how open should you be when things go wrong?

Should you tell your boss, you made a huge mistake.

Should your company tell everyone they got hacked this week?

We talk with a wireless cybersecurity expert about this really important topic.

I hope you enjoy it.

Hi, and welcome to Backup Central's Restore it all podcast.

I'm your host, w Curtis Preston, a k a, Mr.

Backup.

And I have with me, I think might be the only thing between me and a little

dog Prasanna Malaiyandi that's it.

How's it going Prasanna?

I am good and I hope the dog wins out.

Oh.

What happened?

What happened to

I mean, you, you, you have, you have a little dog, right?

So I, I, I technically don't, I, I have, I, you know, I have a grand

dog who ha has been living with us.

Uh, you know, my, my daughter and her husband live here with their dog,

um, for a little bit, and I'm not used to having a dog around, right?

So there are things that if you're used to having a dog around you just.

Don't do.

Um, one of those would be if per chance, I don't know, you've got a podcast

recording coming up at say, I don't know, one o'clock, and perhaps you realize that

say 1240, that you haven't eaten anything and you're gonna starve to death by two.

And so you just go heat up some enchiladas and you put them on

a plate on your desk inside your office where you close the door.

Uh, except for like one minute, you go to get your AirPods

because you forgot your AirPod.

Just, just theoretically speaking, you go to get your AirPods and you leave the

door cracked, not wide open, but cracked, and you say to yourself as you're walking

away, BREW is not going to like open the door, go into the office, climb up

onto my chair, and then attempt to eat.

My enchiladas, she wouldn't do that in the

Oh no.

I'm away from my desk.

Yeah.

So I come back and my enchiladas are upside

floor.

on the floor with the plate on top of them and bru just

sitting there on my chair, like, um,

on her face?

uh, she didn't actually get, get too much apparently,

uh, because the, the, but she, yeah.

so, but maybe that should tell you that if she's not

going to eat your enchiladas, maybe you shouldn't eat your enchiladas.

I'm just saying Curtis,

No, I think she just didn't have enough time.

She just didn't have enough time.

So basically this

to remember to like close the doors, you know, at all times.

It's just not something I'm used to doing, especially since we became

empty nesters a little while ago.

Um, so I'm just sort of, everything's open all the time.

Um, and, uh, but yeah, so that dog,

Well, whose fault is it for leaving the chair next

hey, hey, hey.

Don't blame the victim.

Don't blame the victim.

I am defending the dog who does not

have a voice on this podcast.

Your Honor, I present the, the case of the, the

Preston household versus Brule.

Uh, I submit the plate on the floor.

Um, I could just see, I could just see, you know, a brew on the stand of

like the little, the puppy dog eyes.

She's gonna give

you the

see.

what was going through my head was like Snoopy.

That's what was going through my head.

It was like brew being Snoopy, being like it wasn't me.

It was me.

Yeah.

It was totally her.

Yeah.

She was caught white handed, um,

this means is after the podcast is done, when

you go get some lunch, you should just grab her a snack as well.

Okay.

I'm prohibited from giving her food.

I, I, I have

Even her food, even her snack food.

Well, she has a set snack time and, and this isn't it.

So, um, I, I don't want to get in trouble with my daughter, um, or the

way, the way my son-in-law, uh, says it.

He's like, it's fine, Curtis.

If you want her to live like three years less, it's fine.

That's the way he says, you know,

Hey, so my parents, so growing up I am sure our

guest is like, what is going on here?

So growing up, my parents had a dog and we had a vet who was Indian,

and the vet would always be like, look, I know you guys are Indian.

I know you love to feed your dog Indian food.

Don't do it.

It's unhealthy.

My parents ve everything like Indian Sweetss, Indian food,

like for his birthday, they would make him special Indian food.

He lived till he was 17 and a half, so, so there you go.

Right?

So exactly.

I'm, I'm not having that argument with my daughter.

Um,

Hm.

Anyway.

Well, uh, it's time to bring our guest on, uh, if he, is he still, is he still here?

He's still here.

He's still here.

Don't worry.

in wireless and cybersecurity, and since 1990 has

been the c e O of Berkeley Veratronic Systems, a wireless detection,

manufacturing, and production company.

He is also the host of the What Keeps You Up At Night

Podcast, which is how I met him.

Welcome to the pod, Scott Schober.

Hey, great to be with you.

So I,

Do you have a pet Scott?

I, I do.

And as you guys were talking about some of these things, I was thinking of my dog.

We have a dog, Daisy, she just turned four years old.

Mini golden doodle, lot of fun, high maintenance, but a lot of fun.

Yeah, this is, this particular dog is a cockapoo.

Um, and so it, it, you know, she would've had to literally jump up on my chair and

I was, you know, I was just thinking, she's not gonna do that in the little

time I have, in the little time I'm gone.

Not so much.

The, the, the smell of the food was just too, you know, too.

Too enticing.

Yeah.

Um, if you wanna find brew, all you gotta do is start cooking something

and she'll just magically show up.

Uh, so I, Scott, I gotta, I gotta say, so it looks like the company

that you're at has been around longer than you've been there.

'cause you, you were saying that it has 50 years of experience.

The company has been around for 50 years, but you've been there 30 years.

Um, 'cause normally when I see somebody who's been somewhere for a really long

time, it's like a company they started.

And so of course they're there, but in your case, they brought you in

after they'd already been going for.

Close to 20 years or something in that neighborhood,

yeah.

The interesting story is that it's a family business, so it's

actually founded by my father.

Still our c t o.

He actually happens to be here today, uh, just checking in.

But he, he's since retired and, uh, he founded the business.

So it's really what I grew up with.

I did actually start technically working for the company when I was in sixth grade.

Uh, he, he challenged me.

We had a number of, uh, keypads.

These were wired keypads, old school keypads way, way back in the day.

And he said, for every keypad that you fix, you'll get a dollar.

And he showed me how to solder.

And, and make measurements on a resistor and iOS and things like that.

And I spent the day going through hundreds and hundreds of, of these

keypads and realized, wow, I can make a lot of money fixing these things.

And eventually I kind of got into the business and, and doing everything.

So, um, it's kind of cool growing up in the family business.

'cause I did everything from, you know, cleaning, cutting

a lawn, painting, soldering.

I went to school formally.

And for, um, computer software development and telecommunications.

I went to Kane University for undergraduate stuff and graduate

stuff at, at New York University.

Um, and it's kind of cool because it gets me to cross different things.

You know, you talk about it in your daily life as a family, but

it's also part of your business.

And then also, I, I like to, you know, I'm, I was a gamer growing up.

My father worked for a number of years at Atari.

So he brought home all the latest and greatest games.

My brother and I, we were game testers and we'd stay up to the wee hours

of the night testing games, finding the bugs, documenting them, and then

feeding it back to the programmers.

So it, it's kind of neat 'cause you're around the culture growing up in it.

It's part of your life.

It's part of your D n a.

So it's kind of exciting and that to me keeps me going from a

standpoint of innovating products and ideas within the company.

And I have people here that are actually implementing and doing it, that have

PhDs and far smarter than I am that can actually make the technology work.

So I'm kind of the the guy that's in between and gets my hands

in a little bit of everything.

I know enough about everything to be dangerous.

So it's kind of a fun business and it's niche, very niche cybersecurity.

And, and hardcore design.

We're really hardware designers, which is a little bit different

than most companies out there.

It seems like everybody does software, be it apps or, or high

level programming or whatever.

And yeah, we do that too.

We do program, but our expertise is really at the core, the, the hardware

and understanding radio frequency, uh, be it the wireless I always like

in our company is where we're at.

The intersection of wireless and cybersecurity is kind of where

we fit, which is kind of cool.

Nice.

So you shifted then, I'm guessing you talked about keypads early on, right?

And so at what point were you like, okay, keypads are great and

now let's shift into this wireless cybersecurity aspect of things.

Good.

Good question.

The shift into the first part of your, your question, wireless

really happened about mid 1980s.

We actually got a call as a company.

Again, being a hardcore hardware company, design company, people come

to us with problems and we provide solutions hopefully that, that solve

their problems and are affordable.

And, uh, we were approached by a company down in Washington, DC and said, Hey,

we've got an idea for developing some test equipment, but we don't know how to do it.

You guys might know how to.

We said, okay.

We, we, we were hired for it took on the assignment and we

developed actually the first test tools to test out the cell towers.

And this was, um, very interesting because nobody knew at the time that

wireless cell phones would take off.

So we were in the early days of amps phones and we developed the actual test

receivers and transmitters, and worked on some of the propagation analysis software

so you could see what the coverage was.

And we started work with this company.

We worked for them for well over 10 years, developing test tools, which

really took our business, allowed us to grow, and we're still doing it today.

We're still developing test receivers and transmitters that we sell globally,

but we're not selling it for the old school e amps and things like that.

It went from second generation, third, fourth.

Now we're into the five G technologies that we always hear about, that

our smartphones work about.

Well, a number of years into that, what I started to notice was.

Business has changed and the way propagation analysis done, it's

more done predictive analysis.

In other words, you can use advanced algorithms to actually

figure out how well signals propagate at different frequencies.

So you don't need to do the hardcore drive studies where you're manually driving

around collecting this data, spending thousands of hours and so on and so forth.

So we, I said, let's shift the business a little bit and focus on

the security since we understand.

Smartphones and we know their vulnerabilities and we work

with a lot of the companies.

Let's analyze that space and see if there's some tools and

technology we could develop.

We started to do that and it really took off and, and the short of the story is the

more we started doing it, I was brought in to, to share some expertise and things.

We knew how to keep your company safe and so and so forth.

Well, the more I did that, the more I got a target on my back and the

company's back and hackers went after us, and now it started with.

Credit card compromise, debit card compromise, Twitter account compromise,

repeated DDoS attacks to our online store, so we couldn't do commerce, and finally

we had $65,000 stolen out of our checking account, became a federal investigation,

paperwork, email, so and so forth.

The story goes on and on in the process.

I thought it was kind of interesting because what do you do here you are as a

wireless cybersecurity company, sharing expertise and advice, and you're a victim.

And you made mistakes.

And, and I, ironically, I came, I was doing an interview at the time, it was in

New York City, Bloomberg, uh, TV stopped to get a bite to eat, and I got a phone

call mysteriously from Associated Press.

Don't know how they got my number or how they heard about it, but they

said, we heard from reliable sources.

Your company was hacked and you were the victim of a cyber attack.

Would you be willing to go on the record and share this?

And I said, yikes.

And I said, okay, I'll, I'll, I'll be willing to share it.

A, a allowing that I share maybe my misfortunes and my mistakes and

hopefully some of the things I've learned so other business owners don't

go down the same path that I've done.

And they agreed, I agreed, turned out to be a great story.

It it, it ended up getting me more interviews and more interest and I ended

up being, um, talked into writing a book.

Again, I'm, I'm not a writer.

Um, I agreed to it.

I said, let me try it and see.

Uh, so I did self-publishing.

It took me a little more than two years to write it.

It was my first book called Hacked Again, because of the, the story of basically

being hacked as a, a cybersecurity expert.

And, uh, it kind of opened my eyes up to thing and it opened

the doors up to many other things.

I, I probably wouldn't be talking to the two of you right now if

those chain of events didn't happen.

And then subsequently I put out a second book, cybersecurity's

Everybody's Business where it went more mainstream to other businesses.

And then finally, Another project I had was I, I saw that seniors

were being targeted and it really bothered me, so I wrote a book,

senior Cyber and so on and so forth.

Now thinking about book number four and getting that, the wheels in

motion for that, when I find time.

Yeah, that's the, that's the problem with once you,

once you get over that, uh, that initial hurdle of writing that first

book, uh, you know, I, my first book.

Took me three years to write.

Um, and it, and, and I, I thought I was, I thought I was gonna die.

Right?

The, but like the first, the, the first thing I wrote was actually

an article for Unix Review Magazine back in 1990 something.

And I remember being terrified about, You know, the whole, like, I'm gonna

have a mistake in this article, which for the record I did, I had a

mistake, I had a misunderstanding of the way Oracle hot backups worked.

And uh, and I published that and I'm like, oh, I'm gonna be found,

I'm gonna, I'm, you know, you know, imposter syndrome, right?

And, uh, but from that, uh, I basically, you know, did the

proposal to write my book.

And it took about three years to, to write it.

Um, and then the, you know, the next one that I wrote was much smaller and

easier to digest and, you know, and so I had a running joke that like, 'cause

the first one was like 700 pages, right?

The, the next one was like 350 pages.

And I said, I, I found out the formula.

My next book's gonna be 30 pages.

Right.

Short little

ebook.

less time and sulfur around the same price.

Uh, but yeah, once you, once you've got that process down, uh, it's,

it's, um, so you, you, you don't have to reveal it here, but you have,

you have an idea for your next book.

Yeah.

Yeah, actually, I, I, it's actually, uh, three or four different ideas I

have and, and the, the hardest part is focusing on what do I wanna write about?

And I'm starting to write about each one, which is probably not a good way to do it.

Um, I get distracted, I get, I get, I lose focus.

Um, but, but sometimes writing, I think, and, and maybe it's partly me and maybe

it's other people find this, or I'm curious, maybe even you find this Curtis,

it's almost therapeutic sometimes.

You get a lot of stuff up here as you kind of put pen to paper.

I, I've, I've kind of switched over actually doing, uh, speech to text.

Somebody showed me that it's much faster by the time I got to the third book.

I was like, wow, six months.

Bam.

Knock it out.

This is great.

Um, and, and you understand also the process.

The first book I wrote this much and then trim, trim, trim, trim, lose

this chapter, reorganize and, and you find you wasted a lot of time.

If I spend more time up front and I think about it up here and

organize kind of, kind of the flow.

Get the thesis and here are the chapters and then I stick to it.

I can, I can get through it quickly.

And I think once you commit to it and then you stick with it, and I did, I

do tend to, to write at weird hours.

My family might go to sleep, my kids and the dog at 11 o'clock at night and I'll

say, okay, I'm gonna put three hours in and just get this outta my head.

And then I'll be thinking about it more.

I'm on a plane ride for a couple hours.

I'll get this part of it outta the head.

And I have a story I wanna share here.

Now I'm gonna go back.

So you, you tend to do this a little bit.

Um, it's a good process though.

I learned a lot and I did it self-publishing.

I'm not sure how you did it if, if you went that way, but I, I knew zero and

I had to learn it all from scratch.

And, and I, I also did soft cover, hard cover ebook, um, did

the whole, uh, audible as well.

So going through all of that, those processes with three books, it kind of

scares me to go to book number four, but I know, I know all the difficult

things that I have to overcome, the objectives and how to get through it.

But, uh, but I agree with you.

I, I used to get caught up on, oh, I'm gonna spell this wrong, or the

sentence structure or whatever.

'cause I'm not a writer per se.

And, uh, I think I took one class in college, creative writing.

It goes back a long time ago.

And when I got to the class, I said to the professor, I said,

I don't know how to write.

I wanna learn how to write.

He goes, don't worry.

This year we switched to computers, and I know nothing about computers.

I heard you're a computer science major.

If you help me and all the girls in the class computers, you'll get an A in

this course and I'll teach you to write.

I said, fair Deal.

And I got an A in the course.

Uh, so I, I, I kind of give him some credit.

I learned some bit of writing from him, but I was more of a writer for,

you know, an article for Forbes or doing blogs and things like that.

All short, short stuff.

But it, it does help you, I think, because it forces you to do research.

It, it forces you to think I.

And not be too quick to put everything down on paper, but make, make sure you're

doing the fact checking and you understand what you're explaining and you can

break it down so the reader can get it.

And I think that's an important part of it.

So I kind of had to teach myself a lot of those steps and I, and I a

lot of help from others, honestly.

Talking to others, what are the techniques they use?

I talked to one gentleman, he wrote 185 books

Wow.

How did you write 185 books and going strong?

And he shared a few tips with me that I applied and I said, wow, this does work.

And it really helps keep you focused and allows you to progress.

And I mean, after that I actually got asked to do to, to

go to two different book shows.

One at Jacob Javit Center, I think one in Chicago.

And explain the process of not knowing how to write to being a self-published author

and, and some different things that you can do in the process to make it easier.

And, and to me it's been a wonderful blessing that, that I've been able

to do it and learn from so many great people and, and be on great shows like

this and, and share different stories.

So it's a lot of fun.

Yeah, you and I are gonna have to have a

longer conversation about that.

'cause it sounds like we could swap some stories.

By the way, just real quick, I will say I'm a huge fan of

voice to text, so I use Dragon.

Uh, my last three books have been written entirely in voice.

Um, basically my, my key is that I, I'm a storyteller and I'm.

You know, and what's funny is people like Prasannawho know me personally, and then

they're, uh, they're a, they're a text, they're a, a technical editor for me.

They tell me that when they read it, they hear it.

In my voice.

hear Curtis's voice.

Yeah.

I mean?

I hear it.

Because, because that's the way I write.

I write the way I talk.

Um, I, I agree with you, you, you need to spend more time upfront.

Um, in, in fact, the last book, not on purpose, but the last

book, it took me 10 years to agree on what I was gonna write on,

Yeah.

and then three months I think to, to write it.

Um, but yeah, it took, it, it, I just, I just kept, it was one of those, you know,

you know what, get off the pot finally.

Um, and, uh, was able to get, and I, I am, I am working on book four as well,

but, uh, anyway, enough of what's that?

the.

I was just gonna share one thing, 'cause you, you hit the nail on

the head on one thing just to expound on.

People always ask me, what do you need to do to write a book?

And people think time and money, and da, da, da, all that stuff.

I always say that the most important ingredient I feel

is being a good storyteller.

And I think if you could be a good storyteller, you can learn how to write,

you can learn how to spell check and edit, and you can get help with the graphics

and the cover and the distribution, all the other things you can get help with.

But if you can't tell a good story, nobody wants to read your book and, and

you don't write a book to make a lot of money or to retire as a millionaire,

anybody that thinks those type of things shouldn't be writing a book.

If you have a story up here that you can get in the book, you, you got it.

That's success right there.

I feel.

absolutely.

So I'm not a published author like both of you.

Um, but uh, just sort of going back to your first book, right, Scott,

it's, and or the situation you were talking about when you got hit

with cyber, uh, by a cyber attack.

It's, it come up on the podcast a lot of times where many organizations get hit by.

Criminals, right?

And have these cyber incidences, but they don't say anything.

Right?

And that's just such a huge disservice to the public and other

people who want to learn about, okay, how do I protect myself?

I'm glad to hear that your first book was like, Hey, here's what I could do to

sort of prevent and help other companies prevent these from happening to them.

Have you seen that?

That still continues to be.

Beneficial or that more people are opening up, or is it sort of one

of those closely guarded secrets?

I don't want to air my dirty laundry.

I, I see a mix a lot.

A lot of the close colleagues that I think I've, I've gotten to know over the years,

have shared their horror stories, their, their mistakes, their misfortunes, and

that that granted them a level of success.

I, I think of, um, Some of the things that happened to Brian Krebs, he

a former Washington Post reporter.

And now he focuses on, on cyber crime and reporting that he's got

some incredible stories, how he's was and continued to be targeted

and how it had to change his life.

And I, I, I could certainly relate to that.

I could feel that way.

Talking to Kevin Mitnick, getting closer to him and interviewing

him and talking to him.

He's had some cool background stuff and, and he, he, he has a, a flare for, for

magic and, and hacking and phone freaking, and all these other type of things.

And I can relate to a lot of that.

But hearing again, he was targeted and constantly people go after him.

And I think that's a common theme that I'm seeing.

And most of these people that I, I deal with these other, um, I guess

cybersecurity people, they end up writing books and sharing their

story and sharing their misfortunes and problems that they have.

And I think in some ways, maybe that's how we help ourselves.

And, and, and learn from our own mistakes by feeling like, you know, if I share

some of the, the stupid things I did, other people won't make these same

mistakes and they'll be better than me.

And I think that's important.

It, it's, it, part of it's, I feel like it's teaching and sharing knowledge.

And I often learn from people, not just the things they tell you, Hey, you know,

create a long password, but you also learn when, when you hear somebody, well, I

created a weak password and I used it on 20 counts, and now look what happened.

And it, it really.

Puts up in your head, geez, I'm never gonna do that.

That was really stupid.

But at a teaching moment.

And I think that's, that's one thing that I, I've had the gift to be, the

ability to try to share these things.

And I think writing a book leads to so many more things, and that's

what most people don't realize.

It leads to a podcast show.

So I do two podcast shows.

It leads to.

TV and radio interviews, uh, uh, public speaking.

I enjoy that.

I get to travel and speak to audiences, and I'm hired to go in and, and speak

about different topics and things.

So sometimes don't look at just the book or the story.

Look at the big picture, how it helps.

I.

You grow as a person, helps your business grow, helps other people learn

and, and make practical application to some of the things that you've done.

So to me, it's, it's kind of, I don't know if I, it, it, it's a little extreme thing.

This, but it kind of changed my life, honestly.

It

changed the the daily routine, you know.

Yeah, the same.

The same as it.

It's exactly the same.

Hap.

English.

Um, exactly the same thing happened to me, Scott.

Right?

So my career was absolutely launched by a failed restore.

And, uh, you know, I was at a, at a $35 billion bank.

I.

And we lost our purchasing database.

And I didn't have a backup of it because I, because I didn't understand what

it was, I was backing up and I didn't understand what I needed to do, et cetera.

Uh, you know, we, at the time we blamed it on, um, training because

I was relatively new in the job.

But the reality was is I was using an untested backup and, um, the,

the, and, and so I learned, you know, an incredibly valuable thing.

And, and in my very first book, which was published in, in Christmas of 99, right?

It was, it was my Y two K present.

Um, it was, it was, uh, basically like page two or three of the book.

There's a sidebar and it says the one that got away and it's basically about

this restore that absolutely failed.

And the only reason that, you know, the company didn't lose its entire

purchasing database was a guy by the name of Joe Fitzpatrick that

went in and did some magic stuff.

On the hard drive to this day, I don't know what he did, and honestly, he

doesn't even remember the event, so he doesn't know what he did, but he

did some stuff and brought it back.

So at least it was, it was a near disaster and wasn't a complete disaster.

But I, I think that's a real lesson for all of us, that when you screw

up, well, let's say two things.

If you're, if you, if you have people that work for you,

Um, let them screw up, right?

Like if they, if they, if they screw up, they own up to their mistakes

and they can, um, you know, learn what, what can they, and you and

others learn from what happened?

And they share that and they become a better person and an better, better

employee, a better colleague as a result.

Then encouraging your, your employee through that.

You know, I go back to my boss, Susan Davidson, who did not fire me.

Um, you know, I, uh, to this day, if she had fired me, I might

have had a very different career.

But she, she stood by her employee who had made an honest mistake that just

happened to have grave consequences.

And, um, you know, you don't, you don't, well, it's just my opinion.

You don't fire somebody because something horrible happened.

You fire them.

Because you know, it's about, like to me it's about attitude and you know,

was it that you just didn't care?

Or did you make a mistake?

Right?

Um, did you willfully do something wrong?

Um, and then the other thing is for those people that are the, the ones making

the mistake, um, please, for the love of everything, don't try to hide the mistake.

Um, uh, you know, I can think back to.

I was, uh, on site at a very large, I think the general way to say it is a

data warehouse company is one of these companies that other companies use, um,

for loyalty like, um, you know, frequent flyer programs at like your grocery store.

And, um, I worked with a guy who this was, um, It was a sun E 10 K Prasanna.

You remember?

You remember those.

And it was, uh, think of it as like a virtual machine thing, and

he took a backup of the dev of the test system and restored it onto

the production system accidentally.

And it was, it was a true accident.

Okay.

Um, but what got him fired was that he tried to cover it up.

Right.

Yeah.

And like, so, so don't do that, right.

Don't, don't try to cover up your mistake, uh, cover, you know, it's,

it's, it's never the thing you do, it's always the coverup that gets

you, that gets you fired, right.

Yeah.

So, so share, please share.

This is, you know, we, the, the episode that we just published this week was

about that, that he, he, it was a, you know, another cybersecurity guy.

And what he was upset was that, that he believed that the LA Unified School

District District was literally told that they weren't allowed to share, uh, what,

you know, how and why they got hacked.

And so I, I think the more of us that do this, Uh, the better it is for everything.

And I apologize.

I, I think I stepped up on the soapbox for 20 minutes there, but

Scott, what, you know, what would

Yeah.

I, I, I agree.

I think if, if we can really be transparent and, and

share, we're all imperfect.

I think a lot of people in the industry, I'll just say it in a general statement,

do have, tend to have big egos of themselves and they make no mistakes.

And I think if they.

Share their misfortunes and mistakes.

They've made it, it shows their true self.

And, and it becomes a learning moment.

I always tell my kids this is a life lesson.

I always stop them during different things and say, remember this.

'cause throughout your life you're gonna remember this moment.

And, and it's those type of things.

I think when companies make big mistakes, it's how you handle 'em.

Um, and I look back at even a lot of the breaches, one of the first

ones that stands out in my mind.

I'll never forget because, um, I remember sitting there on

tv, it was the target breach.

And I'm looking at it, I'm going, oh man, I can't believe those poor people.

And my wife looks over at me and she says, you know, we have a Target card.

I'm like, what?

And, and that night I got six different phone calls for interviews for the next

day on the target breach, and I was just running the entire day going from

studio to studio to weigh in on it.

So I'm doing research, staying up all night.

And I went through the whole rounds doing C n N and, and Fox and Bloomberg

and A, B, C, and so on and so forth.

And just sharing what happened and what I learned and how could

this have happened and stuff.

But that moment really got me excited when you, when you hear about something

that is such a big data breach and how many lives it affected, and

most importantly, How is it handled?

How do you disseminate what happened to to this many customers when it's millions of

customers that are so loyal to your brand?

What happens to the brand?

What happens to the shareholders?

What happens to the customers?

What happens to the the security side?

Who dropped the ball?

How did this happen?

All those questions go through my mind, and to me that's kind of exciting so

that it kind of backed me into this part of the industry doing the research.

When things happen makes you wonder and when you hear the stories like you were

telling a great story about the mistakes of not having backed up data at the bank

you were working at and, and as I hear that, It helps me appreciate if I want

to go to an expert about backups, I'm gonna talk to Curtis before anyone else.

'cause he's lived through it.

He understands it, he gets it.

And I think that's what's kind of cool about this industry

if you really dive into it.

Yeah, it's about technology and this and that, but ultimately it's about people and

the mistakes that people make and how you could protect yourself from bad people.

And if you do do that well, Then you can make a great career and

you can also make a difference.

And I think that's, that's an important thing.

I look at people that are doctors and I, I see the amazing things they do.

I faint at the sight of blood.

I'm not the guy for that job, but I appreciate what they can do or a

nurse, how they can be patient and put up with so many things and help

people and make them feel good.

That's important.

Um, hopefully what we're doing in the world of cyber is making

a difference in helping people.

Whether or not they appreciate it or not.

I, I don't know fully, but I think some people do.

Um, I, I was laughing.

I was at our R s A show recently.

I had somebody that I never met.

I happened to be speaking at the same show.

I later found out with this individual and he came up to me

and he says, are you Scott Schober?

I said, yeah, I want to shake your hand.

And he said, I said, okay.

What's your name and how do I know you?

He goes, oh, you don't know me?

He goes, but I bought your book and I read your book 20 times.

I said, that's more times than I read it.

That's pretty amazing.

He said, but I learned things and he started sharing all the things he learned.

He was very excited.

Individual was great, but I made a connection and it helped him solve a

few problems that he had in his company.

But more importantly, we made a connection and we became

friends, and that's kind of cool.

When you're in this industry, there's a lot of great people.

That you're surrounded by a lot of people that are a lot smarter than me.

I'm learning from them.

Hopefully a little bit of the stuff I've learned I could share

with them too, and, and it, and it just makes for a great community.

As you're.

Are talking Scott, through sort of like backup, right?

As being one place that you might like go talk to someone.

I think when it comes to cybersecurity, at many companies it gets very

difficult because it's not always like one person you can talk to, right?

You might have the backup guy, you might have the security guy, you might

have the applications guy, the database guy, the virtual machine admin, right?

And there's so many people involved in order to keep an organization secure.

Right.

And I think making sure everyone is coordinated is a difficult task, right?

Everyone has their own priorities, their own mandates coming from above.

Sometimes they're not even in the same organization.

Right?

And I think that's another aspect that makes cybersecurity so interesting.

It's.

Not like you could say, okay, everyone do this one thing.

Right?

It's that coordination, that team building, right?

It's like everyone needs to be a well-oiled machine for the security of

the organization to be functional even.

Yeah.

Yeah, I, I think that's a brilliant point, and I always talk.

About cybersecurity.

I've been brought into companies to educate, and I say, you know what?

This spans the entire employee spectrum from janitor to c e o,

and people are looking at me.

No, no, we're talking about the IT team.

And I'm like, no, no, no.

I'm talking about the janitor, the ceo, e o.

Everybody has a responsibility.

It doesn't mean you have to be an expert in cybersecurity, but when

you get onto a computer, you have to use some basic common sense

and have some cyber awareness.

So you don't just quickly click on things and, you know, write a sticky

note with your passwords and all, all the silly things that we always hear

about, but people do it every day.

And that's the part that I kind of back up from and I look at and I'm saying,

how could these companies and, and, and I've been to many large companies and

some of the largest organizations, and I see sticky notes with their password.

I see the, the passcode on their credit card machine to issue a

refund that I'm sitting there going.

I hide this, that code with my life so nobody could ever steal money, and yet

they have it out there, broad daylight.

So these things still happen.

And something, uh, some of the basic techniques and things that I've

learned and I try to share in the books and when I talk are things

that people just don't think about.

But when you share it with them, they go, oh, I didn't think about that.

That's interesting.

I, I, I'll give you a typical example.

I always think about security challenge questions, right?

What Curtis, what high school did you attend?

That might be one of your, your answers might be blah, blah, blah, high school.

And I always say don't answer it honestly.

There you get a pass, you can answer it dishonestly and

use a unique password there.

And it could be password 1, 2, 3 is actually a hundred times

more secure than putting the actual high school that you have.

'cause anybody can go on Google and search and see what high

school that Curtis attended, but nobody's gonna put in password.

1, 2, 3, there.

So like even the most basic common sense, almost stupid things that

you could do, help people back up and say, oh yeah, wait a minute.

I don't have to be honest.

I can just create a single password that only I know in my head that I'll

remember forever and use it there.

Problem solved.

Wow, that's great.

Sounds too good to be true, but it worked.

I did those things.

You know, when you were, when you were talking earlier,

um, you know, I was, you know, thinking about that we, that we should

value, we should value people who've, um, had bad things happen to them.

Right.

That, that, that perhaps I, 'cause you know, as we're talking, I, I never know

the way a particular podcast is gonna go.

I, I, I think this is.

This is the purpose of this particular episode is to get,

is to encourage people to share.

And, uh, you know, I think that we, we, um, uh, we value a little bit too

much, you know, our little pride and our little whatever, and we think that

that sharing is gonna get us in trouble.

Uh, and I will say that if sharing a, a, a mistake gets you fired.

Uh, maybe you didn't need to be working at that company anyway.

That, that's one idea.

But, but I was, I found myself, and this is gonna sound really

weird, no matter how many times I explain it, but I found myself

thinking about Platoon, the movie I.

Um, and so my question is, who do you want to be in battle with?

Do you wanna be in battle with Willem Defoe, this like battle

hardened guy, although he turns out to be a bad guy, I think in

the later, so we'll set that aside.

But the battle hardened guy who's been shot at 4,000 times,

or the brand new officer.

Just outta college, right?

The officer's, you know, super smart, super educated.

He's been trained on all the ways that battle works, but

he's never been shot at, right?

Um, we use the term he's never, he's, he's never fired in anger, right?

Um, you know, I think that the person who has been around a while,

um, and has, has made mistakes because honestly, if you're not.

If you're not making any mistakes, you're probably not, you're not innovating, uh,

would definitely, I would say you're not innovating and, um, And if you're, if you

say you've never missed, if you say you've

never made a mistake, you're, yeah.

So I, I liked, I really liked that idea that you, um, You know that

you, that you were saying that, let's go to the person for advice

who's actually been through things.

I like that a lot.

Can you think of any other ways that we can encourage those who,

uh, both the company, right?

So we're multiple levels here.

We want to encourage the company to understand that sharing.

Well, let, actually I have a thought, I'm gonna answer my own question.

sure.

In.

So I'm, my brain's just going a million miles.

'cause I really like this discussion point and that is that we live in a world where

we're almost, we, we become immune to the daily hacks that we see on the news,

Mm-hmm.

We see 'em all the time.

We're like, oh, we got, you know, Yeah.

The, the, you know, the cyber of the day, right.

Um, and so we, we don't, we don't think too much about it.

Um, and so I think too many times the companies, they just try to, you know,

like you, when back when you talked about your thing, you know, maybe they

try to stay under the radar and they don't want to get that, they do not want

to get that call from the ap, right?

Um, but I'm thinking that, um, When I know when we Prasannayou and I, when

we've evaluated sort of incidents, the thing that we value, Is how the

company responds, how open they are, about how soon they announced it, how

open they were about what happened.

The fact that right now, like it just happened.

It just happened two hours ago.

We don't know squat, right?

All we know is that something happens.

Here's A U R L.

Follow this U R L.

This is my particular favorite way.

Here's A U R L.

You know, go to curtis preston.com/.

2023.

Right, and, and

That website does not work for our listeners,

What's that?

that website does not work for our listeners on

that, that website, they'll find out exactly.

Um, that was a, that was the equivalent of a five, five,

five phone number in the movies.

Um, and, and just follow that and just, you know, get, like, it's, it's one nice

way of saying leave us alone while we think, just go over there and don't,

don't call us 8,000 times everything we know, we will put there and then do that.

Right.

Follow up.

Uh, you know, a a along that, uh, the, the more you can share about

what happened, when it happened, how it happened, what lessons you learned

as a result, uh, I think it's better.

I think it's better both for everybody, obviously, but also for you.

I'm, I'm basically applying your, um, your statement about that.

You want to go to the battle hardened person, and I'm applying this to a company

that it's also good for the company.

What?

What happened?

Are you doing a bump up butt Prasanna?

yes, I am doing a, but, but, but I think though I agree

with everything you say, Curtis, but then I also look at the flip side, which is

we're a very, lawsuit, happy country.

And I think corporations worry about how much information they can publish.

I agree that they need some amount of transparency and creating

the website and putting the links that people can go follow.

I a hundred percent agree with it.

I think there's that risk balance that corporations struggle with because like

Scott had mentioned, right, you do take a hit from a brand perspective, right?

You might open yourself up to lawsuits, right?

Or regulatory scrutiny or other aspects that once it's out

there, it becomes hard to undo.

I think the other thing to also mention is, There's also

the public perception, right?

Because when you publish something on a website, right, they assume, oh, this

is a hundred percent the truth versus when you're, I'm sure, Scott, you

could talk about this as well, right?

When you're doing a cyber investigation, right, you don't

always know like what it is really until you're sort of done, right?

Yes, you might have know some aspects along the way, but you may

not be a hundred percent confident the entire time because you're

working off of partial information.

Yeah.

Yeah.

Yeah, I, I, um, I'll, I'll finish my comment.

That was so rudely interrupted by Prasanna.

So I agree.

I agree with what you're saying.

Prasanna, which is why any, uh, incident response plan has legal as

part of the response plan, right.

I'm not giving legal advice here.

I'm just giving sort of my opinion that the more you can share confidently, I

think you're better off as a company.

Yes, I understand the.

The legal thing, but I also know that unders sharing can also be

illegal, um, you know, liability.

So I don't know.

Um, I, I, I never actually came up with a question there, Scott, but

I, I, I'll, I'll answer, I'll answer, the question even with,

though, with two more questions.

No, or two more statements.

Let me give you maybe a, a case scenario that's in my mind.

Think about Uber.

A couple years ago, got, uh, breached, uh, interesting how they handled it.

The president at the time, uh, they kind of covered it up.

They kind of muddied the waters a little bit.

Um, at one point they paid, I guess it was a ransom, but covered it as a

bug bounty, dishonest, uh, misleading to shareholders, so on and so forth.

I think they got their, their hands slapped a few times.

Their brand got hurt.

Um, they were struggling making money.

I think they still are to some extent.

So they kind of bumped along through different leadership and making mistake

after mistake after mistake, and were breached many times and again.

It's to the point they weren't really transparent about everything going on.

They kind of did this and Don don't get anybody upset 'cause the money's

coming in the front door and we need more investors and so on and so forth.

Um, contrast that with JP Morgan.

Uh, they had a major breach and now you're talking about at

the time, the largest financial institution headed by Jamie Diamond.

Um, they were transparent.

Hey, it, it was a third party access, didn't have multifactor

authentication in place.

We didn't do this, this, and this.

We made the mistakes.

We're sorry.

Here's what we're gonna do about it.

Oh, by the way, going forward, we're gonna commit a half a billion

dollars to improve our security.

So these things don't happen again.

Uh, which brand survived?

I think I think you could look at and say, wow, you know what?

JP Morgan Chase, their brand really thrived and continues to thrive.

Uber is still kind of a struggling rideshare company,

even though it's everywhere.

You don't believe everything you hear, you talk to the the drivers

and they're a little bit bitter.

You talk to the shareholders, they're bitter.

You talk to the employees, they're bitter.

So I think a lot of it has to do with how you run an organization and

when you deal with a cyber incident.

To your point, how do you respond?

It's gotta be a company wide and it's gotta come in a sense

from the top down as far as.

Hey guys, we screwed up.

Let's own it.

Let's inform everyone.

Let's take care of it so it doesn't happen again, and let's, let's follow through

this with our whole team and our employees and our shareholders and our customers.

So I think that's kind of important.

Being honesty, honest, and having integrity when there's a cyber

situation really makes a difference in the long run at the moment.

You probably look like an idiot in front of most people.

But in the long run, in hindsight, I think you look back and you say, you know what?

I'm glad I came clean.

I have a clean conscience.

I did it right, and it's not gonna happen again.

And that's, that's probably one of the most important lessons

I've learned is I'm paranoid.

I'm paranoid and to, to the stuff that you have expertise backing up data.

I'm always going around, we gotta get a backup of this.

And they're like, Scott, you backed this up last week.

I, I know, but just in case we changed the code, we updated the system.

Let's back it up.

I'll, I'll put it in the safe on a remote site.

And, but, but you start to think like a cyber thief.

Would you see the value in something and how easy it is to get it?

Because I've learned one thing.

Nothing's a hundred percent secure.

And if somebody wants something bad enough, they're

gonna find a way to get it.

So you just have to do everything you can to make it difficult for them

so they move on to the next target.

That's gonna be much easier.

That's all it's about.

It's a, there's a cat and mouse game, or a whack the mo game, or

whatever you want to call it, but that, that's oversimplifying it.

I know, but I, I think that's important to, to just kind

of think about those things.

If you're running a company or part of an organization, You have to weave

cybersecurity into the fabric of your organization so that you don't just do it

once a year and do a quick phishing test.

Pass.

We move on.

Let's get back to business guys.

That doesn't work.

Yeah, I like that.

I think going back to Uber, I think recently their CISO had some, uh, legal.

Case proceedings against him and I think was found.

Because, because of that incident, right?

Yeah.

Yeah, yeah.

I avoid the legal side of things, but you're, you're absolutely right because

the, the implications of getting caught and misleading shareholders and the public

and covering it up or doing the bait and switch, it's not good for business

in the long run when you get caught.

And I think that was the mistake at the moment.

It seemed like, yay, this is a win.

Now we don't have to go through the pain of everybody else, but.

It caught up with them, unfortunately, and sometimes people make say a little

white lie and they get away with it, and then it leads to more things that they

get implicated on and and legal mess.

And the cost for legal things these days in this society is just astronomical and

it distracts you again from the course.

So sometimes the legal matter outweighs the actual cyber incident.

Yeah,

And, and that's often how cybersecurity works.

I found interestingly enough, they, if they can settle it quickly, and sometimes

that's what a lot of these ransomware pay payments are about, uh, cybersecurity, uh,

insurance and the legal team get there and they look at it and say, you know what?

Pay this many bitcoins quickly, make this problem go away so we don't have to

pay this much over the next six months.

So,

Yeah.

And Prasanna.

I I think, um, going back to what you said, the, so somewhere on the, on the,

on the, the, uh, the pendulum of don't say anything and make up stuff, right.

Somewhere in there is where we're I, I, I think I'm, you know, I'm, I'm.

Wow.

I don't know if I like that pendulum I just created, 'cause I, I wanna

be closer to the making up stuff.

Meaning I, I, I, I don't wanna

sharing too much.

Yeah.

Don't

overshare.

we need to be right in the middle.

Right?

We don't wanna not say anything and we, we definitely don't wanna make up stuff.

We can all agree.

And that's why Prasanna, that, that there was a part in your

answer where you talked about.

That sometimes you just don't know.

Well, if you don't know, don't say, right.

You will, you will get in the, in the heat of the, of the

event, you will get pressure.

What happened.

If you don't know what happened, you can say, we still don't know what happened.

Um, I, I guess, and, and

Prasanna Malaiyandi:

Perfectly acceptable answer.

Prasanna Malaiyandi:

Yeah.

Yeah.

Yeah.

acceptable answer.

I don't know yet.

We are, you know, we are investigating and we will investigate until

we find out the root cause.

Um, yeah,

think that's human nature too.

You as a human.

Another person.

It's okay to hear something, even if it's a little bit disappointing.

I, I think about it directly with we're, we're late on a lot of

our deliveries to our customers.

Here I am, uh, going on the, on the record.

I'm apologizing here.

Please forgive us.

But I think communicating that with a customer is imperative.

Hey, we're late on delivery.

We told you it would take this long.

We were wrong.

There are reasons, and we don't want to stand here and reiterate all the reasons,

but here's a couple of the reasons why.

We're sorry, but here's what we're gonna do about it.

Whether it's you give him something or free chipping or whatever,

or or more importantly, when we do have the date, it will ship.

I will get back to you, I will send you the tracking number and the most important

thing is the follow through on it.

And it's funny, somebody that hates you or is very upset with you, 'cause they're

frustrated, they can't do their job, and when you give 'em the tracking number

and the follow through, they thank you.

They say Wow.

You got back to me.

You must care about me as a customer.

Thank you.

And to me, I've learned that's really important.

It doesn't matter what role you are in the company, and I'll often get that.

Sometimes I'll even get a, a thi.

Aren't you the c e o of the company?

Why are you saying sorry to me that you guys were late?

It's probably not your fault.

I said, no, it's all of our fault.

It's the company's fault, so I am sorry.

The company's sorry.

And just being able to express that I think helps them see you're real, your

honest, you're transparent, and you want what's best for them no matter what it is.

And I think that's important to develop relationships, business relationships.

Yeah, I like that.

And by the way, I, uh, the word legal came up.

I thought I forgot to throw out our usual disclaimer, uh, that, um, that this is an

independent podcast and you're hearing, uh, opinions of people and not companies.

And, uh, if you'd like to, Join the conversation I'd,

I'd love to hear from you.

W Curtis Preston at gmail, or at WC preston on Twitter or linkedin.com/in/mr.

Backup.

Uh, and we, you know, we'll get you, you know, we love to hear from people

and, um, so, and, and also, please rate us, uh, go to your favorite pod

catcher and give us all the stars.

And send us comments.

We'd love to see comments as well.

Uh, Scott, I, I want to thank you for, for coming on.

Uh, it's been a great, like I said, I never know exactly where a given

recording is gonna go, but I really like the, you know, our encouraging

people to share and, and how to share.

Yeah.

Yeah.

No, thank you guys for taking the time and having me on as a guest.

I, I was, uh, approached by somebody before coming on and they said, you're

going on a podcast and what's it about?

I said, well, he is Mr.

Backup, this and that.

Well, whatcha gonna talk about?

I said, I have no idea, but probably something related to cybersecurity.

And if so, it'll be fun.

And then I said, that's all I need to know.

That was a great, great conversation.

That's what's important.

Thank you guys.

Absolutely.

And Prasanna, you know, thanks for interrupting me.

That was a,

that was a good point.

That was a good point you

it.

It's okay though, Curtis, in post-processing.

You can just cut it all out and then you can just continue the conversation.

You'll be fine.

I'll, I'll, I, I might cut it to make it look like you really

stomped on my, on what I was saying.

You know, the, the, the ultimate

It was nice chatting.

Exactly.

It was nice to chat with you, Scott.

Thanks for sharing.

Oh,

Thank you guys.

Stay safe, everyone.

And, uh, thanks to our listeners and remember to

subscribe so that you can restore it all

you could restore it.