Can I Sign Delaware Banking Presentation

Industry sign banking delaware presentation secure

um almost high we thank our friends that we're able to still get together today um and and all our our partners that still made the took the chance to join us that still participated with us even though it's virtual um because our attendees are looking forward to interacting with you and spending some time to get to know you so this is our 11th annual secure delaware workshop and we call it a cyber security summit we call it our delaware cyber security conference i remember just last year we had close to 500 people with us at the chase center and it was wonderful to meet everybody wonderful to to talk about different concepts from from identity to cyber threats to fishing to just fraud right that is the extent of our conversation that we will have today so i'm excited about this platform i'm excited about the chance to spend time with you today and i get to introduce some amazing people today you know even those that i wouldn't directly be um introducing in my mind i am introduced to them and i have that honor of doing that uh thank you we have close to 195 people on connected we have more joining now and uh we'll get this thing going one other thing to note is october is cyber security month uh usually we have events across the whole month with our members of our information security office and members of our community um but with the state of affairs we went virtual with that too and we got great success we had some topics that uh our users and our participants found to be extremely uh educational and they absolutely loved it um i would like to encourage you to check out ron plasco's presentation on cyber fraud that is coming up in november 5th uh that is also extending our cyber security month with a little bit more content that just tells you whether you're a small business or whether you are just a constituent at home to know how to interact with a lot of the the cyber information uh beyond just the panelists will have the breakout sessions where you get to choose a topic and spend time with some of the great participants that we have so thank you again for uh joining us today we'll go ahead and we'll get it kicked off so many of you remember last year are very energetic and charismatic leader uh james collins um with a lot of the changes going on um james has decided made the decision to pursue other opportunities and it was a definitely a tough time for us um but we were so excited for him and we wished him so well um we haven't seen a bow tie since he left so we just gonna have to just put some around the building just so we could uh remember the the energy he brought to us but in his seat mr jason clark has stepped up and and provided excellent leadership for our organization you know jason has been with the state for many years and for the last three years he was the chief operating officer so if you ride on our internet or if you see a traffic light if you see uh if you go to our set site and get health care benefits that infrastructure you were running on was led uh by jason and his team and they've been doing such a wonderful job to keep the state going so we're very excited about our governor's office making that brave decision to to select one of our own to assume this role and lead it until you know after the elections and and when they go through a whole confirmation thing so it is my honor and i consider him a friend we're actually twins uh from different parents nobody knows that born the same day so uh we're we always get together we have a good time so please without further ado allow me to introduce you to jason clark well good morning everyone and thank you very much solomon uh for that introduction and thank you all for joining us james as as solomon mentioned has left and i'm currently acting as the state cio he left a huge footprint on our organization and definitely within the cyber security landscape as a whole his support in this space will remember for years to come as solomon said and we wish him definitely nothing but the best and continued success uh in his new adventure they say uh hindsight's 20 20. i'm not sure how many of us want to look back on this year but for all the challenges that i t uh you know i t has really shined in all of the challenges that we've endured in 2020 there's no doubt we face some major challenges with provisioning thousands of employees for telework configuring and rolling out laptops setting up soft phone implementations and let's not forget the incredible work that our service desk team has been doing in supporting those employees who are working from home for the very first time we've done all of this while continuing to pursue our centralization efforts and keeping all of our services and all of our other services available and online and available for everyone to use but like all of you we are adapting and our efforts to deliver i t are gaining newfound respect within the businesses we support now more than ever our customers are more dependent on i.t the services and the ability to shift whole services quickly as we respond to the new normal that's been presented to us in this pandemic here at dti we continue to broaden our single sign-on solution id.delaware.gov we continue to pursue cloud-first solutions and for the foreseeable future supporting broadband initiatives to increase internet access across our state and ensure that our students can be educated from home and participate we couldn't do all this without many thanks to governor carney our federal and state delegations and really all of our partners for the ongoing support of these efforts solomon mentioned the vendors joining us today the vendors that have supported us during this time really can't thank you enough but many of you know all of this adapting comes with risks cyber security is one of the greatest threats in the modern age we're reminded every day that bad actors are working to find vulnerabilities and exploit our systems this election season is casting a light on that which all of you know occurs daily i had an interview just the other day about the activation and i'll say that we're fortunate again this year to be partnering with the 166th cyber operations squadron of the delaware air national guard along with members of the delaware army guard together with the department of elections we're working hard to safeguard the democratic process and we've gotten a few phone calls about activating the guard and what does this mean and we have to remind them each and every day whether there's election in play or not we face these threats and we have to react and we have to be prepared so it kind of brings me back to the reason we're all here today this is a conference about working together to protect our systems our businesses and our communities i do have the honor today of introducing to you our first keynote speaker mr daniel elliott who fittingly will be speaking on managing cyber risks during times of crisis i'm fortunate to know daniel he was extremely helpful in ensuring outreach to our small business community when we moved house bill 180 on breach notification forward several years ago we appreciated his efforts then and we really appreciate his willingness to come back and join us today for those of you who do not know him uh please let me read a few lines from his bio with a passion for helping people daniel elliott is director of education and strategic initiatives at the national cyber security alliance his role in his role he's responsible for ncsa's educational portfolio and helms one of ncaa's most successful initiatives cybersecure my business which is a national program designated to help organizations of all sizes learn to be safer and more secure online mr elliott assembles the federal government state and local governments academia private sector all in an effort to discuss cutting-edge issues and to create and implement high-quality large-scale education awareness efforts daniel's a certified sand security awareness professional he's an accomplished speaker a champion when it comes to cyber security and he regularly speaks at events across the country collaborating with regional and national cyber security initiatives he's not only a champion of helping people stay safe online but he's also a champion of homeless animals and regularly fosters them for the spca he's uh originally from southern indiana but he has made the east his home and is uh we're quite quite happy with that so as i said he's been a long-standing partner of dti and we're glad he's here and able to join us again today please join me in welcoming daniel elliott thank you so much you know in in order of the day i have my dover downs pencil so i'm mentally uh mentally at the conference but uh no it's it's wonderful uh being part of this and let me share my screen here so you can hopefully you're able to see what i'm seeing now it is an honor being part of this conference i always thought i would be on the main stage talking to the secure delaware conference and um though i am not on this stage physically it's it's a pleasure being here virtually with all of you i love the first states and uh getting to collaborate in any way i can with all of you so uh oh and i also before i get into my remarks i want to thank all of the people who put this event on uh i know how hard it is to assemble these types of events uh whether virtual or in person so thank you to all of the planners and organizers for pulling this together for a great day of learning um so let's dig right in so as jason said i'm going to be talking about managing cyber risks during times of crisis and i'm going to organize my talk into a few different modules i'm going to first provide an overview of the national cyber security alliance and of cyber security awareness month then i'm going to break down some of the tactics and themes that cyber criminals are using to take advantage of businesses and consumers during times of crisis and i'll give some very specific examples of those attacks then i'm going to provide you with some ways that you can reduce your vulnerabilities and i'm going to try i'm going to break that up into two different sections uh for consumers and then for businesses and then i'll wrap up with some q a and uh some resources that you can take advantage of so who is the national cyber security alliance or what are we you know we're a national non-profit focused on cyber security education and awareness and we do that through deploying large-scale campaigns um so some of you may have heard of the stop think connect campaign that we created with the white house a few years ago or a few administrations ago at this point we also coordinate data privacy day which is recognized every january 28th and one of the largest campaigns that we lead is cyber security awareness month and we are in october happy cyber security awareness month everyone we're almost oh it's almost over oh my gosh um so cyber security awareness month recognized every october is a collaborative effort between the government and industry both not private sector and non-profit to raise awareness about the importance of cyber security and to make sure that all americans have the resources they need to be safer and more secure online and so the national cyber security alliance we co-lead the annual monthly uh recognition with the cyber security and infrastructure security agency i know it's a mouthful we can just call them sissa from here on out and the overarching theme for october this year in particular is do your part be cyber smart and that theme is really designed to empower individuals and organizations to own their role in protecting their part of cyberspace because if everyone owns their role right this isn't just the job of the iep department or rit vendor it's everyone's job to secure our personal security and our enterprises security um and if we we if we all own our role that our interconnected always connected world will be safer and more resilient for everyone and so uh there are ways that you can you can still get involved even though we're almost done with october uh it's free to take part in cyber security awareness month we encourage you to become a champion when you sign up to become a champion you receive a toolkit that you can use to design your own awareness initiatives share with your friends family customers i know delaware department of technology and information is a champion and so thank you for uh becoming part of that um many state universities uh or many state governments universities businesses have signed on to become champions to become cyber security evangelists i like to call them to spread the good word about cyber security and help people understand that they can take steps to improve their security but it takes this amplification effort such as becoming a champion to impress upon individuals that they can take steps uh to improve their security so now that my commercial is over for the national cyber security alliance and cyber security awareness month let's dig into this topic here so again managing cyber risks during times of crisis now individuals and organizations face all sorts of risks and threats right it's just it's part of life um whether it's competition or natural disasters or cyber threats or you know the city of philadelphia decided to close the street in front of my house yes or this week to tear it apart and so if i were a business that would be a resiliency-based effort but i would have to figure out a way to continue serving my customers uh with the street destroyed in front of my middle building so we're always facing some sort of threat and risk what's critical is how we as individuals and businesses prepare for and respond to those moments of uncertainty that's what's important how you prepare for and respond to those moments of uncertainty really be the difference between you staying in business or going out of business or means the difference between you being financially viable for your family or not right so it's really important how you prepare for and respond to this uncertainty now 2020 i i think this graphic right here is 2020 in a nutshell um the topic uh as in sums up this topic quite quite well 2020 has been generous in the in showcasing the types of or the spectrum of threats that can face not only businesses but the world's community our citizens as a whole we see fires ravaging california and colorado noaa the national oceanic atmospheric administration was predicting seven to 11 hurricanes with three to five of them predicted to be very serious we've seen social unrest across the globe but particularly here at home and this is manifested in both peaceful and violent protests but both of them had had an impact on general constituents and our business communities and of course we've had the pandemic that we've had to confront not only changing the way we do business but the way we live our lives and you know those are just a few examples of some of the threats that have appeared in 2020 and the year ain't over folks we have plenty more time uh you know there are these killer hornets that are apparently popping up so we there's plenty more time for bad things to happen and so we want to be thinking about how are cyber criminals taking advantage of all these threats and that's where i want to lead because among all of the threats that i just outlined to you there's one persistent threat that um threads itself throughout all of them and that is the threat of cyber um because you know cyber criminals they they prey upon fear they prey upon uh confusion they prey upon generosity and they prey upon curiosity their goal is to exploit not only technological vulnerabilities but vulnerabilities in human behavior and human emotion to get what they want and much of that exploitation happens by through what is called social engineering now criminals are going to manipulate the human element of security through social engineering to get you to disclose sensitive information they love for you to disclose confidential information such as your credentials they want to encourage recipients of emails and text message to click on links or to download malicious files they want you to click on links to infected websites and they want you to the want you to give them physical access to facilities right and they do all of this through social engineering by crafting convincing emails crafting convincing stories to get you to take an action they want to influence you through manipulating your human emotion these are not technological attacks these are psychological attacks that use technology as a delivery mechanism and so we have to stop thinking that cyber crimes are only technological attacks right they're using human emotion to get us to uh elicit certain behaviors so how are they doing that so one of the biggest ways that they're trying to manipulate us is through phishing or these malicious emails and text messages that they're sending so know before one of ncsa's founder but in csa's board member companies found that in their quarter one fishing report uh they looked they found that uh phishing emails related to coven 19 were up 600 percent in quarter one of 2020 up 600 percent now crowdstrike in one of their studies found that there were more intrusion attempts in the first half of 2020 then in all of 2019. so why this increase in the first half of 2020 well crisis right people were desperately seeking information that's why we saw a lot of email attacks that were themed uh using the centers for disease control they were themed from the national institutes of health they were themed from your local uh health department and they were telling getting individuals to click on links because individuals were desperately seeking out uh how to access personal protective equipment they were trying to find out how to uh reduce their chances of becoming infected right they were trying to figure out how to protect their families and their incomes they were trying to access the various um funding mechanisms to support businesses and individuals from the federal government and state governments so of course criminals are going to take advantage of all of this this curiosity um of trying to access more information and of course there was this mass transition to telework which caused a tremendous amount of confusion again criminals are going to take advantage of this confusion and greater than 90 percent of cyber incidents begin with an email cyber criminals know it's an effective tool so they don't change their tactics so much as they just change their themes um with with their email attacks they adapt to the changing times they read the news and so here's an example of and i'm going to provide a few examples of how they are specifically targeting individuals and businesses so here's an example that co-fence phishing labs found this email is praying look at the look at the subject line this email is preying upon human emotion trying to elicit a response to get an individual to click who would not click on that email right staff member confirmed coven 19 positive so once you open the email of course they're going to say one of our team members have been infected by the grotovirus view the secured document to get more details and also guidelines on how to keep safe preying upon our curiosity uh regards management i love that conclusion regards management one i mean yes there's some uh red flags in this email some of the the grammatical errors uh maybe your management wouldn't sign an email as regards management you would look at the reply to email address maybe that isn't a legitimate reply to email address for your organization or trusted partner and of course they're wanting you to click on this malicious file to download onto your computer so we saw a ton of emails that are again themed with covid19 there were some emails that were even too low for criminals that were saying um they were preying upon people's fear of maybe being furloughed or laid off and the emails were saying uh from criminals click on this click on this file because employees are being laid off so learn to see if you're on this list so that's just dirty but criminals are going to use any way possible to elicit emotion uh to get people to click on links and download files and so i'll talk about some ways that we can stop and think before we uh click uh later on but i want to go through a few examples again of how cyber criminals are taking advantage of various crises uh to theme some of their messaging so among the more persistent social engineering schemes has been uh deployed by malicious actors through uh some of the financial programs offered by um the u.s federal government uh so you saw a lot of emails going out to individuals and businesses with the us small business administration logo or some of our trusted banking partners logos encouraging people to click on a link or click on a button uh to download a specific file or to go to a specific file and submit your information uh in order to qualify for or to access your funds uh for the relief and anytime there is a federal stimulus or relief package criminals are always going to be taking advantage of that moment to steal that money from businesses or individuals who need it to survive and so these are some examples that were captured that recently came through that are not legitimate emails from sba and bank of america i mean look at these the link paths themselves you can tell that that's not a legitimate email and of course in any in any instance if you are curious about an email or you're suspicious of an email definitely do not click uh call your trusted partners within those organizations to ask them and verify the legitimacy of those requests and of course always remember that you should you will never have to pay to get a loan or to get a stimulus package from the federal government [Music] so here's another way uh criminals are taking advantage of crisis and this is not through email this is through phone calls so an alert came out through fbi and cisa uh within the last few months and they were saying that criminals are taking advantage of the mass transition to telework um through this what's they call it wishing but it's just it's a malicious phone call right we don't need a fancy name for it it's just a malicious phone call and what cyber criminals are doing is they're calling new employees who are teleworking and how do they know they're new well again that's social engineering they're going out to social media they're seeing that an employee is new because what do we do on linkedin or on facebook or every other social media account we say hey i got a new job this is my title this is what i do this is where i work so what they're doing is they're capturing that information and they're calling the individuals the new employees saying hey i'm the it support staff and i'm going to help you set up your virtual private network and so what does the employee do they submit their credentials to the it staff so that they can help them set up their content or set up their virtual private network it's much easier for a criminal to convince an employee to hand over their credentials than it is to brute force their way in or to guess a password um but it was happening on such a scale that um the fbi and cisa had to issue a warning to businesses in particular letting them know about this scam and so so that businesses can issue guidance to their employees saying rit support staff will never call you and ask you for your virtual private network credentials or this is how to verify the legitimacy of our i.t support staff and you know this is a common support scams are a very common old trick of criminals but this is just a specific way that they're taking advantage of the current crisis to steal from businesses in particular and this one in particular gives them access to your network so this one is uh another way that criminals are taking advantage of crisis and this one here isn't necessarily targeted at businesses but targeted to those individuals who have lost jobs or who are seeking employment um unemployment rose higher in three months of the coven 19 pandemic in the beginning of it than in two years of the great recession it grew from 6.2 million in february to 20.5 million in may of 2020. so to a cyber criminal what that says is oh people are desperately seeking employment they're confused they're they're sad they're confused they're scared perfect opportunity to fraud them so mass unemployment combined with hiring freezes and the fact that majority of people are spending all their time online these days created a perfect opportunity for cyber criminals to take advantage of these individuals and fbi actually found a reported victim losses from employment scams between january and may to exceed 25 million dollars that's a lot of money that individuals who needed that money to survive because they're unemployed lost to cyber criminals 25 million dollars and so um you know again it's that mental that psychological attack they're preying on the on that fear and uncertainty um and you know a lot of these come into form a lot of these attacks these employment scams come in the form of fake job postings on job boards where they come in the form of a fake website um or they come through through phishing emails targeting individuals with enticing offers and a lot of times those offers again are paid to play if you pay x amount of money you'll get this job or get an interview you should never have to pay to get a job that's a good red flag that is not legitimate that it's actually a fraudulent uh posting here's another way they're taking advantage of the pandemic in particular so we're ordering we're shopping a lot more online aren't we i know we're all to blame we're we're bored uh we're looking around and we're saying you know what i need x y z uh or we just feel uncomfortable going into physical storefronts um and in some communities we might not even be allowed to and so what's what cyber criminals are doing is they're um taking advantage of this opportunity by sending in text messages in particular and emails that are impersonating fedex and ups and they're saying hey you've missed a package or you need to fill out this form to get information to get your package or to reschedule a delivery and so we're seeing a lot of this fraud and actually so much of it that fedex had to issue a warning um about letting people know that they don't send unsolicited text messages or emails requesting money packages or personal information and so um just being aware that um criminals are taking advantage of us being at home a lot more shopping online a lot more and so look at these this link you know that's not a legitimate link same with this netflix text message that i received a few months ago i don't even have a netflix account but they're banking on uh they're sending out you know mass emails and text messages uh with the assumption that people have netflix accounts right um and so they want you to click on that link and they're preying upon your emotion right we encountered an error on your subscription oh my i need to click on that and fix it and so um they're not only doing this with our streaming services and with our packages but they're also doing it with many other things like our online gaming services because they know people are spending their time uh playing games on live more and so again it's criminals are watching the news they're watching the environment and they're trying to take advantage of the every opportunity they can during this moment of uncertainty um to defraud you and i have just a few more examples of the methods that cyber criminals use and then we'll get into what can you do now what can you do about it uh with charity fraud uh with moments of crisis um criminals are going to take advantage of generosity in any way they can and so every time there's a type of crisis whether it's a hurricane a flood um fires the um the federal government and ncsa always have to issue warnings to those who want to donate their hard earned money to help people in communities in need criminals are always going to take advantage of crisis to put up fake charity websites or to send fake charity emails to individuals asking them to donate and so i have to say you know if there's a moment that you feel um if you're in a position to donate and you feel inclined to donate to any charity please go to the better business bureau which has um a charity their charity uh vetting process or go out to uh charity guide star charity navigator to evaluate uh the legitimacy of a charity before donating your hard-earned money because cyber criminals are always going to put up convincing uh websites uh to try to steal that now we also saw cyber criminals taking advantage of the social unrest that occurred so it's not just the pandemic it's not just fires that are occurring it's also in these social movements that occur across the country right and across the globe um in both malicious tactics right so uh with this they were taking advantage of the black lives matter movement as a theme to trick people into downloading a malicious file but it's also you know using uh digital tactics to sell confusion so minneapolis was hit with a distributed denial of service attack during the uh george floyd uh protests again it's to sow confusion and fear in individuals and help disrupt services of federal and state governments and so those are just a few a very specific tactics that cyber criminals are using um to theme their attacks with whatever crisis is going on and no we have not seen a zombie apocalypse in 2020 yet but i'm not counting it out and neither should you um but i'm sharing this example because it's a real website it's a real campaign from the centers for disease control uh and you know they launched this campaign in i think 2011 because shockingly enough people were not paying attention to disaster preparedness and they thought this would get people's attention and it did uh it got a lot of attention and it was it was a highly effective campaign because their main message was that there are disaster preparedness steps that you can take regardless of the type of disaster that we can all take to be more resilient as businesses and as individuals and so um so now i'm going to provide what i think some of those uh steps might be but you know i used to say uh when addressing small business communities that i understand that business resiliency topics are not a sexy topic to discuss right access to leads that's a sexy topic for businesses right uh getting getting uh talking about marketing and social media marketing in particular or talking about how to get access capital now those are sexy topics for businesses and really gets their attention but when we talk about disaster preparedness it's hard to get people to pay attention as the cdc found and so what we have to do is really build disaster preparedness and resilience into the way we structure our businesses and operate but it's not just us as the business community it's all of us as governments as individuals because cyber criminals are not picky any criminals not picky they're gonna steal from anyone they can and so knowing that we're all targets we need to take steps to make ourselves and our businesses more resilient and because greater than 90 of cyber incidents begin with email we have to address the problem of email itself now this is a dangerous tool for businesses because it once an email gets through all of your sophisticated email filters and lands in that employee's inbox it is up to that employee to click on that link or not are your employees equipped with the knowledge uh and the understanding of how to vet an email whether to click on a link or not or a malicious file i always encourage the business community uh because cyber criminals use email so often um as their primary vehicle for distributing malicious software why are we not training employees on email security before giving them access to email we give them access to email on day one and then maybe we train them on email security six months later or a year later to meet compliance but they've had that whole year those six months to mess things up so if one click of an email can disrupt a business or put them completely out of business why are we not taking email security more seriously why are we not training people on email before giving them access and this is also for ou personal lives if you sign your child up or a family member out for email why are we not teaching them about email security before giving them access or helping them access those new accounts now in addition to training about email security some of the tips that you might want to share with them one of course is pause if an email requests action right consider the nature the timing the purpose of those emails we want to hover over these links uh to verify the path of that link or to check the reply to to make sure it's a legitimate email address and of course if you're suspicious about an email just delete it don't take action particularly if it inspires if it elicits emotion uh or tries to uh incite fear in someone in particular now for consumers a few additional tips for consumers be aware right understand that during moments of crisis cyber criminals are going to be right there uh to take advantage of the situation and we should always you should be empowered in these moments to be cautious uh when people request sensitive information you can always say no um or you can always pick up the phone and verify the legitimacy of a such a request with lock down your login you know this is so important we are still we as a as citizens global citizens we are still awful at passwords my gosh the most common passwords are still password or admin admin one two three password one two three four five six i could go on but if you have long passwords right length trump's complexity the longer the password the better coupled with two-factor authentication then you will secure your accounts um from criminals you'll go leaps and bounds uh in your security journey uh by locking down with two-factor authentication and long passwords your banking accounts should have two-factor authentication enabled yes it adds a second layer of access to your account but if criminals gain access to that password chances are they won't have that secondary verification that second factor of authentication and so you'll be protected is it a silver bullet no because nothing is a silver bullet in protecting yourself or your organization but it is a great step in protecting yourself i already talked about when in doubt throw it out toss out those suspicious emails and make sure with keeping a clean machine that you're updating the software on devices if you're accessing your banking accounts you're accessing your uh your federal stimulus funding or your online shopping that you're doing so with updated software and your devices and accounts with owning your online presence what i'd like to talk about here is just making sure that uh you're you're immediately configuring all of your conf your privacy and security settings um with your online accounts and it's time to share with care right once you configure your privacy and security settings for all of your online accounts think about what you're sharing on those accounts right we willingly give out a ton of content to cyber criminals that they then use through social engineering mechanisms or tactics to use against us and so being sure that we um are being mindful of the types of information we're sharing and that also goes for i want to empower you if you will to also encourage or to teach your those you love those in your community to help them understand that they should be mindful of what they're sharing online particularly now we have students who are learning online more right uh due to the pandemic what are they sharing in these online uh chat features and online platforms we just want to be mindful of sharing with care and not sharing too much don't give criminal don't make it easier for criminals to do their job and with get savvy about wi-fi hotspots this will this is going to tie to both business and um to consumers and this is being sure that you are connecting to a secure network um there was an alert that came out a few weeks ago that were saying uh individuals are leaving their homes now and the alert was from fbi they're leaving their homes to access wi-fi at hotels and motels maybe they have stronger wi-fi connections they're faster or maybe they just are tired of being around a family and so they're leaving the home and teleworking from hotels and motels and the alert from fbi was really focused on helping individuals understand that they should not be connecting to publicly available wi-fi to transact sensitive information and so accessing your corporate networks or to access your banking account you should be using virtual private networks or vpns or your phone's um your phone as a hotspot through its data plan but not using public wi-fi that creates vulnerabilities for you as an individual and as a business and so helping employees understand that as well and so use trusted networks and so with businesses because i know not everyone is um i i broke it up in this way because i know that everyone is a business owner or leader but also everyone's a consumer right but for the business community have a crisis plan in place you know um when hurricane sandy swept through you know uh the the amazing team at the delaware small business development center ramped up their activity and their action and the u.s small business administration in delaware responded to the crisis by supporting the delaware small business community that were community that was impacted and so a lot of what we saw was that many businesses didn't have a plan in place uh to respond to such a an impact on their business so it's not just cyber incidents right it's how do you have a crisis plan in place for natural disasters for moments of uncertainty or disruption in your business how do we carry on think of this what if we didn't have access to our network or businesses data what would we do do we have a manual process that we can turn to do we have backups somewhere else what is our plan for responding to moments of uncertainty what if we don't have access to our physical office anymore or for a specific period of time how can we ramp up operations digitally and so thinking about moments of crisis and how do we have a plan in place who are those trusted partners we can turn to and with creating a technology toolkit for our employee we saw with the pandemic and the massive transition to telework that we um that employees were getting very creative in how they were um getting their work done because they wanted to do their job right and so businesses uh businesses were scrambling employees were scrambling they were getting creative and using solutions that might not be necessarily secure or trusted and so for businesses it's always good to have a technology toolkit that you can suggest employees use or mandate employees use when they're teleworking not on your network maybe it's a specific password manager and i saw a question come through and i do encourage organizations and individuals to use password managers uh it's a very it's a great way to help organize um the complexity that comes with managing many different passwords maybe it's a specific vpn maybe it's a specific type of meeting platform and then how when you use those platforms and those technologies how do you use them securely maybe you have a session where you teach them how to use the virtual private network how does it benefit them maybe you teach the employees how to use and lock down online meeting accounts and so not only do you give them the technologies to use the vetted technologies to use but then you help them understand how to use them securely and that might mean you need to rely upon your internal i.t or information security team or your trusted vendor to help you and your business uh create some of these toolkits and guidance for your employees with plan for an increase in cyber threats again as i outlined earlier anytime there is a crisis of any scale of any type there's always going to be an increase in targeted cyber attacks particularly themed with that crisis and so how are we educating ourselves and our employees on how to remain vigilant and how to report these cyber threats again either to our vendor or to our security teams themselves i also want to encourage businesses to take a moment to evaluate your insurance coverage now particularly with cyber uh because that's what i'm talking about today you need to understand if you're covered in the instance of a cyber incident or breach or if you have cyber security incident cyber security insurance what is covered and what is not covered but you want to just check your insurance coverage and know what is and not what is and what is not covered and i'm not an insurance agent and maybe there are some insurance experts that will be joining you in this conference today and i uh encourage you to reach out to them and talk to them about insurance cybersecurity insurance and how you can get your business covered this is one of the major threats to organizations today and will continue to be a major threat to organizations and so that should be built into your business plan and your resiliency package now with adjusting your security priorities i i know that in moments of crisis you're focused on the crisis right you want to make sure your employees and your families are safe during a hurricane or doing a flood or during a pandemic whatever the crisis and so it's fair to readjust your the security priorities that you had planned out for the year just as you readjust all of your other priorities but what i don't uh encourage you to do is to eliminate your cyber security priorities during a moment of crisis because cyber criminals are going to be taking advantage of you mostly through digital means during that crisis you have to pivot how you secure your organization maybe it's using short modules to educate your employees on how criminals are taking advantage of the specific crisis maybe it's focusing your attention on helping employees connect your network securely um maybe it's helping them create a secure home work environment and so adjust your security priorities to the moment but do not eliminate them in a moment of crisis and that occurs through continuing to reinforce secure behaviors don't because employees are teleworking they might feel isolated or removed from the organization or from the information technology staff don't let them feel isolated continue to communicate with them and reinforce secure behaviors because if you don't continue to communicate with your employees cyber criminals will take advantage of that lack of communication and communicate with your employees and also you know i always like to you know turn your employees into censors right help teach them how to identify potentially malicious emails and then create a mechanism for reporting incidents or malicious emails help them help you by giving them an opportunity and a mechanism for reporting when something is suspicious and i know when at my time at the university of delaware they had a great program for reporting incidents and so and reward that behavior any way that you can through positive reinforcement and have empathy right during moments of crisis not only are your staff overwhelmed but particularly right now during the mass transition to telework our information security teams are overwhelmed our i.t teams are overwhelmed um whether they're internal or external have empathy with them know they're overwhelmed with help test tickets and requests as people try to figure out how to work remotely have empathy for your employees knowing that their families are you know they're they're scared for their families and their loved ones and so know that they're not cyber security experts and that they're dealing with an emotional time with any type of prices and so just approach any of your communications and your interventions particularly as you with your cyber security with empathy in mind and of course as you get through any type of crisis be sure that you are documenting your lessons learned so that you can come out of this a stronger business and learn from any mistakes that you may have made and implement improvements to um your processes and procedures or enhancements to your technologies whatever they are um and to always come out of any type of crisis with documenting your lessons learned to build up the resilience of your organization now if i put on my miss cleo hat and i look to the future what do i see well one i'm going to see that um you know this telework scenario or situation probably isn't going away right organizations many organizations are saying you know what we're going to make this permanent this is a pretty good thing we don't have to pay for office space or as much of it or employees are more productive teleworking so then how do we as organizations continue to refine and adapt our tele-working processes and procedures um to adapt to this new paradigm looking forward of course we're now upon the holiday season and so people are going to ramp up we're already shopping online more but it's going to be um multiplied in the hundreds multi-hundred percent at this point probably um during the next few months as people shop for presents for their loved ones for all the various holidays so with that is going to come an increased targeting of cyber criminals not just on consumers but also on small medium and large merchants and so how are we as consumers being sure that we're shopping online securely and one quick tip is of course make sure that you're not using your debit card to make purchases online you're using your credit card because they come with more consumer protections and for businesses making sure that you are locking down your ecommerce infrastructure so that you reduce the chances you reduce your vulnerability and the chances of cyber criminals taking advantage of your e-commerce in mobile payment platforms one of the biggest steps you can take of course with that is two-factor authentication on your e-commerce platforms and making sure that your software is updated so many businesses are running outdated versions of their e-commerce platforms and so um or their e-commerce software and so two quick tips for you there but as we move into the holiday season cyber criminals are gonna be taking advantage of this opportunity um and targeting merchants and consumers they're also as we're seeing now um taking advantage of the confusion uh with the election and targeting individuals saying click this link to access your ballot or xyz and so making sure um that we're remaining hyper vigilant um during all of these moments of crisis um and i and i'm classifying all of uh shopping and the election as a moment of crisis as well so you know i come back to this you know the ability to recover from and adjust easily to misfortune or change and again it comes down to you know how have we prepared for and responded to these moments of uncertainty both as individuals and as businesses do we have trusted people in our corner we can turn to do we have a plan backup plan if we lose access to our networks are we educating ourselves and our employees on how to work remotely securely or giving them the tools they need to do their jobs and so this ability to recover from it adjust easily to misfortune or change this resiliency should be baked in to your business planning and your business strategy year after year it should be revised because it changes now i do want to highlight a few resources because i mentioned a lot about you should do this you should do this you should do this but there are some resources to help you to do all of that so cyber security awareness month of course that monthly awareness campaign uh we have a lot of resources that we're issuing throughout the month and all of our business partners toolkits and guidance and best practices we've also put together a coven 19 security resource library uh in february and early march we noticed that um a lot of great resources were being created on how to telework securely uh from our federal partners and uh board member companies from ncsa how to avoid uh and identify scams related to kofi 19 and so we have this resource library that's broken up into identifying scams and teleworking best practices um to give you kind of a one-stop shop for resources that are all free and available to t e public we also have a really great security awareness series with in collaboration with adobe and speechless and these these videos are about less than two minutes long and they're a great resource for again that uh security reinforcement education that you might do with your employees to educate them and if they're entertaining and light-hearted and quickly get to the point with some tips that educate your employees and you can take these resources and use a lunch and learn or you can build it into a um an online training for your employees or put it on your online internet whatever you want to do with them they're yours to use the federal government also has some really great resources that i just wanted to highlight the federal trade commission has issued a lot of resources on coronavirus scams and how to avoid them and so this is the link and you'll have access to all of these slides as well cisa and homeland security have issued their coronavirus guidance as well and a lot of attention that they're placing of course is on critical infrastructure for those who are in uh health care and banking but it's guidance for everyone uh or it's guidance that everyone can use i also you know we think a lot about nist as far as the nist cyber security framework but we forget about all the amazing work that they do outside of that framework and recently they've put together some guidance on telework security basics they have some videos and they have some best practices that they've put together and this is the national institute of standards and technology and they're really they're part of the department of commerce and they are they are a group of subject matter experts senior researchers who are focused on coming up with standards and best practices for cyber security professionals and business leaders to improve not only the the manufacturing of technologies um but also how we use them and deploy them across our enterprises and so i encourage you to check all of these out and they're not jargon laden they're uh they are written so that non-technical audiences can understand them and use them um and so you know i'm coming to the end of my time and so we're never going to eliminate risks to our organizations or our personal lives we're always going to face risk and we but we as individuals individual contributors within an organization individuals within a connected always connected global society we all have a role to play in minimizing our risks and i'm hoping that what i covered today and what you'll learn throughout the day that you will be empowered to take this information and not only apply it to your business um if you are a business owner operator but you apply it to your personal life and you share this information with others sharing is caring if i end on no other note i want to end on sharing is caring become a cyber security evangelist to help others you care about within your community within your sphere of influence help them lock down their accounts secure their privacy and their information and it all it could be is turning to the person next to you and saying and helping them add a password to their mobile device or helping them enable two-factor authentication on their banking account and so with that you know this is my contact information i've come to the end of my time we have a little time for q a but i encourage you to reach out it has been an honor getting the opportunity to share this information with you over the last hour and yeah i hope you all enjoy the rest of the conference sessions there are a lot of great talks and a lot of great uh people who are sharing information in this conference and um it's been an honor thank you so much thank you so much daniel uh this was such a treat uh to get to hear from you and to get this amazing topic you know uh it's so important to think of business continuity and sustainability in this climate you know when you think of the state of delaware we probably had maybe 10 percent or at most 20 of our positions designed for remote work and uh we have to evolve very quickly to be able to support 15 000 people working remotely and what's key to us enabling that to be successful is our business continuity program the fact that our employees and our agencies create these packages of where do i go what do i need and how do i continue to provide key services to the constituents of delaware and recently we started to integrate remote access into that into that module because we felt that it might not always be possible to go to the remote location it might not always possible to get there and have the equipment you need so it was important for us to be able to work remotely and from from anywhere in the world and that was our our opportunity so i strongly encourage everybody that whether it's a zombie a zombie apocalypse or what it is be ready for your business to be able to sustain from anywhere at any time and provide your um your customers the critical services that i know you offer now i want you guys to look to your chat very quickly i just posted the link there this is our vendor booth and i and i know it takes you away from the program a little bit but it's very important that you take the chance to check out our vendors one of the vendors uh we have vendors from cisco as you know cisco runs the world most of the core internet connectivities around the world are are are leveraging uh significant cisco equipment cnt infotech critical professional services across the state and really across the east coast so if you need it services you know you can go to these organizations this organization and they will provide you those critical services crowdstrike if you haven't heard when uh the leading political parties were impacted by cybercrime they turned to crowdstrike a critical solution in the state's portfolio and one that you should know because they look at breach prevention as a critical component we have a cyber security initiative with the university of delaware a strong partnership not only from a training perspective but for knowledge acquisition perspective our small business development center critical capabilities there you definitely want to take a look at that info solutions rit services companies uh that even the state considers as a critical asset my sherpa business technology guides that provide extensive amounts of information for you mtm technologies uh both state and our partner organizations rely on them uh potter anderson if you need legal help if you need legal help that even have a cyber security component don't hesitate to check out that booth tsci staff and services keep the state running one identity is your core uh capability to protect your environment if you haven't heard identity is the new perimeter service now our service generation service that provides the ability for you to support your internal customers now it has built-in things like chat boxes and and chats and you should definitely get to know them securednetmd your healthcare services are covered versaline a strobe partner for the state for years uh now and wilmington university one of the few universities that reach out to you bring the education to you you don't have to come to them and they've been doing this for years even before the pandemic so i want you to take the chance go to the vendor booths check out each one of our vendors and there are incredible prices everything from a hundred dollar visa card to to airbus uh airport i think i'm gonna go for the airpods uh i want one of them um so please check out our booths at 10 10 10 10 please check your your your timer you can go to our breakout rooms and i will also attach the link to our breakout rooms for you so you can definitely get to check out our first sessions so to break our rules will cover future proofing cloud security don't get caught in the fishnet uh scammers love covet 19 yes we know we see them every day and securing very small businesses so that's the breakout session one and that is our 10 10 and if you go back to the delaware cyber uh workshop the links are right there so i hope to see all these health sessions yes we have a just a couple questions that we need to cover before we adjourn yes so um and i guess this one is for dan i don't know that you covered it completely you talked about it a little bit for password managers how do you recommend implementation like are you thinking an institutional platform that you have access to while you're at work or guidance toward a personal solution yeah well i mean that depends on the business and the site you know the size of the business and your infrastructure i think um you know you can take many different approaches but you know for organizations it's always best as i had talked about with that toolkit right to have a vetted service that you want all employees to use what you don't want to do is put the responsibility on the employees to go out and choose particularly if they're not cyber security experts or technology experts um you want to or with your uh trusted it or information security vendor to vet a particular service and implement that service and encourage that service um for employees to use so again it's you don't want to have employees going out and being creative because many times they'll you know purchase the cheapest solution or they'll find a free solution at that and so making sure that um you have a recommendation um for what service they use what if they're paying for it themselves or if the organization's paying for it that you're deploying one vetted solution thank you and solomon this one one might be for you and i think it probably depends um where can someone report a cyber attack fishing etc in delaware ah that is a very very uh good question uh what we'll do is let me find the exact um statewide address and we will post it to the chat in the conference so please join us back and we'll get you the exact link we recommend did you know as a means of getting the information to state government cyber security core team if you go to did you know we have a contact center you can send us a message we respond very quickly and we provide some guidance to you but overall i'll get the perspective from our diet and our state police type of crime on how they would want it to to consume this data so look forward to more information very soon and i'll add to that and it's not delaware specific if you experience a scam you can report a scam to the federal trade commission if you rep if you are victim of cyber crime you can report cyber crimes to the fbi's internet crimes complaint center and what those are just repositories of information that as more more people submit some of these attacks and these scams than the federal government's able to collect this data and then respond and issue guidance and so it helps them in helping others remain vigilant and protected and so that's that's on the federal side but i'll yeah i'll let solomon and your team speak to the delaware side yes uh so definitely a did you know website uh we have a way for you to contact us right on the website and we will provide something that would cover more of the cybercrime uh when we come back um so uh take the time to check out a vendor booth get some of those amazing prices and then come back to the main page for a breakout session at 10 10. we hope to see you there