They didn’t invent it, but the internet and specifically platforms like YouTube, provided a huge boost to the “Do-It-Yourself” movement. Instead of having to rely on hands-on training, word of mouth, books or walking back and forth between project and the VCR player, we can now bring up at least a dozen or more videos on just about any crafting, repairing, constructing, cooking, etc. endeavor we can imagine. I just watched a video on how to harvest and smelt iron from bacteria found in streams. It was detailed enough that I might have a reasonable chance at actually doing so, if I were so motivated. You never know if we might bomb ourselves back to the stone age and these types of skills might be important again. But at the point where this might actually become important, things like YouTube and smartphones aren’t going to be available. Perhaps a bad example, but damn if it wasn’t an interesting video.
Let’s assume the Apocalypse isn’t imminent
A less extreme example might be the myriad of repair and construction projects you can find on various household amenities. I also just watched a video on how to install a mini-split air conditioning unit, and assuming I have the tools and manual dexterity to not kill myself while operating them, I believe I have a reasonable chance at actually completing something like that. But what happens if things don’t go exactly as they are depicted in the video? What if I spend many thousands of dollars on equipment, dozens of hours of labor and the darn thing won’t turn on – or worse, it turns on but doesn’t actually work as expected? There are certain types of projects that make sense as a DIY project. Bookshelves from recycled materials? DIY. Three-D printed keychain rack? DIY. Mural for daughter’s bedroom? DIY! Email for your organization? DI-wait a second… Malware protection for your work PC’s? Uhhh…nope. Could you implement these solutions for your organization by yourself? Sure. There’s probably even videos on walking you through it. What most videos don’t contain are the instructions on when things go wrong, or how to make sure you’ve implemented the proper security measures that match your business requirements. YouTube videos and website FAQs can only provide the basics. Experience and training are what makes the difference between “hobby-grade” and “enterprise-grade” technology. Trust me when I say your organization deserves (and needs!) technology installed and serviced by experienced professionals. It may cost more up front, but will save you time, money and sanity in the long run.
Image by Peggy und Marco Lachmann-Anke from Pixabay
The Los Angeles United School District (LAUSD) was hacked in early September, prompting a near total shutdown of school network systems during the week following Labor Day while law enforcement and the district worked to recover and clear systems of possible backdoors and tripwires, of which many were found. The nation’s second largest school district is one of over two dozen US school districts to be attacked this year, and as you can imagine, the hackers are counting on the threat of releasing student data to provide enough pressure to convince administrators to pay the ransom. While at least 2 of the attacked school districts have indeed capitulated to ransom demands, the LAUSD did not, and the hackers made good on their promise to release the data, which happened this past weekend.
What this means for you
According to a recent report from LAUSD officials, the 500 GBs of data leaked contained a fairly limited amount of truly sensitive data. There were concerns that very sensitive information, such as student psychological evaluations, might be a part of the data stolen, but apparently not. Regardless of the data contents, or how quickly they were able to restore service, this isn’t a good look for the LAUSD especially since so many parents entrust their child’s safety and privacy to the district. Nor would it be a good look for any company, big or small, even if they were able to ignore hacker demands and rely on data backups to bring operations back online. If any confidential customer data was leaked, depending on the type and number of records, the hacked organization might be legally obligated to notified those customers. If that company relied on insurance claims to help recover from a cyberattack, they will most certainly be scrutinized by their insurance company, as well as a third-party audit firm, and again, possibly by law enforcement if the affected database is large enough or contains certain protected information. Being able to recover from an attack is an absolute necessity you should be planning for, but preventing the attacks should be even higher priority, don’t you think? On top of having multiple layers of technical protection around your email services, office networks and remote worker computers, everyone should be trained on how to protect themselves by understanding how to spot potential phishing and social engineering attacks, and this requires systematic training, testing and tracking.
Image by Pete Linforth from Pixabay
You probably already knew this: YouTube is the second most visited website on the internet. In obvious first place is Google.com which also happens to be the parent/sister company of the world’s biggest video streaming site. YouTube has over 800 million videos (and growing) and gets over 17 billion visits per month (source), so saying they make a lot of money on that website off your eyeballs is putting it very mildly. The secret sauce, of course, is the algorithm that keeping must-see videos constantly into your viewing experience, and because it’s Google-powered, you can bet those engineers know exactly how build a data-driven, personalized algorithm that knows exactly what you want to see. Or does it?
One Algorithm to rule them all?
Based on the platform’s success and profitability it’s pretty clear that this algorithm is doing something right, but there is still plenty of criticism and scrutiny on YouTube’s content selection, especially in light of continuing misinformation problems plaguing all social media platforms. If you are a user of YouTube (statistically likely!) you are probably already familiar with the various tools you can use to supposedly tailor YouTube’s algorithm to only provide content aligned with your interests. There are even buttons to dislike, remove from recommendations, or report as misinformation, but according to research done by Mozilla Foundation (full disclosure: a non-profit research and advocacy organization that is funded by Firefox money and search engine royalties from Google, etc.), these buttons are essentially ineffective. My takeaway? YouTube is using the age-old marketing trick in offering the illusion of control, while still driving traffic to the videos and trends that make them the most money. The article is lengthy, but Mozilla helpfully provides an infographic summary that is a bit easier to digest and leads to the true reason they published these findings. In the end, Mozilla is an activist organization attempting to drill some transparency into the biggest content platforms. The only way this is going to happen is if enough people step up and ask for change. You don’t have to stop using YouTube, but recognizing their placebo controls might give you better insight into why true control over your feed feels elusive.
Image by Pablo Jimeno from Pixabay
It would make for a better story if I was writing this from my laptop while huddled up at a coffee shop in the next town over because my office was without power, but so far we are fortunate enough to still have lights, AC and most importantly, internet access. But we, and everyone else, may not be so fortunate, as the heatwave will likely continue through the later part of this week. Everyone is trying to cram five days (or more!) of work into a four-day week, which means power consumption won’t drop off just because state officials are asking us to “flex”. We already run our AC at 78, but when it’s 106 outside and your work requires lots of electrical things, flexing can only go so far.
What happens when the lights go out
A lot of our clients have added UPS’s (aka battery backups) to their workstations at the office, and some have even gone so far as to add them to their home office setups as well. Some of you may even have backup generators, power walls and solar panels at home. This will help keep your food from going bad and provide some safety and convenience, but if you are experiencing a full blackout, all that power might not bring your internet back if the local infrastructure is also de-energized. So Cal’s rolling blackouts may not de-energize infrastructure because of how crippling it is for critical services like street traffic, emergency services communications, etc, but depending on what they view as critical, residential internet may end up very low on their list. In an emergency situation, like the recent wildfires, entire areas may be de-energized for safety, or even destroyed, resulting in a complete power and internet blackout. If you are a remote worker, you may want to make plans for how you might work if you have no power or internet where you work, and whether you have the technical capability to work elsewhere. On top of this, it’s probably also very important to know what critical things you use daily that require internet or cellular network access, whether it be staying in touch with loved ones, knowing critical phone or account numbers, or even addresses of safe places or friends’ houses and how to get there. When you sit down and really think about how much we rely on the internet for everything we do – can you function without it? Even if your phone has plenty of battery, is it as useful with no cell signal? Or is it just a very expensive but poor flashlight at that point?
Image by Boyan Chen from Pixabay
Noted security company Acronis recently released its mid-year 2022 report on cyber security, and to say that their findings are sobering would be an understatement. Let me hit you with some stats. First off: damage caused by cyberattacks is expected to reach $30 billion by 2023, and to give you some perspective, this is nearly half the size of the global video streaming industry (aka YouTube, Netflix, etc.), which was valued at nearly $60 billion in 2021. Here’s another one: the FBI is attributing $2.4 billion in loses in 2021 to hacks that originated from what’s known as a “Business Email Compromise” or BEC.
What this means for you
The BEC, also known as “someone stole my email password and is pretending to be me” is crazy prevalent in the small business world, primarily because email services are often self-managed by the organization, and as we’ve said in the past, just because it’s easy to setup, does not mean that it’s easy to keep it secure. “No big deal, right? I can just change my password and get them out of it.” Unfortunately for you, while the hacker was in your account, they may have used this access to fire off an email to your accountant to wire payment to a fake vendor that just completed a non-existent six-figure project for you. BEC’s are meant to go unnoticed while the hacker combs your account for opportunities, including the chance to use your email address to trick other people into BECs, and so and so forth. Just because you are “small” as compared to the big boys getting hacked, doesn’t mean you aren’t connected through maybe as few as 3 or 4 degrees of email separation to just about everyone in the world.
You may be thinking that your organization isn’t worth a hackers time to attack for a variety of reasons (size, obscurity, industry relevance, etc.) but you are valuing time from a business owner’s perspective, which isn’t how they operate when it comes to phishing. Most of the phishing emails everyone sees on a daily basis aren’t targeted – don’t think of phishers as the lonely angler on the shore looking to land a single fish. They are casting huge nets from automated fleets of phishing bo(a)ts, and then processing the piles of stolen passwords via automated algorithms that access your mail, scan the contents and then flag a human hit squad when certain valuable keywords are found. You may “just” be a doggy daycare center in San Fernando Valley, but one of your clients happens to be a B-list celebrity that might fall for a scam if it comes from their precious pooch’s dog sitter.
Long story short – your email account and your business is worth protecting – don’t underbudget security just because you think you aren’t worth the attention. You are, and you will get attacked, it’s only a matter of time for all of us.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Though the numbers are dwindling rapidly, there are still plenty of working professionals who have spent more time working without email than with. And now there is a growing labor pool for whom email is seen as yesterday’s technology (they are not wrong!) and probably do not place as much relevance into it as the majority of the world’s current knowledge workers do. Like it or not, email is still a pillar of the world’s work processes, and now that criminals have settled into their “groove” exploiting it, there can be no exceptions to taking email security seriously.
Your email service should be robust and secure
Rather than tapering off like many other types of cyber-attacks, email hacking continues to grow in frequency, sophistication and damage impact. For most folks, as we have frequently said in the past, getting hacked is not a question of “if” but of “when”, but there are ways to keep your email secure. Can it be made perfectly secure? No, but you will greatly improve your chances of fending off an attack when it eventually comes.
- Your email should be professionally hosted by a company that keeps its infrastructure up to date, continually monitors security and can provide human-based support to its customers. Most free-mail platforms can’t/don’t do this, and it follows that your organization should not rely on free-mail services.
- You should have 2-factor authentication enabled for your email accounts. Not having it on is now considered a huge security liability. Not only will it result in your account getting hacked, it may disqualify you from being insured. If I had to guess where we are headed in terms of cyber-liability coverage, I would say we are maybe only a year or two from it being a requirement with no exceptions.
- You need 3rd party email filtering. Even the big boys in email hosting (Microsoft and Google) only go so far with their email filtering. While their baseline capabilities are still light-years ahead of the free-mail platforms (and free versions of their own services), its increasingly obvious that their focus is on the core technology of delivering email and securing your accounts, leaving spam and malware detection to companies that focus only on that.
- If you send confidential data through email, it must be encrypted. This isn’t just good security practice, this is actually the law in some cases especially where it comes to PII, medical and financial information, but email encryption is not something that most email services come with “out of the box” and must be added on through additional configuration or even separate vendors. This is another area that is already being used to determine your organization’s insurability.
- Strongly consider email backup services. Most folks store a ton of information in their email boxes and take for granted that because it’s hosted “in the cloud” that they don’t need to back it up. While it may be possible to have your email provider restore accidentally (or purposefully!) deleted emails, if you don’t notice in time (usually 30 days or less) that email is gone forever. Email backups are extremely affordable and literally require zero-attention from you, just a watchful eye by your IT professional.
Image by CrafCraf from Pixabay
As with all things complex and made by humans, technology is rife with myths and misconceptions. Science fiction author Arthur C. Clarke famously wrote, “Any sufficiently advanced technology is indistinguishable from magic,” and while many of you think the only thing missing from my outfit is a wizard hat, I can assure you this is just Clarke’s third law manifested. Most people have no idea how email works, or how a computer works, or how your smartphone can access the knowledge of the world in the palm of your hand. It’s exhausting to learn, and in most cases, not really necessary for most people, but if the alternative is ignoring some important facts, it may be useful for me to dispel some common misconceptions.
What this means for you
I like lists. You like lists. We all like lists. Here are some myths/misconceptions I try to dispel on a regular basis. Some may require further explanation (possible future blogs?), but hopefully you trust me enough that these will cast back some of the arcane darkness surrounding the wonderful technology we use daily.
- “WIFI is a good substitute for a wired data connection.” I’ll admit, WIFI has come a long way from where it was even 5 years ago, but it’s still no match for a hardline. WIFI trades reliability for convenience and accessibility. WIFI is to wired connections as a squirt gun is to plumbing – both will deliver water, but only the latter will do it reliably and in quantity. Today’s WIFI is like the Super Soaker of squirt guns, but if you need to fill buckets fast and in quantity, nothing substitutes for hardlines.
- “My email/data/SMS is private.” A lot of you are slowly shedding this misconception, but it’s like finding out certain festive holiday entities aren’t real. Most of us don’t want to believe this because the reality is unpleasant at best, and at worst, can be a privacy nightmare. If a company can make money selling/using/sharing your data, they will. And lest you think otherwise, your work email isn’t your property, it belongs to your company. No ifs, ands or buts.
- “Hard drives don’t fail often.” Spinning hard drives have an average life expectancy of between 4-6 years, which in case you hadn’t noticed, can pass in the blinking of an eye. If you are using an older computer with a spinning drive, it’s very likely you are working on borrowed time. We can replace broken hard drives, but we can’t replace data that isn’t backed up. Every data drive will fail. It’s only a matter of time or a lightning strike away, so don’t gamble with your data.
- “I don’t need to reboot my Windows PC.” There was a time during the late days of Windows 7 where your PC could be up for weeks, even months without a single reboot, and it would continue to perform like a champ. Those days are long gone. Windows 10 (and 11) should be reboot at least weekly. The longer you go without rebooting, the worse it will get, guaranteed.
- “Hackers won’t bother attacking me.” For whatever reason, a lot of people feel like they aren’t worthy of being hacked. From a monetary standpoint, this may be true, but the attacks you and I will likely face aren’t targeted. More than likely, we will be just a line in a long, long list of potential targets. We’re a large school of fish and the hackers are trawling from above, looking for anyone to go for the bait. Another way to look at cyberattacks is to consider it like pollution or radiation – it will have an impact regardless of who you are, but how much of an impact will depend on how prepared you are for it.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
As someone who is beyond jaded by social media and the mega-corporations behind them, this news isn’t surprising, and I actually expected to see it long before now, but it gives me no pleasure in seeing our worst fears play out. Motherboard has published a story today about a Nebraska teenager and her mother being charged with several felonies and misdemeanors surrounding the teen’s self-induced abortion after their Facebook DM chat logs were turned over to Nebraska law enforcement by Meta. Despite the divisive act at the root of this incident and the current political storm raging around the overturning of Roe V. Wade, I’m hoping it highlights rather than distracts from the point of this week’s blog.
Social media is the exact opposite of privacy and confidentiality
Social media and its daily use have become so pervasive that for most people it’s just a de-facto part of how they live their lives, to the point where many can’t conceive of life without it. Regardless of whether or not the women from the above story acted illegally or immorally, there should be no equivocation about whether or not a social media platform will turn over your data to law enforcement. The answer is, “Yes, they will.” In this particular instance, Meta (aka Facebook) was abiding by a court-ordered search warrant. This doesn’t excuse them morally, but also falls well within expectations we have called out, over and over again. Following the overturning of Roe V. Wade, Motherboard reached out to all the major social media platforms asking them how they would handle just these types of requests in relation to women’s health and pregnancy rights, and none of them were prepared to go on record saying they wouldn’t do exactly what Facebook did in the above case. Unfortunately, abortion simultaneously highlights and distracts from the issue – it shouldn’t matter what is being kept private – only that it is private. In case it wasn’t clear: don’t expect anything you share on social media to remain private, regardless of how that platform professes to honor that privacy. The only commitment they are required to honor is to their shareholders or the equity firm backing the company, possibly even over the laws of the land.
Image courtesy of Stuart Miles at FreeDigitalPhotos.net
Social media is literally ablaze with heated discussions about a wide variety of workers’ rights issues: pay inequity, workplace toxicity, exploitation, unionization efforts, and working from home. On the last one, with Covid’s impact slowly waning, employers are starting to ask people to come back to the offices, and many folks have grown more than accustomed to working from home, to the point where everyone is questioning whether working from home should still be considered a privilege or a new standard that industries and employers should guarantee. As someone who commuted more than 2 hours a day for decades, working from home will always have a special place in my heart, but it does come with some serious downsides that everyone should consider.
I’m speaking as an employer and an employee
Of course, I’m biased – everyone is, and I’m particularly biased because I’m a business owner and an employer. Our entire business is virtual – we’ve been “working from home” from day one, years before Covid was anything more than an exotic, unknown virus. Going back to the office isn’t something we need to worry about at C2, but that’s actually not the part to which I want to draw your attention. What I’ve observed over the years as a both a professional and as a consultant, is that our work life balance hasn’t become better as technology enables us to work anywhere at any time, it’s actually done the exact opposite: work permeates everything we do now, especially since the advent of smartphones and the internet. And while it can be said that personal life also permeates work, I think you all will agree with me that it’s nowhere near the same level as work crossing over into personal, and for many traditional employers taking personal time during scheduled work hours is only tolerable in small amounts. Of the many professionals I speak with on a regular basis who work from home (either full time or on some sort of mixed schedule), most acknowledge that they work “all the time,” and yes, while many are able to mix in personal time with work time to give them more flexibility in their day, work-life balance ends up tilting drastically towards work for most of them because of how easy (and profitable) it is to be working.
Also keep in mind, when white-collar workers extend their business hours, the industries and services that support them must also extend their hours, and many of those folks can’t work from home nor enjoy “flex time” because the very nature of their jobs just don’t allow for it. Remember when we “celebrated” the working “heroes” who couldn’t stay home during the pandemic because they were “essential”? We seem to be back to denigrating them for not wanting work minimum wage jobs, long hours with no health care or retirement benefits. There’s a reason why unionization efforts are suddenly making headlines.
The real question we should be asking ourselves is this: just because we have the technology that enables us to work anywhere at any time, does it absolve us from continuing our quest to work smarter not harder? We seem to be growing in the opposite, and possibly wrong, direction. It’s definitely not healthy, and it doesn’t really seem to be closing that gap with the 1% – in fact that gap continues to widen despite our increased efforts. It’s not that nobody wants to work. We are all working too much and despite the extra effort, we seem to be backsliding both economically and culturally.
Image by StockSnap from Pixabay
It happens to all of us. You are elbow deep in your day’s work (or fun, if you are fortunate!) and your phone buzzes. “Unknown Number” is calling you, and it looks familiar because it’s the same area code and possibly even same prefix as your number. Is that your friend’s new number? Nope, it’s a robocall offering you an extended car warranty or something else completely useless. Your phone helpfully offers to block future calls from this number and flag it as spam, which you dutifully do, hoping to forestall future calls from that number, and possibly provide some cover for everyone else. But should you be marking it as spam?
Why on earth would I NOT mark it as spam?
Robocallers typically use spoofed phone numbers, meaning the number that shows up on your phone when the call comes in is not the actual number being used to make the call. You may have seen a similar tactic used by hackers when sending out phishing or scam emails, most notably the one that comes from your own email address to yourself, purportedly from a hacker has compromising information on you that they will keep private if you pay them hush money. The proof that they have hacked you is this email from your very own email address. The fact of the matter is that spoofing email addresses and phone numbers is trivial to do, and on the email side of things, it’s also trivial to detect, but not so much on the mobile phone side of things if the carriers’ current efforts are any indication. While I’m fairly certain that the carriers could be doing more on the technical side to verify and disqualify calls using spoofed numbers, they’ve done between nothing and minimal effort about it at all, to the point where congress is having to force them to do something, even if it’s barely scratching the surface of the main problem.
The one thing that most carriers have done is implement a database that collects your spam reports and then uses that to provide some context on calls coming in, ala “Scam Likely” labels, etc. on unknown numbers. Essentially, it’s a user-powered blacklist, but that’s a problem because we are reporting numbers as spam that aren’t actually tied to the spammer. In fact, the number might actually be a legitimate business that has now been unfairly tarred and feathered for an act they didn’t actually commit.
This actually happened to a client last week, and the impact was almost immediate. On top of getting dozens of irate and profane return calls from people who thought they were calling the spammer, their main business number was now showing as “Potential Spam” when they were trying to call their own clients. The robocaller apparently spoofed enough calls from their number to get it flagged in multiple carrier’s “Spam list”, which requires the business to appeal the unfair labeling at each carrier. On top of being highly disruptive, this is potentially damaging to them and there is literally nothing they can do to prevent some robocaller from doing it again and starting the process all over again. I’ve had this happen to clients previously, but the backlash was never as immediate and damaging as this latest unfortunate event. Once again, we have created another dual-edged tool that bites back harder than it protects. Meanwhile, carriers stand around wringing their hands and crying crocodile tears on their big piles of money. The next time you receive a spam call, think twice about marking it as spam. Unless you’ve received repeated calls from the same number it’s likely not going to have any impact on the spammer because it’s a spoofed number, and it might actually sideswipe a local business or family inadvertently. Instead, redirect that annoyance at sending a sternly-worded email or voicemail to your local congressperson to ask them why we are still fighting robocalls after all these years.