Access the full text logs of this transmission for compliance and review purposes.
00:00:01:06 – 00:00:07:19
Actual
Welcome to Status Secure, the weekly Cyberthreat briefing for executives who refuse to operate in the blind.
00:00:07:21 – 00:00:20:08
Actual
Hosted by the watcher six collective, uniting former Army Special Forces and Naval Special Warfare communications operators alongside an industry leading CISO nominated for cybersecurity. Woman of the world.
00:00:20:10 – 00:00:27:05
Actual
We cut through the noise and give you the operational intelligence you need for mission success in a hostile digital environment.
00:00:27:07 – 00:00:28:10
Actual
The enemy is listening.
00:00:28:13 – 00:00:32:02
Actual
Is your status secure?
00:00:32:04 – 00:00:54:03
Actual
Welcome to Status Secure. Today we’re covering how physical security can lead to cyber events, such as physical access badges that are giving attackers away through the front door. USB drop attacks and the unlock laptop sitting on every desk behind that door. Then we’re going to get into the HIPAA physical safeguards, the part of the security rule. Maybe most healthcare organizations aren’t maybe thinking about.
00:00:54:08 – 00:01:06:21
Actual
So CISO, start with the badge. Most security awareness programs are about email phishing links attachments. Almost none of them say a word about card hanging around your neck. They’re lanyards. Why does that matter?
00:01:06:21 – 00:01:37:13
CISO
Yeah. I mean, you know, traditionally physical security and cyber security are two where have traditionally been separated, separated in like functions and oftentimes departments. Right. So when the security team builds out the security awareness training they talk about cyber security. They don’t talk about physical security. And so usually physical security is chained by the, you know, the physical security team.
00:01:37:18 – 00:02:08:07
CISO
Right. The physical security team. And if, if that’s outsourced to a vendor. Right. So like you see some like guards. Right. Physical security is a it’s, you know, a third party. Like they’re not going to train them for years unless it’s in their statement of work, which usually it isn’t. Right. So so that’s why it’s mostly, you know, the training that employees get is just around their, you know, their, their devices, how to use their devices, their identity and access to systems.
00:02:08:09 – 00:02:29:23
CISO
But physical security is often missed. You know, in that training the lanyard. So let’s talk about that. Everybody who’s worked at a company pretty much has had a badge, right. Where you see it, you, you know, in order to get into the building, you have to badge or you have to show your badge to guards. Right. And the badge traditionally has your company name, your employee name.
00:02:30:01 – 00:02:49:15
CISO
Sometimes it has like, you know, you know, a lot of more modern. They have your photo on there, right? They have, you know, you’ve been in some I’ve seen some badges have employee numbers on on them. And so when you’re sitting at a coffee shop, you’re eating lunch at the same place you and your coworkers go to, like every Tuesday.
00:02:49:20 – 00:03:12:00
CISO
Hey, you’re wherever you are. Like a bad actor. They start to they do reconnaissance, right? They start to see who who’s here often, who looks like they, you know, who has a badge. That means that they work around, you know, that location. And all they have to do is just wait until lunch is over and just follow to see where you know which office, which company you work for.
00:03:12:03 – 00:03:32:14
CISO
You know, so, you know, this is, you know, oh sent right. An attacker would otherwise build from LinkedIn hand over for free like they are learning about you right. And so just like they would if they were looking at your online presence, now they’re looking at your physical presence. Okay. And then the other thing is that badge you’re wearing, it can be copied.
00:03:32:19 – 00:03:55:11
CISO
Right. So, you know, if you’re looking at like, you know, they’re going to try there’s so many there’s you can even buy it on Amazon and RFID reader. Right. And so, you know, they’re going to sit next to you. They’re going to try and Cologne. Right. And you know reading Cologne your badge. And it only takes seconds. It’s you know, it’s really it’s not expensive.
00:03:55:13 – 00:04:22:12
CISO
Okay. You know, it’s a like for instance, my fair classic. It’s a common higher frequency card. And with that, that card like if your badging system uses it that that cartography was like was easily broken from in 2008. And we’re in 2026 now. Right. You know, you have your pen tester. You know, when they’re doing, you know, physical pen testing, which you should always do, by the way.
00:04:22:14 – 00:04:50:09
CISO
Okay. But a lot of times just to meet compliance requirements and to to do the, you know, to do the bare minimum, you do the cyber pen test, right. You do your external perimeter pen test and that’s it. Okay. So you know this this is where this is a hole where a bad actor can get it in. Oh, if they clone your badge, you know, then it’s very easy, right, to come in.
00:04:50:14 – 00:05:12:03
CISO
And that’s you have the controls in place. Like, we can talk about it, but a very simple control is that, you know, when you’re badging in there should ever only be number one, one active badge at a time. Two, there should never be two badge swipes, right. You know, in different locations. And if you see them, hopefully you have cameras.
00:05:12:06 – 00:05:20:19
CISO
And then you can see who actually badged in. Right. And you’ll find and that’s how you can find like somebody who’s not supposed to be in the building is now in the building.
00:05:20:21 – 00:05:43:17
Actual
Got it. Yeah. You know, this is a topic that is like I had training in this in the military doing this as the attacker and and understanding defensive posture towards this. Basically what we’re talking about is let’s say somebody is having maybe an attack in your organization, like soft attacks, which is kind of what’s been happening a lot recently with some of the Iranian stuff.
00:05:43:17 – 00:06:08:04
Actual
They’ve been doing these like, you know, from across the ocean sort of distance attack, just ping, ping, ping ping thinking, see, maybe we’ll get something right. But when someone’s actually like, no, I’m specifically coming after this company or I’m specifically coming after this piece of information, they would prefer to do the physical stuff first. It’s, you know, we would have a scene that’s like, if I can get my hands on your computer, I win, basically.
00:06:08:04 – 00:06:27:04
Actual
Like, you’re not going to stop me at that point. Right. So if it’s so much easier to go, we’ll do this reconnaissance, we’ll hang out, we will target that company will target the vulnerable people. We will get access to their badges will get into the facility. We’ll have our special USB drives that’ll do all the magic. And then we’ll get what we need to get and we’ll walk out.
00:06:27:04 – 00:06:51:16
Actual
And that is so much easier than trying to attack from a cyber attack. And I also feel like, like you said, maybe security personnel are trained in security, physical security, like, you know, having the appropriate licensing or the appropriate training on firearms or having like understanding like the physical aspect of like the doors and the exits and you know, who’s allowed in and whatever the logging of stuff.
00:06:51:21 – 00:07:09:03
Actual
But like, they may not be trained or be thinking about, oh, the social engineering it takes for someone to recon to come into the facility, to get to a computer, to plug in a hard drive or plug in a thumb drive, or get into an Ethernet port, you know, plug into an open Ethernet port somewhere or what have you.
00:07:09:03 – 00:07:25:09
Actual
You know, and I can see a little bit of that disconnect. And I think, you know, something we were talking about that you brought up was interesting, like routines. Everybody has routines. And so that’s what gets noticed. First is the routines who’s coming in and out, where are they going. Where are they eating. Right. Like okay same the habit.
00:07:25:09 – 00:07:42:08
Actual
The same time, same place, same people okay I can see their badges. Okay. Maybe they got a little smart. Now the badges are just blank. You know, just blank white badges. But, you know, let’s try some of these other techniques. Oh, they’re wearing lanyards. Like, okay, the lanyards have the company name on it, so like, it’s not on the badge, but I’m seeing it on your lanyard.
00:07:42:08 – 00:07:57:06
Actual
I see it on your shirt. I’ve watched you walk out in and out the door. Right? I mean, there’s only so much you can do, to be honest, but. But yeah, I hear you brought up a point of, like, everything is on the person’s badge, you know, their name, the company name, their their employee number, whatever. And it’s like we take it away.
00:07:57:06 – 00:08:15:17
Actual
But then we put the company lanyard on it. So it’s like the same problem or loss, right? And so it’s a talk to us about okay. So let’s say because it can be hard to stop you know. So let’s say I’ve somehow gotten a hold of someone’s badge, I’ve somehow cloned it or I physically took it, and I’ve walked myself into the, the facility.
00:08:15:17 – 00:08:28:14
Actual
So what’s next? So we have let’s just okay. USBs. Like, what are they doing after that? They’re walking out once they’re inside, you know, let’s say they even come to a locked workstation. So what’s kind of the next part of that equation.
00:08:28:18 – 00:08:53:02
CISO
In what you said? Right. Like if they can get their hands on a device like that’s, that’s, you know, half the battle, right? And now it’s just a matter of getting on your network. Right. So, you know, they’re they’re it they got in now they’re walking around. They’re walking around. Nobody’s stopping them. They, they you know, they got in with a badge and and there’s so many people oftentimes in an office that you don’t know who’s who.
00:08:53:02 – 00:09:17:04
CISO
Right. If you you have new people all the time. You have contractors coming in going. Right. So somebody new in the office may not raise any red flags. So they’re just they’re just perusing. Right. You know, they’re they’re just, you know, they’re just walking around trying to see who left their, you know, their device unlocked. Right? I mean, that’s one of the training that they talk about all the time.
00:09:17:04 – 00:09:41:21
CISO
But I could I have to tell you, people got lazy working at home. I, I know that when you know, now people are coming back into the office and they forgot office protocol. I couldn’t tell you how many people walk them out before. So they walk around in like like they’re at home. Okay? So they walk away from their laptops like they’re at home and they forget to lock their laptops.
00:09:41:21 – 00:09:57:11
CISO
They their device, is they right? They they write things down and leave it open on their desk. Right. And walk away. You know, there’s there’s so much, you know, there’s so much of that now because people forgot they’ve been home for years and now they’re back in the office.
00:09:57:11 – 00:10:23:07
Actual
You do bring up an interesting point. When we’re talking about this specific topic, we’re talking about social engineering and the mindset of someone doing social engineering is what’s the easiest way? First, it’s not, can I do something really cool? Like if I’m trying to get into a lock, you know, can I like, show everyone, show off my really cool, like, lock picking technique and how I can, like, use an earth magnet to pop open a certain type of like they’re not trying to do that first.
00:10:23:07 – 00:10:37:05
Actual
That’s sort of the last. Let’s, let’s we can do that, but let’s do that last. The first is like, can I find a key that opens the door? Right. And so I’m sure this is kind of what you may have seen. I’ve seen this a lot. How many people like I’m so tired of it. They’re always telling me to change my passwords is so annoying.
00:10:37:05 – 00:10:49:09
Actual
I can never remember anything. I’m not whatever. Like I got more important things to do. So I’m just going to. Every time I get a new password, I’m going to write it on a sticky note. Boom, put it on my laptop like, yeah, the people doing this kind of stuff, they know that. And that’s what they’re looking for.
00:10:49:09 – 00:10:58:23
Actual
First they’re going to go to your laptop and look at your sticky notes, or they’re going to open your desk or whatever’s on your desk. And they’re going to look through that first because they want to find the easy way. And before they do all the complicated stuff.
00:10:59:01 – 00:11:21:12
CISO
Yeah, of course, you know, and and I can tell you that nobody trained on situational awareness. I’d be surprised if there was a company as part of their security awareness training, trained on situational awareness. But yeah, I mean, once they’re in, you know, they all they have to do is find like open laptop. Now they can you know, they can pretty much again, they’re not going to like you said, they’re not going to do anything big.
00:11:21:12 – 00:11:45:07
CISO
Right. They know they got in. They’re going to like try and see what they can. You know that it can easily take like okay, maybe send themselves an email. Right. And then go and reply with their, you know, with some kind of like malware and accept it like, that’s so easy. Yeah. Or you know, or plug in a USB, you know, that’s not a USB device.
00:11:45:13 – 00:12:09:02
CISO
Right. And now you know, they’re you know, they’re in there with software. Right. Doing again you know, just reconnaissance. Right. They’re just looking around to see where your critical assets are at. Like you know where your high target value. Right. Like high high value targets. Right. That’s what they’re looking for. Because why do they want to come in and be found right away when they they got nothing yet.
00:12:09:04 – 00:12:30:19
CISO
Right. Yeah. So you know that’s you know they do that. And then there was also like the FBI warned that FinCEN in a cybercrime group, like they mailed that USB devices to organizations. I mean, you should never be plugging things into your into your company. You know, devices that you don’t know, you know, you don’t know where it came from.
00:12:30:19 – 00:12:54:22
CISO
Like, you can’t confirm right where they were, you know, where the device came from. That should be. Yeah, that’s common sense. Ain’t part of, you know, but being aware and again they don’t teach that either in security awareness training. So you know you have to take a look at that. I mean they in 2026 they what they did was they you know the attackers combined planting USB devices and fake calls to it.
00:12:55:01 – 00:13:18:19
CISO
Helpdesk. Right. And so that made it even harder because now that that that helpdesk, they you know, they got a call. They think it’s real. They got a USB that they were now expecting. And so they plug it in. Right. But so that’s you know, that’s how they’re the attackers are physically attacking now. Like they’re using all kinds of, you know, different techniques to try and get in.
00:13:18:21 – 00:13:38:20
Actual
Yeah. So you know, if we’re in, you know, this space, what are three things maybe on this topic that can help us, you know, close that physical door like today or this week. What’s something that we can have top of mind and go, okay, I heard it. Yeah. And maybe I really haven’t been thinking about it, but okay, here’s a couple of things I can kind of I can be proactive about.
00:13:38:22 – 00:14:02:13
CISO
Yeah. I mean, these are these are pretty I think they’re pretty easy to implement, right? The first is, you know, you know, audit your your badges. There should never be like, there should never be an active badge for a employee who’s no longer at the company or a contractor that’s no longer at the company. Right? There should only be one badge per person, one active badge per person.
00:14:02:14 – 00:14:28:20
CISO
Right? Like that’s pretty. That’s a pretty easy thing to do. Ranked second. Just put automatic lock screens right. Like if you walk away for like and yeah, two seconds it automatically locks your screen. Right. That’s a pretty easy one. Wait list. Wait list devices right. USB devices. And that what that means is like you have a list of, you know, pre-approved, authorized USB devices that can connect into your network.
00:14:28:20 – 00:14:48:03
CISO
If you don’t have one of those, it doesn’t, you know, you can’t connect it. It’ll it’ll actually alert. It should alert this SoC, right. The Up security operation center. Hey, somebody you just try to connect a an authorized device onto our network. Hey. And sometimes it’s just, you know, employees thinking that they can do it, but at least, you know, it stops it.
00:14:48:08 – 00:15:12:23
CISO
And there’s an alert so you can investigate. The word is just training. You know, we always talk about that. You know, people are the first line of defense, right. You know you should train them on not only you know, you know like their their passwords and yeah, and you know, the traditional cyber training right. Cyber awareness. But you should train them on physical and physical security.
00:15:13:00 – 00:15:26:10
CISO
What they can do to protect like their, their like their physical presence. Right. So people can’t copy them as an identity, not their, you know, not their online, their account, but now them as a person. Right.
00:15:26:15 – 00:15:34:07
Actual
You know, what would be interesting is I don’t know if you’ve ever heard of, like, have you ever heard of Design Thinking? It’s kind of like in the marketing world.
00:15:34:09 – 00:15:37:06
CISO
I like people centric design thinking something like that.
00:15:37:08 – 00:15:55:19
Actual
Yeah. And like if you ever go through some of that kind of training, it’s very like active, like a lot of the training is you’re on your feet or you’re physically doing stuff. There’s, you know, it’s kind of using all the senses. Well, at least it should be. And, so what this was making me think of is, you know, I’ve been through certain training that most people probably aren’t going to get ever.
00:15:55:23 – 00:16:15:19
Actual
But it was it was interesting in some of those exercises or training environments is to see like what you can actually get away with. And I think it would be interesting if there was like a physical security, physical cyber security, like almost design thinking course that you can like run your employees through just so that it like opens their eyes to like, oh, wow.
00:16:16:00 – 00:16:38:00
Actual
Like, you know, you could be standing outside. Here’s an example. Like, you could be going to a Home Depot parking lot and you’re going to test out to see if you can get into someone’s car. I’m not saying someone should do this, but in this was a training environment thing that we didn’t. Of course, the cars were like not someone’s cars, they were training cars, but it was interesting to see, like, I could get Home Depot employees who don’t know me to actually help me.
00:16:38:05 – 00:16:54:17
Actual
I’m sitting there like working on this car, and this person walks by and they’re like, hey, do you need help? And I’m like, yeah, can you hold this for me? And they’re like holding my tools while I’m doing nefarious activities for training. And it’s like, wow, you know, you people are like, they’re not thinking, how do I say this?
00:16:54:17 – 00:17:13:20
Actual
They’re not thinking the worst of people. It’s like most people go living throughout their day thinking the best of people, which is a good thing. Unfortunately, though, that can be taken advantage of a lot easier than we might think. And so if there could be, like a training exercise that, like, you just put people through as a one time, you know, you do it one second, one day thing or whatever, and you just go, hey, go into here and do this.
00:17:14:01 – 00:17:33:10
Actual
And when they do it and people are helping them through the front door and they’re helping them get over here and they realize like, oh my gosh, right. It’s really not that hard. And we maybe we maybe, I don’t know, maybe it might spark a little bit of like, ooh, you know, maybe I could be a little bit more aware of what’s, you know, what people could actually get away with.
00:17:33:13 – 00:17:52:18
Actual
That’s just kind of what you made me think about with this conversation. And because how do you, I guess my my thought around security awareness training, I mean, let’s say I’m like, you know, I’m, I don’t know, I’m like a salesperson or I’m like the product person I’m designing. I’m not mandatory training, you know, along with all the other mandatory trainings.
00:17:52:18 – 00:18:07:23
Actual
Right? I got to do the sexual harassment training and I’ve got to do this training. I gotta do that. You know, here’s security awareness training. It’s like next, next, next next. Okay. Done. Like, how can we get them to have an actual experience that makes them stop and think and go, okay, this is important. Now I’ve registered it in my memory.
00:18:07:23 – 00:18:24:18
Actual
I’m going to actually remember that, kind of like I have to. The reason I brought this up, my experience helped me go, you know, this is a lot easier for people to do that. I, I thought, and, now I’m more aware of it. So that’s just something you made me think about there now and then. So it’s kind of transitioning in a little bit there.
00:18:24:19 – 00:18:46:12
Actual
There’s, you know, an industry where this problem can be even magnified because you’ve got open lobbies, you’ve got 24 hour operations, shared workstations on wheels and all the hallways, you know, vendors and contractors coming through all day long, patients and family members. And just there’s always people you don’t you don’t know. I’m so healthcare could be the most physically open environment in in a regulated industry.
00:18:46:12 – 00:19:01:14
Actual
And it does have a federal rule that specifically covers this. So could you give us the foundational walkthrough for for HIPAA and health care and the security rule and talk to us about the physical safeguards section and what it actually means and requires?
00:19:01:15 – 00:19:36:19
CISO
Yeah. Before I do that, I just want to mention something about what you said. So people learn through all five senses, and the more and the more senses that you use, the more people will remember it. That’s why, like when you walk someplace and you see a place and you and there’s like flowers there that smell like they, you know, that they, they did like, you know, five years ago when you were walking down this same street and, you know, so you’ve got sight now, you’ve got now and then you feel that, you know, you feel the gate and it feels exactly the same because it was cold when you touched it five years ago.
00:19:36:23 – 00:20:04:12
CISO
You’re going to remember that place a lot longer, right? So we have actually changed training now where it’s all CBT online. Right? So you’ve got a site you have no other senses involved in memory. You know, in person, like you said, where they’re actually doing something. Well they will remember that a lot longer ain’t it. So people should think about that when they’re building out and designing their security awareness training.
00:20:04:14 – 00:20:36:17
CISO
Right. That’s my plug there for, you know, or for doing a different kind of security training. But but but to your question about, you know, your question about HIPAA, right. So we had done a episode and we, you know, and most and most security teams will talk about administrative safeguards and technical safeguards. They usually don’t talk about the physical safeguards because those are usually, you know, things that are at the physical security team, bank or facilities handles or a third party vendor, right, handles paint.
00:20:36:18 – 00:20:58:13
CISO
But again, you know, they there are required addressable. Right. And so things that are required, you have to have. So the things that you have to have are you have to have facility access controls. Right. You have to limit physical access to systems holding high, which is your electronic protected health information. Right. So you have to have those controls in place.
00:20:58:13 – 00:21:22:18
CISO
You have to have a security. You have to have a facility security plan. That’s video cameras. So security guards, those, you know, kiosks, right. Where like where, like you have to badge in before you can get in locked doors. I mean, those are, you know, that’s your security plan, you know, procedures for access and being able to validate who gets who’s in, you know, continues the operation.
00:21:22:18 – 00:21:44:05
CISO
So here’s the thing. If you are a bad actor and you pull a fire alarm or you create some kind of physical incident, maybe, maybe set a set of bush on fire right outside the office, right? Whatever. Right. You know, you know, like, people are, like now have lost their bearing and emergency mode. But, you know, what is that?
00:21:44:07 – 00:22:06:08
CISO
You know, what is that? You know, that contingency operation, right? Like, what are you doing in emergency mode? That’s different. Right? You need to understand that. What is it you chose there? If you you know and when you can’t operate in your facility and you operate somewhere else, like what are the controls there because you moved your physical location, but you’ve just changed where your target is.
00:22:06:13 – 00:22:24:04
CISO
That isn’t that doesn’t mean you can’t. You’re not supposed to have the same, you know, security controls there. You’re required to. Right? And of course, maintenance. Right. Making sure that all the systems you have cameras and and you haven’t, you know, you haven’t checked them. And now the camera is now no longer facing your front door and it’s facing the bush.
00:22:24:04 – 00:22:48:18
CISO
You know, I mean, like, those are simple things, but, that’s required your workstation use. Right? So you have to say, like, I don’t know if you’ve ever heard of a clean desk policy, right. But clean desk policy, which means that when you’re not there and you’re not working at your desk, your desk needs to be clean. All the paperwork, everything needs to be in a locked door away from visual sight.
00:22:48:20 – 00:23:10:20
CISO
Right? Okay. So those things are that’s required. And then of course, workstation security, like physical safeguards. I mean, I can tell you a lot of people like I don’t know if you remember where they did the lock, the laptop locks right where you can, you know, physically lock them and attach them. You know, like a bicycle that you would lock, right?
00:23:11:02 – 00:23:38:06
CISO
So, you know, but I mean, you know, don’t, you know, just design it correctly, right? They don’t do overkill. I remember yeah, I remember like they required everybody to have these laptop locks and then it’s like, well, you know, it was a high security facility and you’re already like to get into that office was already like, you already had so many controllers you had to get through, and now you’re also locking that, like that laptop to the desk, which I was.
00:23:38:08 – 00:24:04:14
CISO
So you have to design it. You have to you have to determine what your risk appetite is. Right, like. But keep that in mind. Physical, physical security of the actual devices. Right. And of course, you know, our disposal of them, right. Disposal of your devices and being able to use them. Because if you if you take a hard drive and you just delete everything on it and then you reuse it is that is is the data really gone?
00:24:04:16 – 00:24:19:11
CISO
It is not. Someone can actually take it and restore the old data. Right. So you need you need you know, you need protocols in place to for the destruction of devices. But those are the things on the physical security side that are required.
00:24:19:13 – 00:24:40:08
Actual
And that’s good to think about. I think we’re going to, you know, as we’re getting to the telling of this episode, we’re going to skip down to the marching orders. And, you know, because this is maybe we don’t talk about physical security all the time. And the thing is, though, it it the reason we need like the reason physical security is needed is because it leads to cyber events, right?
00:24:40:10 – 00:24:55:12
Actual
It’s not just for the most part, it’s not just a criminal show or I’m just coming in to just physically take something home and and sell it on the black market or whatever you know, selling on Craigslist, I guess. But like, that’s not really what we’re discussing. It’s more of like, how do we get to the cyber events, you know?
00:24:55:14 – 00:25:23:02
Actual
Yes. What we typically see is some kind of hacking, I guess, situation. Right. We talked about with McKesson before with Stryker, and there was this vision, you know, events where as phone calls and, you know, voice cloning and whatnot getting in. But it was also this also had a little bit of social engineering in them because a lot with, with Stryker, it was, you know, being getting the credentials of it, administrative credentials to do what they wanted to do.
00:25:23:04 – 00:25:41:06
Actual
But this is sort of on that same playing field, but just from a physical avenue. You know, if I can physically get access to your devices, then the result can be the same. And I think that’s just it’s just something people don’t think about as often. But it’s also important and it’s kind of easy if you are thinking about it.
00:25:41:06 – 00:25:58:23
Actual
It’s a little bit easy to, to protect against. And so that’s, you know, one of the reasons why we wanted to talk about this, and we were talking and we started going down that rabbit trail of like physical and, and badges and, and what, what you’ve seen in the past when I’ve had my experiences too, what I’ve seen in the past and kind of that going into.
00:25:58:23 – 00:26:17:08
Actual
Yeah, but that all leads to cyber events. At least that’s the intention, right? People aren’t just physically trying to get into your facilities just just to do it, you know, just to be like, look at me. Look what I did. That’s usually not the case. There’s something that they’re after. If they’re doing that to like that’s the targeted approach.
00:26:17:10 – 00:26:31:06
Actual
Like if I’m actually specifically after something and I and I want it really the best way to do it is their social engineering. I’m just going to go get it. You guys are going to let me in the door anyways, right? So it’s something to think about, something to keep on top of mind. Okay. So so walk us through.
00:26:31:11 – 00:26:43:19
Actual
Right. So we’ve, we’ve listened to this. We’re like, oh man, you’re right. Maybe we haven’t been thinking about this. Okay. So give us those those three marching orders this week that, that people can take back with them. And either keep an eye on review, look over or implement.
00:26:43:20 – 00:27:05:12
CISO
Yeah, I mean, we talked about earlier what you could do. But you know, the one thing right away is encryption on your devices. Because if if somebody were to get in and grab your device, you know, if you have encryption, then you know, it doesn’t matter right at that point. Hey, you know, you know, like you do everything you can, but they got it anyway.
00:27:05:12 – 00:27:25:21
CISO
Well, it’s encrypted. So, you know, they’re not able to take any of your data right. So the second is, you know, make sure your, you know, your reconcile your badge because your badges inventory, you know, asset inventory. Yeah. A badge is an asset. And just like, you know, all the other security foundational things, it starts with inventory. You can’t protect what you don’t know.
00:27:25:23 – 00:27:50:04
CISO
Right. And this is the same. You have to know how many badges are active, who you know, who’s who owns each badge. And you know, and only one badge at a time. They can can badge in X is you know, make sure that you are, reviewing your physical security requirements, that you’re implementing them, that you’ve added on physical security training.
00:27:50:06 – 00:28:10:21
CISO
Hey, you know, that’s really important because if you miss it, and especially for those that say, hey, we hire a third party to do our physical security, you know, those are, you know, I mean, it’s still you’re still accountable. Hey, you you know, you can’t transfer risk, physical security risk to a third party. Just keep that in mind.
00:28:10:22 – 00:28:20:17
CISO
You are still accountable for that. Right. So to make sure that you’re you know, you know what’s required. You know what’s what’s been addressed and what’s still a gap.
00:28:20:19 – 00:28:45:06
Actual
Got it. So a clone badge gets somebody through the door or a stolen one, right. An unlocked laptop or an open USB port or an open Ethernet port gets them on to the network. So not one Cyber control had to be defeated to make that happen. And health care feels like it’s a better maybe it’s a harder environment, more difficult because of just the way that those environments are, at least in terms of like hospitals and places like that.
00:28:45:11 – 00:29:07:00
Actual
HIPAA physical safeguards have been in the security rule. You know, there is an enforcement record around it, right? Laptop gets stolen. Encryption was never turned on. The settlement will follow. Right. So the organization’s own risk analysis had already named the problem. Maybe so. Mission success here in this conversation starts with closing that door you already know is open, right?
00:29:07:03 – 00:29:21:13
Actual
Trust, but verify your own posture. Verify encryption. Reconcile the badges. Put some physical security safeguards in your risk analysis and fund what defines right. So let’s execute the standard and we’ll see you next week.
00:29:21:15 – 00:29:25:08
Actual
Mission. Success isn’t about luck. It’s about preparation.
00:29:25:10 – 00:29:28:09
Actual
You’ve heard the Intel. Now go put it to use.
00:29:28:11 – 00:29:35:19
Actual
If you need to verify your security posture. I’ve established a secure line at watcher 6.com/secure.
00:29:35:21 – 00:29:38:21
Actual
Go there to get the briefing the enemy doesn’t want you to have.
00:29:38:23 – 00:29:42:05
Actual
We’ll see you next week. Until then, keep your head on a swivel.
