Would You Like to Play a Game featuring Joshua Wathen

Transcript

Rob Dwyer (00:01.922)
Thanks for joining today. Next in Queue. I've got Joshua Wathen. Welcome to the show. Joshua, how are you?

Joshua Wathen (00:10.156)
doing well Rob thanks for having me I'm excited to be here today.

Rob Dwyer (00:12.278)
Yeah. Well, I certainly appreciate you taking your time. Joshua, you run a company called Triad InfoSec. Can you give us a little bit of background about you and how you ended up where you are today?

Joshua Wathen (00:30.39)
Yeah, so the company is a cybersecurity company. I ended up here because I know the guy that started it. I ran a leadership consultant company full time for about five years and the founder and CEO of Triad is Jason Rory. He was a client of mine when he was running his IT firm. So he got into this business because he ran an IT firm for 16 years, tried to change it into a cybersecurity firm.

Operationally, it didn't really make sense to do that. So he sold it and started this. And a year ago or so, he put on Facebook that he was looking for a veteran to help with sales because it's a veteran owned company. And I responded and say, I know all the veterans. I do a lot of veteran nonprofit stuff. Send me the job description and I'll find you somebody. And when everything was said and done, I ended up being that veteran that was partnered. And here we are.

growing this thing like wildfire.

Rob Dwyer (01:30.156)
That's fantastic. Cybersecurity is certainly a hot topic, but I'm wondering why you chose to get away from your consulting business and go into cybersecurity? Was that a strategic decision? Was that, let's try something new? What was the basis behind that?

Joshua Wathen (01:55.394)
Well, I stopped consulting full time around COVID. I was still doing leadership consulting and I had a remodel company where we were doing kind of all outdoor stuff. Doing backyards, little bit of landscaping, things like that, but building pergolas and swingsets and yada yada. Anyway, I got real sick, brought it home and my wife got like deathly ill and so did my kid. So I was like, well, I don't really need this right now.

You know, we were doing okay financially, she had a job working remote. I had saved a bunch of money from contracting a business and just said, hey, I'm going to hang out in Homestead and do all that kind of stuff. And I did all that, but what it really turned into is me having to deal with all of my PTSD for about three years because I was sitting still. And during that soul searching, I really figured out that I might be good at a CEO role, but I don't thrive.

unless I've got a partner or a team around me that's pushing me. I like that internal competition. The money is the scoreboard thing doesn't really do it for me. I like that as far as we're worth the team. This is how we measure our success, but it doesn't get me up in the morning. Knowing that there's four five other dudes that I'm working with that are delivering and I got to get up and out work and out do what they're asking me to do. That's my driving factor.

I also learned who I work with is huge. I looked back at my experience in Special Forces and how I was really productive then, contracting in school, doing businesses like that. So when this opportunity kind of fell in my lap, I still have my company. I was kind of piddling around on the side just for friends and family and stuff. But I really jumped at the opportunity to work with somebody that I respected and that I knew his character and work ethic. And it was just...

Yeah, it was God's timing. If you really want the honest truth, it was God's timing.

Rob Dwyer (03:55.8)
It's really what strikes me is that it's incredible self-awareness, that it sounds like it took you a little bit to get to, but really understanding what drives you, what motivates you, and what brings you satisfaction made a huge impact in the direction that you ultimately ended up going in.

Joshua Wathen (04:18.648)
Yeah, I wouldn't credit that to any sort of knowledge or capacity for learning as much as I had a lot of scrapes and bruises on my face and figured, how do we keep that from happening? I've always been the guy to see a wall in front of me and go, hmm, what kind of door do I want to make? And had to learn the hard way that some walls aren't meant to have doors in them. just got to, you know.

Rob Dwyer (04:32.076)
Hahaha

Joshua Wathen (04:46.252)
have a little help or get a little guidance and actually listen to what people are telling you. I battled my ego for a long time before I learned that that's not helpful.

Rob Dwyer (04:57.174)
Well, I think there's some valuable lessons just in that in and of itself. But speaking of doors and walls, let's talk a little bit about the current state of cybersecurity because in my mind, I see this as something that is going to continually be more and more critical to businesses as they move forward. And also,

An important piece of really your brand's reputation that I see continually get damaged over and over by brands because they are not investing enough into cybersecurity. let's just start with what do you see as kind of the state of the cybersecurity landscape today?

Joshua Wathen (05:52.844)
Cybersecurity is the new forefront of warfare. The anonymity, access, availability, it's all there. The way of the stick-up man is going away. You might get a couple hundred dollars from a gas station, but you're going to go to jail eventually. When it comes to cybersecurity, you can get a couple million dollars and nobody knows who you are. So much so that this is not

You know, 15 years ago, was a kid in his mom's basement hacking to try and make a name for himself. Now it's a high rise building in Russia or China with thousands of employees and their nine to five job is to get into your business and steal your information, ultimately to get your money. That's all they do.

Rob Dwyer (06:37.698)
Yeah. Yeah, it seems to me that the state actors anymore are taking over. Certainly there are non-state actors taking over, but the US, not to single out the US, but we're a very rich target and a target rich environment, if you will. Are there?

What are some of the things that you think are the biggest mistakes that companies are making today in maybe making themselves more vulnerable than the next company that does the exact same thing that they do?

Joshua Wathen (07:22.52)
You know, when it comes to like one tactic or technique, I don't think you could put a thumb on it. But I would say there's too much human nature when it comes to security. And what I mean by that is people don't do anything until it hurts. And if you wait until it hurts with cybersecurity, good luck recovering, especially if you're a small to medium sized business. It's like a, depending on what you read, a 40 to 30 % chance that you'll survive.

Rob Dwyer (07:39.073)
Hmm.

Joshua Wathen (07:53.28)
So that's the biggest thing is I understand the economy. It's rough right now. Folks are doing layoffs, Inflation's really high. But when we talk to some companies, sometimes we're looked at as just another expense line, because if we do our job right, you don't notice any difference. It's not like you see a security guard at the door or another camera.

or an access card, you don't feel it. That means we're doing our job correctly. So the understanding that we're doing our job is difficult for the immediate emotional gratification. And so that's the hard part for businesses is to recognize that what we're doing is quite possibly more important than the locks that are on your doors right now.

Because it's all your data and your data is all digital. So the access to that is through the internet. You know, not through your building. Somebody might break in and steal a laptop or two, but if we've done our job, they're not getting into that laptop. And furthermore, if we've done our job to the fullest effect, I've got a GPS tracker on that thing and I'm gonna know when it comes out of that building and I'm gonna erase it remotely.

Rob Dwyer (09:14.23)
Yeah, and I think that is one of the more challenging differences is that when I steal data, it doesn't look like anything is missing, right? It's a copy of that data that is going out the proverbial door, not a physical thing that I'm going to notice is missing. So I'm not just going to walk in one morning to the office and go, my data is missing.

because it's not necessarily missing if it's just being stolen. Now that's different than like a ransomware attack, but if you're just stealing my data, it may take a lot for me to understand that I've been breached, right?

Joshua Wathen (09:57.79)
Yeah, especially because it's not an in and out type of thing. The average time a hacker is in your system is 180 days before they do anything. It's a long game. You get into one receptionist machine, then that gets you into a different email, which gets you into a server. Then you start looking at all the data, coming around figuring out what's valuable, exporting it and copying it.

Cause ransomware has gotten huge. mean, companies have gotten smart enough to back up most of their data. So when it first started out, it was, Hey, we're going to lock you out. You don't have all your stuff. You didn't need to pay us. Now it's we're going to lock you out. And if we can't keep you from all your systems, we're going to hold your data hostage and say pay us, or I'm going to sell all this on the dark web. Then I'm going to publish it on the worldwide web. And I'm going to crush your reputation.

Right? And that's to your first point is where the reputation loss comes in. Because if you're an accountant, for example, and you've got 100 different businesses financial information or people's information, it's a big deal. It's a big deal if that gets leaked.

Rob Dwyer (11:11.916)
Yeah, I'm wondering if you can help some of those who may not have the same background understand some things that you just mentioned. So for instance, can you help us understand what is the dark web? Because that term gets thrown around a lot, but I think maybe a lot of people don't understand what that is.

Joshua Wathen (11:34.04)
Yeah, the easy way to put it is the dark web is what you're not going to find on Google. The internet is a lot bigger than what Google is going to get you to. You've got to download a different type of browser to open it up. And there's no rules on the dark web. So if you're watching this and you're like, I'm going to go play, I would advise against it. Because you click on the wrong thing and you might open up a child pornography site. Now that's on your computer and now you got to talk to a three letter agency.

Joshua Wathen (12:06.862)
It's a free marketplace. There's no oversight, no regulations. So personal identifiable information gets sold on the dark web. A typical record that'll have your social security number and your name and your address and your phone number and your email and everybody's got a profile runs for two to four dollars.

And then on the high end, a health care record runs for $40. Because if I know about your health, I can extort you.

Rob Dwyer (12:39.564)
Mmm.

Should we just all assume as consumers, not as businesses, should we just assume that our data has been compromised? And if that's the case, what can we do knowing that our data is out there and for sale?

Joshua Wathen (13:06.678)
Yeah, it's measures of defense. So if somebody wants to steal your data, let's just use identity theft with a bank transaction. They've still got to be able to log into your banking system. So just because they have all of your password questions, right? What's your middle name? Where were you born? Things like that. Your basic data, which most of that's on your social media. That's how they're grabbing it.

I'm on other ways, but they still got to log in so changing your passwords making sure that all your passwords aren't the same and Realistically if you're like me you've got 10,000 things you got to log into Get something like keeper. It's an app that you can download on your computer and on your phone I don't know. It's nominal maybe 15 20 bucks a month something like that and

It will plug in and keep all of your passwords encrypted and it will randomly generate new passwords for you and you can just have a schedule to where you update and change those passwords on a regular basis. You know, the biggest way people get hacked is they save every single password they have in their Google Chrome browser and then somebody hacks their Gmail and now I've got everything, every single thing. And then I can change the passwords to that and lock you out to where when you try and do something

Rob Dwyer (14:23.464)
Mm-hmm.

Joshua Wathen (14:30.73)
It's notifying me that you're being fraudulent, even though I'm not. It's not my stuff. So it's a lot of basics. Multi-factor authentication is huge. With LinkedIn, for example, I use that for business a lot. You can set up multi-factor authentication on LinkedIn to where you get a text message or you use an app when you log into a new device or a new location. And it'll save you.

save you from somebody else guessing the password.

Rob Dwyer (15:02.764)
Yeah, it seems like multi-factor is really one of the simplest things that both consumers and companies can do to ensure that there's at least an additional layer of authentication when it comes to who's accessing systems. And it's relatively simple for anyone to set up. Are there specific?

Concerns that you have about multifactor when it comes to a phone should I be using text message? Multifactor should I be using an authentication app? Do you have specific guidelines associated with that?

Joshua Wathen (15:49.974)
You know, something is better than nothing. Let's just start there. I wouldn't worry too much about the weeds if you're, you know, if you're not doing anything, something's better than nothing. But generally speaking, if there's an app that's encrypted, if you've got two or three multifactor authentication apps, so you can compartmentalize the different things that you're using, that helps, right? It's risk in the cybersecurity industry is not about getting things to zero risk.

It's about minimizing the exposure and then whatever exposure you have left to compartmentalize it. So that if you get access to these three things, you don't have access to everything else. So that's a big part of it. And then routinely changing those things and routinely scanning your systems. Right. For a person doing a whole network assessment on your home stuff, probably not necessary, not that big of a target.

But having your company do those types of things, making sure that you have good antivirus, not just what's downloaded on your computer right away. know, more deliberate you can be, the better. It's all about not being in a rush. And if you make the time to invest in your own security, it'll pay dividends.

Rob Dwyer (17:09.217)
Mm.

Joshua Wathen (17:18.432)
I think that most folks just they don't want to wait the 30 seconds it takes to do multi-factor on their own stuff so they don't do it. Even in companies, it's a change management piece sometimes to institute that on everything you're doing because people get frustrated that it takes them an extra 10, 15 seconds. But that's the difference between a bad click and a good click. Same thing with phishing.

Taking that extra 10, 15 seconds to verify some things could save you your job.

Rob Dwyer (17:54.594)
Yeah.

I'd like to talk about what you see as maybe an enhancement to threats or a different aspect of threats. And that really is kind of the rise of AI. And when I say that very specifically, I'm talking about voice cloning, about deep fake video technology.

Joshua Wathen (18:12.333)
Mm-hmm.

Rob Dwyer (18:26.164)
as well as some other ways that people can sound very natural when it comes to sending messages back and forth. Is that a looming threat and a new vector, or is it just an incremental thing that we need to also be wary of in the same way that we've been wary of other potential new vectors in the past?

Joshua Wathen (18:55.892)
It is definitely a new threat. is definitely something to be wary of. I use a... I'm a military guy, so I kind of think of it like this, you know, phishing, tishing vishing, of it. But phishing is your email, tishing is text, vishing is voice cloning. They're all weapons that have already been established. AI gives it a whole different new type of ammunition.

Right. So phishing is the most common that we already see. Because the number one way to recognize a phishing email used to be the grammar. It was something that would be a little off. Now with AI, the grammar is perfect. And not only is the grammar perfect, but I can take all of your CEOs and LinkedIn and social media posts, create a profile in ChatGPT

Rob Dwyer (19:33.367)
Right.

Joshua Wathen (19:49.076)
So it spits things out and sounds exactly like your CEO. Then send that email out with his slang and style attached to it as well as the perfect grammar. So things like that. When it comes to deep fakes, yeah, I can make an avatar of myself. Tell it what to do. It makes it look pretty much like me. There's some deficiencies right now.

know, shadowing sometimes like length of fingers or nose, ears, things like that will be a little bit different. But it's coming. I mean, you've got to realize that right now today is the dumbest that you will ever see AI. Tomorrow will be smarter.

Joshua Wathen (20:34.709)
So it's the two-step verification on a phone call. You can make AI sound like somebody else in a different language to make a phone call. So if you're in payroll and you get a call from somebody requesting a check and they give you all the right information and it sounds like them, hang up the phone and call them back.

Rob Dwyer (21:00.662)
Hmm.

Joshua Wathen (21:01.496)
you have their number and now you can ask them if it's really them. know, basic things like that are going to make a big difference and that goes back to that deliberate pace. I was even talking to a banker buddy of mine, he runs a decent sized bank and for a lot of their big lending, big transactions that they're doing,

Rob Dwyer (21:14.358)
Yeah.

Joshua Wathen (21:28.18)
We were talking about how they might end up going back to a human carrier, courier. Because it's such a long process already to verify and make sure that they're not going to send millions and millions of dollars to the wrong place. But they might as well just take a trusted person with a briefcase and fly them overseas to where they need to go move that money.

Rob Dwyer (21:48.364)
Wow. Yeah, low tech to combat the high tech.

Joshua Wathen (21:54.136)
Yep, that's how the Taliban avoided this in Afghanistan. They just didn't use radios and wouldn't talk about what they were going to do. Stayed small teams. And it worked.

Rob Dwyer (22:03.574)
Yeah, absolutely. I wonder if when you are talking to companies about their policies and procedures and all of those things, is the change in how people operate on these little types of things? Like you just talking about that phone call. Is that where you get the biggest pushback?

Or is it more about budget and technology and those types of things? Where's the biggest challenge in really having robust cybersecurity in a business environment?

Joshua Wathen (22:49.24)
Well, I'd say that falls on a timeline. You know, initially it's a budget conversation, a committee conversation to lean in. And that's why our recommendation is always to start with some scans and penetration tests, because then we get exposure on the facts. So we're not going and redoing things that don't need redone. If it's not broke, they'll fix it. And then once you're involved and you've got the security stack in place to include your automated phishing training and things like that.

Then we really want to do, all right, you have a plan. Let's do a tabletop exercise and see what holes there are in the plan when we go to execute it in a simulated environment. Then let's talk with HR and let's see. right. Nancy Drew is the best bookkeeper you've ever had. She's been here 25 years, but she clicks on phishing emails all the time. So now she's your number one security breach. Well, you don't want to just fire her. You want to retrain her. But what does that look like?

You've got some of the automated stuff. If that's not working, we need to sit down and give her a coaching session. If that's not working, she probably needs to go on a PIP. Let's just be honest with each other. We love you. We want you here. You're amazing at your job. But if you keep doing this and leaving the door open, then you could bring the whole company down. We've got to take this seriously. And we'll help you do that. We'll give you all the tools and techniques. I would also say that it's

There is a, we do a lot of compliance. So the government's onto this, right? And they're pushing stuff down with regulations, especially if you're in an industry that has a lot of data like CPAs, healthcare, lawyers, like that. Government contractors, big. So there is the what's required, then there's what's recommended, and then there's best in class.

So it depends on what the company wants to do, what they can afford. And again, that's usually a timeline thing, because if the egg is broken, well, let's get all the yolk back inside of it. Then let's build the outside of it. Then let's shine it up. Let's not try and do it all at once. That doesn't make sense for anybody.

Rob Dwyer (25:06.872)
brought up something that I'd like to ask your opinion on and that is about regulations. Are we in the US too lax when it comes to regulations to ensure these types of things? mean is government trying to catch up and really be behind on policy or do you feel like government is kind of where they should be but companies need to take more responsibility?

Joshua Wathen (25:38.614)
We are way behind, way behind. Like I was doing a little LinkedIn class on China's cybersecurity because I wanted to understand the regulations. They have cyber regulations on an individual basis in China and what you can log into and what you have to have in order to play in their digital environment from their internet access.

but we'll never move as fast as a nation state that is more dictatorial than a democracy or a constitutional republic, right? I also think that the capitalist society that is, or the economy that is the United States fosters a lot of innovation. And so take AI, for example.

Rob Dwyer (26:13.844)
Mm-hmm.

Joshua Wathen (26:29.472)
Just as many things that it can be used for on an evil side, it can also be used for good. And you wouldn't get that initial innovation if the government stuck its thumb on the pulse every single time a new change was made and say, slow down, let me figure this out. And I mean, not as in the military, the government messes a lot of stuff up too. Private enterprise does it right. Cause the market responds almost immediately and you can make those changes that aren't just based on theory or ego or risk, risk mitigation.

Rob Dwyer (26:35.103)
Absolutely.

Rob Dwyer (26:48.202)
you

Joshua Wathen (27:00.296)
But I would say if your viewers are sitting there thinking that, this is up to me, I would say for now, but not forever. Because it is the new forefront of warfare. Our infrastructure is constantly under attack. The water that comes out of your faucet, that plant is under attack. The power that powers your home, it's under attack. And the way that...

Rob Dwyer (27:12.301)
Mm-hmm.

Joshua Wathen (27:28.542)
I would go about getting in if I was a hacker is I would go after a vendor that works for the power company. Because you're an easier target and you don't do the same things they do. And then once you're in their system, I'm in their system. And so this is a big piece of the security framework that's coming down the pipe. Is that we all expose each other. Right? Any team.

Rob Dwyer (27:42.326)
Mm-hmm.

Joshua Wathen (27:57.268)
ever is only as strong as their weakest link. And an economy is no different when it comes to breach protection.

Rob Dwyer (28:06.134)
Yeah, it strikes me that it's not too terribly different than a contagion, right? mean, if as soon as I'm exposed, everyone that I come in contact with, meaning I have access to systems, are now also potentially exposed because of my exposure. And it can spread really quickly if I have a lot of access, meaning I come into contact with a lot of different systems.

Does that mean that potentially we should pay more attention to businesses that have a lot of tentacles? And by that I mean that work with a lot of vendors, are those businesses at a higher risk or not necessarily?

Joshua Wathen (28:57.91)
Yeah, they are. It depends on the access, but one contagion is not the other. Some of them require me sneezing near you. Some of them require intercourse, right? So it depends on what the, what the exposure is there. but yes, absolutely. To the point that for certain companies in certain industries, the cyber insurance policy is dictating that you be SOC 2 compliant, which is essentially the standard for the national standard for cybersecurity. And then they're saying, all right.

Rob Dwyer (29:06.806)
Right.

Joshua Wathen (29:27.958)
Not only you have to be SOC 2 compliant, but your vendors have to meet at least certain frameworks of this requirement if not be SOC 2 as well. And then, you know, if I'm an enterprise level company, giant company, I get to pick and choose. Everybody wants to play with me, right? So I can turn around and say, I'm only accepting bids from folks that are SOC 2. So I think that the market's going to drive some of this. The regulation's going to drive it.

And insurance kind of sits in the middle of that because ultimately they're the only ones that are absorbing the remainder of the risk.

Rob Dwyer (30:08.408)
So as you are talking with business leaders.

who may be not sure that they want to spend the money or exhaust the effort that it takes to really put up a good defense against potential threats. And I think to your point, right, we are only worried about it after we get hurt often, right? All of these threats are potential until they become real. And you reminded me a little bit,

You know, I was a baseball official for about 20 years and we used to always say a good game was a game where nobody noticed the officials, right? You walk off the field and nobody said anything to you. Like that was a good game. Nobody paid attention to you. And I feel like this is very much the same. You're doing a good job when nothing happens and there's, there's no attention being put on the end results. But I wonder,

How you talk to business leaders aside from the things that we've talked about, right? The reputational risk and the survival rate that you mentioned, 30 to 40%. What are some of the other things that you utilized in an effort to kind of do some change management on them in real time?

Joshua Wathen (31:49.016)
But you always start with a scan. Let's find the facts and then let's talk about the facts. Never make any assumptions. Everybody knows what that stands for. And don't take an alcoholic to an AA meeting unless they're ready for help.

You're wasting everybody's time. So I've been using this analogy for a little while and I think it's hilarious because it's very, very true. It's a little more big, but it's kind of true. When people ask what I do, sometimes I tell them I am a cyber doctor because I feel like an oncologist. Because the conversation typically is you know something's wrong. You can feel it. You're just not sure what it is. So I need to run some tests. I need to find out what's going on.

then we need to look at what's actually happening and how to move forward. And it may require surgery or a little bit of chemo or, you know, not much at all. But either way, we're going to stick with you, take the necessary steps in order to get you healthy. And then we're going to stay with you in order to keep you healthy. And if you want me to get you healthy and then you want me to leave, I'll do that.

just know that you might come and be seeing me again in two years and it might be worse. Right? So it's up to the person. It's up to the leadership team. That one of the, one of my mentors told me one time, he said, don't waste your time on prospects that are just going to wait till they have a problem. He said, ask them upfront, do you have a priority or problem?

And if they're not sure, they don't have a priority. And tell them, you know, that's why we do webinars, we do newsletters, do social media posts, I do speaking events, podcasting events. I try to make as much free as humanly possible. So that if you can't afford it, but you want to help protect yourself, that we can be of service. That is our top core value, is to just be of service and help people protect themselves.

Joshua Wathen (34:09.42)
So if you wanna do that, that's what that's there for. But if you wanna go pro, then let's go pro.

Rob Dwyer (34:18.656)
I love that analogy. It's got a certain gravity to it.

Rob Dwyer (34:28.066)
So if people are ready to go pro and they want to talk to you and find out maybe how they get started or get a scan, what's the best way for them to get in touch with you?

Joshua Wathen (34:44.28)
The best way to get started with cybersecurity is to go to our website triadinfosec.io. On there you'll see a contact us page. Click on that and you fill out your information and we'll schedule an hour consultation with you to go through what we see. From there I can send you a questionnaire or two if you want to kind of lean in and do a little diagnosis beforehand. So we've got some more meat to chew on. We're happy to do that.

If you want to talk to me directly, best way to do that is LinkedIn. I'm on there all the time. And I tell everybody the same thing. I will help you with whatever I can no matter what. And I mean it. My two superpowers are leadership and I know a lot of people. So typically the way that I end up helping people is with lot of introductions. But if you've got a question or two and you just want to ask.

Send me a connection request with a note with whatever your question is and I'll get back to you. And it won't be AI, but it'll be me.

Rob Dwyer (35:47.0)
That's good to know. I will make sure that you can access the LinkedIn profile and Triad's website in the show notes. So feel free to just scroll down and take a look there and go directly and connect with Joshua. Say hello. And if you have questions, by all means, reach out. I want to thank you so much for

joining the show today. This has been really informative. I know this is maybe not the most exciting thing that people want to talk about. Sometimes this is like going to the doctor and you go, yeah, I should probably not be saving all my passwords in Chrome or yeah, I should probably do this other thing. But I do think that it is not only increasingly critical for people, but for businesses. And we are

going to have to pay more and more attention to it as time goes on to keep our customer information safe.

Rob Dwyer (36:55.714)
Thanks, Joshua.

Joshua Wathen (36:58.358)
Thank you, sir. I really appreciate it. Rob, I've had a wonderful time with you. Yeah, we need to do this again sometime.

Rob Dwyer (37:05.368)
That sounds good.