BONUS EPISODE Be Cyber Smart: Staying Ahead in the Business Game

0:00So, first off, an email's just arrived for you guys. Yep. You've been nominated for the Podcast Awards.

0:08Joel Dommett:Are you going to click through and enter some details? I'm just going to be honest. I'm almost certainly opening that email. We are borderline narcissists. Of course we are. I am almost certainly replying, yes. The Businessmen, sponsored by BT Business. Welcome to The Businessmen. We are back with a very special episode today, Joel Dommett. Very special indeed. Yeah, like any new business, we need to be cyber secure, don't we? On our Patreon, we have a forum where some of our Patreon community have been able to share their experiences and with regards to cyber security issues. Amwar got in touch.

0:48Joel Dommett:He had said he got an email, supposedly from a supplier to his shop offering to reduce the cost of his supplies if he switched payments to a new bank account immediately. he switched payments and sent the scammers£2 ,000. It's absolutely everywhere right now. So we had another one from Andre. It said he ended up filling in a fake form online and got locked out of all of his work emails for weeks. Says he's lost an important client, nearly sent his business under. It can be hugely important to people. So I have very little understanding of cybersecurity. You famously have even less than me, which makes you more or less in negative equity when it comes to knowledge about cyber security i was uh i got a call from someone who said it was from my bank and i clicked on an email that felt weird that night that day uh that morning and um i put my bank details in of course i did and then i got this call from someone saying it was from my bank he was so confident so convincing it was so convincing And it was on loudspeaker.

1:53Joel Dommett:And the only reason, so I was in a taxi. Yeah. The only reason that I put the phone down was because my taxi driver said, put the phone down. It's a scam. Your taxi driver saved you from being scammed? Yes. I hope you gave him a decent tip. I actually forgot. Five stars and a big tip, Joel Dommett. But I've experienced moments like this. And one of the things we talk about at work quite a lot this morning when we do things like this is the urgency. And people often put, so Anwar saying, you know, you need to switch supply now. And they make you feel like it's going to happen really urgently. So you panic, you start sweating, you think, I've really got to do this because something's going to go wrong.

2:34Joel Dommett:And they really lean into that. I got a message from Cami's wife ages ago. And as it turns out, their email had been hacked. And I replied to the message. I didn't click on the link, but I replied to the message. Yeah, here's my email address. Send me what you want. And I gave my email address, but then I didn't get anything else. And then Cammy messaged me about five hours later. I'd clearly messaged everybody in his phone book and said, look, if you get anything from me, my email's been hacked. Don't click on the link. And it transpired. And it was an absolute nightmare. It transpired that five or six of their friends had clicked on the link.

3:07Joel Dommett:They all had bank details taken. They all lost loads. It was an absolute nightmare for Cammy. Cammy felt so responsible. Imagine the people in his phone book that would have got that message as well, not just friends and family. And it's the insidious nature of it and how it infiltrates every sort of part of your life. And then you just feel so ridiculously vulnerable. I'll tell you what it's very similar to. You'll know this, Ben. When you feel like someone is a guest on Michael McIntyre's Big Show. Yes. This is a very niche reference. when someone's a guest on the big show and they've done the text to reply text to all right you know i know when mcintyre's big show is being filmed yes because every week suddenly on a tuesday i will get a random message from aj adoodoo or derma o 'leary just said oh hey my cleaners are out and she said oh she fancies you could you send a message to her something really weird And I love that.

4:12Joel Dommett:Do you always reply? Always reply. Always reply. I'm not on telly enough. Well, look, we've got one of our listeners. Yes. Harriet got in touch. She's told us an extraordinary story, which is going to come and tell us in the studio in just a moment. Harriet, welcome to the studio. Thank you so much for joining us. Listener of the podcast? Yes. New podcast. So I'm in. A real life listener. You are our listener. I am your listener. It's exciting to put a face to the air. I did the call in when... But if you're on it, who's going to be listening now? Oh, gosh, mum. The family. Although, so Harriet, thank you for coming in and sharing your experience of when cybersecurity has gone wrong.

4:59Joel Dommett:Because this is a very special businessman episode all about cybersecurity, about how we need to try and protect ourselves better. Joel and I have already discussed this. He set the bar very low with his experience. Absolutely. But what is your experience of coming very close, if not dealing with some major cyber issues? Okay, so it was during the pandemic. I was working for a media company at the time. And then I got an email on my work email from the big boss, the CEO. And it said something so calm, just being like, hi, Harry, I need you to do a job for me. Used your name as well, though? Yeah, straight my name.

5:34So interesting. And was like, can we though go on, can I give you my number? Can you have my number so I can message you? Just take this off email, it'll be easier. And so straight away I was like, oh gosh, of course, yeah, no worries. And I was brand new to this company.

5:50Joel Dommett:So you're thinking the CEO wants my number, this is good. Of course. This is a good play. Absolutely. I was like, right, going to get up on the good books or whatever. Easily trustworthy. Yeah, and also wanted a good job. A precious, you want to look after something. Yeah, yeah, yeah. Yeah, and then when I saved them on my phone, their icon was their photo. So I was like, oh, yeah, great. That's my boss. So they've got the CEO's picture and they had that on their profile. Yeah. So at this stage, there's nothing for you to think this isn't actually your boss. Not at all. And I wouldn't have had my boss's number anyway before this.

6:22There wasn't even like a way to check. And then they asked me, they were like, do you live near a corner shop? And I was like, yeah, like a 10 minute walk. but you know it was a pandemic and I was like let's go for a walk it's fine um and they were like I need you to get me some gift cards and I was like okay this is strange but like sure like you don't think about it really because you're like oh the boss wants me to do something like just get on and do it I am like bottom rung in the media company just do what you need to do just do what you need to do yeah and then I got down to the shop and I was like the specific gift card they wanted they were like no I want this other one like do they have it I was like no and they were like, get this other one then, that will do.

7:04And I was like, this is such a strange request. Anyway, so, and then they asked me to get four of them.

7:11Joel Dommett:So they're digital gift cards of some sort. Digital gift cards that are just on the shelf. Like I would just load them up with my money. Yeah. And then I didn't know what would happen next. Transfer them to, yeah, or something. Yeah, basically. But then, so they asked for four of the same ones, loading them of£25 each. And I was like, this is really strange. like surely my boss is like fine yeah he's a ceo yeah sure he needs 25 pound gift yeah but if he did that with everyone in the company he might be earning some sweet coin um but i just remember on the so we were messaging this whole time and the person whoever it was my boss um like constantly messaging and i remember it just getting more and more like less flowery less fluffy and more just like have you got them where are you going harriet you still there and i was like yeah yeah like they haven't got like i can get these ones and like again this is the urgency that you're talking about that ben was saying before you were here if it's urgent then it usually you something's wrong and then they asked they were like okay once you've got them um let me know and i was like okay cool can you just call me like this feels a bit weird and And then that's when it went absolutely like aggressive.

8:25And they were like, I'm in a meeting. Why do you not trust me? Like, who do you think you are?

8:31Joel Dommett:Wow. And how does that make you feel at that point? Oh, I was like absolutely on edge. I was like just shocked because I didn't know this. I don't know my boss. It was COVID. Like, no one was around. Like, and I was brand new to the company. So I'd never really met him either. So there's a sense of panic that you feel like you're doing something wrong. that they're making you feel like you're letting them down. Yeah, and I kept looking at this number being like, but I also remember clicking onto the profile picture and I was like, no, it's definitely him. Yeah, that's how sophisticated it is. I find myself doing that all the time.

9:03Joel Dommett:You just weirdly, it's like there's two sort of things of verification in your mind. But there needs to be more than that now. It's so scary. So you're at the corner shop. You're getting all these angry, urgent texts. You're letting your boss down. You're not trusting him. what did you do? I remember just being like, please call me. Like, and in my head, I was like, okay, maybe I ask him some security questions. But I was like, no, this is really strange. So I was like, please call me like this feels a weird thing to do. And I think almost like at the time as well, I was like, it's quite a lot of money for me.

9:38Yeah, sure. I don't like, just can we sort this out and then it was like you should be more like grateful like this is your job like like went stronger and stronger and heavier and heavier and i just i absolutely broke down so i was just like standing outside the shop like crying being like i'm gonna lose my job like what do i do over four 25 pounds yeah tokens okay when you say it now but that's that's the really ridiculous thing it's

10:10Joel Dommett:Suddenly the pressure that they put on you, you're not even thinking about actually what they're asking you to get. You're just thinking about the trauma and the pressure and the worry and the concern. Anyway, regardless, I was like, the pressure was still mounting and mounting and I was like, oh my gosh, I just need to find a way out here. But anyway, I bought them. Did you? Yes. I was like, can I have four gift cards of£25 each? Like in tears. Yes, let's talk. And the lady was like, yeah. and was just helpful. But anyway, I like walked home because I was just like, I need a little break, I need a little minute to see what was going on.

10:45And literally by the time I got back to my house, like the IT, head of IT from the company had emailed me and some others, I think, but either way being like, someone got through our system and you were emailed. Please let me know you didn't buy anything. Obviously I was like, no.

11:05Joel Dommett:No, you didn't. I was like all fine nothing I was so embarrassed oh my god Harriet and then I like raced back to the corner shop because that's what I'd already said to the cashier being like can I return these if I need to and they were like yes like you can and so ran back started crying again oh god Harriet and then they let me return all the money that's good so did you ever tell your did you ever tell the ITV people did you ever tell anybody at work that that had happened It took a while. I slowly started telling. I was so new as well. Yeah, of course. I slowly started telling like people I work with, like a few weeks later being like, hey, guys, funny story.

11:48And then finally, one of my bosses was like, you should probably have a proper conversation with Big Boss. Because every time I received like an email from him, I'm freaking out.

11:58Joel Dommett:But that's the worst thing, though. They're so sophisticated that they make you feel like you're an idiot and you've done something wrong and you're letting people down. When actually, as you said earlier, you're the victim. Yeah, I mean, I am actually an idiot, though. There is always an exception to the rule, John. It doesn't help. I felt like an idiot because I am an idiot. Yeah. Have you found, though, when you've told your friends or you've told other colleagues when you felt more comfortable about telling them that they've all gone, you won't believe what happened to me. so everybody has the experience of some sort everyone or everyone knows someone and that has actually like happened to I feel lucky that I just I got back like someone got to me in time to be like don't do it but everyone like I tell the story to and I was like this has happened to me or my yeah it's everywhere it's so important and thank you for coming in and sharing thank you for being our listener yes thank you Harriet clearly we all need to get cyber secure fortunately our friends at BT have offered us the help of a cybersecurity expert to help us keep our business safe and secure.

13:03Joel Dommett:Joel, very excited that we have a BT cybersecurity expert with us in the studio. Lee, thank you for joining us. It's what we've just been hearing from Harriet, Joel's own personal experience, my experience and friends. It is really apparent that we need your help. We need your help. because BT Business are sort of protecting the cyber sort of infrastructure in the UK and globally for lots of people. Is that the case? Absolutely, yeah. It's a massive issue for so many organizations, individuals, and something we need to put some real focus and attention into. First of all, let's start at the beginning.

13:42Joel Dommett:Just tell us, what is cybersecurity? What does a cybersecurity expert do? finish on all the foundation parts of this so we can elaborate. So most important thing, I guess, any business is about taking risks. If you want to achieve your goals and get where you need to go, you're going to have to take some risks to do it. Some of those risks are good risks. Some of them not so good. Cyber security is one of the big risks around at the moment. It's all about trying to understand what that risk is, what the impact would be for the business, then try and find ways to manage those risks so that you can cope with whatever comes along and make sure you achieve your business goals.

14:22So what sort of calls do you get then? So main thing is I want to achieve these particular aims. It might be grow my listener base. It might be more people who are signed up for this. It might be I've got this great new formula for this skincare product. I don't want it to get out. You do have great skin, by the way. Thanks very much.

14:43Joel Dommett:We'll come on to that. And so then the question is, how do we protect that to make sure that people can't get their hands on those listener details or the secret formula, whatever it might be? Obviously, a lot of it is best if you can do it in advance. You know, stitching time saves nine, all that kind of stuff. But unfortunately, we do also get some calls when things have gone bad and we've got to try and, you know, work out what happened and pick up the pieces. Can you just give us a small example of, don't need to be specific, obviously, but of something that has gone wrong for a business that you've helped work through, just so people give an idea of what happens to businesses?

15:26Joel Dommett:Yeah. So there's a business that we've done a lot of work with and they had some infrastructure in place that they needed to run their operations. And they had done a number of changes to that. And in order to do those changes, they had to kind of open some stuff up in order that they could, the engineers could come in and do all the work that they needed to do. Unfortunately, they didn't tidy up well after themselves. and then this was a route that the attackers could then use to get through into the business and once they're on the inside they look like any other employee they can do all sorts of things that you don't want people on the outside doing.

16:05Joel Dommett:What is the the losses that small business or big business face sort of annually from cyber attacks like this? I mean it's hugely variable dependent upon the size of the business but certainly some research that we've done indicates It's, you know, the average small business can lose£8 ,000 or more from an incident. And clearly the numbers can go way up from there, depending on the size of the business. And of course, if it's a small business,£8 ,000 can be the difference between profit and loss. Or if it's a cash flow issue, it could actually be terminal for the organisation. I mean, and how to make it about, sorry to make it about me guys, but how could this affect our business?

16:44Well, I thought actually we could play a little game, actually. It's a game that we play with organizations called a tabletop exercise. So I'm going to tell you about a scenario. The question is, how are you going to react to that? So this is going to test our aversion to risk or how do we cope? Well, so the important thing about security is all about people, process and technology. You can't just solve everything by having great people in place, though it helps if you make good decisions. Hearing some of the stuff from earlier. Some work there. I haven't made many good decisions. Some process in place in terms of how things are done and who's allowed to do what's good.

17:24And obviously, you'd expect me to say some underpinning technology can really make a big difference. Okay. So let's play the game. Let's play the game. So first off, an email has just arrived for you guys. Yep. You've been nominated for the podcast awards. are you going to click through and enter some details?

17:44Joel Dommett:I'm just going to be honest. I'm almost certainly opening that email. We are borderline narcissists. Of course we are. I am almost certainly replying, yes. So, okay. Perhaps not the best decision just to go instantly clicking on stuff. Obviously, good idea. Check those links. Check that it looks legit. Okay, so you did it. We've clicked the link. We want the award. You entered some details, I'm afraid. So one of the passwords that you use is the same as the one you use for your main social media account. What, the one with the photos? And the next thing that happens is a message comes to say you've been locked out.

18:22And even worse than that, there's an advert up on there with the new dropshipping business that you just launched. I could see this happening. Yes.

18:32Joel Dommett:So what are you going to do? He's going to make a tour out of it. Yeah. It's content. That's what he's going to do. So from that simple click where he's put his email, they can then extrapolate the password. And if you, if we are, I'm getting told to do this all the time, don't we? Don't use the same password. Don't reuse the same password. If you use the same password, that would look legit because we all see Joel with a tick. Yep. So if you then take that one step further, let's imagine for a second that this then exposes some other information. and one of the key goals I know you guys have got is 10 ,000 sets of details.

19:10That's what we want. We want to get people signed up to join us. Unfortunately, you receive an email. We've got into the customer relationship management system where you're storing all that data and we've changed every single email.

19:24Joel Dommett:Why did you answer that email? Why did you click the link? I've told you before. Oh, no. If you'd like them back, you can have them all back for£5 an address. five times ten thousand and this is an example of something that would you know this is this is a ransomware attack this is the idea i take something of yours away if you want it back you give me some money and you know hey i benefit as the attacker from your lack of security wow and then the final thing obviously underpinning that is some great technology that can help you with things like the password issues that we've talked about, making sure that you stop some of these things before they actually get to the end users.

20:05And that's where obviously we've got a great set of capabilities. But there's many organisations with great technology. It's all about how you use them and making sure you've got that process sorted and that human firewall is going to protect you.

20:19Joel Dommett:And just to be clear, when you say human firewall, you mean it's the different people within the business, they're all going to make those checks before someone actually finally signs on something or clicks on something and says, yes, that's... Absolutely that. Yeah. The beginning, middle and end of every one of these, there's a human involved. So again, those humans part of that process and make sure they're thinking about this as a risk is really important. What happens if the humans involved thinking isn't always... Ben's looking at me. In some cases, you have to take the power away from those humans.

20:55and put some processing around so that they are not, you know, they're protecting from themselves. Yes, genuinely.

21:01Joel Dommett:Yes. My social media accounts are so important to me because my business is me. It's who you are. Yeah, yeah, yeah. Yeah. So here's a simple one. On your phone, you've got a thing that will manage all those really complicated passwords for you. Yeah. And you can have a different one for every website. You should definitely use that. Yeah. That will make it way easier. and a bit of technology there will be supporting you to make better decisions. Okay, great. I can't wait to sort it. Do you know, it's a funny thing though, Lee, isn't it? Because it's the reality of you talking to us about this now.

21:34Joel Dommett:Maybe it's because we're in the process of setting up a business, which we understand is going to have a lot of personal information in. I've talked about this an awful lot and I talk about it with my wife and my teenage boys because they have social media accounts now. And it's really like the effort that you put in to protect yourself will be so worth it. Even if it takes a bit of hassle and it's a bit of faff, it will be so worth it to stop this happening to you down the line. Yeah, that upfront investment doesn't need to be a big thing. Running a small business is really hard. There's loads of risks that you've got to manage.