Welcome to the Adaptive Mindset. I'm Brett Gallant, cybersecurity thought leader and founder of Adaptive Office Solutions. Here, we don't just talk tech, we unlock the strategies, stories, and mindset shifts you need to stay secure, lead boldly, and thrive in a digital world. Let's get started. Welcome back to the Adaptive Mindset. I'm very, very happy to have Matt Magee with me today. Matt is our account manager here at Adaptive Office. And not only is he the account manager, he's the wonder man, doer of all things, happily married and father of two beautiful children. Welcome, Matt.

Brett Gallant

Thanks for having me, Brett.

Matthew Magee

It's really, really interesting to have you. A lot of times we're talking about mindset here, the adaptive mindset, and we're going to do a bit of that today, but we're going to dig into what you and I do every day, which is help people and businesses manage their cyber risk. I know we certainly have some interesting days and challenges, so it just comes with the ebb and flow of life.

Brett Gallant

Yep, lots changing out there in the world in terms of cyber risk and how often attacks are happening. So I think it's a great time to be talking about it for sure.

Matthew Magee

Yeah, and what a great way to do this, we dedicate a little bit of time for cyber. In terms of mindset for small businesses and larger organizations that we serve, what do you think some of the common mindsets people have for cyber security and risk?

I think starting out, business owners are some of the most kind of like risk accepting people that there are. I mean, you take a big risk to start a business, to hire people, you're taking on the risk of making sure that you can keep them employed and pay them. But it seems that when they think about cyber risk, when we first start out with them, they're kind of just like, do I really need this? And I think a lot of them don't quite understand that their environments are made up of computers. They do all of their business on computers. So protecting those machines and networks and even the people who work for them, it's kind of shifting towards people being more presently aware of what's happening. But I think we're a big part in making them aware. So I would say the mindset right now is kind of, I know it's an issue, but I don't know how big of an issue it is.

Yeah, there's often this misconception that it'll never happen to me. I had this reality check that happened just last week. You and I were talking about it. I did a presentation for a pharmacy association, and there was a number of people that attended, and last week we received a contact with somebody that said, I never thought it would happen to me, but a week after your presentation, my pharmacy was hacked. And that was a real sobering wake up call for to hear her story dealing with incident response forensics and not knowing where to go and being down for a couple of weeks because dealing with the lawyers and everything before she can turn everything back on and not having a plan. So.

Yeah, and I think that's really common for a lot of small to medium-sized business owners is they don't have a plan because they don't have the resources or maybe the knowledge of what to do in the event that something happens. And I think that's where organizations like ours are extremely important because we kind of guide them through that process and do what we can to reduce the attack surface so their risk is reduced as well.

Yeah. When we talk to people, some people are really accepting of that risk and they understand it, but sometimes People are on different pathways on their journey of accepting it and recognizing it. And sometimes people say, hey, this will never happen to me. Or, yeah, thank you for telling me this. I didn't know. I didn't know that this was going on here on the news, but I never thought it would happen. To me, or even in my own community, we all know that small, medium businesses are getting hacked, but a lot of times it's just not making the news. It's something that we don't really want to share with the public if it happened, if you're not mandated to report it.

Yeah, because I think people do notice too that like, that being a victim to a cyber attack can not only give you the threat of downtime or having to pay a ransom, but also the reputational risk that's associated with it. People kind of feel like it's one of those things that it's kind of stigmatized that like, oh, I don't want people to know that, you know, I maybe wasn't as careful as I could have been. Or sometimes it's just a matter of the wrong person opened the wrong email, you know, or it's a tough one to keep track of.

Yeah, just one click and you let the bad boys in, or bad girls, bad criminal actors. So you've been in this industry for a long time, and what have you seen change in the last couple of years that you're happy to see, and maybe on the other side of your alarm that's not happening?

I think for things that I'm happy to see, I think the willingness that people have to protect their organizations now is getting a lot better than it was. We used to have a saying at the last place I worked, you can't care more about a client's network than they do. And that was kind of the reason for being like, oh, well, if they don't want to fix it, you know, we're not gonna worry about it. And I think maybe that's not the best approach, but people nowadays seem to realize that like, this is a real issue. More people are kind of coming forward and saying, I need help. This is something that, within our organization, we're not capable of doing on our own. And it's nice to see that that is becoming more apparent to people. And I think it helps that they're seeing more cyber attacks happening. It's happening to their peers because the attacks are on their backs. And I would say that that is the thing that kind of concerns me is AI adoption in the workplace is great. I'm really happy to see people kind of working on workflows. You know, I'm a very process-driven person, but we're not the only people using AI. The threat actors do too, and it's made phishing just like such a huge risk because anybody can craft a really good phishing email, which, you know, even if English isn't your first language and you're attacking an English-speaking organization, It can fix any grammatical errors, spelling errors, any strange language that might be used. It's just a matter of pumping it into a large language model now, and you've got your phishing emails. It's just making the attacks a lot easier.

Yes. And harder for a staff member that's not trained to recognize it. Yeah.

And I think that's another nice thing. We talked at Adaptive a lot about building cultures around cybersecurity and making sure that it's a part of an organization's culture. And I think seeing the adoption of that in some of the organizations that we work with and even just going out and talking to people in my community and seeing that like the willingness to adopt that culture is there is just like kind of the light on the other side of that risky portion of what we do.

Absolutely. I know you're very much like me in terms of the why. If we present to people and we talk to people from a broader place, and we're doing it right now with this podcast, which is so great that we're dedicating it to a little more cyber this week. If this if what we're sharing when we speak to people and maybe they may decide not to do work with us or or work with anybody if we've impacted them at least to make a decision to start doing something then we've done a really good job and that's something we can smile and be happy about that we've made an impact at some business owner or someone in management that says yeah i really I really gotta take what Matt and Brett are saying to heart. It's so important now, and gentlemen, I know I've referenced this with you a few times, we can no longer keep our head stuck in the ground like an ostrich, like my good friend Amir says, which is pretending that the problem isn't there. And so, when we're out there, we're making this awareness. contributing to people understanding it and speaking in English, which you do so well. We like to talk about it in terms that the small medium business owner can understand. There's a lot of jargon behind this, isn't there? So.

Yeah. Yeah. Jargon, acronyms. It can all be really confusing. I mostly try to break it down when we're presenting out to this. You know, if you decide that you don't wanna take action with Adaptive, but you wanna take action, we're kind of presenting a couple of simple things that businesses can do, like using password managers and multi-factor authentication, easy stuff that anybody can do. The amount of reduction that is in your attack surface, like Microsoft says 99.99% of attacks are stopped by multi-factor authentication for credential attacks. And, and if, if everybody starts doing that, it reduces the risk of like impersonation attacks where somebody pretends to be you and reaches out to your clients. And I think like, we're all just spokes on a bigger wheel and it's about protecting that wheel. So if, even if they're not doing business with us, but they're putting some of these basic best practices in place like that, that makes me really happy. And I feel really proud about what we're doing.

100% because I'm thinking of a few organizations that we spoke to and you spoke to, they decided not to do anything right now with their overall managing their bigger risk, but quite sure a few of them did look at the multi-factor and implemented that. So that's a win. That's a huge win because the difference is, that business being able to survive. What happens if an organization suffers a cyber attack? Realistically, it can take a week and sometimes quite a bit more before you can be up and operating fully. Like that pharmacy that I was referencing earlier, it's been two weeks and they're still only operating with one computer in their dispensary. That's crippling.

So even in the few attacks that I've kind of been a part of working with digital forensics and incident response teams, like at the start of the attack, I try and be as transparent with the client as I can to say, like, understand that you might not be working at your maximum capacity for at least a month. And because they need to find where that attack came in, what holes to patch, and how to prevent it from happening again.

Yeah, 100%. So I want to pivot for a second and just go in a little bit of direction, a different direction for you. What really drives you in terms of mindset? What inspires you? What drives your passion that you can shatter any limiting beliefs that perhaps you can share with our audience that can help them on their journey?

I would say that there are probably three things that drive me, and one of the biggest is probably personal growth. I like to think that I'm a lifelong learner, even when I'm not doing what we do during the day. I have a rack in my little network area in my house where I've got all of these tiny servers. I'm running home automations. And I like learning about new technologies and new ways to protect them and just learning in general. I play about seven different instruments just because when I take an interest in something, I kind of just really zoom in on it.

Yeah.

Um, so that lifelong learning thing, I think if anybody takes some time to like invest in themselves that way and find something that they're interested in and really pursue it and give it the time that it needs to be fruitful and beneficial to their life, I think that's a big one. And it also is like, um, getting that personal time back. Outside of that, I would say my family is huge. I spend a lot of time with my kids. My wife and I kind of work opposite shifts, so I get to be a single parent almost half the time, which is a lot of fun. My kids are great, and watching them learn and learn from me makes me want to be a better example for them, which I think is important. And then I would say the last thing is like service and mentorship like those are two things that I think are I've seen firsthand how they've impacted my life. So I, you know, I have a group of guys that I've kind of spent time with over the past couple of years that we've worked together. And one of them actually works at Adaptive with us. And this is my third time working with him.

Shout out to Tyler. Yeah.

Shout out to Tyler. The hardest worker, you know, he's such a self coachable person. He just like comes in and says, these are my goals and here's how I'm going to achieve them. Hold me accountable. And I love that. But he's one of those guys who I think without And this is something that like I feel really glad I was able to do for Tyler is we work together in retail a long time ago, and we went, I got a job working for another managed service provider, and we were looking for staff, and they weren't sure about hiring somebody who didn't have any like kind of aptitude for technology. And I said, uh, I can promise you that this person is going to come in every day and they might, they're going to try to be your best technician. They won't be your best technician every day, but they will come in and try and be your best technician every day. And to be able to do that for, for somebody else and then have it also been paid back to me because I know Tyler said a lot of nice things about me to you.

Um, yeah.

It's just kind of that service to one another and also watching people grow in their goals and seeing how they can change and how we can influence that. It's such a reward.

Oh, 100%. You're making me think of something. I just finished coming back from a Rotary meeting and we say service above self. And a lot of what you were saying is service above self. We have to recognize that we can make so much of an impact on other people's lives. And in your way, a lot of times through leadership and coaching and mentoring, You've been very selfless, and I think the world needs more of that selflessness to give more back into people. Because when we uplift other people and contribute and coach them and share what we've learned, not only do the people on the receiving end learn, it also has a tremendous impact on our own lives, what we do, because that same knowledge or learning that you've shared, you've just made it two times, three times bigger and better from your own comprehension and understanding of it.

It's really gratifying to kind of see that out in the world.

Yeah, and lifelong learning is one of the pillars for you, and I know I can see it because you're continuously working on yourself in all ways, and especially with the tools that we embrace. We we've been leveraging new technologies that are enhancing what we do. And, and it's pretty exciting that we're digging into it with full force and bigger and implementing them and making a difference, which is exciting.

So, so yeah, it's, it's, it's one of my favorite aspects of the job. I like, it feels like we're, we're making changes and making a difference and it's, it's nice.

So, I know it's not all work. Sometimes you get out and play. I know, I believe you have a passion for the outdoors as well. You get out a little bit. I think, if I remember right, you're getting out for a little camping trip and hiking. There might be a climbing of a mountain in the future for you.

Yeah, yeah, we I'm right right before coven actually most of my childhood I spent outdoors and I lived in Ontario and we had like woods all around us, and I love being out playing in it and then as I got older it was something that kind of fell off. And right before COVID, I started getting really interested in being outdoors again. I had a couple of friends who worked as essentially parks rangers, and they were always going on these trips overlanding. And I missed out on a lot of them because of work, but I picked up camping in a hammock, which is, in my opinion, the most comfortable way you can camp and very portable. I started taking out some of the guys from work with me and it ended up becoming kind of this tradition that we go out a couple of times a year and there's a mountain nearby that we usually climb and get up to the top and have a nice fire and some of us sleep in hammocks, some of us in tents. Yeah, if I could be out more once my children are older and I can get them a little bit more involved, I'm really looking forward to that.

Absolutely. So pivoting back for a moment, I want to dig back into cyber. What would you say the top recommendations that you can say to a small business that they could do today to help with managing their cyber risk and decisions they can make.

I would say the three easiest that anyone can do would be first look at using a password manager. So there are a lot of different options. I don't recommend using ones that are built into your web browser. It's only for the fact that if your machine is exploited, those credentials are easy to take. And we do that as part of our risk audits. So using one that's from a reputable third party that is encrypted, we use Keeper. I'd also say Bitwarden is a good option for personal users. The next thing I would say is multi-factor authentication on every account that can have it. It almost should be a requirement for anybody who's offering you a service online nowadays to have multi-factor authentication available and enforced.

Absolutely.

And then the last thing I think is just education. Like again, like making sure that everybody is aware of how these attacks happen and what they can be doing to kind of safeguard themselves against it. Whether it's business email compromise, which is when somebody pretends to be your employer and says, hey, we just changed this account invoice to this person now and they sent off a bunch of money. Like knowing how to review an email and see You know, the sender seems okay. Are the links going where they should be? Was I expecting this attachment? And then does the message look normal? Like those sorts of things. And being able to have the sense to say, something's not right about this. I'm going to pick up the phone and call the person.

Absolutely question everything. In fact, I think you may have seen in our chat this past week, one of our team members, I got an email that looked like it was from him. And I thought they may have been sending from a personal Gmail. And I said, is this you? No. And it looked so legit. And so you question everything. In fact, I used to say that if you get an email from the president or something asking you to change some financial information or to call, you need to verify that and actually pick up the phone and speak to them, or do a Teams or Zoom. But now with AI, with DeepFake, I've modified that now to say, have a secret code word that you, that only the two of you know, because AI and deep fake is so incredibly deceiving now.

So yeah, I think, I think there was a company in Hong Kong who gave away $200 million to a deep fake video last year. Yeah. Um, which is, which is crazy that that happens, but it is getting so good. And the hard part about it too, is these, um, not to get too into it, these deep fakes are, easily trained now because we live so much of our lives online and through social media that there's just a wealth of data so they can train something on your voice or your appearance and your mannerisms and that's the double-edged sword of the lives we lead, right?

We live in such a digital world now where a lot of our lives are online. And I know for me, I believe in sharing what inspires me to inspire others. And there's a treasure trove of information of people online just waiting for these malicious actors to grab and impersonate us. So very sobering.

And that would probably be like my fourth recommendation too for things that you can do to keep yourself safe is keeping your business and personal digital lives separate. I talk about this quite a bit, but if you're using like your company provided email address for your personal accounts, and those personal accounts are usually targeted a little bit more often than some business accounts are, because it's easier to, seems to be easier to breach that information. There's a wealth of it online now. If you're, if you're a person who reuses passwords and it's using your business account and you've been in a data breach, there's their access to your organization. So, um, I always tell people like, use your personal account for personal stuff, use your business account for business stuff. Let's keep those digital lives separate and secure them all.

Yeah, there's so many times that, let's say, for example, the company they work for has been very vigilant and they've secured the business. But if you forget to secure your personal, Then you're leaving yourself vulnerable. I, I have a good friend, uh, I've known for years. Uh, he, he had his hotmail account, um, stolen and had he had it protected by MFA and a valid recovery email password, he wouldn't have lost that account. And what's really devastating for that is in that, in that email, were the pictures, the digital pictures, the memories of his deceased son. And I couldn't do anything for him. That just shouldn't happen, which was really sad. And It's so important for us to recognize that we have to do that. But I want to go back for something for a second. You said about password reuse. When we do cybersecurity risk assessments, which we do for new prospects and clients, let's talk about that for password reuse. Give a few examples. And obviously, we'll keep the business names confidential, because this happens everywhere, folks. it's a wake-up call to recognize this, so.

Yeah, I think it's the single worst practice, in my opinion, that an organization can do. Password reuse is basically when you use the same password for multiple accounts. And the unfortunate reality of it is that data breaches do happen, and most data breaches that we're seeing nowadays include an email address and password list. So it's not difficult for threat actors to go online and review these word lists and even sometimes automate the process of what's called brute force attacking web pages with those credentials to try and gain access to your account. So if you're using the same password and account for your Facebook as you are for your business email, it's not difficult for a threat actor to go look up where your email is hosted, and then go to, let's say, outlook.office.com and pump those credentials in that they found in a word list online, and now they've got access to your organization. And you might not be the CEO of the organization you work in, But I can guarantee you that if a threat actor is impersonating you, anyone in an organization can do some damage or at least give them a method to pivot and move up in that organization.

Oh, and, and, and we know that it's happening all the time. I'm thinking of the example from one of the tools we use that monitors that we, we get alerts when people are trying to get into the HR or the mayor's email account. I believe it was as recent as yesterday. We had multiple attempts on these email accounts that they were coming from all over the world. Uh, like five, five, every hour from a different country.

Yep, and that's a benefit of multi-factor authentication because I don't think that people attempt those attacks that many times without having a credential that they found in a breach. But thankfully, we help our clients with multi-factor authentication and things like conditional access to keep them safe, which basically means if you're outside of this geolocation or you don't meet these specific requirements we set up in this policy, your signing gets denied.

And so we have an example of that. We have some clients that know that we have that in place. So if they're going to be away, they ask, can you restrict this a little bit? I'm going to be in this particular country for the next six days. Can you allow us to get in? If they don't tell us, they can't get in. And if they forget, they all, I forgot.

But better that than the risk of leaving it open. And I always tell people too, because multi-factor authentication is one of those things. And I think you and I discussed this before I came on at Adaptive. People just push back on it. Oh, 100%. They either don't want to install an application on their phone or it's, you know, I don't want to have to pull up my phone or press my YubiKey every time I need to log into an account. In my opinion, the six seconds it takes, or we'll say 30 for a slower typer to type in that six digit code or match the number on their screen versus the weeks of downtime, it could prevent. It's just, it's a no brainer.

Or the case. Yeah, and I can think of a recent example for a business in the last two months that I know of that had over $200,000. Stolen and had they had the MFA and the monitoring, they wouldn't have been in that place where they've lost that much money. And I, I, uh, I don't think many businesses can afford to lose that much money, let alone even 10,000. It it's, it's just, it's not a place where any of us would want to be. So, so.

The nice thing is it looks like the government or other organizations supplemental to the government are starting to care a lot more about it. Like where you're located in New Brunswick, that Cybersecure New Brunswick grant to help businesses do something about their cybersecurity. More programs like that across Canada would be phenomenal.

And I believe they're coming and there are some, but equally so it's... We know in the United States, they have FTC safeguards where businesses are mandated to have a cybersecurity program. Finance departments, car dealerships, and other industries are mandated to have it. We're seeing, typically we know that Canada does follow that leader, that example from other countries. And there's been a bill going through, it's not quite through yet, but we're going to see increasing demands for businesses to have a cybersecurity program. And then equally so, let's talk about this for a second, the vendors coming back and saying, hey, what are you doing to manage your cybersecurity risks? I'm counting on you in my supply chain. What have you put in place for cyber?

And that's such an important question to ask. Because even a couple of years ago, 3CX, they were breached and had that supply chain issue.

Yes.

Now, for people in your audience who aren't familiar with 3CX, it's a phone service that you can sign up for. And businesses all over the world are using this. And they had an executable or a program that you could install on your machine that was an exploit, giving threat actors access to your organization. And thankfully, 3CX was able to catch it. But at the same time, it happened in the first place. And this happens. Sometimes, sometimes you're not the target, if you're the business or the vendor, even it's, it's everyone you're connected to, which comes back to that. We're all spokes on a, on a bigger wheel, you know, like it's not just your risk. It's the risk for everyone that you deal with. Um, and I think that's important to understand.

Yeah. And, and just to recognize that it's. Like you said, it's possible and you may be just the portal to a bigger picture. I had such an amazing conversation with you, but I want to ask you, because I'm going to keep up with the trend that I've been doing with everybody that I have on the podcast. Is there any book or books that have inspired you that you want to share with your with our audience?

I really liked Atomic Habits.

Yeah.

I found, yeah, I really enjoyed Atomic Habits. I thought it was really helpful for me to kind of develop habits. As you know, I'm an avid note taker. I take notes on everything I can just to keep my life organized.

Yeah.

Yeah. And, um, you're a Jedi. But also like, um, that, that, that's a habit that like I just kind of, started and I, and I found like, I started small taking little notes and then kind of expanding on it. And I think like those little wins, like what you get out of that when you have those little wins, uh, kind of help you build a better foundation for, for larger success down the road.

It's so true. That's an amazing book. It reminds me of the talk, I forget, the military man, he did a speech and I've watched it a few times. The first thing you do every day is make your bed and then you can go to bed at night knowing that you did something Great. Matt, it was such a pleasure to have you. Folks, the biggest thank you you could do for Matt and I today, if this has inspired you or if it's helped you, is share this with people you know so that they can be more equipped to manage their cyber risk and also be inspired with some of the great takeaways Matt has shared with us. And I just want to thank you again, Matt, how much I appreciate being able to work with you every day. And it's such a pleasure. And thank you. Thank you very much for being on the podcast.

Oh, I'm grateful for the opportunity both to work at Adaptive and to be invited. So I appreciate it.

So awesome. Thanks for tuning into the Adaptive Mindset. If you found value in today's episode, don't forget to subscribe, leave a review and share it with someone who's ready to thrive in the digital age. Stay secure, stay adaptable, and I'll see you next time.