1 00:00:00,160 --> 00:00:04,160 Speaker 1: This is Bloomberg Business Week with Carol Masser and Bloomberg 2 00:00:04,240 --> 00:00:08,200 Speaker 1: Quick Takes Tim Stinovic from Bloomberg Radio. So I do 3 00:00:08,280 --> 00:00:10,320 Speaker 1: want to get to our next guest, because, as we 4 00:00:10,360 --> 00:00:13,760 Speaker 1: mentioned earlier, among our most read stories on the Bloomberg 5 00:00:13,800 --> 00:00:15,960 Speaker 1: in the past day is about the group of hackers 6 00:00:15,960 --> 00:00:18,880 Speaker 1: who breached a massive trove of security camera data. We 7 00:00:18,960 --> 00:00:22,200 Speaker 1: talked about it earlier with Bloomberg News reporter William Turton. 8 00:00:22,320 --> 00:00:24,520 Speaker 1: He broke that story. This is coming on the heels 9 00:00:24,560 --> 00:00:29,440 Speaker 1: of two other major hacks that we've already seen involving Microsoft, 10 00:00:29,720 --> 00:00:33,400 Speaker 1: and of course earlier we saw certainly the other one 11 00:00:33,440 --> 00:00:37,920 Speaker 1: that tapped into the government also tapped into the private sector. 12 00:00:38,159 --> 00:00:40,280 Speaker 1: So let's get into it and see what Teresa Peyton 13 00:00:40,360 --> 00:00:43,600 Speaker 1: has to say. She is former White House Chief Information Officer, 14 00:00:43,640 --> 00:00:46,680 Speaker 1: first woman to do so. She's CEO at the cybersecurity 15 00:00:46,680 --> 00:00:49,400 Speaker 1: advisory and strategy firm Ford List, and she joins us 16 00:00:49,400 --> 00:00:52,440 Speaker 1: on the phone from Charlotte, North Carolina. Teresa, so great 17 00:00:52,440 --> 00:00:55,520 Speaker 1: to have you back. I've been looking forward to this conversation. 18 00:00:55,600 --> 00:00:59,400 Speaker 1: How are you. I'm doing well, Carol, thanks for asking, 19 00:00:59,400 --> 00:01:01,760 Speaker 1: and I've been like forward to the conversation as well. 20 00:01:01,760 --> 00:01:04,240 Speaker 1: It's it's always a good one. You ask great questions 21 00:01:04,520 --> 00:01:08,080 Speaker 1: and the conversation hopefully is always really great for your 22 00:01:08,120 --> 00:01:11,080 Speaker 1: listeners to give them some points to take away back 23 00:01:11,080 --> 00:01:13,000 Speaker 1: in their business and personal life. Well, and I think 24 00:01:13,040 --> 00:01:15,319 Speaker 1: that's the that's such a great thing to bring up 25 00:01:15,360 --> 00:01:17,520 Speaker 1: because I think at this point, UM, I talked with 26 00:01:17,640 --> 00:01:22,280 Speaker 1: Tom Siebel yesterday of of founder of Sebel Systems UH 27 00:01:22,280 --> 00:01:24,840 Speaker 1: and A three C I or A A three AI. 28 00:01:24,959 --> 00:01:27,440 Speaker 1: Excuse me, C three AI, I'll get it out. What's 29 00:01:27,440 --> 00:01:33,039 Speaker 1: interesting is that we're seeing increasingly serious cybersecurity attacks come out. 30 00:01:33,560 --> 00:01:36,560 Speaker 1: UH and the one with the surveillance cameras was by 31 00:01:36,560 --> 00:01:38,360 Speaker 1: a group that kind of wanted to just raise the 32 00:01:38,400 --> 00:01:41,280 Speaker 1: attention of you know, how many surveillance cameras they're out 33 00:01:41,319 --> 00:01:43,840 Speaker 1: there and essentially how easy it is to tap. What 34 00:01:44,000 --> 00:01:45,880 Speaker 1: is the conversation that we're not having that you think 35 00:01:45,920 --> 00:01:49,360 Speaker 1: we need to be having around these attacks? Yeah, I 36 00:01:49,360 --> 00:01:55,400 Speaker 1: mean this particular attack, although it's incredibly unfortunate because personal 37 00:01:55,400 --> 00:02:00,120 Speaker 1: and confidential information was surveiled as these um hackers or 38 00:02:00,160 --> 00:02:03,720 Speaker 1: did everybody um and turned you know, most everything over? 39 00:02:04,320 --> 00:02:07,240 Speaker 1: But what does that mean for other hackers who potentially 40 00:02:07,320 --> 00:02:12,720 Speaker 1: took advantage of the super admin access this password that 41 00:02:12,880 --> 00:02:18,040 Speaker 1: was out in password dumps of past data breaches. They're 42 00:02:18,040 --> 00:02:20,120 Speaker 1: probably not the only ones who took advantage of that 43 00:02:20,200 --> 00:02:23,320 Speaker 1: type of access, and so what does that mean? Um? 44 00:02:23,360 --> 00:02:27,720 Speaker 1: So a couple of things. Um, this is an avoidable situation. 45 00:02:28,520 --> 00:02:31,840 Speaker 1: Having super admin accounts should be incredibly rare, and this 46 00:02:31,960 --> 00:02:36,320 Speaker 1: password should be changed very frequently. That can be a 47 00:02:36,320 --> 00:02:39,360 Speaker 1: great way to avoid something like this from happening, or 48 00:02:39,400 --> 00:02:43,360 Speaker 1: to at least minimize the damages from the surveillance. The 49 00:02:43,440 --> 00:02:46,880 Speaker 1: other thing that all companies can do, not just for cameras, 50 00:02:46,919 --> 00:02:51,880 Speaker 1: but for employee access and very like critical information access 51 00:02:52,480 --> 00:02:56,760 Speaker 1: is create a log in behavior analysis where you look 52 00:02:56,919 --> 00:03:01,320 Speaker 1: at behavioral patterns. What times of day does this particular 53 00:03:01,480 --> 00:03:05,480 Speaker 1: user or system log in, what's the Internet services provider 54 00:03:05,520 --> 00:03:09,680 Speaker 1: they usually log into you from? What operating system? What 55 00:03:09,800 --> 00:03:12,799 Speaker 1: type of devices being used? All of those can give 56 00:03:12,840 --> 00:03:15,239 Speaker 1: you some baselines and some clues. Because you and I 57 00:03:15,280 --> 00:03:18,080 Speaker 1: are a creatures of habit, and when you see an anomaly, 58 00:03:18,240 --> 00:03:21,240 Speaker 1: that could be a warning that that is not the 59 00:03:21,320 --> 00:03:25,200 Speaker 1: system or the person who's the authorized user. It could 60 00:03:25,200 --> 00:03:27,520 Speaker 1: be somebody else. You know. It's interesting too, because I 61 00:03:27,520 --> 00:03:30,200 Speaker 1: find if I log in on certain accounts and they're like, wait, 62 00:03:30,200 --> 00:03:32,280 Speaker 1: we don't recognize this device that you're on. I certainly 63 00:03:32,320 --> 00:03:35,000 Speaker 1: get a red flag. I feel like this should be 64 00:03:35,040 --> 00:03:37,200 Speaker 1: the norm. Is it not the norm? And you talk 65 00:03:37,240 --> 00:03:39,560 Speaker 1: about the you know, admin account, it just sounds like 66 00:03:39,600 --> 00:03:43,880 Speaker 1: these are basic cybersecurity steps to be taken, you know. 67 00:03:43,920 --> 00:03:45,760 Speaker 1: But if you look across the country, are we not 68 00:03:45,840 --> 00:03:48,120 Speaker 1: doing it? If we look across government, are these not 69 00:03:48,200 --> 00:03:53,680 Speaker 1: being kind of normally done? Yea. Oftentimes it's not being done, 70 00:03:53,840 --> 00:03:58,440 Speaker 1: and the burden rests squarely on the shoulders of businesses, 71 00:03:58,560 --> 00:04:02,640 Speaker 1: government organizations, and users. I mean, in this particular instance, 72 00:04:02,800 --> 00:04:06,960 Speaker 1: you would think, if you're buying a security camera, it 73 00:04:06,960 --> 00:04:09,280 Speaker 1: should be secure out of the box, and but the 74 00:04:09,320 --> 00:04:12,160 Speaker 1: burden is actually on the business to say, well, wait 75 00:04:12,160 --> 00:04:14,120 Speaker 1: a minute, let's make sure it doesn't have a default password. 76 00:04:14,160 --> 00:04:16,120 Speaker 1: We'll wait a minute, let's let's make sure we have 77 00:04:16,200 --> 00:04:20,160 Speaker 1: logging behaviors, you know, all of those things. Many businesses 78 00:04:20,320 --> 00:04:23,400 Speaker 1: who don't do cybersecurity for a living expect that to 79 00:04:23,480 --> 00:04:26,279 Speaker 1: be in there out of the box. And I keep 80 00:04:26,320 --> 00:04:29,440 Speaker 1: asking the question, well, why isn't it, like, why do 81 00:04:29,560 --> 00:04:33,160 Speaker 1: we continue to put this burden on the purchaser of 82 00:04:33,200 --> 00:04:36,440 Speaker 1: the technology. So that's a big reason why it's still 83 00:04:36,560 --> 00:04:40,960 Speaker 1: missing from sort of daily operating routines of many organizations. Teresa, 84 00:04:41,240 --> 00:04:43,040 Speaker 1: when you look at in our world that I think 85 00:04:43,080 --> 00:04:45,760 Speaker 1: about even my home, these smart homes, right, and we 86 00:04:45,800 --> 00:04:48,600 Speaker 1: talk about smart cities and all these things that are 87 00:04:48,600 --> 00:04:53,120 Speaker 1: in many ways making our world more connected, easier in 88 00:04:53,160 --> 00:04:55,280 Speaker 1: some regards. But I wonder how much it's making it 89 00:04:55,320 --> 00:04:58,760 Speaker 1: more vulnerable to our world easily being shut down. How 90 00:04:58,760 --> 00:05:02,120 Speaker 1: do you see it? Yeah, I mean I I do 91 00:05:02,400 --> 00:05:06,120 Speaker 1: believe we have reached sort of this critical mass where 92 00:05:06,560 --> 00:05:10,640 Speaker 1: technology is truly ubiquitous. I mean to the point where 93 00:05:11,040 --> 00:05:14,680 Speaker 1: you don't even realize it's there. Between the smart devices 94 00:05:14,680 --> 00:05:19,040 Speaker 1: in your home, the cameras in your laptops, your tablets. 95 00:05:19,520 --> 00:05:21,640 Speaker 1: Maybe you have a camera on your door, maybe you 96 00:05:21,720 --> 00:05:25,239 Speaker 1: unlock your door using an app on your phone, all 97 00:05:25,279 --> 00:05:29,680 Speaker 1: of those different conveniences and advancements we have in our 98 00:05:29,720 --> 00:05:32,360 Speaker 1: lives that some of us have learned, you know, like 99 00:05:32,480 --> 00:05:35,440 Speaker 1: you can't live without them. For many people, um, they 100 00:05:35,480 --> 00:05:40,159 Speaker 1: are collecting patterns of life, and so that the challenge 101 00:05:40,200 --> 00:05:43,479 Speaker 1: that we have is is our inability to secure data. 102 00:05:44,040 --> 00:05:48,720 Speaker 1: Allah this camera hacking, Allah, Solar winds, Microsoft, you know, 103 00:05:48,839 --> 00:05:53,840 Speaker 1: name the last fifteen organizations that have been victims of 104 00:05:53,960 --> 00:05:58,120 Speaker 1: a cybercrime. UM that data, as it gets collected, could 105 00:05:58,279 --> 00:06:00,560 Speaker 1: in fact, in the future be used to do a 106 00:06:00,640 --> 00:06:03,679 Speaker 1: digital walk in on your life or mine. Those those 107 00:06:03,720 --> 00:06:06,920 Speaker 1: patterns are things that are used to identify you and 108 00:06:06,960 --> 00:06:10,719 Speaker 1: I UM to give us health insurance, to create credit scores. 109 00:06:10,920 --> 00:06:13,159 Speaker 1: And the question is is when do you and I 110 00:06:13,200 --> 00:06:16,279 Speaker 1: get to opt in or opt out at that data 111 00:06:16,279 --> 00:06:19,520 Speaker 1: collection and have it be aggregated under our name. Well, 112 00:06:19,520 --> 00:06:22,760 Speaker 1: we don't write. I mean like you think about any 113 00:06:22,800 --> 00:06:25,040 Speaker 1: time you try to do something, if you don't opt 114 00:06:25,040 --> 00:06:29,480 Speaker 1: in or agree basically to those documents that nobody can read, 115 00:06:29,960 --> 00:06:33,000 Speaker 1: you know you can't access something. You know, you're increasingly 116 00:06:33,040 --> 00:06:35,279 Speaker 1: your hands are tied. In terms of society, I have 117 00:06:35,320 --> 00:06:37,760 Speaker 1: a question for you, and this is something that that's 118 00:06:37,760 --> 00:06:40,520 Speaker 1: stuck with me many times. I did panels with UM 119 00:06:40,880 --> 00:06:45,000 Speaker 1: tech leaders, tech CEOs who would be like, yeah, um 120 00:06:45,000 --> 00:06:47,279 Speaker 1: my kid, I limit how much they're on social media. Yeah, 121 00:06:47,320 --> 00:06:48,920 Speaker 1: I don't let my kid really spend a lot of 122 00:06:48,920 --> 00:06:53,920 Speaker 1: time on a laptop or something. Do you limit kind 123 00:06:53,920 --> 00:06:57,120 Speaker 1: of security access in your in your life, whether it's 124 00:06:57,200 --> 00:07:01,080 Speaker 1: cameras or smart homes or anything like? How because you're 125 00:07:01,120 --> 00:07:05,320 Speaker 1: concerned because you see the risk that's out there. I 126 00:07:05,360 --> 00:07:09,520 Speaker 1: do so for example, UM, we do have security cameras. 127 00:07:09,520 --> 00:07:13,520 Speaker 1: They're outside the house. Uh and and I managed them 128 00:07:13,560 --> 00:07:17,680 Speaker 1: and I specifically didn't want baby camps in the house. 129 00:07:17,920 --> 00:07:20,040 Speaker 1: Um when my children were small, and I didn't want 130 00:07:20,080 --> 00:07:22,480 Speaker 1: cameras inside the house. As a matter of fact, we 131 00:07:22,520 --> 00:07:27,280 Speaker 1: actually have, um, a couple of smart home devices, you know, 132 00:07:27,320 --> 00:07:31,000 Speaker 1: those assistants like Alexa and Google Home. And we're very 133 00:07:31,040 --> 00:07:32,920 Speaker 1: specific where they are. As a matter of fact, they're 134 00:07:32,960 --> 00:07:36,000 Speaker 1: located near our two rescue Great Pyrenees And when we 135 00:07:36,080 --> 00:07:39,040 Speaker 1: leave the house, they the Pyrenees like to listen to 136 00:07:39,040 --> 00:07:41,760 Speaker 1: Ella Fitzgerald when we're gon. So who doesn't like to 137 00:07:41,800 --> 00:07:44,920 Speaker 1: listen to Ella? I mean, right that they have good case. 138 00:07:45,240 --> 00:07:47,920 Speaker 1: But we'll actually just to make it a point with 139 00:07:47,960 --> 00:07:51,760 Speaker 1: my children, UM, when we're talking about family matters or 140 00:07:51,800 --> 00:07:54,760 Speaker 1: school or anything in particular that you wouldn't want to 141 00:07:54,800 --> 00:07:57,440 Speaker 1: broadcast out on the internet, we make it a point 142 00:07:57,440 --> 00:08:00,600 Speaker 1: as a family to unplug those devices. We make it 143 00:08:00,640 --> 00:08:03,160 Speaker 1: a point to make sure that those Internet of Things 144 00:08:03,160 --> 00:08:06,600 Speaker 1: devices are not as part of the family conversation. I mean, 145 00:08:06,640 --> 00:08:09,880 Speaker 1: how many times have you said something to somebody and 146 00:08:10,080 --> 00:08:12,640 Speaker 1: Serie wakes up and says, I'm sorry, I didn't understand 147 00:08:12,680 --> 00:08:17,240 Speaker 1: you too many too often exactly exactly. So there is 148 00:08:17,280 --> 00:08:20,840 Speaker 1: a way to integrate this technology to make it work 149 00:08:20,880 --> 00:08:26,160 Speaker 1: on your behalf. Just always understand that everything is hackable, 150 00:08:26,480 --> 00:08:28,880 Speaker 1: and so you just have to be thinking about when 151 00:08:28,880 --> 00:08:33,120 Speaker 1: this is compromised, what did it have access to? How 152 00:08:33,240 --> 00:08:35,800 Speaker 1: could it be damaging to my family and friends who 153 00:08:35,880 --> 00:08:38,559 Speaker 1: may have come in contact with it, And you'll operate 154 00:08:38,600 --> 00:08:41,240 Speaker 1: a little differently and you'll be able to mitigate the 155 00:08:41,360 --> 00:08:43,840 Speaker 1: damages that happen. And it's the same thing for business. 156 00:08:44,040 --> 00:08:47,880 Speaker 1: Just thinking about that technology. It's great to have just 157 00:08:48,000 --> 00:08:50,800 Speaker 1: assume it will be compromised. So what would the downstream 158 00:08:50,840 --> 00:08:55,280 Speaker 1: impacts be if it were. It's like something to really 159 00:08:55,320 --> 00:08:57,000 Speaker 1: really think about. Well, so then do you think like 160 00:08:57,040 --> 00:09:00,440 Speaker 1: the story that are William Turton did um you know 161 00:09:00,520 --> 00:09:04,240 Speaker 1: about these group of hackers that say they breached all 162 00:09:04,280 --> 00:09:09,080 Speaker 1: these security camera uh you know, security cameras uh and 163 00:09:09,120 --> 00:09:12,280 Speaker 1: their data collection to kind of show and remind the 164 00:09:12,280 --> 00:09:14,400 Speaker 1: world or show the world kind of in an expose 165 00:09:14,600 --> 00:09:18,000 Speaker 1: of like look at how easily you can be exposed? 166 00:09:18,200 --> 00:09:20,200 Speaker 1: Are they in many ways do you think doing us 167 00:09:20,200 --> 00:09:22,839 Speaker 1: a service? And will people kind of wake up because 168 00:09:22,880 --> 00:09:27,199 Speaker 1: of this. I wish I could say this would be 169 00:09:27,240 --> 00:09:31,559 Speaker 1: everybody's wake up called, but everybody is so stressed and dizzy, 170 00:09:31,640 --> 00:09:34,600 Speaker 1: and during this time of pandemic, we're all told to 171 00:09:34,600 --> 00:09:36,800 Speaker 1: be away from each other. You know, before the pandemic, 172 00:09:36,840 --> 00:09:39,520 Speaker 1: we were worried about screen time, and now we're worried 173 00:09:39,520 --> 00:09:42,920 Speaker 1: about being within six feet of other people. UM. The 174 00:09:43,000 --> 00:09:46,760 Speaker 1: other thing that I would say is I researchers who 175 00:09:46,840 --> 00:09:51,760 Speaker 1: do UM ethical hacking and produce the results. It does 176 00:09:51,880 --> 00:09:56,560 Speaker 1: provide the greater good a good service. My caution to 177 00:09:56,760 --> 00:09:59,720 Speaker 1: this group and other groups like them is used to 178 00:09:59,760 --> 00:10:02,240 Speaker 1: really we do it with the right rules of engagement 179 00:10:02,440 --> 00:10:07,160 Speaker 1: and approach, because you could have unintended consequences when you 180 00:10:07,240 --> 00:10:10,520 Speaker 1: jump into something like this, where you could have actually 181 00:10:10,520 --> 00:10:14,400 Speaker 1: taken very important cameras by accident offline while you were 182 00:10:14,440 --> 00:10:17,200 Speaker 1: doing what you were doing, and what if those cameras 183 00:10:17,200 --> 00:10:20,800 Speaker 1: were vital and important to national security and safety. So 184 00:10:20,840 --> 00:10:24,760 Speaker 1: I always caution just because you can and you've got 185 00:10:24,760 --> 00:10:28,320 Speaker 1: good intent, doesn't mean you should like really understand the 186 00:10:28,360 --> 00:10:32,240 Speaker 1: rules of engagement before you engage in ethical white hack hacking. 187 00:10:32,480 --> 00:10:34,760 Speaker 1: I know it's a good interview when our head of 188 00:10:34,760 --> 00:10:37,760 Speaker 1: technical operations here at radio is like sending me messages 189 00:10:37,800 --> 00:10:41,120 Speaker 1: and like commenting on things you're saying, Like, I just 190 00:10:41,160 --> 00:10:44,520 Speaker 1: know people in general are just listening. So what's your advice? 191 00:10:44,600 --> 00:10:47,360 Speaker 1: Just got about forty seconds, Um, Theresa, you know you 192 00:10:47,440 --> 00:10:50,480 Speaker 1: understand this world. You're talking to companies, you're talking to individuals. 193 00:10:50,840 --> 00:10:52,880 Speaker 1: What can we all do or at least, what's one 194 00:10:52,920 --> 00:10:54,800 Speaker 1: step that we should be taking when it comes to 195 00:10:55,480 --> 00:11:00,160 Speaker 1: cybersecurity and concerns? Yeah? I think one step is have 196 00:11:00,360 --> 00:11:04,320 Speaker 1: a playbook. Assume you could be breached or your technology 197 00:11:04,360 --> 00:11:08,320 Speaker 1: could fail you, and practice a digital disaster. It's the 198 00:11:08,360 --> 00:11:10,840 Speaker 1: best thing that you can do to understand what your gaps, 199 00:11:11,240 --> 00:11:14,199 Speaker 1: your holes are. And hopefully you'll never need the playbook, 200 00:11:14,440 --> 00:11:16,000 Speaker 1: but it can be a great way to just sort 201 00:11:16,040 --> 00:11:19,520 Speaker 1: of get everybody rallied around trying to prevent that event 202 00:11:19,559 --> 00:11:23,160 Speaker 1: from happening. Thank you so much, UM, really appreciate it, Teresa. 203 00:11:23,280 --> 00:11:26,400 Speaker 1: Take care of yourself. Teresa Peyton, chief executive officer at 204 00:11:26,400 --> 00:11:29,800 Speaker 1: fort Alis, former White House Chief Information Officer, joining us 205 00:11:30,080 --> 00:11:31,119 Speaker 1: from North Carolina.