SPEAKER_00 0:00

Welcome back to BCX Connects. This is our part two uh Black Friday podcast. Uh today we're gonna be focusing around you know the boardroom meeting the the bargain the bargain bin. Um today uh with me I've got my my colleague uh Chris Um who's gonna be joining us with his ever watchful eye on consumer behavior. And um my name is Hareth Piek, I am the managing executive for cybersecurity. So Chris, today I think uh we're not gonna be talking about um your your spouse's 3 a.m. online shopping spree. Um we we we talk about you, the enterprise, yeah, you know, um the digital fortress

Bargain Hunter's Playground

SPEAKER_00 0:49

that suddenly becomes the the bargain hunter's playground on Black Friday. Um so Black Friday is a big focus for us because we know the behavioral elements of how people um you know shop, etc., and the carelessness of how they shop, and we discussed this in our previous podcast. But why black why why does Black Friday break brains and systems? So I think we know and we've spoken about this how humans are wired um to for scarcity and that dopamine hit. Um that's correct, adding that flashing limited stock um uh sign, you know, it it it it it it uh it changes the rational buyer to become a risk taker. I think uh when when we see some of the studies, studies are showing you know 73% of people admit that uh you know they bought something online during Black Friday that they didn't plan to buy, and you mentioned this clearly in in uh part one of our podcast. Half of those made their purchases um on on a work device, which is the big uh big risk.

SPEAKER_01 1:55

And and that is that is correct. I mean, if you think about I mean in the US, um but most people are actually on holiday, it's Thanksgiving, yes, during the Black Friday sales, but the rest of the world not, and specifically not here in South Africa. No, we people sitting in the office.

SPEAKER_00 2:12

Correct, correct. So it's not just an HR problem, it's a it's a it's a it becomes a cybersecurity nightmare. This is when employees click buy now and they often skip the think later. Um, you know, fake e-commerce uh link using the corporate uh device. Um, you know, they're going to clone payment pages, you know, there's the malicious order tracking links that they're clicking on, that uh QR codes that they're scanning, etc. So cybercriminals are exploiting that FOMO economy better than most marketing people are, and this is what is opening up the threat to the corporate space as well.

SPEAKER_01 2:52

And the landscape just opens up widely, you know, for your threat actors to to find ways into the corporate space.

SPEAKER_00 2:59

Because if you think about it, many uh people are using mobile phones, and they use their mobile phones for both corporate and private use. And they use their the mobile device for some of those purchases as well, right? So the mobile device could be that uh attack vector that gets exploited as well.

SPEAKER_01 3:22

Yeah, that's that's true. I mean, no, we all think, yeah, if you think about your your um uh business uh side, you know, people using their their uh work laptop or something like that. But I think more and more so is the is the actual handheld phone or the the handheld devices that is used for these uh purchases. Yeah, and that's that's a yeah, the bring your own device screen.

SPEAKER_00 3:46

Bring your own device condom, yeah.

SPEAKER_01 3:48

It opens up that attack vector

Threats in Enterprise Environment

SPEAKER_01 3:50

widely as well.

SPEAKER_00 3:51

So I think how the threats play out in the enterprise environments, you know, um it's it's still very much you know that same threat landscape, you know. You know the fishing frenzy. So threat actors, they they copy they they copy popular Black Friday campaigns targeting corporate inboxes, right? Yeah. Uh get 70% off your 40 net licenses. I'll just use a silly example, you know. Um, but until it isn't. Until it isn't, yes. Uh credential harvesting, that is still there. You know, the employees reuse personal passwords once once compromised those same credentials, open VPNs, cloud dashboards, CRM systems. Interesting thing. So um I um know somebody that uh did they had to do some investigation on the dark web with regards to exploring whether any of their company information is sitting on the dark web. And they did a scrape and they they pulled out the whole database of their company information, and it basically had all the usernames, um sorry, the uh like the the domain names and a password that was listed on the dark web. They they verified and said, okay, these some of these users don't work in the in the environment anymore, but there's a psychological element to that because what they found is that all of those users were using their corporate uh credentials to subscribe on third-party sites. Now, yeah, now third-party site, you know, you you log on and you create a password called Chris Bester123. Psychologically, there's a chance that you're probably using that same password in your corporate space somewhere. And those are also elements that that that get exploited. So now they they know Chris Bester works at at uh Company X, you know, and uh because he likes to use his wife's name, his dog's name, or his mother-in-law's name as his password, you know, and they build that pattern.

SPEAKER_01 5:50

That's correct. I mean, especially even the the the big culprit here is LinkedIn. Yeah, yeah, exactly. So don't use your corporate credentials for yeah, but I mean, but this is like are we talking from a retail perspective?

SPEAKER_00 6:03

People are using that uh um on shopping.

SPEAKER_01 6:05

But but the that's the thing when we mentioned uh LinkedIn, but that's it that's that's an entry point. That's an attack vector. That's this uh part of the information that they scrape with AI to build your social profile to target you, yeah.

SPEAKER_00 6:21

And then also you have the the the the shadow IT sprawl, right now. So there's been instances of where staff members install coupon extensions um or price trackers. This is very prevalent in the US. So they um it's an it's a neat way to give uh um you know uh attackers persistence uh um uh view inside your browser. Yeah, you know. Um so there's a lot of bot storms, uh there's um you know the the the fraudulent traffic spikes, you know, one major retailer reported over um 12 billion bot requests on uh Black Friday in 2023. Wow. You know, so so so you know drowning real users, you know, enforcing you know uh emergency scaling. So it's it's it does have an impact on that corporate space as well. Because like the consumer is a target on Black Friday, so is many of the corporate in uh customers as well, right? The ones that's hosting the environments, the ones that's you know selling the solutions.

SPEAKER_01 7:22

I mean the consumer is I think the uh the first sort of um hurdle he wants to get the first target, I mean let's be called the first target, but there's always a hope for this criminal to get the second target from that information that once once you've targeted the user on the on the you know on a retail space that he can extend that information into this corporate space.

SPEAKER_00 7:50

And we and if you recall in our uh episode one, you know, we we spoke about the psychology of the Black Friday brain, you know. Behavioral economists call it temporal discounting, you know. So your brain overvalues immediate rewards and ignores long-term risk. That's that's that's how how they put it. So that fear of missing out overrides policy training, uh, dopamine spikes reduce critical thinking, and everyone else is doing normalizes uh unsafe clicking behavior. So when an employee uses a fake um or an employee sees a fake um exclusive staff deal in the inbox, their brain risks centrally, the center uh literally shuts down for a few milliseconds. You know, there's a psychological study about this. So but the business impact is is big because when personal risk becomes a corporate loss, that is where um enterprise customers feel it, right? I mean, if we talk numbers, the aver the average amount of ransom we attack costs enterprises, and this is according to IBM in 2024, around 5.3 million dollars. Right? Um, Black Friday week sees a 45% increase in phishing campaigns, and one in three data breaches begin with a compromise personal credential used inside a corporate system, which could have emanated from a Black Friday sale exactly. So you can patch your servers, but you can't patch curiosity or discount uh uh driven um dopamine rush. Uh you know, you can't patch common sense. You can't patch

Best Practices for Enterprises

SPEAKER_00 9:33

common sense exactly. So I think we talk about some best practices. Um, you know, you know we you need to treat Black Friday like a red alert. Very much so. If you know your guard needs to be up. If IT calls for a change freeze, it's not because they hate joy, you know, it's because one impulsive click can take down a weekend's um uh can take down an entire weektime, weekdays uptime, you know. Exactly. So blocking shopping sites on corporate networks, you know, it's it's it's important. I think it's very important. I mean, if your team protests, tell them uh it's an employee productivity optimization exercise. I think uh that's one way of getting around it. I think enforcement of MFA and password vaults. We've spoken about this in our previous podcast. You know, your firewall doesn't care if you if the breach came from the cute um pink coffee mug site that you you saw, you know what I mean? Um you know the running of live fishing simulations is really really important, you know. Um, this is something that many, many organizations are putting a lot of weight behind. Uh, you know, so bonus points if your fake campaign says Cyber Monday security discounts, click here to upgrade your your firewall for 80% off. At the end of the day, it's still around the whole education. So we we we we drill down the fact of you know, educate, don't alienate, um, you know, show employees how personal safety still links to business safety. Because if they protect themselves, they will ultimately protect the brand.

SPEAKER_01 11:12

Exactly. That is that's very true. I mean, you um, you know, you have to be just so careful and and and and be uh vigilant, yeah. Um, you know, looking at what's coming into your inbox, in your corporate inbox. Look at look at those things with uh with a bit of a scrutiny, you know. Look at look at it and and don't just say oh just oh it's it's from this or that vendor or whatever, because especially we in the IT space, we get those mails. I mean I get uh 10, 12 a day just from our uh our vendors. Correct. And um or is it really your vendors? That's that's the thing. You have to scrutinize that emails and say, okay, is it really from this vendor or from that vendor? Exactly. Um and and and if the the the red flag is if you open that mail and the vendor offers you something, yeah. So I think uh then then have a look. Especially if it's if that offer is directed at you as a person, not at the corporate. Yeah, yeah. So look at the look for look for those things here.

SPEAKER_00 12:15

So so one thing I'd I'd like to just go back to, right? So there's uh there's this link between the human and enterprise connection. So and here's the twist: the line between consumer and employee has vanished, right? So the same phone, like we mentioned at the beginning, you know, that same phone used to buy the you know, the outfit or the sneakers, you know, is used to approve payments internally, you know. Um the same browser session that checks discount codes opens up SharePoint. Exactly. Yeah, so security must now follow identity, not devices. So zero trust isn't just the buzzword, you know, it's that survival strategy. So when you adopt continuous verification, I think that is still that's still gonna be the key. So every access uh request must be checked, every identity must be authenticated. You you neutralize the big variable, you know, the the human impulse. So that's that's the only way around that.

SPEAKER_01 13:12

I mean, I I'm glad you mentioned the the whole thing about identity cracking. I mean it it's not about the device you're using, it's about your identity on that device. Yeah, it is it that that's the target. The the device is a piece of plastic, yeah, you know, for for for for better or what. But um yeah, that identity is the target for your cyber criminals.

SPEAKER_00 13:36

Yeah, and then if you look at it from a macro view perspective, you know, globally online spending, you know, you get 9.8 billion, you know, on Black Friday in 2024, right? And at 7.5% year on year, so that the attack volumes are up by 52%, etc. So most campaigns begin targeting supply chains, not just the end users. Now, criminals know if they compromise a vendor or payment processor during the chaos, they they can gain the keys to hundreds of corporate network. Exactly. You know, so consumers chase the discounts and cyber teams, you know, chase the logs, essentially. But if we wrap this up, you know, the the cyber paradox, you know, Black Friday is is like a global fishing festival, right? With free entry. So the the one day when you when you see if or even might even click on on that fake deal um for that wireless airbuds. You know, so the model of the story

Cyber Hygiene Factors

SPEAKER_00 14:35

is uh, you know, cyber hygiene doesn't take holidays. You know, like you mentioned, it's it's Thanksgiving in the US. No, it's not Thanksgiving year for us, but your business treats Black Friday like IT party instead of a um you know, instead of a security operation, you know. So I think at the end of the day, we need to still remember that whatever risks we are taking in the consumer space can have an impact in the enterprise space. Exactly. So wrapping up, I think um this uh this was an interesting, very different uh um topic uh because uh to our usual cyber discussions. Um but uh it's a very interesting attack vector. And uh thank you very much for for your participation. I really appreciate it. And um to our listeners, thank you very much. Stay safe, stay skeptical, and remember the only thing that you should uh that that should be 80% off um this week is your attack, um, you know, your attack surface. So uh yeah, let's just reduce that attack surface.