1
00:00:00,240 --> 00:00:03,419
A company sells you a small little box.

2
00:00:04,080 --> 00:00:09,000
Their entire job and their offering of that box is to not trust anybody.

3
00:00:09,580 --> 00:00:10,939
Don't trust the exchange.

4
00:00:11,099 --> 00:00:12,140
Don't trust the app.

5
00:00:12,259 --> 00:00:13,240
Don't trust the cloud.

6
00:00:13,380 --> 00:00:14,400
Hold your own keys.

7
00:00:14,839 --> 00:00:21,879
Last month, about 80,000 of their customers got their names, their phone numbers, their home addresses stolen.

8
00:00:22,500 --> 00:00:23,399
Here's the kicker.

9
00:00:23,699 --> 00:00:26,359
The company was never hacked.

10
00:00:32,009 --> 00:00:32,869
What's good, Internet?

11
00:00:32,869 --> 00:00:40,189
This is your boy Q, a.k.a. your IT guy's IT guy, and this is The Blast Radius.

12
00:00:43,159 --> 00:00:44,439
All right, The Blast.

13
00:00:44,780 --> 00:00:49,399
One story that actually happened and the part everybody's coverage skipped.

14
00:00:49,920 --> 00:00:51,140
The company is Trezor.

15
00:00:52,039 --> 00:00:56,424
Now, if you're not into crypto, they make these hardware wallets, little physical

16
00:00:56,424 --> 00:01:00,213
devices that hold your keys to cryptocurrency so that it stays off the

17
00:01:00,213 --> 00:01:00,700
Internet.

18
00:01:00,700 --> 00:01:04,982
Their whole pitch, the whole entire reason a product exists is

19
00:01:04,982 --> 00:01:09,333
don't leave your money where somebody else holding can can find

20
00:01:09,333 --> 00:01:09,540
it.

21
00:01:09,959 --> 00:01:13,879
Trust nobody. Be your own bank. So here's what's happened.

22
00:01:14,659 --> 00:01:20,859
August 10th, a company called ShipMonk tells Trezor, hey, we got breached.

23
00:01:21,260 --> 00:01:25,180
Now, ShipMonk isn't a crypto company. They do fulfillment.

24
00:01:25,180 --> 00:01:30,099
they're the ones in the warehouse they have the people who put the little thing in the box slap

25
00:01:30,099 --> 00:01:33,264
a label on it and they hand it

26
00:01:33,264 --> 00:01:38,539
to the carrier August 13th Trezor discloses 13,689

27
00:01:38,539 --> 00:01:39,489
customers

28
00:01:39,489 --> 00:01:43,868
were affected now 13,000 is a bad week regardless

29
00:01:43,868 --> 00:01:47,622
but it's a normal bad week you send emails

30
00:01:47,622 --> 00:01:47,890
you

31
00:01:47,890 --> 00:01:52,185
eat the headlines and you move on except

32
00:01:52,185 --> 00:01:57,339
september 2nd ShipMonk comes back and says about

33
00:01:57,339 --> 00:01:57,769
that

34
00:01:57,769 --> 00:02:05,030
there's actually more turns out that the stolen files also had order records from an earlier

35
00:02:05,030 --> 00:02:12,110
stretch of the relationships orders that came from november 2019 through august 2021

36
00:02:12,110 --> 00:02:18,496
September 5th Trezor discloses again hey 67,000 more U. S.

37
00:02:18,496 --> 00:02:22,240
customers so now let's do the math

38
00:02:22,240 --> 00:02:28,690
13,689 plus 67,000 you're about roughly 87,000

39
00:02:28,690 --> 00:02:34,719
people that got their names and information

40
00:02:34,719 --> 00:02:42,580
addresses phone numbers shipping address order number now let's just sit with the shipping

41
00:02:42,580 --> 00:02:50,289
address for just a second these are people who bought a hardware wallet the data set is

42
00:02:50,289 --> 00:02:56,889
functionally a list of names home addresses of people who are publicly known to hold cryptocurrency

43
00:02:56,889 --> 00:03:04,460
and how much hardware they bought to hold in it that's not a spam list that's a shopping list

44
00:03:04,460 --> 00:03:10,639
Let's be real. There's a reason security world would call this one out for particular customers base.

45
00:03:11,000 --> 00:03:16,300
A home address isn't just a leak or inconvenience. It's physical safety problem.

46
00:03:17,030 --> 00:03:23,030
Here's where it gets good. And the part that nobody actually wants to remember or talk about.

47
00:03:23,030 --> 00:03:25,270
The way in

48
00:03:25,270 --> 00:03:28,183
was through a

49
00:03:28,183 --> 00:03:31,543
CVE-2026-72898.

50
00:03:31,543 --> 00:03:35,150
That is an SQL injection.

51
00:03:35,150 --> 00:03:39,789
want y'all to actually remember.

52
00:03:39,789 --> 00:03:45,816
The way in was through a critical vulnerability, or what

53
00:03:45,816 --> 00:03:49,906
some of us know in the field as a CVE,

54
00:03:49,906 --> 00:03:51,090
2026-72898.

55
00:03:51,510 --> 00:03:58,330
That's like the individual markings or identification of a particular vulnerability that is found in software or different tooling.

56
00:03:58,749 --> 00:04:04,650
That's an SQL injection vulnerability in a piece of software called Metabase.

57
00:04:05,169 --> 00:04:08,229
The severity score of this was a 10.

58
00:04:08,229 --> 00:04:15,629
You can't get higher than that. There's no 11. Now, Metabase, what is that? It's a business

59
00:04:15,629 --> 00:04:20,950
intelligent tool. It's a dashboard. It's the thing that somebody on the ops team spun up so they

60
00:04:20,950 --> 00:04:26,289
could look at the charts, the orders this week, shipping times by the region, pretty little graphs

61
00:04:26,289 --> 00:04:31,989
for the Monday meeting for the CEO. Nobody in the building thinks of this dashboard as a security

62
00:04:31,989 --> 00:04:37,890
reporting product. It's the reporting tool. It's the thing that's plugged into a database so it

63
00:04:37,890 --> 00:04:42,950
can draw the charts and we can see how our market is going or whether we're selling or not selling

64
00:04:42,950 --> 00:04:50,210
but here's the problem a reporting tool has to be able to read everything or it can't really

65
00:04:50,210 --> 00:04:56,770
report on anything so the attackers didn't break into Trezor they didn't break into the Trezor

66
00:04:56,770 --> 00:05:03,070
wallets and Trezor was very clear about that the breach does not affect the security of the hardware

67
00:05:03,070 --> 00:05:07,200
wallets nobody's coins removed the crypto part of

68
00:05:07,200 --> 00:05:10,403
this story is fine they broke into the

69
00:05:10,403 --> 00:05:11,330
warehouse's

70
00:05:11,330 --> 00:05:13,500
chart tool same week different

71
00:05:13,500 --> 00:05:14,217
company a company called Mathspace

72
00:05:14,217 --> 00:05:20,160
an online math learning platform

73
00:05:20,160 --> 00:05:26,400
that has nothing to do with crypto nothing to do with any of this they were breached by their

74
00:05:26,400 --> 00:05:33,499
Meta-based reporting system. Over a million students, staff, and parents. Same software,

75
00:05:33,900 --> 00:05:40,359
completely unrelated victims. And that's what a real blast radius looks like. It doesn't travel

76
00:05:40,359 --> 00:05:43,706
along your org charts.

77
00:05:43,706 --> 00:05:45,500
It travels along your software bill of materials.

78
00:05:45,500 --> 00:05:47,199
Trezor had a data

79
00:05:47,199 --> 00:05:53,460
retention rule written into their contract. 90 days. That's genuinely a good practice.

80
00:05:53,460 --> 00:05:58,319
A lot of companies 10 times their size don't even have anything remotely close to that.

81
00:05:58,699 --> 00:06:02,641
And Trezor says, and they, quote, repeatedly requested and

82
00:06:02,641 --> 00:06:07,059
received written assurance confirming the deletion of their data.

83
00:06:07,679 --> 00:06:10,534
Written assurance repeatedly.

84
00:06:10,534 --> 00:06:14,817
And the 2019 through 2021 orders were still

85
00:06:14,817 --> 00:06:19,199
sitting in their 2026 waiting to get stolen.

86
00:06:19,199 --> 00:06:25,179
this is the episode right here somebody sent the email say yeah we deleted it and everybody

87
00:06:25,179 --> 00:06:32,040
filed that email and they felt good and it wasn't true maybe not even a lie maybe somebody truly

88
00:06:32,040 --> 00:06:36,860
believed that the job ran but maybe it was on another system on the backup maybe the person

89
00:06:36,860 --> 00:06:42,739
who deleted it left the company in his state archive it doesn't matter the paperwork said

90
00:06:42,739 --> 00:06:43,544
gone.

91
00:06:43,544 --> 00:06:46,750
The database said present.

92
00:06:46,750 --> 00:06:51,810
Same window, completely separate incident.

93
00:06:52,650 --> 00:06:59,650
Trezor's email provider, a company called Brevo got breached and the attackers used that

94
00:06:59,650 --> 00:07:03,962
access to fish Trezor's customers.

95
00:07:03,962 --> 00:07:07,006
347,000 emails went out.

96
00:07:07,006 --> 00:07:09,669
2,500 people clicked.

97
00:07:09,669 --> 00:07:15,799
so let's count in roughly one month this company got hit through their shipping vendor

98
00:07:15,799 --> 00:07:21,859
and through their email two vendors two different companies and two different failures

99
00:07:21,859 --> 00:07:26,350
Trezor's own systems were never touched either time

100
00:07:26,350 --> 00:07:28,780
go look at the coverage most of it

101
00:07:28,780 --> 00:07:29,499
reads

102
00:07:29,499 --> 00:07:35,299
Trezor data breach some of it gets cute and implies that maybe the crypto people got their

103
00:07:35,299 --> 00:07:43,220
wallets drain both wrong. Trezor did not get breached, not once, not twice. Trezor's security

104
00:07:43,220 --> 00:07:49,139
did not fail. Their vendor's security failed and Trezor's customers paid for it. And honestly,

105
00:07:49,899 --> 00:07:56,600
Trezor handled about as best as you can. As soon as they found out, they disclosed the information.

106
00:07:56,979 --> 00:08:00,899
And again, when it got worse, they disclosed it. They emailed every new person they had.

107
00:08:00,899 --> 00:08:04,183
They are not the villain of the story.

108
00:08:04,183 --> 00:08:11,181
The real headline is this company whose entire product, trust nobody, got burned

109
00:08:11,181 --> 00:08:18,353
twice by trusting somebody, not because they were careless, but because that's the

110
00:08:18,353 --> 00:08:18,790
deal.

111
00:08:18,790 --> 00:08:23,769
You cannot run a business without vendors and you cannot see inside your vendors.

112
00:08:24,290 --> 00:08:29,810
And if it can can happen to a company that says paranoia for a living, we need to talk about it.

113
00:08:29,869 --> 00:08:36,850
And that means what that means for the rest of us. Radius check.

114
00:08:37,149 --> 00:08:41,229
Now, this is we figure out how far this thing actually reaches.

115
00:08:41,749 --> 00:08:46,830
So here's the question I want you to sit with. Where does your company end?

116
00:08:46,830 --> 00:08:47,840
Think about that.

117
00:08:47,840 --> 00:08:51,993
Most people, if you ask them to draw a their security perimeter, they

118
00:08:51,993 --> 00:08:56,989
probably likely drawing around their office or maybe their laptops, maybe the cloud

119
00:08:56,989 --> 00:08:57,350
stuff.

120
00:08:57,470 --> 00:09:03,800
If they're sharp, that's not your perimeter. And it's never been your perimeter in the 15 years that you're in business.

121
00:09:04,300 --> 00:09:09,599
in my sleep because I built systems for hundreds of

122
00:09:09,599 --> 00:09:10,220
them.

123
00:09:10,220 --> 00:09:14,860
Small shops, 10 people, you're selling something physical. Think about this.

124
00:09:14,860 --> 00:09:22,820
who has your company's list of data right now? Your e-commerce platform, your payment processor,

125
00:09:23,120 --> 00:09:28,220
the shipping and fulfillment provider, that's shit, Monk, in this story. Your email marketing

126
00:09:28,220 --> 00:09:33,440
platform, that's Brevo. Your CRM, your accounting software, your support desk, your booking,

127
00:09:33,580 --> 00:09:37,720
your scheduling tool, your payroll provider has employees, has everything. Your backup vendor

128
00:09:37,720 --> 00:09:43,059
has a copy of it all. By definition, that's literally the product. That's 10 and I didn't

129
00:09:43,059 --> 00:09:50,500
even try hard most shops i walk into and the real number is somewhere between 15 and 40 but nobody

130
00:09:50,500 --> 00:09:56,080
in the building has ever written it down every single one of these companies have a bad tuesday

131
00:09:56,080 --> 00:10:01,940
it puts all your customers addresses and internet and information and how will you find out about it

132
00:10:01,940 --> 00:10:08,100
through an email after it's over not on your

133
00:10:08,100 --> 00:10:10,519
get got by some

134
00:10:10,519 --> 00:10:14,300
exotic ShipMonk

135
00:10:14,300 --> 00:10:21,099
specific thing they got through a Metabase software ShipMonk didn't write that they did

136
00:10:21,099 --> 00:10:26,180
but they installed because it was a good tool like that of any a thousand other companies who

137
00:10:26,180 --> 00:10:32,359
install that system. So it's not just who do I trust, it's who do my vendors trust and what do

138
00:10:32,359 --> 00:10:38,300
they install. That's the blast radius. It's not a circle around your building. It's a graph. It's a

139
00:10:38,300 --> 00:10:45,479
node. Your vendors knows their software is a node. A hole anywhere upstream floods you entirely

140
00:10:45,479 --> 00:10:51,680
downhill on you. You cannot audit that graph. And I want to be honest with y'all. I'm not trying to

141
00:10:51,680 --> 00:10:56,280
sit here and stand y'all and telling you that running a 10 person shop, that you're going to

142
00:10:56,280 --> 00:11:02,060
audit every software application, ShipMonk's, dashboards, software, et cetera. That's not a

143
00:11:02,060 --> 00:11:07,079
real thing, but that doesn't mean that you're helpless. It means that you're solving a different

144
00:11:07,079 --> 00:11:09,700
problem than you may first thought about. All right. Now, let me tell you something from the

145
00:11:09,700 --> 00:11:12,466
the third party risk is

146
00:11:12,466 --> 00:11:13,579
a whole

147
00:11:13,579 --> 00:11:19,579
department including vulnerabilities the fortune 100 companies fortune 500 whether it's government

148
00:11:19,579 --> 00:11:24,140
financial it doesn't matter whether these classified and unclassified networks and

149
00:11:24,140 --> 00:11:29,099
sometimes what gets identified as the crown jewels when you do this type of work that

150
00:11:29,099 --> 00:11:34,800
touches these environments you're not going to do anything without a review not a vendor not a cable

151
00:11:34,800 --> 00:11:39,879
not a laptop there's paperwork on top of paperwork and it literally takes months to get anything done

152
00:11:39,879 --> 00:11:44,359
and every department and team that works in these environments know about it they complain about it

153
00:11:44,359 --> 00:11:49,459
but it's just the way it is and you know what's the half half of that process is a theater it's

154
00:11:49,459 --> 00:11:54,820
theatrics it's a lot of check boxes exercises and someone just has to point to when it all goes bad

155
00:11:54,820 --> 00:12:01,280
but the other half is real and the real half is stupidity something simple where someone can just

156
00:12:01,280 --> 00:12:06,440
say hey this is a list of everyone who touches this data and someone owns that list that's it

157
00:12:06,440 --> 00:12:12,739
but the part that actually works and it's the part that small business skip entirely and it's not

158
00:12:12,739 --> 00:12:18,300
because it's expensive it's because no one ever told you some of us have to learn the hard way

159
00:12:18,300 --> 00:12:23,879
It's a real thing. Meanwhile, a small shop signs up for a SaaS product.

160
00:12:24,219 --> 00:12:31,560
That's S.A.A.S. Software as a Service. And they sign about sign up in about four seconds with a credit card number.

161
00:12:31,660 --> 00:12:35,520
They check box. I agree to the terms and services agreement that none of us read.

162
00:12:35,599 --> 00:12:42,959
But at the same token, all of that data, that customer data has the same exposure, zero review.

163
00:12:42,959 --> 00:12:50,420
And I'm not even mad. How can you expect a small business team to run a six month audit on every vendor that they're using information?

164
00:12:50,579 --> 00:12:55,900
They're sending newsletters, emails, blasts saying that, hey, you know what? We need to do this.

165
00:12:56,479 --> 00:13:01,800
Now, here's the thing I really want to drill down on, because this is the piece that's specific to the story.

166
00:13:01,899 --> 00:13:07,369
And it's the one that almost nobody thinks about. Everybody thinks about access.

167
00:13:07,369 --> 00:13:13,830
who can get in? Passwords, MFAs, what are multi-factor authentications, permissions,

168
00:13:14,210 --> 00:13:21,190
they're good, they're necessary. But almost nobody thinks about the data retention. How long does

169
00:13:21,190 --> 00:13:27,649
this company actually have or keep my data? Even after I've unsubscribed or I found a new vendor,

170
00:13:27,850 --> 00:13:31,850
I'm no longer doing business with them. Do you know that they still have your data?

171
00:13:31,850 --> 00:13:39,489
Trezor didn't think about it did think about it in fact they wrote out a 90-day retention

172
00:13:39,489 --> 00:13:46,369
in the contract they asked specifically and they got it in writing and they still got burnt by a

173
00:13:46,369 --> 00:13:53,330
six-year-old orders that were stolen so understanding what this proves you cannot

174
00:13:53,330 --> 00:14:00,450
verify deletion from the outside there's no api or proof that it's gone you can't usually do a diff

175
00:14:00,450 --> 00:14:06,450
on their database. You can ask a vendor to delete your data, but it's no different from you going to

176
00:14:06,450 --> 00:14:10,470
one of your exes and be like, yo, you know all those pictures that you took of me? I don't want

177
00:14:10,470 --> 00:14:14,909
you to have them anymore. Delete them. And then you get a text back and they say, yeah, we deleted

178
00:14:14,909 --> 00:14:22,210
it. Yeah, right. The problem is, is that when you deal with these businesses and they give you a

179
00:14:22,210 --> 00:14:27,970
promise or a reassurance, you have to only take it as far as they give it to you. But somewhere

180
00:14:27,970 --> 00:14:31,845
silently that data may still exist and they may

181
00:14:31,845 --> 00:14:36,050
have legitimately tried to delete it but the checks

182
00:14:36,050 --> 00:14:41,529
and balances of it was it actually remove is a whole nother conversation which leaves exactly

183
00:14:41,529 --> 00:14:46,127
two levers that you could control one it

184
00:14:46,127 --> 00:14:51,069
sounds simple but it's give them less every

185
00:14:51,069 --> 00:14:51,989
optional

186
00:14:51,989 --> 00:14:57,430
field in that software or that vendor that you're using is a field that can leak later on do they

187
00:14:57,430 --> 00:15:01,550
really need the phone numbers of the customers do they need the date of birth do they need the

188
00:15:01,550 --> 00:15:06,590
shipping address after the thing that they shipped and the return window is closed and you've never

189
00:15:06,590 --> 00:15:11,330
collected any more data that data can be stolen if they're not if they're still keeping it why

190
00:15:11,330 --> 00:15:17,719
are they still keeping it you can tell them hey if you manage my data delete that the reality of

191
00:15:17,719 --> 00:15:24,020
is is that a tool that's no longer used but it's still in deployment in their environment can still

192
00:15:24,020 --> 00:15:28,375
be a security risk that's not just fact that's

193
00:15:28,375 --> 00:15:32,919
just not hearsay that's facts now to assume that

194
00:15:32,919 --> 00:15:40,679
it does leaks and leaks unfortunately happen so what do we do next but if we look at that example

195
00:15:40,679 --> 00:15:45,009
that we talked about Brevo and that was the

196
00:15:45,009 --> 00:15:49,439
half of the crm tool 347 000 phishing emails

197
00:15:49,439 --> 00:15:54,014
2,500 and people click on that why not because

198
00:15:54,014 --> 00:15:58,689
they didn't know better but the email came from

199
00:15:58,689 --> 00:16:04,030
a real sender though the the platform was real and the people that they were targeting were

200
00:16:04,030 --> 00:16:10,310
actually really tree source customers so if you got an email from a vendor that that you do business

201
00:16:10,310 --> 00:16:15,209
with and that your customer gets that email your customer says oh yeah they do business with them

202
00:16:15,209 --> 00:16:21,469
So this is probably legitimate. And they actually had an order. Every single normal person is taught to check.

203
00:16:21,669 --> 00:16:26,689
Well, do I know this company? Did I buy from all those gates were checked? Everything was passed.

204
00:16:26,770 --> 00:16:29,062
There was existing order information.

205
00:16:29,062 --> 00:16:35,010
And when that information was found by attackers, they were literally operating from the inside.

206
00:16:35,189 --> 00:16:39,050
So the defense can't be, oh, you got a spot, a fake email.

207
00:16:39,050 --> 00:16:46,350
The defense has to be a thing that even when the message is perfect, you have to be careful.

208
00:16:49,770 --> 00:16:54,649
All right. Now it's time for the fix. Three things that you can do today.

209
00:16:54,730 --> 00:16:57,369
And the first one is free that you can do today.

210
00:16:57,950 --> 00:17:04,669
Every outside company that holds your customer or employee data, one row, each three

211
00:17:04,669 --> 00:17:10,669
columns, who they are, what they have and who owns the relationship on your

212
00:17:10,669 --> 00:17:11,069
side.

213
00:17:11,069 --> 00:17:15,871
When you open up a bank statement and your credit card statements and you go

214
00:17:15,871 --> 00:17:20,798
line by line and you look at every reoccurring charge, that likely is a vendor

215
00:17:20,798 --> 00:17:26,042
and most honest inventory that you ever built because it's the one that nobody ever

216
00:17:26,042 --> 00:17:26,990
really curates.

217
00:17:26,990 --> 00:17:32,509
and I'm telling you right now don't be surprised as there's likely going to be at least two things

218
00:17:32,509 --> 00:17:38,049
two vendors two subscription that you're still paying for still holding an open door for and

219
00:17:38,049 --> 00:17:42,809
I promise you even on a personal or there was software that I was paying for my kids who are

220
00:17:42,809 --> 00:17:48,170
now teenagers and the tool that I was a subscription I was paying for us for like when they were in

221
00:17:48,170 --> 00:17:52,890
pre-k and I'm like why am I paying this five dollars but because it was so small amount

222
00:17:52,890 --> 00:17:58,769
didn't pay no mind but the reality is everyone always finds something that they're paying for

223
00:17:58,769 --> 00:18:03,269
that they should no longer be paying for or their subscription expired and they no longer do the

224
00:18:03,269 --> 00:18:09,730
service you cannot protect though what you have never counted and when a vendor emails you at 6

225
00:18:09,730 --> 00:18:15,630
p.m saying hey we had an incident the list and that difference of knowing between 10 minutes of

226
00:18:15,630 --> 00:18:21,130
exactly what data was there and spending the next three days guessing and investigating it could be

227
00:18:21,130 --> 00:18:25,950
the determination of whether your business continues to be successful or you take that PR

228
00:18:25,950 --> 00:18:26,580
hit.

229
00:18:26,580 --> 00:18:27,100
Next up, pick the top five from the list

230
00:18:27,100 --> 00:18:32,939
of the ones that are holding your most sensitive

231
00:18:32,939 --> 00:18:40,399
information. Send one email. What data of ours do you currently hold? How far does it go back?

232
00:18:40,399 --> 00:18:46,780
And what is your retention schedule? That's it. The whole email. Now, I just spent 10 minutes

233
00:18:46,780 --> 00:18:51,480
telling you that Trezor did this and got burned anyway. So why am I telling you to do it?

234
00:18:51,639 --> 00:18:55,600
Two reasons. One, the answer itself is intelligence.

235
00:18:56,040 --> 00:19:01,219
Plenty of vendors are going to come back with all of it and forever we hold your data.

236
00:19:01,219 --> 00:19:05,179
And now you know that you can decide if you're good with that.

237
00:19:05,850 --> 00:19:07,949
Two, and this is the real one.

238
00:19:08,510 --> 00:19:15,909
Trezor got burned, but Trezor also knew within days exactly who to notify what was taken.

239
00:19:15,909 --> 00:19:21,330
they were disclosing while other companies were still scrambling trying to find out what exactly

240
00:19:21,330 --> 00:19:27,030
was done taking how it happened and the typical statement you'll see in the news is we're still

241
00:19:27,030 --> 00:19:31,929
investigating that means that they didn't have a no they didn't have an audit and they're probably

242
00:19:31,929 --> 00:19:37,090
never going to truly know the effect and just might as well say everyone was compromised the

243
00:19:37,090 --> 00:19:43,949
list does not prevent the breach the list turns a mystery into a notification that's a whole lot

244
00:19:43,949 --> 00:19:49,429
worth more than at a 6 p.m. on a Friday would you rather someone say I think you were hacked

245
00:19:49,429 --> 00:19:54,209
or just someone says hey your phone number and your name was breached but nothing else

246
00:19:54,209 --> 00:20:02,129
so two moves on your side phishing resistant logins pass keys where you can get them a real

247
00:20:02,129 --> 00:20:08,590
authentication app and when you can't get those at least have SMS codes for anything else that

248
00:20:08,590 --> 00:20:15,909
matters the whole point is that when not if your people's who your employees their emails their

249
00:20:15,909 --> 00:20:21,389
phone ups end up in someone else's phishing set a convincing message doesn't hand out an account

250
00:20:21,389 --> 00:20:28,090
just like that when there's controls over the message it is perfect because now it doesn't

251
00:20:28,090 --> 00:20:34,909
depend on someone having to notice hey does that email sound off your customer side you can then

252
00:20:34,909 --> 00:20:39,850
tell them what you will never do. But before that happens, put it on your website, put it in your

253
00:20:39,850 --> 00:20:45,629
contracts, put it in the order that we will never text you a link or update your payment. We will

254
00:20:45,629 --> 00:20:50,850
never call you and ask for a code because here's what a lot of folks miss. When your email vendor

255
00:20:50,850 --> 00:20:56,929
gets popped, the phish that comes out to your customers, and that's phish with a P-H-I-S-H,

256
00:20:57,090 --> 00:21:03,030
has your name on it. The trust that gets spent is yours. You're the one who has to defy it and

257
00:21:03,030 --> 00:21:07,629
you're the one that has to send the letters out later disclaiming that hey a compromise happened

258
00:21:07,629 --> 00:21:11,790
with one of our vendors but you're the one taking a hit and it's the one that when you have that

259
00:21:11,790 --> 00:21:18,090
conversation before it went wrong then you seem better prepared both of those will map to lessons

260
00:21:18,090 --> 00:21:23,969
that will live free in the community right now fix one the counting what you've actually got

261
00:21:23,969 --> 00:21:29,649
that's module one the map the whole idea you can't secure things that you haven't drawn you don't

262
00:21:29,649 --> 00:21:35,109
understand, don't exist, you don't know your retention rates, that's imperative. The fix

263
00:21:35,109 --> 00:21:39,530
number three that we talk about, that's the login app. That'll be on module three, identity,

264
00:21:40,070 --> 00:21:46,129
passwords, MFAs, pass keys, free. Go to it right now. There's even a quiz. It'll take five minutes

265
00:21:46,129 --> 00:21:50,770
once you go through the lesson and test your knowledge and tell you this is something that

266
00:21:50,770 --> 00:21:55,510
if you don't know about it now, you might find out about it the hard way and that's never the

267
00:21:55,510 --> 00:21:56,800
where you want

268
00:21:56,800 --> 00:21:57,499
so that's

269
00:21:57,499 --> 00:22:04,759
the radius on this one a company that sells trust nobody got hit twice by two different vendors

270
00:22:04,759 --> 00:22:12,519
without ever being hacked the thing that failed wasn't a firewall it was an email from 2021 that

271
00:22:12,519 --> 00:22:19,380
said yeah we deleted that information now you have a vendor list like that too maybe you just

272
00:22:19,380 --> 00:22:25,040
haven't written it down go write it down today and if you want the lessons the map the identity

273
00:22:25,040 --> 00:22:31,019
the stuff all that will be in the community it's called inside the blast radius on the platform

274
00:22:31,019 --> 00:22:38,699
Skool — skool.com. the foundation's track is free and the link is in the description come in there

275
00:22:38,699 --> 00:22:44,719
share your story come argue with me tell me that i'm wrong that's what i always love because i

276
00:22:44,719 --> 00:22:49,900
always can tell you this when I'm right I'm right and when I'm wrong I could have been right because

277
00:22:49,900 --> 00:22:54,939
I could have been right about being wrong and one day I might be wrong but that day ain't today

278
00:22:54,939 --> 00:23:01,140
this is your boy Q everything has a blast radius just find out how much yours goes peace