Security Confidential S14 E1 Adam Levin

Manoj Tandon:
This is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security Confidential. Today, we are honored to have our own cybersecurity celebrity join us. He is Adam Levin. I’m sure you folks have seen him on various networks out there. He is the author of the book Swiped. He hosts a regular podcast. He is a nationally recognized expert in cybersecurity, privacy, and identity theft. He has been a huge advocate for consumers, and we’re actually going to talk a little bit about consumer advocacy. He’s the former Director of the New Jersey Division of Consumer Affairs. He’s the founder of Cyberscout and the co-founder of Credit.com. We are just honored to have someone of his caliber here. Thank you, Adam, for joining us. I deeply appreciate it, and so do all our listeners.

Adam Levin:
Well, listen, I appreciate the fact that you’ve invited me on your show, Manoj. And here I am to lower your digital property values. But anyway, it’s a pleasure to be here today, and thank you for inviting me.

Manoj Tandon:
You know, we were looking for your keen insights. One thing that we do get from our listeners is everybody loves the origin story. People always like to know, because cybersecurity is a field where people have come in from various disciplines and backgrounds.

And if nothing else, we’ve broken the myth that you have to be a computer science guy to be in cyber. If you wouldn’t mind sharing a little bit about how this journey began for you?

Adam Levin:
Absolutely. Well, I became, in the mid-70s, the Director of the New Jersey Division of Consumer Affairs. So, I’ve always had a public service and consumer protection orientation to my life. In the early ’90s, I got together with a friend, and we created one of the first online credit education information product and services companies called Credit.com. In fact, we were so early to the process that we actually got the domain by swapping a hard drive for it.

Manoj Tandon:
Wow.

Adam Levin:
And so, Consumer Affairs prepared me for Credit.com because we were very focused on giving people unbiased, clear information about how to understand something that was really like a mystery and a black cloud, which is: how do people deal with credit?

And it really wasn’t that much of a leap of faith for us to take the next step. I’ve been approached by a legal services company that wanted to do the J.C. Penney credit card portfolio, and they said, “Our bid is going to be too high; we’d love to have an identity theft component.” Now remember, this is 2002. No one, even in those early days, ever even knew what identity theft was, even though it had stemmed all the way back from the ’70s, but was really operating under the radar.

And so we looked around. My partner and I didn’t find anything that really would solve their problem, so we decided to do it ourselves. That was a company with a core competence in putting people and organizations back together again after they had suffered some form of compromise. That was the beginning of a company called Identity Theft 911. We had a number of insurance companies that said, “Your name is scaring the heck out of our people, so can you come up with another name?” So we said, “Well, since our URL is IDT 911, we’ll do that.” But after a few years, we had reporters saying, “So, are you an alarm company or a phone company?”

As we became global, because we were in the U.S., Canada, the EU, Asia, Malaysia, and Australia—wow—we looked for a global name and we were lucky enough to get our hands on Cyberscout.

Cyberscout was identity theft education, information, resolution, forensics, incident preparedness, incident response, and election security.

So that’s really the saga from 1993 all the way up to 2021, when I sold the company to a company called Sontiq, which is now part of TransUnion.

Manoj Tandon:
Wow, that’s quite a journey. And you know, you were first to market, essentially, in a lot of ways.

Adam Levin:
Those were the early days. If you think of the cyber days, the early days were when LifeLock was direct-to-consumer, and we were B2B2C. So, we were direct to businesses helping their consumers.

Manoj Tandon:
Wow, fantastic. LifeLock, I think they did real well, too. They ended up selling to Symantec, I believe.

Adam Levin:
They sure did. And actually, Todd Davis, who founded LifeLock, and I have become pretty good friends. We’re on the same board of a medical institution in Arizona. It’s amazing how all lines intersect ultimately.

Manoj Tandon:
Well, I’ll tell you what, we kind of are replicating a little bit of his model with what he did with his guarantee.

Adam Levin:
The million-dollar guarantee.

Manoj Tandon:
Yeah, we are actually—I want to say we might be the first cyber—we are the first cybersecurity company that’s actually putting our money where our mouth is on this thing, which is so important.

Adam Levin:
I was involved with the Consumer Federation of America and many of the organizations in Washington. The NGOs have been really working hard at finding ways to build the bridge between public and private. One of the things that they were worried about—and that’s why you have Identity Theft info—is about where companies come together and sign a pledge that they’re going to be straight with their consumers, that they’re not going to make any promise that they can’t keep, and they’re going to be very fair when it comes to dealing with their customers and not promising something that is beyond their ability to deliver. So, yeah.

Manoj Tandon:
I’d love to turn back the clock to when you were an incarnation in the Consumer Affairs arena. I have a question for you.

You look at when we buy devices today, whether it’s a Samsung TV, a smart TV, I should say, or a refrigerator, or whatever. A lot of these devices now have cameras. They have the ability to take inputs, record your surroundings, or Alexa, or whatever you have out there, right?

And as a consumer, we never really get full disclosure before we purchase. We have to put our money on the table, buy the device, and then we must agree to those terms, which are undisclosed. And I can tell you, nobody reads that stuff. Nobody, right?

Adam Levin:
Nobody. It’s just like nobody reads privacy policies. Nobody understands when they’re giving permission to an app what that permission is. I don’t know if you remember way back when you had Pokemon GO, which became the rage. People didn’t realize in the early stages of it that you were actually giving authority to that developer to get access to your entire Google world until someone brought it to their attention, and they went, “No, we didn’t mean that.” And of course, I always love it when a company goes, “No, no, we didn’t mean it.” I mean, forget the fact the lawyers, the marketing people, everybody already looked at everything.

But yes, when you get involved with buying an Internet of Things device, think about the fact that there are millions of these devices right now that are tracking us, listening to us, watching us. You don’t really understand how privacy-invasive those devices can be, even to the point where you remember when Samsung issued a warning? They said, “By the way, you might want to disable the microphone function of the television.”

Manoj Tandon:
That’s right, yeah. And the camera on some of those TVs.

Adam Levin:
Absolutely. You can become the unwitting star of your own reality show, which is not something that you may really want to happen.

Most people don’t realize it can be as simple as reading the manual and changing the password on the device, or you might not have any control over it. You have to accept the terms as they’re written. That’s the thing.

Manoj Tandon:
Why haven’t our regulators caught up with this and said, “You know what? This is not fair.” Just like we have product labeling on other consumer products, why is there not an open disclosure that if you buy this product, we will listen to you, or you’re giving us permission to do this, or we have an opt-out mechanism to say no, we don’t agree with this EULA, but I already paid for this refrigerator?

Adam Levin:
Well, that’s why one of the things is that the opt-out should not be the norm. The default should be you’re out unless you wish to opt in. That’s been the biggest problem. Apple is probably more aggressively in favor of the consumer than a lot of other companies, where you have so many opportunities not to be part of something, or where you actually have to do something affirmatively in order to be more exposed.

But other companies, it’s all about gathering the data because data is currency.

What’s tragic is we live in a world where breaches have become the third certainty in life behind death and taxes. When all of these organizations collect all of this information, then people want to know, “How did I get exposed?” Well, the answer is you were willing to make the Faustian bargain because you wanted the product, and you clicked on “I accept” without understanding what “I accept” really means.

They’ve made privacy policies, even though they’re trying to make them more accessible in terms of people’s understanding, in 27th-grade English and mouse print. So we start as consumers behind the eight ball.

You have states like California that are working very hard with their Privacy Act to get people more privacy and more people to understand the data that’s being collected. With Apple now, you can go and it will explain to you exactly where your data is being shared.

I have a friend who has a company called LOKKER. What they specialize in is going on your website, doing an analysis, and showing you every single place that data is leaking from your homepage. Then they help you either quarantine it or anonymize it. They found one popular healthcare organization where data was leaking, just based on the code on their homepage, to 650 different organizations from one homepage.

Manoj Tandon:
Wow.

Adam Levin:
People don’t understand this. People need to understand: we are the product. Even if we’re paying, we’re the product.

Manoj Tandon:
We absolutely are the product. We’ve gotten used to—we’ve traded privacy for convenience to a large degree. Convenience versus security: whenever there’s a rub, convenience wins.

Adam Levin:
Convenience wins. Now we find ourselves in this situation. I would venture, is there anybody left in the United States whose data has not been leaked on some account, in some file somewhere, with one of the major breaches?

I would say that’s probably on the same level as the Carolina Panthers winning the Super Bowl next year.

It just isn’t happening. With all due respect and love to the fans in Carolina, the bottom line is no. Between the Equifax breach, the breaches of the Office of Personnel Management, all of the airlines, pretty much all the big hotel chains, the big retailers—we’re out there.

The thing that people really have to understand is we all have day jobs. We’re raising a family, running a business, working for somebody, being involved in philanthropic activities, or getting an education. But to a hacker or a scammer or an identity thief, we are their day job. So it’s not a fair battle. It’s like we’re bringing a water gun to a machine gun fight.

Manoj Tandon:
Wow. So, what is to be done about this? I’d love for you to tackle this in two ways: one, what should be done with these companies that are housing this data and leaking it? It’s inadvertent, it’s being stolen, but it’s getting leaked. And then, what do we as individual consumers do to affect change and to protect ourselves? Because ultimately, individual responsibility is not scrubbed, but in many ways, corporate responsibility seems like it has been scrubbed. I can give a few examples of that, but I’d love for you to give your thoughts on this.

Adam Levin:
Well, I go back to one of my favorite quotes from one of my favorite humans in cybersecurity, which is Bruce Schneier. He is the rock star in cybersecurity. One of his most famous mottos is that if you think throwing a ton of money at technology is going to solve your security problems, then you don’t understand the technology and you don’t understand security, because it’s really all about the human factor.

If you go back to Peter Drucker, who’s one of the great management wizards, his line was, “Culture eats strategy for breakfast,” which is all about culture. It’s something that we as people have to develop, and companies have to develop, which is from the mailroom to the boardroom and back again to the loading dock. Organizations have to create a culture of privacy and security where everyone in the organization buys into the concept that they are part of it, that they have ownership of it. Just like as consumers, we have to understand the fact that we are the ultimate guardians of our information.

I look at it as what I call the Three Portfolio Theory. When you say the word “portfolio” to most people, it means investments. But we have other portfolios in our lives: we have our credit portfolio and our identity portfolio. If any of those portfolios go awry, it will impact the other portfolios.

Now, you would hope that someone professional would manage your investment portfolio, but as consumers, we have to manage our credit and our identity because nobody knows what we do more than we do, even though we don’t acknowledge it half the time. We have to build them, nurture them, manage them, and protect them.

When the CEO of Microsoft made a statement a few years ago, I thought he was dead on. He said, “We have a shared responsibility.” All of us do: government, business, consumers, and the media, because we’re all in this together. If the grid goes down, we’re in it together. If we become a victim of identity theft and our information is used to log into our businesses, and our businesses are in any way involved with a supply chain, and that supply chain has anything to do with national security, something as simple as a really dumb password or a device handed to your child—and kids can be weapons of destruction within a household if not properly secured—it could actually impact America. As terrifying and crazy as it sounds, that’s the way it is.

So we have to start at ground zero, which is our children. We have to teach them cybersecurity. They have to understand that everything they do can protect mommy, daddy, and their grandparents. Families have to work together to better understand it. Companies have to spend more time training their personnel as to cybersecurity, and the government has to get more serious about training its people and making sure that its systems are better protected.

Manoj Tandon:
Yes. And I think on the government side, don’t you think our policies date back to the time of paper and pencil? There needs to be some revisions there.

As an example, you look at our Social Security numbers. We have no ability, once it’s breached and that data is out there, to stop its use, to change the number, or to affect anything with it. Once it’s out there—and I can guarantee you mine is out there and Adam, probably yours is out there.

Adam Levin:
Oh, it’s having a party out there.

Manoj Tandon:
It’s asked for in such a nonchalant way. So many businesses—you go into any form you fill out: “Oh, we want your Social Security number. Oh, we want your Social Security number.”

As a policy example, we need to make some changes here. Our lawmakers need to get with the times, too, not just the consumer. I agree completely. Consumers have to have a change in mindset, but where’s the responsibility on the part of our lawmakers who we elect to do some of these things and look at them in a serious way?

Adam Levin:
Well, first you have to start with the premise that Congress can’t agree on the day of the week.

Manoj Tandon:
That’s a small problem, yes.

Adam Levin:
Many years ago I went to Washington because I used to spend a lot of time there. In fact, I worked in Washington for a period of time. I was talking to—and I won’t identify the party—but I was talking to some of the party leadership of the House of Representatives and I said, “How are we doing on privacy?” And they said, “Well, in the next year or so we’ll probably see something on security, but privacy? No one can agree on what privacy is.”

It’s like, oh yes they can. In Europe they did. In the state of California they did. It’s amazing to me how you can’t figure it out here in Washington.

And then, of course, a lot of people in Congress are worried that if they do come out with something—and they are in the process of coming out with something—that in order to accommodate all of the different interests, whether it’s business groups, consumer groups, or public interest groups, by the time it comes out, it’s a watered-down mess.

You have to ask yourself, for instance, why is there no national data breach disclosure policy in America? That’s because a number of states don’t want it, because they feel that their policies are far stricter than you would get out of Congress. A number of people in Congress just don’t want to do it because, heaven forbid, they put stress on any business.

When I was head of Consumer Affairs, we had two goals: one, protect consumers; and two, protect honest businesses against dishonest businesses—people that would take advantage of business people, consumers, business organizations, and public interest groups.

Yes, it has to start with Congress, but Congress can’t seem to get started. I mean, look at what’s going on in Washington now. It took 15 tries to get a speaker. They got a new speaker who’s terrified that if he does anything wrong, he’s gone. And nobody’s talking. You have situations with bills that were worked on very hard by people in a bipartisan way, and then it comes to the floor and either gets killed in the Senate or the House.

The whole thing is tragic, and we are left almost defenseless. That’s very dangerous because we are living now in a very dangerous world. If you ask some of the national security people, they will tell you off the record—and we’ve read it—that China, Russia, and Iran are in our grid, just as no doubt we are in their grid.

I was talking to someone today and they said, “Look, if the grid goes down, you’ll have anarchy in three days.”

Manoj Tandon:
I don’t know if it would even take that long. Adam, have you read Ted Koppel’s book on that, Lights Out?

Adam Levin:
Yes.

Manoj Tandon:
He talked about sanitation being one of the biggest issues. In major cities, no power means no question.

So, how do we approach this? Because that’s really the crux: how do we approach this, especially in a world where we now have deep fakes, disinformation, misinformation, sextortion, and text scams? Every scam you could imagine. How do we do this? We need a framework.

Adam Levin:
In the book Swiped, Beau Friedlander, who was my collaborator, and I came up with what we call the 3Ms.

One: how do you Minimize your risk of exposure and reduce your attackable surface?
Two: how do you Monitor so you effectively know as quickly as possible that you have a problem?
Three: how do you Manage the damage?

We apply it to both businesses and consumers.

For businesses, obviously, you need to train your people, segment your data, and map your data. Make sure that all of your devices are as up to date as possible. Continue to monitor your devices looking for weird exfiltration patterns and things like that. Manage vulnerabilities. When a patch is issued for software, make that patch happen as fast as you can.

As we saw with Equifax, a patch was issued involving the software. The security group sent a note down to the technology group, and somebody missed it. For months, this vulnerability was there and someone got in. All of a sudden, the data on 150 million people was exposed.

We’ve seen a lot of breaches where, when you look at the reports of the technology groups and the security groups, they will tell you, “We are woefully lacking.” And yet it doesn’t happen, and then the organization gets breached. I mean, go all the way back to the breach of Sony Pictures, where, again, there were warning signs everywhere for months and months that they had a problem—maybe even years—and nobody paid attention to it.

So, you have to first Minimize your risk of exposure, then you have to effectively Monitor. As I said, monitor the flow of data. Make sure that anytime a vulnerability is discovered, you do something about it. And then Manage the damage.

For an organization, that means prepare for the worst. It has to be an effort throughout the entire company. It has to be HR, PR, technology, senior C-suite people, and the security people. If something goes wrong, you’ve got to have a third party on your speed dial that you can go to immediately and get things in motion. You have to find out what happened, where it happened, and plug the leak. Do the PR so that you present the company in the best possible light, but be honest about it.

Companies will be judged on the urgency, transparency, and empathy that they demonstrate when dealing with a breach.

Those are the 3Ms for companies. I could spend hours on it, but I won’t do that.

When it comes to consumers, what are the 3Ms? Again, how do you Minimize your risk of exposure? Use password protocols, maybe a password manager, two-factor authentication, and unique passwords. We had a wonderful guest on our show, Michelle Dennedy, who was saying that she operates on what she refers to as the “panties rule” when it comes to her passwords: they should be exotic, they should be frequently changed, and it is disgusting if they’re shared with others.

So, password protocols. Also, when you set up security questions and answers, lie like a superhero. The reason is because so much information is out there about so many people that we put out there ourselves. It’s on social media: where we went to school, what our favorite color is, what our dog’s first name was, and what our mother’s maiden name was. The list goes on and on.

But we know that Superman never told people he was Clark Kent. Bruce Wayne never talked about the fact that he was Batman. Lie like a superhero. If your mother’s name is Brown, say it’s Smith. If you went to Ridgewood High School, say you went to Sky High. The key thing is, when you’re asked the security question, as long as you give the answer you gave them when you set up the question, you’re fine. This is not a background check for you to get the highest level of security clearance; it’s just a process to make you a little bit more secure and a harder target.

Manoj Tandon:
Well Adam, doesn’t that become burdensome as a consumer? We have so many accounts—whether you’re on Venmo or Zelle or PayPal, and then you’re on Netflix and Prime. God knows how many accounts the average American has that are digitally identified. For every one of those, you have to apply the process that you’re talking about, if you want to do it correctly.

Adam Levin:
Well, get a password manager, which simplifies the process a great deal. Depending upon what manager you get, it’s multi-platform; you simply pull it down and you know what the password is.

Also, we do know with certain browsers, they have ways that you can save your passwords. You just have to make sure that it’s a very safe browser. Also, use a Virtual Private Network. It’s not a big deal; it’s available and you can get it everywhere. That shields you a little better.

Don’t use public Wi-Fi if you’re involved in a transaction that is sensitive. Even if you’re looking at your email, maybe you don’t do it on a public network. You can browse if you want to, but be careful. Just think about the fact that there are people out there that are not your friends.

Just like when you go on social media, do you really have to share every morsel of your life? When you’re on a trip, the whole theory is: share the memory when you return. Be careful about sharing the event as it unfolds in real time. If you do that, then people know where you are and where you aren’t.

Manoj Tandon:
Well, let’s look at that one, Adam. How easy is that to figure out? If somebody sends you an email at work while you’re on holiday, you’re going to get an out-of-office reply, typically. You’re probably going to tell them who to call in your absence, which is even better because now you gave a legit address and verified somebody else. You’ve probably stated on Facebook, “Hey, looking forward to our vacation,” depending on your bent for social media. I don’t use it that much, but my kids use it all the time. I’m sure all those details are there. You have put all this data out there. You’ve just let people know you’re gone, you’re not home, and you’ll be back when.

Adam Levin:
Well, you remember there was a site many years ago called Please Rob Me, where they gave the most egregious examples of people being very forthcoming about where they are, when they’re leaving, and when they’re going to return.

Just like having the post office hold your mail for a few days so that people don’t drive by your house and see mail coming out of the mailbox or a stack of boxes on your front porch. Make a deal with your neighbor to come over every day and just take boxes off your front porch. I mean, there are things that we can do. There are common sense things. Yes, they are a pain in the butt, but I am telling you without question—and you know this as well—that the agony that you will go through as a victim of some form of identity theft or hack, and the expense, will be far greater than whatever the hassle is of doing a series of things. Make it a checklist.

Just like when a pilot gets on a plane, before they start the plane they go through their checklist. I’m sure they would prefer not to have to do that, but they have to do it for safety.

A big thing we have now is virtual kidnapping, which is starting to be a problem. Someone in the family gets a call and they either hear a voice in the background that sounds like the voice of their relative, or see some kind of video where they’re led to believe that someone has been kidnapped. Most of the time it’s not true, but they don’t know.

There was a guy on a very big show in New York, Million Dollar Listing, and one of the brokers on the show got a call saying his brother had been kidnapped. They wanted him, while he had them on the phone, to go to an ATM machine, get money out, and drop it at a specific location. He had the presence of mind to text his brother and he found out his brother was fine. But this is happening more and more.

We had a mother on our show who got a call she thought was from her daughter who was kidnapped. One of the ways that you protect against this—it’s horrible that we have to think about these things, but we do—is to have a “safe word” for the family. A word that only your family members know. If someone is attempting to get them to do something or make you believe they have them in their possession, ask them what the safe word is. If they can’t come up with the safe word, then they don’t have the family member in most cases.

There are little things, just like how many families say, “In the event of a flood, a hurricane, or a tornado, this is where we’re going to meet as a family as fast as possible”? Usually when these things happen, somebody’s at work, somebody’s at school, and somebody’s out shopping. The communication lines go down, so you have to do a little planning. That is discipline, but we do that in other areas of our lives.

Manoj Tandon:
You make a very good point. It gets back to your earlier point of culture. There needs to be a shift in our mindsets if we are going to get serious about protecting ourselves in an increasingly digital world.

Adam Levin:
If I might just take you back for a second when it comes to consumers, there are two other Ms, but they’re much shorter.

The second M is Monitor. How do you effectively monitor? Get your credit report. Don’t just say, “Hey, I got my credit report; I’m good.” Read it. See if there’s anything on there that doesn’t make sense. And if there is, don’t assume it’s a mistake. Contact the credit reporting agency’s fraud department and say, “I see something on my report that doesn’t look right; I need to do a little further investigation.”

Track your credit scores. If your credit score takes a sudden, precipitous drop, there can only be three reasons: you didn’t pay a bill on time (not good), you’re using too much of your available credit (not so good), or you’re a victim of identity theft (really bad).

Also, sign up for transaction alerts from your financial institutions. It’s free and it notifies you anytime there’s activity in your account. If you get notified that you just went to the ATM machine, and you had gone to the ATM machine, you shouldn’t be annoyed by it. You should be grateful that they’re watching on your behalf.

Then, something as simple as when you get Explanation of Benefits statements from your health insurer: take a look at them, because you might find out it wasn’t you. We had a 72-year-old grandmother that we helped through one of the insurance companies who, on the same day on opposite sides of the country, had her insurance billed for a pregnancy test and a sperm viability test. At 72. She found it and it took weeks for them to believe her when she said, “I’m 72; this isn’t me.”

And then, of course, you have more sophisticated forms of monitoring that include dark web monitoring. It’s important for you to know that.

The third M: Manage the damage. A lot of people don’t realize that through their insurance company, many financial institutions, and their employer, there are programs now to assist people who are going through identity incidents. You can take advantage of their programs. It’s either free to you as a result of your employer subsidizing it, or you pay a certain percentage of it, or it’s deeply discounted. But you need to have one of these programs, because this could be invaluable if you become a victim of many forms of identity theft, everything from new account takeover and medical identity theft to child identity theft or criminal identity theft.

There are ways for you to get help. There are wonderful programs where you have fraud assistants who will assist you and get you through it. You just have to do a little research and make sure that you find the one that’s right for you. If you’re lucky enough to work for an organization, almost 40% of them now offer this program to help you.

Manoj Tandon:
I hope all the listeners understand that they need to take inventory of their own personal digital life and go through it in great detail. Get a clean baseline established. Because it sounds like you’re advocating totally for that. Get it cleaned up, get your house in order, and then make it very difficult for someone to cause disorder in that house.

Adam Levin:
Don’t be the victim. Don’t act like a victim. Think about all the things that we do for our health, right? We get medical checkups every year, we go to the dentist every six months—there are things that we do to maintain our bodies and our minds. We need to do things that help maintain our credit and our identity, because it is such a critical part of what we do.

There are people out there that run away from debt or worry about debt. I’m not suggesting people take on debt, but I am suggesting that people understand credit. Credit can be your best friend or your worst enemy. Just like the way you maintain a friendship is you stay in touch and you’re there for each other. With credit, if you’re there for your credit, believe it or not, your credit will be there for you. That is a critical part of your identity.

That’s one of the reasons why we started “What the Hack,” which is our podcast. It is a “no-shame zone.” It’s an educational podcast. We have a lot of fun guests and we try to take a look at problems just like you do here. We try to take a look at the problems that are facing people and look at ways that people have experienced the negative side of it, and the things that they did in order to better protect themselves so they wouldn’t have to go through this.

But you do have to start with the premise that, the way the world is, it is inevitable that one day each and every one of us will be a victim of at least one form of identity theft.

I always say to people, when you look in the mirror, you see a regular person. When a hacker, scammer, or identity thief looks at you, they see Beyonce, Jay-Z, Adam Levine, or Usher, because you’ve got what they want. You have financial information, you have personal information, and of course, you have money that they’d like to get their hands on. Or, it could have absolutely nothing to do with you as you. You could simply be the tributary to a larger river. They want to get to your child, your spouse, your relative, or your company. If you work for the government, they’d love to use you to crawl through your access to get into government systems. Or if you’re affiliated with an organization—say you’re on the board—they may use you by breaching or hacking into you. Because they’ve got your credentials, your password, and your user ID, they’re going to use that to get into anything else they want to get into. And you have no idea that you were the way they got in.

So, what I say to people and businesses in particular is: the 3Ms do apply to you. One of the most critical things: develop a culture of privacy and security in your organization. Use long and strong passwords. Use password managers. Use two-factor authentication. Make sure that the passwords are discrete and they’re not shared by an entire department in your organization. Each person should have their own password, because that will give people a clue as to how the hackers might have gotten in. Also, do everything you can to anonymize the data.

Have people talk to each other. We have situations where people fall for business email compromise or deep fakes because they think they’re talking to the right person. They believe that they received a communication from the right person, but they never take the next step to independently contact that person and ask, “Did you just send me something, and did you just ask to wire money?”

Don’t worry if they’re going to be upset with you. If they’re upset with you momentarily because you disturbed them, that is nothing compared to how upset they’re going to be with you in the event that there is an incident that cost that company money because you blindly followed a communication that you thought came from a superior.

Manoj Tandon:
Adam, did you see recently there was a huge breach with a deep fake in a Hong Kong bank via a video call? They used deep fakes to imitate senior management and the fellow sent $25 million willingly. No hack required.

Adam Levin:
Well, it was a hack, but they didn’t have to get into the systems, bypass your firewalls, exploit a vulnerability. The vulnerability was the person themselves.

Wasn’t there there was oh the MGM hack that had recently, remember that?

Manoj Tandon:
Oh yeah, that was a help desk.

Adam Levin:
It that’s it cost a $100 million to the organization and they wouldn’t pay the ransom, at least they publicly said they didn’t pay the ransom, but with lost time, lost money, ATM machines going down, slot machines going down, and somebody just took 10 minutes, 10 minutes with somebody at the help desk. This is a training issue. When somebody calls you giving you a Saab story and you’re with a small business, just stop for a moment and say why would I do this, why should I do this, maybe I need to Buck this up to a superior in order for them to make a decision on this thing. I mean ransomware can kill an organization. What happened to MGM, if they weren’t stronger, could have destroyed the organization.

Manoj Tandon:
Well look at the stat in the SMB world is six months post breach most SMBs are out of business.

Adam Levin:
Yeah, yep, and that’s why people have to understand that this is a dangerous world. The people contacting you are not your friends.

Now if you want to take it to the saddest extreme, one of the guests on our show was named John DeMay. His son Jordan was a well-known case, came out of Michigan. His son Jordan went up from the dinner table, went online, thought he was communicating with a young woman. She—and I use the term she in parenthesis—got him to send a compromising picture. Almost two minutes after he sends the picture, he gets a DM and he’s told that it’s a scam. They have this picture that unless he pays them $1,000 they’re going to release this picture out to everyone that he knows on social media, that they already have that information. In fact, over a few-hour period they sent him a collage of pictures of people that are his contacts, that he is on social media with. He sent them $300. They said thank you, not enough. He said if you don’t stop I’m going to kill myself. They said go ahead, we’ll help you. And he shot himself to death. His father found him the next morning. The only mini-positive to this story, and there’s almost none, is that the FBI, working with Interpol, working with Nigerian intelligence, managed to track down the guys and extradited two of them to the United States. They’re standing trial right now in Michigan for the murder of this young man.

Manoj Tandon:
That is a horrific story. It’s one thing to lose your credit, it’s a whole another thing to lose your life.

Adam Levin:
Yes, and this is happening more and more. They’re targeting young men. The statistics are coming out: they’re targeting young men and young men are falling for it.

You know, I’m 74 and a lot of people go, well, seniors get targeted. Yes they do. It is horrible. It is tragic. But interestingly enough, more young people are falling for these scams now. Maybe it’s just because they’re reporting these scams as opposed to many elderly people who are embarrassed about what happened and don’t want to talk about it, but more young people are now falling for all forms of scams.

Manoj Tandon:
And you know Adam, it also could be that younger people have such a large digital footprint in comparison to seniors that it’s much easier to socially engineer a believable scam on them than it is a more aged person.

Adam Levin:
Well, and young people tend to be, when it comes to online communication, very trusting, which is very interesting, but they are. Whereas older people are at least becoming more cynical and skeptical about who they’re communicating with online.

And you know another rule of the road is: if anyone contacts you, I don’t care if they say they’re from the IRS, your bank, your favorite realtor, your favorite retailer, any of that, and asks you to authenticate yourself to them, you know one of the great and far-reaching Financial oriented scams is you get a call from your bank and they tell you that they’ve noticed some suspicious activity with your account and they would like to go through some of your transactions with you, but first they need to confirm you’re really you. So would you please take your credit, your debit card, flip it over and read them the security code.

So of course the first question is, you’re calling me, why do I have to prove that I’m me? You’re calling me. I’m not calling you.

And we’ve seen a derivation of this scam where it’s now you’ve given them your security code and they go yep, you are a victim of identity theft and we’re going to help you now secure your accounts, so if you’ll give us your social security number we will call the credit reporting agencies and have them issue fraud alerts. And then you give them your social security number. Now they really have you.

Manoj Tandon:
Yeah, now they have everything.

Adam Levin:
And what brings to mind is credit freezing. Freeze your credit. It’s free. You can now do it for your kids in most states. And you freeze it until you need it, then you thaw it for as long as the creditor is reviewing your file in order to make a decision on whether they’re going to grant the loan or not, and then freeze it again. And it takes minutes—I mean very few minutes—to freeze your credit, to thaw your credit, and to refreeze your credit. And it’s again one of those simple things. People go, oh my God, it’s going to take so much effort. It doesn’t. And trust me, it is nothing compared to the effort that you’re going to have to expend in the event you become a victim of a scam or a fraud.

Manoj Tandon:
And with that sage advice, we’re actually at the hour here, Adam. You’ve only scratched the surface of what you have to offer in terms of knowledge, but we thank you and we’d love to have you back and share further learnings and get into maybe a little bit more detail, especially with businesses as to what they can do.

But thank you for your generosity. We also want to give you a minute or two to plug anything you want to, to let our listeners know. Please take a minute here and let whatever you’d like them to know about.

Adam Levin:
Well, I would love you to come and listen to our show What the Hack with Adam Levin. It’s available wherever you get your podcasts and we have over 130 episodes that we have recorded now and they’re out there. We’ve gotten very nice reviews from people, and the whole point of the show is to educate people to understand that there are horrible things going out there and that many people have suffered through them.

But we use it as a way—it’s a catharsis—for people to talk about what happened and to do what so many people do who suffer these incidents: they want to talk to other people because they don’t want other people to have to endure what they endured.

So we have everyone from Al Franken and Roy Wood—and those are very funny shows—Dan Ahdoot, who’s a comedian who had an incident, all the way to people like Teresa Payton, Nicole Perlroth of the New York Times, Kashmir Hill of the New York Times, Michelle Dennedy, who had been the Chief Privacy Officer of Sun and Oracle and Intel.

So we have interesting people, interesting situations, some very tragic stories, some actually funny stories that people kind of chuckle about as they’re explaining what happened to them and they can’t believe they fell for it. But come join us: What the Hack with Adam Levin, Apple, Spotify, or wherever you get your podcasts.

Manoj Tandon:
Fantastic. We’ll link that in the show notes as well. Adam, you’ve been fantastic. Thank you for the fine work that you’re doing and trying to keep all of us safe.

Adam Levin:
Thank you so much for inviting me.

Manoj Tandon:
Thank you.