[intro]
Wendy Battles: Welcome to the Bee Cyber Fit Podcast, where we're simplifying cybersecurity for everyone, where we cut through confusing cyber speak and make cybersecurity simple and easy to digest. I'm one of your hosts, Wendy Battles.
James Tucciarone: I'm James Tucciarone. Together, we're part of Yale University's information security, policy, and awareness team. Our department works behind the scenes to support Yale's mission of teaching, learning, and scholarly research.
Wendy Battles: Ready to get cyber fit with us?
Hey, everyone. Welcome to another episode of the Bee Cyber Fit podcast. We're excited you're here and hope you are ready to get Cyber Fit with us. If you're a new listener, welcome aboard. This is the place to come for information and inspiration to stay safe online and outsmart cybercriminals. This podcast is one of the many tools in our toolkit that we use at Yale University to help our faculty staff and students build their cyber muscles. Whether you're a part of our Yale community or our global community, we love that you're listening. In fact, we are happy to welcome listeners from almost 40 different countries.
James Tucciarone: Thank you all so much for listening and for joining us on the journey to Bee Cyber Fit. Today, we're continuing our discussion about reporting incidents. We're currently in the midst of our Bee SAFE, not sorry campaign, hoping to increase understanding about why and how to report suspicious activity. One of the themes we've been talking about over the last few episodes is the idea that it's everyone's responsibility at Yale to report something suspicious. And the sooner that we report it, the sooner the Information Security Office can tell if the issue needs further investigation.
Wendy, I don't know about you, but I loved having Jeremy Rosenberg, our Chief Information Security Officer on our last episode. He did a great job of articulating the why when it comes to reporting and talking about our shared responsibility in being good stewards of Yale's data and systems. I really appreciated how he talked about how an infected computer can spread that infection to other computers within an organization. I don't know about you, but it's not something that I would necessarily think about on a regular basis.
Wendy Battles: Nor I, James. It is not something I think about at all. Although, I will say, our colleagues in the Information Security Office do a fantastic job thinking about those things. For me, as that average person who's trying to do my work and keep things safe, I found it really eye-opening to understand, both the impact when something like that happens and how it can spread from one computer to another. It could infect a whole department. That was really a compelling story, but also just reinforcing this idea of, "If you see something, say something," that if there's something suspicious or we're not sure, not to be embarrassed, but to really act on that hunch and report it, because it is the work of our team to do the investigation. Not our Yale community, but the information security team. That's their job. That's what they do. They investigate those incidents. So, I thought it was a really important window into what happens behind the scenes and why our actions are so important.
James Tucciarone: Well, for our listeners, hopefully, they'll have the chance to listen to this episode with Jeremy and maybe even get some of the same takeaways that we did.
Wendy Battles: I forgot to mention too, James, that we have linked to it in the show notes. So, if you didn't have a chance to listen yet to that really engaging episode, you'll find it there, as well as a link to our report and incident page.
James Tucciarone: I'm so glad you mentioned the link in the show notes, and hopefully, everyone will have a chance to listen. Wendy, today, we're talking about lost and stolen devices and why it's so important that we report them right away.
Wendy Battles: Ooh, yes. I'm excited about this topic today, James. I know most of us can barely bear to have our phones out of sight. So, losing it is a whole other dimension that can create a lot of angst. I have to tell you that the other day, I was rushing to get somewhere. I was en route to a meeting. I realized when I got there that I needed to show a digital ID that I had left my phone at home, and you would have thought the world was about the end. Nah, I'm kidding. It wasn't that bad, because I knew where it was. But they're attached to us. We depend on our phones so much, so it feels like a big deal when we don't have them.
We're also going to be talking about some things that you can do to be proactive, so that in the event that does happen, you lose it or it's stolen, there are some easy ways to make sure you can recover your information and keep that device safe. And of course, we will have our buzzword of the day. So, speaking of that buzzword, let's get a preview of it right now.
James Tucciarone: Have you ever decoded a secret message? Maybe you used a secret code or language as a child. Maybe you've tested your skill with a cryptogram puzzle or maybe you're an amateur archaeologist. Stay tuned to find out what secret encoded messages have in common with encryption.
Wendy Battles: James, I'm going to ask you this. If you lost your phone or someone stole your phone, would you be freaked out about that?
James Tucciarone: Yeah, I probably would be a little bit freaked out Wendy, not only because all of my personal information is on there, my financial information, but I also physically have my credit cards, my debit cards, my IDs, all in my phone. So, I would definitely be lost if I lost my phone or had it stolen. But taking that a step further, I also tend to do work for my phone as well. So, while none of it is confidential or sensitive, I do have some Yale data on my phone as well.
Wendy Battles: So, this would be a big deal if you lost it for multiple reasons, and especially, the fact that your whole life is basically in your phone. When you said, it's your wallet, it's your credit cards, I'm like, "What?" Okay. So, that clearly is what we want to avoid. And I feel the same way. So much information is in there for me. A lot of it is photos. The really sad thing, James, I'm going to tell you, I'll be the first to admit this is that I've not done a good job of backing up. And I'll say this. I did it first, but then the storage was full. It keeps reminding me, "It's been X number of days," which is over several hundred now, "since you've backed up your phone. Hello?" Like, "Wendy, what is wrong with you? What are you waiting for?" which means I need to buy more storage. But it would be worth it, because should that happen. I'll just tell you, I would be incredibly upset with myself. Then I'll go through this whole period of beating myself up like, "Wendy, what were you thinking?" which could easily be avoided. So, today, we're going to talk more about some of those things and hopefully, help keep all of you safe.
James Tucciarone: Wendy, I think as well, there's more than just an emotional cost when it comes to losing our devices or having them stolen. Of course, the loss of our photos, maybe our IDs, our credit cards, and things like that, but there's also a legitimate financial loss when it comes to losing our devices. That's not just the cost of the device. We recently saw a study that talked about the costs that are associated with the loss of a device, including laptops. What the data showed was that the cost of the loss is actually far greater than the cost of the device itself. And that's because we're losing productivity, we're losing potentially our intellectual property, we may be exposing our data to some sort of a breach, and ultimately, we may also have some legal fees that are associated with the loss as well. What they found was that, with the loss of a single laptop, including the downtime, the support, and the management time, the average loss exceeded almost $50,000 for one device.
Wendy Battles: I'm sorry, but that's insane. $50,000? When you think about a laptop, that's maybe $1,500 or even $2,000, and then you tell me, $50,000. That is really hard to comprehend.
James Tucciarone: What's even scarier is that a laptop is stolen every 53 seconds. When it comes to our smartphones, almost 70 million of them are lost or stolen every year.
Wendy Battles: That's insane. That is shocking, and it's insane, and it's hard to believe, especially when you're telling me that a really tiny percentage of smartphones are even recovered. So, yeah, that's pretty shocking, James. That reminds me that we have to be, especially conscious of our surroundings because I know that sometimes I am a multitasker. I know many of us feel like we can get more done if we do things at the same time, which is not true at all. But I think it's those distractions that may lead to us leaving our phone behind at home, rushing somewhere, or leaving it in an Uber, or something else that might happen. So, we have to be especially conscious of our devices and what's around us.
James Tucciarone: Wendy, I think you actually have another personal story about a lost device.
Wendy Battles: Well, I do. [laughs] I hate to be the one that's sharing all these stories, James, but this is definitely a lesson in what not to do. Don't do what Wendy did. Several years ago, it was in the winter. I had gone to look for some new snow boots to wear in bad weather. I went to this shoe store. I tried on all these different pairs of boots, and it ends up I couldn't decide, so I was going to think about it. So, I was there for a while. I left the store. Hours later, I was like, "Where's my phone?" Hmm. I can't find it anywhere.
So, I use the function where you can find your device. Interestingly, it said it was at the shoe store. I was thinking, "Well, that's weird." But anyway, I called up the shoe store, I explained what happened, and they looked all around. I explained where I'd been sitting. They looked all around, they're like, "I'm so sorry, but we don't see it anywhere." And I thought "Oh, shoot." It's weird that it'd been stolen, because it's at the shoe store, but yet, they couldn't find it. So, I was like, "Okay, thank you."
The next day, I thought, I still know where my phone is and something told me, "Go to the store and just check myself." So, I go to the store. I explain everything. They're like, "Oh, we remember talking to you yesterday, and you're welcome to look around." So, I looked all around. Of course, the phone's not there. And then they said, "Well, what did you try on yesterday? Did you try something specific on?" I explained that I tried on boots in a size eight and a half. I explained the styles. So, they go into the back room, they bring out several different boxes. I'm thinking, I'm sure they're not there. But I ended up going and opening up these boxes of these things I tried on, no phone.
Then something told me, "Just, check inside the boots." James, would you believe that my phone, which was now dead was inside the boot, inside the box, inside the storeroom? [laughs] It was crazy, but I got my phone back. That is an example of how using that function to find your device can be helpful. Again, by the next day, the phone was dead. It's a good thing I did it when I did. So, case in point, please be careful. Be aware of your surroundings to hopefully avoid this situation.
James Tucciarone: But you're definitely not alone, Wendy. I'm sure lots of us have hopefully only lost our devices and not had them stolen, but it definitely happens.
Wendy Battles: It definitely happens. I'm going to give you just a few examples of stories where people have either lost or have had their laptops or phones stolen. One example, someone was in a gas station. They're pumping gas. Someone, unbeknownst to them, went inside their car and stole their whole bag. And you know, it is like our life is in that bag with our phone and all those other things. So, we don't want that. So, again, being aware of your surroundings, someone dropped their whole laptop into the ocean. They were using it on a boat. Okay, that's never going to be recovered again. Terrible situation. We don't want that. Someone threw their phone away inadvertently in the trash in an airport, because they put it on their tray at the food court, threw the whole thing away, and were on their flight when they realized, "My phone?" Goodbye to that phone.
Then, James, you might remember this from the first time we interviewed Jeremy back in Season 1 of the podcast. He told this crazy story about how he was in a mall and someone ran past him, grabbed the phone out of his hand, and kept running his brand new phone he had just gotten and stole the phone. It happens in many different circumstances in many different ways. Increased vigilance can help us avoid doing things like you're rushing to get somewhere to make the train, you're in your Uber, you don't really double-check your surroundings and you realize, afterward you left your laptop bag in that Uber. Maybe you get it back, but chances are you may not.
So, with that being the case, let's talk about some proactive, pretty simple steps that we can take to protect our devices, should these circumstances occur in whatever way they may manifest. So, number 1, as I mentioned, utilizing the location services on your phone, whether it's an Android or an iPhone, doesn't matter. You can utilize those services, and that makes a big difference in being able to locate your phone. Number two, password-protecting your phone. I don't remember if I even had password protection on my phone at that time when I lost my phone in the boot, but it's so key. And now, they make it so easy when you're setting up a new phone to set up your password right away. That makes all the difference because if someone does get a hold of it, it's going to be really difficult for them to be able to access the information if it's password protected.
Backing up the data. I mentioned already, James, that I have not been doing a good job myself. So, I'm listening to what we're saying, and I want to encourage myself to go do this. But backing up the data on your phone, making sure that happens regularly, and again, that should also be true for your laptop. Whether it's your work laptop where we make it easy for people to back things up, or it's even your personal information. It's your personal laptop you use outside of work at home. Are you backing up that data? Have you done that recently? What will you do if something happens? So, those are three things to think about. What else have you got?
James Tucciarone: I would also add to that, Wendy, thinking about the data that we have on our devices. Once we no longer need the data that's on our devices, it's probably best to get rid of it. For most of us, I'm sure that we probably have a lot of things on there that we need on there that we don't want to take off of there, but it's always a good idea to consider it. Do we need to have this on our phones? Do we need to have this on our laptop? That includes our work information as well. Do we need to have this file stored on this laptop? Can it be stored on a secure server? Do we need to have this file on our smartphone or a laptop? If it's not there, it's one less chance for that data to be exposed.
Then the other thing I would talk about is the idea of encryption. That's because it really is our main defense against lost data. It is standard on Yale's managed workstations. So, we do have that protection right out of the box. But when we're using our personal devices, whether it be for work or for our personal lives, it can leave us vulnerable if those devices don't have encryption on them. For those of us who may have a few questions about what encryption is, let's go ahead and hear more about it in our Buzzword of the Day.
Here's the buzz on the process of encryption. Simply put, encryption takes unprotected information that can be read by anyone and transforms it into a form that hides the original meaning. Just like a secret code, encryption uses keys that can be used to conceal or restore the information, known respectively as encrypting and decrypting. If you use any number of modern and common devices like personal computers, smartphones, or even an ATM, you're already reaping the benefits of encryption, even if you didn't know it.
Our passwords and sensitive information are typically encrypted. Our digital wallets and online shopping are too. The data being transferred when using that ATM is almost certainly using encryption to protect your financial data. Many of these examples can describe encrypting, an exchange your transcription. An ATM transaction, using our password to log into a website. Another common example is encrypting an email containing confidential information. Even our routers and VPNs take advantage of encryption to protect our internet traffic. But encrypting stored data is really important too. Transforming it through some computational process for concealment and security. Think about if you were to lose your smartphone, and whether you'd want to have the protection of encryption for your personal information.
Now, even though encryption is critical for protecting sensitive data, like, most technical solutions to security, it isn't a silver bullet. That's why being aware and expanding our knowledge about cybersecurity is so important. Luckily, we can rely on some of our key cybersecurity behaviors. Click with caution. In this case, be sure you're only using secure and legitimate websites. Use secure passwords. Using unique passwords for each of our accounts protects us from an incident spreading and infecting our other accounts. And apply updates. Last week, we heard about updates sealing known security gaps and patches containing new or updated encryption algorithms could be an example of that. For my final tip, keep listening to the Bee Cyber Fit podcast, where we simplify cybersecurity and help you to be aware, be prepared, and be cyber fit.
Wendy Battles: So, based on what we've just talked about in today's episode, and now that more about encryption from our Buzzword of the Day, let's talk about three simple calls to action to help you prepare for a lost or stolen device should that happen. Number 1. We encourage you to be proactive and look at our report and incident page, so you know exactly what to do, should this circumstance happen to you and you lose your device or it is stolen.
Number 2. We mentioned password protection. If you do not already have a password enabled on your phone, we are encouraging you to do so. It is such a simple action you can take to boost protection. And number 3. For a little fun, to reinforce some of the things we're talking about regarding reporting an incident, we've got a puzzle that we are linking to in the show notes. And for all of our Yale community, if you complete that puzzle and you submit your entry, you'll be entered to win our very cool report and incident prize pack. We've got some really cool stuff in there that we are excited to give away. Three simple things that you can do to help avoid lost or stolen devices, and if that were to happen, be able to address it proactively.
[music]
James Tucciarone: Well, Wendy, that's all the time that we have for today. So, until next time, I'm here with Wendy Battles. And I'm James Tucciarone. We'd like to thank everyone who helps make this podcast possible. We'd like to thank Yale University, where this podcast is produced and recorded.
Wendy Battles: Thanks everyone for listening. We're so happy you were here. And remember, it only takes simple steps to Bee Cyber Fit.
[Transcript provided by SpeechDocs Podcast Transcription