Speaker 1: T T.
Speaker 2: I know, we already did an episode about scammers, The
Speaker 2: Art of the Con.
Speaker 3: Yes, we talked about what happened at Firefast. Firefast feels
Speaker 3: like it was forever ago and yesterday.
Speaker 2: Right, But you know what, I think it's gone all digital.
Speaker 2: Between inventing Anna, the tender swindler, that couple that was
Speaker 2: stealing bitcoin from people.
Speaker 3: People are getting advanced in their scamming technology.
Speaker 2: Yes, I've got to build up my digital fortress because
Speaker 2: it's looking grim out here. Yes, I've been getting so
Speaker 2: much digital spam that is actually scamming on the back end,
Speaker 2: like links that say track your package here, even if
Speaker 2: I haven't purchased any ash that has.
Speaker 3: Been going around a lot. I've gotten text messages that
Speaker 3: are like track your UPS package, which I might have
Speaker 3: a UPS package on the way, and so you're tempted
Speaker 3: to click it. But there's what is it?
Speaker 2: Scamware, spyware, ransomware, phishing attacks.
Speaker 3: I don't know any of those words.
Speaker 2: You remember when everybody was getting emails about those gift
Speaker 2: cards and people.
Speaker 1: Were buying them.
Speaker 3: People were buying gift cards and was not the gift.
Speaker 1: Yeah, just out of control.
Speaker 3: I'm TT and I'm Zakiyah and from Spotify. This is
Speaker 3: Dope Labs. Welcome to Dope Labs, a weekly podcast that
Speaker 3: mixes hardcore science, pop culture, and a healthy dose friendship.
Speaker 2: This week, we're talking all about cybersecurity.
Speaker 3: And with everything that's going on in Russia and Ukraine
Speaker 3: right now, there's been a lot of talks about a
Speaker 3: possible cyber attack.
Speaker 2: We really wanted to know more about how people's online
Speaker 2: data is collected and used, what happens during a cyber attack,
Speaker 2: and what we can do to stay safe. Ready for
Speaker 2: the recitation, Yes, let's get into the resitation.
Speaker 1: So what do we know?
Speaker 3: Well? I know that we are always online, whether it
Speaker 3: be for work or social media. Every time my phone
Speaker 3: tells me how long I've been, like the amount of
Speaker 3: screen time I've had, and I go and check the details,
Speaker 3: I'm like, hm, hmm. I spent a lot of time
Speaker 3: on TikTok and Instagram, And sometimes I'm ashamed because it'll
Speaker 3: be like, you were on there today for nine hours.
Speaker 3: How is that possible? When I work eight hours.
Speaker 2: That's nobody's business, all right, that's the first.
Speaker 3: Thing, that's my business, that's my visiness.
Speaker 2: We also know that there have been some pretty big
Speaker 2: cybersecurity breaches in the news. You remember the Colonial pipeline attack.
Speaker 2: You know, it's one thing to feel like it's the
Speaker 2: matrix and people are moving the zeros and ones and
Speaker 2: they're green and moving down the screen.
Speaker 1: But the gas.
Speaker 3: Honestly, like, how is gas even involved with this? Those
Speaker 3: types of things just go way over my head because
Speaker 3: every time I think of cyber attack, I just think
Speaker 3: digital stuff.
Speaker 2: What isn't it in the cloud? That gas is real?
Speaker 3: And right now with everything that's going on, all the
Speaker 3: tensions because Russia is invading Ukraine, the US banks are
Speaker 3: preparing for a potential retaliatory cyber attack from Russia.
Speaker 2: In the topic of cybersecurity, we're seeing that blow up.
Speaker 2: Even in entertainment. So I already mentioned inventing Anna, and
Speaker 2: we talked about Tender Swindler, but there's also the Matrix,
Speaker 2: So the old one and the reboot and Enemy of
Speaker 2: the State.
Speaker 1: Too, Yes?
Speaker 3: Is that the one with Will Smith?
Speaker 1: Yes?
Speaker 3: Yes? So what do we want to know?
Speaker 2: I want to know what's being collected? What are y'all
Speaker 2: taking off of my phone in my computer?
Speaker 1: What are you doing with it?
Speaker 3: Why do you want it?
Speaker 2: Yes?
Speaker 3: First and foremost, why I am very born. You want
Speaker 3: to see all these silly pet videos? I don't know why.
Speaker 2: And then what's legal versus what's illegal? What are people
Speaker 2: allowed to do with our information? Whatever they're collecting? My
Speaker 2: question is what is rants?
Speaker 3: Where? Here are a lot of things like ransomware, spyware? Where? Where?
Speaker 3: Where is all the stuff coming?
Speaker 1: Where isn't the where? Yeah?
Speaker 3: I don't understand any of it, and so I just
Speaker 3: want like clear definitions for all of this stuff.
Speaker 2: Yeah, and like you said, who wants our stuff? Are
Speaker 2: we the common people? Are we the targets of these
Speaker 2: types of cyber attacks? Or are they like high value
Speaker 2: assets like on mission impossible? Is it for the common people?
Speaker 3: Right? Because I feel like there's not enough money in
Speaker 3: my bank account for y'all to want to hack it.
Speaker 2: Yeah, I don't understand. But if I am a target
Speaker 2: just in case, what do I need to do to
Speaker 2: be safe?
Speaker 1: You know?
Speaker 2: Because Norton isn't out here anymore?
Speaker 3: No, I have Norton on myself.
Speaker 2: Nobody's here to save me. So what do I need
Speaker 2: to do?
Speaker 3: That's just out of how old we are.
Speaker 1: That's all right, I'm okay with that.
Speaker 3: Let's jump into the dissection.
Speaker 2: Our guest for today's lap is Christina Morillo.
Speaker 4: My name is Christina Marillo. I am based out of
Speaker 4: New York City. I am in information security and technology
Speaker 4: practitioner with about two decades of combined experience and everything
Speaker 4: from enterprise technology, information security, cloud.
Speaker 3: Christina recently published a book called ninety seven Things Every
Speaker 3: Information Security Professional Should Know, and it's a practical guide
Speaker 3: from a variety of information security experts.
Speaker 2: So we ask Christina, what exactly is cybersecurity?
Speaker 4: Cybersecurity is pretty much the practice of protecting systems, networks,
Speaker 4: and programs from digital attacks. It's like the equivalent of
Speaker 4: an intruder coming into your home and taking your stuff
Speaker 4: right or accessing or touching your stuff.
Speaker 3: I can't imagine somebody coming to my house and just
Speaker 3: touching stuff. Oh that just seems gross.
Speaker 2: That makes me feel sick, even when I think about
Speaker 2: stuff that I'm looking at on my phone, things that
Speaker 2: I'm saving. Like, I know, I share a lot of links,
Speaker 2: but I don't want everybody all up in my stuff.
Speaker 2: And I don't know about it exactly exactly. I don't
Speaker 2: know about you, but I keep a lot of tabs
Speaker 2: in bookmarks. What would you do if you lost all
Speaker 2: of that, I.
Speaker 3: Wouldn't even know where to begin. I think a problem
Speaker 3: that I have now is that because I use my
Speaker 3: phone and my finger on my computer to enter my passwords,
Speaker 3: I don't remember my passwords anymore. I don't feel like
Speaker 3: I have to. But I know it's important because if
Speaker 3: all that stuff was wiped away, I would still need
Speaker 3: to have access to all of my things, yes, like
Speaker 3: my email and everything that requires a password, right, So
Speaker 3: I would feel some type of way.
Speaker 2: And so all of this, you know, quote unquote stuff, numbers, passwords,
Speaker 2: all of these things, and also like browsing behavior and
Speaker 2: what we like and don't like. It's really hard to
Speaker 2: understand what's legally collected versus, you know, what's illegally collected.
Speaker 2: So let's start with the legal collection of our stuff
Speaker 2: on the Internet.
Speaker 4: The reason why data is collected in the first place
Speaker 4: is to help answer like everyday questions, right, evaluate outcomes,
Speaker 4: and also make predictions about trends. So all of our
Speaker 4: data is valuable.
Speaker 2: So this changes how we've been thinking about it. T
Speaker 2: t Absolutely, people want to know when we see a page,
Speaker 2: what we clicked on, why we clicked on it, to
Speaker 2: help them understand what's useful.
Speaker 3: Yeah, like if you come to this website, what are
Speaker 3: most people clicking on? So that it gives like a
Speaker 3: lot of people information like what's most popular? What are
Speaker 3: people interested in? Christina likes to think about data in
Speaker 3: four categories. The first is personal data.
Speaker 4: That's like any personally identifiable information like social security numbers
Speaker 4: or your gender, even your IP address, your device ID. Right,
Speaker 4: like stuff that can be tied back to you as
Speaker 4: a human, as an individual.
Speaker 2: And in addition to personal data, there's also engagement data.
Speaker 4: So that's how customers interact with the business. So that
Speaker 4: could be like social media apps, texts, navigating to different websites. Right,
Speaker 4: everyone is now aware of the cookie pop up that
Speaker 4: comes up, which is super annoying.
Speaker 2: We see this all the time on websites. But what
Speaker 2: exactly are cookies?
Speaker 4: Cookies are pretty much little software programs that retain information.
Speaker 4: As an example, they retain maybe your pre di for instance,
Speaker 4: if you like your website icons to be larger when
Speaker 4: you visit CNN dot com, if you always search for
Speaker 4: a specific topic, you know, if you have favorites listed
Speaker 4: on the site for any reason. Also, you're signing your
Speaker 4: logging information This is like little pieces of software that
Speaker 4: are downloaded onto your computer to retain your history.
Speaker 3: The cookie pop up is something that depending I might
Speaker 3: just say, fine, whatever, just accept, but sometimes I take
Speaker 3: this time. I'm like, no, just only collect what is
Speaker 3: necessary or whatever it says, like I switch all those
Speaker 3: things off. But I think my default is just like except.
Speaker 2: No manage my settings. One trust. I want those things
Speaker 2: all off. I only want the bare minimum that they need.
Speaker 3: They're taking advantage of the impatient folks. I'm like, move
Speaker 3: this thing out the way, let me see this toothpaste.
Speaker 4: Then there's like behavioral data, So that's transactional information, so
Speaker 4: your purchase history, usage. You know, when you swipe that
Speaker 4: credit card, you swipe that debit card, all of that
Speaker 4: information is being stored the credit card to you. There
Speaker 4: is the time, the location the store all of that information.
Speaker 2: And last is attitudinal data.
Speaker 4: That's more about consumer satisfaction. So that's like looking at
Speaker 4: criteria to purchase an item or a service.
Speaker 2: That's a lot of different kinds of data. I think
Speaker 2: previously I would have thought it was all just one thing.
Speaker 2: So we've hit personal data, engagement data, behavioral data, and
Speaker 2: then attitudinal data.
Speaker 3: Yeah, I think most people just think it's your passwords. Yeah,
Speaker 3: that's all they're selling.
Speaker 2: And so all of these things can be legally collected.
Speaker 2: But where does it all go? That's my question?
Speaker 3: Yeah, and how are companies using that data?
Speaker 4: So once you have all of this information, all of
Speaker 4: this information is like dumped into the terabytes and petabytes
Speaker 4: on hard drives and databases.
Speaker 3: Right from there, the data is organized into large data sets.
Speaker 3: Then the companies hire data scientists to develop software to
Speaker 3: analyze the data sets, and from this they can use
Speaker 3: the data to discover patterns and make p dictions.
Speaker 4: So they take all this data and then they can say, okay,
Speaker 4: well we can predict that. You know, I don't know
Speaker 4: the twenty twenty one Nissan is going to sell more
Speaker 4: than any other vehicle in twenty twenty two.
Speaker 2: So okay, if there's a lot of engagement around a
Speaker 2: big collection or something that comes out, people can't predict.
Speaker 2: This is going to make a big splash. People are
Speaker 2: going to spend a lot of money here. People are
Speaker 2: clicking here, there's this much interest. Maybe companies adjust once
Speaker 2: they see how people are responding to things they put out.
Speaker 3: Right, Yeah, and I can see how that can be
Speaker 3: valuable to a business. You want to know where to
Speaker 3: put your marketing dollars. So you're like, if I know
Speaker 3: that everybody wants this twenty twenty one Nissan, I'm going
Speaker 3: to put my marketing dollars behind that twenty twenty one
Speaker 3: Nissan and not another car, because then it just be
Speaker 3: wasting money. Or if I am, I'm just going to
Speaker 3: like put more here and a little bit less there.
Speaker 2: That makes a lot of sense. And this really highlights
Speaker 2: what Christina told us is the motivation behind collecting this
Speaker 2: data in the first place.
Speaker 4: At the end of the day, though, it truly about
Speaker 4: getting us to buy more or use more of something.
Speaker 2: So, just like you said, TT companies are using this
Speaker 2: for marketing. They're trying to create specific targeted marketing campaigns.
Speaker 4: It's getting us to use more social media, getting us
Speaker 4: to buy more at Target. Right, Like, for example, when
Speaker 4: you go to Target and you go in to buy soap,
Speaker 4: but you coincidentally walk out with like four hundred dollars
Speaker 4: worth of stuff that you didn't really need. It's not
Speaker 4: by coincidence.
Speaker 3: Right. There have been so many times where I have
Speaker 3: online shop and I'm like, I just need a plane
Speaker 3: white blouse and next thing, I know, my car is
Speaker 3: filled with fourteen items and I've got to figure out
Speaker 3: what is going on and how did those items get
Speaker 3: in there. I know I put them there, but it
Speaker 3: just feels like everything is being put in front of
Speaker 3: me in a very specific way that makes me want
Speaker 3: to purchase.
Speaker 2: Do you know how on some of the sites, it'll say, Okay,
Speaker 2: you're looking at this white blouse, and other shoppers who
Speaker 2: looked at this also looked at this tan belt with
Speaker 2: this gold detail. Yes, I want that with my white glass.
Speaker 3: You know, they also like I'm like, oh no, you
Speaker 3: know I also like.
Speaker 2: This, yes, And so all of that, I guess is
Speaker 2: behavioral and attitudinal data that is being collected to inform
Speaker 2: my shopping, to make me continue to shop. I'm reinforcing
Speaker 2: the algorithm because you know, I'm adding it to my cart.
Speaker 3: Always, always, always. All of this feels a little bit creepy, but.
Speaker 1: It is legal and it is working. It is right.
Speaker 2: I wanted to see that, and I think that's the
Speaker 2: strangest part. Do you remember TT when we went to
Speaker 2: we were in New York.
Speaker 3: Yes, I know this story, and we.
Speaker 2: Were shopping and I was really torn on these pink Adidas.
Speaker 2: They were what Stella McCartney, Yes, I think they might
Speaker 2: have been Stella McCartney. And they had this really interesting
Speaker 2: gum soul that was pinkish reddish, but it was really
Speaker 2: giving me all the vibes I needed. And we stood
Speaker 2: there and I was like, Oh, I just bought an
Speaker 2: orange Stella McCartney hat.
Speaker 1: Instead.
Speaker 2: We left and that shoe showed up everywhere. Yeah, and
Speaker 2: any chance there was for me to get an ad
Speaker 2: it showed up.
Speaker 3: It also showed up for me. Yeah, I got Instagram
Speaker 3: ads about that specific shoe, which let us know that
Speaker 3: even like where you're standing within a store, Like some
Speaker 3: of these businesses have worked with companies that let them
Speaker 3: track where you're standing, how long you're standing there.
Speaker 2: Bluetooth Wi Fi all even if you don't connect, you
Speaker 2: still have device IDs, right, and that's your personal information.
Speaker 2: And so this divitation kids, we know it likes this
Speaker 2: type of stuff, Hugh.
Speaker 1: And it's all legal.
Speaker 4: Yes, it's all of these statistics, and it's all around
Speaker 4: the data science and the psychology around it. It's usually
Speaker 4: coordinated by like different demographics, right, it could be based
Speaker 4: on age, sex, location, how much you make if you've
Speaker 4: gotten your education.
Speaker 3: And some companies don't just use data for their own
Speaker 3: marketing purposes, they also package and sell the data to
Speaker 3: different companies and organizations. Christina points to Facebook as one example.
Speaker 4: They collect a bunch of information, including attitude and on data. Right,
Speaker 4: they know of you're feeding, side, depressed, lonely, and they're
Speaker 4: able to then serve up content that matches your mood,
Speaker 4: your demographic, how much money you make, what you like,
Speaker 4: et cetera.
Speaker 1: Et cetera.
Speaker 2: I'm not a big Facebook user, but I can say
Speaker 2: on Instagram, yes, if something is happening and I like
Speaker 2: one of those you know, text posts, and I'm like, hmm,
Speaker 2: if wait and see, or if I can show you
Speaker 2: better and I can tell you was a person when
Speaker 2: I'm feeling spicy, and I like that. It serves me
Speaker 2: up more content just like that, even if I'm not
Speaker 2: following people exactly.
Speaker 3: Look at your explore page. Your explore page is curated
Speaker 3: based off of the posts that you like, and my
Speaker 3: explore page does not look like your Explore page.
Speaker 1: Right.
Speaker 2: As a kid, yes, mine is all cooking videos, sassy quotes, and.
Speaker 1: Animals.
Speaker 3: Mine is like eyebrow babies acting silly I don't even
Speaker 3: know travel blog stuff.
Speaker 2: And now Instagram also has suggested posts in the feed,
Speaker 2: so they're constantly giving us content so that we'll say yes,
Speaker 2: I like it, no I don't. They're just trying to
Speaker 2: learn what we like and don't like.
Speaker 4: The more they learn about you, the better they can
Speaker 4: serve you. Now, because Facebook collects all of this data,
Speaker 4: that makes them extremely valuable. Because now if I'm another corporation,
Speaker 4: let's say I'm Colgate and I want to sell you
Speaker 4: more toothpaste, I need to know how you tick, why
Speaker 4: you shop, how you feel a certain way, how I
Speaker 4: can market to you as the consumer or to your demographic.
Speaker 4: And so I would go to a company like Facebook
Speaker 4: and I would say, Okay, can I buy this data set?
Speaker 4: Can I pay a charge to access this data set?
Speaker 4: Or can I pay a feed to market on your platform?
Speaker 4: Because I want to sell more toothpaste and the demographic
Speaker 4: I really want to sell to, you know, our top
Speaker 4: users on Facebook. What a lot of people don't understand
Speaker 4: is that when we do not pay for a service,
Speaker 4: we are the product.
Speaker 3: Zakia, you say this all the time.
Speaker 2: Yes, if you're not paying for it, you're on the shelf, baby.
Speaker 3: Okay, nothing in this life is free. You paying somehow.
Speaker 4: We don't pay for Twitter, we don't pay for Facebook,
Speaker 4: we don't pay for Google, we don't pay anything. What
Speaker 4: we pay with is our data.
Speaker 2: We don't pay cash, but we pay an information about
Speaker 2: who we are, what we believe, what we're interested in,
Speaker 2: what we will buy. All of those things, inform companies
Speaker 2: and help them make money off of our clicks, off
Speaker 2: what we choose to share. All of those things are
Speaker 2: just embedded into the process. You can feel kind of helpless,
Speaker 2: right because if you don't choose to let this information
Speaker 2: be shared, you can't use the site. Do you remember
Speaker 2: when there were all those emails coming out about companies
Speaker 2: updating their privacy policy.
Speaker 3: Yes, Oh my gosh, that was a wild time. I
Speaker 3: completely forgot about that.
Speaker 2: It was like everybody was sending emails at the same time.
Speaker 2: I'm about what they would and would not collect and
Speaker 2: all of this stuff. And that wasn't even tied to
Speaker 2: the United States.
Speaker 3: Right. In May twenty eighteen, the General Data Protection Regulation
Speaker 3: or GDPR was put into effect. And this is an
Speaker 3: Internet privacy and security law passed by the European Union.
Speaker 3: But since the Internet is global and most websites process
Speaker 3: data from EU citizens. It pretty much affected the entire Internet, and.
Speaker 2: So what did that mean for our privacy? As users
Speaker 2: of these websites.
Speaker 4: People basically own their data. They have a right to
Speaker 4: delete their data, to collect their data, to request that
Speaker 4: a company delete their data. So because of that, there
Speaker 4: has been a lot of legislation around privacy and more
Speaker 4: discussions around privacy and security. So now companies have to
Speaker 4: tell us that they're collecting and what they're collecting. It's
Speaker 4: a great win for privacy. It's a terrible hit to useability.
Speaker 4: It makes experience terrible because people rarely know what they're
Speaker 4: clicking on. People also don't know what they're being asked
Speaker 4: to click on.
Speaker 2: Yes, it slows down the process where you're going from
Speaker 2: site to site.
Speaker 3: Yeah, Like I said, if I'm in a rush, I'm
Speaker 3: just hitting accept because I just need to get to
Speaker 3: what I'm looking for. And I'm like, I don't have
Speaker 3: time for this. Yes, except the cookies. I love cookies,
Speaker 3: It's perfect. I prefer chocolate chill and so I just
Speaker 3: click accept and keep it moving. You know.
Speaker 2: Another option is to use Duck Duck Go. That's a
Speaker 2: browser that limits what can be collected about your browsing activity.
Speaker 1: My mom actually put me onto Duck duck Go.
Speaker 3: Really mm hmyh VICKI you want it.
Speaker 4: I use a browser called Duck Duck Go. I use
Speaker 4: it when I want to go navigate something and I
Speaker 4: don't want to be trapped or I don't want any
Speaker 4: potential malicious by whear or anything to be installed.
Speaker 2: I think this helps us get a really solid understanding
Speaker 2: of what all the various types of data are, how
Speaker 2: it's being used by companies. I mean, it seems like
Speaker 2: it's being used in aggregate, you know, so in groups
Speaker 2: to understand trends and behavior and what people like. And
Speaker 2: all this stuff is legal. But we're going to take
Speaker 2: a break and when we come back, we're going to
Speaker 2: talk about the things that are illegal. So what happens
Speaker 2: when there's a data breach or a cyber attack, and
Speaker 2: what we can do to keep our data protected.
Speaker 3: We're back and we've been talking to expert Christina Morillo
Speaker 3: about data privacy and how to have more control over
Speaker 3: the data that's shared with companies online.
Speaker 2: Next week, we're talking about organ transplants. We'll explore the
Speaker 2: science behind donor matching with our guest expert, doctor Dave
Speaker 2: Low from Thermo Fisher. Turns out it's a lot more
Speaker 2: complicated than just matching blood types.
Speaker 3: Now let's get back to the lab.
Speaker 2: So, now that we know our data is being tracked
Speaker 2: and analyzed all the time, are there protections in place
Speaker 2: to keep our personal inform?
Speaker 1: Say?
Speaker 2: Yes, I understand that what I click on and what
Speaker 2: you click on and all of our device IDs, all
Speaker 2: that stuff is supposed to be analyzed in bulk in groups,
Speaker 2: functionally making it anonymous. But is anonymized data a real
Speaker 2: thing and is it actually keeping our information safe?
Speaker 4: We ask Christina, Well, what it's opposed to mean is
Speaker 4: that any information that is collected is stripped of any
Speaker 4: personally identifiable information. If you're collecting my data, right, if
Speaker 4: you're collecting my information, that means that you're going to
Speaker 4: strip my social Security number, You're going to strip my
Speaker 4: location data, any information that can be tied back to
Speaker 4: me as a person, you're stripping it. And that's what
Speaker 4: that means by anonymized, So you're only collecting information that
Speaker 4: you really need. So it could be city state, things
Speaker 4: that are very generic that can apply to a population,
Speaker 4: versus things that are very specific to me as an individual. Now,
Speaker 4: we don't really have a guarantee. There's really no assurance.
Speaker 4: We basically have to trust that what companies say is
Speaker 4: correct until there's a breach and they say, you know,
Speaker 4: we really care about your security and care about your privacy. However,
Speaker 4: you know your data has been exposed in this breach.
Speaker 1: Yes, I don't want my data in the breach.
Speaker 3: Yes, but it always seems like everybody's data is in
Speaker 3: the breach. It always just blows my mind. There'll be
Speaker 3: a security breach and I'm just like, but I literally
Speaker 3: have never even used this before, So how is my
Speaker 3: information there?
Speaker 1: Yes?
Speaker 2: And what exactly is the breach? Wikipedia defines a data
Speaker 2: breach as the intentional or unintentional release of secure or
Speaker 2: private confidential information. But it feels wrong, right, It's not secure.
Speaker 2: If somebody accessed it and it was released, it's not secure.
Speaker 2: It's no longer private. Yeah, it definitely wasn't secure enough.
Speaker 3: It's just like you know those diaries we used to
Speaker 3: have when we were kids and had those bowlocks, and
Speaker 3: we thought everybody's secure, but all you had to do
Speaker 3: is just pull it and it would just pop right open.
Speaker 3: That's what these companies are using to protect our data.
Speaker 3: That's what it feels like. Them little pink locks ain't
Speaker 3: doing nothing. And you know, it feels like these things
Speaker 3: are happening more and more. So.
Speaker 2: There was recently a report reviewing the data breaches in
Speaker 2: the first six months of twenty nineteen, and that report
Speaker 2: showed that there were thirty eight hundred publicly disclosed data breaches.
Speaker 2: And do you want to know how many records were compromised?
Speaker 3: I feel sick already.
Speaker 1: Four point one billion.
Speaker 2: We're gonna link this in the show notes billion with
Speaker 2: a B with a B baby.
Speaker 3: Oh my gosh, it's everybody.
Speaker 2: And just to give you a sense of magnitude, three
Speaker 2: point two billion of that four point one billion, three
Speaker 2: point two billion of those records were exposed by just
Speaker 2: eight breaches. Somebody has too much access.
Speaker 3: That is crazy. Only eight breaches and you got three
Speaker 3: point two billion of those records.
Speaker 2: And the actual type of data that was exposed. It
Speaker 2: had email addresses that was in seventy percent of the
Speaker 2: data and passwords that was also in sixty five percent
Speaker 2: of those breaches.
Speaker 1: So we in trouble.
Speaker 3: We in big trouble.
Speaker 1: Yeah.
Speaker 2: And so when we think about these data breaches. We
Speaker 2: know that's not from a company wanting to know whether
Speaker 2: I like a red top or a white top, right exactly.
Speaker 2: This is something that's a little more malicious and is illegal.
Speaker 3: We all know that data is valuable, especially for companies
Speaker 3: who use data to inform their business strategies, and if
Speaker 3: it's not properly protected, then there's a risk for a
Speaker 3: cyber attack, such as a security breach or a ransomware attack.
Speaker 3: But we wanted to know more about ransomware and the
Speaker 3: people behind them.
Speaker 4: Cyber criminals. They basically want access to your bank accounts, money, right,
Speaker 4: or something of value that then they can sell on
Speaker 4: the dark web. It's malicious software and the sole purpose
Speaker 4: of it is to encrypt, which is lock rate, to
Speaker 4: encrypt your files.
Speaker 2: It's always about the money. It's always about what can
Speaker 2: be sold. Cash rules everything around me. Yes, dollar dollar bill, y'all.
Speaker 2: And it just seems that in the new digital age,
Speaker 2: ransomware is the method.
Speaker 4: So in mainencrypt your entire seed drive, so every file
Speaker 4: you have on your computer is locked, right. Sometimes it'll
Speaker 4: have a nice little lock Sometimes you'll see some kind
Speaker 4: of like logo on your screen that says you've been ransomed.
Speaker 3: Some of these things. You feel like it's obvious, like
Speaker 3: I shouldn't click on this because you click on a
Speaker 3: website and these things just start popping up and flash,
Speaker 3: and it's like, if you click here, you get a
Speaker 3: million dollars in a trip to Aruba. And you know,
Speaker 3: random text messages from unknown numbers that have weird links.
Speaker 3: I'll be getting a lot of those recently. Do you
Speaker 3: remember the Facebook acts and when you get weird links
Speaker 3: from like friends in your messenger and then if you
Speaker 3: click the link, your profile sends it to all of
Speaker 3: your friends.
Speaker 2: Everybody in your contacts. And this was happening not just
Speaker 2: on Facebook. You know, I used to dabble in Facebook.
Speaker 2: I don't anymore, but this was happening on other platforms,
Speaker 2: and people would say, oh, that wasn't me. If you
Speaker 2: get a message from me, don't click the link, you know,
Speaker 2: stuff like that.
Speaker 3: Yeah, I got an Instagram DM from I'm a friend
Speaker 3: that was saying knockoff Guji bags. You can get a
Speaker 3: knockoff Gucci bag for twenty dollars. So I text him
Speaker 3: and say, hey, you need to change your bat's word.
Speaker 2: Yes, because you're selling Gucci bags.
Speaker 1: I don't know if you know.
Speaker 2: And it happens in this world of convenience where FedEx
Speaker 2: is saying click here to check your tracking link, or
Speaker 2: somebody else is saying, hey, want to see the latest
Speaker 2: sales styles, or one in on this great travel deal,
Speaker 2: and links are everywhere, emails, text messages, and everybody's using
Speaker 2: these little shorthand bitley and all this stuff. All it
Speaker 2: takes is one click, and it's so easy to do
Speaker 2: if you let your guard down just a little bit.
Speaker 4: So you click on a link it takes you to
Speaker 4: a bad website that downloads malicious software, or you click
Speaker 4: on an attachment via email that has malicious code attached
Speaker 4: to it, which downloads that bad software onto your computer
Speaker 4: and then does its thing, which is locking off your files.
Speaker 3: What I would need to know is something like this
Speaker 3: happened to me, is how do I get my things back?
Speaker 3: I would like my things back? So after a cyber attack,
Speaker 3: how do you get out of it?
Speaker 1: Like?
Speaker 3: How do you loose yourself from the grips of these
Speaker 3: people who are attacking your software?
Speaker 4: Pay the ransom right, which is risky because the criminal
Speaker 4: or the attacker can decide not to provide the key.
Speaker 4: They can decide, oh, you know, I got your money, sucker,
Speaker 4: and I'm not going to give you back your data, right,
Speaker 4: Or they can say, ah, you paid me, I don't
Speaker 4: know one hundred and fifty million dollars, and so here
Speaker 4: here's a key, and here's access to your data. Maybe
Speaker 4: maybe not. You never know. There's no guarantee, right, it
Speaker 4: doesn't come with a warranty. The other option is that
Speaker 4: companies or individuals do not pay the ransom, and then
Speaker 4: they do restore all their data from their backups because
Speaker 4: they were smart and they did have backups. But the
Speaker 4: risk there is that whatever information the attacker collected can
Speaker 4: now be leaked and sold on the dark web.
Speaker 3: I don't have one hundred and fifty million dollars.
Speaker 1: I don't either, do you have a no?
Speaker 3: Okay, that's what I didn't want to listen, But now
Speaker 3: you know we don't got it.
Speaker 1: You know how I live, and you know I do
Speaker 1: not have a one hundred and fifty million dollars. I didn't
Speaker 1: want one hundred fifty thousand either, okay.
Speaker 2: And I think the other thing is if I had
Speaker 2: to live off my last backup, I might as well
Speaker 2: start over.
Speaker 3: Yeah, just give me a brand new everything. Right before
Speaker 3: my qualifying example, I had to write a portion of
Speaker 3: my dissertation and I lost the whole thing because my
Speaker 3: hard drive crash. I had an external hart drive, that
Speaker 3: thing broke and I basically had to start all over again.
Speaker 3: And that's when I started using the cloud. Yes, but
Speaker 3: now even the cloud ain't safe because we've seen celebrities
Speaker 3: clouds get hacked and you know, some of their racy
Speaker 3: photos make it out to the common mess ye, And
Speaker 3: so it ain't safe anywhere. And so the next thought
Speaker 3: is how do we avoid these problems in the first place? Yes,
Speaker 3: how do we get to a place where we are
Speaker 3: aware of all these goings on and protect ourselves?
Speaker 4: Cyber awareness is pretty much kind of like the education
Speaker 4: piece of that, right, So it's like, what do we
Speaker 4: need to do to protect these systems? What do we
Speaker 4: need to do to protect our networks, our software applications?
Speaker 4: What does that look like in real life?
Speaker 2: And it's all about taking these small steps every day
Speaker 2: to start building that awareness around our data to know
Speaker 2: what's important, what you should be protecting. Things that don't
Speaker 2: feel important to you may be useful to someone else.
Speaker 3: Mm hmm.
Speaker 4: Think about it like you're protecting yourself when you come
Speaker 4: home at night, you lock your doors, right, just kind
Speaker 4: of taking those small steps where make sure your passwords
Speaker 4: and your accounts, your bank accounts are secure.
Speaker 2: Christina gave us some really good advice. You know, don't
Speaker 2: share your password.
Speaker 3: But another thing is that you shouldn't use the same
Speaker 3: password for everything. Now this, I know lots of people
Speaker 3: have a Problemly, you know, you got a different password
Speaker 3: for everything. How are you supposed to remember what it
Speaker 3: is for each thing. Some things do have like a
Speaker 3: multi factor authentication. I love that me too. They'll send
Speaker 3: you a text message or an email that says, hey,
Speaker 3: here's this code. Put it in so that we can
Speaker 3: verify that it's you and not somebody else that's trying
Speaker 3: to log into.
Speaker 2: Just press yes, push it directly to my device. Christina
Speaker 2: also told us not to play sketchy games.
Speaker 3: Yeah, like those websites that let you play blackjack and
Speaker 3: stuff like that.
Speaker 2: Right, because some of those games are actually tied to
Speaker 2: bank account information. So it's different if you're just accumulating
Speaker 2: coins that are not real. But once you start tying
Speaker 2: bank info, that feels a little dangerous. I know this
Speaker 2: is gonna be hard for you friend, Yes, you know,
Speaker 2: I like that.
Speaker 3: And the last thing was don't give out personal information
Speaker 3: like your address on social media because once it's online,
Speaker 3: it's there forever. You might delete the tweet, delete the
Speaker 3: Instagram post, those pixels exist in perpetuity for all time. Yeah,
Speaker 3: so you have to be really, really careful about what
Speaker 3: you're putting out on the internet.
Speaker 2: All this is telling me is that we must remain
Speaker 2: diligent when we are using these devices. Just think about
Speaker 2: how easy it is to just zone out online or
Speaker 2: on social media and just click click, mindleusly scrolling.
Speaker 3: I have fallen asleep scrolling on Instagram to have almost
Speaker 3: purchase something. I was like, why does it only take
Speaker 3: three taps to purchase something?
Speaker 2: It's so easy to almost retweet a thing around ust
Speaker 2: click a link, and we could really compromise something in
Speaker 2: our personal and because we're all working from home now
Speaker 2: professional too.
Speaker 1: In our personal and professional lives, we're spending.
Speaker 3: A lot more time on the internet at home, so
Speaker 3: we're feeling a little bit more relaxed, a little bit
Speaker 3: more comfortable, so a lot more susceptible.
Speaker 4: As employees, we basically have a professional responsibility to keep
Speaker 4: the security and privacy of our company and customer data.
Speaker 4: So whether it's our information or employer's information, we need
Speaker 4: to make sure that we are doing the best and
Speaker 4: everything that we can to ensure security. And also companies
Speaker 4: have also a responsibility to provide that cyber security awareness, right,
Speaker 4: talk about Hey, this is what we value. If you're
Speaker 4: on your work computer, please refrain from using it for
Speaker 4: your personal matters, et cetera. So it really depends on
Speaker 4: the company. But I think education is a big part
Speaker 4: of it because there's only so much that we can
Speaker 4: do from a system point of view.
Speaker 2: And like you said, you're also more relaxed when you're
Speaker 2: working from home. It's easy to click on stuff when
Speaker 2: I'm in my pajama pants.
Speaker 3: Absolutely, I got my bondet on my at home glasses.
Speaker 1: M different glasses for at home.
Speaker 4: Yeah, you know, it really depends on what in the
Speaker 4: security community we like to call your threat model.
Speaker 3: That sounds scary.
Speaker 2: Threat modeling sounds like now we're really in a spy movie.
Speaker 2: Threat modeling is a process that identifies security vulnerabilities and
Speaker 2: countermeasures to manage risks.
Speaker 4: Who are you, what do you do for work, and
Speaker 4: what are you trying to protect. If you're a diplomat,
Speaker 4: what you need to protect is a little bit different
Speaker 4: than let's say a mom or just a banker, a teller.
Speaker 4: So it really depends on who you are and what
Speaker 4: the risks are of you being attacked.
Speaker 2: Listen, I may not be a diplomat, but that doesn't
Speaker 2: mean I want people going all through my cookies and
Speaker 2: I don't want my data to be up for grabs.
Speaker 2: That's right, and Christina says one of the best ways
Speaker 2: to protect your data is just to make sure you
Speaker 2: have a backup.
Speaker 3: Have a backup.
Speaker 4: Always have a backup of your information, right, same as
Speaker 4: when you have your credit cards in your life, you
Speaker 4: should always like have a copy or something or at
Speaker 4: least know what you have in your wallet so that
Speaker 4: if your wallet gets laws, you can call in cancel.
Speaker 1: Right.
Speaker 3: Okay, So we have to back up everything on every device.
Speaker 3: For a lot of us, that means our computers, our phones,
Speaker 3: and any other device that we use every day. For companies,
Speaker 3: that could end up being a lot of data that
Speaker 3: needs to be backed up, depending on how many employees
Speaker 3: they have.
Speaker 4: They need to have a backup of their environment, have
Speaker 4: a backup of their valuable data, their secret saws, their
Speaker 4: customer information, whatever it is that makes a business run
Speaker 4: or that allows a business to run, they should have
Speaker 4: a backup. Unfortunately, many companies and many individuals do not
Speaker 4: have a backup. So what that means is that if
Speaker 4: they do get ransomed and their files are locked or encrypted,
Speaker 4: then they cannot recover.
Speaker 2: This has been eye opening for me. I feel like
Speaker 2: I have a lot of apps I need to delete,
Speaker 2: I have a lot of practices I need to change same,
Speaker 2: and a lot of passwords that must get updated right away.
Speaker 3: I'm really just going to take the time and go
Speaker 3: through each thing and change my password. It's time. It's time.
Speaker 3: It absolutely is time. And I think that the advice
Speaker 3: that we got from Christina was really really important, and
Speaker 3: I think that everybody should be trying to do that
Speaker 3: so that we can, you know, fend off these attackers.
Speaker 2: Yeah, you know, she said, the Internet is like the
Speaker 2: deep sea or deep space, where we only know a
Speaker 2: very small percentage of it. And let me tell you something.
Speaker 2: I don't want to beat the dark web, Okay. I
Speaker 2: want to stay right here in this galaxy, the lights web. Yes,
Speaker 2: I want to step into the light Caroline, Okay, and
Speaker 2: I do not want my information all out there in
Speaker 2: those streets.
Speaker 4: We just have to stay alert, and we have to
Speaker 4: say vigilant to keep ourselves and our companies or just
Speaker 4: personal information safe as safe as possible.
Speaker 3: All Right, it's time for one thing. What's your one
Speaker 3: thing this week?
Speaker 2: Ze, I hope my one thing is our thing. Yes,
Speaker 2: this is an event called Dope Labs Unplugged and it's
Speaker 2: with the Boston Museum of Science on Thursday, April fourteenth.
Speaker 2: Guess what, It's free ninety nine. So all you have
Speaker 2: to do is register and you can join us in
Speaker 2: person in Boston April fourteenth at seven pm. We're going
Speaker 2: to have a live show. Come get these laughs and
Speaker 2: these facts in person.
Speaker 3: We want to see y'all faces. Come.
Speaker 2: That's it for Lab fifty five. I hope that after
Speaker 2: listening to this episode, you're gonna do something a little
Speaker 2: bit different. Maybe change those settings on your phone. Call
Speaker 2: us at two zero two five six seven seven zero
Speaker 2: two eight and tell us what you thought, or give
Speaker 2: us an idea for a lab you think we should
Speaker 2: do this semester. We like hearing from you, so call us.
Speaker 2: That's at two zero two five six seven seven zero
Speaker 2: two eight and don't forget that there's so much more
Speaker 2: for you to dig into on our website. There will
Speaker 2: be a cheat cheat there for today's lab and additional
Speaker 2: links and resources in the show notes. Plus, you can
Speaker 2: sign up for our newsletter, so check it out at
Speaker 2: Dope labspodcast dot com. Special thanks to today's guest expert,
Speaker 2: Christina Morillo. You can find and follow her on Twitter
Speaker 2: and Instagram at Divine Techygirl, d I v I n
Speaker 2: E t E c h y g i r L.
Speaker 3: You can find us on Twitter and Instagram at Dope
Speaker 3: Labs Podcast.
Speaker 2: And TT's on Twitter and Instagram at d R Underscore
Speaker 2: T s h O.
Speaker 3: And you can find Zakia on Twitter and Instagram at
Speaker 3: z said So. Dope Labs is a Spotify original production
Speaker 3: from Mega Ownmedia Group. Our producers are Jenny Ratlickmast and
Speaker 3: Lydia Smith of Wavebrunner Studios. Our associate producer from Mega
Speaker 3: Ohmedia is Brianna Garrett. Editing in sound design by Rob Smerciak.
Speaker 2: Mixing by Hannes Brown.
Speaker 3: Original music composed and produced by Taka Yasuzawa and Alex
Speaker 3: Sugu from Spotify Creative producers Candice Manriquez Wren and Corin Gilliard.
Speaker 3: Special thanks to Shirley ramos Yasmin of Fifi, camu Elolia,
Speaker 3: Till krat Key and Brian.
Speaker 2: Marquis, executive producers from Mega OH Media Group, r us
Speaker 2: T T Show Dia and Zakiah Wattley