WEBVTT 00:03.220 --> 00:09.837 [SPEAKER_03]: It feels a little bit like when there's choose your own adventure books where you're told, you know, if your victim mentions a promotion, turn to page 47. 00:10.218 --> 00:13.325 [SPEAKER_03]: If they seem sad about their cat, go back to page 23. 00:14.067 --> 00:16.032 [SPEAKER_03]: Deploy emergency empathy. 00:25.124 --> 00:34.702 [SPEAKER_01]: With smashing security, episode 449, how to scam someone in seven days, with Grand Kluely and Special Guest Leslie Carhartt. 00:35.544 --> 00:38.650 [SPEAKER_03]: Hello, hello and welcome to smashing security episode 449. 00:39.051 --> 00:40.534 [SPEAKER_03]: My name is Grand Kluely. 00:40.654 --> 00:42.357 [SPEAKER_00]: And I'm Leslie Carhartt. 00:42.337 --> 00:44.420 [SPEAKER_03]: Leslie, thanks for coming on the show. 00:44.460 --> 00:51.729 [SPEAKER_03]: First time on the pod of course, hey, you're a well-known name in the world of cybersecurity. 00:52.089 --> 00:59.599 [SPEAKER_03]: If people aren't familiar with Leslie Carhartt, they should at least be familiar with hacks for pancakes, which is your, where is that easy? 00:59.619 --> 01:00.780 [SPEAKER_03]: Are you pseudonym? 01:00.921 --> 01:02.563 [SPEAKER_03]: Is that what we'd be right to call it? 01:03.023 --> 01:04.265 [SPEAKER_00]: I'm well-known. 01:04.325 --> 01:05.466 [SPEAKER_00]: This is very exciting. 01:05.506 --> 01:10.673 [SPEAKER_00]: Somebody tell my dad, it's self-deprecating humor. 01:11.260 --> 01:12.803 [SPEAKER_00]: my handle refers to. 01:12.823 --> 01:15.228 [SPEAKER_00]: It's like, move so fast for pizza, something like that. 01:15.348 --> 01:16.951 [SPEAKER_03]: It's, oh, I see. 01:17.532 --> 01:22.402 [SPEAKER_00]: I do a lot of volunteer work in the community, and I never get rid of you created for it. 01:22.943 --> 01:26.410 [SPEAKER_00]: And I just do that now, you know, like, I do it because it's fun. 01:26.450 --> 01:28.033 [SPEAKER_00]: And I care about people. 01:28.053 --> 01:30.878 [SPEAKER_00]: It takes so I kind of get paid and food for a lot of stuff. 01:31.059 --> 01:31.159 [SPEAKER_03]: Yeah. 01:31.139 --> 01:35.846 [SPEAKER_03]: You are being self-deprecating here because you are a no name in the world of cyber security. 01:35.886 --> 01:38.951 [SPEAKER_03]: You give talks, you're an online presence. 01:39.212 --> 01:45.141 [SPEAKER_03]: I see popping up on my social feeds all of the time as well and you've been working in cyber security for some years now. 01:45.321 --> 01:49.267 [SPEAKER_00]: Since Dana's first walk the year, yes, I've been in cyber security for about 20 years now. 01:49.508 --> 01:52.152 [SPEAKER_03]: And what particular area of cyber security do you work in? 01:52.132 --> 02:07.231 [SPEAKER_00]: I do critical infrastructure investigations, so digital forensics and incident response on things like planes and trains and factories and ships and all kinds of industrial stuff that's part of critical infrastructure. 02:07.592 --> 02:20.468 [SPEAKER_03]: Well before we kick off today's podcast, let's thank this week's wonderful sponsors, Mita Vanta and Threat Locker, we'll be hearing about them later on in the show. 02:20.498 --> 02:37.174 [SPEAKER_03]: We won't be talking about how hackers are hunting for Android-powered smart TVs to build at the denial of service popnet. 02:40.107 --> 02:50.590 [SPEAKER_03]: and we won't even mention how fake blue screens of death delivered via boobytrapped bookin.com emails other latest tactic being used by hackers targeting hotels. 02:54.559 --> 02:57.525 [SPEAKER_03]: So Leslie, what are you going to be talking about this week? 02:57.640 --> 03:00.444 [SPEAKER_00]: I'm not going to be talking about critical infrastructure cyber today. 03:00.484 --> 03:11.500 [SPEAKER_00]: I want to talk about something that's near and dear to my heart, and that is the direst rate of the cybersecurity hiring and jobs market, especially for young people, and what they can potentially do about it. 03:12.121 --> 03:16.928 [SPEAKER_03]: And I'm going to be telling you what star sign is the best if you are a romance scammer. 03:17.429 --> 03:21.234 [SPEAKER_03]: Plus, we have a featured interview with Danny Jenkins from Thret Locker. 03:21.815 --> 03:26.061 [SPEAKER_03]: All this and much more coming up on this episode of Smash and Security. 03:30.665 --> 03:35.713 [SPEAKER_03]: Before we go any further, I want to say a few words about one of our sponsors this week, threat locker. 03:35.845 --> 03:42.516 [SPEAKER_03]: Most cyber attacks don't start with some genius hacker writing custom malware, they start with something much simpler. 03:43.117 --> 03:49.968 [SPEAKER_03]: Like a misconfigured setting, an exposed service, or a security policy that quickly drifted out of line. 03:49.988 --> 03:56.719 [SPEAKER_03]: And in large complex IT environments, those misconfigurations are everywhere and almost impossible to track manually. 03:57.159 --> 04:03.169 [SPEAKER_03]: And that's my threat locker built, defense against configurations or DAC. 04:03.436 --> 04:09.753 [SPEAKER_03]: Threat Lock at DAC gives you a real-time view of configuration weaknesses across your entire environment. 04:10.134 --> 04:18.677 [SPEAKER_03]: It runs deep checks across every endpoint, not just your threat locker policies, but your operating systems and application settings too. 04:18.657 --> 04:25.606 [SPEAKER_03]: All of it appears in one clean dashboard showing what's misconfigured how risky it is and exactly how to fix it. 04:26.147 --> 04:29.311 [SPEAKER_03]: So no more discovering problems after the attackers do. 04:29.711 --> 04:33.336 [SPEAKER_03]: With DAC you see configuration drift as it happens. 04:33.917 --> 04:39.484 [SPEAKER_03]: You can also check alignment with major security frameworks and see which endpoints don't make the grade. 04:39.464 --> 04:47.177 [SPEAKER_03]: If you want to stop firefighting, harden your environment and catch hidden risks before they turn into breaches, you need DAC. 04:47.617 --> 04:56.953 [SPEAKER_03]: Try for free the 30 days at ThreatLocker.com and find out what's misconfigured before it costs you. 04:56.973 --> 04:59.717 [SPEAKER_03]: Right, Lizly, I've got a question for you, quick question. 04:59.883 --> 05:10.625 [SPEAKER_03]: When you think about your ideal romantic partner, what star sign springs to mind, Jim and I are sexy Scorpio, what do you fancy? 05:11.247 --> 05:13.551 [SPEAKER_00]: But I'm a very unique individual. 05:13.912 --> 05:15.375 [SPEAKER_00]: So who is it for everyone else? 05:16.237 --> 05:19.123 [SPEAKER_03]: Ooh, who is it for everybody else? 05:20.133 --> 05:20.814 [SPEAKER_03]: I'm not sure. 05:20.934 --> 05:23.938 [SPEAKER_03]: I've always heard Scorpio's a meant to be the sexy ones aren't they? 05:23.958 --> 05:25.520 [SPEAKER_03]: Isn't that the the marked into Parliament? 05:25.540 --> 05:27.643 [SPEAKER_03]: Isn't that what the PR people say for Scorpio? 05:28.084 --> 05:30.507 [SPEAKER_00]: Perhaps like I can tell you about Mr. 05:30.567 --> 05:36.415 [SPEAKER_00]: Spark and I can tell you about Captain Picard and I can tell you about Chelsea attacks. 05:36.496 --> 05:39.019 [SPEAKER_00]: You're going to have to you can have to throw me at the light here. 05:39.083 --> 05:42.306 [SPEAKER_03]: OK, OK, you've got truly interplanetary, I suppose. 05:42.487 --> 05:45.730 [SPEAKER_03]: This is what you've got on the Alpha Centauri when we're talking stars here. 05:45.830 --> 05:47.231 [SPEAKER_03]: You've got to beat all you saw me. 05:47.492 --> 05:52.537 [SPEAKER_03]: Well, apparently, apparently, back down to Earth Leslie for a moment, get your feet on the ground. 05:52.837 --> 05:55.880 [SPEAKER_03]: Apparently, the correct answer is Taurus. 05:56.541 --> 06:07.993 [SPEAKER_03]: Because according to professional romance scammers, Taurus is the most compatible with other signs. 06:07.973 --> 06:13.564 [SPEAKER_03]: or you might be the right match for me, then saying your tourists is apparently the best thing. 06:13.584 --> 06:19.014 [SPEAKER_03]: Now, I'm not sure what astrological experts they can salt on this, presumably not mystic make, but there we are. 06:19.114 --> 06:20.136 [SPEAKER_00]: Probably chat to BT? 06:20.196 --> 06:24.204 [SPEAKER_03]: Yeah, well who goes to any legitimate experts these days anymore? 06:24.244 --> 06:26.067 [SPEAKER_03]: They just go to AI, don't they? 06:26.047 --> 06:53.708 [SPEAKER_03]: But this revelation about Taurus comes from a recent Reuters investigation that describes how police and the Philippines raided a couple of scam compounds north of Manila and found something rather interesting what they uncovered were actual written instruction manuals 06:53.688 --> 07:14.312 [SPEAKER_03]: And these things, these manuals, these were detailed, they had scripts, they had personality assessments, they had day by day timelines, it's like they had commercialized and written and operations manual for heartbreak effectively, you know, whatever, we're going to grab them and then we're going to rip them apart. 07:14.292 --> 07:16.316 [SPEAKER_03]: That's what these books would tell you how to do. 07:16.336 --> 07:26.597 [SPEAKER_00]: Grandma, I think we should step back for a moment and talk about these compounds in the kind of people who end up in these compounds conducting the scams that we receive through our social media and phones and things. 07:26.797 --> 07:39.670 [SPEAKER_03]: Well, this is a really good point because the thing which many people don't realize it, you tend to think in all scammers are bad guys, but often the scammers are actually victims themselves because these aren't lonely individuals in basements. 07:40.210 --> 07:42.933 [SPEAKER_03]: These are people who are victims often of human trafficking. 07:42.953 --> 07:47.998 [SPEAKER_03]: They've been led to compounds in Southeast Asia often, with promises of legitimate jobs. 07:48.358 --> 07:50.300 [SPEAKER_03]: They've had their passports confiscated. 07:50.460 --> 07:55.285 [SPEAKER_03]: They're often forced to work on these scams and their videos online. 07:55.265 --> 08:06.016 [SPEAKER_03]: of some of the conditions and the way in which government and law enforcement is trying to shut down these huge compounds with sometimes thousands of people who are working effectively as slaves for the scammers. 08:06.236 --> 08:06.576 [SPEAKER_03]: Yes. 08:06.656 --> 08:07.957 [SPEAKER_03]: Really heart-breaking, isn't it? 08:07.977 --> 08:15.645 [SPEAKER_00]: And that seems like it's horrible, and that's a really good explanation for why they would make a manual like that, because these people never thought about being scammers. 08:15.685 --> 08:22.892 [SPEAKER_00]: They thought they were going to go to become a cook or a thiener in another country, and all of a sudden, they're being told they're the quota of scams to make. 08:22.872 --> 08:25.458 [SPEAKER_00]: Yeah, I guess the guidebook makes a lot of sense. 08:25.959 --> 08:33.097 [SPEAKER_03]: So, if we look at one of these handbooks, like Reuters have done it, here's the opening line from one of them, because it really sets the tone. 08:34.059 --> 08:35.262 [SPEAKER_03]: It says... 08:35.478 --> 08:56.693 [SPEAKER_03]: A woman's IQ is zero when in love, whereas a man's IQ is obviously zero even when he's not in love with that, but he's not charming, he got real guidebook to romance, he's like, well when she's in love, she'll go have any intelligence at all, it's horrendous thing to say. 08:56.733 --> 08:58.296 [SPEAKER_03]: I mean, where do you even begin with that? 08:58.377 --> 08:59.919 [SPEAKER_00]: but they had some more statistics. 09:00.079 --> 09:01.540 [SPEAKER_00]: It had a little bit more to it then. 09:01.681 --> 09:02.542 [SPEAKER_03]: Yeah, there's more to it. 09:02.562 --> 09:09.169 [SPEAKER_03]: So they say, as long as the emotions are in place, the client's money will naturally follow. 09:09.790 --> 09:16.177 [SPEAKER_03]: And yes, they actually call them clients, not victims and the thefts which occur as a result of the scam. 09:16.517 --> 09:18.139 [SPEAKER_03]: Those are described as sales. 09:18.579 --> 09:22.984 [SPEAKER_03]: So even the romance scammers 09:22.964 --> 09:27.613 [SPEAKER_03]: These handbooks, they go into real detail about building a fake persona. 09:27.653 --> 09:29.377 [SPEAKER_03]: This is where it gets weirdly specific. 09:29.417 --> 09:42.222 [SPEAKER_03]: So if you are a romance scammer, according to these handbooks, apparently you should claim that you work for SinoPek, which is China's state oil company, but that your station oversees. 09:42.202 --> 09:43.926 [SPEAKER_03]: your birthday makes you a tourist. 09:44.287 --> 09:50.622 [SPEAKER_03]: You say that you were divorced six years ago, and you have a daughter who lives with your ex-wife. 09:51.103 --> 09:53.950 [SPEAKER_03]: So I think the intention is to say, look, I'm 09:54.520 --> 10:12.826 [SPEAKER_03]: I'm obviously as accomplished a personality that I have managed to have a relationship with somebody in the past, I have managed to consummate my relationship and have a child so I'm clearly capable of having a relationship, but don't worry because they're not going to be hanging around very much. 10:13.167 --> 10:14.689 [SPEAKER_03]: So I'm available. 10:14.669 --> 10:18.695 [SPEAKER_03]: I am a father, but at the same time, there's not a daughter who's going to crampaster. 10:18.916 --> 10:20.558 [SPEAKER_03]: It's really oddly specific isn't it? 10:20.738 --> 10:27.068 [SPEAKER_03]: It's like if you added, and my favourite biscuit is the hop-nob, but I will eat a digestive if pushed. 10:28.831 --> 10:35.001 [SPEAKER_03]: I wonder if there's somewhere a scammer who accidentally sometimes says, oh, I was divorced seven years ago and they think, oh, I've blown it. 10:35.562 --> 10:41.571 [SPEAKER_03]: I've said seven years, rather than six years, we're going to have to start again all from scratch finding a new victim. 10:41.551 --> 10:44.517 [SPEAKER_00]: I am fascinated by those catfish scams. 10:44.597 --> 10:54.839 [SPEAKER_00]: I've been watching a lot of the catfish UK show recently and you see a lot of those parallels even when it's somebody vocal in the same country that saying, I worked for a remote company in an out of town. 10:55.480 --> 10:59.789 [SPEAKER_00]: And don't push a long for a year or two or three just saying, oh, we'll meet up. 10:59.969 --> 11:00.731 [SPEAKER_00]: Oh, I got delayed. 11:00.771 --> 11:02.715 [SPEAKER_00]: I have to work another month overseas. 11:02.695 --> 11:08.302 [SPEAKER_00]: So it's a really good way to say, oh, I've got a stable job in our country and someday I'll come back and buy a house and settle down. 11:08.703 --> 11:13.269 [SPEAKER_00]: But right now, I have to be just far enough that we can't have reliable FaceTime. 11:13.349 --> 11:18.676 [SPEAKER_00]: We can't have reliable video calls and I'm working different hours and I have to miss you. 11:18.756 --> 11:22.401 [SPEAKER_00]: So I can keep pushing me at a long and keep saying, I'm not available. 11:22.441 --> 11:24.444 [SPEAKER_00]: I can't come home, I can't do a video call. 11:24.884 --> 11:30.812 [SPEAKER_00]: And it's amazing to me, like in some of these cans that I've read about and seen on TV and things, how long they go on. 11:30.792 --> 11:37.302 [SPEAKER_00]: with these people able to continue making excuses for like why they never talk on the phone or never show up on video. 11:37.683 --> 11:38.584 [SPEAKER_00]: But it's really affected. 11:38.664 --> 11:41.088 [SPEAKER_00]: Like the things that you're talking about in this guidebook. 11:41.549 --> 11:42.971 [SPEAKER_00]: Yeah, I'm a stable person. 11:43.151 --> 11:44.694 [SPEAKER_00]: I'm a parental. 11:44.754 --> 11:49.922 [SPEAKER_00]: I have a good job, but there's just this nagging reason why I can't commit right now. 11:50.423 --> 11:53.728 [SPEAKER_00]: So you're going to have to send me some money and we're going to have to wait a while. 11:53.708 --> 12:17.387 [SPEAKER_00]: it's it's very much like other standards it's not so much the pressure of like oh my gosh you're going to be a trouble like a lot of fishing emails it's more like you've got to emotional tie to this person who just seems like the ideal person for you and they're just making you wait a little bit longer and give a little money and just wait a little bit longer and and you've invested so much emotionally that you you come back to it and you you've fought for it and you stay there for it you 12:17.367 --> 12:19.851 [SPEAKER_00]: year or many months or something. 12:19.911 --> 12:20.812 [SPEAKER_00]: It's kind of crazy. 12:20.912 --> 12:26.521 [SPEAKER_03]: And some of these scams, as you said, they can go on for years, collecting money over time. 12:26.541 --> 12:36.977 [SPEAKER_03]: And you think, hang on, hang on, if you really are in a relationship with Brad Pitt online or Jason Staten, isn't it likely they would have fixed their webcam by now? 12:36.997 --> 12:45.771 [SPEAKER_03]: It's likely they would have gone into a Starbucks and got a decent Wi-Fi connection in order 12:45.751 --> 12:52.241 [SPEAKER_03]: slight glimmer of hope that it might be true is what keeps people hooked for so long. 12:52.341 --> 12:54.744 [SPEAKER_03]: And so you're right, sometimes these things go on for ages. 12:54.804 --> 12:58.871 [SPEAKER_03]: This particular handbook lays out a seven day plan. 12:59.471 --> 13:06.582 [SPEAKER_03]: I thought, come on, you can't surely pull off a scam like this within seven days, but according to handbook, it reckons you can. 13:06.602 --> 13:10.628 [SPEAKER_03]: So you have a lot of churn in this particular model. 13:10.608 --> 13:17.275 [SPEAKER_03]: and apparently goes from seven days from saying hello nice to meet you to stealing your money. 13:17.335 --> 13:20.779 [SPEAKER_03]: So this is how they describe it is done. 13:21.740 --> 13:25.003 [SPEAKER_03]: Day one, first contact that you've given you a Star Trek reference. 13:25.383 --> 13:29.307 [SPEAKER_03]: First contact, the script literally starts with hello. 13:29.848 --> 13:33.272 [SPEAKER_03]: My name is, I don't know, Graham, not the sexiest name in the world. 13:33.312 --> 13:33.792 [SPEAKER_03]: Let's be honest. 13:34.152 --> 13:36.615 [SPEAKER_03]: My name is Graham, nice to meet you. 13:38.519 --> 13:43.789 [SPEAKER_03]: Day two, you're already talking about investment because that's grade A flirting in my experience. 13:43.809 --> 13:48.919 [SPEAKER_03]: This goes straight to the crypto currency, D5. 13:49.320 --> 13:51.745 [SPEAKER_03]: Day five, you're in a proper relationship. 13:51.785 --> 13:57.135 [SPEAKER_03]: I guess you've bombarded the wind so many messages that haven't got any room for common sense in their head anymore. 13:57.115 --> 13:58.398 [SPEAKER_03]: Not that you've met each other. 13:58.879 --> 14:00.584 [SPEAKER_03]: Of course, that's just old fashioned. 14:00.624 --> 14:08.142 [SPEAKER_03]: If you have chatted online, there may be you've been speaking to a deep fake rather than a genuine person. 14:08.162 --> 14:08.864 [SPEAKER_03]: D7. 14:08.884 --> 14:09.425 [SPEAKER_03]: Day 7. 14:09.947 --> 14:13.335 [SPEAKER_03]: According to the timeline, lay down these handbooks. 14:13.315 --> 14:17.982 [SPEAKER_03]: is when your victim is put in money into a fake investment platform. 14:18.002 --> 14:23.890 [SPEAKER_03]: One week, that is the timeline, laid out in this handbook, which Reuters has got its paws on. 14:24.311 --> 14:31.381 [SPEAKER_03]: And if someone isn't responding quickly enough, according to this particular group of scammers, the handbook says, well, drop them after day three. 14:31.702 --> 14:32.183 [SPEAKER_03]: Move on. 14:32.543 --> 14:33.504 [SPEAKER_03]: Don't waste your time. 14:33.765 --> 14:35.427 [SPEAKER_03]: There are other victims to find. 14:35.507 --> 14:39.373 [SPEAKER_03]: So there are people who can fool for these things very quickly. 14:39.353 --> 14:43.799 [SPEAKER_03]: The manual includes this corporate mission statement, which boils down to it basically. 14:45.141 --> 14:51.109 [SPEAKER_03]: Don't chat awkwardly, our mission is to share life and work happily with our customers. 14:51.189 --> 14:54.634 [SPEAKER_03]: Again, they're describing the victims as their customers. 14:54.714 --> 14:56.977 [SPEAKER_00]: I think there's two very important lessons in them. 14:56.997 --> 14:57.178 [SPEAKER_00]: Yep. 14:57.238 --> 15:03.927 [SPEAKER_00]: And the first lesson there that's really significant is they are playing on two things they're desired to get quick rich. 15:03.907 --> 15:07.215 [SPEAKER_00]: and the desire to find true love without too much effort. 15:08.037 --> 15:11.305 [SPEAKER_00]: It's hard for those things to be offered to you way too quickly. 15:11.345 --> 15:13.390 [SPEAKER_00]: There's probably a red flag there. 15:13.490 --> 15:19.384 [SPEAKER_00]: If anybody's going to tell you that you can instantly get a lot of money or you can instantly get love in seven days, 15:19.533 --> 15:20.995 [SPEAKER_00]: something is really wrong. 15:21.075 --> 15:22.056 [SPEAKER_00]: Let's just say that. 15:22.076 --> 15:31.768 [SPEAKER_00]: And that's the same kind of pressure that's used in all kinds of scans, fishing email, things like that, that pressure to do things really fast, especially to make a bunch of money or get rewarded somehow. 15:31.788 --> 15:33.009 [SPEAKER_00]: And there's two rewards there. 15:33.089 --> 15:35.653 [SPEAKER_00]: So they're really doubling down on the carrot there. 15:36.133 --> 15:40.699 [SPEAKER_00]: And the other thing is that moving on to another target, that's true in a lot of scams too. 15:40.839 --> 15:45.945 [SPEAKER_00]: Like, a lot of people talk about, you know, oh, it's so hard to defend against adversaries, 15:45.925 --> 15:58.190 [SPEAKER_00]: A lot of head-to-series groups, they tried with certain threshold and sometimes it's a very well-established organizational threshold and if you are too part of a target up to that level, they move on to the next group. 15:58.210 --> 16:03.360 [SPEAKER_00]: And so even having some defenses is a great deterrent for those types of criminal actors. 16:04.032 --> 16:05.134 [SPEAKER_03]: Yep, it's a good point. 16:05.876 --> 16:12.689 [SPEAKER_03]: So looking at one of these handbooks, it gives specific advice for targeting different groups of people. 16:12.709 --> 16:19.403 [SPEAKER_03]: For instance, mid-stage women, mid-stage women, it says, are in fact the group carrying the heaviest burden. 16:19.423 --> 16:23.070 [SPEAKER_03]: They say, husbands often don't listen patiently. 16:23.050 --> 16:36.514 [SPEAKER_03]: Children are too young to understand the intricacies and difficulties within the family, so if you want to build a relationship with middle-aged women, chat with them about trivial matters, is what this says. 16:37.175 --> 16:39.239 [SPEAKER_03]: Which is pretty horrible thing to say, isn't it? 16:39.319 --> 16:41.363 [SPEAKER_03]: Not least because maybe, 16:41.343 --> 16:42.425 [SPEAKER_03]: It's not actually wrong. 16:42.505 --> 16:46.431 [SPEAKER_03]: There are plenty of people who find themselves stretched. 16:46.631 --> 16:52.640 [SPEAKER_03]: People who find there's an emotional gap in their life and these scammers are find in it and they're exploiting it. 16:53.341 --> 16:57.307 [SPEAKER_03]: And in the guidebook, it gives advice to the scammers. 16:57.368 --> 17:03.537 [SPEAKER_03]: It says, look, if your target is quite a cold-hearted sort of personality, 17:03.517 --> 17:08.481 [SPEAKER_03]: Tease them a little bit, undermine them slightly, then sweet talk them afterwards. 17:08.521 --> 17:09.983 [SPEAKER_03]: It says, that's the best approach. 17:10.163 --> 17:18.090 [SPEAKER_03]: They say, if they're career-oriented, mirror their positive energy appear reliable, if they're a bit conservative, you offer excitement. 17:18.590 --> 17:22.273 [SPEAKER_03]: And then a scape from daily life, apparently that is the trick. 17:22.654 --> 17:33.523 [SPEAKER_03]: It feels a little bit like when those choose your own adventure books where you're told, you know, if your victim mentions a promotion turn to page 47, if they seem sad about their cat, go back to page 23. 17:33.503 --> 17:36.207 [SPEAKER_03]: to deploy emergency empathy at this point. 17:36.868 --> 17:38.811 [SPEAKER_03]: It's bizarre, isn't it? 17:38.832 --> 17:39.953 [SPEAKER_03]: But it kind of makes sense. 17:39.973 --> 17:41.956 [SPEAKER_03]: It's the industrialization of scamming. 17:42.517 --> 17:43.799 [SPEAKER_00]: And we all think they're immune to this. 17:43.920 --> 17:47.686 [SPEAKER_00]: We all think that, oh, well, we would never fall for that stuff that sure that scam or anything. 17:47.726 --> 17:49.468 [SPEAKER_00]: But we all have emotional needs. 17:49.489 --> 17:56.880 [SPEAKER_00]: And we just talked about in that this, like a bunch of different things that play on our insecurities and our hurt center trauma as we get older. 17:57.041 --> 17:59.224 [SPEAKER_00]: And any of those could work on anyone. 17:59.288 --> 18:01.834 [SPEAKER_03]: So there are all kinds of techniques which they're using. 18:01.874 --> 18:14.867 [SPEAKER_03]: They give descriptions of what to do if their victim has had a traumatic childhood or is it breakups, for instance, or if people have been pampered or spoiled in the past different ways to behave with these different kinds of people. 18:15.016 --> 18:20.583 [SPEAKER_03]: It's really kind of behavioral conditioning, all with the intention of getting money out of them. 18:20.744 --> 18:31.458 [SPEAKER_03]: And I know we're having a bit of a laugh at some of the absurdity of all of this, but this is genuinely horrendous stuff that can ruin lives, because they exploit very human needs. 18:31.898 --> 18:39.388 [SPEAKER_03]: The connection, as you said, for validation, for love and I think that's why it's important we talk about these things openly, because anyone can fall for this. 18:39.789 --> 18:42.913 [SPEAKER_03]: And if they catch you at a vulnerable moment, that's a problem. 18:43.585 --> 18:51.679 [SPEAKER_03]: So, one of these handbooks targets men, and it's full of banal conversation or prompts, you know, it's like, how are you this afternoon? 18:51.799 --> 18:55.125 [SPEAKER_03]: Or, remember to eat on time when you're busy at work. 18:55.245 --> 19:00.614 [SPEAKER_03]: It's like something that's been generated by an AI that's been trained exclusively on texts from your mum. 19:00.955 --> 19:01.836 [SPEAKER_03]: You know, have you eaten? 19:01.876 --> 19:02.918 [SPEAKER_03]: Are you warm enough? 19:02.938 --> 19:04.681 [SPEAKER_03]: Are you wearing your jumper? 19:05.162 --> 19:07.045 [SPEAKER_03]: Don't forget to call your man. 19:07.025 --> 19:10.449 [SPEAKER_03]: And one of the conversational gambits they use with men is to do with sport. 19:11.050 --> 19:18.399 [SPEAKER_03]: So, couldn't for handbook, what men really want is they want a romantic partner who is also into basketball. 19:20.182 --> 19:29.033 [SPEAKER_03]: And so they're saying, talk to them about basketball, say that you've always been a fan of the leakers, but since Kobe left, they've been unable to watch any leakers go now. 19:29.393 --> 19:36.542 [SPEAKER_03]: For those of you don't follow American sport and I include myself in that I had no idea 19:36.522 --> 19:39.628 [SPEAKER_03]: This Kobe chap apparently was a star play died a few years ago. 19:40.169 --> 19:47.202 [SPEAKER_03]: So essentially, they're instructing scammers to pretend that they're still emotionally processing this guy's death. 19:47.643 --> 19:54.075 [SPEAKER_03]: It's like if they said to me, I've never been the same since they cancelled C-facts and turned off teletext on the television. 19:54.055 --> 19:56.638 [SPEAKER_03]: because yeah, yeah, I would identify with that. 19:56.658 --> 20:00.521 [SPEAKER_03]: That was a similar emotional impact on me when that sort of thing happened. 20:00.942 --> 20:03.384 [SPEAKER_03]: There's an FAQ Leslie as well. 20:03.905 --> 20:08.309 [SPEAKER_03]: Questions, victims might ask when they start getting suspicious. 20:08.329 --> 20:11.012 [SPEAKER_03]: So I wanted to run some of these questions by you. 20:11.432 --> 20:13.575 [SPEAKER_03]: And I'm surprised there isn't one which says question. 20:13.855 --> 20:14.576 [SPEAKER_03]: Are you a scammer? 20:14.736 --> 20:16.137 [SPEAKER_03]: And the answer would be dull. 20:16.157 --> 20:22.644 [SPEAKER_03]: And if I was a scammer, would I've told you about my vulnerable elderly mother, my dreams of opening an artisan bacon? 20:22.664 --> 20:24.045 [SPEAKER_00]: Yes, actually. 20:24.025 --> 20:26.170 [UNKNOWN]: What? 20:26.611 --> 20:27.032 [SPEAKER_00]: What? 20:27.112 --> 20:27.674 [SPEAKER_00]: Gentleman. 20:27.834 --> 20:28.536 [SPEAKER_00]: Gentleman. 20:28.596 --> 20:28.836 [SPEAKER_00]: Yes. 20:28.937 --> 20:30.541 [SPEAKER_00]: Here's the advice for the gentleman. 20:30.841 --> 20:32.806 [SPEAKER_00]: It's not the money and the true love thing. 20:33.227 --> 20:42.068 [SPEAKER_00]: If somebody offers to be your mother and your bro in a relationship immediately within seven days, there's a big problem that's a red flag. 20:42.048 --> 20:45.314 [SPEAKER_03]: But if they dream of opening a bakery, I'm in there, right? 20:45.475 --> 20:49.082 [SPEAKER_03]: I'm so fantastic, we've got sausage rolls, we've got some decent sourdough. 20:49.202 --> 20:51.526 [SPEAKER_03]: Yes, let's do this, let's get together. 20:51.907 --> 20:54.792 [SPEAKER_03]: So here are some of the genuine entries from the FAQ. 20:55.454 --> 20:56.456 [SPEAKER_03]: Question from the victim. 20:57.117 --> 20:58.740 [SPEAKER_03]: Why can't I withdraw the money? 20:59.902 --> 21:03.547 [SPEAKER_03]: answer because the platform has a detection mechanism. 21:03.928 --> 21:07.232 [SPEAKER_03]: Freak when we've draws might attract customer service attention. 21:07.293 --> 21:10.938 [SPEAKER_03]: So, darling, you must listen to me and follow my lead. 21:12.280 --> 21:14.483 [SPEAKER_03]: Next question, why is the account frozen? 21:15.184 --> 21:17.287 [SPEAKER_03]: And this is for bait amounts of which they steal. 21:17.327 --> 21:18.889 [SPEAKER_03]: So why don't you listen to me? 21:18.869 --> 21:25.162 [SPEAKER_03]: Didn't I tell you whether to withdraw or not your random operations lead to the account being frozen? 21:25.322 --> 21:37.688 [SPEAKER_03]: And this is extraordinary that the victim's money is frozen in a fake platform and the scripted responses to blame them for not following instructions. 21:38.174 --> 21:40.398 [SPEAKER_03]: real proper gaslight in which we're seeing here. 21:40.418 --> 21:46.507 [SPEAKER_03]: And you saw them shift from calling them darling to suddenly blame in them for what they've done wrong. 21:46.608 --> 21:48.691 [SPEAKER_00]: It's a narcissist level of manipulation. 21:48.771 --> 21:50.654 [SPEAKER_00]: It absolutely psychologically brilliant. 21:50.754 --> 21:51.576 [SPEAKER_00]: And it's horrible. 21:51.896 --> 21:52.778 [SPEAKER_00]: It's just terrific. 21:53.078 --> 21:53.198 [SPEAKER_00]: Yeah. 21:53.218 --> 21:53.739 [SPEAKER_00]: It's horrible. 21:54.340 --> 21:54.901 [SPEAKER_03]: It's horrible. 21:55.241 --> 21:57.365 [SPEAKER_03]: And there was a bit of me reading this article. 21:57.405 --> 21:59.929 [SPEAKER_03]: And indeed, talking about it on the podcast, which 21:59.909 --> 22:05.014 [SPEAKER_03]: We've given a little bit of a blueprint for a scammer's now to follow in these footsteps. 22:05.094 --> 22:07.897 [SPEAKER_03]: I guess they wouldn't tell them too long to work this out. 22:07.937 --> 22:10.120 [SPEAKER_03]: But you have to think when you're reading these things. 22:10.200 --> 22:12.703 [SPEAKER_00]: I think they know because these scams are nothing new. 22:12.743 --> 22:15.485 [SPEAKER_00]: I was just watching the old TV shows about scams like this. 22:15.586 --> 22:16.827 [SPEAKER_00]: And they've gone on for years. 22:17.508 --> 22:19.550 [SPEAKER_00]: Romance scams haven't changed a whole bunch. 22:19.670 --> 22:23.494 [SPEAKER_00]: It's just a young guy that element of the internet being connected to everything. 22:23.874 --> 22:28.279 [SPEAKER_00]: They're still manipulating the same emotions in the same ways to do similar stuff. 22:28.664 --> 22:46.271 [SPEAKER_03]: So some people are losing tens of thousands of dollars, some people are losing, well, their life savings, you know, it could be hundreds of thousands, which they're losing as a result of some of these scams, and they can go on for a long time as people, once they've given some money, they almost want to give more. 22:46.291 --> 22:49.837 [SPEAKER_03]: They can't accept the fact that it may have gone terribly, terribly wrong. 22:49.877 --> 22:52.461 [SPEAKER_03]: So a few things spring to mind, right? 22:52.829 --> 22:54.171 [SPEAKER_03]: These scams are industrialised. 22:54.672 --> 22:57.417 [SPEAKER_03]: They're not some lonely individual in the basement anymore. 22:57.457 --> 23:03.587 [SPEAKER_03]: These are operations with handbooks and training and quotas and style guides as to how to behave. 23:04.228 --> 23:10.799 [SPEAKER_03]: Somewhere there's probably a middle manager who's looking at the KPIs to find out how much money each individual scammer is bringing in. 23:11.360 --> 23:13.504 [SPEAKER_03]: Secondly, no one is immune from this. 23:13.484 --> 23:37.213 [SPEAKER_03]: Thirdly, if you know someone, or if you indeed are summoning an online relationship and the other person starts talking about investments or crypto or amazing opportunities, that should be a red flag, however deep you are in, be extremely cautious and careful right there, because real romantic partners, they talk to you about what's on Netflix. 23:37.193 --> 23:37.554 [SPEAKER_03]: right? 23:37.955 --> 23:41.542 [SPEAKER_03]: They're not, they're not talking about cryptocurrency yield strategies. 23:42.083 --> 23:45.690 [SPEAKER_03]: That's what you should be talking about with your limit, actually. 23:45.710 --> 23:51.462 [SPEAKER_03]: Maybe it'd be better to be talking about the poems of Gerard Manley Hopkins of Elizabeth Barrett Browning instead. 23:51.822 --> 23:59.117 [SPEAKER_03]: I don't know, but you know, talk about something like that which you can both get into rather than crypto currency. 23:59.468 --> 24:01.352 [SPEAKER_03]: So, um, Leslie, haven't tell me. 24:01.372 --> 24:02.575 [SPEAKER_03]: Are you a tourist? 24:02.595 --> 24:03.016 [SPEAKER_00]: Oh, no. 24:03.036 --> 24:03.517 [SPEAKER_00]: I know. 24:03.938 --> 24:05.401 [SPEAKER_00]: I'm not an Alio. 24:05.903 --> 24:06.624 [SPEAKER_03]: Oh, okay. 24:06.644 --> 24:07.446 [SPEAKER_00]: Can you tell? 24:07.526 --> 24:08.448 [SPEAKER_00]: Can you tell? 24:08.488 --> 24:12.297 [SPEAKER_00]: Nobody has ever seen I've been pretending to be Alio. 24:13.795 --> 24:17.299 [SPEAKER_03]: Well, let's take a moment now to thank one of this week's sponsors, META. 24:17.739 --> 24:26.229 [SPEAKER_03]: Now, if you've ever worked to 19, especially networking, you'll know when the network's working, nobody notices, when it isn't everybody notices. 24:26.649 --> 24:33.537 [SPEAKER_03]: The problem is that most business networks are a mess of different providers, tools, dashboards, contracts, and cross-fingers. 24:33.817 --> 24:41.946 [SPEAKER_03]: And somehow, despite all that complexity, they're expected to be fast, secure, reliable, 24:41.926 --> 24:43.671 [SPEAKER_03]: And that's where META comes in. 24:44.172 --> 24:53.579 [SPEAKER_03]: META builds networks from the ground up, they deliver a complete, full stack, network solution, wired, wireless and cellular, all as one integrated service. 24:54.200 --> 24:56.948 [SPEAKER_03]: And this is genuinely full stack, META. 24:56.928 --> 25:02.835 [SPEAKER_03]: designs the hardware rights the firmware builds the software manages the deployment and runs the support. 25:03.156 --> 25:21.838 [SPEAKER_03]: They even take care of things like ISP procurement, routing, switching, farbals, VPNs, DNS security, SD1, and multi-site networking in other words, fewer vendors, fewer dashboards, fewer who owns this problem, conversations, and far fewer late-night panic attacks. 25:21.818 --> 25:27.026 [SPEAKER_03]: Meeters' approaches about real control, proper visibility, and networks that behave themselves. 25:27.046 --> 25:32.554 [SPEAKER_03]: And for IT leadership, it means something almost mythical in networking, predictability. 25:32.834 --> 25:37.862 [SPEAKER_03]: If you're responsible for keeping the business online, you really should check out Meta. 25:38.283 --> 25:42.829 [SPEAKER_03]: So go to meta.com slash smashing to book a demo now. 25:43.210 --> 25:50.661 [SPEAKER_03]: That's metr.com slash smashing, and thanks to Meta for supporting the show. 25:52.717 --> 25:54.520 [SPEAKER_03]: Leslie, what do you want to talk to us about today? 25:55.180 --> 25:55.281 [SPEAKER_00]: Yeah. 25:55.301 --> 25:56.342 [SPEAKER_00]: I want to talk about the job. 25:56.863 --> 25:59.887 [SPEAKER_00]: I'm terminally online and I talk to a lot of young people. 25:59.947 --> 26:01.429 [SPEAKER_00]: I have free mentorship sessions. 26:01.650 --> 26:03.352 [SPEAKER_00]: I let people everywhere on the planet. 26:03.472 --> 26:08.759 [SPEAKER_00]: Talk to me about their career plans and cybersecurity and I run career clinics and I mentor you and students. 26:09.240 --> 26:10.522 [SPEAKER_00]: And so I work with a lot of young people. 26:10.862 --> 26:13.246 [SPEAKER_00]: And there's just some things people are getting. 26:13.706 --> 26:15.909 [SPEAKER_00]: Yeah, both hiring managers and students. 26:15.930 --> 26:18.393 [SPEAKER_00]: And it's it's ending kind of catastrophe right now. 26:18.533 --> 26:19.855 [SPEAKER_00]: So here's a deal. 26:19.835 --> 26:25.645 [SPEAKER_00]: It's not great economic times globally right now and there's been a lot of layoffs and chuckling recently. 26:25.665 --> 26:30.252 [SPEAKER_00]: So that compounds this problem of the cybersecurity job market being poor right now. 26:31.033 --> 26:32.816 [SPEAKER_00]: It's poor for a multitude of reasons. 26:33.397 --> 26:34.319 [SPEAKER_00]: The economy is one. 26:34.820 --> 26:38.666 [SPEAKER_00]: The rise of AI is a big buzzword to replace human beings. 26:39.087 --> 26:46.078 [SPEAKER_00]: Probably not that effectively, but it's being sold well to senior leadership and 26:46.058 --> 27:03.647 [SPEAKER_00]: And also for a while cyber security is marketed as this huge awesome well-paying space where they needed millions of people around the world and you were going to get paid six to years and everybody about four years ago went into a university program or boot camp for cyber security. 27:04.007 --> 27:09.957 [SPEAKER_00]: They've seen number of people like post-pandemic and they all just graduated over the last couple of years. 27:09.937 --> 27:10.878 [SPEAKER_00]: and there's too many. 27:11.619 --> 27:12.260 [SPEAKER_00]: There's too many. 27:12.280 --> 27:15.505 [SPEAKER_00]: There's more applicants and jobs in most countries right now. 27:16.286 --> 27:22.154 [SPEAKER_00]: And what that has resulted in is a catastrophic collapse of the cybersecurity junior jobs market. 27:22.835 --> 27:24.137 [SPEAKER_00]: And I'm not trying to oversell this. 27:24.237 --> 27:25.359 [SPEAKER_00]: You can go on Reddit. 27:25.419 --> 27:29.785 [SPEAKER_00]: You can go on hiring forums and career boards and seeing it just stop at it is. 27:29.765 --> 27:35.517 [SPEAKER_00]: And I'm not trying to be like doom and gloom, but like if you want to get into cyber security right now, you need to have a really good plan. 27:35.638 --> 27:37.442 [SPEAKER_00]: It's not like the wild less anymore. 27:37.482 --> 27:40.829 [SPEAKER_00]: There are very clear academic credentials you need to get in right now. 27:40.849 --> 27:41.631 [SPEAKER_00]: And I don't like that. 27:42.092 --> 27:43.014 [SPEAKER_00]: I'm not endorsing it. 27:43.114 --> 27:45.900 [SPEAKER_00]: I don't want everybody to have the same degree, but 27:45.880 --> 27:55.073 [SPEAKER_00]: right now, the people who are making it into junior jobs, the lowest level entry level cybersecurity jobs in, let's say, blue team, like sock analysts jobs. 27:55.634 --> 27:57.757 [SPEAKER_00]: They have a four-year computer science degree. 27:58.158 --> 28:00.781 [SPEAKER_00]: They have a couple years working in full-time general IT. 28:01.582 --> 28:11.837 [SPEAKER_00]: They have their usually tricep to a basic IT certifications and then like a higher tier sock analyst 28:11.817 --> 28:19.371 [SPEAKER_03]: because you need that level of qualification to poke your head up above all the rest of the people out there when you're applying for a job. 28:19.391 --> 28:28.547 [SPEAKER_00]: My peers who hire for socks were seeing 150 to 300 qualified candidates meet those qualifications applying for every position right now. 28:28.848 --> 28:29.769 [SPEAKER_00]: It's pretty dire. 28:29.930 --> 28:30.771 [SPEAKER_00]: So, 28:30.751 --> 28:32.414 [SPEAKER_00]: it's not like don't get into the field. 28:32.675 --> 28:36.222 [SPEAKER_00]: It's just like you see wanted to be a doctor or a lawyer or something. 28:36.322 --> 28:40.871 [SPEAKER_00]: There's now going to be much more serious qualifications need mentorship. 28:40.891 --> 28:43.877 [SPEAKER_00]: You should do a network of like-minded professionals. 28:43.897 --> 28:47.705 [SPEAKER_00]: And there's lots of good community resources about we have the B-sides conference. 28:47.725 --> 28:48.186 [SPEAKER_00]: Yes. 28:48.166 --> 28:49.408 [SPEAKER_00]: We have discourse. 28:49.828 --> 28:50.449 [SPEAKER_00]: We have slaps. 28:50.489 --> 28:52.572 [SPEAKER_00]: You have wonderful podcasts like this one. 28:52.612 --> 28:58.060 [SPEAKER_00]: You have lots of ways to network and meet people at professional groups like ISSA. 28:58.120 --> 29:06.252 [SPEAKER_00]: There's options but you can't just bring your way into cybersecurity anymore and the jobs aren't nearly as high paying as they used to be at entry level. 29:06.432 --> 29:10.478 [SPEAKER_00]: So it has to be something you genuinely care about and want to do. 29:10.458 --> 29:16.771 [SPEAKER_00]: And you have to have a good strategy for how you're going to complete adequate academics to get through HR screening. 29:17.272 --> 29:23.485 [SPEAKER_00]: Right now HR screening automated screening is blocking a lot of people's path of cybersecurity. 29:23.505 --> 29:25.971 [SPEAKER_00]: So mentorship networking. 29:26.572 --> 29:30.981 [SPEAKER_00]: Understanding the market around you and what is being asked for in job positions. 29:30.961 --> 29:39.236 [SPEAKER_00]: understanding that you might really need some general IT work you might have to go work in it help us for a while before you can qualify for a cybersecurity job. 29:39.857 --> 29:41.961 [SPEAKER_00]: And you might need a degree at this point. 29:42.161 --> 29:44.365 [SPEAKER_00]: It's going to be tough to get in without one. 29:44.466 --> 29:47.451 [SPEAKER_00]: So all those things are considerations. 29:47.431 --> 29:51.015 [SPEAKER_00]: Please don't jump into the seal right now unless you understand what you're getting into. 29:51.195 --> 29:52.256 [SPEAKER_00]: It's hard out there. 29:52.276 --> 29:53.338 [SPEAKER_00]: It's really tough. 29:53.618 --> 29:57.202 [SPEAKER_00]: Bring down people right now and it's for us who are senior professionals in the field. 29:57.342 --> 29:58.904 [SPEAKER_00]: I hope you are venturing like me. 29:58.924 --> 30:03.389 [SPEAKER_00]: I hope you're meeting with young people because I see a couple people and tears that are really great now. 30:03.609 --> 30:12.139 [SPEAKER_00]: Like please talk to young people around you, volunteer at programs, help young people get into the seal because it's so much harder for them than it was for us. 30:12.119 --> 30:13.061 [SPEAKER_00]: It's really important. 30:13.241 --> 30:14.043 [SPEAKER_00]: We need people. 30:14.083 --> 30:20.016 [SPEAKER_00]: We would like to retire some many so we have to pipe line people in like I live out of each now. 30:20.397 --> 30:22.602 [SPEAKER_00]: Sunday I just want to sit on that beach all day. 30:23.063 --> 30:31.562 [SPEAKER_00]: So I need young people to get into this field successfully and if we make their lives impossible they're not going to do that and I won't get to sit on my beach. 30:32.032 --> 30:40.585 [SPEAKER_03]: Well, I think you make a very fair point and it certainly has changed enormously from, well, I just fell into this industry completely by accident. 30:40.785 --> 30:46.594 [SPEAKER_03]: I didn't get any cybersecurity qualifications to get my first job working in cybersecurity. 30:48.096 --> 30:50.500 [SPEAKER_03]: I got in through someone like one of my video games. 30:51.261 --> 30:57.651 [SPEAKER_03]: But it also means that I, as a veteran in this industry and I'm sure we've got some other veterans who are listening here as well. 30:57.867 --> 31:03.617 [SPEAKER_03]: I sometimes feel ill qualified to give advice to young people because the world is so different from my day. 31:03.657 --> 31:13.374 [SPEAKER_03]: You know, when they say, well, what areas of cybersecurity should I be looking into is difficult to know where I should point people if they're a particular niche is, which they should follow. 31:13.394 --> 31:14.897 [SPEAKER_03]: Do you have any advice on that? 31:14.877 --> 31:30.979 [SPEAKER_00]: Sometimes they just need somebody to talk to because it's so hard out there like I will sit on call sometimes we're I'll just listen to somebody rant and cry for a while and they know what they need to do it's like oh I'm gonna have to go back to another two years of school to get a bachelor's the two year degree isn't enough. 31:30.959 --> 31:37.189 [SPEAKER_00]: It's something like that, or I really need to put this toxic job where I'm being treated horribly, but I'm scared to do it. 31:37.389 --> 31:41.756 [SPEAKER_00]: Sometimes they just need to hear an unbiased person say, yeah, super, you need to do that. 31:41.937 --> 31:46.063 [SPEAKER_00]: So you'd be surprised how much you can help just like listening to somebody for 30 minutes. 31:46.184 --> 31:49.028 [SPEAKER_00]: And you don't have to be an expert at every area of cybersecurity. 31:49.068 --> 31:52.073 [SPEAKER_00]: You just have to be an ear who's done this for a while. 31:52.053 --> 31:59.654 [SPEAKER_00]: You can definitely help them tune down possibilities for programs from burning for self-study, like that's it's all helpful. 31:59.815 --> 32:07.075 [SPEAKER_00]: Anything you do right now to like motivate them and encourage them and be there for them is important because they're getting really bad advice from other people. 32:07.055 --> 32:23.072 [SPEAKER_03]: And one of the pieces of advice, which I've heard people use recently, and I don't know how I feel about this, is you mentioned how CVs and resume is, I get in pre-screened by eight child departments, maybe by automated processes, and a lot of people are now saying, well, they're hacks. 32:23.052 --> 32:37.371 [SPEAKER_03]: which you can use, maybe inside the PDF of your resume to hide keywords, which maybe an AI, which is scanning the resumes on mass, we'll say, oh, this matches are job advert. 32:37.391 --> 32:39.734 [SPEAKER_03]: You know, this is the right candidate to put forward. 32:40.015 --> 32:41.557 [SPEAKER_03]: You advocate that sort of thing. 32:41.577 --> 32:48.486 [SPEAKER_03]: So changing your resume to try and get past the pre-screen int specific to each job application, which they're making. 32:48.466 --> 32:52.457 [SPEAKER_00]: I tell people to think about ATS is that automated applicant tracking systems. 32:53.259 --> 32:54.623 [SPEAKER_00]: I tell people, it's a game. 32:54.784 --> 32:55.526 [SPEAKER_00]: True, like a game. 32:55.546 --> 32:56.629 [SPEAKER_00]: You've got to play the game. 32:56.930 --> 32:57.772 [SPEAKER_00]: I didn't make the game. 32:58.273 --> 32:59.397 [SPEAKER_00]: You have to play the game right now. 32:59.417 --> 33:01.081 [SPEAKER_00]: ATS is not usually AI. 33:01.222 --> 33:03.087 [SPEAKER_00]: It's usually like string searches. 33:03.107 --> 33:03.488 [SPEAKER_00]: Right. 33:03.468 --> 33:05.972 [SPEAKER_00]: for exact keywords by percentile. 33:06.192 --> 33:07.294 [SPEAKER_00]: It's not that smart yet. 33:07.775 --> 33:17.870 [SPEAKER_00]: And so yes, like if you need to stick a bunch of extra keywords in white text in the margin to get more into your CV or your resume, fine, as long as you're not lying, don't lie. 33:18.051 --> 33:20.194 [SPEAKER_00]: Never lie on your CV or resume. 33:20.695 --> 33:25.302 [SPEAKER_00]: Something that's very important is every time you're applying to a job, make sure that you're matching those keywords. 33:25.703 --> 33:28.888 [SPEAKER_00]: The ones who actually have exactly in their selling and their format. 33:28.908 --> 33:29.188 [SPEAKER_00]: Yes. 33:29.168 --> 33:38.102 [SPEAKER_00]: Their computer is basically doing a percentile keyword match against your spills section in your resume and your certifications and what's in that posting. 33:38.202 --> 33:41.026 [SPEAKER_00]: And if you're not updating a certain percentile, you're just getting tossed out. 33:41.347 --> 33:44.151 [SPEAKER_00]: So if you're getting almost immediate rejections, that's the problem. 33:44.372 --> 33:45.694 [SPEAKER_00]: It's not you, it's your document. 33:46.154 --> 33:56.290 [SPEAKER_00]: And again, understand it's a bit of a game right now, but the thing that really sucks about that is people are using AI to like rebuild their resumes and then send them automatically to all these postings in 33:56.270 --> 34:00.875 [SPEAKER_00]: It's considered formats and it's bogging down the systems because they're sending them out to everything. 34:01.336 --> 34:12.649 [SPEAKER_00]: So we've got like this horrible applicant screening automation that people are trying to defeat through horrible LLM mass emailing and like mass submissions and like everything is grinding to a halt. 34:13.489 --> 34:18.455 [SPEAKER_00]: So networking, personal networking, referrals, things like that also incredibly important right now. 34:18.755 --> 34:22.800 [SPEAKER_00]: Need to be at meetups, you need to be at conferences, and you need to get referrals for jobs. 34:22.915 --> 34:30.273 [SPEAKER_03]: So I never thought, excuse my conspiratorial, mind at this point, I never thought a curse to me. 34:30.994 --> 34:37.650 [SPEAKER_03]: If we've got this huge mess of people who have an interesting cyber security, 34:38.086 --> 34:48.279 [SPEAKER_03]: have learnt about cyber security, cannot get compensated through legitimate means for their cyber security skills by forge an conventional career. 34:49.340 --> 34:59.773 [SPEAKER_03]: Is there a danger that those skills could be misapplied because there's certainly plenty of news about other people with cyber security skills who appear to be stealing millions of dollars? 35:00.007 --> 35:14.411 [SPEAKER_00]: I mean, that's been happening since the early end days, like the, you know, cybercrime back and the 90s at early 2000s, like people who had computer science degrees and just had no prospects for a job, going into cybercrime for various desperate reasons and it still happens today. 35:14.471 --> 35:16.375 [SPEAKER_00]: And there's, it's not just job hunting. 35:16.395 --> 35:17.276 [SPEAKER_00]: It's also integration. 35:17.897 --> 35:22.205 [SPEAKER_00]: Oh, hey, in a rating is an IT person right now is incredibly hard. 35:22.485 --> 35:25.731 [SPEAKER_00]: Again, it's the job market of saturated, the immigration market of saturated. 35:25.931 --> 35:26.031 [SPEAKER_00]: Yeah. 35:26.011 --> 35:43.648 [SPEAKER_00]: So for people who are trying to get out of very bad situations in lower resource countries in the world who count it on immigration to get out and what IT was going to be their way you're competing with all of them and they're competing with each other and if they can't make it out that's a bad situation for them from that perspective. 35:43.688 --> 35:54.499 [SPEAKER_00]: So lots of people are really good and they won't do bad things unless they're absolutely desperate to eat, to support their families and then it's a question mark. 35:54.479 --> 36:08.829 [SPEAKER_00]: Yeah, I think that is classability, and like the surge of young people is just such a mess because again, we need to pipeline and there's open jobs at senior levels and it's certain issues like mine, like in OT, legacy, we can't hire people fast enough because nobody who knows how to use Windows 95. 36:09.511 --> 36:15.323 [SPEAKER_00]: And then there's like regulatory areas where we can't hire anybody and there's senior positions we can't hire anybody. 36:15.303 --> 36:17.066 [SPEAKER_00]: and then other things are going on filled. 36:17.126 --> 36:20.271 [SPEAKER_00]: And then they're competing with a child or people are giving up to poor blinded crime. 36:20.311 --> 36:21.873 [SPEAKER_00]: It's like, it's huge mess right now. 36:21.933 --> 36:23.195 [SPEAKER_00]: Everybody needs to be aware of that. 36:23.215 --> 36:25.359 [SPEAKER_00]: And the only idea between our part to try to help with it. 36:26.100 --> 36:33.411 [SPEAKER_03]: Well, Leslie, I'm actually a little bit comforted by what you said in a personal level, because you said you can't hire anyone who still knows how to use Windows 9.5. 36:33.431 --> 36:35.514 [SPEAKER_03]: Because I think I know how to use Windows 9.5. 36:35.594 --> 36:39.981 [SPEAKER_03]: Windows 11 would be completely lost on Windows 95. 36:40.001 --> 36:41.243 [SPEAKER_03]: I don't know my way around. 36:41.358 --> 36:45.512 [SPEAKER_00]: To you can support all the hard plans in the world, don't worry, some. 36:48.985 --> 36:54.071 [SPEAKER_03]: Okay, before we go any further, I need to share a quick word with you about one of our sponsors today, Vanta. 36:54.352 --> 36:57.275 [SPEAKER_03]: You know how everyone's got an AI assistant these days. 36:57.656 --> 37:05.185 [SPEAKER_03]: Well, imagine one that doesn't just write high coos about zero-dane vulnerabilities, but actually does your audit work for you. 37:05.706 --> 37:07.108 [SPEAKER_03]: That is Vanta. 37:07.428 --> 37:17.541 [SPEAKER_03]: It connects to all of your tools, gathers evidence, tracks compliance, and quietly helps you prove that yes you do take 37:17.521 --> 37:28.375 [SPEAKER_03]: It pulls everything together, keeps an eye on your systems and basically make sure you're ready for an audit at any time, which means no last minute panic for screenshots and policies. 37:28.793 --> 37:33.919 [SPEAKER_03]: It also plugs into the tools you're already using and flags up issues before they become a right-ordnest. 37:34.259 --> 37:43.250 [SPEAKER_03]: So if that sounds like something that might save you from a few sleepless nights, check out vantar.com slash smash in. 37:43.751 --> 37:46.714 [SPEAKER_03]: And if you use that link, you'll get a thousand dollars off. 37:47.195 --> 37:54.143 [SPEAKER_03]: So don't forget vantar.com slash smash in, and thanks to vantar for sponsoring this week's episode. 37:55.169 --> 37:59.434 [SPEAKER_03]: and welcome back in your join us at our favourite part of the show, the part of the show that we like to call Pick of the Week! 38:05.601 --> 38:16.654 [SPEAKER_03]: Pick of the Week is the part of the show where everyone chooses something like a funny story a book that they read a TV show, a movie, a record of podcast, a website, or an app, whatever they wish it doesn't have to be security-related necessarily. 38:17.095 --> 38:19.517 [SPEAKER_03]: Now, my pick of the week this week is not security-related. 38:20.499 --> 38:23.522 [SPEAKER_03]: I was lucky enough to receive a marvelous 38:23.502 --> 38:33.101 [SPEAKER_03]: Willon Scarf, for Christmas knitted by my stepson Joe, it was a work of art now a scarf is not my pick of the week instead. 38:33.662 --> 38:44.143 [SPEAKER_03]: What I can tell you is it could not have been more perfectly timed because I have been devouring episodes of a TV show called Game of Wall. 38:45.322 --> 38:52.299 [SPEAKER_03]: And this is a TV show hosted by Olympic Diver and knitting evangelist Tom Daley. 38:52.860 --> 39:02.925 [SPEAKER_03]: He's a fine young man, and I've been watching this recently, where amateur knitters knock needles to impress judges. 39:02.905 --> 39:06.673 [SPEAKER_03]: So, so they are given just hours to tackle everything from fair-style tank tops to full-sized knitted sofas, right? 39:06.713 --> 39:18.737 [SPEAKER_03]: And they have to produce these things, click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click-click 39:18.717 --> 39:20.400 [SPEAKER_03]: This is where my life has got to. 39:21.161 --> 39:26.250 [SPEAKER_03]: The point where I'm watching, not so much rock and roll, I'm watching programs about knitting. 39:26.911 --> 39:39.273 [SPEAKER_03]: Now I should warn you, there's been some outrage and some online criticism of game of wool with TV show, specifically from the Fundamentalist fringe parts of the knitting community. 39:39.674 --> 39:41.417 [SPEAKER_03]: Some of that angry mob, 39:41.397 --> 39:50.840 [SPEAKER_03]: have said that the tasks given to the knitters are ridiculous, particularly the swimwear around, and which isn't really practical knitwear I have to say. 39:52.103 --> 39:58.900 [SPEAKER_03]: They also reckon that the skill range of some of the contestants is too broad, so as one contestant is actually my favorite holder. 39:58.880 --> 40:05.830 [SPEAKER_03]: Holgo is a marvellous nitter but a turns out he's a professional fashion designer and he's competing against Tobias. 40:06.191 --> 40:12.520 [SPEAKER_03]: So some controversy in the program hasn't ruined my enjoyment but if you are a militant nitter you're very very upset. 40:12.580 --> 40:18.188 [SPEAKER_03]: Oh and you're also upset that it's supposed to be about nitting but apparently there's a fair amount of crochet. 40:18.168 --> 40:22.774 [SPEAKER_03]: and crochet and knitting never the twain shell meet apparently. 40:23.555 --> 40:25.677 [SPEAKER_03]: So anyway, I've enjoyed the show. 40:26.058 --> 40:27.139 [SPEAKER_03]: It's called Game of Wall. 40:27.239 --> 40:30.303 [SPEAKER_03]: It's filmed in a remote Scottish barn, but it's gentle. 40:30.363 --> 40:43.839 [SPEAKER_03]: It's perfect for dark winter evenings, which we're having up in the northern hemisphere at least Leslie, and I watch it on Channel 4 here in the UK and maybe if you're really into knitting or think it would be up your street, maybe you'll get to find it online as well. 40:43.879 --> 40:44.460 [SPEAKER_03]: So that is it. 40:44.801 --> 40:47.584 [SPEAKER_03]: My pick the week is 40:47.868 --> 40:49.997 [SPEAKER_03]: Leslie, are you into knitting at all? 40:50.017 --> 40:53.794 [SPEAKER_03]: This is something you've never been asked on a cybersecurity podcast before I suspect. 40:54.297 --> 40:56.401 [SPEAKER_00]: I feel like I really need to be now. 40:56.521 --> 40:58.624 [SPEAKER_00]: This sounds incredibly intense. 40:59.646 --> 41:01.610 [SPEAKER_00]: I've always loved the Drake British Bake-off. 41:01.670 --> 41:06.538 [SPEAKER_00]: So I guess I'm going to need to finish all those episodes and then move on to fabulous garnish. 41:06.578 --> 41:10.024 [SPEAKER_03]: This is clearly a rip-off of the Great British Bake-off. 41:10.064 --> 41:11.146 [SPEAKER_03]: There are a number of these shows. 41:11.166 --> 41:14.592 [SPEAKER_03]: There's another one where there's a Great British Pottery Throwdown. 41:14.612 --> 41:16.435 [SPEAKER_03]: I also do like the Pottery Show. 41:16.455 --> 41:18.138 [SPEAKER_03]: Maybe that'll be a future pick the week. 41:18.759 --> 41:19.360 [SPEAKER_03]: Thanks. 41:19.340 --> 41:29.411 [SPEAKER_03]: For yes, this is the knitting one which I have been particularly enjoying, but yes, game of wool go and check it out if you are able and if you are so enticed. 41:29.993 --> 41:31.678 [SPEAKER_03]: And Leslie, what's your pick of the week? 41:32.047 --> 41:36.614 [SPEAKER_00]: Mindtick of the week is a local to Melbourne Australia, but I'm hoping it spreads out across the world. 41:36.634 --> 41:36.934 [SPEAKER_03]: Okay. 41:37.435 --> 41:39.438 [SPEAKER_00]: Yesterday I did an escape room here. 41:39.538 --> 41:42.703 [SPEAKER_00]: It's called Earthrise 1, and they have two escape rooms. 41:42.883 --> 41:55.742 [SPEAKER_00]: One is called Earthrise, and one is called Star Crew, and we did Star Crew, which is advertised as command, a spaceship bridge, in Star Trek inspired escape rooms, complete with real-time flight simulation. 41:55.722 --> 42:06.038 [SPEAKER_00]: So they've actually used a video game engine to run under space so that you can fly your spaceship around from eight completely constructed starship bridge in your uniforms. 42:06.659 --> 42:12.048 [SPEAKER_00]: There are bunch of scenarios including rewiring the bridge and everybody has a job. 42:12.108 --> 42:13.390 [SPEAKER_00]: Every somebody's the navigator. 42:13.430 --> 42:14.792 [SPEAKER_00]: Somebody's flying the ship. 42:14.812 --> 42:15.894 [SPEAKER_00]: Somebody's the captain. 42:15.954 --> 42:16.354 [SPEAKER_00]: Yeah. 42:16.374 --> 42:21.342 [SPEAKER_00]: And interacting with AI based characters who they can speak to a natural language. 42:21.322 --> 42:25.007 [SPEAKER_00]: And it was just such an amazing augmented reality experience. 42:25.027 --> 42:27.751 [SPEAKER_00]: I'm not a huge fan of AI, but this was brilliant. 42:27.971 --> 42:32.157 [SPEAKER_00]: I'm not paid up or anything to promote them, but it was just such a cool experience. 42:32.237 --> 42:38.306 [SPEAKER_00]: And it was one of the most brilliant augmented reality science fiction experiences I've done in my entire life, so check them out online. 42:38.326 --> 42:45.456 [SPEAKER_03]: So in this discovery room, you're in a some kind of space station and something's gone wrong that there's some sort of dilemma which you have to solve. 42:45.622 --> 42:47.544 [SPEAKER_00]: they have a two different episodes. 42:47.564 --> 42:54.512 [SPEAKER_00]: And one, I believe, is like rescuing the captain and the one that we did is a first contact with an alien species that goes wrong. 42:54.572 --> 42:57.195 [SPEAKER_00]: And you're on a model spaceship bridge. 42:57.295 --> 42:58.496 [SPEAKER_00]: And it's wired up. 42:58.516 --> 42:59.678 [SPEAKER_00]: These got screens. 42:59.718 --> 43:01.019 [SPEAKER_00]: It's got special effects. 43:01.540 --> 43:02.761 [SPEAKER_00]: You're all in costume. 43:03.102 --> 43:04.403 [SPEAKER_00]: And again, you're interacting. 43:04.423 --> 43:05.344 [SPEAKER_00]: You're in costume? 43:05.504 --> 43:06.565 [SPEAKER_00]: You're in costume. 43:06.605 --> 43:10.650 [SPEAKER_00]: They hand you a costume when you come in for your specific role on the bridge. 43:10.630 --> 43:12.078 [SPEAKER_00]: So it's magnificent. 43:12.098 --> 43:17.468 [SPEAKER_03]: You weren't wearing a red shirt, I hope, because that always is quite dangerous in those Star Trek scenarios, isn't it? 43:17.566 --> 43:19.969 [SPEAKER_00]: I think they avoided the red one for that reason. 43:19.989 --> 43:23.713 [SPEAKER_00]: I think they were other colors, but it was brilliant. 43:24.014 --> 43:28.599 [SPEAKER_00]: And it feels like something that needy if they do well and they can export to the rest of the world. 43:28.740 --> 43:30.662 [SPEAKER_03]: So, well, they're sounds like lots of fun. 43:30.682 --> 43:34.046 [SPEAKER_03]: And it's called Earth Rays 1, down in Melbourne. 43:34.166 --> 43:35.308 [SPEAKER_00]: Very, very cool concept. 43:35.368 --> 43:39.933 [SPEAKER_00]: I hope to see more escape rooms that are high-tech like that and use like unity engine and stuff. 43:39.953 --> 43:40.654 [SPEAKER_00]: Really cool. 43:42.693 --> 43:45.718 [SPEAKER_03]: Okay, well let's now have a quick word from another guest. 43:45.738 --> 43:48.802 [SPEAKER_03]: I am delighted to be joined today by Danny Jenkins. 43:48.943 --> 43:51.186 [SPEAKER_03]: He's the CEO and co-founder of ThreatLocker. 43:51.306 --> 44:02.764 [SPEAKER_03]: They're a company that takes a fairly firm view on what software should and shouldn't be allowed to run in your environment and how systems ought to be configured in the first place. 44:02.824 --> 44:03.946 [SPEAKER_03]: Danny, welcome to the show. 44:04.587 --> 44:06.169 [SPEAKER_03]: Thank you for inviting me today, Graham. 44:06.149 --> 44:07.854 [SPEAKER_03]: Well, it's a real pleasure to have you here. 44:07.994 --> 44:14.352 [SPEAKER_03]: Now, when organisations come to threat locker, what kind of problem of they usually try to fix? 44:15.535 --> 44:18.724 [SPEAKER_03]: Is there something that's just gone wrong that's made them pick up the phone? 44:19.687 --> 44:21.171 [SPEAKER_02]: Well, hopefully not. 44:21.151 --> 44:30.525 [SPEAKER_02]: So I think probably 20% of people that we onboard in throughout locker are in the middle of a cyber of attack or just experience the cyber attack on one of make sure it doesn't happen again. 44:30.585 --> 44:36.713 [SPEAKER_02]: Most people we try to get to and educate beforehand and they just wanted to make sure that they don't get hit by ransomware. 44:36.733 --> 44:49.572 [SPEAKER_02]: They don't get hit by a cyber attack and they know that they're seeing issues like users are clicking on go to meeting links or users are downloading team viewer and they're just scared about what this could ultimately mean in the future and what we're here 44:49.552 --> 44:57.317 [SPEAKER_02]: Those tools don't run unless you want them to, right, and one point Lee ransomware and reverse shells don't run in your environment. 44:57.685 --> 45:03.450 [SPEAKER_03]: Well, is that mostly an SMB problem or does everyone get bits in the same kind of way? 45:03.890 --> 45:04.811 [SPEAKER_02]: It's pretty much everybody. 45:04.831 --> 45:10.436 [SPEAKER_02]: I mean, if we think about some of the major cyber attacks happen, we see like MGM and Colonial Pipeline and Marx and Spancers. 45:10.516 --> 45:17.362 [SPEAKER_02]: It's not just SMB, SMB is obviously a much easier challenge because there's less change control as less culture to deal with. 45:17.722 --> 45:19.864 [SPEAKER_02]: A company can come in and say, well, you've got two new employees. 45:20.385 --> 45:21.365 [SPEAKER_02]: This is on your policy. 45:21.385 --> 45:22.406 [SPEAKER_02]: This is what we're going to do. 45:22.907 --> 45:26.730 [SPEAKER_02]: But our customers range from some of the biggest companies in the world. 45:26.710 --> 45:29.653 [SPEAKER_02]: right down to small companies through their MSPs. 45:30.154 --> 45:37.002 [SPEAKER_03]: And Fred Locker, what do you do differently from the tools organization to already think are protecting them? 45:37.603 --> 45:43.169 [SPEAKER_02]: What we're essentially doing is saying, the security is really about defining what is allowed and what isn't allowed. 45:43.209 --> 45:48.195 [SPEAKER_02]: The people often think, throughout our saying, no, you can't do anything and zero trust means nothing can happen. 45:48.175 --> 45:54.742 [SPEAKER_02]: It's not really about saying what's needed to do your job, what software is needed, what the software need access to in your environment. 45:55.403 --> 45:58.727 [SPEAKER_02]: And if we give it that and then we just don't give it any more. 45:59.228 --> 46:06.536 [SPEAKER_02]: And when you do that, you're saying I'm not just going to stop known ransomware or known cyber attacks, but I'm going to stop right the unknown from happening. 46:06.596 --> 46:11.061 [SPEAKER_02]: And what most securities trying to do is detect post breach. 46:11.041 --> 46:15.345 [SPEAKER_02]: And we do have input detection response, and we do have a cloud detection response. 46:15.385 --> 46:18.008 [SPEAKER_02]: But the reality is that's after something happened. 46:18.408 --> 46:20.890 [SPEAKER_02]: What we want to do is say, you don't need to run team view. 46:20.911 --> 46:22.772 [SPEAKER_02]: Or you don't need to run software on your machine. 46:22.812 --> 46:32.442 [SPEAKER_02]: Maybe you run office and Chrome and Zoom and say, agent, QuickBooks and SAP, but outside of that, what you really run that you didn't know about the day before. 46:32.482 --> 46:36.385 [SPEAKER_02]: So let's just define the policy that allows all of those things to run. 46:36.726 --> 46:38.027 [SPEAKER_02]: And let's define a policy that 46:38.007 --> 46:40.053 [SPEAKER_02]: defines what they can do in your environment. 46:40.113 --> 46:43.141 [SPEAKER_02]: So 7Zip doesn't need access to your network shares. 46:43.202 --> 46:48.978 [SPEAKER_02]: And I'm PowerShell doesn't need access to the internet or your files or 7Zip doesn't need access to the whole internet. 46:49.479 --> 46:52.467 [SPEAKER_02]: And then anything else that tries to happen outside of that is going to get blocked. 46:52.508 --> 46:53.029 [SPEAKER_02]: Now, in 46:53.009 --> 47:04.885 [SPEAKER_02]: In the world of detection and response, what you do is you say, well, this is what we consider abnormal behavior and if it happens, we're going to create an alert and they're trying to constantly outsmart the bad guys on what abnormal behavior is. 47:04.905 --> 47:09.331 [SPEAKER_02]: They're trying to say, oh, this is a new type of attack, perfect example of the MSHTA. 47:09.771 --> 47:11.994 [SPEAKER_02]: A year ago, I hadn't seen any attacks with it. 47:12.234 --> 47:16.600 [SPEAKER_02]: It basically is attackers now, emailing users saying copy and paste this into the runbox. 47:16.660 --> 47:20.265 [SPEAKER_02]: It will use MSHTA to create file a malware. 47:20.245 --> 47:25.793 [SPEAKER_02]: throughout our code will do is by default we said well MSHDA doesn't need access to the internet doesn't need access to your file so therefore it doesn't have it. 47:26.273 --> 47:29.858 [SPEAKER_02]: We don't care whether it's going to be used for good or bad it just doesn't need that therefore going to stop it. 47:30.219 --> 47:35.205 [SPEAKER_02]: An EDR will now say oh we just saw suspicious behavior on MSHDA let's try and lock down your machine. 47:35.546 --> 47:37.148 [SPEAKER_02]: It's much better to just block it to begin with. 47:37.729 --> 47:43.857 [SPEAKER_03]: Right okay so this is for some customers a bit of a mind set shift. 47:43.837 --> 47:49.143 [SPEAKER_03]: because this isn't necessarily the way in which they've been approaching security in the past. 47:49.163 --> 48:02.038 [SPEAKER_02]: It is, and it isn't, so it isn't in the terms of software because people aren't really thinking about software in that way, but they are thinking about files in that way since the 1990s, early 2000s, every file had a default denied policy at the bottom. 48:02.058 --> 48:05.963 [SPEAKER_02]: And if you wanted to open a purpose, you wanted to host a web server, you'd open up the web server port, 48:05.943 --> 48:06.223 [SPEAKER_02]: Right. 48:06.464 --> 48:07.705 [SPEAKER_02]: That's essentially what we're doing. 48:08.185 --> 48:15.473 [SPEAKER_02]: We're doing it in a bit of an automated way because typically you have five ports open at most if you're really, really hosting a lot of services with software. 48:15.493 --> 48:16.715 [SPEAKER_02]: We're going to push an agent out. 48:16.815 --> 48:20.979 [SPEAKER_02]: We're going to figure out all of the allow policies at the top and then we're going to put a denied policy at the bottom. 48:21.320 --> 48:24.804 [SPEAKER_02]: But we'll do that through an automatic learning onboarding discovery process. 48:24.864 --> 48:27.807 [SPEAKER_02]: And it takes a few hours of your time, maybe a few days of your time. 48:27.827 --> 48:32.252 [SPEAKER_02]: It takes maybe a month or two to onboard, but it's really hours of your investment. 48:32.312 --> 48:34.414 [SPEAKER_02]: Most of it is automatic learning. 48:34.394 --> 48:41.125 [SPEAKER_03]: feels to me like there are more attacks happening now than ever before and many of them are actually succeeding right now. 48:41.245 --> 48:46.153 [SPEAKER_03]: Do you have any sense as to where attackers are getting the most leverage at the moment? 48:46.233 --> 48:48.016 [SPEAKER_03]: What sort of attacks are working the best? 48:48.437 --> 48:55.508 [SPEAKER_02]: So I think it's such a large scope but I guess the biggest change we've seen in the last two years is from where they're getting leverages data. 48:55.977 --> 49:01.585 [SPEAKER_02]: So it used to be a couple of years ago that encrypt your files and the demand decryption keys to get your files back. 49:02.045 --> 49:03.988 [SPEAKER_02]: Now they're doing that kind of double distortion there. 49:04.168 --> 49:06.852 [SPEAKER_02]: They're encrypting your files, but they're also extracting all of your files. 49:07.112 --> 49:10.777 [SPEAKER_02]: And then if you refuse to pay them, they're going to release that data onto the Dart web. 49:11.158 --> 49:12.159 [SPEAKER_02]: They're going to use it against you. 49:12.179 --> 49:13.521 [SPEAKER_02]: They're going to send it to your customers. 49:13.561 --> 49:16.385 [SPEAKER_02]: And that could obviously cord massive reputation damage. 49:16.425 --> 49:21.732 [SPEAKER_02]: So I think that they're being very successful in getting paid to stop data getting out there. 49:21.712 --> 49:23.655 [SPEAKER_02]: But also ransomware is still very popular. 49:23.695 --> 49:25.598 [SPEAKER_02]: Speed-efficient is very very popular. 49:26.038 --> 49:28.281 [SPEAKER_02]: All of these other attack methods are still happening. 49:28.662 --> 49:32.788 [SPEAKER_02]: And also what's happening is, again, not just bigger targets, but it's supposed to be bigger ransoms. 49:32.828 --> 49:37.014 [SPEAKER_02]: If we go back to 2017 and we think about 1.5, most of the ransoms were $500. 49:38.096 --> 49:42.182 [SPEAKER_02]: Now, to get a ransom payment of less than $200,000 is pretty rare. 49:42.462 --> 49:45.947 [SPEAKER_03]: Do you think organisations are making the same mistake? 49:45.927 --> 49:53.034 [SPEAKER_03]: So for an over again, and if they are, is it that they're suffering because of the sheer complexity of their network? 49:53.114 --> 49:56.238 [SPEAKER_03]: So is it bad defaults, is it poor visibility? 49:56.278 --> 49:58.300 [SPEAKER_03]: What's the cause of all of this? 49:58.840 --> 49:59.741 [SPEAKER_02]: I think there's a couple of things. 49:59.781 --> 50:01.323 [SPEAKER_02]: I think, yes, they're making the same mistakes. 50:01.403 --> 50:09.371 [SPEAKER_02]: And we often hear on the news a sophisticated cyber attack took down a supermarket chain or a pipeline or a casino. 50:09.411 --> 50:12.154 [SPEAKER_02]: The reality is these are never sophisticated attacks. 50:12.134 --> 50:22.990 [SPEAKER_02]: There's somebody downloaded, go to a sister or a virtual, they clicked on an email link, piece of software ran, they left the port open, their firewall wasn't patch, they had a poorly configure VPN. 50:23.751 --> 50:27.336 [SPEAKER_02]: But those words are often used because it almost justifies the defense. 50:27.416 --> 50:31.081 [SPEAKER_02]: Like, well, we're the victim because these were sophisticated. 50:31.101 --> 50:37.230 [SPEAKER_02]: Whereas, if somebody says to you, I left my friend door unlocked and so on, walked in my house and stole my TV, you go, well, you're 50:37.210 --> 50:45.805 [SPEAKER_02]: But if someone says, well, I had my door locked and I had a house alarm and so on broke in, then they're more of a victim and I think we hear this word sophisticated because it paints. 50:45.845 --> 50:50.874 [SPEAKER_02]: The, the accompanying is a victim and they are victims and it's not right what's happening. 50:50.914 --> 50:55.422 [SPEAKER_02]: The reality is though, it's normally a poor configuration. 50:55.402 --> 50:58.789 [SPEAKER_02]: It's normally like they don't block untrusted software. 50:59.250 --> 51:02.076 [SPEAKER_02]: They have ports open on the internet shouldn't be open. 51:02.116 --> 51:04.281 [SPEAKER_02]: And apart, this is because they just didn't know. 51:04.321 --> 51:13.039 [SPEAKER_02]: And also, we're expecting IT professionals who have been in the same job for 20 years to suddenly know that the world is very, very different to what it was 20 years ago. 51:13.019 --> 51:20.651 [SPEAKER_02]: We're no longer dealing with viruses that show your pop-ups on your machine and say they love you, we're dealing with ransomware and coordinated crime gangs. 51:20.691 --> 51:22.373 [SPEAKER_02]: So you've got to be willing to defend. 51:22.433 --> 51:31.888 [SPEAKER_02]: And if you've got the same IT guy or girl sitting in the basement, update in the servers that they were in 2005 and expecting the same result, then you're not doing enough. 51:31.868 --> 51:41.068 [SPEAKER_02]: So that's one of the bigger areas, just not knowing what they should do and we've put a lot of effort into this in the last year making sure that almost given that customer's checklist, like this is 2025. 51:41.329 --> 51:46.099 [SPEAKER_02]: If you're not doing this, there's this and giving them a score of where they stand compared to their peers. 51:46.119 --> 51:49.607 [SPEAKER_02]: So then these guys and girls know what they should be doing. 51:49.807 --> 51:55.316 [SPEAKER_03]: you mention misconfigurations that they are really behind a uncomfortable number of breaches today. 51:56.017 --> 52:03.089 [SPEAKER_03]: Why is that such a hard problem to sort out even for organizations who believe that their world defended? 52:03.549 --> 52:15.088 [SPEAKER_02]: I think part of it is you make exceptions and the bigger the organization, the more exceptions they get made and people aren't aware of them and even actually in throughout luck as we release the feature in our product, we don't charge extra for it, it's called defense against configuration. 52:15.068 --> 52:20.178 [SPEAKER_02]: And we do, it's two hundred and something checks on every endpoint every day and now we're doing Office 365 as well. 52:20.599 --> 52:25.568 [SPEAKER_02]: And we're really quite good in security when it comes to insider thought like we're very strict on policies. 52:25.929 --> 52:30.318 [SPEAKER_02]: With a lot of monitoring, we have a lot of controls, no one can monitor us, did software or ports are shut down. 52:30.738 --> 52:32.562 [SPEAKER_02]: And now and again, we make temporary exceptions. 52:33.183 --> 52:36.790 [SPEAKER_02]: And when we actually deploy this, we realize that even in our own environment, 52:36.770 --> 52:56.230 [SPEAKER_02]: After we'd gone through a full fed ramp order and if you think about how difficult a fed ramp order is and what they're looking at these auditors, there were still configurations that were not right and there's a lot happening and it's very, very easy to say one day the CEO calls or somebody calls are doing an event, we need to open up this VPN. 52:56.210 --> 52:58.232 [SPEAKER_02]: We need to get publishers to serve on the internet. 52:58.252 --> 53:01.235 [SPEAKER_02]: We need to install this software so we can gain access over the weekend. 53:01.535 --> 53:10.303 [SPEAKER_02]: There's a hurricane happening or there's a wildfire or the government shutdown or COVID's happening and people are just adding exceptions temporarily. 53:10.843 --> 53:14.206 [SPEAKER_02]: And they don't realize that those temporary exceptions are now suddenly permanent. 53:14.286 --> 53:18.830 [SPEAKER_02]: And when you start compiling them together and you end up with quite a week system. 53:19.271 --> 53:26.217 [SPEAKER_02]: So having that constant review of your configuration is really important. 53:26.197 --> 53:35.290 [SPEAKER_02]: not to a bad state, but I was pretty mad that when we got our first DACA ports, we print this nice PDF, it's got charts, it shows where you are to your peers. 53:35.730 --> 53:39.095 [SPEAKER_02]: You know, I had veins popping out the side of my head, like, why is this so? 53:40.337 --> 53:43.982 [SPEAKER_02]: Why is there an elevation policy on command prompt on this person's machine? 53:44.523 --> 53:53.976 [SPEAKER_02]: And it was that, oh, because eight months ago there was this ticket and there was diagnostic because they said they needed to do this and it wasn't set up temporarily, 53:53.956 --> 54:03.952 [SPEAKER_02]: and it's very easy to do, and especially if you go back years and years and years and you think through paddemics and hurricanes before you know it you've got gaping holes in your system that you didn't even know about. 54:03.972 --> 54:10.463 [SPEAKER_03]: So, DAC, this is the defense against configurations, yes, technology which you have. 54:10.443 --> 54:13.128 [SPEAKER_03]: Is that something which teams can adopt gradually? 54:13.188 --> 54:19.520 [SPEAKER_03]: I'm just thinking of how many blood vessels are going to be popping out of people's foreheads if they roll it out across their entire enterprise. 54:19.861 --> 54:29.599 [SPEAKER_02]: So the idea of defense goes to regulation is not to actually do something but to tell you where your weaknesses are and it essentially any of our modules just include it for you. 54:29.579 --> 54:34.006 [SPEAKER_02]: It all say things like, you've got 14 machines that are allowing entrusted software. 54:34.046 --> 54:38.072 [SPEAKER_02]: You've got 25 machines that don't have a lot of policy on the screens. 54:38.112 --> 54:47.065 [SPEAKER_02]: If we're going to tell you why that's a problem, why a lot of policy might not seem important in a lot of office, but if someone was the game about access or allow them in overnight and things like that. 54:47.045 --> 54:49.408 [SPEAKER_02]: And then it'll give you easy fixes for them. 54:49.468 --> 54:58.119 [SPEAKER_02]: So it'll say here, click on this policy to stop MSHDA going out to the internet or click on this policy to create a screen server, but it's not necessarily saying, put them all in place. 54:58.179 --> 55:00.462 [SPEAKER_02]: But it's almost because of risk register. 55:00.903 --> 55:03.205 [SPEAKER_02]: And we've had customers say, well, how could I accept this risk? 55:03.226 --> 55:04.407 [SPEAKER_02]: And so are we going to accept the risk? 55:04.447 --> 55:07.110 [SPEAKER_02]: But you shouldn't bury your head and pretend it's not there. 55:07.171 --> 55:08.993 [SPEAKER_02]: You just say, I'm accepting the risk. 55:09.493 --> 55:13.879 [SPEAKER_02]: And every quarter I'm going to review that risk and say that I still accept that risk, 55:13.859 --> 55:14.940 [SPEAKER_02]: because it makes sense. 55:14.980 --> 55:17.643 [SPEAKER_02]: Like for example, I've got two monitors in my office that run the wall. 55:18.164 --> 55:20.166 [SPEAKER_02]: It doesn't have any major sensitive data. 55:20.186 --> 55:28.094 [SPEAKER_02]: It doesn't have access to systems, but it does tell me what our average weight times are on support, what our average ticket time or approval times are on our approvals. 55:28.154 --> 55:32.258 [SPEAKER_02]: And I, those machines can't lock after 15 minutes, because I wouldn't get to see them anymore. 55:32.659 --> 55:36.423 [SPEAKER_02]: If you're in an airport, you're not gonna stop them, but you should know that this machine doesn't lock. 55:36.523 --> 55:40.167 [SPEAKER_02]: So what are the risks and what are the compensating factors if I take it? 55:40.187 --> 55:42.229 [SPEAKER_02]: And if you have that report, 55:42.209 --> 55:54.723 [SPEAKER_02]: You now get to see one is where your weaknesses are, just review them every quarter, and to how you compare to your peers, because we'll actually show you what percentile you are to other companies in the industry. 55:55.544 --> 56:05.235 [SPEAKER_02]: So if you think, well, I'm doing a great job and you say, well, see your 15 percentile, maybe you should do a better job because you are the weakest of the weak right now or your 90 percentile. 56:05.255 --> 56:07.558 [SPEAKER_02]: So you're actually doing really well, you've got a good score. 56:07.994 --> 56:10.878 [SPEAKER_02]: Oh, which would be a good thing to be able to take back to the bosses, wouldn't it? 56:10.898 --> 56:12.460 [SPEAKER_02]: And so actually we're doing pretty well. 56:13.140 --> 56:16.505 [SPEAKER_02]: Yeah, go back to the bosses, but also tell you how well you've improved every month. 56:16.585 --> 56:29.040 [SPEAKER_02]: So you can do an executive report that says in the last few months we've improved by, you know, you don't want to show the percentile when you're asking for money and want to show the improvements when you're asking for a pay rise. 56:29.020 --> 56:34.550 [SPEAKER_02]: So you can get those executive reports and we'll even give you a justification page on every check. 56:34.590 --> 56:40.782 [SPEAKER_02]: We'll say these are real world attacks that happened and this weakness was used in this attack. 56:40.822 --> 56:45.631 [SPEAKER_02]: So this is why you probably should do this and we'll even tell you what the risks are of doing it. 56:45.651 --> 56:48.717 [SPEAKER_02]: So we won't just say disable macros in office. 56:48.697 --> 57:01.912 [SPEAKER_02]: We'll say, disabling macros in office will reduce 25% of ransomware initial access because it comes from macros, however, if you have a finance team that's regularly using macros, you should carve them out because the risk is somebody's using macros and it might break something. 57:02.292 --> 57:04.435 [SPEAKER_02]: But 90% of your company can probably disable them. 57:04.635 --> 57:05.556 [SPEAKER_02]: Your score is going to go up. 57:05.576 --> 57:08.639 [SPEAKER_02]: You're going to be 90% more secure than you were in that one area. 57:08.719 --> 57:14.586 [SPEAKER_02]: We'll give real-world examples and we'll let you know the risks of doing it and the risks of not doing it. 57:14.566 --> 57:15.827 [SPEAKER_03]: fantastic stuff. 57:16.147 --> 57:24.775 [SPEAKER_03]: Well, I'm sure plenty of organizations listening will be interested, maybe they're worried about misconfigurations, maybe they want to clear a picture of what's really going on there environment. 57:25.536 --> 57:27.598 [SPEAKER_03]: What's the sensible next step for them? 57:27.618 --> 57:28.639 [SPEAKER_03]: What's your recommendation? 57:29.019 --> 57:38.928 [SPEAKER_02]: So I would say everyone has weaknesses in their security and there's no such thing as achieving zero trust people often say that to me, but it's really about a mission of we're going to reduce privileges where they're not needed. 57:39.549 --> 57:44.353 [SPEAKER_02]: You can probably reduce your risk by 90% with very, 57:44.333 --> 58:00.799 [SPEAKER_02]: And what I would say is to find out how, you know, come to us, we'll talk about how we can block on trusted software, really, really easily, how we can show you your configuration, we just as you can do a free trial, you can do a free demo throughout Loco and you can just go to ThreatLocker.com and schedule a call with one of our engineers directly from the homepage. 58:01.119 --> 58:03.943 [SPEAKER_03]: Well, thank you very much, Danny, for spending some time with us today. 58:04.064 --> 58:10.874 [SPEAKER_03]: And listeners, you can check it out for yourself, just as Danny's described by going to ThreatLocker.com to find out more. 58:11.175 --> 58:12.096 [SPEAKER_03]: Thank you very much, Ben. 58:13.173 --> 58:14.196 [SPEAKER_03]: fantastic stuff. 58:14.236 --> 58:16.221 [SPEAKER_03]: Well that just about wraps up the show for this week. 58:16.362 --> 58:18.708 [SPEAKER_03]: Thank you so much Leslie for joining us. 58:19.089 --> 58:22.599 [SPEAKER_03]: I'm sure lots of listeners would love to find out what you're up to and follow you online. 58:22.619 --> 58:24.364 [SPEAKER_03]: What's the best way to do that? 58:24.648 --> 58:32.580 [SPEAKER_00]: I'm on almost all social media including Reddit at app hacks for pancakes, the number for hacks for pancakes. 58:32.600 --> 58:36.386 [SPEAKER_00]: See hi, I'm pretty friendly when I'm not exhausted and I'd love to be friends. 58:36.987 --> 58:40.031 [SPEAKER_03]: Ah, and of course smashing security is on social media as well. 58:40.051 --> 58:52.410 [SPEAKER_03]: You can find me grand clearly on LinkedIn or follow smashing security on Blue Sky or MasterDone and don't forget to ensure that you never miss an episode for the smashing security in your favorite podcast app, such as Apple Podcasts, Spotify and Pocketcast. 58:52.441 --> 58:53.666 [SPEAKER_03]: Like and subscribe! 58:53.706 --> 58:55.052 [SPEAKER_03]: Yes, exactly! 58:55.293 --> 58:57.763 [SPEAKER_03]: Give us five stars all that stuff until next time! 58:58.144 --> 58:59.008 [SPEAKER_03]: Cheerio, bye-bye! 58:59.791 --> 59:00.072 [SPEAKER_03]: Bye! 59:11.662 --> 59:24.004 [SPEAKER_03]: If you've been listened to Smashin' Security with me, Graham clearly, and I'm grateful to Leslie Carhartt and Danny Jenkins for joining us this week on this episode as well as it sponsors Meta Threatloka and Banta. 59:24.605 --> 59:32.860 [SPEAKER_03]: And to all those chams who've signed up for Smashin' Security Plus over on Patreon, they include Daryl Green, Vladimir, Jurisek, 59:32.840 --> 59:55.692 [SPEAKER_03]: Bobby Hendrix, Daven Pam, always a package deal, my callat, Marvin 71, Sean, just Nate please, which is also a good life advice, Ragnar Carlson, which sounds like he owns a very large axe, Mark Norman, Adina Bogotobrein, and Projigeria, almost nailed it. 59:55.672 --> 59:57.435 [SPEAKER_03]: Would you like to hear your name read out? 59:57.515 --> 01:00:05.029 [SPEAKER_03]: Perhaps, rather badly, at the end of the show from time to time, will it so consider joining Smash In Security Plus for as little as $5 a month? 01:00:05.449 --> 01:00:10.859 [SPEAKER_03]: You'll become part of our merry band and get early access to it, so to without the annoying ads. 01:00:11.300 --> 01:00:15.908 [SPEAKER_03]: Just head over to smashinscurity.com slash plus for all of the details. 01:00:15.888 --> 01:00:23.586 [SPEAKER_03]: Now, of course, I know not everyone can stretch the $5 a month and maybe you've got better things to spend your money on than smashing security. 01:00:24.087 --> 01:00:26.272 [SPEAKER_03]: And that's absolutely fine. 01:00:26.312 --> 01:00:28.497 [SPEAKER_03]: There's no pressure at all to become a patron. 01:00:28.645 --> 01:00:45.494 [SPEAKER_03]: However, if you're finding yourself a bit chilly this winter, you may want to go and check out the smashing security merchandise store, which has recently been spruced up with shiny new t-shirts and mugs and other tempting goodies, but there are also ways in which you can support the show, which don't involve you spending a penny, as it were. 01:00:46.015 --> 01:00:49.641 [SPEAKER_03]: You can like, you can subscribe, you can leave a five-star review where if you listen. 01:00:49.621 --> 01:00:53.128 [SPEAKER_03]: tell your friends about the show or simply spread the word. 01:00:53.409 --> 01:00:58.880 [SPEAKER_03]: All of that is gratefully received, so thanks to each and every one of you for your ongoing support. 01:00:59.000 --> 01:01:04.031 [SPEAKER_03]: I hope you have in a great new year and are looking forward to plenty more episodes of smashing security. 01:01:04.071 --> 01:01:05.915 [SPEAKER_03]: It's certainly good to be back. 01:01:06.336 --> 01:01:08.440 [SPEAKER_03]: So until next time, Cheerio, bye bye.