Security Confidential S14 E3 Scott Augenbaum

Manoj Tandon (00:13.764)
The FBI, he is a keynote speaker. He’s a cyber crime prevention trainer. He’s an entrepreneur. He spent 30 years of his life handling cyber crime in his career. He’s got a book out.

The Secret to Cybersecurity, which will ask him about a simple plan to protect your family and business from cyber criminals. And he is going to present us with some very practical things. And I would advise you all to listen to him as to what he has to say and make use of his advice. Scott, welcome to the show. Thank you for being here.

Scott Augenbaum (00:56.932)
It’s great to see you. I know me and you were looking at each other. Do you see the big smile on my face?

That’s because I’m retired from the FBI. And the number one question I get from people is, do you miss the FBI? And I go, are you out of your mind? And let’s get the record straight. I had an amazing 30 year career with the FBI. I spent the majority of my career on the investigation of cyber crime. If I had my life to do it all over again, I would do the same thing. I love being an FBI agent. I know there’s a lot of stuff in the news.

Manoj Tandon (01:07.026)
I do!

Scott Augenbaum (01:34.244)
The reason I don’t miss the FBI is because I’ve taken the best parts of my job, which is sharing what I’ve learned and educating people. And I have one goal here today for your listeners and for you. I’m going to teach you how to reduce your chances of being the next cyber crime victim. Let me ask you a question. How many people in the marketplace make that claim?

Come on, everybody says they’re gonna reduce your chances of being a victim.

Manoj Tandon (02:01.618)
not too many, not too many.

No, well, they say that we’re going to reduce your cyber risk is what everybody says. But there are no that. But a reduction in risk doesn’t always correlate to a reduction in you being a victim of cybercrime, because you may not be reducing the right risk. Right.

Scott Augenbaum (02:20.356)
Absolutely. But what if I made this claim and maybe you can call me crazy. It doesn’t matter. I teach people how to reduce their chances of becoming the next cyber crime victim without them purchasing products or services or having a PhD in computer science. I’m not saying you don’t buy products. I’m just saying.

Good! No, I don’t mean it like that. I’m oversimplifying it. But let me tell you what I just…

Manoj Tandon (02:46.386)
Now you just pissed off a whole bunch of people, Scott, who make it their lives.

Manoj Tandon (02:56.242)
I know, I know, I know what you’re saying, but are you inferring that that cybersecurity is not a tech problem and it’s actually a people and business problem?

Scott Augenbaum (03:00.036)
Did you just read my mind or is it on my forehead? I mean, I am telling you right now that during my decades with the FBI, I’ve interviewed thousands of cyber crime victims. I discovered a bunch of things, but let’s just, let’s talk about the scope of the problem. I retire in 2018. I don’t think the problem can get any worse in 2018. According to cybersecurity ventures, the problems is a three million global problem. I’ about this in 2015. I’m we’re in 2024.

Manoj Tandon (03:52.594)
it’s not getting better. It’s the ransomware as a service has continued to grow. And if you look at the insurance payouts, they have, they have continued, the claims have continued to grow, but their payouts have actually gone down because they are finding ways to not cover the additional losses that are happening. So I guess it’s not getting that much better, Scott.

Scott Augenbaum (04:12.612)
But what does it mean when the amount of money we are spending keeps getting, we keep spending more and more money and the problem keeps getting worse. So let’s just think about this. We got a cyber crime problem going up and we have the amount of money being spent on products, services, insurance, even retired FBI agents who speak for a living and sell books. Look, I’m part of the same information security marketplace, but what does it mean to you?

If we spend more money to reduce our risk and the problem keeps getting worse.

Manoj Tandon (04:55.41)
It means that we are not focusing on the right thing and we’re just throwing good money after bad.

Scott Augenbaum (04:57.476)
I’m going to tell you what it means in my mind. It means what we’re doing isn’t right. It’s not working. And that’s what I really want to sit down. And that’s why I’m so excited that you brought me on here today. Because I share kind of an unorthodox story on cyber crime prevention. But it’s based on what I’ve learned during my decades with the FBI. Because I had a chance to look behind the scenes.

Manoj Tandon (05:24.082)
So, you know, I, I, I, Scott, I got to ask you a question here. When you started with the FBI were on, were you on the computer side or did you

Scott Augenbaum (05:28.548)
I started with the FBI, but that’s another question I get all the time. Scott, did you always want to be an FBI agent? And I go, no. I graduated high school in 1985. OK, so I’m Gen X. I was raised by a single mom and there was no such thing as helicopter parenting back in the day. OK, when I went from seventh grade to eighth grade, she was just really, really happy.

Manoj Tandon (05:53.65)
No there wasn’t.

Scott Augenbaum (06:12.452)
Here I am, I’m growing up in Brooklyn, New York, raised by a single mom. She was just happy I was going from seventh grade to eighth grade. I went to community college, I didn’t do very well. She filled out an application for me to be a file clerk with the FBI in 1988, making $5 .50 an hour. And my mom…

Manoj Tandon (06:14.514)
Well, it’s okay.

Scott Augenbaum (06:39.332)
gonna be 89 years old, still loves to tell the story that it was part of her grand plan to keep me out of jail and to keep me away from my pothead friends. That’s how I got into the FBI.

Manoj Tandon (06:58.162)
Wow. That’s a… So she played the reverse. Instead of being the guy in jail, let’s… Why don’t you guard the guys in jail or put them there in the first place and then you don’t have to be…

Scott Augenbaum (07:03.652)
Yeah. But when I got into the FBI, I was surrounded by a lot of positive role models. I went back to college at night. I spent six and a half years as a clerical employee with the FBI, worked on an MBA in finance and technology in 1992, where we were learning that the business units were having a hard time talking to information technology units. Let me ask you, 32 years later, how are we doing with that situation?

Manoj Tandon (07:36.146)
Probably not that much better, to be honest with you. Probably a little worse because on the bad guy side, they’ve gotten much more sophisticated. The technology has lent itself to a lot of automation, which has allowed the scaling up of criminal operations and the extraction of a lot. Yeah, please.

Scott Augenbaum (07:36.46)
Yeah, so and we’re going to talk about that because a lot of what I talk about is the same as it was 10 years ago. So I become an FBI. Yes. I become an FBI agent in Syracuse, New York. But yeah, as we hit on that point, I go over to people and I, you know, I do live presentations for a living. And I was from an audience that I got in front of eight years ago.

Manoj Tandon (08:10.258)
Really?

Scott Augenbaum (08:22.852)
I go, hey, how many people here heard me speak eight years ago? A handful raised their hands. I went like this, I don’t have anything new to talk about, except I’m gonna throw a couple of terms at you. I’m gonna use artificial intelligence, I’m gonna use crimeware as a service. Everything we’re dealing with is still the same as it was eight years ago. Just the automation is different. The automation, the, so, but when I get into cybersecurity back in the early days of the FBI, I was the only guy in the office with advanced computer skills in 1997. Can you tell me what, what do you think was an advanced computer skill in 1997?

Manoj Tandon (08:47.026)
There you go. You knew about TCP IP networking. You knew about, active directory understood windows a little bit. understood how you were going to, how connections and packets worked across the internet. how signatures, signatures work. That, that to me would be someone with some more than basic skills.

Scott Augenbaum (09:22.788)
I was the I was the only guy in my office. I’m the only agent in the Albany division with advanced computer skills. I knew how to use Windows 95 and get AOL to work. So by default, I became the cyber guy in the office, which was not the cool and fun, sexy job to have. If you ask me to find the role of an agent in 95, I’m gonna tell you how easy it is.

Manoj Tandon (09:53.138)
That’s awesome.

Scott Augenbaum (09:58.82)
Bad people did bad things to good people. I worked with state and local cops. We put bad guys in jail. What a fun and exciting job. I was a 27 year old kid from Brooklyn, New York, a gun of bad. The harder I worked, the more bad people I put in jail, the better I felt about myself. And that’s a part of my origin story here, was crime was very different. Because back then we were chasing thrill seekers and amateurs. If you go back in time, what do you remember from the late 90s, early 2000s about the role of cybercrime? We weren’t even calling it cybercrime.

Manoj Tandon (10:48.37)
and it would have been.

guys hacking into various private and government entities just because they could and to prove that they could. Mostly very young kids with a very high IQ who didn’t all they a lot of them didn’t even have mal intent they just did it because they wanted to see if they could.

Scott Augenbaum (10:56.708)
Yeah. Let me tell you a funny story about that. It’s probably right after Y2K. I get a call from the National Infrastructure Protection Center. This is before the Department of Homeland Security. They tell me there’s a young man over at Potsdam University, which is about two hours north of Syracuse, where I was stationed. They told me he was trying to gain unauthorized access to the Cape Kennedy Space Center. And they gave me one bit of instructions.

neutralize the threat. What does that mean to you? Yeah, but my neutralizing the threat was playing social services worker because there were no crimes and I had to go up there and kind of yell at the kid. And you know, that’s not while I joined the FBI to kick down the door of some kid in feet pajamas. And here’s the funny part to this story. So I kind of had a nice, I had a nice conversation with him. It’s the same conversation that I had with my boys, you know, not to do drugs. Okay, is that kind of, you know,

Manoj Tandon (11:50.962)
Neutralize means someone’s getting a bullet put in their head.

Scott Augenbaum (12:19.012)
235 pounds, six foot three, New York guy. Couple of days later, I get a call from the kid’s mother and she’s pissed. I go, what’s the matter? She goes, my son hasn’t come out of the house in three days. I said, what’s the problem? Yeah. I go, what did I have to do with that? She goes, you yelled at him and you said that there was going to be FBI surveillance vans around the clock following him. And I was like, well.

Manoj Tandon (12:22.706)
Yeah. Well, that’s a good thing.

Scott Augenbaum (12:48.74)
I guess maybe I did say that’s a good thing. There were no cameras and cell phones back then. But I was like, no, that’s we’ll call it off. But that’s what we were dealing with. But cyber takes a sinister turn about the time e -commerce comes around about that time, because now it changes on the way on how we access money. And now the thing that applies to every bit of crime that I dealt with, which wasn’t violent crime, which was white

Manoj Tandon (12:56.754)
Ha ha ha!

Scott Augenbaum (13:17.924)
in 95 to 2000 is what we deal with today and it’s all social engineering and that’s where things go. Okay? So cyber, the FBI forms a cyber division after the events of September 11th and the number one priority for the FBI is preventing terrorism, counterintelligence is number two and cybercrime is number three.

Manoj Tandon (13:42.482)
Okay.

Scott Augenbaum (13:47.3)
And that’s when I embark on my journey in 2003 to really get into the world of cyber crime. And when I got accepted to FBI headquarters as a supervisor, most of my peers made fun of me. They told me the cyber crime problem will go away by 2007. It will be solved by guess what? Technology.

Manoj Tandon (14:07.346)
you

Scott Augenbaum (14:15.492)
Let me ask you, how’s that working out for us?

Manoj Tandon (14:18.162)
Yeah, right. Well, it’s never been

When has the taking of money, whether it was in the 1800s, 1700s, 1900s, or in the 2000s, ever been a pure technology play? It’s always…

Scott Augenbaum (14:35.14)
Well, now it’s technology assist in it because now, unfortunately today, what we have is every 13 year old has been Mo, every 80 year old has been Mo, and so many of us are caught in this generational gap where, and this is what I love to talk about is we have kids we need to protect and we have elderly family members. We need.

Now, I’ve been through a lot of victimizations and if your business is the victim of cyber crime, you’re going to be okay. But let me tell you, just yesterday, I dealt with, and this is going to kill me to tell this story because it’s been ruining my trip, I dealt with a friend of a friend who, elderly gentleman in his 70s, finds somebody that he meets on LinkedIn.

who convinces him into investing into a cryptocurrency scam. This is called pig butchering. I don’t know if you’re familiar with pig butchering. We can go into this. But let me tell you.

Manoj Tandon (15:36.594)
Okay.

Scott Augenbaum (15:45.988)
Three months later, the guy’s out $6 million. And this is going to go into the four truths of cybersecurity, which is what I want to talk about. But I’m trying to convince this person that this is a scam and he will not listen to me at all. And his friend called me up.

Manoj Tandon (15:58.034)
Yeah, please.

Scott Augenbaum (16:06.564)
I’m sorry.

Manoj Tandon (16:07.922)
What’s his basis for that?

What’s his basis for this alternate reality that I mean, you take cryptocurrency and you put investment together. You have to be suspicious with just those two words right there.

Scott Augenbaum (16:19.556)
Well, it’s the fear of missing out. So let’s kind of talk about this for a second. So the crypto card. Well, listen, people can debate all day long if crypto is a scam or crypto is not a scam. If you invest in crypto, good luck to you. I know people who do. I’m not against that. But I’m talking about people investing money that they believe is going into crypto. So here’s how the scam works. It’s the oldest ploy in the book.

This has been going on since 1800. It’s a pretty girl who befriends an elderly guy and they have conversations. She says, I have an elderly uncle who’s a wizard in cryptocurrency. She sends him the link to this guy who appears to be a whiz. She has him download this app, which is nothing more than a fictitious app. She goes, look, I’ll invest in it with you.

So she puts $500 of her own money into the app. So he believes, he believes because he’s seeing the screen, three days later, it goes up to $1 ,500. Then he starts putting in a little bit of his money. He puts a thousand and it goes up to 3 ,000. So he puts 10 grand and it goes up to eight. Then it keeps going up and keeps going up.

Here’s where it goes. They start telling him that if you leverage money and options, you can get some really amazing things. So at the end of the day, his crypto account balance on this app says he’s up to $200 million.

every single day and this guy wants to mortgage his house because they keep telling him all you need to do is cover the margin call by 250 ,000 and you will get your money out. This guy doesn’t realize he’s lost everything. This is my world. This is what I’ve dealt with my whole career.

Manoj Tandon (18:49.33)
Now, Scott, that’s a horrible event that happened. But I have one side question there is how much, how large a scam does it have to be before the FBI actually gets really interested in the problem themselves?

Scott Augenbaum (18:59.856)
Okay, let’s talk about that. You’re familiar with my four truths, right? Okay. All right, so let me just explain to you because repeat your question one more time when the FBI gets involved. So tell me.

Manoj Tandon (19:09.586)
Yeah, how big a number does it have to be before the FBI really takes it on and says, okay, we got to look into this, what’s going on.

Scott Augenbaum (19:24.592)
Okay, perfect question. So now I want to apply to you what I call the four truths about cybersecurity. This is what I’ve learned during my decades with the FBI after responding to 1 ,000 cyber crime incidents. And I’ll put it this way, I think in the past six years I responded to more because now I get victims who talk to me. So this is, the FBI has already been involved.

Manoj Tandon (19:37.522)
Okay.

Scott Augenbaum (19:52.048)
So let me tell you the four truths because this is going to be really important. Truth number one, and I’m going to stop and I want to talk to you about each truth. None of my victims ever expect to be a victim because they do not fit the victim profile. When you talk to small and medium sized businesses in what you do for a living, do they ever expect to be a victim?

Manoj Tandon (20:05.298)
Please. Yes. No, that’s the biggest pushback we get is, hey, I make pipes. I mean, who the hell cares about me? But what they don’t realize is that you make pipes for Westinghouse. So it’s not you that they care about. You’re a conduit into what they do care about.

Scott Augenbaum (20:30.092)
Exactly. And I just want to say when it comes to that, every time I interview the victim, how did this happen to me? Why did this happen to me? I didn’t fit the victim profile. I’m a small business. I’m a non -profit organization.

I’m a religious institution. Nobody’s targeting me and those were my worst victims. And in Nashville, I’ve interviewed, I talked to hundreds of healthcare companies where the Silicon Valley and they all said, we don’t fit the small, we don’t fit the profile. I had one company was a $300 million company. They told me they’re a small business. Why should they be concerned? Well, compared to a…

Manoj Tandon (20:49.426)
Yup.

Manoj Tandon (21:12.85)
We hear it all the time. We hear it all the time. And what they don’t do, that’s a failure of recognizing what’s of value in your organization. Understanding your people, who in your organization is connected to who, that is something I would take stock of. Looking at if your data has been breached out there, you know, maybe you didn’t get a breach, but…

Scott Augenbaum (21:27.12)
Mm -hmm.

Manoj Tandon (21:39.026)
The insurer that insures you as an example, they got breached. And now every bad guy knows what your cyber liability policy is and you just gave them X number of reasons. If it was $2 million, they have $2 million to ransom for you for it.

Scott Augenbaum (21:49.36)
Yes, exactly.

I’ve been dealing with this my whole career.

Manoj Tandon (21:55.25)
How do you, you know, we could go down this list. There are so many ways to look at this, Scott, that that’s just a failure of imagination on their part to actually understand the value of their organization.

Scott Augenbaum (22:04.656)
Well, and I’m going to explain this to you because honestly what I’m doing right now and I’m doing this to all your users and you, you don’t even know what I’m doing. I am trying to change your mindset because here’s what I need to do first. As we go through this, I need to explain to you that there’s a cyber crime problem getting worse. I need to explain to you that people keep spending more and more money to.

reduce victimization and it’s almost an inverse relationship. That’s the first part of what I do when I get into an audience and I try and we’re going behind the scenes, but this is what I do during.

Manoj Tandon (22:48.082)
And you know what, Scott? Have you heard of the prevention paradox?

Scott Augenbaum (22:50.032)
Go ahead, explain it to me.

Manoj Tandon (22:56.914)
So there was a study, the prevention paradox is a term that was coined by the US Air Force. So they did an extensive analysis and study and what they came out with was the prevention paradoxes, the more you focus on prevention, the less secure you actually become.

Scott Augenbaum (23:11.024)
Really? That’s interesting. Well, that’s going to not go in. So keep that in the back of my mind. Let’s talk about that after the fourth truth.

Well, no, no, no. I mean, I think we can turn this into a telethon here because that’s the first truth of cybersecurity. None of my victims ever expect to be a victim. They don’t think they fit the victim profile. If you have email, you got a bank account, you’re fit the profile. The second truth about cybersecurity is when the bad guys steal your stuff, they steal your data.

Manoj Tandon (23:22.642)
Yeah, let’s talk about it because it gets really deep as to how they came up with it. And you.

Scott Augenbaum (23:44.656)
They hit you with ransomware. And let’s say somebody’s sitting here right now and they go, well, I don’t have a company. I’m not the owner. I don’t like my job. Well, they’re going to hit you. You’re going to be the victim of identity theft. Your kids are going to get victimized. Your elderly parents are going to be victimized. And when you contact law enforcement, we do not have a reset button to make the problem go away. We are not getting your money back, OK, or your stolen data back.

It’s gone, it’s gone. Truth number two. Let me ask you, when you’re dealing with your intrusion response for your clients, when they lose their money, how much money have you ever gotten back for a client?

I’ve mine is next to nothing.

Manoj Tandon (24:32.754)
Most of our, you know, we’ve had maybe an instance or two where the FBI actually got involved and they…

Scott Augenbaum (24:36.208)
And I’ve recovered quite a few and it was all for luck. It was luck. I’m going to be honest. So let’s go to the third truth. The chances of law enforcement putting the bad guys in jail is slim to none because the threat actors are located overseas. They’re located in Russia. They’re located in China. They’re located in West Africa, Iran.

Now we’re dealing with Southeast Asia for the pig butchering scams, even though the FBI and the Secret Service do an amazing job of putting bad guys in jail and disrupting networks. I mean, last week I was quoted in Bloomberg. They asked me, what did I feel about the fact that one of the ransomware gangs was disabled? And I said, great work on the part of the US government, but it’s the same thing in tackling the drug cartel.

You take one down and another comes up. So let’s, let’s focus on this. And I want to ask you, problems going up. It’s getting worse. Nobody expects to be a victim. Bad guys get your stuff. Law enforcement’s not getting it back. The chances of law enforcement putting the bad guys in jail is slim to none. How does it make you feel?

Manoj Tandon (25:37.586)
Yeah.

Scott Augenbaum (26:02.768)
Okay, let’s talk about the fourth truth to cybersecurity and compare it to what the Air Force says. Okay, here I am, I’m dealing with cyber crime victimization. The harder I work, I have to tell people I can’t put the bad guys in jail and I can’t get anyone’s money back. I remember one day it all clicked for me and this was when I had my major epiphany. I’m sitting with a victim.

Manoj Tandon (26:03.382)
Pretty defenseless against cyber crime.

Scott Augenbaum (26:31.44)
He goes to Google, he’s looking for an investment for a certificate of deposit. He hits the first link, he finds a bank in California. He talks to them, he does what he believes is his due diligence. And he wire transfer $700 ,000. Three days later, the bank’s website goes back, nobody returns his phone calls, they contact us.

And now we’re off to the races getting grand jury subpoenas tracking the money. Because you know, there’s a money trail, you know, that’s what we would do. We would track the money. So we track the money from his bank in Tennessee to a bank in New York to a bank in California. And then we lose track of the money at a bank in Georgia. The country of Georgia. And I’m sitting here with the family members and the family members are going like this.

They’re beating the living heck out of me. They’re saying, I don’t understand. You’re the FBI. You can’t get our money back. You can’t put our, you can’t do anything. I find that hard to believe. And I just wanted to say, if your dad just would have done these couple of things, it would have been prevented. And that’s when I had the major epiphany. And I went over and I realized that almost 90 % of what I dealt with,

easily could have been prevented if my end users were only armed with a couple of key pieces of information. And in that time, that was when I decided that that’s what I love to do. I went out and I educated every person that I can get in front of saying, hey, here’s what you need to do. Here’s here. Here are the steps. Take these steps.

and you can apply them in your life and you could prevent victimization. The other 10 % is kind of hard. So that’s when I had my discussions with the insurance companies because let’s just go through right now and this is where I can change behavior.

Scott Augenbaum (28:39.024)
If I can go back in time and I can spend 10 minutes with a victim, I could give the victim eight to 10 points that would have prevented 90 to 95 % of cybercrime victimization. And all I have to do is ask an audience and say, can you, do you mind if I tell you what my stories were? And I have an entire audience going like that.

Manoj Tandon (28:56.402)
Wow.

Scott Augenbaum (29:08.848)
And that’s why I wrote the book called The Secret to Cybersecurity. And let me tell you, I don’t even want to sell it to your users. I’m going to have them connect with me on LinkedIn or somewhere else. And I’ll give them a free audio copy. I recorded my book. So I wrote a book called The Secret to Cybersecurity, a simple plan to protect your family and business. If you’re looking to read a good book by an FBI agent who’s really technical,

Manoj Tandon (29:08.946)
No.

Scott Augenbaum (29:38.672)
really uber smart and put a lot of bad guys in jail and save the day. I just want to tell you right now, don’t read my book. I’m not your guy. I’m not your guy. I’m the guide in this. I realized that most stuff could be prevented. And that’s what I want to focus on. You don’t even need to read it. Take control over this interview or I’m just going to go on on a monologue.

Manoj Tandon (29:54.418)
So you know what Scott, Scott, so let me, let me back up for one second so we can, I want to.

No, no, I want you to talk. I mean, I’m not going to get in the way of a guy from Brooklyn. What the heck? Although I’m from Cleveland, so, you know, we’ve got our own. Yeah. So I just want to reiterate the four truths back and make sure I got this right. OK, and make sure our audience gets it. Truth number one, I don’t fit the victim profile.

Scott Augenbaum (30:08.656)
come on, that’s tougher. You had like effects. No, we didn’t. Nobody expects to be a victim. Truth number one.

Manoj Tandon (30:38.226)
Nobody expects to be a victim, right? Truth number two, data and money that’s gone, it’s gone. It’s not coming back. Can’t get it for you.

Scott Augenbaum (30:44.112)
And also remember this one thing, forget about your business. This is your personal life too. Your kids are hurt, your elderly parents are hurt, you’re hurt. That’s it, no reset button.

Manoj Tandon (31:01.522)
No reset button. Truth number three. Chances of the bad guys getting put in jail is zero to none because

Scott Augenbaum (31:06.352)
I’d say Slyndonanda. I don’t like to take that away. The FBI and the Secret Service doing an amazing job of really, they’re working their tails off, okay?

Manoj Tandon (31:21.906)
Absolutely, but the kicker is truth number four, that 90 % of cyber crime could be prevented if people could understand key behaviors, eight or 10 points, that if they followed, they wouldn’t be a victim in the first place.

Scott Augenbaum (31:34.032)
Yeah.

Yeah, but it’s not as easy as that. Listen, I’ve been trying to get off that extra 12 pounds since I was 13 years old. I know what I need to do. You know, I read lots of books and that’s where I incorporated what I call the cyber secure mindset. It’s just being aware of what are these key points? What are the things that we need to do? And unfortunately, you know, so many companies are getting off or getting, you know, check the box.

type compliance awareness.

Manoj Tandon (32:11.25)
my God, those ones drive us crazy. Because they don’t really care about cybersecurity. They’re like, my insurance company says, do I check this box? My third party vendor compliance program says, do I check this box? But checking that box doesn’t actually help them.

Scott Augenbaum (32:28.176)
Okay. So now I’m going to ask you to do something that you probably didn’t expect the retired FBI guy to do. Can you play, can you play therapist with me? Can you help me? All right. But talk to me in the world of cybersecurity because I’ve been getting really frustrated lately because I’m trying to help a percentage of the population that doesn’t want to be helped. Everybody wants an easy button.

Manoj Tandon (32:38.706)
Okay.

Scott Augenbaum (32:56.4)
Everybody wants a pill. Everybody wants a piece of magic software. And let’s even talk about that in one of the key areas here where it doesn’t exist, because I know you’re probably familiar with products. So let’s talk about this. Everybody wants the easy button for social engineering. I just did an hour talk track because I’m a content creator. I did an hour talk track.

Manoj Tandon (33:21.042)
everybody.

Scott Augenbaum (33:23.568)
on social engineering, cybercrime, and the world of AI. So let’s talk about social engineering for the next couple of minutes. Because everyone goes, what should I buy to prevent social engineering? And I want you to look at this from an insurer’s point of view. First of all, social engineering is the number one tool in the cyber criminals tool belt. Let’s forget about network attacks for a second, OK?

Manoj Tandon (33:35.73)
Okay.

Scott Augenbaum (33:51.344)
You’re going to get an email from somebody you know and somebody you trust. Well, I got a great email protection product that has AI. Now they’re going to go to text messages. okay. That’s a little different. Then they’re going to go to telephone calls and robo calls, all with the use of artificial intelligence. Then you’re going to deal with pop -ups on your computer. Then you’re going to deal with third party.

your third parties that are compromised and they’re getting into the Slack channels and everything like that. And because of those, and also malvertising through websites. So you have six things, real main points here. And then I have about eight or 10 different types of romance scams, work from home scams, phony invoice scams. So let me ask you, what kind of product should somebody buy for that?

to eliminate all their risks.

Manoj Tandon (34:55.89)
a good brain and a mindset to just be vigilant. To me, it’s no different than don’t walk down a back alleyway in Philadelphia at night. Don’t do it.

Scott Augenbaum (35:04.016)
I know, and that’s what really comes into it because a lot of times that I’m sitting here and trying, because it all goes back into point number one. Now, when people listen to me, and I want you to remember this, this is where the behavior change goes. When I tell this story, they go, it’s not gonna happen to me. I talk to my 89 -year -old mom all the time. She goes, Scott, what are you carrying on for with this cyber crime stuff?

I only have $1 ,200 in my bank account once a month from Social Security. I go, Mom. She goes, they only want to target the rich. I go, Mom, what if you don’t have your $1 ,200? it’s not until that. People don’t do things until they’re victimized. And then they run out and they buy like LifeLock after the fact.

Manoj Tandon (35:57.138)
Well, I’ll tell you, some of our best customers are those that called us after the horse left the barn.

Scott Augenbaum (36:00.944)
And I tell people right now.

Manoj Tandon (36:06.514)
And that’s really terrible actually, because when you try and do it beforehand, it’s like, well, eh, we don’t need it. And what they don’t realize is that I’ve had people tell me that, well, you know, they got insurance and that’s gonna cover it. What they don’t realize is the insurance companies in a lot of instances have limited their payouts to 30 % of the amount.

Scott Augenbaum (36:26.992)
And who’s going to cover this guy for losing $6 million or this other one for $14 million? The bad guys are attacking the end users. The bad guys are going after his companies are getting better. They’re going after us. They’re going after our family. It’s the same scams that I’ve seen for decades, but now it’s getting into the hands.

Manoj Tandon (36:35.826)
Nobody

Scott Augenbaum (36:53.872)
of unsophisticated individuals and now they’re targeting high net worth individuals. So maybe as a business owner, you’re gonna do everything in your power that you think you could do. You’re gonna do your risk assessment. You’re gonna do your network segmentation. You’re gonna have your MDR, XDR, EDR, and two -pronged.

Manoj Tandon (37:15.954)
Yeah, and you know what, Scott, I hate to say it, we’ve done all that, but we even in our own company had a more senior employee who got, thankfully, it was a very small amount, but they ended up buying gift cards and got.

Scott Augenbaum (37:28.912)
Yeah, I just dealt with that the other day. And these are the types of things that people, you know, I just built a customized cybersecurity awareness course for a client on one very specific healthcare thing. And they came back to me and I said, look, it’s too long. You know, we just want to give out people 30 minutes worth of training a year. And I’m going to be honest with you and what I do, that’s not my ideal customer.

You know, I’m blessed. I have great retirement. I get paid. I speak all around the world. I go over, I, you know, and to me, everything I do is all different because next week I am going over and I’m speaking to a group of small business owners in a conference in India, in Indianapolis. Then I’m speaking to a group of

credit unions. Then I’m speaking in the real estate sector. I was just brought in by a bunch of small doctors offices, you know, in the light of everything. But you know what? Listening to me speak for 45 minutes, reading my book is not going to do it. It’s a commitment to change and it’s a commitment to changing your mindset. And that’s why I asked you as my therapist for the day. I don’t know how to do that. I mean, I try my best.

Manoj Tandon (38:57.85)
I think we have to say it again and again and again, and when they get tired of hearing us say it, Scott, say it some more, and then maybe they’ll start listening, right? That’s the old adage there. And just keep illuminating the problem.

Scott Augenbaum (39:17.968)
Well, and that’s what I keep doing. And now I keep getting brought in. I keep getting brought in to do things and I keep getting hired. And here’s one of the problems that I see, you know, and this is interesting. I love doing podcasts, but I never know where I’m going to go. I get brought in and I’ll give you a perfect example. I get brought in to do a conference and I go, this is great. Give me 90 minutes to do what I do.

And then I’m going to record a webinar for your employees on how to prevent keeping your kids safe and keeping your elderly parents safe. And the conference organizer goes like this, we just want to give you 45 minutes. And then I keep forgetting, like I was in the government and I’m talking about the private sector and now.

I’m like, I guess you’re supposed to do the least amount of work. Nobody has ever taken me up on keeping their kids safe and keeping their parents safe. Nobody.

Manoj Tandon (40:22.514)
So, you know, I wanna make sure that you get to put some tips out there, otherwise we’ll run out of time, and I want…

Scott Augenbaum (40:23.952)
I’m going to send you a bunch of things that you could provide to your attendees. I’ll give them an opportunity to link up. I mean, this was so great talking to you. We went off topic. But here’s my big thing that I really like to tell you.
Because you know what, I’m gonna give you a link that you can get a copy of my audio book for your listeners if they contact me directly. But I can monitor who listens to the audio book. Nobody listens to the book. You know, that’s the problem. But here’s what I need to tell you. Social engineering, number one tool in the cyber criminals tool belt. Number two, the account compromise. The theft of a username and password is the biggest.

Manoj Tandon (40:45.202)
Give us some advice. Yeah, some key things here, please.

Scott Augenbaum (41:14.672)
causes the most loss of data or loss of money. The other thing is password reuse. Are you using the same password for multiple platforms? Are you one of the, okay. You need to have a strong, robust password. And here’s the biggest indicator. If you are not using two factor authentication on all of your remote platforms.

Manoj Tandon (41:32.146)
Absolutely everybody is. Yeah, password reuse.

Scott Augenbaum (41:43.376)
I don’t know how to sugarcoat this. You’re going to be a victim, your life’s, that’s it. None of my victims, whenever I talk to them and they, I had this gentleman who got hit with a scam the other day, bad guy’s got in his bank account. And I said, did you put two factor authentication on? He goes, no, I never thought I’d be a victim. Now he’s out $47 ,000. And understanding the social engineering side, I know that’s oversimplifying it. I know that’s oversimplifying it.

But now for the people who call me, that’s the thing. That’s what hits them up. I’m gonna send you that list. You can post it on your website. I’m gonna send you the outline that I did on the social engineering talk with the bullet points. And when you contact me, people contact me all the time on LinkedIn. And I’m hospice. I can’t help them. And maybe if you can get the FBI interested in your case.

Manoj Tandon (42:16.306)
Yeah.

Scott Augenbaum (42:41.872)
You’re not getting your money back. I mean, I hate to say it. So why don’t we take some prevention steps now? This is the endless loop that goes in my head all the time.

Manoj Tandon (42:58.13)
Now, that’s now would you mind if we actually sent a note out to some of our subscribers and said here is a link to a free audio copy by Scott.

Scott Augenbaum (43:05.68)
Yeah, sure. Sure. We’ll do it for a yeah. We’ll call. Yeah, no, absolutely.

Manoj Tandon (43:13.746)
It’s a public service for us. This is a public service kind of a thing, but you bring up like social engineering is a

Scott Augenbaum (43:15.408)
Yeah. And you want to know why I don’t, you want to know why I don’t sell the book? I like that way because I’m afraid nobody will buy it. And then I’ll feel really bad. You know what I mean? Then I’ll feel like I’m going to be honest with you. Like I don’t sell books. I do. Listen, I’ve been, I’ve been doing great with my book. I usually include those in with engagements and stuff like that. People buy it on Amazon.

Manoj Tandon (43:25.65)
Why? I think you might have a bestseller on your hand. You know, we had.

Scott Augenbaum (43:43.632)
I recorded the book and then I put it on a platform called Thinkific. Every once in a while I do sell it if I get brought into a situation and I give the money to my kids so they can run that side of the business. But I rather just, you know, engage with people because I’m on a passion project mission. I overcharge Fortune 500 companies. I joke around, but I do. They bring me in to do an hour’s worth of talk. And I do that so I can help fund what I love to do.

Manoj Tandon (44:19.25)
That is absolutely fantastic. And what you’ve said about social engineering is very, very true. I mean, we had an ex -CIA case officer on the show and we’ve had a naval officer on the show whose job it was to target people. And when they talk about how you compromise a person in their case, they’re on our side and they’re trying to compromise somebody in another country.

they’re doing a lot of the same things that some of the bad guys are doing in time to figure out what the connections are. How do you get to the target? What does that target interested in? You know, go through their junk, go through their garbage, go through and find out what’s going on and then carefully and meticulously engineer. It’s like threading a needle, an attack that eventually,

will lead to a compromise or an outcome that they’re seeking. And…

Scott Augenbaum (45:18.608)
Absolutely. And that’s why I call it the cyber secure mindset. You know, it’s just these 10 principles and now I’m building courses that I’ve been getting a little frustrated on it because nobody really wants a course. Nobody wants the education part of it. It’s they, they just want the easy.

do this and during my decades with the FBI discovered there is no easy button you know we need to people’s attention spans are limited so what do I do now as I joke with people I go just follow me on LinkedIn I do videos every day minute in length I go at least use those I get people tell me all the time that I’m giving away way too much content and I go it’s victim stories.

You know, and the more I give away to companies, companies call me up and say, hey, can you do this for me? And I’m like, sure. I never advertise. I never tell people to buy my books. I never tell people to hire me to speak. They all come to me. It’s a fun thing, you know, and I couldn’t do it without. Yeah, I’m having a blast.

Manoj Tandon (46:29.746)
So you’re doing something right. Scott, you have to. And you’re living in paradise at the same time. How could you go wrong with any of this?

Scott Augenbaum (46:34.736)
I am trying my best, my friends, and you know, it’s just to me, it’s, I really feel that when I was with the FBI, I couldn’t help enough people. So now it’s whatever I could do to share my stories, because I’ve become quite the storyteller. I have realized that as a guy who speaks way too much, I’ve learned how to make a living capitalizing on that.

Manoj Tandon (47:05.138)
You know what, I’d love to get you back to talk about your, just do a quick episode, like 10 stories, things that you have seen that you could share with people. From the group of people that said, we don’t fit the victim profile.

Scott Augenbaum (47:18.928)
And I have stories on companies that have been victimized to this day that I don’t really talk about because it’s inappropriate. But there’s a major breach going on as we speak where the former CEO of the company said to me, we’re a privately held company. Why would anyone want to target us? They were an $8 billion company.

Manoj Tandon (47:47.314)
Well…that is deeply unfortunate. That’s that mindset that you talked about that you want to change. Hey, we’re at the hour here, but I wanted to give a few minutes for you to plug anything that you’d want to. Are you making any appearances, any new books, anything that whatever you want our audience to know about. I want you to use this.

Scott Augenbaum (48:03.92)
I would follow me on LinkedIn. I would go to my website, cybersecuremindset .com, and I provide everything that you need on how to reduce your chances of becoming the next cybercrime.

Manoj Tandon (48:19.57)
Okay?

Scott Augenbaum (48:25.072)
And what I want you to do is take whatever you learned, whatever resources you have from me and share it with your family. Share it with your colleagues. Share it with dad. It takes a community to stay safe. That’s my big, that’s my big point here.

Manoj Tandon (48:46.61)
That’s fantastic. We appreciate the good work. And I hope people listen, you really got to the heart of the cybersecurity problem because the biggest mindset change we run into is that it’s a tech problem. It’s a guy in a hoodie in the back room that’s gonna solve it. And they will help, but they are not the frontline of this.

Scott Augenbaum (48:46.64)
Well, I appreciate it. I look forward to working with you.. And I’m oversimplifying the problem. You do need all these different things. But if you just don’t do what I tell you to do, and we can have a whole nother debate about the whole insurance thing. And I’m like, I look at people’s insurance and it’s not even covering. I had one company, they called me to help them. I looked at their insurance requirements and I was like, wow, they’re still going to insure you with this. You know.

Hey, listen, I know we’re gonna have a lot of more conversation.

Manoj Tandon (49:50.162)
I know we are too, Scott. You have been a fantastic guest and we are looking forward to having you back. I think we’ve just scratched the surface with the four truths. I think this needs a much deeper dive, but thank you for what you do. And we know you have to run, but we appreciate you spending a part of your afternoon with us.

Scott Augenbaum (50:06.928)
Thank you so much.

Manoj Tandon (50:13.394)
Thank you, Scott.

Scott Augenbaum (50:15.152)
Yeah, and let’s chat later or next week or something because.

Manoj Tandon (50:17.746)
That was great.