Security Confidential S1 E2 Stefan Ludlow

Podcast Host: Welcome back to the Dark Rhino Security podcast. In today’s episode, Chief Sales Strategy Officer Manoj Tandon will be interviewing Stefan Ludlow, director of technologies at wealth management firm Cerity Partners.

Manoj Tandon: Today we are fortunate enough to be joined by Stefan Ludlow, a gentleman that I have known for quite a bit of time, and he’s been gracious enough to join us on today’s podcast. Stefan, welcome. How are you?

Stefan Ludlow: Thank you very much. I’m doing quite well. It’s a chilly day here in New York City.

Manoj Tandon: Well, I’m actually in Pittsburgh today, our studio where we are casting this in Dublin. I can tell you we had snow in both locations. As long as you’re not getting snow and not having to clear off your car, you’re doing better than we are.

Stefan Ludlow: Oh, hears that.

Manoj Tandon: So, one of the things, Stefan, in this whole world of cybersecurity, we always talk about this concept that people have to take responsibility. There’s an element of personal responsibility. And I think it’s going to be nice to get some of your views, especially given your background. You can give us a little bit about some of the things you’ve done in the cybersecurity world and just introduce yourself to our listeners who may not know you right now.

Stefan Ludlow: Sure. Absolutely. So I’m the director of technology at Cerity Partners. We’re a wealth management firm in New York City and across the nation. And my role is specifically responsible for the technology stack that advisors who are part of our group can go out and work with their clients in a secure and safe fashion. A lot of my work is involved with securing our systems, making sure that our client information is kept safe, and that’s been my main priority through my career in wealth management services. Prior to that, I was director of technology at GM Advisory Group, and then I was at Dynasty Financial Partners prior to that. And in each role, a large part of the responsibility has been working with the firm to make sure that our client information is safe and secure. And so I’ve got a lot of experience seeing what data is out there, not only within firms like us in our systems, but with firms that we work with—the Fidelity, Pershing, and Schwabs of the world, and the banking services out there. So in the financial services space, I’ve worked for some time keeping an eye on that data and making sure that everything is where it should be and it isn’t where it shouldn’t be.

Manoj Tandon: You know, Stefan, the financial industry has been the leader in cybersecurity in the non-defense, non-government space, if you will. And the data that you are protecting is obviously highly, highly sensitive. We know that in the financial sector, you folks put a great deal of thought and effort into the cybersecurity and cyber well-being of your organizations and the partners that you do business with. But what about your clients? Do they have the same vision of cybersecurity? Are they aware, or do they believe that cybersecurity means having McAfee or Symantec antivirus and then they’re done?

Stefan Ludlow: Well, it tremendously varies. We work in the ultra-high-net-worth space, so our clients range from folks who have been executives at companies where cybersecurity has been very much forward-facing. In those instances, everyone is perfectly aware and keeps an eye on these things. I’ve seen presentations done for clients where that is one of their major concerns: cybersecurity. Are their assets safe? Is their information safe? But that’s definitely not universal. We deal with a demographic that has not always had to personally worry about keeping their information safe. But I think the landscape is changing and has changed. People who didn’t previously interact with technology on a day-to-day basis are every single day literally carrying around a device with all of their personal information on their cell phones. Even if they’re not tech-forward in what they do on a day-in and day-out basis, everyone now, regardless of being ultra-high-net-worth or just someone doing your job, is interacting with technology and putting information into technology constantly.

So we see experience varies, but we try and approach cybersecurity from that lowest common denominator. It’s not especially onerous to make yourself secure, but it does take some cognizance that not everybody has.

Manoj Tandon: This leads to an observation: in your experience, do you see folks looking at cybersecurity as a technology problem or as a problem that is more personal in nature and dependent upon their own actions as much as it is just on the technology? Is there any cognizance or personal responsibility in addressing this issue?

Stefan Ludlow: In speaking with people who have been victims of a cybersecurity breach, it’s almost universal that there is an element of that personal responsibility. If anyone listening to this has either been compromised on their end or have had their parents compromised or someone they know, they know it’s not easy to recover from. It is an intimately personal and challenging thing to recover from being a victim of a cybersecurity breach or from identity theft. So once you’ve been breached, you understand very much that there’s a huge element of personal responsibility there.

For people who haven’t yet been breached, though, there can often be a different mindset because unless you’ve been breached and unless you have emails going out from your personal inbox to all your friends and family asking them to click a malicious link, or unless you’ve seen some sort of financial loss, you’re not thinking about cybersecurity on a day-in and day-out basis. It’s not everyone’s personal expertise. As you’re using Facebook, as you’re logging into different things, it’s a technology issue for people who have not yet been a victim of it; they are trusting vendors like Facebook, Google, and others to keep their information safe.

While that is one way to approach it, it’s also a very good way to become a victim yourself. So I want to encourage people to take that element of personal responsibility before a breach happens, make yourself safe, and have some share in securing yourself beforehand.

Manoj Tandon: We often in our own firm preach that before you get to a discussion on technological controls with prevention, detection, and response, you really need to look at your policies and your procedures. In a company that applies, but at an individual level, that’s completely akin to personal responsibility. On the corporate level, we’ve got checklists, sign-offs, cybersecurity policies, and a depth of expertise. Anything we put data into has to go through a fine-grain process until we’re confident using it. That should be the same on the personal side.

And for those of our listeners who may not be aware, there was a staggering statistic that I read: for high-net-worth individuals worth more than $1 million, they have a 90% probability of getting hit with a $75,000 loss by the year 2020. That’s not insignificant. I guess that’s a risk that one should not ignore because 75 grand is just the monetary loss. There’s the loss to reputation and all the other losses that go along with potential identity theft.

Stefan Ludlow: I absolutely agree with that. The vulnerability that’s out there right now if you’re a high-net-worth individual is everyone is targeting you. If you look at who is the ideal person to breach, it is a high-net-worth individual or ultra-high-net-worth individual. Your name is out there. Your family’s names are out there. And oftentimes it’s an open environment of who is wealthy and who could be vulnerable.

Those types of individuals are oftentimes hit with what we call phishing attacks. You’ll get an email. It’ll look like it’s from a friend or family, or it’ll look like a service that you use. I’ve seen them look like, “Hey, you have a FedEx package. Click here to see the tracking link,” or “Click here to make sure that Facebook is linked to Instagram.” There’s all sorts of different ways, and they’re very, very sophisticated.

But if your name is out there, you are absolutely a target. That’s why the statistic for those high-net-worth individuals is almost 90%, because you’re getting hit constantly and it only takes one slip-up to cause a problem. Now for those individuals, there’s folks who work with them, like myself and the partners, who have processes and procedures in place to prevent an asset loss if that individual is breached. For example, in the case of wire transfers, it’s absolutely critical for there to be a callback to the individual who is having that wire transfer done. You have requested these funds, and you are confirming not just via email, but also getting a verbal confirmation.

Manoj Tandon: So if you are fortunate enough to be a client of yours at Cerity Partners, then you get the benefit of having that extra set of eyes. But if you are a regular person out there, what should I be doing? Phishing is something I’ve seen. Those emails even come into my Gmail inbox and it’s, “Click on this and you’ll win something,” or “Someone has attacked your Facebook page, change your password.” It was completely bogus, right?

Stefan Ludlow: No, absolutely. And you don’t need to be a high-net-worth individual to protect yourself. You don’t always need to go out and hire someone to provide that service for you, but if you can afford it, definitely do. It’s not everyone’s core area of expertise.

But there are things that everyone should be doing. Enabling two-factor authentication is one of the easiest ways to prevent breaches. I’ll reiterate that two-factor authentication is, let’s say I log into my bank from a computer that I’ve not logged into previously. It’s going to text me a code to my phone number, which is a second factor. If someone were to breach my account, they would not only have to have my login information to my bank, but they would also have to have my phone or access to my phone text messages to breach my account.

You can do that with Facebook, you can do that with Google, you can do that with Instagram. It’s that philosophy: do what you do with your most secure information with all your information, which is absolutely critical.

There’s a few other things you can do as well, such as using a password manager and protecting things like your credit and financial information in case of a breach.

Manoj Tandon: You bring up passwords. I was recently at a security conference in Washington DC, and they had an interview there with three ex-hackers. Looking from their point of view, they cited the number one method that they’d like to use to compromise an individual’s accounts was passwords, because once they figured out one, nobody changes them across all the systems that they access and they keep the same password, right?

Stefan Ludlow: Yeah, absolutely. In addition to two-factor authentication on everyone’s accounts, it’s also important to, at least in my mind—and there are debates in cybersecurity spaces, like NIST guidelines and others—should you have a super complex password? Should you have a password that’s easy to remember but hard for a computer to guess? None of this guidance is universal, which makes some of this complicated. When you see an article on MSNBC or an article on CNN or Wired.com, there may be conflicting advice because there are conflicting views out there.

But that said, in my personal opinion and my professional experience, I’d like to treat passwords as one-time use: one password per application. In addition to two-factor authentication, you can use a password manager. That’s LastPass, OneLogin; there’s a handful of others. Chrome has it to a certain extent by default. Apple has it on their iPhones where it can generate passwords.

I personally like LastPass, where you’re not coming up with a password yourself for the applications that you access, but are rather generating a single password per application. As you say, hackers love when the password is the same from one application to another. If they get access to one, they don’t need access to your email to get access to other things. They’ll just start logging into Chase.com, Bank1.com, and Facebook.com with that email and password combination that they found for something else and hope they get lucky. Oftentimes they do.

Manoj Tandon: A huge number of times they do.

One of the pushbacks that I’ve gotten on using a password manager is that then I have to have it available to me always. If I’m on my computer, it’s relatively easy to do, but if I’m on my mobile device, it challenges me too much; it’s a pain. I actually had one gentleman from US Cyber Command who was on the other side of that debate. This was a discussion I was having with him regarding exactly this LastPass password manager topic. He said we would almost be better off having for our Facebook page ABC123 and then for Gmail ABC12345. That is a lot more secure than having one super strong password that goes across all of these things. Once that gets hacked, or they might not even hack the actual password, they might just get the hash. Once they have that, it doesn’t matter what the strength of the password was. It’s open season. Whereas if you even changed it a little bit across systems, you would be a lot more secure. That was an alternate point of view from somebody in our defense forces, and I thought it was interesting because it does contradict some of the other advice.

Stefan Ludlow: Absolutely. There is no one perfect solution to cybersecurity, and that is why I think it is such a shared responsibility. Going back to that original point, it’s not something you can set and forget. It is something that you have to be cognizant of. The rules of the road, so to speak, don’t really exist. There are guidelines, and they change over time. It is something that people need to be mindful of. What was best practice in 2011 is not best practice now. For example, it used to be that philosophy: have one super secure password for everything. But they find people don’t remember it and they write it down. They make it hard to guess for a person but easy to guess for a computer. A random string of lowercase letters and numbers is not the most difficult thing in the world.

Manoj Tandon: You’re absolutely right. In fact, there was a paper presented last year at the Columbus B-Sides on how to do password attacks, and it was absolutely remarkable at the level of sophistication and technology available to hackers by which they can guess strings and get lucky a significant percentage of the time.

Stefan Ludlow: Absolutely. It’s almost to the point now where it’s not a question of if you’ll be hacked. It’s going to happen. One of your accounts somewhere will be compromised. It’s how we have structured our digital lives that is really the difference between someone who, when one of their accounts gets compromised, their entire identity is stolen, versus someone where one of their accounts is breached, but because of things like two-factor authentication and different passwords across different applications, that breach is very, very limited in scope.

Manoj Tandon: Speaking of continuing down this path, Stefan, of these breaches, you talked about phishing being one avenue, and it seems to be a very popular avenue of people getting compromised. What about some other techniques? Any comments on connecting to open networks in your hotel room or at the airport, or to networks unknown to you that are open out there? Those all represent threat factors, if you will.

Stefan Ludlow: Absolutely. One of the most important things that companies like Google are doing is raising awareness of access in insecure environments. I’m thinking particularly of HTTPS encryption when you’re accessing a website. Google, in particular, if you’re accessing a site that doesn’t have HTTPS, will actually warn you about it. That’s one of the nice things: as technology gets more robust, the cybersecurity layer becomes more complex, but it’s nice that some folks out there are doing more to protect us.

That goes to exactly what you’re saying: accessing, say, your bank from, in my case, the subway platform in New York City on a wireless network that I haven’t the faintest clue if it’s secured properly. Things like that have improved over recent years to make access like that a little more secure. If you had asked me that question probably three years ago, I’d say, “Oh my goodness, don’t log into anything when you are on public Wi-Fi.” I do think that’s changed over the last couple of years, in particular with HTTPS. Now, I’m sure there would be people that disagree with me on that, particularly on the cybersecurity front, but I do think things have improved.

Manoj Tandon: Stefan, what are your thoughts at an individual level, whether you’re a high-net-worth individual or not, on employing a VPN service at all times when you’re connecting, at least for critical applications like banking, retirement accounts, or health records? Any advice on that?

Stefan Ludlow: I think that VPNs, in particular, can be a component of a high-quality digital hygiene policy. I do think, though, that often the complexity and the number of vendors out there has created a market where it’s a little difficult for the end consumer to go out and find a VPN and actually be secure using it.

That said, if you can take the time to do the research, understand how a VPN works, and find a good vendor, it’s absolutely something that should be part of your suite. If it’s not part of that cybersecurity suite that you have personally, I don’t think that it’s quite reached the level of recommendation like using a password manager. Now that said, for the corporate side and folks in those corporate environments, particularly like on our end or others, a VPN when accessing information remotely is absolutely essential. We have the resources to put those in place effectively. I would just argue that I’m not sure that everyone has those resources yet. We’ll see what happens in a couple of years. Three or four years ago, password managers weren’t as prominent as they are today. We may see the same on the VPN front.