#153 Cybersecurity, SMBs, and Mental Health: An In-Depth Discussion with Nate Sheen

0:00 From the heart of Dubai, where tomorrow is being built today, to the world. Welcome to the CTO Show with Mimet. Here we redefine technology and reimagine possibilities. With MIMET delve into the riveting realms of a I cybersecurity and digital technology. Experience the thrilling highs and lows of startups, immerse yourself in the spirit of entrepreneurship, and witness the future of Business Innovation being written in real time. Now, without further ado, let's TuneIn and explore the future.

0:46 Hello and welcome to a new episode of the CTO show with Mehmet. My name is Mehmet and as you know when you check is old, I talk about different topics from cybersecurity, digital transformation, emerging technologies. And also recently I've started to do more and more one to one conversations with entrepreneurs, startup founders and people who are subject matter experts. And today I'm pleased to have with me Nate. Nate, thank you very much for being on the show. Well, thanks for having me. Yeah. Can you just little bit tell us about yourself and about what you are doing currently? Yeah. So, I'm Nate. I'm the President and founder of Astoria.

1:26 We're AIT and cybersecurity service based out of Cleveland, OH. And so we manage aspects or the the whole picture of clients, IT and cybersecurity and of the businesses. Over 7 years old now and it's a great space to be in and a lot of fun to work in that space. That's great. My first question, which is kind of maybe traditional, but personally I love to to understand more. Cybersecurity is not the easy career path someone can take, right? So what have led you to choose to be in this space and to start your company? And I think you have to be in cybersecurity in IT these days, especially in the smaller companies, the mid market, IT kind of gets served that oh you're going to, you're going to handle the security, right, because you're dealing with all of these other things.

2:31 And so we've kind of been forced into it now me starting and founding my own company, I wasn't necessarily forced, but I definitely see it as an opportunity. Better serve our clients and make them better. It's a little bit different than the IT piece of our business because it's really more about process, it's about philosophy, it's about culture and it's less about the technology cuz you can have a lot of great technology in place. But if you don't set it up in a secure manner then it doesn't really help you at all if it's been taken over by a bad actor or somebody malicious. So that's that's why we got until we see such a need in that especially in the small mid market area where we really serve it is so needed and there so needs to be a conversation about it.

3:27 And So what we bring is just like framework and say you don't know what you're doing, that's okay we do and this works well let's start with. Here with you that's that's great to know. Now next of course like cybersecurity is is a very, very large topic and you know like we can talk maybe 4 hours about it but of course and again and you know similar to what you are doing. I also try to help as much as possible. Small, medium businesses and startups mainly to help in dealing with their cybersecurity issues.

4:11 But what are and I think that we can make it, I mean it's a global, it's coming across all geographies and it's not different in the US than any other part in the world. Or this reason I'm asking what are you the key challenges from your perspective that Smb's are facing when it comes to cyber? I believe it's really buy in from a culture perspective. I don't believe that the whole organization is bought into it. So the first thing we have to start with this is a culture change that from the top down we're going to believe in the security of it. Because if your CEO doesn't believe in your password policy or implementing 2 factor authentication. Then why would the receptionist who answers the phones goes through and all those hoops that need to go through to protect their accounts?

5:09 I guess the biggest challenge in it and everything else is primarily easy after that if everybody is really on the same side of implementing it as a policy or a process in a couple. Yeah. Now it's hard to sometimes also I think to as you said, not only to get the buy in, sometimes they get the buy in, they understand the issue, but you know they say I don't have money for this. Well, it's not happening to us and something similar I would say, but like in the 1st place And I think let's go back a little bit to basics like why? These organizations in particular are more like, I would say vulnerable to being attacked in your opinion more of course enterprises, they are also like vulnerable, but why? Why the SMV should be worried that? Can you put some lights on on some of the aspects that you know that might affect their businesses? Sure.

6:18 It's a it's a process issue. It's not a technology issue. They don't have a plan in place. They haven't written up any kind of process of what do we do if or This is why we do this. And so we use a lot of the concepts from the the book traction. I would tell anybody who's looking to build a cybersecurity policy or process for their company. Or it it would just be great for an S MB to implement the entire traction system in their entire company. But we bring that from the IT and cybersecurity space and say what is the issue that you're dealing with? Let's identify those issues.

7:05 Let's discuss what it's going to take to do that why is it happening and solve it together. And we work through that because usually of the longest period of time it takes when a hack happens is. Not really fixing the problem. We have to first start where I just said and identified what's actually happening, what's actually been affected. And they don't know because you know, who has the password, who has the codes, who has the access, what application is. I didn't know we had that. I didn't know we were spending money on it. And that's a lot of the discussion that goes around when those moments happen as opposed to the companies who get, you know, hacked and they have a planning process in place. They just grab the playbook and they go through it and they recovered from it a lot faster.

7:54 And those are the businesses that stay in business. We've seen a couple of those republicly in the last year or two businesses survived some ransomware attacks because they haven't played in place when it happens. Now you mentioned a couple of things, Nate. And if, if, if I was your customer right and. Like I ask you, I need list of items that I have to fix like I mean in general like high level I would say and you have to come up with let's say top five things that I should have. What do you think the most important ones would be?

8:36 Yeah. And this I'm going to get really general because every customer specific, so typically my. Typically my customers have no idea what they have that's they're asking us to figure that out. So and they'll say you're going to need a, you're going to need a password policy in place, you're going to need two factor authentication turned on that would that would be step one, you're going to need some clarity and documentation on all of your systems, that's your computers, your servers, your network gear, all of those things in place. And then I'm going to need an offboarding and an onboarding. User policy that's going to connect tenants to your HR process, your hiring and firing or somebody gets laid off those types of policies. What do I do when a new employee starts and how do I know, as your IT or Cybersecurities have and somebody says I need access to these systems, how do I know who to get that approved from? How do I know who should or should not have access to certain systems?

9:37 And then the another piece in that would be, it's just having good robust systems in place that's making sure that systems are not dates, making sure they're updated, getting rid of old hardware that maybe has security vulnerabilities into patching those things, which is a consistent thing, making sure those are all in place. And then the really the 5th step was just that ongoing management taking all of that and just managing that on a consistent basis and inconsistent or knowing what happened when that's really your ground level of those items. And then there's a lot of other things that we can add into that that really has to be your basic of your infrastructure there. And what about awareness, Nate, What do you think? As far as like cybersecurity, like training and awareness, is that what you're thinking?

10:29 Yeah, yeah, definitely. I think, don't you, that I always feel like that's like kind of like Level 2, like we gotta get these basics in place because a lot of times they don't have that. Because what's the point? If I do a bunch of training on things that are working, I'm really more of a fan. Of. And we're working, and we're developing this consistently, but doing more. Kind of like making it fun. So we do like 3 Truths in a Lie game. I don't know if you've ever played that game. So we'll do like a cybersecurity edition with the staff and make it more fun to go through that. Do some cybersecurity trivia.

11:10 Rather than having me or somebody on my staff sitting there and giving you a slideshow on e-mail security, let's actually do something fun and interactive and actually have the users engage with that. We're developing a couple of other things, of course. Do you like some of the phishing tests? So we do some scoring and some prizes, like, you know, Jim and accounting did really well because you know, he caught all the phishing emails that we sent out from the test system this month. So he gets a $25 Amazon card. Or things like that to kind of make it fun and try to help make the culture of security something that everybody wants because there's some more fun built into it, and make it a better culture rather than a culture of you're in trouble because you failed on this test.

11:59 Yeah. Like also one of the things that I hear a lot is. You know the landscape keeps changing very fast at this. I'm talking from customs perspective at or then they say we cannot keep you know like up to date with what's happening. How are you seeing, you know, the rise of, you know, this fast changing technologies affecting customers and at the same time, you know like making it more challenging for people like us. Like for example AI like we need to keep up with AI like how we can also ourselves keep up to date so we can first protect our self and then protect our clients. Sure.

12:48 I think I see a lot of seer from people on like the marginal SEESO, marginal CTO side, service side. Where they're kind of like afraid of even trying the new technologies, even from the rest of maybe losing their jobs or they're not sure of the security probabilities in it. I'm really from the school of thought. It looks embrace it, let's learn it, let's poke some holes in it. And so I love getting to know new technologies. That's one of the fun pieces of being a CTO and trying out those technologies and seeing where they. Where they don't understand any of the vendors that are in that space, but it really does take a lot of time and energy to read.

13:36 You know, all the publications, check the vulnerabilities, talk with peers, go to the conferences and I think that's where the NSFB market, they can really rely well on having a fractional CTO, having the fractional cybersecurity officer. Because there's no way you can really afford somebody full time to do that. And that's really where the fractional is like kind of huge right now. Because the CEO, like some CEO's are really good at like learning that stuff for themselves, but they don't have time. They've got a lot of other aspects in the business to run. So when they can say she's somebody like that, hey, can you help me out with this and force.

14:22 Really, you know, small cost honestly as comparing to have so much full time on payroll doing that they can contract one of those fractional services and they can really save themselves a lot of time. So I think I think that is really the rise in that industry of that managed security side that fractional signs that a lot of SMP's need to take a look at and it was really what's at their disposal there. So they don't have to be afraid of it, they really don't because with the workforce issues that are out there, the A I is just amazing what it can do for you. But I also think on the other hand there's some risk that comes with that, not really sure what it's doing and some of these things are are going live and doing more and more things. I do think there's a lot of risks in what you have to consider as you know you can't just. Forget about it and walk away from it. You have to keep an eye on it and make sure you understand what it's doing.

15:21 It's just like having a new employee, kind of half you're going to on board that AI and make sure that you actually do it right. So that'll go back to my process. How do you want to board your AI? Yeah, made you mention ransomware. And of course, like everyone knows about ransomware and you know it's the number one, it's on the top of mind of every. I mean when we talk enterprise, it's top of mind of FPC, so even on the board level, but other than that somewhere like. Where do you see the biggest? Threats for businesses in general and because we've talked about small video businesses, what would be the other big threats currently? Yeah, I think there's a lot of fraud that goes out there. Just not even straight ransomware, but just on the fraud side of payment schemes and tying that with like employee complacency or employee poor communication. So I think if you don't have good communication with your employees, they don't know what is expected of them, they're more susceptible and you're more susceptible to fraud. And we we see that a lot where they don't even have to necessarily get hacked, just the employee 1 wired $50,000 to the wrong vendor or the the fake vendors. And that is such a huge risk that companies need to put more controls in place there and have

16:55 better communication with that staff that has access to those things to make sure they think twice about this is strange maybe as you call and verify. Before we actually send money to this vendor, we see that happen a lot, especially when you're busy with projects and you aren't really following what's actually being e-mail fraud is a really big piece of that and and that's probably the next risk after ransomware. Next. I really think that more companies are losing money that way. They just start reporting it as much as rates somewhere. Yeah, that makes sense. And just for the audience to to put some, I would say by observations, it's much easier for the hackers actually. Or let's say, let's say they are not hackers in this case, they are like bad actors.

17:50 It's much easier for them to grab you out of of your own area to somewhere else where they can do these frauds rather than just entering. It's of course they need to still do some more. They need to do social engineering to convince you to click that lane. But yeah, it's much easier for them because they don't have to cross any firewall, they don't have to cross any any like security measures. They just all what they need to convince you to go and click that lane, right. So 100% I agree with you Nate. Now. Like I want now to ask from a different perspective as a service provider yourself. So you are someone who help other customers protecting their data, making sure that everything is up and running the best way the processes that you mentioned, but of course yourself made you have to choose solutions. So I never asked this before and I really wonder about it. So when you want.

18:54 You know, like because cybersecurity is a very huge, saturated kind of space. Now if I knock on your door today and I'm telling you, I'm a cybersecurity vendor and I work with MSPs, so where would you give me 30 minutes of your time to listen? What would grab your attention in other way from an MSP perspective, what are your top priorities when it comes to selecting vendors? Wow. I I probably get a dozen or more emails a day from somebody trying to sell me some type of cybersecurity platform software that's going to save me or my company or my customers in Subway.

19:42 So it's very, very noisy. So I don't want to give up anybody too many ideas because I I so many sales people. I would say that a lot of these companies are not very personal at all. I get a ton of emails, I get a ton of calls and they really approach it in a lot of ways similar to how the the fraudsters approach it, where they try to trick my stats to get me on the phone because of course I have gatekeepers. You know, I've grown the company tool point works. I don't have to answer every single phone call and I'm in meetings and so they've got to take. The the time that goes through there, I will say those who have taken the time, I've actually had some vendors who will set up and meet me in person and say, hey, I'm going to be in your area and I'm actually going to come prove that I'm a real person and I really care about more business and that has really set it apart.

20:43 Give them 30 or 60 minutes of my time because it's such a noisy space and not one software is going to save it for me. But a lot of what I look at and how I choose vendors, we're looking at the culture of the company that we're working with, because I don't want them to be complacent. I want them to be really good and I want them to match my company's culture. So if they're going to talk to me, they're going to talk to my staff. We're going to really work through it together. It's just stop me making the decision because everybody's going to have to work with. It's going to be part of the light of our company. We're going to know a lot about it. But those who are really pouring into us, really working on making us better and helping us understand security and those things in place is really what's gonna be there. And there might be some really great companies out there that do that we're not working with yet or we haven't worked with because maybe our culture and their culture just haven't, we haven't matched up and so.

21:46 We go to a cybersecurity show and there's always 150 vendors in the room and they're all selling cybersecurity stuff. There's no way that anybody needs 150 cybersecurity vendors. It's just too confusing. There's too much crossover. And so we really have to look our threat landscape internally and try to keep that as a smaller package because it makes us less disorganized. There's less training to go through and trying to keep that into one or two or three buckets. Rather than 15 or 20 buckets because a lot of MSP's out there talking to some of the MSP owners have a lot of products they bought because they were shining and they never use them. And that's something I definitely want to keep down, to keep my costs down so that I can keep better pricing for my clients and actually pay my people better too because we have more cash on hand to be able to do that. Continuing on that, do you think we have a lot of high currency in the market?

22:46 I mean, do you agree with me that we have a lot of, as you said, noise from marketing perspective? Oh, absolutely. It's always this product is going to save you money. Or if you don't buy my product, like you're going to get hacked like you've been the shows and it's just like, Oh my gosh, if I'm going to hear one more time if I don't buy your products. I will be hacked. Like, I would just get up and leave the room. I'm just like, well, I'm going to go get some more food or something like go hang out in the hallway and network out. I'm kind of tired of that story. I think there's a lot of good things out there. Take the time to get to know me as a person or company, as a culture, and see if we're probably a great product. But just because I use your product doesn't mean that I won't get hacked because there's so much more to the story than your product.

23:38 Yeah. Let me add one thing. I myself, I work at vendor side back in the days. Right now I'm in, I have my own company, I'm a consultant by myself and let me tell everyone I hope like there are some people there. My old world depict days hearing me. And this is feedback not from me, it's from customers direct. Never ever come to me with a feeling. I mean fear, you know? Caring message. We don't like this Okay. We know that we have missing components today in our network. We got this. But if you got to come to me and tell me you I will be hacked if I don't buy your product, guess what? I will not buy your product.

24:23 I'll prefer to get. I've listened to this just two days back from a customer I was talking to and he said anyone nowadays who come with this messaging to me. I'm saying sorry, I don't care what you have. I don't care about your solution because you going to go go get fix your messaging first or really shape it in another way. As you said, show me what the profit would be, don't show me like I going to be had so they don't like it 100% agree with now. I agree so much. That's good. Yeah, so shifting gives a little bit. While I was preparing, I always try to find out a few things, so.

25:05 I see like you, you you talked about the relation between mental health and cybersecurity. I know it's a very you know, I I covered mental health, but it was not about cybersecurity. We covered just for tech people, for startup founders what you can tell us, you know, and especially for people who works in cybersecurity about the importance of mental health. Yeah, So I work with a lot of, you know, C-Suite executives, founders, CEO's, Cto's. And what I have found was there, they're really stressed out. There's a lot of things to know what's happening with a I what happens if I they have, they've got pressure from, you know, my boss or my board to save money here or not be hacked. And this thing is going on and it's really taxing on their mental health.

25:55 And so if you go to my website, trustthestory.com, how much free relates? Believe that the trust is what needs to be there. We become a trusted advisor and that really become a trusted consultant with them. And I've been shared with a lot of stories about just mental health struggles from these people about they are just so stressed out and it's so much more than that. And I say and this is my messaging to people, I'm saying I'm not the only one out there that does this, but I'm saying if you trust me. Let me take that off of your plate and you know that I can handle it and you can help focus on your mental health and take one extra sitting away from you.

26:40 There is a really high mental health like disparity in the C-Suite where people aren't taking care of themselves and if you aren't taking care of yourselves, then you aren't able to take care of the rest of your organization and you're really are able to do your job. But if you're in the text field. It's just really stressful because you have all these things coming at you you already probably have some challenges with like vendors telling you to be freaked out and scared of everything. So you're running scared and you're making decisions scared. Well really need to do is be able to slow down and say okay, I'm not going to do this out of a fear base thing which is not a healthy place.

27:21 Well let's do it out of a data let's do it out of a trust that for a say who are my trusted people around me and and put yourself. Into that that place of safety where you can actually start working and putting it together well. I really think it's so important to start with your own personal mental health and start working on that and helping you get to a better place. Because we make these reactionary decisions that damage ourselves personally and the business and we are not able to make good decisions because we really didn't put that. In front of and things. So it really does assess the organization more than anything else is to have that mental health in place. And we as an organization, my organization is really focused on helping people feel healthier in that way. And one way that we should do that, one aspect that we do is take that stress of cybersecurity out through play. Create insight.

28:17 Now the question I want to ask. Of course other than you know many people they. Say. I want to go and become a professional in cybersecurity, right? So in addition to the skills, of course they need to get to know how you know they need to go the trainings. But what other nontechnical skills you would advise someone who want to choose this carried path to have? You need to make sure. I think you should a personality test and you should have a high sense of empathy. If you can't empathize with people, understand where they're coming from, I don't think it's the career path for you. I think it's very, very important to care about people. And it's it's not that saying if you don't feel like you can counsel people, if you don't feel like you come alongside, if you don't feel like from time to time it's going to be up to you to give somebody a hug and say it's going to be all right. This isn't the career really for you. There's a lot of other great pieces in the 10th world that you can work in.

29:26 But in cybersecurity, a lot have to really be just a trustful, loving person because you're going to see some stuff happen and people are going to be at their worst and they're going to be really stressed out. And you can't take it personally and you have to say let's stop and listen and kind of grieve the loss that is your data center. That is all of your employee records. That is, yes, this is going to be expensive. Yes, we're going to have to call the attorneys. Yes, we're going to have to call the state authorities in here and we're going to have to work through some stuff. This is going to really be terrible today.

30:06 But let's take a minute and breathe and and get through it and really be that counselor with them. That is really the ultimate job in cybersecurity. That's the job that I personally do in my company. It's not an easy job and there's a lot of other pieces like if you don't have a high sense of empathy, I'm not saying that somebody couldn't be on my team, but it's probably not gonna be the frontline thing. I may have to go and fix the servers that they take with ransomware. That may be your job. So there are a lot of aspects to that field, but I think the more empathy you can have, the better off you're going to do in. The stage great advice again made as we are even coming to the end just something not related to technology is just something because you know again you you've done great job I I've seen you know some of the work I've done before So what advice you can give.

31:03 For someone who won't start their own businesses and how they can have the same success that you you. It's going to start your own business. I'm going to tell you it's it's not easy, but it's it doesn't has to be hard. You just need to 1st focus on the team that you want to build and you've got to actually take that jump. I should have taken the jump. Long before I took the jump on. And you may not be successful the first time. So this is my third try at doing this business, and I got told along the way, you know you can't do this. It's too expensive.

31:51 You're going to, you know you're not going to do well with it, and you have to push those voices aside. You need to find those people who are going to be your cheerleaders. And let them speak into your life. And you can't be afraid of failures, and failures aren't necessarily like going to kill your business. And even not having enough money doesn't kill your business. It's really about your mental stability. So I think anybody's going to start a business. The first point of action is, is go get a counselor and have somebody to talk to, whether it's professional counselor, whether it's your minister, whether it's your priest. Go talk to somebody, make sure you have somebody to just. Go talk to you on a regular basis. That's other than your spouse, because this could be really, really hard on your spouse and you can do it. But getting to that first year or two is going to be the hardest point because you really have to prove yourself to yourself and then you can continue to weather the challenges.

32:53 Because the matter at what point in business you're in, there's always going to be another challenge that comes along. You're going to have to overtime. So don't operate in here. You just, you have to wake up and say, oh, it's fun. And that's one of the things I love to do, I wake up every day is say, oh, there's these problems in my company, but I get to come into my company every single day and see that. So you just got to get up and do it. I don't have to. Sometimes I just wake up and I have to. I get to go to my company. That's what's important to me. I get to do this, I get to build this legacy. I get to help peoples. I am achieving the vision. That I set out the deal and nothing can replace that.

33:34 And so that's what you have to remind yourself of every single day. I would agree on the point of asking for help and I think we are living in a time which is, you know, I don't remember a time where it was so easy to reach people for help because I'm a little bit from all generations, I would say. At my time, LinkedIn when I was young, when kiddin wasn't there, you know a lot of of. These things weren't there. And. You know, but now you can as you said made. You can reach to someone who's subject matter expert in the business you're planning to start and just, you know reach out. Maybe you know someone close in your city, someone you know that you have met at the some conference or something and yeah go ask.

34:20 And people believe me they are always willing to help if you ask. So you just need to go and and ask. And I liked also you saying that remove the fear fact, no need to to steal, say I going to fail, what will happen? There's nothing called failure, just a learning experience. Now I have a famous question that I ask at the end and the question is what is the question you wish that I ask you, Nate. Oh, I would say, what do I do to kind of relax into a steps in the business? So I would say my favorite thing to do is I love being outdoors and so I'll make an offer to anybody who's listening to the podcast. If you're wanting to go kayaking with me, please reach out. There's all my social channels below. I'll take you on a kayak trip for the afternoon. It's one of my favorite things to do, especially in the summer. I live in the northern part of the US. But I can't be convinced to fly somewhere in the winter. So yeah, so that's what I do.

35:31 I think it's important that everybody find their thing to go do and get away from it all, turn off the phone and disconnect. 100% I thought that you know the I have to be on top of everything 24 by 7 I can't afford now I have for the ball. I think I it's one of the positive things about Pandemic that. You know, I changed my old habits and now I have a habit that during the weekend, you know, like I have times where my phone is away from me, Once a quarter I go at least one or two days again, somewhere far where no phone, no Internet, nothing. So this is very important, especially for people like us who work in deck, so 100%.

36:16 By the way, I would be putting the social media handles of Nate. So in that description if you want to connect with him. If someone in the US, I'm not sure. Do you offer outside of the US your services Nate by any chance? Yes. If anyone interested I would be putting also the website there, so if someone is interested to reach out to Nate, you can do so also as well. Yeah, and like we've wished that the end of this episode. I hope that you find that useful and informative As usual, and as I say at the end of each episode, if you have any question or feedback about this episode or the show in general, please don't hesitate to reach out to me.

37:00 You can find me on LinkedIn, on Twitter, you can send me an e-mail, and I'll be more than happy to answer you if you are interested to be a guest on the show. Also we can talk about it, we can discuss it and we can arrange for that as well. And don't forget, if you are listening the first time, subscribe to the podcast and if you are watching this on YouTube also you can subscribe to the channel. Tell your friends, tell your colleagues, tell your family who are trying really to get the best of the best here and make this podcast as much as knowledge rich and information rich as possible. Well, thank you very much. And until we meet the next episode, thank you. Thank you.

37:44 Hit that subscribe button, share the show with your tech savvy friends and fellow entrepreneurs and leave us a review on your favorite podcast app. Your support means the world to us.