Speaker 1: This is Bloomberg Business Week from Bloomberg Radio. I'm Carol
Speaker 1: Masser and I'm Tim Stunk. Welcome to the Bloomberg Business
Speaker 1: Week Extra, our weekly podcast bringing you a highlight or
Speaker 1: favorite or just really cool interview from the week. This one,
Speaker 1: it is a cool one. It's a timely discussion considering
Speaker 1: the Bloomberg exclusive on the group of hackers who breached
Speaker 1: a massive trove of security camera data and coming on
Speaker 1: the heels of two other major hacks. That's right, China's
Speaker 1: global attack on Microsoft's popular email software. Tim, we got
Speaker 1: that last week or just about a week ago, and
Speaker 1: then of course the equally sprawling Russian attack discovered three
Speaker 1: months ago. A lot of folks are saying, we're not
Speaker 1: talking about all of this enough, and the stakes are
Speaker 1: getting even higher when it comes to cybersecurity. And once
Speaker 1: you listen to this interview, you they want to think
Speaker 1: twice about your home security cameras and connected home devices.
Speaker 1: It certainly helped me think more about that great voice
Speaker 1: on this right, it's Theresa Peyton, former White House Chief
Speaker 1: Information Officer. Tim. She was the first woman to hold
Speaker 1: that position at the White House. She's also CEO at
Speaker 1: the cybersecurity advisorn strategy firm fortis this particular attack, although
Speaker 1: it's incredibly unfortunate because personal and confidential information was surveiled
Speaker 1: as these um hackers alerted everybody um and turned you know,
Speaker 1: most everything over. But what does that mean for other
Speaker 1: hackers who potentially took advantage of this super admin access,
Speaker 1: this password that was out in password dumps of past
Speaker 1: data breaches. They're probably not the only ones who took
Speaker 1: advantage of that type of access, And so what does
Speaker 1: that mean? UM? So a couple of things, UM, this
Speaker 1: is an avoidable situation. Having super admin accounts should be
Speaker 1: incredibly rare, and this password should be changed very frequently.
Speaker 1: That can be a great way to avoid something like
Speaker 1: this from happening, or to at least minimize the damages
Speaker 1: from the surveillance. The other thing that all companies can do,
Speaker 1: not just for cameras, but or employee access and very
Speaker 1: like critical information access is create a log in behavior
Speaker 1: analysis where you look at behavioral patterns. What times of
Speaker 1: day does this particular user or system log in, what's
Speaker 1: the Internet services provider they usually log into you? From,
Speaker 1: what operating system? What type of device is being used?
Speaker 1: All of those can give you some baselines and some
Speaker 1: clues because you and I are creations of habit and
Speaker 1: when you see an anomaly, that could be a warning
Speaker 1: that that is not the system or the person who's
Speaker 1: the authorized user. It could be somebody else. You know.
Speaker 1: It's interesting too because I find if I log in
Speaker 1: on certain accounts and they're like, wait, we don't recognize
Speaker 1: this device that you're on, I certainly get a red flag.
Speaker 1: I feel like this should be the norm. Is it
Speaker 1: not the norm? And you talk about the you know,
Speaker 1: admin account, it just sounds like these are basic cybersecurity
Speaker 1: steps to be taken, you know. But if you look
Speaker 1: across the country, are we not doing it? If we
Speaker 1: look across government, are these not being kind of normally done? Yea.
Speaker 1: Oftentimes it's not being done, and the burden rests squarely
Speaker 1: on the shoulders of businesses, government organizations, and users. I mean,
Speaker 1: in this particular instance, you would think, if you're buying
Speaker 1: a security camera, it should be secure out of the box,
Speaker 1: and but the burden is actually on the business to say, well,
Speaker 1: wait a minute, let's make sure it doesn't have a
Speaker 1: default password. We'll wait a minute, let's let's make sure
Speaker 1: we have logging behaviors, you know, all of those things.
Speaker 1: Many businesses who don't do cybersecurity for a living expect
Speaker 1: that to be in there, out of the box. And
Speaker 1: I keep asking the question, well, why isn't it, Like,
Speaker 1: why do we continue to put this burden on the
Speaker 1: purchaser of the technology. So that's a big reason why
Speaker 1: it's still missing from sort of daily operating routines of
Speaker 1: many organizations. There when you look at in a world
Speaker 1: that I think about even my home, these smart homes, right,
Speaker 1: and we talk about smart cities and all these things
Speaker 1: that are in many ways making our world more connected,
Speaker 1: easier in some regards, But I wonder how much it's
Speaker 1: making it more vulnerable to our world easily being shut down.
Speaker 1: How do you see it? Yeah, I mean I I
Speaker 1: do believe we have reached sort of this critical mass
Speaker 1: where technology is truly ubiquitous. I mean to the point
Speaker 1: where you don't even realize it's there. Between the smart
Speaker 1: devices in your home, the cameras in your laptops, your tablets.
Speaker 1: Maybe you have a camera on your door, maybe you
Speaker 1: unlock your door using an app on your phone. All
Speaker 1: of those different conveniences and advancements we have in our
Speaker 1: lives that some of us have learned, you know, like
Speaker 1: you can't live without them. For many people UM, they
Speaker 1: are collecting patterns of life, and so that the challenge
Speaker 1: that we have is is our inability to secure data
Speaker 1: all UH this camera hacking, Allah wins, Microsoft, you know
Speaker 1: name the last SUF team, organizations that have been victims
Speaker 1: of a cybercrime. UM that data, as it gets collected,
Speaker 1: could in fact, in the future be used to do
Speaker 1: a digital walk in on your life or mine. Those
Speaker 1: patterns are things that are used to identify you and
Speaker 1: I UM to give us health insurance, to create credit scores.
Speaker 1: And the question is is when do you and I
Speaker 1: get to opt in or opt out at that data
Speaker 1: collection and have it be aggregated under our name. Well,
Speaker 1: we don't write. I mean like you think about anytime
Speaker 1: you try to do something, if you don't opt in
Speaker 1: or agree basically to those documents that nobody can read,
Speaker 1: you know, you can't access something. You know, you're increasingly
Speaker 1: your hands are tied. In terms of society. I have
Speaker 1: a question for you, and this is something that that's
Speaker 1: stuck with me many times. I did panels with UM
Speaker 1: tech leaders tech CEOs who would be like, yeah, um,
Speaker 1: my kid, I limit how much they're on social media. Yeah,
Speaker 1: I don't let my kid really spend a lot of
Speaker 1: time on a laptop or something. Do you limit kind
Speaker 1: of security access in your in your life, whether it's
Speaker 1: cameras or smart homes or anything like? How do you?
Speaker 1: Because you're concerned, because you see the risk that's out there.
Speaker 1: I do so. For example, UM, we do have security cameras.
Speaker 1: They're outside the house. Uh, and and I managed them
Speaker 1: and I specifically didn't want baby cams in the house,
Speaker 1: um when my children were small, and I didn't want
Speaker 1: cameras inside the house. As a matter of fact, we
Speaker 1: actually have, um, a couple of smart home devices, you
Speaker 1: know those assistants like Alexa and Google Home. And we're
Speaker 1: very specific where they are. As a matter of fact,
Speaker 1: they're located near our two rescue Great Pyrenees. And when
Speaker 1: we leave the house, they the Pyrenees like to listen
Speaker 1: to Ella Fitzgerald when we're not so who doesn't like
Speaker 1: to listen to Ella? I mean right that they have
Speaker 1: good case. But we'll actually just to make it a
Speaker 1: point with my children, UM, when we're talking about family
Speaker 1: matters or school or anything in particular that you wouldn't
Speaker 1: want to broadcast out on the internet. We make it
Speaker 1: a point as a family to unplug those devices. We
Speaker 1: make it a point to make sure that those Internet
Speaker 1: of things devices are not as part of the family conversation.
Speaker 1: I mean, how many times have you said something to
Speaker 1: somebody and Serie wakes up and says, I'm sorry, I
Speaker 1: didn't understand you. Too many? Too often? Exactly exactly, So
Speaker 1: there is a way to integrate this technology to make
Speaker 1: it work on your behalf. Just always understand that everything
Speaker 1: is hackable, and so you just have to be thinking
Speaker 1: about when this is compromised, what did it have access to?
Speaker 1: How could it be damaging to my family and friends
Speaker 1: who may have come in contact with it, And you'll
Speaker 1: operate a little differently and you'll be able to mitigate
Speaker 1: the damages that happen. And it's the same thing for business.
Speaker 1: Just thinking about that technology. It's great to have of
Speaker 1: just assume it will be compromised. So what would the
Speaker 1: downstream impacts be if it were. It's like something to
Speaker 1: really really think about. Well, so then do you think
Speaker 1: like the story that our William Turton did, um you
Speaker 1: know about these group of hackers that say they breached
Speaker 1: all these security camera uh, you know, security cameras uh
Speaker 1: and their data collection to kind of show and remind
Speaker 1: the world or show the world kind of in an
Speaker 1: expose of like look at how easily you can be exposed?
Speaker 1: Are they in many ways? Do you think doing us
Speaker 1: a service? And will people kind of wake up because
Speaker 1: of this? I wish I could say this would be
Speaker 1: everybody's wake up call, but everybody is so stressed and dizzy,
Speaker 1: and during this time of pandemic, we're all told to
Speaker 1: be away from each other. You know, before the pandemic,
Speaker 1: we were worried about screen time, and now we're worried
Speaker 1: about being within six feet of other people. UM. The
Speaker 1: other thing that I would say is I researchers who
Speaker 1: do UM ethical hacking and produce the results. It does
Speaker 1: provide the greater good a good service. My caution to
Speaker 1: this group and other groups like them, as you could
Speaker 1: really do it with the right rules of engagement and approach,
Speaker 1: because you could have unintended consequences when you jump into
Speaker 1: something like this where you could have actually taken very
Speaker 1: important cameras by accident offline while you were doing what
Speaker 1: you were doing, and what if those cameras were vital
Speaker 1: and important to national security and safety. So I always
Speaker 1: caution just because you can and you've got good intent,
Speaker 1: doesn't mean you should like really understand the rules of
Speaker 1: engagement before you engage in ethical white hack hacking. I
Speaker 1: know it's a good interview when our head of technical
Speaker 1: operations here at radios like sending me messages and like
Speaker 1: commenting on things you're saying, Like, I just know people
Speaker 1: in general are just listening. So what's your advice? Just
Speaker 1: got about forty seconds, Um, Theresa, you know you understand
Speaker 1: this world. You're talking to companies, you're talking to individuals.
Speaker 1: What can we all do or at least what's one
Speaker 1: step that we should be taking when it comes to
Speaker 1: cybersecurity and concerns? Yeah, I think one step is have
Speaker 1: a playbook. Assume you could be breached or your technology
Speaker 1: could fail you, and practice a digital disaster. It's the
Speaker 1: best thing that you can do to understand where your
Speaker 1: gaps your holes are. And hopefully you'll never need the playbook,
Speaker 1: but it can be a great way to just sort
Speaker 1: of get everybody rallied around trying to prevent that event
Speaker 1: from happening. That was Theresa Peyton, former White House Chief
Speaker 1: Information Officer and CEO at Ford List you've been listening
Speaker 1: to Bloomberg Business Week Extra, be sure to listen to
Speaker 1: our Bloomberg Business Week Daily radio show, airing live Monday
Speaker 1: through Friday at two pm Wall Street time on Bloomberg Radio.
Speaker 1: Watch us too on our daily broadcast on YouTube just
Speaker 1: search Bloomberg Global News and you can also see me
Speaker 1: on Bloomberg Quick Take, available at Bloomberg dot com, slash qt,
Speaker 1: and then streaming platforms like Roku, Apple TV, Samsung TV,
Speaker 1: and more. I'm Tim stead Of and I'm Carol Manzer.
Speaker 1: This is Bloombergh