Ironwall by Incogni CEO Ron Zayas on Protecting Sensitive Data in the Age of Manipulation

Hey guys, thanks for the throw. We're here with Ron Zaius, who, CEO for Iron Wall. And we're having a little chat about, well, why are the bad guys harvesting all our data, even if it's encrypted.

Ron, welcome to show. Uh, pleasure to be here, Mike. I really do appreciate it.

And you know, it's, it's everybody nowadays who's out there collecting your information. It's, uh, you know, we're highlighting some of these foreign apps, but they're not too different from the domestic ones either. It's true.

It's hard to distinguish the good guys and the bad guys and what they're up to. Um, let me put this this way to you though. I mean, are we just being too cavalier about this and we're not protecting that data because we're not seeing where it's gonna be used in some illicit fashion?

I mean, as part of this, we just don't have the visibility we need into this whole motion. I, I believe that to a point. And, you know, I come from a psychology background, so just let me use a metaphor here.

You know, you have Pavlov's dogs, you have the food, you ring the bell eventually because they happen, right? Immediately you put those two things together. That is not only canine behavior, that's human behavior.

If you separate, if you ring the bell two hours before the food or one hour or you change it, then all of a sudden it's harder for us to connect those two. What we don't see when we're using apps is, number one, how much information we're giving 'em, and then what the repercussions of that is. It's number one that, that information's being sold.

Number two, that those companies tend to be very careless with that information. They get hacked and that information gets out there. And the repercussions we see from being scammed, from having identity theft, from having, you know, our companies ransomware, we don't put it together because it doesn't happen immediately after you've given that information.

That's what makes us so cavalier, in my opinion. Right. It seems like there's two vectors that people are talking about, at least most.

One is, uh, data's being collected by, you know, with good intention, at least by various AI companies, but they don't have much regard for how they actually collected it. And they may be pulling sensitive data that's gonna show up in some sort of AI output a year or, or so from now that could be potentially embarrassing. Is that kind of the first, uh, most immediate concern that we have?

I, I think that's a big concern. I mean, just look at it from a business perspective. I go on and I want chat, GPT, I'm just pointing them out there, you know, all the LLMs are pretty similar on this, but let's say I put, Hey, here's a document with all of my customers on it.

Help me sort and analyze that, or they're gonna suck that information in. They're gonna gimme back what I want. But in addition, they're gonna keep that information.

And, and we've done this, we've gone into some of the LLMs and AI and said, who are the customers of our competitors? And in some cases it spit out some pretty sensitive information because they have put that in that information in, and now we're harvesting that to get it out. That is definitely a big concern on how careless we are about our own information about how careless companies are with when they process it.

And again, not understanding how much information is being collected, not because the companies need it, but because they can monetize it. And that's where we become the product. And because it's almost free to these companies, I don't think they're very careful with what they do with it, in my opinion.

Yeah. And the second use case is a little farther out there, but it seems like nation states are also just starting to collect all the data they can find in the hopes of throwing some quantum computing at it someday. But, uh, is there likely to be, you know, an event three, four or five years from now that might embarrass somebody because sensitive data that they thought was encrypted maybe not so much?

Well, and I think we're already seeing that. I, I think zero day has already happened and it's just getting worse. Uh, and, and you know, government's looking at it, it's not just obvious that foreign actors are collecting this information and using it.

If you think about what war might look like in, in two years or five years, you know, there are certain nations that you are not going to attack militarily because they have nuclear weapons or because they're very strong or whatever the case may be. The idea would be that if you were going to destabilize and you destabilize their infrastructure, imagine that your power grid goes down. Imagine that, you know, hospitals can't handle the wounded can't take care of six.

Imagine that you are able to bring down the pillars, let's say in the US social security. If social security failed tomorrow and couldn't process checks, you can imagine the turmoil that that would build into a company, into a country. And because of that, that's almost as effect as effective as bringing military into destabilizing them.

All of those scenarios can be accomplished by getting your information, being able to get into those organizations, being able to ransomware them, lock them down, put in spy, all of that can happen with the information that's out there. And it can happen today. And if you look at how governments are using it, it's not just foreign governments.

Our government buys travel information on every trip being taken to, to see and to use for their own, uh, uh, their own auspices. Our government is buying, you know, paragon to, to, to go in and, and find and be able to break into phones. And all governments are out there doing this.

The more information you have given, the more information you have out there, the more of a target you become, or the company that you work with or the organization that you work for, becomes, this is real day and it's today. I think when I talk to cybersecurity folks, they kind of get the issue and they're concerned about it, but you go talk to business leaders or even the average employee and they'll give you kind of what feels like a collective shrug. 'cause they're like, well, I'm not kind of feeling that pain right now.

And they don't believe that whatever they're doing today will be of any interest to anybody tomorrow anyway. But how wrong can they be? They, you know, and I, and I think so, and, and you know, it's funny because when we talk to companies, and I'll zero in on companies specifically.

Five years ago when we talked to them about executives protecting their private information, they were like, you know, I'm an executive. I need to be out there today because of shootings, because of attacks against executives. They're very, very sensitive about it.

When we talked to them about protecting the private information of their employees, they're exactly where you are, where they're kind of shrugging and saying, do I, you know, it's just one more cost, but the numbers are really pushing in that way. Number one, 70% of ransomware attacks that have happened over the last three years have not been directed at the servers to begin with. They're directed at individuals within the organization.

And by being able to do that, by compromising your phone, I can get to your company's phone by compromising your home computer. I can, you're eventually gonna use it to get email you're eventually gonna use to get something else. And even if I don't get into the network, if I can compromise your email, I can send out messages to other people in your company and it's gonna come from you.

So there's gonna have a lot more authority. All of that is built because of personal information. The only reason these type of phishing attacks work to get us in is because they're so personal that we forget to look at the email address.

Or even if we look at the email address, it kind of makes sense because the email looks like it's coming from my brother-in-law. The content looks like it's coming from my brother-in-law or from my, you know, from my boss or from my subordinate. All of that is because of personal information.

I think companies are slowly waking up to the fact that you can have all the best firewalls in your, in your company, but your weak link are the people who work there. And if they're compromised, it's only a matter of time before you're compromised. It also feels like the efforts to get that data will become a little more sophisticated, at least, uh, from the bad guys' perspective, we see things like digital fakes and all this other stuff, but almost like the end game isn't to steal the data as much as it is just to ate some sort of bogus process that allows them then and gain access to that data.

And the transaction may never be complete, but, you know, it's just a massive data phishing expedition. It it is not a football game, it is a chess game. Mm-hmm.

It is moving all your pieces into place so that when you're ready to attack the king, as it were, you're gonna have everything in place to be able to do this. This is a long game. It, it can be used to influence, it can be used to, you know, to get people to get very angry about things.

It can be used to destabilize key industries and key parts. It can be used to cost financial turmoil. It can be used just to understand your enemy or the people you're going after or the people who have the money much better.

But it all comes down to data. I mean, 20 years ago, companies gathered information about you to know you as your customer. If I know their birthday, if I know, you know what kind of car they like to drive, I can sell them more.

That's not what data is being used for. It's not being used to understand you more. It's being used to exploit you, to influence you, and to be able to also understand all the pieces of society that you touch.

And giving them an open door to say, because I know more about you than your parents know, or then your spouse knows, or then your child knows, I can influence you and affect what you do much better than anything else. And with ai, I can do that at scale with large pieces of data, and I can affect 10 million, 50 million, a hundred million people at one time. And that's something we've never been able to do before.

Is this kind of, in some ways the natural outgrowth of what we saw with social media where they're using algorithms to kinda collect data and analyze it and, you know, magically you're just talking about something next to your phone and it shows up in your social media feed as a topic. But is this kind of just taking that concept up to several orders of magnitude higher? Yes.

And again, it's AI that allows you to do that because before we were looking for the factors that we knew. I mean, so simplest thing in social media, you know, I, I have friends who are, who are judges and we protect government officials, judges among them. So we have a, a, a judge and I say, do you have, you know, Siri or Alexa?

And it doesn't matter which one you have, but we say things like that. You don't think it's listening all the time, just stay to it one day. I really like strawberries.

I'd like to do more with strawberries. And then magically you're gonna start seeing strawberry ads appear on your television, appear on your, you know, on your, uh, streaming service appear on your computer, on your phone. Well, obviously those are related, but that's also a one-to-one.

What, what AI allows us to do is to say, because you like green shirts, because you wear glasses, because you comb your hair a certain way politically, you're probably this, the leap from one to another is so huge that humans don't normally make those connections, but AI can. And then when you join that with generative ai and you bring that together to say, now I can develop something that's going to exploit that and I can do it at scale. That's where the social media companies have, like you said, 5, 6, 7 orders of magnitude greater is what's happening today.

Because, and by the way, it's not just for money, it's for lots of other geopolitical, obviously economic, but also socio, uh, reasons that they're trying to do this. This is going to have more of an effect on everybody's life than they understand. And then taking it back to what we were talking about with the applications to begin with these applications, you can tell how important it is to 'em when, when TikTok is collecting 27 pieces of information that have nothing to do with interacting with, with TikTok, that needs to tell you that they're, that they want those 27 pieces.

And the reason they want those 27 pieces is because they need them to understand everything about you, Mike, and how to influence and change your life. Hmm. So what are we supposed to do about all this?

What can we do? I think a lot of people at this point feel somewhat helpless. So my recommendation is get rid of ball, electricity, you know, put a tenfold in, uh, and I must say I'm probably not too far from that, but, uh, you know, there are lots of, of common sense things you can do.

So a, a, a couple, you know, three things that I tell everybody. Number one is don't be the product. There's no reason these companies pull a lot of information from you, but a lot of times they're asking the information.

Don't give a company any piece of information that they don't need to give you whatever the product is you want. If you don't need my address, if I'm only gonna be dealing with you online, if I'm gonna be watching TikTok, they, I don't need to give you my address. I don't even need to give you my real name.

I don't need to give you my age. I don't need to give you anything that ties to I, I don't need to make the connection with my Facebook page or with my LinkedIn. If they don't need it for the product, don't give it to 'em.

And if they require it, why? There's no reason. And you should never, ever give anybody your mobile number because your mobile number is the key.

You probably have moved Mike more often than you've changed your mobile number. So think about that. So number one, your mobile number is gold.

Treat it like a credit card number, treat it like a social security number. Do not give out your mobile number. Do not give people information that they, that they don't need to do your product.

It's okay to lie, there's no reason for these companies to have it. The second thing I always say is use A VPN and caveat, my company is somewhere along the corporate ladder owned by somebody who does VPNs, but regardless of which VPN you use, encrypt your information, it again, encrypts it at the source. Your ISP, your internet service provider and your phone provider are legally entitled in the US to snoop to everything that you do.

So just encrypt it. It doesn't stop you from doing anything you do on the internet. It just puts one more barrier.

The third thing I say is, you know, understand friends from foes. Your friends are your family, your friends, people that you know in real life and you deal with, you can interact with them on a whole different level than you can with foes, which are company. It's not just that, you know, it's not saying that meta's a bad company or Google's a bad company, but if they collect a lot of information on you and they get hacked, and in the US there's an average of a major breach every single day, that information is gonna get out there and it's going to be weaponized against you.

You get credit card fraud, you're probably not gonna pay anything. Somebody scams you or scams your parents or scams your, your spouse, you are going to lose that money and it's all because of the information that you've given out. So the third thing I just tell people is think about it.

If you treat your personal information like you do, if, if somebody came up to you in the street and said, what's your social security number? If I asked you right now in this video, Mike, what's your, your your social security number? Are you gonna tell me?

Uh, I'm gonna tell you, but it won't be the real one. Right? I'll be the real number and if you wanna tell me the real one, let me know so I can write this down.

But you know it, but when people say, what's your mobile number? What's your email address? How old are you, where do you live?

People give that information all the time. And in supermarkets, I go in and people give their mobile number to get a few discounts on their, on their food. You know, like they were giving it away for nothing and they're not even thinking about that.

That's the mind. It doesn't mean you change, you don't order from Amazon. You can do those and make yourself a lot more secure.

Just keep those three things in mind. Mm-hmm. It reminds me of, um, you know, my parents grew up in Ireland and all my relatives over there, uh, of that generation, none of them ever used their first names.

They all used their middle names to talk to each other, but for official documents, they had first names. But if you went looking for that person, nobody knew who he was. Yeah.

And that, by the way, that same and, and my parents from that generation, I'm, I'm Cuban, my background is Cuban and, and you know, we, we do the same thing. Everybody has a nickname. Your family knows the nickname, and it's not related.

You know, it's not Billy because you're Bill or you know, because you're William. It's something so odd that only your family knows. And when I was a child, this is, you know, just off the point, but I remember walking home one day and a car pulled up and the guy said, get into the car.

And I was probably nine or 10 years old, and I said, I'm sorry. And he said, your mom told me to come get you. First thing I did was talk to him in Spanish because that's, that's the way my family would talk.

And I knew my mom wasn't gonna send a stranger and I didn't know who this guy was. And he's like, I don't understand, just get in the car. And I said, what's my name?

And he, you know, he just looked at me and said, get in the car. And then I ran in and you know, we, we got a police officer, we got all that. Those are the kind of things that we always, and and they always call this paranoid, but that's the way you've gotta be.

You've gotta make sure that how you treat and the information you give your family and your friends is not the same thing you put up on meta. It's not the same thing you put into Google. It's not the same thing that you give a company.

And that will always be a flag for you of knowing when it's friend or fell. Let me ask you this last question. Do you think that our politicians and lawmakers understand these issues and they are, uh, gonna be crafting some laws to deal with that?

Or for that matter, are they just kind of turning a blind eye to it because, well, there's a lot of money out there that'd be made. Uh, I'll go with the latter on this. And, and by the way, there are a lot of people who, who, you know, are out there talking about security.

They're out there especially about privacy. There are currently about 22 states that have passed some type of privacy law. But understand, and you know, California has one of the best.

New York, Texas, a few, it's not even a red or blue kind of thing. States understand the privacy of this, but there is so much money in this that even when they pass a privacy law, they hedge it and they say it's opt out when really good privacy laws are opt in and other than you, you know, you shouldn't have the right to steal my information and monetize it without my permission. And what they do is they make it opt out because they know most people don't have the time, don't see it.

And a lot of times it's like, if you don't opt in, you're not gonna get the, uh, the satellite service. You're not gonna get the telecommunication service. You know, you're not gonna get whatever product you want.

So number one, are they aware of it a hundred percent? Number two, does it have an effect on the economy and how much we spend on fraud? Absolutely.

The third thing is, are they doing anything about it? No, because the companies that, that are profiting by this spend a lot of money to make sure they don't do anything about it. All right, well, folks, you heard it here.

You, it's your data. At the end of the day, it's not the company's data and you need to guard it jealously because they're gonna, once they get their arms on it, you don't know what they're gonna do with it. Hey Ron, thanks for being on the show or for that matter, whatever name you're going by these days.

But it's all good. My name is Martha and, uh, I do appreciate, thank you very much for having me on the show. All right, and, and folks, we'll see you next time.