Brett Gailey on Cybersecurity Myths for SMEs

speaker-0: see a lot of folks kinda orient on kind of black and white, which is either use all these AI tools explicitly without question and just go for it. Or don't use them at all and stay far away. speaker-1: Hey guys, what's up? Jeremy the Online Ad Guy here at the ⁓ founder of Digital Glass Marketing.

So I came off a call with Brett Gailey. So Brett is the ⁓ being the game for twenty-five years in a cybersecurity game. ⁓ very knowledgeable, ⁓ highly insightful and ⁓ things I wanted to ⁓ really ask was about the current ⁓ hacking landscape I guess and how it matters to smaller businesses, entrepreneurs, startups, the things that we should be paying attention to, the things that we are overly indexed in. ⁓ you know, just to dispel the myth that what can and can't happen.

I think look it's ⁓ a very short episode, it's only like sixteen minutes, but he explained it really, really well. So yeah, give it a listen. If you ever be interested in cybersecurity, LLMs, how AI accelerates everything and all that, yeah, give it a listen man. Alright guys, welcome back to another episode.

I'm here with Brett Gailey. He is the Chief Info System Officer and Senior Director of Security and Compliance at Tia. Welcome to the show, man. Thank Appreciate it.

Man, I appreciate coming on, dude. ⁓ so you are a friend of Acvilla, which we had on earlier last week. I was such a great guest. I was like, man, do you know anyone in cybersecurity?

'Cause it's pretty hot topic. ⁓ a lot of misconception, a lot of gated content, I would say. Cause you don't know what they're selling at. Do you what I mean?

Like you might turn half and then you're gonna have to buy some stuff or whatever. And then you just came up with like there's nothing 'cause you're already working for a big company, do you know what I mean? And you just know a lot of stuff. So if we take it back to let's say ⁓ 'cause this show is kind of more for small business entrepreneurship.

So the the purpose of this episode, if we're gonna leave them with one takeaway is how do we ⁓ like to stop the misconceptions and what they should be focusing on instead? Absolutely. Okay, cool. speaker-0: Yeah.

speaker-1: So if we go back to the like the history of it, like how did you get started in cybersecurity? Was it like by chance? Yeah. speaker-0: a little bit of ⁓ by chance, but I started in ⁓ the early two thousands in the United States military.

⁓ no and then ⁓ transitioned in ⁓ mid to late two thousands into ⁓ systems engineering and software development. And then in the mid two thousand and tens transitioned back into cybersecurity. ⁓ and since then I've been in cybersecurity specifically in the healthcare space in the United States. speaker-1: So was it like a thing you know nine eleven, right?

Yep. That went w was there like a shift towards that kind of thing, like cybersecurity was more or was it something else that was more triggering inside the whole world event? speaker-0: think at that time the world and kind of where a lot of our efforts went towards ⁓ was towards that concept of terrorism in the United States. Yep.

⁓ but since then I would say since the late two thousand and ⁓ two thousands, we've had a transition into cybercrime and really kind of a renaissance in the information security and cybersecurity space. Maybe originally that might have been something like the concept of hackers and frackers back in the eighties and nineties. ⁓ Nowadays we see, you know, red teamers, blue teamers, purple teamers, these different roles in cybersecurity that are really focused on enhancing cybersecurity capabilities within different organizations.

speaker-1: Ne never heard of that term. Can you i is it is it real is it common? Like red team is and all that? speaker-0: Yeah, red team is your more offensive type of people, the ones that are doing hacking or doing security research, finding vulnerabilities.

Your blue teamers are your defensive individuals that are monitoring and preventing attacks from happening. They kind of work side by side in order to prevent attacks and discover new ones before they're exploitable. speaker-1: Wow, okay, cool. That's just the first time it's it's ⁓ been explained to me.

Thank you, man. no, with the before we get into the L ⁓ stuff, right? So the way I look at AI and all that, right? And I I don't know, like I see I'm like a common man on the street, yeah.

Like I don't know the technology layers. So my thing is always like the hackers are using it to try to exploit like the speed of it, right? And the big security banks and everything is try outspeed the that speed to prevent it from happening. Yeah.

Is there really like a race like that, or is it only the hackers only get the vulnerable guys? speaker-0: There's been a race since ⁓ probably nineteen eighty. ⁓ can you prevent an attack from happening? You're always trying to catch up against attackers.

⁓ attackers ⁓ are gonna be opportunistic. They're gonna find vulnerabilities that are easy for them to exploit. Yeah. ⁓ so any type of defense that just makes it more difficult, generally that is a good enough put off for different different attackers.

But ultimately your your blue team, your people that are defensive minded, ⁓ they're always chasing what the bad actors are doing. So it's always a bit of a cat and mouse type of game. speaker-1: So let's let's let's bring ⁓ like a say like a practical example when crypto first came, like crypto, right? And then crypto wallet was like Chrome extension, right?

Exactly. Was it just like was it just like heaven was like ⁓ my gosh, look at all this, like they were 'cause people going to me, they say, Man, no one's gonna hack your Facebook account. They've got crypto accounts to hack. There's so much money in that, you know what I mean?

Like I'd love to hear your take. Yeah. speaker-0: Yeah, yeah. It's it's anything that's sufficiently profitable generally for a lot of these cybercrime opportunists.

Yeah ⁓ they're gonna find anything that is going to fulfill whatever goal they have. So there's lots of different goals from different bad acting groups. There might be politically motivated, financially motivated, they might be ⁓ nation state sponsored. They might be ⁓ you know a terrorist organization of some sort, whether that's you know whatever ideology they may have.

⁓ there's even things like ⁓ you know environmental cybercrime. ⁓ so there's a lot of these different types of motivations that will exist and the way that those organizations may attack are really motivated around, you know, these different types of businesses and these different types of ideal ⁓ ideologies. speaker-1: So if we take that to a like a small like micro small business level, it's probably ransomware, right? Yep.

Like w like blackmail stuff. speaker-0: ⁓ ransomware is the most common. speaker-1: Yeah, so with ransomware, like just say we go to the Indian call centers or whatever, right? Is that is does like does AI fully accelerate what they can do and how many emails?

⁓ interesting. speaker-0: Yeah, AI so specifically when we talk about the power of AI in the context of cybersecurity, specifically on the attacking side of cybersecurity, what we think about ⁓ is two kind of specific angles. One is the ability to generate an exploit ⁓ quickly without a lot of skill. ⁓ and then secondly Is the ability to trigger agentic workflows to exploit those vulnerabilities and then potentially pivot to other exploits that might be available.

speaker-1: So as soon as they're in, like boom boom boom, like the whole exact take take in Whereas before it's more manual, before you have someone like more technologically advanced to be at that level, right? Now it's like it's it's done. Wow. speaker-0: It what would traditionally be a very senior research person spending hours, days, weeks, months on a specific issue.

⁓ I read just the other day that ⁓ really advanced ⁓ attack that then pivoted into other parts of an ecosystem ⁓ was exploited ⁓ within a matter of like two point seven seconds. speaker-1: Can't stop it. That's it. It's done.

Once they're in, it's in. can make it difficult. You can make it really difficult. So when when you look at so this is gonna be a dumb question even when I ⁓ if I ask it.

So when someone like you, right, you look at laymans like me and entrepreneurs and people just try to make it work, right? We just try to make it work. We just try the best. We can't really afford anything sophisticated, just doing the best we can, learn the best we can.

I mean, some of the things that that might speaker-0: Make it difficult. speaker-1: happened to us hack wise, do you see it like fully preventable? You you do you just see it go, man, it's just done A and B and that's it. That wouldn't have happened, dude.

speaker-0: Most yeah, it's actually pretty straightforward to be honest. Like yeah, a lot of the hacking techniques that are used, those attack what we call attack vectors, yeah, ⁓ they're the same ones that have existed for the last thirty years. You know? Right.

⁓ is your password compromised and you can go check that for free ⁓ on the internet. Yeah. And two, ⁓ is is somebody impersonating the person that you're talking to? Yeah.

⁓ There's a couple different ways that that kind of comes up, but fishing, smishing, things like that, those are some of the most common techniques that people are ⁓ that bad actors use because people are inherently trusting. They want to do well, they you know, they want to support other people so they can be unfortunately manipulated or abused in that type of way. So when we say what are the primary ways we can defend ourselves in these small business settings, it's just being diligent.

It's just verify. Trust but verify. That's the most common theme I can I can tell folks to ⁓ to c kind of orient around. Yeah.

Is you can trust the person that you're talking to, verify that the identity is who you suspected. speaker-1: Okay, cool, got you. 'Cause a lot of it has to be like again in layman terms, a lot of it has to be the multi-device authentication, right? Like you have to be a little bit social engineered to be giving them that code as well, right?

Cool. speaker-0: Correct, yeah. I mean but you know, that yeah the concept of social engineering is violating someone's trust and yes that's why I say trust but verify. speaker-1: Okay, got you.

Cool. Amazing. So in terms of the new tools that are coming out, in terms of out of them and all that, I know we when we've done our pre-call, we kinda started there. We're saying that look there's people who think that, you know there's there's there are people who are worrying about stuff they shouldn't be worrying about.

Yes. And the people who's not worrying about the stuff they should be worrying about. Do you wanna like maybe expand on that a little bit? 'Cause I know you got a view on that.

speaker-0: Yeah. Well so in the AI space I think we see a lot of folks that either lean in one direction or another direction. And it's kind of on two sides of a spectrum. Yeah.

⁓ where I see a lot of folks kinda orient on kind of black and white, which is either use all these AI tools explicitly without question and just go for it. Or don't use them at all and stay far away. ⁓ in reality, ⁓ for a small business, you know, you wanna look at ⁓ how your risk profile exists with the types of organizations that you're working with. So you want to make sure that the tools that you're using, whether it's like Claude or ChatGPT or Gemini or what have you, comply with your contractual obligations.

Yeah. And you also kind of want to really look at how you want to position yourself in terms of like data privacy and the types of information that you're sharing. ⁓ the reason I flag that that last one, data information sharing, things like that, is if you're using f these free accounts that are provided by Claude or Gemini or what have you, ⁓ you know, you're sharing data with them to train on that data. and that can cause all kinds of downstern problems.

And we as a society have not solved that copyright problem, we've not solved that training problem. ⁓ it's a pretty large issue. So One thing I constantly tell folks to look and reflect on is what are your contractual obligations? ⁓ are are you allowed to use these tools in whatever way you want based on the types of ⁓ organizations that you're working with?

And also in what capacity are you using those tools? speaker-1: Okay. So that's interesting 'cause I I w I remember talking about that and one of the things we touched on was insurance. Yes.

And and with the way you made it sound like the the the scenarios I was throwing at you and the way you made it sound was very cut and dry. You said make sure you have indemnity insurance that covers what you have, that then do the best you can to secure your own system, right? And then the game goes on. Like there's nothing more to think about in in that aspect.

speaker-0: Cybersecurity insurance is pretty straightforward. It allows for a lot of different bad events to happen because sometimes a sufficiently motivated attacker is just going to compromise that it's not something you can specifically avoid. At least not with general resources that most people have. Yeah.

⁓ but allowing those type of contracts that you have with your partners and things like that Generally you want to carry cybersecurity insurance that way if there's an indemnification clause within that contract, you get a lot of protection and you're not financially obligated to to like spend money out of your own corporate pocket. speaker-1: Yeah, I got you. I got you. That that's really good.

So with the ⁓ moving on to say things like vibe coding, right? Again, is that like a heaven just for hackers? Because I know that once Zapia you can give it certain permissions, you can do a lot of things. Does that does that mean that once I don't know, but does that really mean that once they get into one thing?

Just say they hacked your Zapia and they're fully inside it, right? Can they go speaker-0: It's a little more complicated than that, I would say. So yeah, maybe Zapier has a lot of like your Zapier workf whatever your workflow you built in. Zapier has a lot of permissions and have a lot of OAuth things.

Yeah. ⁓ you do have I mean, if that account is compromised, they do have a lot of access to resources and tools and things like that. Yeah. I don't think vibe coding in of itself is necessarily a problem or these automation tools are necessarily the problem.

But I do think there's something to say about the ⁓ How permissive we give these tools or how much permission we give these tools without really understanding the context of the information we're actually sharing. It's so easy to do an OAuth or what we call like an OAuth exchange. Yeah. ⁓ which is like you clicking in and logging in with Gmail as an example.

Yeah. ⁓ it's so easy to do that, but it also grants the keys to the kingdom. So it's just I ⁓ I constantly kind of remind folks that like It's really just a risk versus reward scenario for you. Yeah.

If the value of using those tools is really high for your business, use them. That's okay. It's not wrong. Yeah.

⁓ but if you're just doing it to do it and just 'cause you're playing around, be careful. speaker-1: Yeah, that's all. That's yeah, okay. Alright, gotcha.

Alright, amazing. So no, that's that's great. So what would be like ⁓ your advice or something that we haven't covered today that you feel like smaller businesses should know? Entrepreneurs, start ups.

Yeah. speaker-0: Absolutely. I think it's really important and very it can be a little difficult to think about, but I think it's really important to understand your risk profile as an organization. Who are the most likely people to attack you?

Yeah. ⁓ why are they the most likely people to attack you? Yeah. And what are the tools and processes that you put into place, whether they be big or small, ⁓ that help prevent those type of attacks from happening?

Yeah. You know, as simple as something as, you know. ⁓ a script kitty wants to put a ransomware on my device so I can pay them a bitcoin. Yeah.

That it might be just that simple. Uh-huh. And if you have a process that says, well, the most likely way that's gonna happen is somebody's gonna send me a bad email, so I'm just gonna always gonna double check the sender. That is more than enough for most small businesses to say I have a process that's going to prevent most of these types of attacks from happening.

There's never anything that we can do to prevent all attacks, especially some of the more sufficiently motivated attackers. Yeah. The nation states, the really well funded orgs. But you can get ninety nine percent of the win.

speaker-1: They they're not gonna they're not coming for us, I don't think. But like ⁓ what would be like ⁓ what would be like a high pro you know, 'cause I was talking about risk profile, right? Like what would be ⁓ like a higher risk, what would be like a lower risk profile? Could you give examples?

speaker-0: A high risk profile might be an organization in America, ⁓ like the example that I yeah I I work at, ⁓ we're a women's healthcare, which has some political motivations around that. ⁓ that might be treated as slightly higher risk, both for ⁓ the healthcare ecosystem, which contains PhI or protected health information. Yeah. and also some, you know, ⁓ ideological ⁓ perspectives that might be on the higher side of risk.

Whereas some ⁓ an organization that's maybe, you know, manufacturing dolls might have a lower risk profile. speaker-1: Right. Is there anything else that you want the people to know about the TR or anything like that? speaker-0: Yeah, absolutely.

⁓ well Tia is a women's health care ⁓ primary care provider in the United States. We ⁓ provide care for women ⁓ all over the United States. ⁓ it's something I'm really passionate about. ⁓ I've been here for the last six years and ⁓ I think what we've been building is really special and has really meaningful value for women ⁓ across the United States.

speaker-1: What is that you're building? speaker-0: Well, one of the most important things that we've been focused on is trying to figure out how women can get the best care possible, ⁓ considering that the primary source of research that is done in the United States and around the world is focused on men, specifically white men. And that is really undervalued when about six sixty to seventy five percent of all health care in the United States goes towards women and women's decisions.

There's a massive misbalance misbalance there. Instead. Yeah. And what we're really trying to focus on is how do we give women the holistic care that they deserve because every woman is speaker-1: Got you.

Well that's very kind of meaningful place to, you know, for the for the the the thing. Yeah. Now well thanks again man for c jumping on and I think that the way you've answered it, like it's very direct and very actionable, very practical. Do you know what I mean?

Like we can we know exactly what we have to go and do to kind of prevent it. Yeah, man. So if anyone have any questions we'll put in the comments. ⁓ if there's any links that you have, we'll chuck in the comments as well, man.

But thank you so much, dude, for jumping on with us. speaker-0: Well, I appreciate you. Thank you so much. speaker-1: Hey what's up?

Jeremy Yang, the online ads guy here, owner of Digital Glass Marketing. If you ⁓ found whatever you're watching helpful, you found interesting, like, subscribe, comment, suggest other topics you think we should cover here. We've aimed to release weekly episodes helping SMEs with marketing, advertising, talking to professionals about growth, processes, all that good stuff. Right, see you on the next one.