S2Ep169 

Karen Kirton   0:03
Welcome, Frasier. 

Fraser Jack   0:14
Thank you for having me. 

Karen Kirton   0:16
Thanks, and I’d love it if you could just give us your elevator pitch couple of sentences about you. 

Fraser Jack   0:21
Oh yeah, very quickly. So I run a cyber security business I have done for the last five or six years. And we predominantly work with financial service professionals or professional firms in helping them create strong cyber cultures. So we’re very much around the compliance and the people side of cyber security. 

Karen Kirton   0:40
Excellent. And yeah, we’re going to talk a bit about that because sometimes people forget about how much the people side actually has an impact into this, which takes me really to my first question. I don’t know about you, but a lot of business owners that I speak to think of cybersecurity as an IT issue. What are your thoughts? Is it an IT issue? 

Fraser Jack   1:00
A little bit of yes and a little bit of absolutely not. It has to, it comes down to the concept of when we think about cyber incidents, around 95% of those incidents happen to be human related or the human making the mistake. And whilst we need really strong technology security in place, and there is quite a bit of that.
that we go through with our clients and make sure that they do have that. So that’s a yes. But it’s a bit like probably driving a car with all the safety features involved. And often when accidents happen, it’s because the humans were at the wheel and the humans that hold onto the steering wheel and the humans that put their foot on the brake or the accelerator or get distracted or by something that’s going on.
tend to cause car accidents. It’s the same thing around the concept of cybersecurity. So I have a really horrible saying that I don’t like using, but I’m going to throw it at you anyway, because people do remember it. And we do know the saying out of other countries that say, guns don’t kill people. People with guns kill people.  

And if I take that, the gun’s word out of that and replace it with technology, then often the technology can be a really safe thing in our business. But it can also be a really dangerous thing in a lot of businesses, depending on whose hands we put it in. 

Karen Kirton   2:16
Yeah, no, I think that’s so true. And I was reflecting as you were talking before this episode, you know, like many businesses, we, you know, have a firm that helps us with this and they give us the phishing emails. And I had one of the team recently send me a Team message saying, I can’t believe that I fell for that!
But that’s what happens, right? Like we can put all of these processes and training in place, but it just takes someone to be a little bit distracted to not read the e-mail address correctly. So, you know, what are the most common mistakes that you see small and medium sized businesses making when it comes to cyber? 

Fraser Jack   2:40

I see a lot of mistakes being made, but I think for what you’re referring to there is that, you know, human psychology, we know this thing exists, we know it exists in sales, we know it exists in businesses. Human psychology is around this concept of getting people to do things that they weren’t supposed to be really be doing. And whilst they might know from a logical point of view, I’m supposed to be following the bouncing ball or following this process or doing these things. When you introduce concepts like stress or fear or urgency into a mix, then often our brains can get taken over by the emotive aspect that we then need to panic and follow, do something quick or it’s urgent or there’s pressure involved. And so 

Fraser Jack   3:42
And sometimes those processes can go out the window. And so when that happens, that’s when things can go wrong. And cyber criminals know that. They completely understand that process and they use that to their advantage. So, you know, again, your phishing campaign emails can be nice and simple and you easily depict them. But as soon as you add pressure or stress or, you know, and  a deadline involved or some senior management needs this ASAP, people start to do strange things and even really, really smart people stop using the logical parts of their brain and start thinking emotionally. So it’s very easy for cyber criminals to exploit human behavioural aspects. And so they do. And so whilst we’ve got…
this whole world, there’s new threats coming with AI and all these other parts of the business. The old way of doing things, the old human psychology still works. And so whilst that still works, people will still be exploiting it. 

Karen Kirton   4:34
Yes, and it can be really confronting sometimes. Like I had a client who they had an out of office response on, and it said, you know, hey, everyone, like, you know, I’m going to Hawaii or whatever, I was going to go and have a great time. And then that got used to then, you know, send an e-mail to the finance person, say, while I’m in Hawaii, And it’s, you kind of just think, oh, wow, like.
We can’t say anything fun or personal because then it gets taken. So have you seen those types of things, particularly in growing businesses, like how that cyber risk starts to increase as people become a little bit less, I guess, cognizant of what they’re putting out there? 

Fraser Jack   5:21
Yeah, absolutely. Generally, if you trace any incident or attack that’s been personalised back to its grassroots, then you do find out there is some information that’s been gathered, some reconnaissance, and that reconnaissance could be from an e-mail reply saying I’m out of office, I’m travelling another place.
If so, send my e-mail or contact this person. Great, there’s two pieces of information I can use to manipulate. But also, when people post stuff on social media, there’s often keys. And when people are starting new jobs and businesses in the HR space, then they’re posting that they’ve had a promotion or they’re moving or whatever it might be.  

Often those triggers can then spark an attack in some way because they’re giving a piece of information where there could be a deadline, there could be some pressure, there could be some changes, there could be some new people that don’t quite know. So it does open up a whole lot of those things. But I think the thing that really scares me and whether I see it is…
is a lot of professional firms that we tend to work with have really strong trusted relationships with their clients. And so some of the things that we see on websites, for example, is testimonials of clients and clients saying, and that then provides a link that somebody can go, hey, here is a trusted relationship.
that we might be able to manipulate. So the trust between a professional service person, an accountant, for example, and their client might be able to be manipulated because of something that is then seen or readily available that we’ve put, we’ve posted on the internet thinking that it’s gonna do us good where it could actually come back to bite us. 

Karen Kirton   7:01
What do we do about that? Because every marketer is going to tell every small business, get those testimonials. So there’s this friction there. So do you have the magic answer? 

Fraser Jack   7:12
I don’t think there’s a magic answer, but I do think there are steps you can put in place. So for example, you know, we’ve got client stories that we have recorded from our clients. You’ve got, you know, podcast episodes that you’ve recorded. And so what we do though is we don’t put them necessarily the client stories on a publicly facing part of our website. So we’ll do that if we’re working with somebody that wants to then hear from our existing clients, we can then direct them to this particular page. But we just don’t make it public or available to be searched. 

Karen Kirton   7:35

Yeah. Now, something that’s also become much more frequent over the last five or 10 years is outsourcing work and offshoring work. Does that bring with it a whole bunch of new risks or is it really no different to having employees in your business? 

Fraser Jack   8:01
It does. There is a number of different reasons why that incurs additional risk. One is, are they an employee? So do you have the legal rights and responsibilities to put, to take disciplinary action on anybody who’s doing the wrong thing? In the case of working you know, remotely and overseas, you know, if you’re not employing those individuals through a business in that country, you might have zero legal rights, you know, HR style rights to be able to say, hey, this person is acting inappropriately, doing the wrong thing, sharing our information with third parties that shouldn’t be shared with, et cetera.
Are those, is culturally, from a cultural point of view, there is a lot of job sharing that can be done overseas. So sometimes you could be asking one person to do the job and then they’re getting their friend or cousin or relative to do the job because they’re busy and they want to deliver. They’re doing what they believe is the right thing to do and look after you. But that might be a privacy breach because that person has no right to see, you know, client or
patient data or information. So there’s those types of things. But there’s always this concept of every time we connect to the internet, we’re connecting to an internet highway, I call it. It could be there could be people up and down that internet highway in a dangerous place. We connect in a way that is through a device, generally called a router or a or a modem, and that can be, people can get in between that connection. So when people are working from home, one of the first things we like to do is say, you know, let’s have a look at the device that’s connecting you to the internet. You know, is there encryptions and firewalls and security on the router?  

Fraser Jack   10:08
The connection that you provide them, rather than just allowing people to connect to the internet from anywhere on any device that they might have, and then log into to a work device. So, there is a lot of things that can be done, and when we talk about the human aspect in that, a lot of that is around the leadership of the business, the directors.
making decisions to add some money to the budget and pay for that type of hardware to be set up. So there’s lots of conversations around that and that involves more than just the person working from home. It is a lot to do with the leadership of the business and what decisions they’re going to put in place for team members that might be working from home and that could include, generally includes some extra cost and, you know, providing them a phone, providing them a device, providing them a connection, a router, a router that you can, you know, put strong or make sure it’s got strong settings and security settings into. So yeah, there are a lot of things that can be done and there is a lot of risk where people don’t really take into consideration like you might do an OH&S assessment of your
office, but you’re not doing it in the home. So there’s a lot of different things that can be done to do with some security in that space, yeah. 

Karen Kirton   11:14
Yeah.
That’s a good point.
Yeah, so there are any warning signs then that a business might be becoming vulnerable without realising. 

Fraser Jack   11:27
There is always a lot of ways that people can see if businesses are vulnerable. And so, you know, back in the day, you’d walk past an office and you could see if there was lots of doors and windows and they were often left open, that a business might not have very high levels of security. Well, you can actually do that by walking past people’s websites or looking at their e-mail settings online. So there are a lot of  search tools available that you can just search a company’s website, you know, their domain, their business name.com.au and look at whether they’ve got, whether they are low-hanging fruit when it comes to their security settings. 

Karen Kirton   12:07
Yeah, it’s just fraught, really.
So one of the things that I’d like to ask you about is, you know, when something happens in a business and it’s clearly an employee has done it, so they’ve clicked on a link, they’ve paid that invoice, you know, whatever it might be,
As a business, how do you respond to that? Because I think it’s really easy to go forward and, you know, blame the person. But what are your thoughts? What’s the best way to manage that situation? 

Fraser Jack   12:41
Yeah, it is a tricky one because it’s a bit like, you know, playing in a sports team and one of your teammates lets in their own goal or gives away the, gives away something. And so it happens, inevitably it happens in a business. So there’s a few things we do. One is we actually plan for it.
So we do a lot of work with, you know, what we call an incident response planning. And so making sure people have a plan in place, that plan has rules, and that has the concept of introducing that concept. Like now, for example, where we’re talking about it when there is no actual incident, where we know we can talk about this concept of, you know, okay, if this was to happen, this is how we should look after that team member and making sure
that that team member is rallied around and et cetera, et cetera, even if people aren’t quite feeling that just yet. And then the next part of that process is then rehearsing it. So we talk about this concept of, I talk about the concept of cyber drills, a bit like you might do a fire drill or first aid training if you were doing first aid.  

You want to try these situations when you are, when there is no pressure on so that when the pressure does come on, you can then revert back to your training. So I would say make sure you’ve got an incident response plan, make sure you address that in your incident response plan and have, you know, a few team meetings where you do discuss if this ever happened to our business.  

Here is where you find the plan. Here is the first few steps in the plan that we need to follow. Here is how we call on the troops. Here is how we treat our team members. Here is how we communicate with the press when they call, et cetera, et cetera. So there are a few things that people need to understand what their roles are, because if you’re not trained to do that, 

Fraser Jack   14:25
you can’t be then expect all of your team members to react the way that you would expect them to react if they’re not trained. And so just like, you know, keeping a register of when you’ve done your fire drills, you need to keep a register of the training you did around your cyber drills and making sure that humans do that way. 

Fraser Jack   14:44
And then understanding, of course, that most people are doing everything they can to help or protect or serve or, you know, all those types of things, where people are actually trying to do the right thing by your client or trying to do the right thing in many situations, and then revert that back to how you might physically help somebody.
versus how you might help somebody in a digital space. So there are a lot of different concepts there, but I think it’s really around the concept of understanding that this could well happen. It probably will happen. Most businesses will come across something at some point and inevitably it’ll be somebody’s fault more than the other. And then we’ve got to make sure we treat people like human beings at that time. 

Karen Kirton   15:09
Yeah, and I like that idea of practising and making that up front because that can help to do that in a non-emotional state versus an emotional state where you’ve just lost, you know, $100,000 or whatever it might be. 

Fraser Jack   15:36
Yeah, yeah, I think it’s I think it’s easier to revisit neural pathways than connect them in the 1st place.  

Karen Kirton   15:41
So if someone listening to this today wanted to reduce their cyber risk this month, do you have a best tip or one thing that they should be doing to start with? 

Fraser Jack   15:56
I think the best tip is to create time and budget for it. Often it’s been left as one of those things that, yeah, we just get our IT to do that and do we know that? So there is a very big onus from the regulators on the directors taking core responsibility for this and making sure that they understand what things are and aren’t in place. They understand what the risks are and how they’ve mitigated against those risks.
So, you know, I sort of start with the concept instead of starting with a tool or a, you know, should we just put a password manager in? Well, absolutely you should, but let’s finish with that and start with the concept of understanding what the director obligations might be for the business, then work our way into the concept of risk and saying, let’s do a risk assessment of all the things that could go wrong in our business. And when we do that with firms, we have about 70 odd different risks on that board? What are the strategies, the mitigation strategies we need to reduce that risk, that inherent risk we have just by opening the doors? How are we reducing that risk? And then what’s the residual risk left over? So that risk assessment process is really important in cyber as it is and most other risks to the business. And then off the back of that, that’ll give you a list of all the things that you should be doing.
in a business to make sure that you’ve covered those risks. But then that concept of directors understanding is really important. It’s around saying, okay, as a director of a business, I can’t just say, you know, oh, that’s the responsibility of this person in the business. You need to know. And so that person might be doing the work, putting it in place.
But you’re the one, if you’re the director, that needs to understand why that’s important to your business and how that affects your business and what that thing does. And so, yeah, getting your head around those concepts and learning a few new terms that might be technical terms that your IT person has spoken about before. But yeah, really getting your head around it.  

Fraser Jack   17:50
So that takes time, effort and a little bit of money to spend often, because generally the more you get into the cyber world, you realise you need to spend a bit more money. I’m sorry to say, sorry to be the bearer of bad news in that situation, but things are only getting stronger and stronger as we get into this new world of frontier AI and the regulators have put out warnings in recent months around that and they’ll continue to put out more warnings In that space, because that that’s becoming more and more serious. 

Karen Kirton   18:18
Yeah, and I think sometimes it’s those little stories that people share, like the one that I did around that out of office response, that makes people realise it can be small things that make a big issue. And not that I want, you know, to scare people and make this all fear-based, but
But it is important, right? Like, is there something that you’ve seen maybe with the other way that people have done really well that has helped them to prevent a cyber issue rather than the small thing that made a big one? 

Fraser Jack   18:48
Yeah, I think the biggest thing, the biggest saving grace in any incident is speed. And so, you know, you got to think of it a bit like someone just lit a small fire in your business and the longer you let it go for, the bigger that fire gets and the more fuel that’s thrown on it. So speed is definitely of the essence and getting onto things very, very quickly taking systems down as quickly as possible and then and then rebuilding, calling, we call it calling, you know, calling in the troops or setting up the war room. And so often that involves your insurance company, if you’ve got cyber liability insurance, because they respond and, you know, they bring in the lawyers as well as the forensic IT people. And so you’ve got different people with different specialist jobs, forensic IT, you’ve got your IT person. So you’ll generally have two. You’ve got to make sure you’ve got your PR sorted very quickly. You’ve got to make sure you’ve got your communications out because media will call in very quickly. You’ve got to make sure that you’ve got people doing, you know, the right people in the right seat of the bus.
So the quicker you can get that set up, the better. You know, we have this fight, fright, or flight mechanism that kicks in very quickly. As soon as adrenaline kicks in and these things happen, people then tend to freeze or they tend to want to fight back, have this person get in, let’s get back to them. 

Fraser Jack   20:11
And they don’t think of their clients or their patients or the right thing to do at the time. So yeah, it is very much around speed. And if you think something happened, then it’s about taking it seriously. Again, that comes back down to practising and doing those cyber drills. 

Karen Kirton   20:27
Excellent. Look, I really enjoyed our conversation today. And my last question is what I like to ask everybody, which is what is one thing that you wish that you knew earlier about running a business or leading a team? 

Fraser Jack   20:44
I think the one thing I wish I knew, I think I like to talk about this concept, the difference between leadership and management. And so I can very easily, you know, put the two different behaviours in boxes. And so often when, you know, we talk about this concept of managing people,
or leading people. You know, the difference to me is when people say, you know, how can I help you do an amazing job today? Is there anything standing in your way? Is there any obstacles I can remember? That’s the concept for me of leadership. And the concept of management is just saying, you need to do this, you need to do that for me, do this for me, do that for me. So I think.
I think I often see, you know, often when I’m looking at businesses from the outside looking in, that always stands out to me, you know, that’s somebody that’s somebody who’s learned to be a manager versus somebody who’s learned to be a leader. And so, you know, it’s, you know, I’ve been in business for, you know, 30 odd years. And so those are the sort of things I like to see that stick out. And when I see that happening, it makes me smile, you know, even if it’s in, a coffee shop somewhere, or if it’s, you know, in somewhere that you’re at or a restaurant and you see it happening, it’s fantastic. 

Karen Kirton   21:48.
Yeah, absolutely. Look, thank you so much for joining me today. What’s the best way for people to get in touch with you? Is it a website, LinkedIn, other? 

Fraser Jack   22:02
Yeah, so our website is thecybercollective.com.au, or they can look me up, Fraser, F-R-A-S-E-R, Jack is my surname, and I’m on LinkedIn. So LinkedIn or our website, feel free to reach out, or I’m sure wherever you’re listening to this, you could probably find my details. 

Karen Kirton   22:19
Excellent. Yeah, we’ll put the links to that into the show notes. So thanks so much for joining today, Fraser. And for those that are listening, if you’ve received value from this episode, I’d love it if you could leave a rating or a review over Apple Podcasts or Spotify so someone else can find the episodes to help with their business. The episodes are released on Mondays, so click subscribe and you’ll be notified of when that’s available. If you have any questions,
comments or ideas for future episodes, head on over to Amplify HR.com.au or connect with me on LinkedIn and we can start a conversation.