Cybersecurity is simple. It’s based on confidentiality, integrity, and availability. As Senior Director of Security and Compliance at Pax8, Matt Lee understands the significant measures to keep data protected and secure for your business. Since the internet boom, our ideas about technology and data have changed. So have our cybersecurity policies. Listen to Chip Arenchild and Matt Lee examine the infrastructure insurance brokers and IT providers use to protect data.
Current Cybersecurity Landscape Transcript
00;00;00;08 – 00;00;22;02
Matt Lee
My single charge in life is this understanding from what I do as a cybersecurity professional. You know, I assist in a lot of the public private partnerships around cybersecurity in the United States. And I don’t think our world will be the same. The luxuries that you grew up with as a child, that I grew up with as a child and as a young adult and as my age now, they won’t be here in the same way.
00;00;22;03 – 00;00;38;05
Matt Lee
We won’t have the same certainty in our financial systems. We won’t have the same certainty in our systems that we do business with. We won’t have those same luxuries at the same time. We’re having increasing debt and gross loss and all of these things that create a very different world for us as a, as a, as a superpower.
00;00;38;08 – 00;00;53;09
Matt Lee
And I think the challenge is that if we don’t all as businesses, as humans, take it upon ourselves to learn something about cyber, to learn something about this brand new technology that runs and ruins and builds our world. Then it’s on our shoulders.
00;00;53;12 – 00;01;17;15
Chip Arenchild
Welcome to Know your Risk and insurance Coverage with Risk Pro Net, where we will discuss all things insurance for you and your company. Risk Pro Net is a network of independent agencies who offer specialized insurance across business sectors. Regardless of where you are in your insurance journey. We want to invite you to join us to think about insurance differently.
00;01;17;17 – 00;01;26;02
Chip Arenchild
Know your risk and insurance coverage with risk Pro net provides answers to all your insurance questions.
00;01;26;05 – 00;01;56;05
Chip Arenchild
Good afternoon everyone, or wherever you’re listening to. This is Chip Aaron child with risk Pro net and know your insurance with Risk Pro net day today we’re going to continue our conversation around cybersecurity. And we’re going to continue to focus on what do businesses need to do or how are they prepared. From the C-suite in the management seat and the technologies that are required to, you know, kind of beat back this ransomware attack potential and things that we’re up against in our guest today is Matt Lee from Pax eight.
00;01;56;07 – 00;02;20;21
Chip Arenchild
And Pax eight is a distributor of technology products to MSPs and like me, and I think like a lot of you, I’m going to have him explain what an MSP is. And then I think we’re going to learn today a little bit about things we can do to prevent attacks again, and what he would recommend, as well as some ideas around technology, good technology and culture building with technology.
00;02;20;21 – 00;02;35;26
Chip Arenchild
So hey Matt, welcome to the podcast. We’re glad to have you here. You come. Highly recommended. And I’ve looked up some of your stuff online, and I really like what you’re putting out there in social media over this pandemic period to promote cybersecurity. How are you today?
00;02;35;29 – 00;02;57;24
Matt Lee
Hey, Chip, I really appreciate you having me on. I’m doing fantastic today. I, you know, like I said, in earlier comments, I had a managed service provider, which is what an MSP is. And when you think about what is an MSP, if you decide that you need help in your in your technology and you decide that you need to outsource that, right, that’s what a managed services do.
00;02;58;01 – 00;03;15;16
Matt Lee
We come in and provide the security. We come in and provide the technology. We come in and provide the support desk and help and those type of things. And so it’s really just a marketing term. But what it’s grown to mean is outsource sourcing technology in an all encompassing fashion, not just calling somebody because something broke.
00;03;15;19 – 00;03;35;05
Chip Arenchild
If I’m a company and I want to look at that, I would assume that most middle market businesses that we work with, it maybe started off, with holes, it hosting their own servers. Right. And now they realize, oh, I need to move to the cloud and you’re in some transition period. What’s the assessment we should be doing to say, do I need an MSP?
00;03;35;05 – 00;03;41;11
Chip Arenchild
Do I need to outsource this in entirety? And and how do I trust that process? What advice can you give us on that.
00;03;41;14 – 00;04;04;15
Matt Lee
Yeah. So this is actually a really fast shaping world. And being insurance people, I think you kind of understand why. You know, I’ll take us in on a little quick stab into it. So in insurance you have this concept of classes of insurance, right. You have this concept of actuarial separation. Meaning if Matt lives fat and has high blood pressure, he’s probably going to die like a fat guy with high blood pressure.
00;04;04;15 – 00;04;28;06
Matt Lee
And it has a fairly, you know, linear understanding there. And so with that, you have cyber security and cyber security insurance and cyber insurance for threat actors. Right. For the ransomware. As for the breaches, for these things that are coming and there’s no classes of insurance, there’s nothing that makes you as an insurance professional, even have any plan of how you’re going to protect yourself, almost none at all.
00;04;28;08 – 00;04;47;02
Matt Lee
And going further, there’s nothing that says, I know what I’m talking about. There’s no legislation, there’s no regulation. I’m going to have to have a license. And the challenge you face is that this burgeoning technology kind of understanding has been allowed to be thought of as an expense or as something that we use to do our job, but in reality, it is the means to your demise.
00;04;47;07 – 00;05;08;24
Matt Lee
It is the means to me as a threat actor, as a hacker, being able to steal money from you and attack your systems and find ways to to get your information and use it. And as an insurance broker, you have lots of information. You have my social, you have my date of birth. You have my medical records. In some cases, you have all my business operational details, you have my legal agreements, you have all of those things.
00;05;08;24 – 00;05;22;10
Matt Lee
And yet many people don’t even have the first concept of how they’re going to protect themselves. Technology has only been this thing. We pay hourly rates for, and I can’t figure out which wire to plug in. And I love taking advantage of those people. It’s very easy to do as a hack.
00;05;22;12 – 00;05;28;20
Chip Arenchild
And you do some hacking, if I’m not mistaken. Right? Yes. Very much you are. Yeah. You are a professional hacker, right?
00;05;28;23 – 00;05;46;28
Matt Lee
I am, yeah. And I think that it started for me because I was on the in our team we have this blue team, red team concept. Blue team protects red team attacks. Right. And so in understanding trying to protect companies because that’s what I did I was at an MSP. We managed 20,000 endpoints, you know about 17,000 belly buttons if you will.
00;05;47;00 – 00;05;47;07
Matt Lee
And.
00;05;47;07 – 00;05;59;25
Chip Arenchild
So, hey, maybe we maybe give the everyone a definition of an endpoint because we were hearing that. All right. Like, you know, yes, when you purchase a cyber policy, they want to know what your endpoint security and wherever.
00;05;59;25 – 00;06;26;16
Matt Lee
Data is touched is an endpoint. Okay. So if that’s my cell phone, I’m touching data there. And a lot of people will forget about that and its risks to them. But I computer so typically an endpoint is going to be something that a human touches to interface with data. So cell phone tablet computer those are endpoints. And so when people are asking about endpoint security they’re saying hey most likely when I attack you I’m going to attack the endpoint.
00;06;26;18 – 00;06;43;14
Matt Lee
What are you doing to secure the endpoint? Because it touches data, right? So security is actually not all that complex. Everybody makes it out to be this big challenge. But security is really operated under the CIA triad. And that stands for confidentiality integrity and availability.
00;06;43;14 – 00;06;44;13
Chip Arenchild
Okay.
00;06;44;16 – 00;07;10;00
Matt Lee
Everybody in technology only thinks of availability. My server’s down, I’m losing money. My computer doesn’t work. I can’t look up this insurance policy I’m having. That’s all availability. But cybersecurity lives in all three, right. Because I get attacked. The availability Facebook went down right. That was massive. Their their business was impacted because of a lack of availability. What we have to also think about is confidentiality and integrity.
00;07;10;02 – 00;07;33;22
Matt Lee
Confidentiality says, is that chip and should Chip be reading this document. That’s it. That’s confidentiality. Integrity says is that Chip’s insurance application or has it been modified in some way. Right. And so cyber security is just looking at data determining first off, should I even have it. Right. That’s where privacy comes into play. Like I shouldn’t give my social to buy an ice cream cone, right?
00;07;33;22 – 00;07;57;18
Matt Lee
Right, right. It is probably not the best thing in the world. The ice cream cone companies should not because, right. And, you know, but in the same breath, when you are in a highly, data driven company, like an insurance professional that does have so much data about the individuals, the, you know, the legal ramifications, you’re often not thinking about the confidentiality requirements and you’re just buying that cheap laptop because it was the thing I had to buy.
00;07;57;18 – 00;08;21;09
Matt Lee
And you’re just doing it yourself because you don’t want to pay a person to help you with this, or the broker dealer doesn’t provide that or. Right. And so you, you get into this world where we’re so broken that the insurance industry is what’s driving this. And risk is what’s driving this, right? Because you’re you’re setting these actuarial basics on fake data, on stuff that even the insurers and the insurance professionals aren’t doing.
00;08;21;11 – 00;08;28;08
Matt Lee
You know, travelers kind of came out in June and July and said, hey, listen, we need MFA, we need endpoint protection. Nobody stings.
00;08;28;15 – 00;08;39;24
Chip Arenchild
Everybody. Since the Colonial Pipeline, you’re you’re absolutely right. Yeah. There was an upheaval. And all of a sudden it’s like, whoa, if you want a policy, if you can’t demonstrate these things, we can’t you can’t get one.
00;08;39;24 – 00;08;41;18
Matt Lee
So yeah.
00;08;41;21 – 00;09;08;02
Chip Arenchild
And yeah. And that’s happened right now. And so the market’s going through the roof. And so and whether it’s an agency like ourselves when you talk about insurance our clients that we serve that I think have been woefully unprepared to make that move to the technology that’s required either to protect yourself and then to step back even further and think about how am I using technology globally inside my enterprise, and what am I doing and move it forward?
00;09;08;02 – 00;09;27;03
Chip Arenchild
And that’s what’s so interesting when you talk about an MSP and that concept that you guys do that you can outsource all of that. If I’m a business owner and I want to look at outsourcing my technology to an MSP, what does that process look like? Is a difficult to what do you have to do if that sounds like a better snake oil?
00;09;27;03 – 00;09;49;21
Matt Lee
Yeah, it’s it’s snake oil. And no, I think the challenge is actually not just on the consumer here. Okay. You know, without risking exposing too much the challenges that unlike a barber, for example, my barber, has to go to the board of cosmetology, get a license, give information, take a nine week course, prove some level of efficiency and capability.
00;09;49;24 – 00;09;57;25
Matt Lee
I don’t there’s nothing that says I know what I’m talking about. There’s no barrier to entry in my industry. There’s nothing to be and IT provider at all. Nothing.
00;09;57;27 – 00;10;17;03
Chip Arenchild
I think that’s a great point because I’ve been calling it the Wild Wild West because it is, you know, if you if you were running cabling and all saying, you know, you’re a security provider, right? And so do you have any tips for people on what things you should look for if you’re going to hire? Is it it is it cyber is is it what would you call it.
00;10;17;07 – 00;10;34;17
Matt Lee
It’s converging converge. The challenge you have also is that this is a bit of a convergence in that industry, right? Like, if you bring it back to my statement that security is all about the CIA triad, then that means security is all about data. How can you be a security company if you don’t understand the data and when it’s worth?
00;10;34;20 – 00;10;52;02
Matt Lee
And so you get into this challenge where it understands the data and what it’s worth. Security purports to protect it, but in reality, they cannot do each other’s job without being each other. And so you have this bit of convergence happening, in my opinion. But that said, back to your question of how can you tell a good one when you’re trying to hire a one?
00;10;52;04 – 00;11;09;17
Matt Lee
What I would ask is, do you have a framework? What are you using as a framework? And that’ll be like, what’s a framework? Matt. So when doctors started kind of being a thing in the 1800s ish, right. When you when the US doctor side happened, they basically knew how to cut your leg off or put a leech in your groin.
00;11;09;19 – 00;11;28;08
Matt Lee
And that was about it. And there was no regulation. And snake oil became a thing. That term is real because it was really people selling crap out of wagons. And to fix your health, it went was. And so you start seeing this world where as that technology grew, doctors were shooting from the hips, right? They were doing their own kind of pseudo medicine.
00;11;28;08 – 00;11;43;17
Matt Lee
They were doing their own kind of beliefs, is what would help a human and all kinds of stuff. Like Kellogg made a cereal, because if you just eat Kellogg’s, you’re fine. Like literally at a hospital where they Kellogg’s. And that was the reality of it. Right. And so you look at that technology developing, we’re like that now. You say wild wild West very much.
00;11;43;20 – 00;11;52;28
Matt Lee
Right. Technology’s only really been in its kind of stages that it’s in today for the last what, 6070 years. Right. And it’s advanced thousands of years in dog years.
00;11;52;28 – 00;11;55;11
Chip Arenchild
Right? Right. Oh, totally. Yeah. Yeah.
00;11;55;13 – 00;12;15;20
Matt Lee
And so you see this as kind of us as practitioners were the magicians five years ago, ten years ago. Oh, I don’t know. That’s the smart folks. They get it. But in reality, we’re starting to have to normalize those and set a set expectation. And so much like doctors now have the American medical journals, they have these these reference bodies of architecture information.
00;12;15;22 – 00;12;20;22
Matt Lee
We as an industry are starting to have those. Right. So the frameworks.
00;12;20;28 – 00;12;26;21
Chip Arenchild
So is there a particular one that someone should be paying attention to if they’re interviewing a provider?
00;12;26;24 – 00;12;47;14
Matt Lee
No. If you ask a provider do you have a framework and can you show me what framework you’re tying to. And they say, yes, you’re probably doing fine, okay. Because most want most are just shooting from the hip and saying you need malware protection because I say malware protection. And I say you need malware protection courses, which is a body of 18 controls that if you do those 18 things, your bell curve risk will be down by 85%.
00;12;47;19 – 00;12;48;12
Chip Arenchild
Okay.
00;12;48;15 – 00;13;05;25
Matt Lee
That’s defensible. I’m speaking from a position that I’m not having to be the smartest guy in the room. I’m being referential to something that is guided as a body of knowledge. That’s professionalism. When you do your insurance replacements, you damn well better know what my cost of being insured was before and what my cost of being insured is now.
00;13;05;26 – 00;13;22;14
Matt Lee
What compliances you might break in the state of Florida, or whatever state you might be in, and how that’s going to apply. Why do you? Because I used to be an insurance agent. So the point is, is that, you know, you have those understandings in our industry doesn’t I could lie to you and you would not know it if I smiled nice and talked with big words.
00;13;22;14 – 00;13;23;16
Matt Lee
You would have no idea.
00;13;23;16 – 00;13;40;14
Chip Arenchild
I think that’s absolutely true. And it’s like when you said earlier about the magicians, right? I’ve always joked about it. They just show up at your desk or they get you over the phone and they hit a few buttons and they go, there you go. You’re like, well, how in the heck did you do that? Right? It’s like, and and you’re so far out of the loop, you’ll never know it.
00;13;40;14 – 00;14;03;26
Chip Arenchild
So yeah. So I want to think about outsourcing my technology to an MSP or, or even cybersecurity. So framework is one if I’m a business owner and a company right now and I’m told, hey, listen, you need to do something different with your security in even order to get cyber insurance in, just to protect yourself. What are the 4 or 5 things you would recommend really just to kind of what’s the process?
00;14;03;26 – 00;14;06;02
Chip Arenchild
What are the things that need to be done?
00;14;06;05 – 00;14;21;09
Matt Lee
You know, that’s that’s kind of like, I hate to be the attorney here, but it kind of is that it depends. Right. What I what I mean by that is like, are there basic things that should be done? Sure. You should have you should have multi-factor authentication. Right. That’s probably the first thing. And I don’t want to be too prescriptive is true.
00;14;21;11 – 00;14;41;07
Matt Lee
But let’s now say okay. On what? Zoom in. What needs MFA, what are the possibilities? Are some of these not even possible to have MFA? Is this software that I’m using on this computer not even capable of doing that, in which case I might have to change softwares. I might have to change the structure of my technology. I might have to invest in something different.
00;14;41;07 – 00;14;58;05
Matt Lee
So. So for so long, so many business owners have said, oh, I’m in this one software. I got to stay with it. It could be your anchor, it could be your death. And so yes, can I be prescriptive and say MFA. Sure. But. But to what? And you have to zoom in and see where all my data is and what is the risk.
00;14;58;05 – 00;15;17;03
Matt Lee
And, you know, for anybody who doesn’t know what multi-factor authentication is, I’ll try to dispel that real quick. So MFA is simply more things to validate your you. And so if we think about C in the CIA confidentiality I want to know that chip is chip. And the way we used to do that was chip at a username chip@chip.com.
00;15;17;06 – 00;15;34;28
Matt Lee
Right. And he had a password chip was awesome. One exclamation point because you got to have that exclamation point. It helps a lot. Right. So that’s normally the way it gets in. That is a type one authentication meaning something I know. So Chip knows his password. So he’s he’s authenticated with a type one. A type two is something you have.
00;15;35;01 – 00;15;54;03
Matt Lee
Right. So think of your cell phone. Think of a security token like this one that I have. Right. These are something I have. And so combined with my password and plugging this in and using it, I now have multi factors involved in my decision to sign in. The last type is type three which is something you are.
00;15;54;07 – 00;16;11;04
Matt Lee
That would be an iris scan. That would be a thumbprint. That would be a palm vein scan. Things that are biometric. You if you combine those three together, that means that if I’m a bad guy, if I’m a threat actor, I don’t use hacker because hackers are good too. Okay, if I’m a threat actor and I get your password, I now need to sign in.
00;16;11;04 – 00;16;26;18
Matt Lee
It now prompts your cell phone says I need this Pin. That’s type two. That’s something you have. The bad guys have gotten good. Hello. This is, blah blah, blah support. We just sent you a code. Would you please read that to me? They take over your account. And that’s the point is, it’s a game you have to think of.
00;16;26;18 – 00;16;49;22
Matt Lee
This is not a win lose. It’s a constantly evolving thing. And so what would be my thing to someone? You know what? What can you do? Pick a plan to start adding a framework and adopting it. So if you look at CES, which is the center for Internet Security, they’ve got 18 major things that if you do these things, you can do a better job of protecting yourself and detecting the issue.
00;16;49;24 – 00;17;05;27
Matt Lee
So it really is I can’t just give you things to do, right. I would definitely say partner with an expert. Right. If I if I said to you, hey, Matt, here’s this giant body. You know, Chip, there’s this giant body. It’s called a 1040 form. There’s also k ones. There’s also E ones. These are all the forms for tax returns.
00;17;06;03 – 00;17;26;02
Matt Lee
Now, which part of the tax return do you want to work on chip. Let’s work on the K one. It’s not how it works. You have to plan. You have to make choices that allow the data to be the right data, so that I can make a profit and reduce my tax impact. And when I hire a CPA or when I hire an insurer, it’s because I’m trying to either offset risk or plan for things to be cheaper or right.
00;17;26;02 – 00;17;45;04
Matt Lee
And so like the professional services engagement is what you need on the cybersecurity side and on the technology side too. Now you can either learn that yourself or you can hire someone to be that consultant. Right. But but it’s one of those things where what’s really been happening is you’ve given Jaime a crayon, let him fill out his 1040 every year and send in the IRS.
00;17;45;04 – 00;17;52;22
Matt Lee
Like, that’s what’s happened with our industry, because it is the Wild West and there isn’t some standard form. But frameworks are the best attempt at standard form.
00;17;52;22 – 00;17;59;14
Chip Arenchild
So. So I ask for your framework and if you don’t like the answer, ask somebody else and probably interview a couple of different people, okay?
00;17;59;14 – 00;18;02;04
Matt Lee
If they don’t know what a framework is, you’ve probably picked the wrong person.
00;18;02;04 – 00;18;22;17
Chip Arenchild
All right. Keep moving from there. All right. That makes sense. Now, before we jumped on the call, we also are talking about clean technology and making sure your technology works. And you know, it’s never been more important. I, you know, Mr. Obvious statement here than right now. Right. With our work from home environment and the pandemic and everybody going home and everybody struggling with how do you make this work?
00;18;22;17 – 00;18;36;27
Chip Arenchild
And so it sounds like this is another chance to reevaluate your technology. And and that’s what you guys do. You write a package. You help businesses understand if they have the right software to make, make it work. Or can you talk about good technology?
00;18;37;00 – 00;18;39;04
Matt Lee
Yeah, we actually help businesses. Help businesses.
00;18;39;04 – 00;18;39;12
Chip Arenchild
Okay.
00;18;39;13 – 00;19;04;17
Matt Lee
We are a we’re an educator and an enabler for the companies that you would hire, to protect yourself. And so I happen to have come from one of those companies, and I’m educating pax8 about those companies, if that makes sense. But, you know, good technology when I talked about all those security things and frameworks, the good answer, the good news, the, positive is that if you started a new company today, you could be more secure than someone that was there before.
00;19;04;18 – 00;19;25;29
Matt Lee
Right. And the reason is, is that if you went and just consumed all Microsoft or all Google or all AWS products, right? And you did everything in one platform, there, making it to where the settings can be set between one customer, the next customer, the next customer, the next customer, all the same way. Right? So Microsoft, if you sign in, you can walk up to your computer at pax8.
00;19;25;29 – 00;19;41;05
Matt Lee
I type in emily@pax8.com anywhere in the world I put in my password, I fulfill my second factor authentication and I sign in. I don’t have a VPN to start. I don’t have to do anything. You know, stand on one foot and hold one tongue out the left side and hold my hand up to the right and hope it works.
00;19;41;08 – 00;20;04;14
Matt Lee
I don’t have to do any of that. I just know my technology platform will work here in my basement, at Starbucks, at anyone’s place that I’m at at any time, the same exact way that I’m used to working with it. And the challenges that if you started a business ten years ago, or five years ago, or four years ago, or even a year ago, you likely weren’t directly and purely in that model for a number of reasons.
00;20;04;14 – 00;20;24;28
Matt Lee
One would be you’re probably doing it yourself. So in which case you probably didn’t have that repertoire to go figure that out. But second would be that even the MSPs and service providers that are out there didn’t understand this concept of modern office until the last couple of years, and mainly due to pandemic. Okay, there were only a few of us that were living way out on the bleeding edge of those services like I was in 2018.
00;20;25;00 – 00;20;30;24
Matt Lee
And so essentially, there’s a new way, there’s a new model. Anybody ever had an iPhone? You got an iPhone?
00;20;30;24 – 00;20;31;18
Chip Arenchild
Yeah I do okay.
00;20;31;22 – 00;20;48;27
Matt Lee
Yeah. When you signed into it the first time, does it feel the same when you got the next iPhone and signed into it and everything just came back and the next iPhone and the next iPhone and it just knew you. And when you bought applications, it came back on the next phone. That’s the world we have not lived in in technology for business.
00;20;49;00 – 00;21;09;20
Matt Lee
But were there the challenges? You can’t be there if you’re carrying the anchor of the legacy technology. The old server based stuff, the old even people that went to Azure or went to cloud, they didn’t go to cloud. They moved their crap to cloud. There’s a difference between that and starting up in a way that there’s modern, okay, you’re not using servers.
00;21;09;23 – 00;21;30;22
Matt Lee
You don’t have any of that infrastructure using only cloud based applications. You’re signing into your machine what that allows in the experience is, let’s say a broker starts with you new insurance agent, right? For your broker. You call Dell and ask them to ship a machine. It shows up at Sally or Bob’s house. He opens it up and there’s his stuff and he’s already there.
00;21;30;22 – 00;21;43;28
Matt Lee
And you know, he knows him, and all he has to do is sign in. And once he does, all of his documents are set up, all of his experience is set up, all of his software is installed, all the settings are the way they’re supposed to be, the machines encrypted and protected. It’s got its protection tools and not a single human touched it.
00;21;44;04 – 00;22;09;10
Matt Lee
Why? Because modern office understands the ephemeral nature of devices. Just like your stupid iPhone. My stupid iPhone, right? When this goes away, I don’t care. The me exists in the core, in the cloud. What other people have been trying to do with regular technology is pretend like that’s the model, and that’s not how it works. And so, you know, when I talk about what is the positive is that some of these things get easier when it’s just your iPhone.
00;22;09;13 – 00;22;13;13
Matt Lee
Right? You cannot interact with this in a way that isn’t the way it’s meant to be interacted with.
00;22;13;13 – 00;22;27;05
Chip Arenchild
And it’s a very good point. Yeah. And your description of trying to take our other stuff and force it into it is accurate as well. Right. And I think a lot of businesses are in that. Well, the pandemic has shown that light that you’re stuck. Right. And then you got to make a decision which way you’re going to go.
00;22;27;05 – 00;22;48;22
Chip Arenchild
And and that kind of leads to, some other thing I wanted to talk to you about was, you know, we’ve all now work from home. We’ve adopted it or this hybrid schedule on what we’re going to do. It’s our rent and our leases and everything. But you mentioned in an article you wrote, and I asked you a little bit about before I hopped on the call about using technology and good technology to help sustain culture.
00;22;48;22 – 00;23;05;20
Chip Arenchild
And I think that’s a big I’m kind of going off to off the topic here a little bit, but I think culture is a big thing that’s being talked about now and everything you read like, hey, we’re bringing our people back to work. Are we want to because we’ve lost our culture. I’m afraid of losing my culture. But with every three months at past, have you brought them back to work yet?
00;23;05;20 – 00;23;27;06
Chip Arenchild
No. Not yet, you know, and I think we’re in here. And the longer everyone’s gone, the less they want to come back. So, you know, all these variables. Talk to us a little bit about your thoughts on good technology and using good technology to build culture. I think people be fascinated to know that you believe you can build culture in a remote, or a work from home, or a hybrid environment.
00;23;27;08 – 00;23;45;04
Matt Lee
Yeah. And I think you have to be intentional, right. Let’s let’s start with it has to be intentional. But that said, you know, thanks for reading my article. Yeah, that is awesome. I appreciate it. You know, I think the challenge is that if you try to do these things with bad technology, you’ll find you cannot. And so I’d say that’s an altruism.
00;23;45;04 – 00;24;07;23
Matt Lee
That is that is it does play out. But I think if you have a good technology base and you understand that the experience, the user experience has to be so good and you have to be able to start replicating some of the things that made culture in your in your, in your environment, like think about the water cooler time, think about the, the just chatting with chip over the water cooler and talking about this and venting about that and doing these things.
00;24;07;25 – 00;24;27;15
Matt Lee
You know, I think you can’t replicate that experience if you don’t have good technology, good identity based solutions. And I just picked up the teams and I called Chip, and we’re sitting there and chatting. And right, you enable that, you have to empower that from a cultural perspective to say, listen, just because you’re at home, you should be working and you have to experience it like an office where somebody can just pop in.
00;24;27;18 – 00;24;45;23
Matt Lee
And I think some of those challenges are things like, you know, making sure that they have a good workspace, make sure that they have good internet. That might mean spending some money on that and downsizing your office and actually investing in their technology capabilities. Right. And making sure that they have a good stable base. But once you do that, it allows you to start building some information.
00;24;45;25 – 00;25;10;17
Matt Lee
If everybody’s using Microsoft or if everybody is using Google, you can actually gather information about how they respond to emails, how they they work, what times they’re working. You can see when they’re most I mean, you start getting data and then if you gamify those things and if you start saying, let’s give Chip 50 bucks a month, you can give away to all anyone else in our company, and let’s find ways to have that be public and gamified.
00;25;10;17 – 00;25;26;14
Matt Lee
And, you know, inside iconic, what we did was something similar that we had 170 employees. And so everybody got money to give away essentially through a platform called I think it was bonus Lee. And you could just give it away as very public. You’d be like, Chip was so awesome today in that webinar. He really helped me understand something.
00;25;26;14 – 00;25;45;05
Matt Lee
I didn’t get 20 bucks. Wow. And it builds and I know it’s not I mean, you know, it sounds like that can be expensive, but compared to costs that were no longer, say like coffee and then food and all that crap in the office, it actually worked out about the same. But what they built was like, really cool ways for people to engage.
00;25;45;09 – 00;26;05;01
Matt Lee
And then we started doing online stuff like today’s picture of your Cat day, right? And everybody brought it up, and you judge them and you gave points. And then something was like, and so what you ended up doing was taking a ubiquitous technology platform that brings people together. That’s always the same that you don’t have Sally going, well, my teams doesn’t load because I’m in the country and I and you have joint.
00;26;05;01 – 00;26;20;16
Matt Lee
And so you have to like overcome some of those burdens. But once you get everybody to parity, right, once you get people to the parity of the connection and parity of the system they’re using, you now have this unified platform. Why is Facebook so successful? Why is this? Because you can. The identity is there. It’s always on. It works.
00;26;20;16 – 00;26;40;23
Matt Lee
You get the content, you add in some social component. And so I think you can use that fairly effectively to maintain the current culture, to have the things about people show out. Right. Like, you know, our CEO would do speeches and stuff and give people points for listening to their name called like, I mean, just stuff. But you can’t do that from crappy technology.
00;26;40;25 – 00;26;51;14
Matt Lee
And I think that’s the point, is that people judge it based on the state they’re in and going, man, I the culture is not able to be manipulated, can’t you? Yeah. Because you barely have the wheels on the bus like this, right.
00;26;51;15 – 00;26;52;05
Chip Arenchild
You know. Right.
00;26;52;06 – 00;26;53;01
Matt Lee
You’re operating.
00;26;53;01 – 00;27;17;06
Chip Arenchild
Yeah. Yeah. I think you make a good point. And I think that’s really true about getting to parity with technology. Right. And I know that we struggle. We have some rural locations, right, where the internet or technology isn’t always in our favor. And so that that creates some headaches. But I do agree, you know, if you built a culture of people being able to step up and pull up a teams meeting any time, that just becomes how you do it is you just do it quickly and get off of it.
00;27;17;11 – 00;27;36;28
Chip Arenchild
It can help and help. The other thing I think that happens when if you don’t have good technology, is people get limited to their bandwidth inside the firm, the only people they speak with. Right. And we’re not sharing anything. And even though we think we’re sending out information, I still only call the three people I like. And if they don’t have the right information, I’m no smarter than I was when I started the day.
00;27;37;00 – 00;28;01;14
Matt Lee
We did that. So, we actually have this, meet for lunch program. And so all it really is, is, basically an open license to go get a free Uber Eats, right? And I understand the money. You do have to invest in your people. So don’t take this as frivolously, you know, frivolously throwing away money. But it’s a we said, hey, listen, if Chip wants to meet any other person in this company, you can randomly just pick that person and ask them to meet for lunch and expense the lunch.
00;28;01;14 – 00;28;25;08
Matt Lee
That’s it. And what it’s done is like, I’ve had people come up to me go, man, I just really want to chat with you. Do you have time? And I’m like, yes, I’d love to. And so we’ll sit and just chat. And it replaces kind of that water cooler kind of esque thing. And almost in some ways, if you’re trying to be strategic about your career, like you almost open up new avenues that would not have potentially existed, like walking up to someone’s office and asking to sit with the VP.
00;28;25;11 – 00;28;30;01
Chip Arenchild
Yeah, because you want to do it. But yeah, you can do it this way. And, surreptitiously.
00;28;30;01 – 00;28;32;29
Matt Lee
Yeah. Totally. Right. Like, yeah. So those are, those.
00;28;32;29 – 00;28;58;06
Chip Arenchild
Are some pretty clever ideas and and that’s not being talked about. We can almost do another episode. Matt. Just trying to talk about, this, cultural stuff because that is, that is a byproduct of what we’re living in right now. So is there, anything else that you’d want to say to people about what you’re doing and the importance of why we’re doing it, that you think we need to at least get out there in the air today?
00;28;58;08 – 00;29;17;02
Matt Lee
You know, I think I’ll take it back to I don’t want to sow fear, in what I do. Yeah. My children are 17 and 18, and my single charge in life is this understanding from what I do as a cybersecurity professional, you know, I assist in a lot of the public private partnerships around cybersecurity in the United States.
00;29;17;05 – 00;29;33;22
Matt Lee
And I don’t think our world will be the same. The luxuries that you grew up with as a child, that I grew up with as a child and as a young adult and as my age now, they won’t be here in the same way. We won’t have the same certainty in our financial systems. We won’t have the same certainty in our systems that we do business with.
00;29;33;22 – 00;29;58;23
Matt Lee
We won’t have those same luxuries at the same time. We’re having increasing debt and gross loss and all of these things that create a very different world for us. As a, as a, as a superpower. And I think the challenge is that if we don’t all as businesses, as humans, take it upon ourselves to learn something about cyber, to learn something about this brand new technology that runs and ruins and builds our world, then it’s on our shoulders.
00;29;58;23 – 00;30;15;27
Matt Lee
And so what do I do? I spend my time educating. I spend my time trying to make analogies so that people can understand the world of cyber. And I think that every person could do something to improve their body of knowledge around cyber security. Go consume some content. Find someone who speaks to you about it. Ask for better professionals, right?
00;30;15;27 – 00;30;30;28
Matt Lee
And I think if people would take that upon themselves, it takes all of us to solve this tool. Don’t solve cyber security. Antivirus doesn’t solve cyber security. It takes participatory sport, right? This is a team sport. So yeah, that’s my advocation.
00;30;30;28 – 00;30;44;17
Chip Arenchild
I like that and I what when you tell that story, you relay that. I think of my kids and and kids in general. They don’t think about security at all, right? They just want to have a connection. They don’t care. And they’ll give away their information all day long.
00;30;44;17 – 00;30;50;24
Matt Lee
I’m teaching a class to eighth graders, in Derby Middle School next week about the dangers of social download.
00;30;50;24 – 00;30;54;07
Chip Arenchild
Hey, I gotta download this song. Here’s my date, birthdate, and my social.
00;30;54;10 – 00;31;03;12
Matt Lee
What if I just pretended to be their grandmother and said, hey, here’s a picture I pulled offline. It’s grainy. My old Facebook account got compromised. Can you tell me the address I need to send your Christmas card to?
00;31;03;12 – 00;31;04;26
Chip Arenchild
Yeah. Granny, I get.
00;31;04;26 – 00;31;06;09
Matt Lee
That data in five seconds.
00;31;06;09 – 00;31;18;18
Chip Arenchild
Yeah, yeah. And it allows. I do think the articles you read I’ve used this term too, right? It’s, the hackers are the new modern day pirate, and it’s amazing, right? It’s a it’s an unlimited opportunity for that, for that to happen.
00;31;18;18 – 00;31;22;17
Matt Lee
So I am really wrong side of the fence monetarily, let’s put it that way.
00;31;22;19 – 00;31;36;04
Chip Arenchild
Yeah. Well, hey, I appreciate you making some time for us today. And on a risk prone, podcast. It’s been wonderful to talk to you. If people want to find you, especially be able to consume what you’re generating, where would they find yet? Matt?
00;31;36;07 – 00;31;51;04
Matt Lee
Cyber Matt lead com is a good start. I don’t maintain that perfectly. But my YouTube, which is, youtube.com cyber, Matt Lee and most importantly, linkedin.com, cyber Matt Lee. So yeah that all under cyber Matt.
00;31;51;04 – 00;32;08;05
Chip Arenchild
Lee cyber Matt Lee we’ll get all of that in the show notes. And I think you’ve given us plenty of things to talk about and, and build on. So we just once again we want to thank you. And it’s fun to talk to you and hear your enthusiasm is, contagious about things and positive solutions. So appreciate it very much.
00;32;08;07 – 00;32;09;00
Matt Lee
Thanks for having me.
00;32;09;07 – 00;32;31;10
Chip Arenchild
All right. You’re welcome. We’ll see you again. We hope you enjoyed this episode of Know Your Risk and insurance Coverage with risk. Coronet. For more information about Risk Coronet, please visit our website. You can follow us on Facebook and Twitter for insurance insights from everyone at risk. Pro Net, we want to say thank you for tuning in and see you next time.
