Title: Mike Hlavaty-Laposa – How Evolving Cyberthreats Impact Businesses
Guest: Mike Hlavaty-Laposa
Peter: Welcome to the Biz and Life Done Well podcast, where we explore what it means and what it takes to do business and life well. I’m your host, Peter Wilson. If you’re like me, you’re intrigued by stories of common people who have achieved uncommon success in business and life. Join me as I interview fascinating people about how they got started, their successes and failures, their habits and routines, and what inspires them. Today, my guest is Mike Mike Hlavaty-Laposa from TeamLogic IT.
He is the North Seattle and Eastside owner for TeamLogic IT. Hello, Mike.
Mike: How you doing? Nice to nice to be here, Pierre.
Peter: So today, we’re gonna talk about technology in relation to, you know, how businesses have adjusted in 2020, how they were forced to adjust, and then how they are using technology to both grow their business and protect their business going forward. So, you know, what are what are you hearing out there? What are you seeing out there? What what did businesses do in 2020 just to to get through?
Mike: So there was a wide variety of, approaches or things. Right? I mean, you know, once folks got over the initial panic or really got past the initial expectation of, oh, well, this is only going to take a couple of weeks or this is only going to be a month. Once it became more apparent that this was going to have a much deeper and wider set of effects, then folks started asking a lot of questions. And a lot of companies to include the big guys realized they weren’t ready for this.
You know, they they were not equipped for it. They were not trained for it. They didn’t have the capacity in place for it. And so a lot of adjustment, a lot of changes had to get forced into a very small slice of time. And that put a lot of pressure on folks.
So and then we had a, you know, unfortunately, you know, a large number of businesses that were either shutting down or scaling back quite a bit. And then it became a question of, okay, how can they keep going? Right. And so a lot of them had to transition to some form of online presence. Right.
You know, you think about the restaurants. Yeah. Of a sudden had to pop up online ordering websites so that Right. They could keep doing something.
Peter: Right. Yeah. Yeah. That’s, it was really an amazing year. One of the things that we did is we shifted our marketing focus to webinars and events like that to reach the audience.
Right. It was about a year ago we did a series called the small business, survival guide where we were just trying to let businesses know, you know, how to get through. We actually have those, webinars and podcasts archived. So if anybody wants to go back and listen to any of those, they’re there. So you’ve got a, a workforce that was all gathered in an office.
Right? Now you’ve got them all Yep. Spread out. So what what is what are the challenges that you saw with respect to cybersecurity? That
Mike: honestly was the largest concern that we had for, you know, our clients and really for, you know, any of the businesses that were out there. When when you transition out of the protected office, you know, because you’re firewalled and, you know, DMZ’d and, you know, all kinds of things.
Peter: A bunch of corporate assets that are protecting you in the four walls of Exactly. The Okay.
Mike: Exactly. And so, you know, you’ve you ended up with people all of a sudden having to work from home, you know, which was use that as the largest sample.
Peter: Yeah, of course.
Mike: You know, folks ended up going to, you know, anywhere they could pick up Wi Fi. Right. But at home, that, you know, they’re the largest problem is the lack of security. Most of us don’t have firewalls at our houses where we just have our Internet provider modem, whatever that happens to be.
Peter: In Comcast, I trust.
Mike: Well, yeah, Comcast, CenturyLink and, you know,
Peter: Zipline
Mike: now as opposed to Frontier or Wave. But their equipment is residential and so therefore not built to withstand a determined attack. Right. And what the hacker community has done, number one, they’ve organized. They’ve got LLCs that are hacker companies.
And it is actually, you know, some of us who have been in the industry for quite a while are kind of laughing. It’s just like all of a sudden, not only are these guys organized, they’re selling, you know, hacking as a service. So they’ve created these packages of tools and, you know, exploits and everything that you can if you know where to go, you pay on their licensing price and you just set it up and let it go. Yeah. And so you’ve got a lot more people now.
Yeah. Some of whom are more desperate, right? Because of the situation, you know, they don’t have a job or something. And so they’re just out there trolling the Internet. And most of our households are not protected against that.
Peter: Okay.
Mike: A lot of people don’t even know to put a password on their Wi Fi. Or if they do, it’s usually something pretty easy.
Peter: Password 123.
Mike: Yeah. Or like, know, for us, you know, it could be something as simple as HL Home. Right?
Peter: Right.
Mike: Which it’s not, by the way. Right. But, you know, you get those types of things. And so folks, now they’re doing business work at home and they’re accessing sensitive company information. They’re accessing really what falls under PII, possibly the PHI stuff, right?
So you’re starting to fall under regulations that you know, they’re they’re quite serious about. Yeah. So you’re not getting the level of encryption or the level of protection. The other avenue of attack that, you know, folks hadn’t really thought about was the sideways or lateral attack. Okay, you’re on your home network.
You have your business computer, your business computers got very strong cybersecurity software on it, etcetera. Your home computer or your kids, you know, Nintendo or Xbox do not. Oh, yeah. The exploits are coming in through other on the home network. Once they’re once they infect, yeah, now they can move across and infect the business computer.
Peter: Oh, man. I never now, knew that.
Mike: You know, your business computer connects to your corporate network. Well, it’s trusted. Yeah. But now it’s infected. And if your corporate network doesn’t have the right things in place.
Now you’re going to infect your corporate network or your business network.
Peter: Yeah. So so is is the is the CryptoLocker still the the, you know, the thing where you click on something and then everything on your hard drive gets infected and encrypted. Is that still one of the biggest sort of I know, like, two or three years ago, that was huge. Is that still
Mike: The ransomware type Ransomware. Of attacks.
Peter: Yeah. Is that still big?
Mike: Yes. In fact, it’s just it’s only gotten bigger. Okay. And but the nature of the attack and and the tactics that are being used have evolved a lot.
Peter: Okay.
Mike: And and and in two ways. One, the method by which they gain entry, is mostly through phishing emails now.
Peter: So it’s an email that
Mike: looks spear phishing. Looks like it’s
Peter: from Amazon or somebody or yeah. Exactly. And You click on something you’re not supposed to, and next thing you know. Right.
Mike: For example, I in fact, I had just got a call from a client who got an email that said something about their Apple ID. That’s that’s a very popular one. I don’t own an Apple. I don’t own an iPhone. So therefore, I don’t have an Apple ID.
Yeah. But three to four times a week, I get an email that says your Apple ID has been compromised. Please click here.
Peter: Oh, wow.
Mike: They’re getting better because most of these emails have typos and, you know, grammatical errors. Yeah. That type of thing. They’re getting a lot better. They’re looking real.
They’re looking real. They’re I mean, in fact, and I don’t remember exactly who it was, but there was a legitimate website that got hijacked and the email sent you to a website that looked exactly like the real corporate one. Yeah. But was not. Yeah.
And so if you entered any of your information into it, you were
Peter: you were done. It looks so what they did is they took a copy of the corporate website.
Mike: They took a copy of a corporate website.
Peter: It was not a bank. And the links probably look similar.
Mike: Yes.
Peter: I mean, one of the things that you that’s so easy to do is just look at the root domain of where Yes. You’re gonna click on anything. I mean, first of all, don’t just click randomly on stuff. But if you are But there are
Mike: people who really don’t you know, they’re they’re they’re trusting by nature. And, you know, if they see an email that comes in from Amazon or Apple or Microsoft or, you know, whoever, a company that they trust. Yeah. Right. You know, they’re going to look at that.
And, you know, obviously, if you kind of know that this is coming, the thing that we always tell folks is go click on the header of the email so that you see the real address. Right. Because, you know, the email systems allow you to put in a, you know, display name. Right. And so you may see the email come up and say, hey, this is Mike H.
L. And in reality, right, my address is, you know, about to hack you Right. Dot, you know, russia.com or something. Right? Yeah.
You know? So you have to kinda look at
Peter: that part of it. So so one of the ones that I just had happened to me last week was, a woman who works, with my mom, sent an email. Her email account was hijacked. It was Outlook. And it said, oh, hey.
I’m it just said, hey. Do you have a, do you have an Amazon account or something like that? That was it. Mhmm. And then I said, sure.
Why? I knew it was something. And they said, oh, I’m just trying to, buy some gift cards for my niece. I’m trying to do it online. I’m having a little trouble figuring it out.
Hey. Do you think you could help me out? If not, no biggie.
Mike: Right.
Peter: So I didn’t reply. Clearly, that’s and that happened to another person who works in our organization, their wife. Similar thing. Somebody pretending to be their boss had them go get buy gift cards
Mike: Right.
Peter: At the store. That’s That should be the first clue. If you’re if you’re buying gift cards, that seems to be the big one because then they have you transfer the numbers, and then, of course, it’s
Mike: They’re untraceable.
Peter: Yeah. So wow. So stuff to look for. So this cybersecurity just really is a huge thing. Well, the other thing that that I’m curious about is just this, you know, if you’ve got you know, you’re used to having this infrastructure in your organization because everybody’s there.
Mike: Right.
Peter: And now they’re not there. So you really kinda have to shift your whole infrastructure. Right?
Mike: Yes.
Peter: In your company? So do you guys I’m assuming you’ve seen trends there, and how do you help people with that? And
Mike: Yeah. You know, a lot of folks have thought, you know, well, we’ll just do, you know, VPN, you know, type of connection. So VPN is panacea. Virtual private network.
Peter: So you’re kinda setting up a network within a network, right? It’s like a private tunnel Exactly. Kind of
Mike: It’s yeah. It’s based on the the concept of a of an encrypted tunnel. Okay. Right? So, you know, if you think of it as I’ve got a big water pipe and I’m going to take a smaller pipe and put it down the center of it.
Yeah. Nothing else can touch it. Right. And everything that’s inside of it is safe. Yes.
Peter: Right. Okay.
Mike: Because it’s got very high level encryption. Right. And all that type of thing. Those are good to use, you know, kind of to protect the data flow. The problem is, again, those lateral attacks from, you know, things that are coming at you, but also, you know, folks getting, you know, the phishing emails or they click on a link that is malware.
Yeah, right. And a lot of this now happens in the background where there is no warning to you. As an example, one of my clients sent me an email that they got, And this is a manufacturing company and they sell around the world. Yeah. And they got an email from a company that was in Greece, quote unquote.
And they wanted them to bid on a job for them. And they attached a link that they would go to and have to download their bid proposal for.
Peter: Okay.
Mike: And the lady in the office was smart enough to, you know, she tried to do it and the security software that we put on their systems Yeah. Stopped
Peter: Oh, okay.
Mike: And so she, you know, sent the thing to me and called up and said, Hey, I’m having this problem trying to get this file. Is this good or not? Yeah. And I went looked and sure enough, that was a complete malware site. And so we save them.
But that’s happening every day to businesses all over
Peter: the place. So they’re getting more sophisticated in the ask. So they’re targeting specific businesses by type, right? By type.
Mike: And, you know, they’re doing enough research to know how do we get their attention. Yeah. Right? Yeah. And or, you know, again, one that’s been around for a while, now has gotten even worse is the, hey, here’s an invoice or, hey, we don’t understand your invoice.
And they will spoof. Yeah. They’ll spoof the name of one of their clients.
Peter: I’ve seen that.
Mike: Yeah. And so that’s getting people in a lot of trouble.
Peter: So there’s research involved to find out who the I clients don’t know how they necessarily discover that. And then there’s then you’re getting the invoice. It may come back as a file they want you to click on. Right? Oh, yeah.
It’s a PDF or a Word doc or something that looks like that. It’s got a doc extension, but it’s not. Right?
Mike: Well, actually, it very well can be a dock extension or an XLS or whatever. But the malicious code is embedded inside and it gets run-in the background.
Peter: Right.
Mike: Where you know nothing about it. So and unfortunately, this has been happening now. I mean, the estimate that from the statistics we’ve seen, you know, suggests that sixty percent to 70% of small businesses have been hit in one way or another. Wow. And the average cost of recovering has doubled.
The ransom demands have doubled for these things. Wow. And, you know, the other and I when I talk about the tactics that changed, right? You know, the first one being this method of attack. Yeah.
The second is the fact that these guys are no longer letting you know as soon as they’ve got you. They go in and they see how far can they go, how many other systems can they infect, what other types of data can they find and extract. Wow. So now they’re going to download whatever they can find that is sensitive. Yeah.
And then once they think they’ve got everything they need or can get, now they’re going to do the encryption and hit you with the ransom for the money. Demand. Yeah. And if you don’t do it now, they’ve taken the tactic of, Oh, okay, well, if you don’t want to pay us, then we’re going to post all of your data on our, you know, bad actor
Peter: website or
Mike: a bad, bad client website. Yeah. Right? Yeah. And they’ve done this now to several corporations.
Peter: Okay.
Mike: And the ransom demands have, like I said, they’ve gone up. You know, the average one now is is over $300,000.
Peter: Now if you’ve got your data backed up correctly, you may have to disinfect the machines, but aren’t companies that have their data backed up correctly able to recover?
Mike: You can recover from it. And in fact, we’ve done that for a couple of companies. But if they have copied your data and are threatening to release it.
Peter: Oh, I see.
Mike: That’s that’s where some companies have ended up paying the ransom.
Peter: Even though they had
Mike: the backup, even though they could back it up they could restore everything. But it was okay. Well, yeah, fine. We don’t want you to release our data. Well, they pay the ransom and then the data got released anyway.
There’s no really one good way to you know, kind of recover from it, right? You can recover your systems and maintain your business, then you’ve got to figure out, okay, well, what about my data? This is where the preventive measures have to be taken. Right. This is and unfortunately, that’s the hardest part to get small business owners to do.
Right. Most small business owners and I’m talking about, you know, companies with, you know, 50 or less employees.
Peter: Yeah. Right.
Mike: Yeah. Know, lot of them think, oh, I’m too small. You know, nobody wants my data. Nobody wants my stuff. Right.
Well, you know, that includes medical offices, dental offices, healthcare facilities, long term care facilities. It includes, you know, manufacturers, you know, insurance companies, CPAs, lawyers, everything, All of that data is worth something to somebody. Right. And, you know, the US government has become, more aware of and are pursuing breach investigations and fines on businesses who cannot demonstrate that they took the appropriate actions.
Peter: Right. Wow.
Mike: It’s so and that’s like I said, that’s the biggest hurdle I have. Right. Right. When I talk to companies and and explain to them why cybersecurity and managed services and everything are are a good idea for them.
Peter: Right.
Mike: And they’re saying, well, nothing’s happened to me, and I don’t think anything’s going to until it does.
Peter: Well, and and they may not even know something did happen.
Mike: Well, exactly. They may not know.
Peter: Yeah. That something could be happening right now or could it happen earlier? So, if I’m a business and I want to, you know, take the first step, what is it? Is it a consultation with you guys or what what do you recommend?
Mike: That well, that is, a great first step is, you know, recognizing that you have very valuable assets in your business and therefore you want to protect them. So how do you do that? Giving us a call, or, you know, going on our website and just filling out the hey,
Peter: want teamlogicit.
Mike: Teamlogicit.com and then /lin WoodWa is our Got it. Okay. Easy one. Yep. And we’ll have links
Peter: in the notes too. Right. Yeah. Go ahead.
Mike: And, you know, and then we can sit down with you. The consultation is free, right? And, you know, we’ll talk with you about what is your environment? What is your business? What have you done so far and what do you need to do right going forward?
And, I’ve had, you know, some of those consultations over the last couple of months with businesses and I showed them weaknesses that they had. One business still had mostly Windows seven computers. And they dealt with a lot of sensitive information.
Peter: And
Mike: then they just kind of disappeared on me. And so like, I’m a little concerned about that.
Peter: Oh, I see. So it’s like they wanted to bury their head in the sand.
Mike: I’m not quite sure, but you know, that’s, I would rather talk to somebody and at least let them know what are you dealing with and what should you be watching. And then we can talk about, okay, well, what are some steps you can take? Right. And, you know, it doesn’t matter what the size of your budget is. But at the same time, you’ve got to realize what is the cost of my business if this happens.
Peter: So a couple of things. You do you you I’m assuming you guys do formal security audits Yes. On businesses as well. Right. Aren’t there insurance related, like, don’t a lot of businesses have to carry, insurance, cyber attack insurance, and things like that?
Mike: Well, you’re not required to have cyber insurance, but these days it has become more and more of a necessity. Right. You know, I mean, everybody’s got business liability insurance.
Peter: Yes.
Mike: Right. And and some of us who are in the services industry have, you know, the errors and omissions insurance.
Peter: Right. Right.
Mike: Yeah. The cyber insurance is just the third leg of that, you know, workbook. Right. Because, again, the cost of recovering can run into the tens to hundreds of thousands of dollars. Yeah.
The cyber insurance helps with that. Right. But, you know, and again, that’s one aspect of it. But it’s really now, the HIPAA regulations are they just got strengthened.
Peter: So HIPAA is the health industry’s standard for data security and things like that.
Mike: Yeah, it’s the Health Insurance Protection I always forget the first day act, but it’s essentially anybody who has anything to do with healthcare, any aspect of healthcare has to adhere to those regulations. Most businesses don’t understand them. That’s one of the things that we try to help with is, you know, we’ve got HIPAA certified people, right? We can come in and do a security assessment. You know, we can help with audit preparation, you know, that type of thing.
But and again, you know, this isn’t, you know, not meant to scare anybody.
Peter: Right.
Mike: But it is it’s out there.
Peter: Mhmm.
Mike: And it’s becoming more and more in the forefront because of these breach attacks that are coming.
Peter: Right. Wow. Well, Mike, I really appreciate your time today, and we’ll have links in the notes, to some of the things we’ve talked about to your site. I think there’s a form on there they can fill out to Right. To to, you know, schedule a call with you.
And, we’ll, look for, also put to put some links for some specific PDFs that are available.
Mike: Yeah. We’ve got some tip sheets and and that type of thing for folks that, you know, can be very helpful.
Peter: Great. Well, I appreciate your time. Look forward to, continuing the discussion and and going a little deeper
Mike: Alrighty.
Peter: In some of these topics.
Mike: Thanks a lot, Peter. Appreciate it.
Peter: Thanks for listening to this episode of Biz and Life Done Well with Peter Wilson. You can subscribe to us on iTunes, Google Podcasts, Spotify, and most of the other popular podcast platforms. Please tell your friends about us and leave us a review so even more people will find out about us. Thanks again. We’ll see you soon.
