THE Cambridge Connection - Episode 59

Without a doubt. And it brings up a great point as we talk about this, Tim. Obviously there are kids younger and younger and younger getting this type of technology. It’s an incredible age we live in where these kids are just growing up with technology in their hands. You see them all the time, two, three, four years old and they’ve already have iPhones and tablets.

iPads, yeah, all of that. So we’re going to get into that because obviously it’s important that we talk about at that age there are some vulnerabilities there that we need to share with everybody. It’s vulnerabilities across the board. There are so many avenues in which criminals or people that are just trying to get information, they’re attacking, it doesn’t matter your age, they’ll attack, they’ll try to get information from a kid, try to steal their identity, the parent’s identity, the grandparent’s identity and just use it to, it’s really all about money. They just want to steal your money.

It’s all of this that helps or prevents me from sleeping at night. So before I jump out the window, we’re going to take a quick break. And before we do, what’s your favorite ice cream, Tim? My favorite, I’m a plain vanilla, vanilla bean ice cream. Okay.

All right. And then what’s your favorite meal that grandma has made? I love, she makes a nice filet with mashed potatoes. Beautiful. Yeah, I’m a little, I’m a little offended over here.

She said rice pilaf, you know, the way I cook for this kid. That’s the one. We’re going to go home and talk about this. I’m going with the filet, Tim. Sometimes you got to keep it simple.

Yeah, I guess so. Tim, I’ll wait for the invite for the filet. I’ll wait for that. So we’re going to take a quick break and when we come back, we’re going to get everything security on a personal level and on a business level. This is Gordon Oliver with The Cambridge Connection.

Tim’s background in IT security

We’ll be right back. If you’ve lost income during the pandemic and have fallen behind on your rent or mortgage payments, Cambridge Credit Counseling can help. Talk to one of our HUD certified counselors at 1-800-CAMBRIDGE. Welcome back everyone to The Cambridge Connection. I’m your host Gordon Oliver here with my co-pilot Tina Marie and our special guest Tim Veloso from Simply IT LLC.

And Tim, this information is so important because this show is about financial wisdom, financial wellness, and if people are vulnerable with electronics on the internet, obviously it can cause all kinds of problems for people. People can, bank accounts can be accessed, personal information. So we’re going to get into that. Before we do, can you just tell our listeners a little bit about your history, your career, what got you to where you are today? So I’ve been in the IT for over 30 years.

Back in the day when we were building computers for local area colleges, physically putting motherboards in, this is pre-internet. We used to have this modem thing that we’d have to connect to bulletin boards to try to share information. And then I remember mid-90s when the internet really started to come out and that just changed. It changed the dynamic of the world. So I also have a bachelor’s in IT security and information assurance.

So this is just something I’ve lived and breathed and I’ve seen it grow right from the ground up, probably since the late 80s. Speaking of the 80s, and I can’t exactly remember the timeframe, but I had a leading edge computer and I remember the huge monitor and it was always so exciting to hear the drive. Spin up. Spin up and then watch the dash and waiting for the next thing, you know. But we certainly have come a long way since then.

I had an intern and he’s like, what is this light on the top of the computer for? He didn’t really understand what it was and for us, we know that that means that the drive is doing something. So it became a lesson for us. Then it became, okay, now it’s the, oh, it used to be the hourglass of doom. Now it’s the blue circle of doom, right?

When it’s just processing. There is a bunch. There’s a blue screen of death, white screen of death, black screen of death. That totally exists everywhere. Are we talking about the circle?

Protecting personal information and devices

Yeah, of course. When you’re waiting for the computer to move. Round and round and round. Okay. Once again, we have Madeline in the studio, which is my co-pilot, Tina Marie’s granddaughter, and she has a device, Tim, obviously it’s a phone, iPhone, and there’s information on there.

So what happens even for our youth, for anybody that has these devices, if our information is stolen? I think that’s a good point to think about the personal information that they’re actually getting after, to know what they’re getting after and then to know what they’re going to use it for. So they’re looking for names. They’re looking for emails. They’re looking for phone numbers.

Once these hackers, once these thieves start getting your personal information, it can have implications that could actually last your entire life. It could follow you through your entire life. Even pictures, right? Pictures. Pictures.

Obviously, there’s some heavy hitters like your social security and bank account. Those are the big ones out there, but it even gets more simple than that. It’s your name and your email address and a phone number. We had a customer who has a, they got an AT&T bill and it was a phone number for one of their managers and an email address for a different manager. And that’s how we were able to connect the dot that there was fraud there.

And that information is publicly out there. So it’s not just about protecting yourself. It’s just really about being aware. This can impact children and it can impact parents and grandparents. So it can have, they don’t care.

There’s no discrimination as long as they can get information and try to steal money is really what the bottom line is. It’s so funny. Again, we talked about the eighties and nineties. It was, don’t throw your mail away, right? Because there’s personal information on there.

Now we’ve got it all on our devices and it’s vulnerable. And I always say, one of the things we advise people to do is pulling credit reports annually. To just see that there’s activity that’s all the activity that you would expect if there’s anything abnormal that has time to do something about it. That’s actually one of my recommendations on how to prevent it and it’s it’s and I’m glad you you know it’s it fits perfect with what Cambridge is trying to do to obviously keep an eye. You have to be aware you have to be aware of your own information be aware of your own credit information.

Without a doubt. So what would happen though what do you do when your personal information is actually stolen? I talk to people on a daily basis and they’re so frustrated where they will pull a credit report and find something that they have no idea what it’s about they want to dispute it and they’ve got to literally jump through hoops to dispute it. So what what is your recommendation? What do you think is the best way to go about maybe disputing something or trying to figure out how to take care of something that’s really not yours?

Obviously the best way to dispute it is to try to prevent it in the first place and so a lot of the methods that are in place are the prevention and being aware ahead of time. You know we talk about how hackers and thieves steal your information and you know obviously since the theme has gone back to the 80s and 90s the original ways people would just steal like your mail or steal your wallet. Wallet’s a big thing you know. You know they would another technique that’s not as commonly known is they would submit a change of address to the post office and route some of your mail especially some of your credit card information in that aspect. But now we’re in a technology day and age where you know our whole lives are on the internet in some way shape or form and hackers can start simply as you know hacking your Facebook or your social media accounts and changing things there and going forward in that aspect.

Here’s where I see a problem too. You see companies like Target and Citibank, major organizations getting hacked and I feel like I hear a lot from people. Well if they want my information they’re going to get it anyway. So people have almost become like well not much I can do about it. So I think that’s false.

Obviously you need to do as much as you can about it. So let’s talk about that. So if you’re looking at Garmin getting you know ransomware for $10 billion or whatever it was and Target and you know Microsoft they’re facing attacks all the time. So is it totally prevented if someone wants to get at your information that may be true. But let’s think about it like this.

If I am walking down a street in New York City and I’m a thief and you know remember when we had those nice cassette players in the cars with the face plates. Yeah for sure. I would walk down the street and I would check the door and if the door was locked I’d go to the next one and I’d check the door and if that door was locked I’d go to the next one. Oh this one’s unlocked it’s an easy target. So by putting some of these techniques in place what you’re doing is you’re creating you’re lowering your attack surface if you want to use a technical term.

You’re making it a little bit harder for the potential thief to steal your information. I like to look at it as the locked door mentality and you’re just trying to stay under that radar because you are not the big target. They’re casting this wide net and trying to catch whatever fish they can. Now if they wanted to scheme and get after a big target that’s spending tens of billion dollars on security well that’s you know a whole campaign that they can attack and it becomes a big game for them. But you know in our scenario we’re looking at protecting the individual and there’s a lot of individuals that these guys are just casting a wide net and if your door is locked they’re going to move on to the next person.

So how do you propose to protect yourself? So I look at security like an onion right an onion has a lot of different layers and so there’s a lot of different techniques that you’re going to you know I recommend we put in place to prevent that from happening. So let’s talk about the first thing let’s talk about cell phones and we brought that up with an iPhone. How many people do we know that don’t lock their phones or have any form of lock on it any security code on it or they use the same security code you know one two three four which by the way is one of the most common passwords out there. It’s crazy.

Yeah so you know wanting to lock your phone making sure that it has like a 30 second timer and making sure that there’s a method of unlocking it that isn’t just a passcode or you know drawing a shape on the screen. Biometrics is definitely one of the big things that are out there and it’s super secure because it’s something that is you it’s not something you know. I have just a small opinion my only problem with that is you see a lot of these you know in the news we’re always faced with all this crime. I feel like the criminal just punched me in the face and then put the phone up to my face and next thing you know it’s got the facial ID you know like I struggle with that a little bit because of that but again and in the grand scheme of things that’s an anomaly right. So for the regular usage it’s great.

So remember if they want to get at if they’re targeting you like they target Target or they target Garmin they’re going to find a way to do what they do they’re going to they’re going to really narrow in on it but again we’re trying to stay under the radar. I’m kind of curious what do you feel your personal opinion about the Apple wallet? So I think there’s a lot of securities in place for it a lot of banks often require a secondary verification to allow it. Those are the those are the reasons why your Apple phone should have you know a short timer for the lock screen and it should be more than just a passcode it should be some form of biometrics facial recognition or thumbprint yeah absolutely. Okay so we’re coming up against a hard break so let’s just summarize strong passwords don’t use the same passwords for the same accounts we’ve had that conversation in the past when you’ve given presentations you’ve talked about the different what you should have different passwords for everything.

So you’re not showing patterns consistency right? Monitor your credit report right? You have to monitor I mean that’s so the problem with that is it’s a little harder because it actually requires you to be a little proactive but you absolutely need to keep an eye on them. There are apps like Capital One has credit wise as an example where it gives monthly updates it even shows when your information’s showed up on the dark web. If if you have a new credit card that’s been you know applied for and that you know you didn’t do it you know those are important things to kind of just key indicators that something may be amiss.

We’re going to definitely have you back because the personal side we can talk more about and there’s never this is information is always important because this can ruin a person’s finances and credit profile. Not just the person but their families. And their families exactly. We’re going to take a quick break right now when we come back we’re going to speak with Tim about the business side of this. This is Gordon Oliver with The Cambridge Connection we’ll be right back.

Business email scams and phishing

Are you having trouble paying down credit card debt? Cambridge has been helping people safely pay down their debts for more than 25 years without settlements or bankruptcy. Call us at 1-800-CAMBRIDGE. Welcome back everyone to The Cambridge Connection. I’m your host Gordon Oliver here with my co-pilot Tina Marie Madeline and Tim Velozo from Simply IT LLC talking an extremely important topic which is securing personal information.

Tina obviously we’ve had our guest from Scamicide on to talk about fraud and protecting yourselves and we’ve seen people get hurt. I’ve helped a friend just recently I’ve talked about it on the show that got scammed with student loans where the scammers used the Department of Education logo for the envelope just making it look like that’s who you’re supposed to call. So we’re going to jump into the business side. Go ahead. I’ve received personal company emails from the president of the company asking me to get gift cards for him and I didn’t even recognize the email was not correct and I answered back sure and then it hit me.

Let’s dig into that because that is so true. Yeah. You thought it was coming from the president. Yeah. So Tim.

We’re obviously still talking personal, but it also blends into business. So let’s talk about receiving things that are telling you to take action. The first thing I would say is, it’s unfortunate we have to take the mindset where we have to kind of not trust. We have to have this initial not trust when it comes into email, and you kind of look at it and first thing we need to do is vet it, really make sure it is who we think it is. I’ll give you an example.

We have a customer we sent out, they have 30 employees. We had 16% of the employees click the link. We sent out a fake phishing email saying it’s from the IT department and nothing in the email really indicated to who, and we were able to track how many people and it became a good conversation. Exactly. Yeah.

Yeah. So companies actually will do tests to test their employees. Sure. That’s smart. We’ll talk about that when we get to the business segment.

That’s smart. And some of that. But to- How do you identify it? So first of all, you kind of get a sense of when we’re sending emails, we kind of know our language, we kind of know how we’re talking to each other. So if there’s something seems off about that, trust your gut.

That’s the first thing I’m going to say. The second thing is never click a link. If you hover over the link- Or an attachment. Or an attachment, if you hover over that, you will be able to see where that link is pointed to. And so you have to change your login for such and such, and you hover over it and then you look at where that link is actually pointing to and it doesn’t- Doesn’t add up.

Yeah. It doesn’t add up. Don’t click it. So be very, very cautious about clicking anything in an email or opening up any attachments, especially on the personal level because most personal level, most of the individuals don’t have the high tech things like spam filters and firewalls and all the things that are out there for businesses, which we’ll talk about in a second. So it’s really up to the individual to kind of be mindful about what they’re clicking.

Yeah. And so just for that one piece, even it’s a safe bet always, you said trust your gut. If you feel at any point that it’s something that’s not right, go call the company that you have a relationship with, or even if it’s one that’s soliciting selling something. If you’re interested, go outside of that communication, find the company information and call them. Ask them, did you try to reach out to me for X, Y, and Z?

Or I’m interested in this product and do the proactive outreach rather than clicking links, answering to emails, even phone calls. Same thing. Yeah. I think it comes back to just having, it’s unfortunate we have to say this, but have less trust about that email coming in. You kind of have to look at it and you have to verify that it is who it is.

Yeah. Better be safe than sorry. Exactly. Yeah. All right.

Business network security and training

So let’s shift to businesses because there are a lot of people that listen to the show that are entrepreneurs, that are single business owners, salespeople, et cetera. So let’s talk about business security. So we kind of touched about it on the personal level. When we talked about the security awareness training, there are programs out there that, for instance, the example I brought up, we had a customer that implemented a security awareness training. They have 30 employees.

Every month they get basically hit with spam, but it’s controlled. It’s from a controlled environment where they get sent information. Sometimes it’s a fake Facebook email or sometimes it’s a fake IT department needs to change a password. But if a user clicks on it, A, it tracks who clicked it and it also brings them to a training and it says, you’ve been hooked, you’ve been phished, you clicked on a link you shouldn’t. Here’s how to avoid that.

Furthermore, it gives the company an opportunity to have a one-to-one conversation saying, hey, listen, this one particular company had 30, I think I said 16, but I think it was closer to 30% the first time we did it. And then the second month it dropped to 16. Now we’re hovering around the 4-5% and a lot of the 4-5% are the new employees who are just now getting into the program. So they’ll call and say, hey, did you send this email? And I can say, no, that was the phishing one.

They say, oh, I identified that right away. So that’s a major step that companies can take to help you because the number one vulnerability in any business is actually the human factor. So just say one person clicks on this phishing email. Once they click on it, I mean, is everyone going to have to get shut down or how do you go about focusing on not getting phished or not having any information out there that because of that just one person, can it take just one person? So that’s a great follow-up question.

Let’s start with that. It can take just one person clicking and it can lock out an entire organization if they don’t have the controls. Will it always be one click? Well, it depends on the severity of the attack. It depends on the motives.

A lot of times these guys are just throwing out a wide net trying to solicit information. If they can get a little bit more information such as your email and credentials of that nature, maybe they can hack into the system. They’re putting a wide net out trying to get it. In the cases as we mentioned earlier with Target, those are a little bit more targeted, pun intended, to really get at their systems and lock it down because there’s big money. If you can lock out a multi-billion dollar company and then ransomware them for $10 million and they can’t operate, well, they’re losing money every second.

And yes, it can come back to an employee who has the right credentials that might click the wrong thing and in fact a virus gets downloaded or it locks out their systems and then it propagates throughout the entire network. Is this not how cryptocurrency was created? Didn’t they use that as a means of payment to get your information unlocked? A lot of things in life that we look at as beneficial financially started out deviously. Unreal, isn’t it?

No. All right. No, you’re right. It’s not unreal. So in the company structure, obviously one computer if you’re on a network, does that make the network vulnerable if you were to make that kind of mistake?

It’s possible. Our company implements a, we follow industry standards such as NIST, which is the National Institute of Securities and Technologies, where it depends on the network structure. On a company like Cambridge, for instance, I know for a fact, their network is going to be segregated. So if let’s say the billing department gets hacked, it’s separate from the accounting department. So it kind of minimizes how much is getting attacked on that or how much is vulnerable.

So different companies will structure things differently. One of the things we look at is trying to look at what are the business processes, what are the vital important systems, and then let’s separate those networks for it so that if one particular department gets hacked or targeted or falls subject to a phishing scam, it is localized. It has stayed in just that department. So those are some of the techniques that I think are important. It depends on the size of the business too.

So finding the right balance between making things too difficult to function because you’re making it so secure. We could make it so secure that you have five different things to enter before you can open up Microsoft Word. Well, that’s not feasible for most companies because you take more of your time actually unlocking the system than you do actually performing work. And then how many people forget their passwords? I complain all the time we have to change our passwords.

I think it’s every 30 or 60 days, but I understand obviously it’s for security at the company. Let me speak to that because here’s the other problem. We’re obviously short on time. We’re definitely going to have you come back on. I definitely would like to talk to you and the principal at Scamicide to talk about potentially doing a seminar, webinar, et cetera, because you can’t talk about this enough.

But what you just said, the other challenges, I love to hear that there’s training for companies because instead of treating it like you’ve been bad, it is let’s learn together because you’ve got to have the staff buy in. They have to lock their computer down when they walk away from their desk, all of the things that are important. I can put 50 different technology security implementations in place for a company, and the biggest vulnerability is still going to be the individual. And the individual goes back to it. We’ve got to change the way we do things and constantly be paying attention to this.

Volleyball officiating and personal interests

Where can businesses or people find you to get help? com. Tim, I’m going to go home and unplug everything and close all my drapes, and I’m going to become a recluse. Put tinfoil on your roof. Exactly, exactly.

I’m going to probably leave here with some paranoia. So not like I already didn’t have it, but now it’s even worse. Something we missed. I want you to tell our listeners about the other amazing craft that you do. Oh, I’m a collegiate volleyball official.

I referee Division I College Volleyball. And I’ve seen you were on the ESPN Top 10. You want to talk about that? It’s my claim to fame, yeah. I had an opportunity to get down to South Carolina at Clemson, and the two teams playing, it was Louisiana Tech versus Clemson, and the young lady in Louisiana Tech made this phenomenal play that you hardly ever see.

She, broken play, and she ended up kicking the ball like a soccer ball. It went over the net for the point. Wow. ESPN picked it up and put it up. We made top four.

I did follow up with an email, though, to ESPN, because I was a little disappointed in the FaceTime from me. They actually focused in on her a little bit more than I thought. Oh, sorry to hear that. So you know how this works out. You’re on the Cambridge Connection as the main host.

Oh, there you go. Right, as the main guests here. At least you’re not on, come on, man. Come on, man. Come on, man.

Closing summary and key takeaways

Exactly. All right, so again, important show. Securing information. Tina, you do such great work helping people with credit problems. The message that we have to leave with is don’t add to the opportunity to have a problem, right?

Do everything you can to protect your information from Social Security, credit cards, electronic devices, and you can never follow this enough. Or be too careful. I think when Tim said that earlier, wording, if it doesn’t sound right, it might not be. Chances are, yeah. So three things to take home, right?

Number one, make sure your devices are locked. Make sure you have a device locked on it with some type of biometrics, face scanner, and that goes for iPhones, even for kids. Number two, when you open your emails, just have a sense of, is this not right? Is this right? Have that sense, that caution.

And number three, just be careful where you’re going on your websites. That leaves me to end this show with a quote from James Comey, the ex-FBI director. The diverse threats we face are increasingly cyber-based. Much of America’s most sensitive data is stored on computers. We are losing data, money, and ideas through cyber intrusions.

This threatens innovation, and as citizens, we are also increasingly vulnerable to losing our personal information. Again, James Comey from the FBI. Special thanks to our producers, Leah and Lisa, for always guiding us and helping us with the show. Special thanks to you, co-pilot, and your granddaughter, Miss Madeline, for joining the show today, and Tim Veloso from Simply IT, LLC. Thank you so much for joining us.

We definitely will have you back again, because we cannot talk about this enough. This is about financial wellness, the show, financial wisdom, so we appreciate you coming by. Thank you for having me on. m. We have great experts, and collegiate volleyball stars on our show.

m. com, click on podcasts, or you can find us where you listen to your favorite podcast shows. Once again, we want you to be part of the conversation. org, or feel free to call.