Speaker 1: This is Bloomberg Business Week with Carol Masser and Bloomberg
Speaker 1: Quick Takes Tim Stinovic from Bloomberg Radio. So I do
Speaker 1: want to get to our next guest, because, as we
Speaker 1: mentioned earlier, among our most read stories on the Bloomberg
Speaker 1: in the past day is about the group of hackers
Speaker 1: who breached a massive trove of security camera data. We
Speaker 1: talked about it earlier with Bloomberg News reporter William Turton.
Speaker 1: He broke that story. This is coming on the heels
Speaker 1: of two other major hacks that we've already seen involving Microsoft,
Speaker 1: and of course earlier we saw certainly the other one
Speaker 1: that tapped into the government also tapped into the private sector.
Speaker 1: So let's get into it and see what Teresa Peyton
Speaker 1: has to say. She is former White House Chief Information Officer,
Speaker 1: first woman to do so. She's CEO at the cybersecurity
Speaker 1: advisory and strategy firm Ford List, and she joins us
Speaker 1: on the phone from Charlotte, North Carolina. Teresa, so great
Speaker 1: to have you back. I've been looking forward to this conversation.
Speaker 1: How are you. I'm doing well, Carol, thanks for asking,
Speaker 1: and I've been like forward to the conversation as well.
Speaker 1: It's it's always a good one. You ask great questions
Speaker 1: and the conversation hopefully is always really great for your
Speaker 1: listeners to give them some points to take away back
Speaker 1: in their business and personal life. Well, and I think
Speaker 1: that's the that's such a great thing to bring up
Speaker 1: because I think at this point, UM, I talked with
Speaker 1: Tom Siebel yesterday of of founder of Sebel Systems UH
Speaker 1: and A three C I or A A three AI.
Speaker 1: Excuse me, C three AI, I'll get it out. What's
Speaker 1: interesting is that we're seeing increasingly serious cybersecurity attacks come out.
Speaker 1: UH and the one with the surveillance cameras was by
Speaker 1: a group that kind of wanted to just raise the
Speaker 1: attention of you know, how many surveillance cameras they're out
Speaker 1: there and essentially how easy it is to tap. What
Speaker 1: is the conversation that we're not having that you think
Speaker 1: we need to be having around these attacks? Yeah, I
Speaker 1: mean this particular attack, although it's incredibly unfortunate because personal
Speaker 1: and confidential information was surveiled as these um hackers or
Speaker 1: did everybody um and turned you know, most everything over?
Speaker 1: But what does that mean for other hackers who potentially
Speaker 1: took advantage of the super admin access this password that
Speaker 1: was out in password dumps of past data breaches. They're
Speaker 1: probably not the only ones who took advantage of that
Speaker 1: type of access, and so what does that mean? Um?
Speaker 1: So a couple of things. Um, this is an avoidable situation.
Speaker 1: Having super admin accounts should be incredibly rare, and this
Speaker 1: password should be changed very frequently. That can be a
Speaker 1: great way to avoid something like this from happening, or
Speaker 1: to at least minimize the damages from the surveillance. The
Speaker 1: other thing that all companies can do, not just for cameras,
Speaker 1: but for employee access and very like critical information access
Speaker 1: is create a log in behavior analysis where you look
Speaker 1: at behavioral patterns. What times of day does this particular
Speaker 1: user or system log in, what's the Internet services provider
Speaker 1: they usually log into you from? What operating system? What
Speaker 1: type of devices being used? All of those can give
Speaker 1: you some baselines and some clues. Because you and I
Speaker 1: are a creatures of habit, and when you see an anomaly,
Speaker 1: that could be a warning that that is not the
Speaker 1: system or the person who's the authorized user. It could
Speaker 1: be somebody else. You know. It's interesting too, because I
Speaker 1: find if I log in on certain accounts and they're like, wait,
Speaker 1: we don't recognize this device that you're on. I certainly
Speaker 1: get a red flag. I feel like this should be
Speaker 1: the norm. Is it not the norm? And you talk
Speaker 1: about the you know, admin account, it just sounds like
Speaker 1: these are basic cybersecurity steps to be taken, you know.
Speaker 1: But if you look across the country, are we not
Speaker 1: doing it? If we look across government, are these not
Speaker 1: being kind of normally done? Yea. Oftentimes it's not being done,
Speaker 1: and the burden rests squarely on the shoulders of businesses,
Speaker 1: government organizations, and users. I mean, in this particular instance,
Speaker 1: you would think, if you're buying a security camera, it
Speaker 1: should be secure out of the box, and but the
Speaker 1: burden is actually on the business to say, well, wait
Speaker 1: a minute, let's make sure it doesn't have a default password.
Speaker 1: We'll wait a minute, let's let's make sure we have
Speaker 1: logging behaviors, you know, all of those things. Many businesses
Speaker 1: who don't do cybersecurity for a living expect that to
Speaker 1: be in there out of the box. And I keep
Speaker 1: asking the question, well, why isn't it, like, why do
Speaker 1: we continue to put this burden on the purchaser of
Speaker 1: the technology. So that's a big reason why it's still
Speaker 1: missing from sort of daily operating routines of many organizations. Teresa,
Speaker 1: when you look at in our world that I think
Speaker 1: about even my home, these smart homes, right, and we
Speaker 1: talk about smart cities and all these things that are
Speaker 1: in many ways making our world more connected, easier in
Speaker 1: some regards. But I wonder how much it's making it
Speaker 1: more vulnerable to our world easily being shut down. How
Speaker 1: do you see it? Yeah, I mean I I do
Speaker 1: believe we have reached sort of this critical mass where
Speaker 1: technology is truly ubiquitous. I mean to the point where
Speaker 1: you don't even realize it's there. Between the smart devices
Speaker 1: in your home, the cameras in your laptops, your tablets.
Speaker 1: Maybe you have a camera on your door, maybe you
Speaker 1: unlock your door using an app on your phone, all
Speaker 1: of those different conveniences and advancements we have in our
Speaker 1: lives that some of us have learned, you know, like
Speaker 1: you can't live without them. For many people, um, they
Speaker 1: are collecting patterns of life, and so that the challenge
Speaker 1: that we have is is our inability to secure data.
Speaker 1: Allah this camera hacking, Allah, Solar winds, Microsoft, you know,
Speaker 1: name the last fifteen organizations that have been victims of
Speaker 1: a cybercrime. UM that data, as it gets collected, could
Speaker 1: in fact, in the future be used to do a
Speaker 1: digital walk in on your life or mine. Those those
Speaker 1: patterns are things that are used to identify you and
Speaker 1: I UM to give us health insurance, to create credit scores.
Speaker 1: And the question is is when do you and I
Speaker 1: get to opt in or opt out at that data
Speaker 1: collection and have it be aggregated under our name. Well,
Speaker 1: we don't write. I mean like you think about any
Speaker 1: time you try to do something, if you don't opt
Speaker 1: in or agree basically to those documents that nobody can read,
Speaker 1: you know you can't access something. You know, you're increasingly
Speaker 1: your hands are tied. In terms of society, I have
Speaker 1: a question for you, and this is something that that's
Speaker 1: stuck with me many times. I did panels with UM
Speaker 1: tech leaders, tech CEOs who would be like, yeah, um
Speaker 1: my kid, I limit how much they're on social media. Yeah,
Speaker 1: I don't let my kid really spend a lot of
Speaker 1: time on a laptop or something. Do you limit kind
Speaker 1: of security access in your in your life, whether it's
Speaker 1: cameras or smart homes or anything like? How because you're
Speaker 1: concerned because you see the risk that's out there. I
Speaker 1: do so for example, UM, we do have security cameras.
Speaker 1: They're outside the house. Uh and and I managed them
Speaker 1: and I specifically didn't want baby camps in the house.
Speaker 1: Um when my children were small, and I didn't want
Speaker 1: cameras inside the house. As a matter of fact, we
Speaker 1: actually have, um, a couple of smart home devices, you know,
Speaker 1: those assistants like Alexa and Google Home. And we're very
Speaker 1: specific where they are. As a matter of fact, they're
Speaker 1: located near our two rescue Great Pyrenees And when we
Speaker 1: leave the house, they the Pyrenees like to listen to
Speaker 1: Ella Fitzgerald when we're gon. So who doesn't like to
Speaker 1: listen to Ella? I mean, right that they have good case.
Speaker 1: But we'll actually just to make it a point with
Speaker 1: my children, UM, when we're talking about family matters or
Speaker 1: school or anything in particular that you wouldn't want to
Speaker 1: broadcast out on the internet, we make it a point
Speaker 1: as a family to unplug those devices. We make it
Speaker 1: a point to make sure that those Internet of Things
Speaker 1: devices are not as part of the family conversation. I mean,
Speaker 1: how many times have you said something to somebody and
Speaker 1: Serie wakes up and says, I'm sorry, I didn't understand
Speaker 1: you too many too often exactly exactly. So there is
Speaker 1: a way to integrate this technology to make it work
Speaker 1: on your behalf. Just always understand that everything is hackable,
Speaker 1: and so you just have to be thinking about when
Speaker 1: this is compromised, what did it have access to? How
Speaker 1: could it be damaging to my family and friends who
Speaker 1: may have come in contact with it, And you'll operate
Speaker 1: a little differently and you'll be able to mitigate the
Speaker 1: damages that happen. And it's the same thing for business.
Speaker 1: Just thinking about that technology. It's great to have just
Speaker 1: assume it will be compromised. So what would the downstream
Speaker 1: impacts be if it were. It's like something to really
Speaker 1: really think about. Well, so then do you think like
Speaker 1: the story that are William Turton did um you know
Speaker 1: about these group of hackers that say they breached all
Speaker 1: these security camera uh you know, security cameras uh and
Speaker 1: their data collection to kind of show and remind the
Speaker 1: world or show the world kind of in an expose
Speaker 1: of like look at how easily you can be exposed?
Speaker 1: Are they in many ways do you think doing us
Speaker 1: a service? And will people kind of wake up because
Speaker 1: of this. I wish I could say this would be
Speaker 1: everybody's wake up called, but everybody is so stressed and dizzy,
Speaker 1: and during this time of pandemic, we're all told to
Speaker 1: be away from each other. You know, before the pandemic,
Speaker 1: we were worried about screen time, and now we're worried
Speaker 1: about being within six feet of other people. UM. The
Speaker 1: other thing that I would say is I researchers who
Speaker 1: do UM ethical hacking and produce the results. It does
Speaker 1: provide the greater good a good service. My caution to
Speaker 1: this group and other groups like them is used to
Speaker 1: really we do it with the right rules of engagement
Speaker 1: and approach, because you could have unintended consequences when you
Speaker 1: jump into something like this, where you could have actually
Speaker 1: taken very important cameras by accident offline while you were
Speaker 1: doing what you were doing, and what if those cameras
Speaker 1: were vital and important to national security and safety. So
Speaker 1: I always caution just because you can and you've got
Speaker 1: good intent, doesn't mean you should like really understand the
Speaker 1: rules of engagement before you engage in ethical white hack hacking.
Speaker 1: I know it's a good interview when our head of
Speaker 1: technical operations here at radio is like sending me messages
Speaker 1: and like commenting on things you're saying, Like, I just
Speaker 1: know people in general are just listening. So what's your advice?
Speaker 1: Just got about forty seconds, Um, Theresa, you know you
Speaker 1: understand this world. You're talking to companies, you're talking to individuals.
Speaker 1: What can we all do or at least, what's one
Speaker 1: step that we should be taking when it comes to
Speaker 1: cybersecurity and concerns? Yeah? I think one step is have
Speaker 1: a playbook. Assume you could be breached or your technology
Speaker 1: could fail you, and practice a digital disaster. It's the
Speaker 1: best thing that you can do to understand what your gaps,
Speaker 1: your holes are. And hopefully you'll never need the playbook,
Speaker 1: but it can be a great way to just sort
Speaker 1: of get everybody rallied around trying to prevent that event
Speaker 1: from happening. Thank you so much, UM, really appreciate it, Teresa.
Speaker 1: Take care of yourself. Teresa Peyton, chief executive officer at
Speaker 1: fort Alis, former White House Chief Information Officer, joining us
Speaker 1: from North Carolina.