how open should you be when things go wrong?
Should you tell your boss, you made a huge mistake.
Should your company tell everyone they got hacked this week?
We talk with a wireless cybersecurity expert about this really important topic.
I hope you enjoy it.
W. Curtis Preston: Hi, and welcome to Backup Central's Restore it all podcast.
I'm your host, w Curtis Preston, a k a, Mr.
Backup.
And I have with me, I think might be the only thing between me and a little
dog Prasanna Malaiyandi that's it.
How's it going Prasanna?
Prasanna Malaiyandi: I am good and I hope the dog wins out.
W. Curtis Preston: Oh.
Prasanna Malaiyandi: What happened?
What happened to
W. Curtis Preston: I mean, you, you, you have, you have a little dog, right?
So I, I, I technically don't, I, I have, I, you know, I have a grand
dog who ha has been living with us.
Uh, you know, my, my daughter and her husband live here with their dog,
um, for a little bit, and I'm not used to having a dog around, right?
So there are things that if you're used to having a dog around you just.
Don't do.
Um, one of those would be if per chance, I don't know, you've got a podcast
recording coming up at say, I don't know, one o'clock, and perhaps you realize that
say 1240, that you haven't eaten anything and you're gonna starve to death by two.
And so you just go heat up some enchiladas and you put them on
a plate on your desk inside your office where you close the door.
Uh, except for like one minute, you go to get your AirPods
because you forgot your AirPod.
Just, just theoretically speaking, you go to get your AirPods and you leave the
door cracked, not wide open, but cracked, and you say to yourself as you're walking
away, BREW is not going to like open the door, go into the office, climb up
onto my chair, and then attempt to eat.
My enchiladas, she wouldn't do that in the
Prasanna Malaiyandi: Oh no.
W. Curtis Preston: I'm away from my desk.
Yeah.
So I come back and my enchiladas are upside
Prasanna Malaiyandi: floor.
W. Curtis Preston: on the floor with the plate on top of them and bru just
sitting there on my chair, like, um,
Prasanna Malaiyandi: on her face?
W. Curtis Preston: uh, she didn't actually get, get too much apparently,
uh, because the, the, but she, yeah.
Prasanna Malaiyandi: so, but maybe that should tell you that if she's not
going to eat your enchiladas, maybe you shouldn't eat your enchiladas.
I'm just saying Curtis,
W. Curtis Preston: No, I think she just didn't have enough time.
She just didn't have enough time.
Prasanna Malaiyandi: So basically this
W. Curtis Preston: to remember to like close the doors, you know, at all times.
It's just not something I'm used to doing, especially since we became
empty nesters a little while ago.
Um, so I'm just sort of, everything's open all the time.
Um, and, uh, but yeah, so that dog,
Prasanna Malaiyandi: Well, whose fault is it for leaving the chair next
W. Curtis Preston: hey, hey, hey.
Don't blame the victim.
Prasanna Malaiyandi: I am defending the dog who does not
have a voice on this podcast.
W. Curtis Preston: Your Honor, I present the, the case of the, the
Preston household versus Brule.
Uh, I submit the plate on the floor.
Um, I could just see, I could just see, you know, a brew on the stand of
like the little, the puppy dog eyes.
She's gonna give
you the
Prasanna Malaiyandi: see.
what was going through my head was like Snoopy.
That's what was going through my head.
It was like brew being Snoopy, being like it wasn't me.
W. Curtis Preston: It was me.
Yeah.
It was totally her.
Yeah.
She was caught white handed, um,
Prasanna Malaiyandi: this means is after the podcast is done, when
you go get some lunch, you should just grab her a snack as well.
W. Curtis Preston: Okay.
I'm prohibited from giving her food.
I, I, I have
Prasanna Malaiyandi: Even her food, even her snack food.
W. Curtis Preston: Well, she has a set snack time and, and this isn't it.
So, um, I, I don't want to get in trouble with my daughter, um, or the
way, the way my son-in-law, uh, says it.
He's like, it's fine, Curtis.
If you want her to live like three years less, it's fine.
That's the way he says, you know,
Prasanna Malaiyandi: Hey, so my parents, so growing up I am sure our
guest is like, what is going on here?
So growing up, my parents had a dog and we had a vet who was Indian,
and the vet would always be like, look, I know you guys are Indian.
I know you love to feed your dog Indian food.
Don't do it.
It's unhealthy.
My parents ve everything like Indian Sweetss, Indian food,
like for his birthday, they would make him special Indian food.
He lived till he was 17 and a half, so, so there you go.
Right?
So exactly.
W. Curtis Preston: I'm, I'm not having that argument with my daughter.
Um,
Scott Schober: Hm.
W. Curtis Preston: Anyway.
Well, uh, it's time to bring our guest on, uh, if he, is he still, is he still here?
Prasanna Malaiyandi: He's still here.
He's still here.
Don't worry.
W. Curtis Preston: in wireless and cybersecurity, and since 1990 has
been the c e O of Berkeley Veratronic Systems, a wireless detection,
manufacturing, and production company.
He is also the host of the What Keeps You Up At Night
Podcast, which is how I met him.
Welcome to the pod, Scott Schober.
Scott Schober: Hey, great to be with you.
W. Curtis Preston: So I,
Prasanna Malaiyandi: Do you have a pet Scott?
Scott Schober: I, I do.
And as you guys were talking about some of these things, I was thinking of my dog.
We have a dog, Daisy, she just turned four years old.
Mini golden doodle, lot of fun, high maintenance, but a lot of fun.
W. Curtis Preston: Yeah, this is, this particular dog is a cockapoo.
Um, and so it, it, you know, she would've had to literally jump up on my chair and
I was, you know, I was just thinking, she's not gonna do that in the little
time I have, in the little time I'm gone.
Not so much.
The, the, the smell of the food was just too, you know, too.
Too enticing.
Yeah.
Um, if you wanna find brew, all you gotta do is start cooking something
and she'll just magically show up.
Uh, so I, Scott, I gotta, I gotta say, so it looks like the company
that you're at has been around longer than you've been there.
'cause you, you were saying that it has 50 years of experience.
The company has been around for 50 years, but you've been there 30 years.
Um, 'cause normally when I see somebody who's been somewhere for a really long
time, it's like a company they started.
And so of course they're there, but in your case, they brought you in
after they'd already been going for.
Close to 20 years or something in that neighborhood,
Scott Schober: yeah.
The interesting story is that it's a family business, so it's
actually founded by my father.
Still our c t o.
He actually happens to be here today, uh, just checking in.
But he, he's since retired and, uh, he founded the business.
So it's really what I grew up with.
I did actually start technically working for the company when I was in sixth grade.
Uh, he, he challenged me.
We had a number of, uh, keypads.
These were wired keypads, old school keypads way, way back in the day.
And he said, for every keypad that you fix, you'll get a dollar.
And he showed me how to solder.
And, and make measurements on a resistor and iOS and things like that.
And I spent the day going through hundreds and hundreds of, of these
keypads and realized, wow, I can make a lot of money fixing these things.
And eventually I kind of got into the business and, and doing everything.
So, um, it's kind of cool growing up in the family business.
'cause I did everything from, you know, cleaning, cutting
a lawn, painting, soldering.
I went to school formally.
And for, um, computer software development and telecommunications.
I went to Kane University for undergraduate stuff and graduate
stuff at, at New York University.
Um, and it's kind of cool because it gets me to cross different things.
You know, you talk about it in your daily life as a family, but
it's also part of your business.
And then also, I, I like to, you know, I'm, I was a gamer growing up.
My father worked for a number of years at Atari.
So he brought home all the latest and greatest games.
My brother and I, we were game testers and we'd stay up to the wee hours
of the night testing games, finding the bugs, documenting them, and then
feeding it back to the programmers.
So it, it's kind of neat 'cause you're around the culture growing up in it.
It's part of your life.
It's part of your D n a.
So it's kind of exciting and that to me keeps me going from a
standpoint of innovating products and ideas within the company.
And I have people here that are actually implementing and doing it, that have
PhDs and far smarter than I am that can actually make the technology work.
So I'm kind of the the guy that's in between and gets my hands
in a little bit of everything.
I know enough about everything to be dangerous.
So it's kind of a fun business and it's niche, very niche cybersecurity.
And, and hardcore design.
We're really hardware designers, which is a little bit different
than most companies out there.
It seems like everybody does software, be it apps or, or high
level programming or whatever.
And yeah, we do that too.
We do program, but our expertise is really at the core, the, the hardware
and understanding radio frequency, uh, be it the wireless I always like
in our company is where we're at.
The intersection of wireless and cybersecurity is kind of where
we fit, which is kind of cool.
Prasanna Malaiyandi: Nice.
So you shifted then, I'm guessing you talked about keypads early on, right?
And so at what point were you like, okay, keypads are great and
now let's shift into this wireless cybersecurity aspect of things.
Scott Schober: Good.
Good question.
The shift into the first part of your, your question, wireless
really happened about mid 1980s.
We actually got a call as a company.
Again, being a hardcore hardware company, design company, people come
to us with problems and we provide solutions hopefully that, that solve
their problems and are affordable.
And, uh, we were approached by a company down in Washington, DC and said, Hey,
we've got an idea for developing some test equipment, but we don't know how to do it.
You guys might know how to.
We said, okay.
We, we, we were hired for it took on the assignment and we
developed actually the first test tools to test out the cell towers.
And this was, um, very interesting because nobody knew at the time that
wireless cell phones would take off.
So we were in the early days of amps phones and we developed the actual test
receivers and transmitters, and worked on some of the propagation analysis software
so you could see what the coverage was.
And we started work with this company.
We worked for them for well over 10 years, developing test tools, which
really took our business, allowed us to grow, and we're still doing it today.
We're still developing test receivers and transmitters that we sell globally,
but we're not selling it for the old school e amps and things like that.
It went from second generation, third, fourth.
Now we're into the five G technologies that we always hear about, that
our smartphones work about.
Well, a number of years into that, what I started to notice was.
Business has changed and the way propagation analysis done, it's
more done predictive analysis.
In other words, you can use advanced algorithms to actually
figure out how well signals propagate at different frequencies.
So you don't need to do the hardcore drive studies where you're manually driving
around collecting this data, spending thousands of hours and so on and so forth.
So we, I said, let's shift the business a little bit and focus on
the security since we understand.
Smartphones and we know their vulnerabilities and we work
with a lot of the companies.
Let's analyze that space and see if there's some tools and
technology we could develop.
We started to do that and it really took off and, and the short of the story is the
more we started doing it, I was brought in to, to share some expertise and things.
We knew how to keep your company safe and so and so forth.
Well, the more I did that, the more I got a target on my back and the
company's back and hackers went after us, and now it started with.
Credit card compromise, debit card compromise, Twitter account compromise,
repeated DDoS attacks to our online store, so we couldn't do commerce, and finally
we had $65,000 stolen out of our checking account, became a federal investigation,
paperwork, email, so and so forth.
The story goes on and on in the process.
I thought it was kind of interesting because what do you do here you are as a
wireless cybersecurity company, sharing expertise and advice, and you're a victim.
And you made mistakes.
And, and I, ironically, I came, I was doing an interview at the time, it was in
New York City, Bloomberg, uh, TV stopped to get a bite to eat, and I got a phone
call mysteriously from Associated Press.
Don't know how they got my number or how they heard about it, but they
said, we heard from reliable sources.
Your company was hacked and you were the victim of a cyber attack.
Would you be willing to go on the record and share this?
And I said, yikes.
And I said, okay, I'll, I'll, I'll be willing to share it.
A, a allowing that I share maybe my misfortunes and my mistakes and
hopefully some of the things I've learned so other business owners don't
go down the same path that I've done.
And they agreed, I agreed, turned out to be a great story.
It it, it ended up getting me more interviews and more interest and I ended
up being, um, talked into writing a book.
Again, I'm, I'm not a writer.
Um, I agreed to it.
I said, let me try it and see.
Uh, so I did self-publishing.
It took me a little more than two years to write it.
It was my first book called Hacked Again, because of the, the story of basically
being hacked as a, a cybersecurity expert.
And, uh, it kind of opened my eyes up to thing and it opened
the doors up to many other things.
I, I probably wouldn't be talking to the two of you right now if
those chain of events didn't happen.
And then subsequently I put out a second book, cybersecurity's
Everybody's Business where it went more mainstream to other businesses.
And then finally, Another project I had was I, I saw that seniors
were being targeted and it really bothered me, so I wrote a book,
senior Cyber and so on and so forth.
Now thinking about book number four and getting that, the wheels in
motion for that, when I find time.
W. Curtis Preston: Yeah, that's the, that's the problem with once you,
once you get over that, uh, that initial hurdle of writing that first
book, uh, you know, I, my first book.
Took me three years to write.
Um, and it, and, and I, I thought I was, I thought I was gonna die.
Right?
The, but like the first, the, the first thing I wrote was actually
an article for Unix Review Magazine back in 1990 something.
And I remember being terrified about, You know, the whole, like, I'm gonna
have a mistake in this article, which for the record I did, I had a
mistake, I had a misunderstanding of the way Oracle hot backups worked.
And uh, and I published that and I'm like, oh, I'm gonna be found,
I'm gonna, I'm, you know, you know, imposter syndrome, right?
And, uh, but from that, uh, I basically, you know, did the
proposal to write my book.
And it took about three years to, to write it.
Um, and then the, you know, the next one that I wrote was much smaller and
easier to digest and, you know, and so I had a running joke that like, 'cause
the first one was like 700 pages, right?
The, the next one was like 350 pages.
And I said, I, I found out the formula.
My next book's gonna be 30 pages.
Right.
Scott Schober: Short little
ebook.
W. Curtis Preston: less time and sulfur around the same price.
Uh, but yeah, once you, once you've got that process down, uh, it's,
it's, um, so you, you, you don't have to reveal it here, but you have,
you have an idea for your next book.
Scott Schober: Yeah.
Yeah, actually, I, I, it's actually, uh, three or four different ideas I
have and, and the, the hardest part is focusing on what do I wanna write about?
And I'm starting to write about each one, which is probably not a good way to do it.
Um, I get distracted, I get, I get, I lose focus.
Um, but, but sometimes writing, I think, and, and maybe it's partly me and maybe
it's other people find this, or I'm curious, maybe even you find this Curtis,
it's almost therapeutic sometimes.
You get a lot of stuff up here as you kind of put pen to paper.
I, I've, I've kind of switched over actually doing, uh, speech to text.
Somebody showed me that it's much faster by the time I got to the third book.
I was like, wow, six months.
Bam.
Knock it out.
This is great.
Um, and, and you understand also the process.
The first book I wrote this much and then trim, trim, trim, trim, lose
this chapter, reorganize and, and you find you wasted a lot of time.
If I spend more time up front and I think about it up here and
organize kind of, kind of the flow.
Get the thesis and here are the chapters and then I stick to it.
I can, I can get through it quickly.
And I think once you commit to it and then you stick with it, and I did, I
do tend to, to write at weird hours.
My family might go to sleep, my kids and the dog at 11 o'clock at night and I'll
say, okay, I'm gonna put three hours in and just get this outta my head.
And then I'll be thinking about it more.
I'm on a plane ride for a couple hours.
I'll get this part of it outta the head.
And I have a story I wanna share here.
Now I'm gonna go back.
So you, you tend to do this a little bit.
Um, it's a good process though.
I learned a lot and I did it self-publishing.
I'm not sure how you did it if, if you went that way, but I, I knew zero and
I had to learn it all from scratch.
And, and I, I also did soft cover, hard cover ebook, um, did
the whole, uh, audible as well.
So going through all of that, those processes with three books, it kind of
scares me to go to book number four, but I know, I know all the difficult
things that I have to overcome, the objectives and how to get through it.
But, uh, but I agree with you.
I, I used to get caught up on, oh, I'm gonna spell this wrong, or the
sentence structure or whatever.
'cause I'm not a writer per se.
And, uh, I think I took one class in college, creative writing.
It goes back a long time ago.
And when I got to the class, I said to the professor, I said,
I don't know how to write.
I wanna learn how to write.
He goes, don't worry.
This year we switched to computers, and I know nothing about computers.
I heard you're a computer science major.
If you help me and all the girls in the class computers, you'll get an A in
this course and I'll teach you to write.
I said, fair Deal.
And I got an A in the course.
Uh, so I, I, I kind of give him some credit.
I learned some bit of writing from him, but I was more of a writer for,
you know, an article for Forbes or doing blogs and things like that.
All short, short stuff.
But it, it does help you, I think, because it forces you to do research.
It, it forces you to think I.
And not be too quick to put everything down on paper, but make, make sure you're
doing the fact checking and you understand what you're explaining and you can
break it down so the reader can get it.
And I think that's an important part of it.
So I kind of had to teach myself a lot of those steps and I, and I a
lot of help from others, honestly.
Talking to others, what are the techniques they use?
I talked to one gentleman, he wrote 185 books
Prasanna Malaiyandi: Wow.
Scott Schober: How did you write 185 books and going strong?
And he shared a few tips with me that I applied and I said, wow, this does work.
And it really helps keep you focused and allows you to progress.
And I mean, after that I actually got asked to do to, to
go to two different book shows.
One at Jacob Javit Center, I think one in Chicago.
And explain the process of not knowing how to write to being a self-published author
and, and some different things that you can do in the process to make it easier.
And, and to me it's been a wonderful blessing that, that I've been able
to do it and learn from so many great people and, and be on great shows like
this and, and share different stories.
So it's a lot of fun.
W. Curtis Preston: Yeah, you and I are gonna have to have a
longer conversation about that.
'cause it sounds like we could swap some stories.
By the way, just real quick, I will say I'm a huge fan of
voice to text, so I use Dragon.
Uh, my last three books have been written entirely in voice.
Um, basically my, my key is that I, I'm a storyteller and I'm.
You know, and what's funny is people like Prasannawho know me personally, and then
they're, uh, they're a, they're a text, they're a, a technical editor for me.
They tell me that when they read it, they hear it.
In my voice.
Prasanna Malaiyandi: hear Curtis's voice.
Yeah.
W. Curtis Preston: I mean?
Scott Schober: I hear it.
W. Curtis Preston: Because, because that's the way I write.
I write the way I talk.
Um, I, I agree with you, you, you need to spend more time upfront.
Um, in, in fact, the last book, not on purpose, but the last
book, it took me 10 years to agree on what I was gonna write on,
Scott Schober: Yeah.
W. Curtis Preston: and then three months I think to, to write it.
Um, but yeah, it took, it, it, I just, I just kept, it was one of those, you know,
you know what, get off the pot finally.
Um, and, uh, was able to get, and I, I am, I am working on book four as well,
but, uh, anyway, enough of what's that?
Prasanna Malaiyandi: the.
Scott Schober: I was just gonna share one thing, 'cause you, you hit the nail on
the head on one thing just to expound on.
People always ask me, what do you need to do to write a book?
And people think time and money, and da, da, da, all that stuff.
I always say that the most important ingredient I feel
is being a good storyteller.
And I think if you could be a good storyteller, you can learn how to write,
you can learn how to spell check and edit, and you can get help with the graphics
and the cover and the distribution, all the other things you can get help with.
But if you can't tell a good story, nobody wants to read your book and, and
you don't write a book to make a lot of money or to retire as a millionaire,
anybody that thinks those type of things shouldn't be writing a book.
If you have a story up here that you can get in the book, you, you got it.
That's success right there.
I feel.
W. Curtis Preston: absolutely.
Prasanna Malaiyandi: So I'm not a published author like both of you.
Um, but uh, just sort of going back to your first book, right, Scott,
it's, and or the situation you were talking about when you got hit
with cyber, uh, by a cyber attack.
It's, it come up on the podcast a lot of times where many organizations get hit by.
Criminals, right?
And have these cyber incidences, but they don't say anything.
Right?
And that's just such a huge disservice to the public and other
people who want to learn about, okay, how do I protect myself?
I'm glad to hear that your first book was like, Hey, here's what I could do to
sort of prevent and help other companies prevent these from happening to them.
Have you seen that?
That still continues to be.
Beneficial or that more people are opening up, or is it sort of one
of those closely guarded secrets?
I don't want to air my dirty laundry.
Scott Schober: I, I see a mix a lot.
A lot of the close colleagues that I think I've, I've gotten to know over the years,
have shared their horror stories, their, their mistakes, their misfortunes, and
that that granted them a level of success.
I, I think of, um, Some of the things that happened to Brian Krebs, he
a former Washington Post reporter.
And now he focuses on, on cyber crime and reporting that he's got
some incredible stories, how he's was and continued to be targeted
and how it had to change his life.
And I, I, I could certainly relate to that.
I could feel that way.
Talking to Kevin Mitnick, getting closer to him and interviewing
him and talking to him.
He's had some cool background stuff and, and he, he, he has a, a flare for, for
magic and, and hacking and phone freaking, and all these other type of things.
And I can relate to a lot of that.
But hearing again, he was targeted and constantly people go after him.
And I think that's a common theme that I'm seeing.
And most of these people that I, I deal with these other, um, I guess
cybersecurity people, they end up writing books and sharing their
story and sharing their misfortunes and problems that they have.
And I think in some ways, maybe that's how we help ourselves.
And, and, and learn from our own mistakes by feeling like, you know, if I share
some of the, the stupid things I did, other people won't make these same
mistakes and they'll be better than me.
And I think that's important.
It, it's, it, part of it's, I feel like it's teaching and sharing knowledge.
And I often learn from people, not just the things they tell you, Hey, you know,
create a long password, but you also learn when, when you hear somebody, well, I
created a weak password and I used it on 20 counts, and now look what happened.
And it, it really.
Puts up in your head, geez, I'm never gonna do that.
That was really stupid.
But at a teaching moment.
And I think that's, that's one thing that I, I've had the gift to be, the
ability to try to share these things.
And I think writing a book leads to so many more things, and that's
what most people don't realize.
It leads to a podcast show.
So I do two podcast shows.
It leads to.
TV and radio interviews, uh, uh, public speaking.
I enjoy that.
I get to travel and speak to audiences, and I'm hired to go in and, and speak
about different topics and things.
So sometimes don't look at just the book or the story.
Look at the big picture, how it helps.
I.
You grow as a person, helps your business grow, helps other people learn
and, and make practical application to some of the things that you've done.
So to me, it's, it's kind of, I don't know if I, it, it, it's a little extreme thing.
This, but it kind of changed my life, honestly.
It
changed the the daily routine, you know.
W. Curtis Preston: Yeah, the same.
The same as it.
It's exactly the same.
Hap.
English.
Um, exactly the same thing happened to me, Scott.
Right?
So my career was absolutely launched by a failed restore.
And, uh, you know, I was at a, at a $35 billion bank.
I.
And we lost our purchasing database.
And I didn't have a backup of it because I, because I didn't understand what
it was, I was backing up and I didn't understand what I needed to do, et cetera.
Uh, you know, we, at the time we blamed it on, um, training because
I was relatively new in the job.
But the reality was is I was using an untested backup and, um, the,
the, and, and so I learned, you know, an incredibly valuable thing.
And, and in my very first book, which was published in, in Christmas of 99, right?
It was, it was my Y two K present.
Um, it was, it was, uh, basically like page two or three of the book.
There's a sidebar and it says the one that got away and it's basically about
this restore that absolutely failed.
And the only reason that, you know, the company didn't lose its entire
purchasing database was a guy by the name of Joe Fitzpatrick that
went in and did some magic stuff.
On the hard drive to this day, I don't know what he did, and honestly, he
doesn't even remember the event, so he doesn't know what he did, but he
did some stuff and brought it back.
So at least it was, it was a near disaster and wasn't a complete disaster.
But I, I think that's a real lesson for all of us, that when you screw
up, well, let's say two things.
If you're, if you, if you have people that work for you,
Um, let them screw up, right?
Like if they, if they, if they screw up, they own up to their mistakes
and they can, um, you know, learn what, what can they, and you and
others learn from what happened?
And they share that and they become a better person and an better, better
employee, a better colleague as a result.
Then encouraging your, your employee through that.
You know, I go back to my boss, Susan Davidson, who did not fire me.
Um, you know, I, uh, to this day, if she had fired me, I might
have had a very different career.
But she, she stood by her employee who had made an honest mistake that just
happened to have grave consequences.
And, um, you know, you don't, you don't, well, it's just my opinion.
You don't fire somebody because something horrible happened.
You fire them.
Because you know, it's about, like to me it's about attitude and you know,
was it that you just didn't care?
Or did you make a mistake?
Right?
Um, did you willfully do something wrong?
Um, and then the other thing is for those people that are the, the ones making
the mistake, um, please, for the love of everything, don't try to hide the mistake.
Um, uh, you know, I can think back to.
I was, uh, on site at a very large, I think the general way to say it is a
data warehouse company is one of these companies that other companies use, um,
for loyalty like, um, you know, frequent flyer programs at like your grocery store.
And, um, I worked with a guy who this was, um, It was a sun E 10 K Prasanna.
You remember?
You remember those.
And it was, uh, think of it as like a virtual machine thing, and
he took a backup of the dev of the test system and restored it onto
the production system accidentally.
And it was, it was a true accident.
Okay.
Um, but what got him fired was that he tried to cover it up.
Right.
Scott Schober: Yeah.
W. Curtis Preston: And like, so, so don't do that, right.
Don't, don't try to cover up your mistake, uh, cover, you know, it's,
it's, it's never the thing you do, it's always the coverup that gets
you, that gets you fired, right.
Scott Schober: Yeah.
W. Curtis Preston: So, so share, please share.
This is, you know, we, the, the episode that we just published this week was
about that, that he, he, it was a, you know, another cybersecurity guy.
And what he was upset was that, that he believed that the LA Unified School
District District was literally told that they weren't allowed to share, uh, what,
you know, how and why they got hacked.
And so I, I think the more of us that do this, Uh, the better it is for everything.
And I apologize.
I, I think I stepped up on the soapbox for 20 minutes there, but
Scott, what, you know, what would
Scott Schober: Yeah.
I, I, I agree.
I think if, if we can really be transparent and, and
share, we're all imperfect.
I think a lot of people in the industry, I'll just say it in a general statement,
do have, tend to have big egos of themselves and they make no mistakes.
And I think if they.
Share their misfortunes and mistakes.
They've made it, it shows their true self.
And, and it becomes a learning moment.
I always tell my kids this is a life lesson.
I always stop them during different things and say, remember this.
'cause throughout your life you're gonna remember this moment.
And, and it's those type of things.
I think when companies make big mistakes, it's how you handle 'em.
Um, and I look back at even a lot of the breaches, one of the first
ones that stands out in my mind.
I'll never forget because, um, I remember sitting there on
tv, it was the target breach.
And I'm looking at it, I'm going, oh man, I can't believe those poor people.
And my wife looks over at me and she says, you know, we have a Target card.
I'm like, what?
And, and that night I got six different phone calls for interviews for the next
day on the target breach, and I was just running the entire day going from
studio to studio to weigh in on it.
So I'm doing research, staying up all night.
And I went through the whole rounds doing C n N and, and Fox and Bloomberg
and A, B, C, and so on and so forth.
And just sharing what happened and what I learned and how could
this have happened and stuff.
But that moment really got me excited when you, when you hear about something
that is such a big data breach and how many lives it affected, and
most importantly, How is it handled?
How do you disseminate what happened to to this many customers when it's millions of
customers that are so loyal to your brand?
What happens to the brand?
What happens to the shareholders?
What happens to the customers?
What happens to the the security side?
Who dropped the ball?
How did this happen?
All those questions go through my mind, and to me that's kind of exciting so
that it kind of backed me into this part of the industry doing the research.
When things happen makes you wonder and when you hear the stories like you were
telling a great story about the mistakes of not having backed up data at the bank
you were working at and, and as I hear that, It helps me appreciate if I want
to go to an expert about backups, I'm gonna talk to Curtis before anyone else.
'cause he's lived through it.
He understands it, he gets it.
And I think that's what's kind of cool about this industry
if you really dive into it.
Yeah, it's about technology and this and that, but ultimately it's about people and
the mistakes that people make and how you could protect yourself from bad people.
And if you do do that well, Then you can make a great career and
you can also make a difference.
And I think that's, that's an important thing.
I look at people that are doctors and I, I see the amazing things they do.
I faint at the sight of blood.
I'm not the guy for that job, but I appreciate what they can do or a
nurse, how they can be patient and put up with so many things and help
people and make them feel good.
That's important.
Um, hopefully what we're doing in the world of cyber is making
a difference in helping people.
Whether or not they appreciate it or not.
I, I don't know fully, but I think some people do.
Um, I, I was laughing.
I was at our R s A show recently.
I had somebody that I never met.
I happened to be speaking at the same show.
I later found out with this individual and he came up to me
and he says, are you Scott Schober?
I said, yeah, I want to shake your hand.
And he said, I said, okay.
What's your name and how do I know you?
He goes, oh, you don't know me?
He goes, but I bought your book and I read your book 20 times.
I said, that's more times than I read it.
That's pretty amazing.
He said, but I learned things and he started sharing all the things he learned.
He was very excited.
Individual was great, but I made a connection and it helped him solve a
few problems that he had in his company.
But more importantly, we made a connection and we became
friends, and that's kind of cool.
When you're in this industry, there's a lot of great people.
That you're surrounded by a lot of people that are a lot smarter than me.
I'm learning from them.
Hopefully a little bit of the stuff I've learned I could share
with them too, and, and it, and it just makes for a great community.
Prasanna Malaiyandi: As you're.
Are talking Scott, through sort of like backup, right?
As being one place that you might like go talk to someone.
I think when it comes to cybersecurity, at many companies it gets very
difficult because it's not always like one person you can talk to, right?
You might have the backup guy, you might have the security guy, you might
have the applications guy, the database guy, the virtual machine admin, right?
And there's so many people involved in order to keep an organization secure.
Right.
And I think making sure everyone is coordinated is a difficult task, right?
Everyone has their own priorities, their own mandates coming from above.
Sometimes they're not even in the same organization.
Right?
And I think that's another aspect that makes cybersecurity so interesting.
It's.
Not like you could say, okay, everyone do this one thing.
Right?
It's that coordination, that team building, right?
It's like everyone needs to be a well-oiled machine for the security of
the organization to be functional even.
Scott Schober: Yeah.
Yeah, I, I think that's a brilliant point, and I always talk.
About cybersecurity.
I've been brought into companies to educate, and I say, you know what?
This spans the entire employee spectrum from janitor to c e o,
and people are looking at me.
No, no, we're talking about the IT team.
And I'm like, no, no, no.
I'm talking about the janitor, the ceo, e o.
Everybody has a responsibility.
It doesn't mean you have to be an expert in cybersecurity, but when
you get onto a computer, you have to use some basic common sense
and have some cyber awareness.
So you don't just quickly click on things and, you know, write a sticky
note with your passwords and all, all the silly things that we always hear
about, but people do it every day.
And that's the part that I kind of back up from and I look at and I'm saying,
how could these companies and, and, and I've been to many large companies and
some of the largest organizations, and I see sticky notes with their password.
I see the, the passcode on their credit card machine to issue a
refund that I'm sitting there going.
I hide this, that code with my life so nobody could ever steal money, and yet
they have it out there, broad daylight.
So these things still happen.
And something, uh, some of the basic techniques and things that I've
learned and I try to share in the books and when I talk are things
that people just don't think about.
But when you share it with them, they go, oh, I didn't think about that.
That's interesting.
I, I, I'll give you a typical example.
I always think about security challenge questions, right?
What Curtis, what high school did you attend?
That might be one of your, your answers might be blah, blah, blah, high school.
And I always say don't answer it honestly.
There you get a pass, you can answer it dishonestly and
use a unique password there.
And it could be password 1, 2, 3 is actually a hundred times
more secure than putting the actual high school that you have.
'cause anybody can go on Google and search and see what high
school that Curtis attended, but nobody's gonna put in password.
1, 2, 3, there.
So like even the most basic common sense, almost stupid things that
you could do, help people back up and say, oh yeah, wait a minute.
I don't have to be honest.
I can just create a single password that only I know in my head that I'll
remember forever and use it there.
Problem solved.
Wow, that's great.
Sounds too good to be true, but it worked.
I did those things.
W. Curtis Preston: You know, when you were, when you were talking earlier,
um, you know, I was, you know, thinking about that we, that we should
value, we should value people who've, um, had bad things happen to them.
Right.
That, that, that perhaps I, 'cause you know, as we're talking, I, I never know
the way a particular podcast is gonna go.
I, I, I think this is.
This is the purpose of this particular episode is to get,
is to encourage people to share.
And, uh, you know, I think that we, we, um, uh, we value a little bit too
much, you know, our little pride and our little whatever, and we think that
that sharing is gonna get us in trouble.
Uh, and I will say that if sharing a, a, a mistake gets you fired.
Uh, maybe you didn't need to be working at that company anyway.
That, that's one idea.
But, but I was, I found myself, and this is gonna sound really
weird, no matter how many times I explain it, but I found myself
thinking about Platoon, the movie I.
Um, and so my question is, who do you want to be in battle with?
Do you wanna be in battle with Willem Defoe, this like battle
hardened guy, although he turns out to be a bad guy, I think in
the later, so we'll set that aside.
But the battle hardened guy who's been shot at 4,000 times,
or the brand new officer.
Just outta college, right?
The officer's, you know, super smart, super educated.
He's been trained on all the ways that battle works, but
he's never been shot at, right?
Um, we use the term he's never, he's, he's never fired in anger, right?
Um, you know, I think that the person who has been around a while,
um, and has, has made mistakes because honestly, if you're not.
If you're not making any mistakes, you're probably not, you're not innovating, uh,
would definitely, I would say you're not innovating and, um, And if you're, if you
say you've never missed, if you say you've
never made a mistake, you're, yeah.
So I, I liked, I really liked that idea that you, um, You know that
you, that you were saying that, let's go to the person for advice
who's actually been through things.
I like that a lot.
Can you think of any other ways that we can encourage those who,
uh, both the company, right?
So we're multiple levels here.
We want to encourage the company to understand that sharing.
Well, let, actually I have a thought, I'm gonna answer my own question.
Scott Schober: sure.
W. Curtis Preston: In.
So I'm, my brain's just going a million miles.
'cause I really like this discussion point and that is that we live in a world where
we're almost, we, we become immune to the daily hacks that we see on the news,
Scott Schober: Mm-hmm.
W. Curtis Preston: We see 'em all the time.
We're like, oh, we got, you know, Yeah.
The, the, you know, the cyber of the day, right.
Um, and so we, we don't, we don't think too much about it.
Um, and so I think too many times the companies, they just try to, you know,
like you, when back when you talked about your thing, you know, maybe they
try to stay under the radar and they don't want to get that, they do not want
to get that call from the ap, right?
Um, but I'm thinking that, um, When I know when we Prasannayou and I, when
we've evaluated sort of incidents, the thing that we value, Is how the
company responds, how open they are, about how soon they announced it, how
open they were about what happened.
The fact that right now, like it just happened.
It just happened two hours ago.
We don't know squat, right?
All we know is that something happens.
Here's A U R L.
Follow this U R L.
This is my particular favorite way.
Here's A U R L.
You know, go to curtis preston.com/.
2023.
Right, and, and
Prasanna Malaiyandi: That website does not work for our listeners,
W. Curtis Preston: What's that?
Prasanna Malaiyandi: that website does not work for our listeners on
W. Curtis Preston: that, that website, they'll find out exactly.
Um, that was a, that was the equivalent of a five, five,
five phone number in the movies.
Um, and, and just follow that and just, you know, get, like, it's, it's one nice
way of saying leave us alone while we think, just go over there and don't,
don't call us 8,000 times everything we know, we will put there and then do that.
Right.
Follow up.
Uh, you know, a a along that, uh, the, the more you can share about
what happened, when it happened, how it happened, what lessons you learned
as a result, uh, I think it's better.
I think it's better both for everybody, obviously, but also for you.
I'm, I'm basically applying your, um, your statement about that.
You want to go to the battle hardened person, and I'm applying this to a company
that it's also good for the company.
What?
What happened?
Are you doing a bump up butt Prasanna?
Prasanna Malaiyandi: yes, I am doing a, but, but, but I think though I agree
with everything you say, Curtis, but then I also look at the flip side, which is
we're a very, lawsuit, happy country.
And I think corporations worry about how much information they can publish.
I agree that they need some amount of transparency and creating
the website and putting the links that people can go follow.
I a hundred percent agree with it.
I think there's that risk balance that corporations struggle with because like
Scott had mentioned, right, you do take a hit from a brand perspective, right?
You might open yourself up to lawsuits, right?
Or regulatory scrutiny or other aspects that once it's out
there, it becomes hard to undo.
I think the other thing to also mention is, There's also
the public perception, right?
Because when you publish something on a website, right, they assume, oh, this
is a hundred percent the truth versus when you're, I'm sure, Scott, you
could talk about this as well, right?
When you're doing a cyber investigation, right, you don't
always know like what it is really until you're sort of done, right?
Yes, you might have know some aspects along the way, but you may
not be a hundred percent confident the entire time because you're
working off of partial information.
Scott Schober: Yeah.
Yeah.
W. Curtis Preston: Yeah, I, I, um, I'll, I'll finish my comment.
That was so rudely interrupted by Prasanna.
So I agree.
I agree with what you're saying.
Prasanna, which is why any, uh, incident response plan has legal as
part of the response plan, right.
I'm not giving legal advice here.
I'm just giving sort of my opinion that the more you can share confidently, I
think you're better off as a company.
Yes, I understand the.
The legal thing, but I also know that unders sharing can also be
illegal, um, you know, liability.
So I don't know.
Um, I, I, I never actually came up with a question there, Scott, but
Scott Schober: I, I, I'll, I'll answer, I'll answer, the question even with,
though, with two more questions.
No, or two more statements.
Let me give you maybe a, a case scenario that's in my mind.
Think about Uber.
A couple years ago, got, uh, breached, uh, interesting how they handled it.
The president at the time, uh, they kind of covered it up.
They kind of muddied the waters a little bit.
Um, at one point they paid, I guess it was a ransom, but covered it as a
bug bounty, dishonest, uh, misleading to shareholders, so on and so forth.
I think they got their, their hands slapped a few times.
Their brand got hurt.
Um, they were struggling making money.
I think they still are to some extent.
So they kind of bumped along through different leadership and making mistake
after mistake after mistake, and were breached many times and again.
It's to the point they weren't really transparent about everything going on.
They kind of did this and Don don't get anybody upset 'cause the money's
coming in the front door and we need more investors and so on and so forth.
Um, contrast that with JP Morgan.
Uh, they had a major breach and now you're talking about at
the time, the largest financial institution headed by Jamie Diamond.
Um, they were transparent.
Hey, it, it was a third party access, didn't have multifactor
authentication in place.
We didn't do this, this, and this.
We made the mistakes.
We're sorry.
Here's what we're gonna do about it.
Oh, by the way, going forward, we're gonna commit a half a billion
dollars to improve our security.
So these things don't happen again.
Uh, which brand survived?
I think I think you could look at and say, wow, you know what?
JP Morgan Chase, their brand really thrived and continues to thrive.
Uber is still kind of a struggling rideshare company,
even though it's everywhere.
You don't believe everything you hear, you talk to the the drivers
and they're a little bit bitter.
You talk to the shareholders, they're bitter.
You talk to the employees, they're bitter.
So I think a lot of it has to do with how you run an organization and
when you deal with a cyber incident.
To your point, how do you respond?
It's gotta be a company wide and it's gotta come in a sense
from the top down as far as.
Hey guys, we screwed up.
Let's own it.
Let's inform everyone.
Let's take care of it so it doesn't happen again, and let's, let's follow through
this with our whole team and our employees and our shareholders and our customers.
So I think that's kind of important.
Being honesty, honest, and having integrity when there's a cyber
situation really makes a difference in the long run at the moment.
You probably look like an idiot in front of most people.
But in the long run, in hindsight, I think you look back and you say, you know what?
I'm glad I came clean.
I have a clean conscience.
I did it right, and it's not gonna happen again.
And that's, that's probably one of the most important lessons
I've learned is I'm paranoid.
I'm paranoid and to, to the stuff that you have expertise backing up data.
I'm always going around, we gotta get a backup of this.
And they're like, Scott, you backed this up last week.
I, I know, but just in case we changed the code, we updated the system.
Let's back it up.
I'll, I'll put it in the safe on a remote site.
And, but, but you start to think like a cyber thief.
Would you see the value in something and how easy it is to get it?
Because I've learned one thing.
Nothing's a hundred percent secure.
And if somebody wants something bad enough, they're
gonna find a way to get it.
So you just have to do everything you can to make it difficult for them
so they move on to the next target.
That's gonna be much easier.
That's all it's about.
It's a, there's a cat and mouse game, or a whack the mo game, or
whatever you want to call it, but that, that's oversimplifying it.
I know, but I, I think that's important to, to just kind
of think about those things.
If you're running a company or part of an organization, You have to weave
cybersecurity into the fabric of your organization so that you don't just do it
once a year and do a quick phishing test.
Pass.
We move on.
Let's get back to business guys.
That doesn't work.
Prasanna Malaiyandi: Yeah, I like that.
I think going back to Uber, I think recently their CISO had some, uh, legal.
Case proceedings against him and I think was found.
W. Curtis Preston: Because, because of that incident, right?
Prasanna Malaiyandi: Yeah.
Scott Schober: Yeah, yeah.
I avoid the legal side of things, but you're, you're absolutely right because
the, the implications of getting caught and misleading shareholders and the public
and covering it up or doing the bait and switch, it's not good for business
in the long run when you get caught.
And I think that was the mistake at the moment.
It seemed like, yay, this is a win.
Now we don't have to go through the pain of everybody else, but.
It caught up with them, unfortunately, and sometimes people make say a little
white lie and they get away with it, and then it leads to more things that they
get implicated on and and legal mess.
And the cost for legal things these days in this society is just astronomical and
it distracts you again from the course.
So sometimes the legal matter outweighs the actual cyber incident.
Prasanna Malaiyandi: Yeah,
Scott Schober: And, and that's often how cybersecurity works.
I found interestingly enough, they, if they can settle it quickly, and sometimes
that's what a lot of these ransomware pay payments are about, uh, cybersecurity, uh,
insurance and the legal team get there and they look at it and say, you know what?
Pay this many bitcoins quickly, make this problem go away so we don't have to
pay this much over the next six months.
So,
W. Curtis Preston: Yeah.
And Prasanna.
I I think, um, going back to what you said, the, so somewhere on the, on the,
on the, the, uh, the pendulum of don't say anything and make up stuff, right.
Somewhere in there is where we're I, I, I think I'm, you know, I'm, I'm.
Wow.
I don't know if I like that pendulum I just created, 'cause I, I wanna
be closer to the making up stuff.
Meaning I, I, I, I don't wanna
Prasanna Malaiyandi: sharing too much.
Scott Schober: Yeah.
Don't
overshare.
W. Curtis Preston: we need to be right in the middle.
Right?
We don't wanna not say anything and we, we definitely don't wanna make up stuff.
We can all agree.
And that's why Prasanna, that, that there was a part in your
answer where you talked about.
That sometimes you just don't know.
Well, if you don't know, don't say, right.
You will, you will get in the, in the heat of the, of the
event, you will get pressure.
What happened.
If you don't know what happened, you can say, we still don't know what happened.
Um, I, I guess, and, and
Prasanna Malaiyandi: Perfectly acceptable answer.
Yeah.
Scott Schober: Yeah.
Prasanna Malaiyandi: Yeah.
W. Curtis Preston: acceptable answer.
I don't know yet.
We are, you know, we are investigating and we will investigate until
we find out the root cause.
Um, yeah,
Scott Schober: think that's human nature too.
You as a human.
Another person.
It's okay to hear something, even if it's a little bit disappointing.
I, I think about it directly with we're, we're late on a lot of
our deliveries to our customers.
Here I am, uh, going on the, on the record.
I'm apologizing here.
Please forgive us.
But I think communicating that with a customer is imperative.
Hey, we're late on delivery.
We told you it would take this long.
We were wrong.
There are reasons, and we don't want to stand here and reiterate all the reasons,
but here's a couple of the reasons why.
We're sorry, but here's what we're gonna do about it.
Whether it's you give him something or free chipping or whatever,
or or more importantly, when we do have the date, it will ship.
I will get back to you, I will send you the tracking number and the most important
thing is the follow through on it.
And it's funny, somebody that hates you or is very upset with you, 'cause they're
frustrated, they can't do their job, and when you give 'em the tracking number
and the follow through, they thank you.
They say Wow.
You got back to me.
You must care about me as a customer.
Thank you.
And to me, I've learned that's really important.
It doesn't matter what role you are in the company, and I'll often get that.
Sometimes I'll even get a, a thi.
Aren't you the c e o of the company?
Why are you saying sorry to me that you guys were late?
It's probably not your fault.
I said, no, it's all of our fault.
It's the company's fault, so I am sorry.
The company's sorry.
And just being able to express that I think helps them see you're real, your
honest, you're transparent, and you want what's best for them no matter what it is.
And I think that's important to develop relationships, business relationships.
W. Curtis Preston: Yeah, I like that.
And by the way, I, uh, the word legal came up.
I thought I forgot to throw out our usual disclaimer, uh, that, um, that this is an
independent podcast and you're hearing, uh, opinions of people and not companies.
And, uh, if you'd like to, Join the conversation I'd,
I'd love to hear from you.
W Curtis Preston at gmail, or at WC preston on Twitter or linkedin.com/in/mr.
Backup.
Uh, and we, you know, we'll get you, you know, we love to hear from people
and, um, so, and, and also, please rate us, uh, go to your favorite pod
catcher and give us all the stars.
And send us comments.
We'd love to see comments as well.
Uh, Scott, I, I want to thank you for, for coming on.
Uh, it's been a great, like I said, I never know exactly where a given
recording is gonna go, but I really like the, you know, our encouraging
people to share and, and how to share.
Scott Schober: Yeah.
Yeah.
No, thank you guys for taking the time and having me on as a guest.
I, I was, uh, approached by somebody before coming on and they said, you're
going on a podcast and what's it about?
I said, well, he is Mr.
Backup, this and that.
Well, whatcha gonna talk about?
I said, I have no idea, but probably something related to cybersecurity.
And if so, it'll be fun.
And then I said, that's all I need to know.
That was a great, great conversation.
That's what's important.
Thank you guys.
W. Curtis Preston: Absolutely.
And Prasanna, you know, thanks for interrupting me.
That was a,
that was a good point.
That was a good point you
Prasanna Malaiyandi: it.
It's okay though, Curtis, in post-processing.
You can just cut it all out and then you can just continue the conversation.
You'll be fine.
W. Curtis Preston: I'll, I'll, I, I might cut it to make it look like you really
stomped on my, on what I was saying.
You know, the, the, the ultimate
Prasanna Malaiyandi: It was nice chatting.
Exactly.
It was nice to chat with you, Scott.
Thanks for sharing.
Oh,
Scott Schober: Thank you guys.
Stay safe, everyone.
W. Curtis Preston: And, uh, thanks to our listeners and remember to
subscribe so that you can restore it all
you could restore it.
Rescue me.