- Hello you wonderful people.
Today we're gonna talk about taking action,
because there are so many of you out there that just don't.
For those who don't know me, I'm Pete from Tekkers,
thank you so much for all the comments
you've been leaving for me recently,
really appreciate it, keep at it.
So I wanna talk to you today about taking action,
since there's been a couple of scenarios
that have happened in the past couple of weeks,
and I thought it'd just be interesting to address them
in a video.
Now the first is for a customer who we have recently
onboarded, you know, when you get free cupcakes,
and that kind of onboarding.
And the reason why we are onboarding them
is because they have had two cyber breaches
in the last six months, and in each situation,
they informed the IT company and they took some steps,
and that's the key here, is they took some steps.
And so after the first breach, some steps were taken,
they cleaned up the infection and "fixed" the issue,
and nobody asked the question of, well how did it get in,
or why did it get in, and so
what do you think happened next?
The same thing happened again,
the exact same thing happened,
I think it was two or three months later.
And again, the issue was cleaned up,
and no one asked any questions, nobody patched the hole,
nobody did anything to fix the reason why
this was happening, they just did nothing.
And that brings me on to the second story of the week,
where we are onboarding another new customer,
and part of the process of onboarding is
receiving the passwords from the outgoing IT company,
the people that were supporting them
and they hold all of their information,
their passwords is one of the key things
that we need to be able to get into their systems
and access their servers and the networking
and their accounts.
And one of the passwords that was accidentally
handed across to us was the master password
that actually got us access into all of their,
well maybe not all, but quite a number
of their customer's networks,
and so this is a network administration tool
where we can log in, we have basically full access,
I mean we could connect into the customer networks
if we wanted to, we could see wireless passwords,
we could change passwords, we had the power
to delete entire networks, had we been that way inclined.
Of course, we have ethics here, and standards,
so we didn't, but that was an accident,
which is absolutely fine, accidents of course do happen,
and what we then did, and this what surprised me,
is we then notified them that they had done that,
and it's now four days later,
and nothing's happened, we can still get access,
they've not changed the password, nothing's happened.
And so, earlier today I sent a message
to the director of the company,
who hopefully will do something cause you know perhaps,
perhaps there is something going wrong here,
perhaps the employee has made a mistake
and they don't want to own up and say
"Sorry, look, I've made a mistake here,
"we need to change the password."
So I've notified them, and as of yet
I've not had a reply back,
the password still works, but it has only been about
six to eight hours since I've done that,
so still quite not that great that it has been
six to eight hours on an issue where,
it's effectively a breach, you know,
it's a cyber breach, had it been handed
to somebody malicious they could've done
a lot of damage with that, notifying the ICO,
fines, all of this kinda thing that I guess,
and I'd imagine would be the process that you go down.
Notifying the customers themselves, but,
we'll see what happens.
And it was a bit of a conundrum for me,
because I felt morally obliged to let them know,
and get in contact with the director,
but then also as I was drafting the message,
it felt very much like, "Ah, you've made a mistake,
"haha, we're better than you," that kind of thing,
and being a bit of a telltale,
and it just didn't feel, didn't sit right with me.
So it was a bit of a conundrum,
I sent the message, I did send it across,
but I would be interested to know what your thoughts are,
what would you have done in that situation
if something had happened with a customer of yours
or a partner of yours, and some information had been leaked,
no damage has been done, and no damage was done,
would you then tell them about that,
would you go up the ranks because you told somebody
and they've not done anything, would you then go up
to the next director level
and the owner level to report it?
I think I would, and I did,
but it was a decision I had to make.
And there's the virtual kick up the bum,
so that's what I'm gonna leave you with this week,
oh, actually, no I'm not, I'm going to,
friend of mine, Mike, thank you, lent me a Oculus Quest,
it's an Oculus Quest, and you might have
seen these online or you might have seen people
wear them or read about them already,
and this is the latest, I think it's one of the latest
VR headsets, so the Oculus Quest is completely wireless,
it doesn't need to be wired into a PC or a console,
or anything else, you literally just
have the wireless headset, I think the battery life
lasts two hours or so, and you have a couple
of wireless controllers as well, so let's have some fun.
- Whoa, that is...
Wow.
- Can you see how sweaty I am now after that?
Wow.
That's definitely a workout and a half, that's for sure.
Really, really shows you how far
technology has come.
It's better than a gym membership,
you can do it from the comfort of your own home,
you break out a sweat, yeah.
So anyway, slightly off topic I know,
but it's like I've said, this week is all just about
taking action, like the two cases I gave you,
it's a simple, simple case of just doing something.
There's a problem, let's go fix it.
It's not that difficult.
So, if you need any help with anything,
cybersecurity, IT or otherwise,
you know where we are, we're not always sweaty,
we normally sit down at our desks
and do quite a lot of work.
I work very very hard here, so,
you know who we are, you know where we are,
just connect in with us and we'll make sure
we do the best for you.
That's all for this week, like, subscribe,
all of those things.
I'm gonna have a shower, see you in the next one, bye bye.
If any of my staff get to see the CCTV of this,
it's gonna look like the most ridiculous thing.
Actually, I might try and find the CCTV
of me wandering around the office and cut it in.