Protect Your Business Data: Expert Tips for Enhanced Security with Darren Gallop

it is affecting businesses of all sizes and there's a kind of a couple of different camps there's organizations that are just being alert to the realities and they're wanting to be preemptive and build a security program and that that's very admirable I think most smbs unfortunately the reason that they they decide to Endeavor into building a security or privacy program is because something happens that makes it mandatory and now what we see like you're talking about a dentist clinic it's a good example because the b2c side is a little less clear because most consumers don't have the sophistication or time or unnecessarily feeling of the individual risk to scrutinize each of their vendors to the same degree a lot of people are unfortunately not super aware of how they'd even do that but hackers yeah hackers go with the least resistance if they're seeing a certain demographic customers or certain niche of companies starting to tighten their security they're going to move and find a niche that hasn't gotten there yet it's b2c companies or I would say in a lot of ways higher risk now yes [Music] welcome to Super entrepreneurs podcast I'm your host Shahid durani today we have with us Darren Gallup Darren is a business leader and security professional with over 20 years of experience as a CEO and ciso of companies that handle sensitive data Welcome to our show Darren thanks for having me happy to be here it's great to have you my friend so can you share with us how you got into this world yeah it's a pretty fascinating story my background in my early 20s was in music I was a professional musician for several years got into producing and Engineering records started a record to start a music studio that turned into a record label uh and then in 2008 I started my first tech company which was actually built around helping managing the logistics of touring musical groups and labels and managers and the folks that work with coordinating all the activities associated with touring musicians that pivoted to include festivals in 2012 and by 2015 we had Burning Man Bonnaroo Coachella Just for Laughs X Games it's just a pile of big events in 23 countries around the world and the product and customer base evolved in being larger and the product evolved to having more and more confidential information so naturally the requests that we were getting from the the purchasers the people are using the product especially organizations like Live Nation AG Disney that have fairly sophisticated cyber security a due diligence departments they're looking at their vendors and their security posture overall I just it's got it really intense for us and it actually in fact became became one of the biggest barriers in the business and I ended up putting a lot of emphasis on it fixing the problem understanding the problem learning about what our best practices for what we're doing and this is all just around the time when the gdpr general data protection regulation out of Europe was being drafted not yet had not yet been put to punishable by law or anything but it was out there and everybody knew it was coming we were navigating ISO 27001 sock 2 getting ready for gdpr there's some Canadian regulations that we had to beef up on as well and so this became a big barrier to sales to renewals and I dove in all over it and just got me it's pushed me into being super immersed in the security and data privacy world over a span of about a year we went from being fairly naive about it having some best practices by default but generally not having full comprehensive security and privacy posture and we went to being really the leader in our space in terms of having our security and data privacy where it should be and that Journey involves taking some courses online reading a lot bringing Consulting Consultants working with them learning from them drafting policies building controls training people amongst our team re-architecting parts of our Tech stock and apis and various different things like that so it was very immersive kind of gun to our heads like feeling of we need to do this or we're going to be we're going to be taking out as a as a company this is a this is super important and then when we got there once we got to that point we really started feeling that it was a very good place to be from a sales perspective in in the competitive landscape so we actually didn't stop there we kept improving our posture we kept innovating around how we do things secured in a secure way giving security features to the customers and becoming a bit more of a Trail Blazer in that context I moved along to get my CIP certification and then in that Journeys when I started thinking about this wow this is a big problem that a lot of small to medium-sized companies are going to get slapped in the face with and they're not going to be ready for it and the consultant world of the templates out there and a lot of the toolage out there is designed for the Enterprise risk world and there really wasn't much demand or much created around helping organizations that were smaller that we're going to need to very quickly meet these Enterprise security requirements of their customers so I just got really obsessed about it and then as we started eyeing the acquisition of the last company I was pretty deep into the idea of how do we create automation how do we generate documents how do we create tailored Security Programs using models and matrixes and software and things like that so it was just a really natural next step to jump into and something with a huge Market potential that was exciting I like big messy problems where you can see through all the murkiness and you can see a way to to build a solution like most of those Visions the build is harder than the vision and it's proven to be the case but that's how I went from being in my 20s playing the drums and music and producing records to being a security leader and building and running a security business and if you enjoy challenges you learn a lot more too yeah it's been a massive learning experience like the whole thing of navigating them back in my last company was a huge learning experience but just the experience of building a security company is just very different in building a music company or an event company so it's been a huge difference yeah yeah and the expertise is coming mostly from experience like hands-on experience yeah initially it was like I took some online courses I bought I went through a certification process that involved reading and studying from very thick books and taking some online courses and things like that and initially that's where it derived from but as the company started to mature poster seed round we actually started recruiting talent that has other other experience and more years in the trenches in the security world so we've run a VP of product our VP of product our VP of sales both came from security companies with pretty strong backgrounds and selling or servicing security customers and we brought on an expert out of the US that really helps us somebody who worked at PWC and some of the other bigger firms and really experienced in a more Enterprise security word world so we could diversely brought in an I.T security guy who's got a lot of experience in application security penetration test ethical hacking and all that stuff started with started with my research sort of philosophies and thoughts around this which but I and it's still that's still an important part like that Vision we brought in all these highly skilled people but it's one of the things that I really early on in this journey found was this huge differentiator in my way of looking at this problem was that like I wasn't a security person first I was the person that was like an entrepreneur dealing with the problem and I took a more I think I took a more creative in a more thoughtful approach versus just reading stringent controls from very large security standards and trying to stuff them into companies that were very different maybe all companies a lot of companies we deal with are SAS companies you've got maybe there's no office Network maybe everybody works from home and really the network and the IT environment is highly cloud or SAS SAS organize different SAS tools that are integrated together by apis just a different lingo different mindset and just recreate how we talk about security and how we approach it in a way that can fit into the organizational culture these small to medium-sized businesses and what do you think the landscape will look like with artificial intelligence becoming more part of our lives and in businesses yeah big question I think about it a lot definitely been very I've been following the open Ai and some of the other AI llms from for a while now and been a heavy user of chat CPT since it became able to the public I do use it in a regular almost daily basis in the line of work that I do just whatever I'm doing whether it's on the personal front to in the kitchen making recipes and coming up with meal plans things I'm working on at work we have partnered with a company that's built an abstraction layer a for us set us up in a way we've baked an open AI integration into our version 2.0 over platform we're actually very deeply innovating on the AI front leveraging AI in terms of how our tool will evolve which I think a lot of companies are doing that determine how does it affect the how does it affect the space it's going to give super tools to both the adversary criminals your hackers your malicious actors it's doing that already the the criminal world is heavily using chat CPT in their line of fraudulent work and that ranges from just making their emails seem more like they're a native speaker of whatever language they're trying to hack you in um chat CPT is really good at translating and that's a good potentially and so like the phishing emails and stuff like that like the likelihood of seeing grammatical errors or non-collochial type language is reduced highly by the use of chat CPT we now see I did I actually did an episode on chat CPT and and I I featured in my last my last episode of my podcast I featured what we call the AI scam or the I call it the AI voice scam and essentially what it is I could take a very small sample of your voice I could program a tool within about five minutes to replicate your voice and then I can talk to my microphone and essentially sound like you like colloquial accent tonality intonation and everything right we did some samples where I recorded my own voice uh trained a tool typed out some messages had it do a portion of the podcast where it wasn't actually me speaking so like that technology is very accessible in the hands of every single individual just be more or less on the planet and we're seeing that happening there's been scams all over the US and Canada where grandparents get a phone call and it's somebody pretending they have their daughter and you can hear the daughter in a very convincing very real her voice help mommy give the man the money so he lets me go like all kinds of weird things like that are happening right so that's going to happen across the direct to direct to Everyday People are going to be hit with this and it's happened on a daily basis it's gonna have it's going to elevate things on the other side and then we see hackers building hackers that are like more like script kitties that may not have the skills to generate to really sophisticated malware but they're able to trick Chachi PT into creating malicious code for them that they can then leverage and use we're seeing it on that side and then on the good guys side it's kind of like the same game rate it's like somebody invented the radar gun so that you catch Speeders and then yeah companies invented the tool that the cops could use to see Catch the radar guns and then somebody came up with a radar detector detector it's like that ping pong volley going on and what we're seeing on the cyber security size there's tons of stuff happening like we're in innovating and leveraging AI in a very big way on documentation and control generation report generation variety of different things there we're seeing it in advanced threat detection where anomaly detection can be correlated in different products where you're just able to to to reduce the amount of human time needed the old way is like everyone's modern logs looking for something weird happened but now you've got AI monitoring logs and flagging things and getting a lot more accurate in terms of identifying potential threats yeah we're going to see innovation in all sectors but the criminal organizations out there heavily leveraging AI to advance their their abilities and their technology stack as they move forward and the defense side the good guys are also hard at it coming up with new ways to leverage developments and AI to build first-in-class products cyber security was mostly for like you mentioned for Enterprise now what are your thoughts on small businesses the medium-sized businesses working on creating cyber security for their business for example a dental clinic has a lot of personal information what kind of recommendations can you give to start the process of securing the data yeah it is affecting businesses of all sizes and there's a kind of a couple of different camps there's organizations that are just being alert to the realities and they're wanting to be preemptive and build a security program and that that's very admirable I think most smbs unfortunately the reason that they they decide to Endeavor into building a security or privacy program is because something happens that makes it mandatory so we see a lot in SAS companies is if you're selling to government or Enterprise right now there's a security there's a third party vendor due diligence process that you're going to be put through and they're going to expect to see a certain degree of sophistication that's appropriate to the amount of risk that your your products or Services pose to their organization so let's so then the B2B side we see a lot of that that sophistication happening quickly it's being pushed through it becomes a sales enablement process for a lot of small business so it's like they can't sell to whole classes of customers unless they have a certain ability to articulate a posture around security or privacy or maybe even a certification like an ISO 2700 01 or CMC or a sock 2 or something like that so there's that size and now what we see on like if you're talking about a dentist clinic unfortunately example you know as an example and it's a good example because it's a the b2c side is a little less clear because most consumers don't have the sophistication or time to end of or unnecessarily feely of the individual risk to scrutinize each of their vendors to the same degree that say a Microsoft or an AWS is gonna if they're scrutinizing a SAS company a lot of people are unfortunately not super aware of how they'd even do that so where we see hackers hackers oh yeah hackers do love it and hackers you know hackers go where the minute where's the least the chain of least resistance right so they're going to go if they're seeing a certain demographic customers or certain niche of companies starting to tighten their security they're going to move and find a niche that hasn't gotten there yet it's b2c companies or I would say in a lot of ways higher risk now because they haven't had these sales these supply chain pressure yeah and so what's happening there the reason that's being created there quite rapidly and variety of jurisdictions and U.S Canada and across the world quite frankly is all these privacy regulations that are popping up rightly and gdpr was a very very highly publicized one 2018 2019 um but we're seeing in Canada we have a reform of a privacy act here we're seeing each state has their own Privacy Act and and you eat or each sorry Province and Canada and the United States we're seeing various new privacy legislations popping up across the U.S in a variety of different states so all of a sudden what's changing out there for all the businesses this I think this is where the pressure is going to really come on to the to the b2c and it's already starting to happen is that you're technically breaking the law by collecting person identifiable information and we were talking about a dentist shop it was a great example because you're getting into Phi personal help information so yeah identifiable information like people's names phone numbers addresses maybe payment information and then you get into that socially yeah social serial numbers you're going to have which insurance plans you're going to have but then you're also going to have different aspects of their medical history that are going to be on file you then like in the U.S for example and you have a requirement under the HIPAA act which is a privacy legislation that's been around for quite a long time since the 90s in the US that focuses on protecting health information and then you have requirements on whatever state you're in likely around a privacy component for that non-health related personally identifiable information you have but at the same time because there's the legislators are having a hard time really policing this and where are they finding organizations and it's usually large organizations or posts to breach so if you have a breach and all of a sudden and we've actually seen one happen in Canada was a whole conglomerate of of dental clinics that were all purchased by one vendor or a really major data breach and things like that and what happens there is like then all of a sudden you have the jury you have a potential fine coming down the line when they find out that you weren't really practicing your due care due diligence attributed or associated with the Privacy regulation so then you have a fine coming from your government and then that return then the next thing that happens is then they make you buy everybody some sort of credit monitoring tool and then all of a sudden you'll have a legal firm pop up and go oh class action time and they'll put together a class action suit with a couple of people leading the queue on that and then they'll go out look do announcements and find people and so you get the fine you have the loss of money when you've got hacked you get the fine then all of a sudden you're staring down the barrel of potential lawsuit of some sort or class action suit right so it can be really detrimental and then we see a lot of companies too where they might see like I know other dentist clinics that saw this happen with this bigger dentist clinic and then they all go oh no like when you so when you see one of your own one of your own because you see the preachers like oh Microsoft Equifax got breached like whatever I'm a doctor or whatever but when you see like US 27 dental clinics in Atlanta Canada were a ransomware then you're like oh they're coming after us too and then so you get that sure thing but when it comes to what do you do to where do you start if you don't have a background in security and privacy which is the case for 99 of all business small business owners really to understand your risks and understand your obligations that's really where everything starts right so it's really understanding the business and you really do you need a qualified firm or firm that has toolage that can scan your environment understand your environment understand your regulatory environment understand your risks and what threats that are active out there so it's not you can go about it in a patchwork way there's all kinds of used multi-factory encryption and change and make your passwords complex like all that stuff is good stuff and those are things that are going to help but to really the starting point is really understanding what the risks are understanding the business understanding the security threats and where the exposures are and the risks what would the outcomes be and then building a plan like so you can really figure out okay what are we going to do now like in this quarter what are we going to do over the next year where we where's the ideal posture that we should be aiming to be here from now and then under that's where it all starts right that's how any time I've ever helped a company build a security program or that my company has when we engage that's the first thing we do it's really okay let's get it all over the table let's understand the business let's understand the exposure points let's understand what active threats that we're aware of out there in the threat landscape that could likely have a high degree of likelihood and a high degree of impact on the business let's start with that and then build out policies programs controls set rules set responsibilities uh bring in whatever toolage or assistance that's needed or any upskilling that needs to happen or awareness training across the organization put some tools in effect to measure success so that because it's a change like organizations going from not thinking about this to practicing and becoming like a secure and privacy by Design type company is it's a cultural change people have to and there needs to be some degree of education and there needs to be change I always make the analogy of this time of year A lot of people are trying to hammer in the diets and hit the gym and try to lose a little bit of that winter a layer before the shirts come off on the beach and you can't just do that for two months and then go back to your old habits and to maintain that physique and in security posture is very similar right like it needs to be a change in the organization there needs to be processed it needs to be measurable you need to have action there needs to be metrics driven so that you can be alerted when you're not performing well and it's like I will jump in on the scale every couple of weeks and seeing okay maybe I'm drinking too many beer I'm putting on a couple of pounds you know where you need that you need that measurable aspect to understand when you're performing well and when you're not meaning so Darren can you share some tips for a small business owner of some sort that they can do immediately before getting professional help of course but something that they can immediately do in the next few days to make it more secure so at least they're watching this episode they can get the ball rolling for sure the first thing I would do would be go look at all the passwords for all of the things that I log into and if I'm using the same password for anything or if I've been in other words if you have a password that you use over and over for multiple Services change every one of your passwords it's really easy because I can go on the dark web right now and buy find your password that you've used and say say you were part of the LinkedIn breach and you still use that password I can find that password and then I can use your email address and I could send a robot to go after all the popular the top hundred and fifty or 250 most popular websites in the world and try to log in using those credentials what's really easy to do it's like anybody could do that you don't need to be yeah you don't need to be a rock scientists yeah and if you have a lot of passwords you can look at something like single sign-on whether you're a Microsoft customer or Google customer or both of those environments have single sign-on tools where you then just sign on to the Google environment and then you can use that to single sign on to other things so you have to worry about memorizing 30 or 40 passwords password managers stuff like one password so you can set up you just have to memorize the password your one password the password to your computer and then you have really long impossible to guest passwords that are generated by one password for all your things and then it manages the logging in and like that's a really good one hardening your devices would be another next step and what I mean by that is your all your technology right if you have do you have servers do you have routers Wi-Fi hotspots laptops phones update them are they still supported you see this all the time especially in small clinics so you might go into a clinic and be like oh they have a Wi-Fi router that's from 10 years ago it's no longer supported it's now it's not able to upgrade to use the supported version of TLS encryptions there's tools you can buy to hack old routers and you don't need to be that technically inclined you can just download it off the web sit outside run the tool robot the tool do most the work and all of a sudden you're in their Wi-Fi environment right update things make sure the firmware is up to date on everything if you have any iot devices in your home in your business make sure they're supported devices they're not get rid of them and replace them with supported devices make sure you have a program in place to update those devices make sure you harden your items like your cell phone so encrypt your laptop so if you've accidentally got if you got robbed or left in the coffee shop then somebody doesn't just gain access to everything things like that you can easily Google how to hire any device that you use pretty easily the other one that I would say this is a big one is MFA multi-factor Authentication use that on everything and don't lock it to your cell phones what happens if you lose your cell phone stuff like that so lock it to an authenticator app and use MFA what is MFA multi-factor authentication means technically the term is that there's two different factors that you have to enter to access any of your websites so a lot of the platforms are asking you to do enter your cell phone number and we'll send you a text under temporary code and what the concept is something when something you have that's those are the factors something something you have something you earn like in Biometrics you'll see some tools will use your fingerprint that's something you are right unless somebody cut your finger off you're gonna have a hard time getting your fingerprint and then something you have is your phone having something like an authenticator app like Google Authenticator on your phone then you can log in I use that yeah so having MFA on all those things means that if for some reason somebody did get your password there's another layer of Defense there so in the example I described earlier where I go and find your favorite passwords by some breach data that I find on the dark web if I go to try to get into your Google account using that that password and maybe it's even the correct password but because I'm using it on a new device it's going to go okay tell me your give me your second factor and be like okay this guy's got MFA next next subject move on right next and then you're gonna get an alert from Google saying uh somebody from IP address blob blah blah and Iran just tried to log into your yeah wherever Jamaica or somewhere in the world so then you get the notification from that provider right so those are some those are some things that everybody should do and that's not just if you're small business like I say that to people that are anyone you know in your home your family your children like looking after yourself and your loved ones that's like core foundational practices that can take you out of the low-hanging fruit category where there's a lot of hackers out there looking for low-hanging fruit thank you so much Darren it was a pleasure meeting you pleasure talking to you about this stuff is great that you're spreading that awareness not just for your company but to actually make people understand how serious this is because technology is ramping up like next level and it's happening in days and months now it doesn't take a few years anymore protecting that data protecting sensitive information is super important so I'm glad that you came on if we I was going to ask you to play some music too but maybe next time it sounds good I might need to practice a little bit first I'm a little rusty no worries Darren it was great my friend thank you definitely we'll be following all your pages keep in touch and also appreciate you agreeing to help us promote your episode on your network it really helps us make a bigger impact I appreciate you for that yeah thank you Darren and audience thank you once again for joining us for another episode you heard Darren you got to take a look at what they're doing most probably you have a business you don't want to brush this security stuff off your list I know you have so many things to do I get it but it's definitely something that you want to pay attention to especially nowadays and I'm saying this to myself too I appreciate you guys helping us grow thank you for being part of our show and we'll see you next time and Darren thank you thank you take care cheers [Music]