Cybersecurity training for Property Operations

Key Takeaways

foreign [Music] best-selling author note speaker member of Forbes Technology Council architect of the cyber crime equation list is endless with more than 20 years of experience in the cyber security industry Danny pihar has become one of its foremost experts thank you for joining and how are you doing today yeah pleasure to be here Harsha thank you so much for having me and I'm a big fan of uh of these shows that you put together and I'm really happy to be here thank you so much Danny and great to have you one of the things I always like to stop it and like if we know each other for for so long but for our audience tell us about your career Journey so yeah great question so so I've been in cyber security um for over 20 years now as you had mentioned um but the funny thing was I got into it almost completely by accident right I was I was working at a restaurant uh you know at the time specifically actually the restaurant was Chuck E cheese and uh I I was actually the Chuck E cheese mascot that I don't know if you're familiar with that restaurant but there's a mouse that would walk around patting kids on the head that was me and uh and and I knew I I needed something a little bit more serious and I knew I needed a change and so so I got a job and I remember I was actually looking through a newspaper if you could remember the last time you might have touched an actual newspaper and I remember I saw an ad in the newspaper um and it was for a very entry-level role in the cyber security industry and uh and so I went and I applied and I didn't really even know what cyber security was but I thought hey it's entry level what does it matter right if I don't know what it is and so so they were telling me how you know this job is so entry level it was a new job that was even even more entry than the previous entry level job right right and they said um you know so they're they were kind of laughing and they're like you need to be promoted just to reach the bottom right and but I didn't care because it was in this really nice building and it had air conditioning I never worked in a place that had air conditioning before and I had chairs I was always standing whenever I worked and I'm like man this is the greatest job I ever had and and of course I didn't realize just how great it would end up becoming right uh you know the industry well it was filled with so many different um challenges and of course with challenges also become comes opportunities uh and just a wonderful place where I met a lot of people I really got to learn quite a bit as well and so it's been definitely a fascinating experience today's discussion is about cyber security training for property operations now when you hear this topic it's like why do we really need a cyber security training for property operations it makes sense to do uh building automation system training how to run these smooth operations vendor management maintenance tenant relationship budgeting but as we all know we are putting so much of technology in the building with devices and sensors Cloud platform getting connected with the traditional Building Systems so much of Technology coming in the building and the threat landscape is also changing hackers are moving into different domains like buildings making buildings the target for some of the obvious reasons like disrupt the operations try to look for a path in the I.T environment for data Financial uh implications like there are so many reasons so that's why we felt that there is a need for a specific training program designed for property management team and so we have Danny here who has so much of experience in the cyber security training but before we dive into specifics on this training I would like to hear from you the importance of training for rules that touch technology yeah absolutely excellent question Harsha so so I think the the best way for me to answer that question is let's take a step back away you know you talked a lot about building operations you talked a lot about property operators let's let's take a step away from that for just one second and what I want to talk about is is I want to talk about the first two laws of cyber security and so so to be clear when I say the first two laws I'm not talking about actual law but what I'm talking about is something more related to like a mission statement um you know things that are very important to understand so the first law of cyber security States that if it can be programmed it can be hacked and of course what this really speaks to is this really speaks to the vulnerability associated with technology and the second law of cyber security states that if it can be hacked it most certainly will be hacked okay and this of course what this really speaks to is the probability of the vulnerability associated with technology being impacted in some way and so when you think about the complicated buildings the modern buildings of today and you think about the people who are in charge of working with those buildings right then yes absolutely we really want to arm these people with something that can teach them about the threats and the vulnerabilities that are going against their very specific roles on their very important jobs of making sure that those buildings and that technology within those buildings are taken care of not to mention the tenants and the vendor management associated with this right so so absolutely specific cyber security training for this industry for this role is absolutely crucial and and I really think that the best way that speaks to that are those first two laws of cyber security that I talked about and then you make things so simple and easy to understand now going through your last second like if it can be had it will be had because many people they think that oh we have a building in suburb or our building does not have high technology we only have simple like traditional Building Systems but yes they are connected over internet you know what yeah absolutely story in a rat Harsha but it's such a good point I just wanted to say this before I forget I've been hearing that my whole career when somebody says oh well you know it's not going to happen to us because uh you know we don't have anything too important here or we don't have anything and I always bring them back to those first two two laws one being if it can be programmed it can be hacked and if it can be hacked it will be hacked and I'm going to take it a step further and I'm going to say a lot of times people think that it's the biggest target that the bad guys want right so hey it's not like I've got a vault in my building with with you know millions and millions of dollars of cash right why would somebody want to come here right it's not the biggest target that they're looking for it's the easiest Target that they're looking for so the very fact that you think no one's going to come here I don't need to worry about this that's the very fact that's making you a bigger Target right is because you are an easy target right yes yes and you're not putting enough um effort to secure the building so yes you are an easy docket yeah 100 percent yes because property management team has always been focused on overseeing the property operations like annual budgets operating budgets maintaining the tenant relationship tenant retentions and focusing on operational excellence now when we talk about the training specific for these type of roles we hear that we get training by Our IT department so yes it Department do provide these cyber security training and most in most of the cases these are online training sessions like pre-recorded sessions so um how this training is different than the training given by the IT department of any organization yeah a really really great question and I hear that so so often as well right so so let's talk about that as you said let's talk about traditional I.T training um a traditional I.T training when an organization says you know oh yes my employees have taken um you know cyber security training or it's done by the it group or traditional I.T cyber security awareness training what they're really talking about is they're really talking about training that's really been designed for the employees that work in an office and and very specific to in whether of course we're talking about a corporate office or whether we're even talking about working from home a home office right that's really what that training is designed for and then even that even though it's really specific to office life it really then is a glorified version of anti-fishing train that's really what most of this type of training is Right whereas I send out a bunch of phishing emails if I'm the one in charge if I'm the one running this campaign I send out a bunch of fishing emails I check to see who clicked on it and then I run training saying hey guys we sent you a phishing email this is how many of you you know did the wrong thing this is what we need to do next time right and that's really what it is it's a cyber security training for the most part today has become anti-fishing training um for the office and that's it and that is sure that's very important for those people who only work in offices but that does not translate very well for the people who have to deal with day-to-day building operations where you have access to critical systems like HVAC critical systems like elevators and also other factors as well like uh managing tenants as well as vendor management right and and these such critical systems like the HVAC like the elevators if compromise can absolutely disrupt operations they can compromise safety and even physical safety right and of course lead to Major Financial losses so really what you don't want to do is you don't want to lump all of the professionals that you're working with in in the same training instead what you want to do is you want to give these very critical roles something very specific that they can specifically be taught about the vulnerabilities specific to those buildings specific to their roles and of course the threats and then what to do about them so they could learn about how to protect themselves how to protect of course the building and everyone inside that building the organization and the associated Technologies right so so definitely excellent question Harsha uh and there is a huge huge difference and you don't want to be naive oh and the other thing that I want to add to that is because this is so critical and because what we're talking about is is so specific and attached to so many critical systems you don't want it to be a computer-based training program right I think what a lot of people will do is is if I'm in charge if I work for a big company I'm in charge of 5 000 employees I might just think okay yeah my boss told me I had to get these guys on training you know here's a computer program I'll get them the computer program I'll send them a couple of phishing emails and I could check that I did it right and so many of the employees all they do is they just click through it right I've seen Time and Time against stats about people just clicking through these things right instead what you really want to do because this is so critical is you want to have it be an instructor-led program you have you want it to be a human that's speaking to them in real time so they can ask questions as needed and really make sure that they understand because again this is I would say A Cut Above because they are in charge of so many critical things right so got a long answer to a short question Harsha but a very important question those are really great points Danny because a instructor-led training and this is a specific area not like um ID environment like this is building operations so completely different environment handling critical systems like elevators or HVAC failing to which can lead to like you said physical security reputational damage and financial implications Plus instructor-led training can help them understand you know specific use cases okay if I'm in the situation how to handle this or even things like how to even identify if there has been any compromise absolutely and it can give them a chance to also tell their own stories they can give them a chance to ask questions give them a chance to tell their own stories when we do computer-based training we we tell them this is really important and we tell them this matters you have to take this training we make it mandatory but then when they say oh but I have a question who do I ask my questions well it's not that important we're not actually going to answer any of your questions because you can't really answer any questions a lot of times with computer-based training um there's there's a line from the company and it'll say it's completely Interactive of course when they say it's completely interactive what they mean is you know you click on a red button and the red button turns green after you've clicked on it or something like that right but I'm talking about human interactivity when you can actually have human interactivity and give proper training and really answer their questions listen to their stories share your own stories and really connect um and I it just makes such a huge difference years yeah and there'll be more understanding how their role and their action impacts the security in the building 100 100 percent no one last bonus question freaky takeaways that property operations can do now so so excellent question and I always like leaving things with with a takeaway right uh so three key takeaways well one key takeaway would be um if this is something that you are it's a somewhat of a New Concept to you you know the aspect of securing a building or securing building operations is a great place to start is with some sort of security assessment specific through a building specific to building operations um with cyber security one of the great ways that we like to start is knowing well what are those vulnerabilities what is it that I need to plug quick story here for you um there was uh there was a story that um uh in the not too distant past about a casino uh that was breached through their fish tank they had a smart fish tank and the the bad guys were looking for the the simplest point to get in right and they got in through the smart fish tank from there they got into the building and then from there they got into some very sensitive stuff and got access to the money right and so so when you're doing an assessment but somebody typically we tend to only think of the old-fashioned assessments we think we don't think of the building we think of the network and we think of things along those lines right but bad guys don't care they're going to look for the easiest entry point they're going to get in through there if somebody did an assessment in that casino and they did it Beyond just the network and they did it on things like that it would have spotted the Gap within that smart fish tank and that would have been locked down so I like starting with an assessment another thing that I like to do is you know we talked about that that second law you know if it can be hacked it will be hacked I like starting off with the mindset of understanding this most likely may happen so what's my plan what's my incident response plan right what's the plan if trouble happens where do I go who do I call and what exactly am I doing because when it does happen you're going to be panicking and you're not going to be thinking about all those things and and kind of my my sub point to the incident response plan is once you have them so the first point obvious this is make sure you have one right that's that's the obvious um the second point is practice it and and I don't just mean practicing it so you can get better at it it's not just about rehearsing but it's about seeing what might be missing so as an example there's an organization that I was working with and they were doing an incident response plan and they they wanted to practice it and they wanted to make it realistic so they came in on a weekend they came in after hours right and uh and while we were doing it we quickly realized we don't have access to the washrooms because in that building part of their building operations is they would lock the washroom's doors um on the weekends and we realized well if we're going to be here for you know six to eight hours working on this we have to have access to the washrooms and so we realized in the event of a breach we are going to need to have that contact information of whoever it is that can unlock those washroom doors we need to have them in our incident response plan we never would have thought of that unless we ran through it there are certain things you are only going to see if you're running through it and and on that uh the point of insulin response the last point that I would add is is you want to make sure to have a paper backup plan okay because imagine and so many things are digital nowadays imagine you come up with this great plan you know everything you're supposed to do and all the numbers you're supposed to call then all of a sudden that happens to be on a server that you've been locked out of because it's been hit with some sort of ransomware right and what's interesting is the people that I talk to that are most prepared that really have done their homework that have that do regular assessments that do you know an incident response plan those people I find they're the ones that want to say but do you have a paper backup they always say oh I forgot that one that's one of the ones that people tend to to forget about and so so my third takeaway um is of course what we've been talking about throughout today um is you want you definitely want cyber security awareness training but specifically for the world of building operations specifically for the world of property operations um something that's designed very specifically for them to talk about those specific vulnerabilities and those threats and of course how to fight back against them and also something you don't want it to be something that's some off the shelf you know really boil down to just a basic you know anti-fishing computer-based training program but you want it to be something instructor-led so it can be customized for the team that's training um and and that was definitely something that that I would highly recommend so those three is is you know the assessment the incident response plan with the bonus points that I mentioned uh and of course the training um and what I also did was Harsha I I wrote a really small article really small kind of one pager about those three takeaways just a couple of things to consider I'll send it over to you and in that way if anyone asks you for that paper you can you can be sure to share that with them that's great Danny and thank you Danny those were really great points you know understand what's there in your building understand the risk and then plan and put measures to secure your building and then keep a backup plan because running building operations smoothly is the key 100 thank you for sharing your experience and your knowledge and it's always a pleasure talking to you you as well Harsha thank you so much absolute pleasure [Music]