Q: It seems like there have been increased cyberattacks in recent years, including the Colonial Pipeline ransomware attack that happened earlier this year. What would you say are currently the biggest threats to cybersecurity, and how can organizations and individuals best protect themselves against those?

A: There has definitely been an increase of ransomware attacks over the last two years with more people working remotely. A ransomware attack is exactly what happened with Colonial Pipeline -- where a cybercriminal or a group of cybercriminals will hack into an organization's network, hold the data hostage and then request a particular ransom. But whether it's ransomware or another type of malware attack, cybercriminals can gain access to company and personal networks through phishing and social engineering. To further break it down, they will either send a text message, a direct message on social media, a social media invite or an email that looks like it's from a legitimate source and the whole goal is to get you to click on a link or download a photo or attachment. Once you do that, they'll be able to gain access to your devices and network, and they can then track your movements, such as keystroke logging.

For companies and individuals to protect themselves against this, it goes back to security training and security awareness. It is important for individuals to know how to better protect themselves by implementing security best practices. For social media, don’t accept invitations from people you don't know. We’re even seeing that on LinkedIn -- people will have on their profile that they work at a certain company, but they don't have any connections or any other links on their profile. They just want to connect to employees at certain companies to get information, which is social engineering. If that happens to you, go into the employee directory to see if this person actually works for your company. Also, don’t post too much personal information on social media because cybercriminals can triangulate personal information such as your pet’s name, your kid’s name, where you went to school or where you were born to potentially answer security questions.

Lastly, it’s important to remember that anything can be breached -- that's the overarching philosophy that cybersecurity operates from. Cybersecurity is all about minimizing risk, not eliminating it altogether because that is impossible. So use passphrases instead of passwords, which are harder for cybercriminals to crack. Also, when you operate with the mindset that anything can be breached, you're going to be naturally careful and cautious with where you enter your email address online or what credit cards you use digitally. It’s all about protecting your information, because ultimately information is the gatekeeper of your personal, or company, assets.

Q: Considering how early kids start using technology now, what do you think is the ideal time to begin educating youth about cybersecurity, and what precautions should parents and schools take before handing over devices to children?

A: I think it's so awesome that children know how to use iPads or know how to go to YouTube and find their favorite show. But if they're already doing that, it's best to start educating them about security awareness at a young age. If minors do have a Snapchat or TikTok, talk to them about what they should and should not be posting about themselves, their friends and their families. Not only will that protect their information, it also will protect them from predators. We've seen in the news, most famously with Instagram recently, that many social media companies do not have a lot of safeguards and protections for minors on their platforms. So, it really falls to the parents to educate their children about security best practices and how to protect themselves online.

Q: I’m imagining as an expert in cybersecurity, you often have to enter the mindset of a cybercriminal in order to devise ways to thwart them. How difficult is it to do that?

A: You do have to put yourself in the mind of a cybercriminal because then you're going to be hypervigilant and better able to protect yourself. I've always been like that — I have a unique last name, so growing up my parents always emphasized, ‘Be careful about what you post,’ When it comes to thwarting phishing attempts, I don't open emails if I don't recognize the sender. I immediately block calls that I don't recognize and there's even a feature on iPhones now where you can immediately send any number to voicemail that you don't have saved in your contacts. If I get email spam, I send it straight to the junk folder and don't even unsubscribe because sometimes it’s a phishing email, and when you click unsubscribe, they’ve just confirmed your email address is active.