From Solopreneurs to Small Firms: Why Cybersecurity Matters More Than Ever

Intro: Broadcasting live from the Business RadioX studios in Atlanta, Georgia. It’s time for Veterans Business Radio, brought to you by ATL Vets, providing the tools and support that help veteran owned businesses thrive. For more information, go to ATLVets.org. Now here’s your host.

Lee Kantor: Lee Kantor here another episode of Veterans Business Radio and this is gonna be a good one. But before we get started, it’s important to recognize our sponsor, ATL Vets, inspiring veterans to build their foundation of success and empowering them to become the backbone of society after the uniform. For more information, go to ATLvets.org. Today on the show we have Todd Mitchell, owner of Cybersecurity4biz LLC. Welcome.

Todd Mitchell: Well, thank you for having me.

Lee Kantor: Well, I’m excited to learn what you’re up to. Before we get too far into things, tell us about Cybersecurity4biz LLC. Who are you serving? How are you doing?

Todd Mitchell: Well, I, uh, I focus on cyber security for smaller businesses. Uh, I’m in that 0 to 10 employee space. So solopreneurs and small firms. And I found a niche. Back when I first got started, I realized that there was a huge gap in. Most cybersecurity companies won’t work with you unless you’re a major company with, like, 250 or 1000 or 10,000 employees. And it was really important to me to, uh, I guess my military background, you always have to have a mission. So that’s how I found my mission in life was to be the the little guy helping the little guy, so to speak.

Lee Kantor: So what’s your backstory? How’d you get involved with cyber security?

Todd Mitchell: Well, it’s kind of a long time coming, and I actually avoided it for many years. It’s kind of a funny story. So I’ve been a computer geek since high school. Not to give away too much about how old I am, but back in the late 70s, early 80s, Dungeons and Dragons came out and I was a huge fan of playing that game. And then they come up with a video game. Of course, back then video games were black screen with green writing. You know, the textual saying, you’re going through the woods and you see a monster, you know, a run, B scream, C hide, you know, fight whatever. And I wanted this video game really bad. Of course, you have to have a computer to play it on. And at that time, computers cost more than cars. So my dad’s like, yeah, no way. We’re buying an IBM computer just so he can play a video game. And I made a deal with everybody for Christmas presents instead of everybody giving me presents. They gave me money. And I went to RadioShack and bought a box full of parts. Came home and built my own computer. Um, and that kind of launched my computer geek ness. I had to learn how to program the thing because this was pre windows, and once What I did 20 years in the military and retired. And after that I was kind of looking for a second career. And computers was still something that I was very interested in. I’d been the local IT guy, fixing everything for everybody for years, and I got into cybersecurity and it just kind of went on from there.

Lee Kantor: Now, when you were in cybersecurity, you mentioned kind of the distinction where most from a business standpoint, most people look at cybersecurity for kind of the enterprise level organizations, the the ones with hundreds if not thousands of employees. But you felt it was important to serve kind of the the entrepreneur, the solopreneur, the small firms who probably think that cybersecurity is just installing, you know, some antivirus?

Todd Mitchell: Yes, definitely. Um, and that transition, what kind of really woke me up was I was actually working for the Marine Corps. Uh, I was the lead engineer in charge of software development for, uh, command and control the battlefield. All the software that helps with that. And cybersecurity was a huge piece of that, obviously, because, you know, the information secret where they’re at secret, all the stuff going on in secret. Uh, and then what happened was my best friend, who was a disc jockey, um, that I had known him since grade school, and he got hacked with a ransomware attack and lost all of his music. And he called me up in a panic, and he’s like, hey, you know, you got to find somebody to help me. So we started looking for cybersecurity companies that could help them. And that’s when I realized that all this, you know, if you Google cybersecurity companies, the first, you know, 7 or 8 pages of a Google search is nothing. All those companies are looking for fortune 500 companies. They’re all enterprise level and large business. And, uh, so we couldn’t find anybody. We finally found one that said Small business. And I called them and they’re like, oh, yeah, we love small business. You got to have at least 250 employees, 10 million in revenue. It’s like, oh my gosh, that’s not a small business. So I ended up helping my best friend, uh, in my spare time. Of course, I wasn’t getting paid. And, you know, it was all nights and weekends labor. And he kept poking at me, trying to get me to open my own business.

Todd Mitchell: And I was telling him that there wasn’t a big enough need. And then he started bringing people to me, one after the other. And after about 5 or 6 of them, I’m like, okay, maybe there is a thing here. So I dove head first, quit the corporate world, jumped in head first into, uh, owning my own business. And and so it’s been my my mission right from the beginning to, uh, help those solopreneurs that have no other resources available to them. And I do a lot with, uh, compliance. Um, and and, like you said, you know, a lot of, a lot of, uh, people think that, you know, having an antivirus is is all you really need. But, uh, 92% of data breaches are caused by human error. Uh, the days of, you know, like Hollywood likes to present, you know, where somebody in a black hoodie in her mom’s basement, clacking away on a keyboard for 12 hours to hack into you. That just rarely happens anymore. Uh, most most of the time, it’s our own, uh, bad habits. Sharing passwords, weak passwords, uh, not using multifactor authentication because it’s too inconvenient to have to look up that tax code every time you get into a website. Things like that are our worst enemies. So when I’m working with a company, I basically take a look at how they receive information, where do they store it, and take a deep dive into the business itself and see how we can effectively create a culture of cyber safe environment.

Lee Kantor: Now, you’ve been able to do this in a way that’s affordable for small business, because that’s usually the rub, right? That the reason the enterprise people are the ones that are so well served in this area is because they can afford it.

Todd Mitchell: Right? Definitely. And I think I have, um, based on, My client input. When I first started this, I was doing the typical consulting thing where you charge, you know, for however many hours of work you think it’s going to be and, you know, half up front, half when you’re done type of thing. And, you know, it comes out to be, you know, thousands of dollars worth of work and, and a lot of people couldn’t afford that. And one time it was actually kind of funny. I was watching TV and saw some ads for some iPhones around Christmas time about 2 or 3 years ago. And I’m in my head thinking, how can all these people, you know, all these broke people running around with $3,000 iPhones? I’m like, and then it hit me. I’m like, they take the price of the phone and spread it out over a contract. And I’m like, well, I can do that. So I kind of switched my my whole pricing model to a 24 month contract, which lets me divide out that cost over a 24 month payment plan and make it quite affordable. So now I’m more like another utility bill instead of a lifetime investment.

Lee Kantor: But it’s something that it doesn’t go away after 24 months, right? Like, isn’t this something that you need forever?

Todd Mitchell: Yeah. True. And the way I usually do it is that first 24 months we’re building a culture. And then a lot of that part once, once you have that culture in place, um, that’s a lot of the big work. And also as a follow on after after that 24 months, um, I usually drop the cost way down because now it’s kind of more in maintenance mode, and it’s just doing a monthly check in and making sure everything is still in place, and that reduces the cost way down.

Lee Kantor: So what has been the hardest part of serving this niche? Is it just an education standpoint or they think they’re too small? It’s not the they’ll never be hacked.

Todd Mitchell: Um, I think one of the hardest obstacles I have is not necessarily, um, it’s more of just letting people know that there is an option for them out there. They get disgruntled, you know, all the big cybersecurity companies that you would recognize the names of, you know, IBM, Cisco, Trend Micro, Bitdefender, you know, all these big companies. They are unaffordable and or won’t even work with somebody that small if you don’t have a thousand employees or something. And so I think my biggest obstacle is just letting people understand that, hey, there is other options. There’s people like me out there that will work with you, and it won’t charge you enterprise level rates and only give you what you really need because it is a it’s the same cybersecurity, but it’s slightly different. If you have a big company and you have an IT closet and you have servers and you have switches and routers and firewalls, you know, all these things, you need different software to run that kind of stuff. When you’re working on your dining room table with a laptop in your home router, you don’t need any of that. But you do still have security risks because you got your kid the next bedroom over. Playing on a PlayStation that hasn’t had a security patch since he bought it. You’ve got your ring doorbells and your refrigerators and everything else hooked up to your network that’s on the same network as your work computer, and none of that stuff has any security in it at all. So if somebody hacks through there, you know, so it’s it’s just different. It’s it’s um, and that’s a lot of what I educate people on is what, what they can do, uh, free, cheap and easy. Uh, it takes a little elbow grease and be able to make themselves a lot safer just by changing some of the the way they do some things.

Lee Kantor: Now, any advice for the folks who are the small guys out there that are using maybe their phone as their main kind of device? They may not even be using a laptop or a desktop that everything’s happening through their phone or through cloud services.

Todd Mitchell: And, and with those types of, uh, individuals is still almost basically the same story. You know, uh, if everything you do is stored in a cloud, um, I would say, first of all, you still need to back up some of that because what happens if they go away, you know, and people tell me, well, you know, Google’s too big to fail. Well, they thought that about Kmart and Sears for decades, too. And where are they at? Um, so I would always keep a local copy, um, whether it’s on your phone or it’s on an external hard drive. And the other thing about those devices is it’s it’s slightly different, but you can still get security software like antivirus or anti ransomware things. Um, you still have to do the same types of protocols of making sure your data is encrypted so that if your phone gets left behind somewhere and somebody picks it up, they can’t, you know, make sure there’s a good, strong password to get into it. Make sure that everything on it’s encrypted so they can’t just pull all the files off of there. Uh, so there’s still those same types of things still apply.

Lee Kantor: And it’s one of those things, like you said, that if you do some of these fundamentals right, then that’s that’s the bulk of it. Now it becomes maintenance.

Todd Mitchell: Right. And I mean, it’s kind of a funny analogy, but it’s also very applicable, I think. Uh, you know, this is like the bear, you know? You don’t have to run faster than the bear. Just run faster than the guy next to you. If you do all the the basic cybersecurity, uh, um, best practices, and you’re going to be harder to get into and they’re going to give up and go find somebody else that’s not doing that stuff.

Lee Kantor: So that that’s how this is working, right? Like, like you mentioned, it’s not that kid in the basement anymore, but maybe it’s a nation state or it’s organizations that are doing this like their job, like they’re walking into rooms and they’re have whiteboards and they’re kind of, uh, engineering some strategies to get into computers.

Todd Mitchell: And a lot of it’s automated. I mean, it’s just like a business owner, right? When, when, uh, you know, I’m not a marketing expert, but I know some of the basics. When you when you’re marketing, you do email campaigns, any email address you can get a hold of, and you send them an email. And if they click on it and open it and they’re interested, you know, type of thing, then you follow up with better emails and things. The bad guys are doing the same thing. That’s what phishing is. I don’t need to target you specifically. I can send out some Viagra ad or whatever the heck it is and blast 10 million people with it. And if half of them click on that thing and I can download ransomware onto their computers, then it’s a win. And I didn’t have to target any specific individual.

Lee Kantor: Right. So they’re doing it kind of at scale. And they just hoping for that kind of lucky break that goes their way or the person that’s not prepared.

Todd Mitchell: Yeah. Because you never know when somebody’s clicking on a phishing attack and they get malware downloaded onto the computer that’s going to search their inbox. You don’t know if it’s a grandma that doesn’t do anything but check, you know, check your email once a month and look at pictures of the grandkids. Or if it’s the secretary at IBM with 10 million, you know, 10 million customers in their database. You know, and sometimes they get lucky. And that’s all it takes is one, one, uh, one bad. Uh, decision or, you know, one. Um, I don’t want to say bad decision. I guess that’s probably a bad way of saying it, but, you know, one wrong move by an employee, uh, and your whole company is at, uh, vulnerable.

Lee Kantor: So what? Uh, let’s give some advice to folks listening. Is there some low hanging fruit a person could do right now? Or in a few clicks that can, you know, protect them a bit?

Todd Mitchell: Yeah, definitely. Um, I’ll go on my soapbox for a second. Multifactor authentication. That is the single biggest thing that can help you, in my opinion. Um, I look at it this way. If for some reason just hypothetical your username and password for your bank account gets out there and it’s published and everybody knows it now, right? There’s 3 billion people on this planet with internet access that can hack into your bank account. If you use multifactor authentication, they got to send you a text code. Now you have like 5 or 6 people that can get access to you and your phone at the same time. So you literally just took your attack surface from 3 billion down to a handful. It is the single most effective thing I know. It’s a pain to have to punch in that six digit code or five digit code every time you get into a website or whatever. But, uh, your bank is going to force you to use it because of their laws. But all your social media, all your utility bills, your work accounts, your email accounts, all that offers multifactor authentication. And I encourage everybody, whether they’re business owners or, you know, forcing the people in their families, whatever. But everybody should be using multi-factor authentication on every possible account, because it really it’s like a deadbolt lock. It’s already on your front door. Why aren’t you using it now?

Lee Kantor: How do you recommend the business people who are kind of relying on remote workers to be maybe their virtual assistant or they’re, you know, they’re helping them in some manner and it’s just, you know, that you want to give everybody the access they need to get to what they need to get to, to do the work to help you grow your business. But you don’t want to be put yourself at risk.

Todd Mitchell: So in those types of cases, uh, I, I would say in most cases it’s possible sometimes it may be a little bit more difficult to arrange, but try to set them up on an admin account, um, where they have their own access. So they have their own username and password they’re using, like for an example like Facebook. You can do that, right? You have your own Facebook page, but you can assign admin to somebody else and let them go in and post for you. And that way if something happens, they’re not they don’t actually know your own password. And if something happens to that relationship and you want to cut them off, you can just go in there and uncheck the box and they no longer have access. So I would say that’s the way to do it for most of your accounts, um, giving them their own access that you can revoke if you want to, uh, as opposed to sharing passwords with people, because that’s really not a good way to do it, because not only do you not know what they’re going to be doing with that password, but if something goes wrong, you can’t If everybody, you know, if you had three people logging into your bank account as you the bank’s never going to know if it was you or not that actually did it. So it’s, you know, you have no you have no audit trail to prove who was in there and when, where if everybody has their own login, then you know exactly who was in there at that time.

Lee Kantor: Now when a new customer comes to you, is it usually because something bad has happened or are they being proactive?

Todd Mitchell: Uh, a lot of my customers are being proactive. I have a lot of clients that are in the financial industry, in the healthcare industry, because they have federal regulations telling them how they have to secure your financial information for all their customers or, you know, your patient files for all the healthcare industry. So a lot of those a lot of those types of businesses know they have to have security. They just don’t know exactly what that means or how to do it. But they know they got to have it. And those are the ones that reach out to me the most. I do have other types of customers, just general businesses that want to beef up their security. Um, I have individuals. I, um, you know, I call it my, uh, my, my crazy stalker ex is ruining my life type of thing. Um, you know where they’re they’re looking for, uh, a little extra protections. And so I work with just about anybody. I’m a kind of. Take a look at what they need and how to do it.

Lee Kantor: But the ideal customer sounds like, are those ones that have compliance, like healthcare or finance?

Todd Mitchell: Yeah, those are the ones that mainly got me into this business in the first place, because people who had a specific need. Um, but the more generic answer to your question, I guess, is I have I deal more in the prevention side. So I’d much rather have a client that I helped get safe in the first place than have the ones hit me up after they’ve already, uh, encountered something, because now it’s, uh, it’s a big, uh, mess that you have to clean up first, and then you got to try to get them safe so it doesn’t happen again.

Lee Kantor: Yeah. So you’d rather I not mail you my, uh, laptop with the, uh, the ransom attack on it?

Todd Mitchell: Exactly. Yeah, it’s it’s one of those, uh, you know, that that old saying an ounce of prevention is worth a pound of cure, and the cost of setting your business up to be safe is way less than the cost of forensics, of figuring out what happened and how and making, uh, you know, and cleaning up the mess.

Lee Kantor: Yeah. And it sounds like once they start working with you, you give them kind of that peace of mind that look, as long as we do what he said, then we’re going to be okay here.

Todd Mitchell: Yeah. For the most part, I’ve, I’ve had, uh, I’ve been working now, uh, I think I’m in what my a little over six years and, uh, I’ve got over 100 devices that I’m monitoring at any given time. And, uh, knock on wood, nobody’s been hacked yet. I’ve had a couple of people who had trouble with their website, but that was something outside the scope of what we were doing. Um, and I’m actually looking at how to, how to, how to fix that so that I can help them with their website security as well.

Lee Kantor: So but that’s a case where if people think like, oh, I think I’ve been hacked, you can assess like, no, you just have a computer problem. Like you can tell the difference, right?

Todd Mitchell: Yeah, yeah, I can go in there and look and find, uh, find out exactly what happened. It’s much, much easier for me to do that if there’s somebody who is already a client because I have software on their computers that will tell me if anything is happening or after the fact, it’s a little bit harder to find it. But, uh, yeah, definitely can go in there and see exactly what’s going on and find out if it’s, you know, if you actually have something on your computer that’s doing it, or did somebody just get your, your, your username and password and get into your account without you knowing about it? Uh, type of thing.

Lee Kantor: And then, um, it sounds like no business is too small for you. You want the small guy?

Todd Mitchell: Yeah. Basically, I think 75% of my clients are solopreneurs working from home on uh, on their with some of them have an office or a spare bedroom or whatever. But about 75% of my clients work from home with no other employees.

Lee Kantor: Well, Todd, if somebody wants to learn more, where should they go? What’s a website? What’s the best way to connect?

Todd Mitchell: Uh, so my website is cybersecurity for for biz. And that’s with the number four. Uh, com and uh, I’ve got, uh, a contact page on there. They can hit me up with questions, or they can sign up for a free, uh, assessment. We can have an hour to to talk. About what? You know, what they’ve got going on and, uh, what they’re looking for, and I’ll see if I can help them.

Lee Kantor: Well, Todd, thank you so much for sharing your story today. You’re doing such important work, and we appreciate you.

Todd Mitchell: Well, thank you for the opportunity.

Lee Kantor: All right. This is Lee Kantor. We’ll see you all next time on Veterans Business Radio.