you know, those things have to be earned and just getting a connection request is not earning it 100%.

Yeah, I’ll definitely make sure that add the link also into the show notes as well, so people will be able to find you.

Eric, it’s always amazing.

It’s all I.

You’re one of my favorite people to talk to.

Always great seeing you all the time and many thanks for, for joining me on the podcast today.

No, I. I appreciate that so much.

Like, when we get to finally see each other, it’s usually a defcon now, right?

Like, that’s about the only place we ever run into each other is out there.

And I always look forward to you, always bring a smile to my face and I always learn something from you and the people you know.

So I absolutely appreciate that and I love that you gave me the opportunity to be on here and hopefully somebody’s going to learn something from it or think about something because of this.

So thanks for that opportunity.

Absolutely.

It’s a pleasure.

So for everyone, this is the Security by Default podcast, bringing you really awesome guests, interesting topics that’s really important to make the world a safer place.

And that’s really what we’re here to do.

Help bring you insights, help teach you, help learn about new technologies, new innovations, and ultimately where the world’s going.

So hopefully this has been educational.

I’ll make sure that all the information show notes will be added.

So easy to find afterwards.

So this is security by default.

Join us every two weeks.

New episodes, new guests, new topics.

Stay safe and take care until the next time.

Thank you.