Security Confidential S13 E2 Joseph Steinberg

Manoj Tandon (00:00.184)
Hello everyone, this is your host Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. Today we have a very special guest, an extremely talented human being who spent many decades in the cybersecurity field, Mr. Joseph Steinberg. Joseph is the author of Cybersecurity for Dummies. If you haven’t read it, go check it out. But he is the CEO of Secure My Social. When he’s not writing books and when he’s not writing, being CEO, he’s involved in so many things. You know, he has advised the US federal government, he has advised many businesses on topics and tech related issues with cybersecurity. He holds very advanced certifications in cybersecurity, CISSP, ISSAP, ISSMP and CSSLP. So…

Let’s just say that he is the man all things cyber, and we’re honored to have him here. Thank you, Joseph, for joining us. Appreciate it.

Joseph Steinberg (01:09.293)
Thank you for having me and thank you for that intro. I hope I’ve earned it.

Manoj Tandon (01:14.304)
Well, you have, and from what I understand, you’re one of a handful of people in the world that actually has those credentials, all those credentials.

Joseph Steinberg (01:25.19)
Yes, I mean, I’ve spent a lot of time in this field, so I’ve worked on things that go wide and things that go deep. I’ve worked on the architecture side, the management side. So, you know, over years you build different skill sets and hopefully today, you know, I can leverage all these different aspects in our conversation.

Manoj Tandon (01:44.544)
Oh, that’s fantastic. So Joseph, what is your origin story? So how did this begin for you?

Joseph Steinberg (01:53.538)
So I’ve always liked playing around with computers and trying to get them to do things that they weren’t intended to do. When there are restrictions made, how do those restrictions work? How do they prevent me from doing what I wanna do? Are there ways around them? Intellectual curiosity, can I adapt a machine that used to do X to do Y? Can I change its function? Can I get machines A, B, and C to work together even if they weren’t designed to work together?

so that I can get a one plus one plus one equals 100 kind of benefit. So when you play around with these kinds of things over time, you develop an understanding of how machines work and how you can get around certain controls or what types of controls should be put in place to prevent certain things from happening, whether intentionally or unintentionally. And that’s sort of how I got into this field. The rest is history.

Manoj Tandon (02:48.396)
So you were always in computer science from day one?

Joseph Steinberg (02:52.318)
i was always interested uh… you know as a little boy i wasn’t officially a computer scientist uh… but i was interested in computers and playing around with them and seeing if i could get them to do things that i wanted them to do even if they weren’t designed for

Manoj Tandon (02:57.27)
Eh.

Manoj Tandon (03:05.644)
So is there a story there? Did you break somebody’s systems at one point or another?

Joseph Steinberg (03:12.65)
I have no criminal record, never been caught doing anything illegal. The truth is I didn’t spend my time hacking other people’s systems. I was playing around with stuff that was in my possession, although I am of the generation and do know some of the people who did get caught doing various things early on in the history of cybercrime.

Manoj Tandon (03:32.512)
Yeah.

Manoj Tandon (03:37.056)
Yes.

Joseph Steinberg (03:38.598)
i’m sorry to put it so broadly but cybercrime in that case paid in most cases because the people became famous for and then built major careers around security uh… so uh… you know the early cases of cybercrime actually worked out well for those who uh… engaged in it but most of those were people who weren’t really interested in doing a lot of damage they were uh… exploring but may have stolen money or may have stolen services etcetera uh… but that was the early era now of course cybercrime is a totally different

a situation organized crime, you know, spying from foreign governments, uh, you know, the, the attackers are much more sophisticated, uh, and the consequences are much greater. You know, we were, I’m talking about an era. If you think back to the 1980s and early nineties, where almost nothing was connected to the internet. So it wasn’t about hacking, you know, production systems in a bank. It was, uh, fooling around with, you know, cracking a game, protect, you know, protection software, what have you.

Manoj Tandon (04:20.686)
Yeah.

Manoj Tandon (04:35.076)
Having taken such a deep dive into a host of different systems, is there something about system design or the QA process in software that surprises you or to this day that it may not have been addressed and should have been addressed a long time ago?

Joseph Steinberg (04:53.174)
well preface my answer by saying that at this point nothing surprises me uh… because one thing that you learn over time in the cyber security field is that there’s a mistake that humans could potentially make the gonna make it at some point uh… we make mistakes were imperfect so at this point nothing surprises me that the i’m sorry cuz you know i’m a human too but we can be honest with ourselves

Manoj Tandon (04:57.597)
Okay.

Manoj Tandon (05:09.124)
Mm-hmm.

Joseph Steinberg (05:20.354)
The level of stupidity that can exist in a human’s mind is pretty bad. And human mistakes can be pretty bad. So if we say that human stupidity knows no bounds, that’s probably quite accurate. So nothing surprises me. That said, I think we are making many of the same kinds of errors we were making 20 and 25 years ago. And for some reason, we still haven’t figured out that the approaches that

Manoj Tandon (05:20.362)
Yes.

Manoj Tandon (05:46.574)
I’m sorry.

Joseph Steinberg (05:49.022)
we’ve taken don’t work. You know, we keep trying the same thing over and over and it doesn’t work as a society. I’ve seen so much bad security advice been spoken about on major television programs throughout major media for so many years. And it’s presented as if it’s good advice. And it’s just the lack of understanding of how humans actually work, I think has played a big role in that.

So you know, you’re starting to see a change, but it used to be you’d see security quote-unquote experts telling you, you know change all your passwords on a frequent basis and that’s actually terrible advice Because if you’re actually controlling the password changes, that means you’re the one who’s managing the passwords and there’s no way the human mind can remember The number of passwords that we need to use on a daily basis if you’re changing them frequently So it almost guarantees again, we’re talking about someone who’s managing their own password

Manoj Tandon (06:23.965)
Yep. Okay.

Joseph Steinberg (06:46.182)
It almost guarantees that they’re going to reuse passwords or use terribly weak passwords. And you were probably better off with a strong password that you didn’t change for many years. So, you know, there’s a lot of that kind of stuff that goes on in our field where the theory is that one thing is better, but when you deal with humans, the reality is quite different.

Manoj Tandon (07:04.724)
So, you know, give me a top three. You gave one there, and that’s an interesting one, where people are managing their own passwords, and that is ubiquitous. I’ll say to this day, I guarantee you most people are managing their own passwords. So, some other pieces of gems that you’ve seen out there propagated as good advice, but genuinely have not been good advice.

Joseph Steinberg (07:20.129)
Oh yeah.

Joseph Steinberg (07:31.114)
So one of the other, let’s call it practices that I’ve seen that is less than ideal, to put it mildly, is you have some entities that keep their backups connected to their main production systems in order to be able to do frequent backups. So the backups will occur across a network or even in some cases, you know, USB drives plugged into equipment.

And that is true, that allows for real-time backup, which has its advantages, right? You create a new file, it’s immediately backed up. But some of those organizations don’t have disconnected media as well. And what that means is if they get hit with a ransomware attack, the backups are likely to get corrupted along with the primaries. If I said that I have seen this rarely, I’d be lying. I’ve seen it more than rarely. And you know, it may be getting better now, but these are the kinds of things where

Manoj Tandon (08:12.132)
corrupted.

Joseph Steinberg (08:25.814)
You know, people were given the advice, you know, keep a backup connected in all time so you can back up in real time so you don’t lose your data. And, you know, if your computer goes kaput, you know, you lose 10 minutes of work, not days or weeks. But the risks that we need to mitigate against today are different, right? It’s true. Computer could go kaput, but the reality is that the ransomware threat is probably a lot bigger than the fact that suddenly you’re, you know, solid state.

Manoj Tandon (08:32.722)
Right.

Joseph Steinberg (08:54.35)
and your computer is gonna completely fail, number one. And number two, you can have mechanisms to back that up that aren’t attached to it constantly. You can back it up at the end of the day and disconnect. And my preference, of course, is to have some connected storage for backup and some not. But again, I’ve seen it many times where you find out after a ransomware attack, oh yeah, we have many backups. Well, where are they? Oh, they’re on the network. Well, how are they connected? Oh, they’re connected to every machine. And you’re like, uh-oh.

Manoj Tandon (09:21.737)
Also, they’ve been encrypted. And you know, one of the things that’s interesting there, if you look at ransomware actors, bad actors have gotten really wise with this too, right? They don’t want dwell times to go insane like they used to be. You know, many years ago, it was like 200 plus days of dwelling. Now speed is king. You know, these guys want in, they want to encrypt and…

Get their money.

Joseph Steinberg (09:52.45)
Sometimes we joke that yeah, because they want to make sure that they get their money before somebody else’s ransomware hits the machine and then crypts what they did and they can’t access it. But that’s, you know, maybe being a little facetious. You know, there’s another thing going on with ransomware, which is that it’s much better targeted now. So if in the old days, the good old days, we could call it, which isn’t that many years ago, if ransomware got into a computer and immediately.

Manoj Tandon (10:01.586)
Hahaha.

Joseph Steinberg (10:19.926)
would trigger on the first machine or whatever. And then as you said, they started having delays where they look for better stuff, because if you trigger on a machine where the owner doesn’t really care if the data is lost, they’ll just wipe the machine, and now they know there’s a ransomware problem, so they address it, they disconnect the machine, they address it before it infects the crown jewels of the infrastructure. So they created things that would look for more important data before triggering, and that was actually quite effective. But as you said, now they can do it faster.

So things, but it’s faster. The point is they can get to, right. They can get to things faster. They can find the crown jewels faster. There’s better intelligence in how to do that. So the damage is much greater. And they also very frequently today profile the target. So they know what they can ask for, what a user is likely to pay and what a user is likely to be unable to pay. So if they hit a small business, they’re not asking for a $5 million.

Manoj Tandon (10:49.368)
Symmetrical encryption, right? I mean, that’s, it’s much faster.

Joseph Steinberg (11:17.762)
uh… you know reds because they know the business can’t pay them that’s for number that the business is likely to pay yet if they are larger company they may ask for that larger some so that there’s a lot of intelligence that’s gone into ransomware uh… in recent years again these are pros these are not uh… you know people just looking around and you know fooling around and trying to figure out technology you know for curious the reasons of being curious this is professional criminals

Manoj Tandon (11:44.592)
That’s two. Give me one last one. And then I got so many more questions to ask you about this.

Joseph Steinberg (11:51.85)
I wish there was only one other stupid thing. But Post-It notes with passwords on them in, I’m not finished yet, in areas where people go on television. I’m dead serious. It’s one thing to have a Post-It on the back wall of your office with the password to something. It’s another thing to be interviewed on live television with that Post-It behind you.

Manoj Tandon (11:53.964)
Well, you pick a favorite, what comes to your mind? Oh man.

Manoj Tandon (12:05.601)
What?

Joseph Steinberg (12:19.39)
the wall visible to everybody watching and I’ve seen that happen more than once So I would say that Reaches the level as I said that if you hadn’t seen it you wouldn’t believe it But once you’ve seen it once nothing is surprising anymore

Manoj Tandon (12:36.872)
I will have to look for that. Quite honestly, this is the first time someone’s brought that one up. I’ll have to look out for that on live TV and see if people, I’m sure, now that you bring it up, it’s probably, again, you said something earlier, it’s about how humans function and the lack of understanding of that. And that’s something, there’s a deep topic there, and we’ll touch on that in a minute, because I think that…

Joseph Steinberg (12:44.436)
Oh yeah.

Manoj Tandon (13:02.728)
leads to a whole bunch of rabbit holes in our world, in this industry. But, you know, looking at cybersecurity, one of the things that we’ve seen is that, you know, you see the legislators and policymakers wanting to try and make an appearance of doing something about it. And one of the suggestions has been to hold the software developers themselves accountable for the breaches. What…

What’s your thoughts on? Do you think that’ll make a difference? What are your thoughts on?

Joseph Steinberg (13:36.974)
Well, I haven’t seen us hold our legislators accountable for the effects of their bad legislation, which would be probably a much more beneficial thing to society than what they’ve been proposing. We have a few problems when it comes to legislation and cybersecurity. The first thing is that legislation in this area is almost always reactive. So something happens, we see there’s a problem, then legislators try to address it.

Manoj Tandon (13:49.38)
Okay.

Manoj Tandon (14:01.257)
Yes.

Joseph Steinberg (14:06.766)
And since this is a fast moving target, cybersecurity threats change, the actors change, the theaters change, the mechanisms change so fast. And our legislative system is not designed to deal with things quickly. Frequently by the time anything gets done, it’s either useless or counterproductive. The other problem that we have, and by the way, that’s by design, right? In the US,

legislative system, as opposed to most Western democracies, for example, we have a bicameral structure. We have the House and the Senate, plus the President, and by doing that, you can have different parties in control, which causes legislation to have to be more pushed towards the center, let’s call it. In order to get something passed, you’re going to have to have the agreement in many cases of people from both parties.

Manoj Tandon (14:56.942)
Okay

Joseph Steinberg (15:02.902)
that slows down the process. It’s intended to ensure that we don’t pass bad legislation. If you have a single body legislature and your prime minister is the majority party leader, so when the majority party gets elected, they have a lot more power than anybody, individual election winner in the United States. So it’s designed to make the laws better in the big picture, but it slows down the process. There’s a lot more negotiation. That works well for a lot of things. It does not work well for cybersecurity.

Manoj Tandon (15:18.688)
Yeah.

Joseph Steinberg (15:32.986)
one issue. The second problem is that if you look at the demographics of our legislative bodies, especially the US Senate for example, there are a significant number of people who don’t really have a great understanding of technology as it exists today. I remember during the conversations about a decade ago about Hillary Clinton’s emails for example, there were senators who admitted they don’t use email, right?

So it’s very hard to regulate things if you don’t have a clue what you’re talking about and you have no experience with it. And again, because technology changes rapidly, it’s very hard for people who are behind the times and our legislators almost always are gonna be behind the times to really understand what needs to be done and what should not be done. And frequently this leads to…

legislators using their experience in other areas as a basis for making legislation, and these things tend not to work and to be counterproductive. So I’ll give you an example. Right now, for example, there’s legislation pending in a bunch of different places related to forcing providers of adult content to do age verification online, which at first glance sounds like it’s very sensible. But the way that…

Manoj Tandon (16:39.64)
Please.

Manoj Tandon (16:55.584)
Yeah, Virginia is leading this one, right? Virginia implemented this, I think.

Joseph Steinberg (16:59.494)
There are some states here, there was stuff in Europe and Australia looked into it, but the Australians were ahead of us and one of the things they found is that A, it doesn’t work, and B, in many cases it can even be counterproductive. It creates privacy problems and security problems for the legitimate users who are using it. But the reason that it was chosen to pursue this is when we sell liquor, we require ID. When you go into a movie that’s rated R, we check it.

But that’s a very different scenario, right? That’s where someone’s there in person. You can see that it’s a person presenting the ID. You can see that it’s a real ID. You can see a lot more about it. You can’t use a VPN to pretend that you’re, you know, halfway around the world accessing something and not subject to the jurisdiction when you’re going to buy liquor, right? It has to be delivered in person. So they’ve taken a model that worked in the physical world and tried to apply it in the technology world without really understanding.

Manoj Tandon (17:48.482)
Right.

Joseph Steinberg (17:57.482)
the differences. And one of the reasons I worry about that, for example, is I think it can be counterproductive, right? If you announce to parents, hey, we’ve put in this great law that’s gonna control content on the internet so your kids will be safe. If that law doesn’t work, you’ve probably created a situation where fewer parents are actually gonna filter or do what they should be doing to protect their kids. And you could have a situation where more kids rather than fewer kids.

are getting access to things they shouldn’t have access to and you’re creating a security and privacy problem for the people who are legitimately accessing the stuff, nevermind a potential national security problem, if somebody hacked the data and then found out, for example, that some politician is, you know, looking at certain things online that would cause a major scandal, right? You could have blackmail and things of that nature. Not that any of our politicians would do that, but of course not.

Manoj Tandon (18:46.809)
Of course not.

Joseph Steinberg (18:50.346)
But remember, I’m from the New York area and we’ve had, you know, our Anthony Weiner scandals and that already. So you know, the point is that sometimes there’s, I’m sorry, Elliot Spitzer also with a little bit of a different kind of scandal, but yes, you know, and I’m sure these are not the only two in history, right? So the point is that sometimes you have well-intentioned laws, but the legislators don’t understand

Manoj Tandon (18:55.996)
Oh.

Manoj Tandon (18:59.412)
We are attorney general. Elliot, your former attorney generals, Elliot Smith.

Manoj Tandon (19:12.605)
I’m sure, right?

Joseph Steinberg (19:19.81)
the way that technology functions in the real world. Even sometimes to understand the consequences, New Jersey over a decade ago passed a law that would have prohibited all firearm sales in the state other than smart guns, once smart guns, meaning guns that could identify that the person pulling the trigger was the authorized party, would be available. Again, it sounds like a really great thing, right? We’re gonna prevent kids from picking up a gun and shooting it if they’re not the authorized user.

Manoj Tandon (19:45.176)
Right.

Joseph Steinberg (19:49.494)
But the only thing that law effectively caused was that all the research into smart guns stopped because none of the gun manufacturers who would be the ones who would typically invest in something like this wanted to make all their other products illegal. So again, it’s not understanding the way that the real world works. That law was ultimately changed. It took about a decade to do that. And now you have research resuming related to smart guns and you have products coming out that may save lives. So again, it’s about the legislators not understanding.

the real world implications of what they’re doing, trying to do something positive that ends up being negative. And I think those are two examples. And so when you talk about legislation, I always worry because my experience tells me that frequently the legislation actually is harmful, not just not beneficial, but actually harmful when legislators try to step in and act in areas that they really don’t understand.

Manoj Tandon (20:47.212)
So Joseph, you’ve advised the US federal government. Do they listen? Are they listening to your advice?

Joseph Steinberg (20:56.234)
So the parties who I have worked with certainly do. I think there are very big differences between Professionals and people in the Let’s say Department of Defense and Law enforcement and various other aspects of government. There’s also big differences in between various divisions of the federal government and state and local government not just in terms of knowledge, but also in terms of budgets

in terms of where they stand today. So at the same time that the federal government was ripping out certain Chinese products and making it against the law to use certain Chinese technological products in networks within certain parts of the federal government, there were states buying those things. Okay, so let’s understand the federal government is saying it’s a national security risk to use this particular kind of network switch, and you must get rid of anything you have because it’s a problem. And at the same time, states

are investing money and buying more of them. Okay, that’s where we stand today in terms of, you know, so if you see things like that, as I said.

Manoj Tandon (22:02.712)
That is, yeah, that’s third party supply chain risk if there ever was one. I mean, you… Yeah.

Joseph Steinberg (22:11.026)
Again, but it’s reality. If you made this up, nobody would believe it. But it’s reality and we’ve seen it and, you know, it’s, that’s part of the problem. You know, when you have a decentralized government, which is essentially what we have, right? We have federal and we’ve got different agencies there and different departments. And then you’ve got the states and the local and, you know, county governments in New Jersey, we’ve got, you know, hundreds of municipal governments. You’ve got boards of ed with their own budget.

It’s very hard to control how things work. And even if theoretically there are certain policies in place, they may or may not be implemented the same way in the same different departments. I mean, even just think about sewage processing. If sewage processing got knocked offline, the number of people who would get sick would be astronomical. Infectious diseases.

Manoj Tandon (22:59.612)
infectious diseases, right? I mean, that’s, we saw, I mean, Tom, who was it? A Ted Koppel, I think, wrote about it in his book, Lights Out, you know, that’s one of the.

Joseph Steinberg (23:09.678)
It’s one of the biggest risks of a cyber attack is taking out the sewage processing, right? But if you try to make a list of all the systems used in the US for sewage processing, it’s impossible because it’s done at a local level in many cases and it’s not overseen with this, you know, any single entity or any single process, you know, when it comes to cybersecurity. And, you know, it’s not that long ago that there were machines hacked

Manoj Tandon (23:11.278)
You’re right.

Joseph Steinberg (23:38.678)
sewage processing plants in the US and it turned out they were running like 20 year old software. You know, that’s just the reality that we face. I’m not saying it’s a bad system that we have. Obviously, it’s worked very well. We’ve produced, you know, the greatest economy of all time, the greatest innovations of all time. But we need to be aware as the world changes that there may be certain things we need to adapt to if we want to prevent certain kinds of problems from becoming, you know, changing from little mole hills into big mountains.

Manoj Tandon (24:08.48)
You know, what you’ve described is so true, which leads to a very basic question, is that is cybersecurity really relevant? Are people just accepting that the inevitable may happen and we’ve done the best that we could, and that’s about all we can do.

Joseph Steinberg (24:30.85)
I’ll address that two ways. Every person on this planet is going to die, but that doesn’t mean we don’t take precautions to try to increase the length of our life and the quality of our lives. It’s the same thing. There may be breaches, but the damage that happens from those breaches and the frequency of those breaches is highly dependent on how we behave before.

Manoj Tandon (24:39.169)
Yes.

Sure.

Joseph Steinberg (25:00.098)
can determine whether the consequences of a breach are, you know, horrific or trivial and forgotten shortly thereafter. So, you know, there is a lot we can do. That’s number one. Number two, there is definitely fatigue. I blame a lot of it on people in my field who are crying wolf for lack of better terminology going on, you know, TV and radio interviews or in the press, you know, written press. And every time there’s a breach saying, change all your passwords.

and this has been going on for decades already. If it’s, you don’t tell people change all your passwords or spend a lot of time doing X after a breach that’s not likely to happen, or not likely to affect them, right? If the odds that they’re gonna get hit by lightning are higher than the odds that they’re gonna actually suffer damage from a breach, don’t let them waste brain power on it. Because what ends up happening is whoever does spend their time dealing with it and changes the passwords, find out that none of their friends did and nothing happened to their friends.

So the next time when there is a significant breach that could affect them, they don’t listen to you. So don’t listen to the advisor. So my feeling is, there’s a lot of alarmist attitude in my field, which is a problem. It’s gotten better in recent years, but it used to be like every breach, you’d see some talking head talking about changing all your passwords. No, no, most breaches you don’t need to do anything and they’ll have no effect on you. And the ones that do in many cases, there’s nothing you’re gonna do that’s gonna make a difference, right? If somebody stole.

Manoj Tandon (26:15.264)
Right.

Joseph Steinberg (26:26.838)
your social security number for the 17th time, it’s probably not gonna have much of a difference in the fact that it was stolen the 16th time. So just make sure you’re not using that in a way that was gonna be potentially damaging after, if it wasn’t damaging after the 16th, it won’t be after the 17th, in terms of your practices. There’s not much you’re gonna be able to change.

Manoj Tandon (26:29.781)
Yeah.

Manoj Tandon (26:33.256)
They try. Yeah.

Manoj Tandon (26:49.356)
That’s very well said and very well put, which brings us to really, cybersecurity is a people problem, but there is in our industry an absolute focus on the tech and the people side of it seems to not get an equal or greater level of importance. If you can modify behaviors,

Joseph Steinberg (26:53.847)
Thank you.

Manoj Tandon (27:18.912)
you can really impact cyber hygiene. If people can understand what’s good, what’s bad, similar to wash your hands after you go to the bathroom. Basic things. Why is that? Why is this treated, everybody wants tech. Everybody wants tech, but nobody looks at the process that got them in the pickle in the first place.

Joseph Steinberg (27:32.496)
I agree, wholeheartedly.

Joseph Steinberg (27:45.218)
So I will tell you two things about this. If you look at my list of, I have an article in Firewall called, I think it’s titled like 13 things you can do to improve your cybersecurity without spending a lot of money. Most of them are free actually. It’s actually online, js.tc slash one three. So six characters, six letters. You can look at it. The number one thing I tell people, and it’s by far the most important, and I’ve put out videos saying the same thing. If you,

believe that you are a target, you behave differently than if you don’t. So if you own a business and you have not trained your employees where they know intellectually that they can answer a survey correctly, but you have gotten your employees to believe, to internalize, that they really are targets. There are criminals who want to breach their devices and steal their data. That will have more of an effect on security than probably every technology that you’re gonna buy.

Manoj Tandon (28:43.508)
Absolutely.

Joseph Steinberg (28:44.094)
And maybe I’m exaggerating to some extent, but the reality is I don’t care what technology you buy, if your employees do not believe they are targets, somebody is going to social engineer them and you’re gonna have a problem. So I’m not saying not to use security technology. What I’m saying is that it’s not gonna be effective. You’re still gonna be breached if your employees do not internalize that they really are targets.

uh… it’s not education right because education means oh yes i learned on the target so when they send the survey around so that i get my bonus i will check off i am a target i mean believe it people who are targets when they get an email that says you know hey you need issue this wire out to x y z they stop and think for a second hey is this real and it’s that pausing for a second and thinking that can make a big world of difference so that’s number one

I think that is a big issue. I also think we have a problem, and this is a general problem across humans all over the world, from what I can see, when it comes to security, which is we tend to think of devices and visible obvious things as delivering more value than things you don’t see. And when you go and let’s say you go to the White House or you go somewhere in a secure building,

Manoj Tandon (30:01.004)
Yeah.

Joseph Steinberg (30:05.034)
and people will point out, oh, you see this guard booth and the guards are armed and they have dogs and they’re checking bags and that. And we’ve come accustomed to that’s what security is, it’s the visible things. There’s probably facial recognition systems there looking at people coming in, but you don’t know that so you don’t think about that. When you talk about, when there was a slew of attacks on synagogues and from anti-Semitic people, at some point they’re talking about, should there be armed people inside?

Manoj Tandon (30:30.026)
Yep.

Joseph Steinberg (30:34.634)
you know, to protect people. But again, that’s not really the main way of protecting a building and the people in it. It’s, you know, the fences around it, the cameras around it, the lights around it, police car outside as a deterrent. There’s many things that are not as obvious as arms that do a lot more. And I think it’s the same in the cybersecurity world. And that’s why people talk about tech, right? Oh, we bought the latest flashy, you know.

Manoj Tandon (30:59.344)
Yeah, that’s right.

Joseph Steinberg (31:01.174)
Gizmo and we have this system and that system and it does this yes, that’s nice But that may not be your biggest problem your biggest problem Maybe that you have users who don’t believe that they are targets and they’re downloading and going to websites that are gonna Infect them with malware and maybe your anti-malware works 99% of the time, but the one time it doesn’t you’ve got a problem, right? so it’s that visual cool looking stuff, right it’s those the equivalent of the

Manoj Tandon (31:25.059)
Yep.

Joseph Steinberg (31:30.658)
10 people in SWAT team suits standing there with rifles and carbines outside of the building keeping it secure. That looks secure. You’re not looking at the cameras, the facial recognition systems, the panic buttons, the man traps, all the different techniques that could be in there to keep people secure that aren’t cool or aren’t obvious. And I think that’s one of the reasons why technology is always getting the cool end of the stick.

Manoj Tandon (31:43.777)
Right.

Manoj Tandon (31:57.953)
Yeah.

Joseph Steinberg (32:00.094)
It’s hard also from a budgeting perspective. It’s a lot easier to say, look, we had a million dollars for security and we spent it on this cool system and that cool system than to say, hey, we spent it on bringing in people and coaching people and training people and testing people. It just doesn’t sound as cool. And unfortunately, the results are clear.

Manoj Tandon (32:05.657)
It’s…

Manoj Tandon (32:19.188)
Yes, they are, and we’re gonna link up to your article because that is just solid advice. And it’s one that we’ve been harping on for some time is that everybody wants to talk about tech. We’re like, well, but let’s talk about how an event happens in the first place and all the behaviors that lead up to it. Right? And that brings up, you bring up an interesting point.

Joseph Steinberg (32:43.842)
You know what, I’m gonna add one thing there, and I think we should be blunt about this, right? I’m a New Yorker, I say it as it is, and let’s accept this about us, okay? We call ourselves intelligent life. I’m not sure that aliens would consider us to be too intelligent, considering what we do to ourselves. You know, we’ve seen it in the news in recent weeks, right? Humans can do to themselves, even most animals are not capable of doing such stupid and terrible things.

Manoj Tandon (32:49.548)
Say it, please.

Manoj Tandon (32:58.872)
short.

Joseph Steinberg (33:08.566)
But when you think about human brains, right? We have the same brain that our ancestors had a thousand years ago. It’s the same brain. There is no change, right? It takes hundreds of thousands of years to evolve even small changes. What that means is that when a knight in the dark ages killed another knight and took that knight’s armor and then showed up at the castle and said, “‘I am sir so-and-so, let me in.'” They were doing exactly the same thing as a fishing attack just in a different venue. And the brain that’s being tricked

is the same brain that’s being tricked today in a different venue. Humans, we are still human brain 1.0. Technology every few months there’s a new generation that comes out. Think about how much phones have changed in 25 years. Think about how much computers, right? You can’t even compare. So the technology advances orders and orders of magnitude faster in capability than our human brain.

Manoj Tandon (33:52.846)
Oh, yeah.

Joseph Steinberg (34:03.382)
We may know new things, but the brain, the CPU, is the same brain as 1,000 and 2,000 years ago. That’s why we’re the weak link, and we can’t change that. We’re gonna stay the weak link because we can’t evolve our brains to human brain 2.0 quickly, like technology can. So if people think that technology is where the weak points are, it’s almost a form of ego because we’re the idiots. Let’s just face it, we are intelligent compared to

some forms of life, we’re not too intelligent compared to AI, and we’re certainly not as advanced as we think we are. And I think we need to start accepting that, that humans are the Achilles heel of security.

Manoj Tandon (34:45.492)
You’re absolutely right, but I think there’s one thing there that you said that I don’t have a good solution of how to implement it, but I think it could work towards making huge strides, and that’s if we could make the problem of cybersecurity tangible for the average person. That’s the thing. It’s almost like no one thinks they need cops until they get robbed, right? Then they’re like, oh, I know why we’re funding this.

Joseph Steinberg (35:15.682)
Right, it’s like a home alarm system. Right.

Manoj Tandon (35:16.188)
It’s because it became tangible, it became tangible. So how do we make it tangible? And I don’t have an offering that I could say, I know exactly how to do this although I’d be doing it right now, but that is something that could change people if we could bring it home to them in some way.

Joseph Steinberg (35:21.794)
only.

Joseph Steinberg (35:33.294)
Well, first of all, I think if you and I solve this on this podcast, we’d probably be up for a Nobel Prize if there was an actual solution. But I think there’s an inherent problem that we can’t solve, which is, again, going back to history, right? So 200 years ago, our ancestors and by our, I mean, I don’t care where they were on the planet. And we probably had ancestors all over the planet, right? They all taught their children do not play with fire. Right? OK.

Manoj Tandon (35:37.905)
Yes.

Manoj Tandon (35:57.537)
Yes.

Joseph Steinberg (35:59.222)
They told their children, do not run in the middle of the road where the horses or the camels or the elephant, it doesn’t matter what animal people were riding. Whatever animals, don’t run in the middle of the road. And then when cars came out, don’t run in the middle of the road. There were certain things that humans all over the world have taught their children in terms of staying safe because these things have worked and the people who didn’t teach their kids, those kids got killed and evolution selected the people who did.

Manoj Tandon (36:25.353)
Oh, you…

Joseph Steinberg (36:27.99)
Protect the kid. Don’t play with the saber-toothed tiger, right? Stay away from it, okay? You can play with that domestic kind of cat, but not with that lion, right? These kinds of things over time, human society came up with very clear rules, and it doesn’t matter where you are on the planet, right? Societies that had no interaction with each other, even, let’s say, going back 100 years, societies that had no interaction, they had similar security and safety things that parents were teaching their children.

Manoj Tandon (36:31.049)
Yeah, bad idea.

Joseph Steinberg (36:57.502)
about many fundamental things. Don’t go places with strangers. You can’t do that for cyber because the dangers keep changing so fast that the things that I would teach my children today, those will still be important to teach a generation from now but those will be so many new things that you can’t come up with a list. People can’t learn from their parents or from their teachers in school how to stay cyber secure.

and use that knowledge for the rest of their lives the way they can with fire. Right? It’s just… much harder to stay current. And that’s part of the problem. I’m not sure we can do that. Because even if we could do it today and make it tangible, the risks of tomorrow are not tangible and people still need to address that. Think about social media, right? 20 years ago, nobody spoke about the risks of social media because it didn’t exist.

Right. And now all of a sudden there are many, many things related to that. 20 years ago, nobody was worried about Chinese apps being put on kids’ computers. Right. Now it’s an issue. You know, the risks change as the technologies advance. And part of the problem is people need to learn that. We as humans are not used to the fact that there can be fundamental dangers to us of a catastrophic nature that we didn’t learn from our teachers or our parents as children.

That’s just a new thing that now exists in the world that we really didn’t have as humans before at all. And so that’s part of the problem. Even if you made it tangible, well you and I would make tangible, it’s not going to help in 20 years.

Manoj Tandon (38:39.099)
Agreed. So what is your mission then at Secure My Social? What are you guys doing?

Joseph Steinberg (38:46.422)
So Secure My Social is a business that has technology that actually can warn people if they’re making social media posts that are problematic or leaking data, which today is kind of a big problem.

Manoj Tandon (38:58.82)
I mean, that’s going to be every teenager that is in the United States.

Joseph Steinberg (39:03.746)
I think it’s probably every person that uses social media, but that’s maybe I’m less optimistic than some, but there’s plenty of other things going on. But that’s one thing that I’m involved with. And actually today I spend most of my time actually serving as an expert witness on cybercrime cases. So there, you know, the corollary to our politicians not understanding cyber issues is that when there are thefts or there are crimes.

Manoj Tandon (39:07.209)
Uh…

Joseph Steinberg (39:29.922)
frequently it’s very difficult for juries and judges to understand what really happened and who really should have done things differently. And both sides in a case will typically bring in people to try to explain these types of things to both judges and juries, whether it be criminal or civil, because sometimes these things are A, complicated and not

they’re not black and white decisions, right? There’s a breach, there’s a provider and a user, and the user made a mistake, but the provider should have stopped the problem anyway, and there’s a third party service, and there’s a fourth party managing the networks, and this company was brought in to do an audit, and they didn’t find the problem, right? It can be very complicated to figure out who caused what, and who’s responsible for what, especially when you start throwing in federal laws and state laws and international laws when the party’s overseas.

Manoj Tandon (39:59.748)
Sure.

Joseph Steinberg (40:25.13)
So it can be quite interesting and the good thing about what I’m doing today is I have helped people who are wronged recover funds and in some cases have also been able to help punish parties that were looking the other way on crimes that in the end were funding either organized crime, child traffickers, drug traders and terrorists.

you know these are the parties that the people who are making the most money off cybercrime today are the worst people in the world let’s leave it that way because it’s there’s so much opportunity if you’re a country under sanctions can affect stuff over the internet so they all get involved in cybercrime and money laundering uh… so you know stopping these types of things is not just a matter of protecting the innocent it’s it you know in terms of people’s money it’s also stopping all sorts of terrible things that happen when you know rogue regimes are

organized crime or terrorists get money.

Manoj Tandon (41:23.04)
Yeah, and those guys aren’t gonna stop anytime soon. I mean, there’s no incentive and it’s really very, it’s just not enforceable. I mean, it’s just not…

Joseph Steinberg (41:32.362)
You’re not going to be able to stop the North Koreans from stealing cryptocurrency, but you can make it that parties that don’t enforce rules strictly that would have stopped some of the crimes, you can incentivize those entities to be stricter and that might reduce the amount that the North Korean regime has taken. For those who are not familiar, the North Korean regime is at present believed, and this is not my belief, this is the

Manoj Tandon (41:51.78)
Sure.

Joseph Steinberg (42:00.31)
belief of the entire west, the White House has said the same thing. They are the number one stealers of cryptocurrency online. A significant percentage of all crypto that’s stolen online is stolen by the North Koreans, as much as potentially close to half. And they use it to help fund their nuclear program. So at least as of last year, the money that they were stealing online…

I was about 10 times the size of their legal exports. Okay, so just to put things in perspective, they’ve been a little over a hundred million exports and stealing over a billion dollars a year in crypto, a significant percentage of which the White House has acknowledged is going to fund a nuclear program. So when we stop these cyber crimes, we’re not just protecting innocent people’s money, we’re stopping really bad parties from doing really bad things.

Manoj Tandon (42:31.405)
Wow.

Manoj Tandon (42:56.364)
I did not know that statistic was that large. And yeah, you’re right. I mean, we can affect some of the controls that surround North Korea or any other regime for that matter, or any other bad actor set. Like people initiating ransomware attacks from inside the Russian Federation. The FBI is not gonna be able to arrest those people, ever. I mean…

Joseph Steinberg (43:20.286)
No, no, we’re not going to be able to get to the parties who are committing the crimes, but there are parties that are in our reach that I don’t want to call our facilitating. Some of them may be facilitating, but some of them may be looking the other way because by having more lax rules, they make more money or they’re processing transactions they shouldn’t be processing because they’re getting commissions or what have you. There’s a case now involving the federal government.

Manoj Tandon (43:23.367)
Yeah.

Joseph Steinberg (43:46.67)
uh… which they’ve accused certain parties of helping facilitate for example eight billion dollars of activity with the run occurring online in violation of sanctions these are real numbers right that’s a lot of money in a lot of transactions uh… they could do a lot of really bad things uh… but at the same time the parties the process them they have made a lot of money doing it so they have been incentives sometimes to look the other way and so i think cracking down on the

parties that are allowing this to happen, it won’t solve the problem, but it may reduce the amount that these, you know, evil regimes obtain. And as I said, it’s not just evil regimes, it’s also criminals, human traffickers, child traffickers, drug dealers. Remember, online has made their world much easier. They don’t have to go through the banking systems, they don’t have to physically be present where they’re committing crimes, you know, and if you’re in North Korea…

Manoj Tandon (44:18.744)
Do said.

Joseph Steinberg (44:41.642)
and you’re under sanctions, it’s gonna be kinda hard to physically commit a crime in the US, but it’s a lot easier to do it online.

Manoj Tandon (44:48.74)
It absolutely is. So we’re down to the last couple of minutes here, Joseph. I wanted to give you a chance to plug anything that you’d like, you know, do you got any, are you making any appearances, any new books coming out, any talks, whatever you’d like to let the audience know about, floor is yours.

Joseph Steinberg (45:07.134)
So thank you for the opportunity. So I do write my column, which is on my website. I don’t write news, right? I write things that I want people to know that I don’t think they’re hearing. So if there’s a news story about a breach and everyone’s saying change your passwords and I don’t think you need to change your passwords, I’ll say that. But it’s really my opinion on different things. And I’ve been talking about some of the dangers, for example, that AI has. I think the dangers that we’re talking about are the wrong ones.

They’re the ones that may be best for media to talk about because they’re topics that are full of controversy and rile people up. But I think the bigger dangers are the ones we’re not discussing, which I’ve talked about in a few recent talks and I’ll be writing about in detail over the next few weeks. I think there are other topics. I’ve spoken about the impact on jobs that we’re ignoring from self-driving trucks.

which will affect us much more than self-driving cars in the near term. There’s millions of people in the United States, for example, whose income depend on the long distance trucking industry, moving goods across the country. And that’s gonna be one of the first things that gets replaced because it’s the easiest drives and it’s got the best return on investment because you can drive 24 by seven instead of driving and having people sleep eight hours. So…

uh… you know that there’s a lot of things that are going to be impacted by technological change uh… that i do tend to talk about saying that it does a starberg dot com or if you prefer short codes j s dot t c joseph starberg that totally can that will take you to the same site uh… the cyber security for those book is now in its second edition it’s actually in several languages uh… books done quite well again i think i will admit that i’m a dummy when it comes to a lot of these things we’ve all made mistakes on cyber security

Manoj Tandon (46:56.937)
Absolutely.

Joseph Steinberg (46:58.282)
I’ve seen Nobel Prize winners literally make mistakes on cybersecurity matters. And part of it is, as I said before, we’re not educated on this in school. I was not taught cybersecurity in school. And even if you’re young enough that you were, by the time you finish school and you get your first job and move into that job and enter an adult life, the rules have changed, right? The dangers have changed. So it becomes this constant cycle. And

You do want to stay up to date on major trends and things like that because it can affect you. But again, that number one thing, if you believe you are a target, you’ll behave differently. And I promise you, whoever you are who’s listening to this, you are a target. Because everybody has data that’s valuable. And if you want to know how valuable that data can be, because you think you don’t have anything, I’ll leave you with one thought. Somewhere in the United States right now.

Manoj Tandon (47:48.452)
Please.

Joseph Steinberg (47:52.226)
There are children oversharing data on social media about all sorts of things. One of those children may become the president of the United States. Some will be senators, some will be judges. Maybe it’s 20 years, 30 years, 40 years, 50 years. Some of them will be ambassadors. Some of them will be military leaders. If a foreign government is collecting all this data, which of course, even if it’s encrypted, will be decryptable by then because the capability will be there, right? You know, quantum, et cetera.

Manoj Tandon (48:10.34)
Sure.

Joseph Steinberg (48:20.81)
But it’s mostly it’s not encrypted. It’s being overshared. I don’t know how that data is gonna be used, but I don’t wanna, you know, it’s gonna be a big problem because the oversharing is going on and people say, oh, it’s just my teenage kid doing that. But somebody’s teenage kid is gonna be the president and somebody’s teenage kid is gonna be the chief justice of the Supreme Court. And we don’t know the value of our data. That’s my point. You do not know the value of your data because you only know.

what it looks like now, and you only know what the world looks like now. But the future is coming. And it’s not a question of will there be someone who’s a future president who’s oversharing? There will be, we just don’t know who it is. And since storage is cheap, they’re storing everything. So just remember that if your data is breached, maybe it’s not used against you now, but maybe it’s used against your kids in 20 years.

Manoj Tandon (49:00.75)
who it is.

Manoj Tandon (49:11.996)
Very sound advice. It’s been a pleasure, Joseph, having you here. And we’ve barely scratched a host of topics that we could discuss. So we would look forward to having you back sometime. But thank you so much for a wonderful conversation.

Joseph Steinberg (49:27.618)
Thank you very much.

Manoj Tandon (49:29.412)
I appreciate it.