0:00

0:01

1 second

Sharon: what's it like to deal with the Privacy commissioner 

Eric: hahaha this part we might have to

0:07

7 seconds

edit part of this and we come back 

Sharon: our next guest is a partner at BLG

0:14

14 seconds

he deals with breaches before they actually happen and of course in the inevitable and unfortunate situation

0:22

22 seconds

that a breach happens I happen to see him right there let's go get him hey need a ride how are you coach Eric

0:29

29 seconds

Eric:  oh I'm good I'm good I got to get one of those hats that just says coach 

Sharon: well I know I have so many questions for you 

0:36

36 seconds

What would you say is maybe the number one or at the top uh tip you would give organizations to better protect themselves

0:45

45 seconds

maybe without your help something that they can do on their own to minimize the risk of a breach 

0:52

52 seconds

Eric: I would say clean up your digital junk drawer. so like let me give you an example.

we all have junk drawers we have one in the kitchen we have one in the basement

1:00

1 minute

might even have one right here in the glove box; if I open this glove box you know what's in this glove box should we do should we do an experiment you know maybe an

1:08

1 minute, 8 seconds

apple some stuffed up napkins or something 

Sharon: I brought somethingI something go 

Eric: here we go all right okay 

Sharon: so I I actually asked my

1:16

1 minute, 16 seconds

husband to help me out last night and take our junk drawer from the kitchen and stuff it in

1:23

1 minute, 23 seconds

there all right we got a Mama Mia  the program Play bill :

Eric: yeah got to keep that that's for yeah keep that you have

1:31

1 minute, 31 seconds

definitely need the program for 

Sharon: um we have a lint roller

Eric: I own a Siberian Husky I'm never going to question

1:38

1 minute, 38 seconds

anybody's use of a lint roller 

Sharon: um oh I have a question yes a lint roller is like privacy

1:46

1 minute, 46 seconds

Eric: Because  a lint roller is like privacy compliance 

Sharon: okay okay

Eric: Because you never know what you're

1:54

1 minute, 54 seconds

capturing all over your operations and when you really take a close look you'll be surprised by

2:02

2 minutes, 2 seconds

what's in there

Sharon:  yeah worried about how did that get in there

Eric:  it is true sometimes I do that lint roll and I'm like how was that on my pant leg

Sharon:  Yeah

2:11

2 minutes, 11 seconds

gross yeah yeah okay um oh a pistachio 

Eric: is there a nut in there or just a shell there is an

Sharon:  oh are you allergic to nut

2:19

2 minutes, 19 seconds

Eric: no no I was just,

Sharon:  I should have asked  that before 

Eric: saying the shell 

right yeah the last Consulting uh car poool you ever

2:27

2 minutes, 27 seconds

have yeah car poool Consulting Take it to the ambulance 

Sharon: yeah okay so um

Eric:  yeah definitely got to put the nut in the junk drawer that's a good location oh um

2:35

2 minutes, 35 seconds

Sharon: I'm going to have to talk to my husband about this hemorrhoid cream 

Eric: that definitely doesn't go in the

2:41

2 minutes, 41 seconds

junk drawer that goes in the junk in the trunk I couldn’t resist

2:52

2 minutes, 52 seconds

Sharon: coach how is hemorrhoid cream 

Eric: don't make me do it I can't that analogy is just going to spiral in to the wrong

3:00

3 minutes

place I can't please no

Sharon:  so every company has that junk drawer in the kitchen what do they do with it 

Eric: the folders right

3:07

3 minutes, 7 seconds

like each employee has their own folder on a file share somewhere that they get to just stash stuff right

often what we

3:16

3 minutes, 16 seconds

see is that's what the bad guy steals when they steal a lot of data for two reasons:

one it's usually not as

3:23

3 minutes, 23 seconds

As protected as a as a set of data in one Cloud uh application but 

two it's a mess

3:32

3 minutes, 32 seconds

right cuz let's say I mean it's one thing you have two employees but imagine you have hundreds of employees and each have their own folder there and what they're doing is they are reporting out

3:41

3 minutes, 41 seconds

of these applications right they're bringing down summary reports of these applications that have sensitive data fields and then 

3:49

3 minutes, 49 seconds

they're just leaving that hot spreadsheet and forever yeah exactly and then 

Sharon: but they don't even forget they know it's there

but they don't realize the threat that they're creating by just keeping it there 

Eric: 100%

3:59

3 minutes, 59 seconds

Sharon: okay so what do people what should they do 

Eric: at first you need to identify if you have that file share then you got to make sure the privileges around it are

4:07

4 minutes, 7 seconds

right so that only that there's basically no golden ticket that can access all of the files on the file share 

Sharon: it is a really hard task in my

4:16

4 minutes, 16 seconds

opinion like impossible practical

Eric:  it's incredibly hard to do what what you need to do first things first so I'm giving I'm giving you from easy to hard so easy

4:24

4 minutes, 24 seconds

is make sure your privileges around the file share are right they're where they need to be 

Sharon: so like in other words put a lock on that kitchen drawer like don't

4:33

4 minutes, 33 seconds

let your kids in but maybe you'll let your spouse in

Eric:  you got it only the spouse that's only the spouse just the spouse second thing is make sure your policies are in the right right place

4:41

4 minutes, 41 seconds

and you're training on them right so you have to actually have a storage policy on what can and can't be in there 

Sharon: right

4:49

4 minutes, 49 seconds

like stop putting the hemorrhoid cream in the drawer

Eric:  get it out of there okay medicine cabinet 

Sharon: Yeah, can you tell me

4:56

4 minutes, 56 seconds

what is a breach coach explain it to us 

Eric: simplest way I could put it is a breach coach is a lawyer that you're going to call if you have a cyber in but it's

5:05

5 minutes, 5 seconds

somebody who's going to come in and guide your organization, project manage the response to this incident because

5:13

5 minutes, 13 seconds

they've done it a 100 times before they're going to look around corners they're going to know where the pitfalls are and they're going to talk strategy with you all in a privileged way, so when

5:21

5 minutes, 21 seconds

you have a data breach sometimes you know you're finding warts and bumps and things that sort of shouldn't have been like that and you want to be able to

5:29

5 minutes, 29 seconds

have conversations candidly to manage risk that comes from that

Sharon:  can we clear something up what is the difference between a

5:36

5 minutes, 36 seconds

breach and an incident 

Eric: so a breach has to do with data security right you could have a breach of security safeguards that's like the protections that are

5:44

5 minutes, 44 seconds

surrounding the data uh whether it's your firewall or it's a you know like an email scam something like that incident could be anything right you could have a

5:53

5 minutes, 53 seconds

malicious attack on a system that's designed to bring down operations that doesn't care about data at all 

Sharon: I want to

5:59

5 minutes, 59 seconds

get into what a reportable breach is um and are incidents reportable 

6:07

6 minutes, 7 seconds

Eric: reportable incident depends on the law that applies okay could be a personal health information incident in Ontario

6:15

6 minutes, 15 seconds

it's reportable if that personal health information is impacted but basically there's no harm threshold that's important when you think about a data

6:23

6 minutes, 23 seconds

breach almost every statute that requires notification of a data breach has a harm threshold good example of PHI

6:32

6 minutes, 32 seconds

Sharon: PHI personal health information for who don't know

Eric: That’s right sorry

Sharon: yes 

Eric: yeah data breach could involve appointments right like my

6:39

6 minutes, 39 seconds

doctor appointment thing that's that or my you know my address and my uh like some innocuous history right like the

6:48

6 minutes, 48 seconds

last time I went to the doctor was X that's that's going to be PhPHI i probably under the statute but it's not harmful right like that's going to be health

6:56

6 minutes, 56 seconds

information so maybe it's reportable but like if we really think about that practically does the patient care does anybody care that that happened is there any harm that can happen there right are

7:05

7 minutes, 5 seconds

we going to scare them if we tell them about it there's no harm threshold in PHIPA the Ontario health information

7:12

7 minutes, 12 seconds

statute 

Sharon: but that's not the case for private sector commercial organizations that's right for PIPEDA

7:20

7 minutes, 20 seconds

or the provincial ones right the BC pipa Alberta PIPA, the Quebec Privacy Law those have a harm threshold so you got to look at it and sort of do an equation

7:29

7 minutes, 29 seconds

it's a it's like sort of a two-part test where were the safeguards breached right did the data get exposed and then is it

7:36

7 minutes, 36 seconds

sensitive and and uh what's the likelihood of misuse what's the what's the likelihood that some bad guys is going to use it 

Sharon: what are the like threat

7:45

7 minutes, 45 seconds

actors after like what are what are they looking for 

Eric: leverage that's all 

Sharon: so they're not doing this for fun they're doing it because they want money

7:53

7 minutes, 53 seconds

Eric:  think about it this way folks are like who cares let's say I make you know widgets who cares about me this SME widget maker and

8:01

8 minutes, 1 second

my data but that data goes out the door so maybe you see the bad guy stole that data you think I don't care like publish it fine

8:10

8 minutes, 10 seconds

the other method of Leverage that the bad guy's going to use is they're going to come in and encrypt your system lock it up and try and

8:18

8 minutes, 18 seconds

delete your backups right so whether your data is important or sensitive or anybody cares about you doesn't matter

8:24

8 minutes, 24 seconds

do you care about keeping making money continuing to work continuing to operate pretty sure the answer to that for every single

8:32

8 minutes, 32 seconds

business is yes.  and so that's the leverage the bad guys can come in and break your stuff so you can't keep doing it then you're a potential Ransomware target

8:40

8 minutes, 40 seconds

Sharon:  okay so coach we were so excited to have you on the show your fans were like

8:47

8 minutes, 47 seconds

bombarding us with so many questions that they had for you 

Eric: all 16 of my followers on Linkedin

Sharon: no like thousands of

8:57

8 minutes, 57 seconds

fans all right this is a really good question so it's an overtime scenario okay what's the first move when a breach

9:05

9 minutes, 5 seconds

happens at 4:59 p.m. on a Friday of a long weekend 

Eric: oh my God I I got to find a

9:13

9 minutes, 13 seconds

team so cuz it's got to be 

Sharon: wrong you got to call your wife 

Eric: well usually Friday I work from home so she knows right 4:59 I get that

9:20

9 minutes, 20 seconds

email and she hears me I'm like oh boy she's like what what is it she knows she it's like the for the viewers at home

9:27

9 minutes, 27 seconds

the bad guys hit late on and just the worst 

Sharon: ransomware or fishing who is the

9:34

9 minutes, 34 seconds

tougher opponent 

Eric: oh so would be easy for me to say Ransomware here  it's more expensive can be more devastating but fishing is

9:42

9 minutes, 42 seconds

common and if you're not responding to those fishing attacks in the right way they could be more expensive how because

9:51

9 minutes, 51 seconds

they could result in funds diversion fraud and that's when the bad guy comes into your account and impersonates uh one of your Vendors

9:59

9 minutes, 59 seconds

sees who you're doing business with impersonates one of your vendors and says we've got a new bank account send our next invoice here in the millions

10:09

10 minutes, 9 seconds

millions of dollars single transactions in the millions of dollars spot these emails but what you need is a change of banking information policy and that

10:18

10 minutes, 18 seconds

policy has to say any time that we are provided with new banking information we verify the new banking information by

10:27

10 minutes, 27 seconds

calling the trading partner whoever ever it is the vendor or whatever the client with the contact information we have on file

10:34

10 minutes, 34 seconds

Sharon: Yeah 

Eric: That's important because if you call the number at the bottom of the email you're just going to call the bad guy 

Sharon: Excellent advice another amazing

10:42

10 minutes, 42 seconds

question coach MVP of cyber security is it multiactor authentication or encryption 

Eric: Oh, I got to go with

10:50

10 minutes, 50 seconds

multiactor authentication there's no doubt that there are so many attacks that can be prevented that way but it's not always that simple I got to say

10:58

10 minutes, 58 seconds

there are way is to circumvent it and depends on the multiactor Authentication Protocol there's one thing you could do that's relatively inexpensive that would

11:06

11 minutes, 6 seconds

make you more secure put MFA on your remote access and any administrative credentials 

Sharon: every coach has one inspirational speech they keep in their

11:15

11 minutes, 15 seconds

back pocket what's yours and when do you deliver it come on Coach 

Eric: okay so everyone gets the same speech when we start working together on data breaches and

11:24

11 minutes, 24 seconds

that is you are like the person riding driving the stage coach okay this is not a job where you can say

11:32

11 minutes, 32 seconds

it's on the client's desk the ball's in their court it's in the cop's desk the balls in their court,  forensics’  desk the ball's in their Court no way cuz what's

11:39

11 minutes, 39 seconds

going to happen is you're going to put it on their desk the ball's going to be in their court and they're 

going to think I got a week to do this no big deal but you know somebody else's work

11:47

11 minutes, 47 seconds

is waiting for that work to be done right so instead you're driving the stage coach the horses get tired what do they say what do they say when right

11:55

11 minutes, 55 seconds

oh got you yeah right that's the speech I gave everybody you you are driving even if it's on their desk you got to remind them time to get me information

12:03

12 minutes, 3 seconds

back time 

Sharon:so when a breach happens you say yeah 

Eric: it's more of a yah

12:10

12 minutes, 10 seconds

Sharon: yah yeah yah yeah yah ex correct except on

12:17

12 minutes, 17 seconds

a Friday at 4:59 p.m. 

Eric: yeah then it's more like wealp

Sharon: damn 

Eric: look we're here to serve our clients if they happen on Friday

12:26

12 minutes, 26 seconds

we're we're going to do it we're going to work all weekend you got to do it that's that's table Stakes if you want to work in cyber security 

Sharon: if you want to be a

12:33

12 minutes, 33 seconds

coach 

Eric: you want to be the coach you got to work Friday night 

Sharon: sometimes the statistic that I always

12:43

12 minutes, 43 seconds

see for SMB’s uh for when a breach happens is the cost of like $4.5 million the average

12:52

12 minutes, 52 seconds

cost of a privacy or security breach is that right is that 

Eric: that number I think is probably high for an SMB but I will

13:02

13 minutes, 2 seconds

say it is very common if you include business Interruption and a full a full list of vendor costs and I could tell

13:10

13 minutes, 10 seconds

you who those vendors are you're going to get over a million bucks very easy 

Sharon: right so I mean multiple vendors

13:19

13 minutes, 19 seconds

but probably 90% of the cost of that million dollars goes to their breach coach right