29. Greg Hoffman: "Helping individuals & companies solve problems with their security & compliance vulnerabilities"

Rather read?

Greg Hoffman: Well, that's a good question. Sierra. 

To give you a little background on Bellhops, that's a moving company designed for students. I helped start-up and manage the Hawaii branch while I was at the University of Hawaii. 

The great thing about this service is that it's based on convenience. Students are very busy, and they can't always work all the time. The beauty of Bellhops is that it allows students and those moving to pick and choose the times that work best for their busy schedules. It all comes down to helping people and convenience. 

Today, I'm a senior enterprise account executive at Paubox, a fancy way of saying that I'm a sales guy. I spend most of my time helping individuals and companies uncover and solve their security and compliance vulnerabilities. 

So whether you're moving furniture or you're securing the transmission of sensitive data, at the end of the day, it all comes back down to helping people and convenience.

Greg: That's an interesting story. The short answer is a lot of hard work and a little bit of luck. 

I met our fearless CEO and founder, Hoala Greevy, through an internship while I was at the University of Hawaii. That internship actually snowballed into another internship with a company called PauSpam, which was the first Hawaiian spam protection company in Hawaii. 

Now to clarify, we're talking about email spam. Although, you know, Hawaiians do love eating their spam as well. 

As a side note, in Hawaiian, “pau” actually means done or finished. So the name PauSpam means “done with spam.”

While interning with PauSpam, we had a customer you may have heard of called Make Wish Foundation. Hoala built Paubox for the Hawaiian chapter. They grant more wishes than any other chapter because everyone wants to go to Hawaii. They had a tremendous need for an easier way to send and receive sensitive data, like protected health information.

After developing Paubox for Make a Wish, we realized there's a massive demand for this service type. 

Long story short, we ended up moving the company from Hawaii to San Francisco. In the early days, we figured out that I was inherently decent at building, maintaining customer relationships,

What I love to do is help customers solve their email security and compliance problems. The rest is history.

Greg: Healthcare has always really been behind the times when it comes to technology. That seems pretty wild because healthcare is one of those industries that affect us all.  

The thing about this thing called life that everyone who's tuning in to this podcast shares is that, unfortunately, none of us are going to get out of this life alive. We all have an expiration date. 

So, why are we not putting the most innovative technologies to work in healthcare? 

Sometimes, innovation happens, but many times true innovation is impaired by humans being stubborn and slow to adopt change, along with the long red tape of HIPAA regulations put in place by HHS. 

HIPAA mandates how you can handle data like protected health information, which is is a good thing for the patient. Sometimes HIPAA regulations can slow down the way that data is transmitted and processes are handled. 

For example, if you look at that ancient hunk of technology sitting in all healthcare offices today.

Greg: You may not know this, but the fax machine dates back to 1843. That's well over 150 years ago, and we're still using that today.

Greg: Yeah, it's pretty bizarre. 

To get back to your question, I'm passionate about helping healthcare communicate more securely and freely because we're talking about the transmission of vital medical history, patient conditions, and ultimately, life and death. Right? Paubox is literally helping save lives.

Greg: That is an interesting question. There are a ton of things that you can do.  I read a blog post recently that outlined this very well. 

The five top things that you should do are number one move from complex passwords to phrases. It's a common misconception that changing your passwords constantly is more secure, but actually, changing your password all the time can introduce its own security vulnerabilities. The length and unique pattern of your passphrase will increase your level of security of your passwords. You won't have to update them so frequently. 

Number two, you can add and update passwords on internet-connected devices. You need to secure the things that you can. So, control the things that you can control. 

Number three, use a virtual private network (VPN).

Number four, set up a guest network. This will keep you safe from security vulnerabilities from a guest that comes over to your house. 

Greg: You're also going to want to make sure that that's password-protected as well.

Greg: Good call. 

Number five, restrict administrative access on your devices. You don't want all of your employees at home to have admin access. The less admin access that you have out there, the more secure you are.

Greg: The top things that I'm seeing from our customers as far as security vulnerabilities, actually are themselves. 

Unfortunately, the most significant security issue is the human element, and hackers know this. That's why they target employees. Whether they are merely making a mistake or acting out of ignorance, the human being is the weakest link.

Greg: I believe that we're going to see an increase in the display name spoofing, phishing, and farming attacks. If you aren’t familiar with display name spoofing or phishing attacks, hackers are impersonating key employees within an organization, such as a CEO or CFO. 

What happens is, these cybercriminals are using a generic Gmail, AOL, or Yahoo! email address and change the display name on the email to match one of these key employees. Then they email an employee and use their fake authority to establish urgency and demand sensitive data or even money be sent to them. Employees without actually looking beyond the display name or checking the email address will go ahead and comply because they don't want to upset their boss.

These are so effective because it's really easy to do, and it's tough to catch. Since 2019, this has been the number one type of phishing attack. 

I would keep an eye out for this one. I think we're going to see a lot more of these types of attacks.

Greg: The second point, on farming attacks, is something that we've seen a lot more of. It works the same way. 

A hacker is going to purchase a domain name that's remarkably similar to an existing domain name. When someone goes to plug in a website name, maybe they have fat fingers, or they just put it in a typo there or misspell it only slightly, the user is redirected to a different website that looks similar. 

That's where they farm your data. You give them your data by plugging into a contact form, filling out credit card information, or whatever it may be. 

With Black Friday right around the corner and Cyber Monday following shortly after, we're going to see an overall spike in cyberattacks. It happens every time. 

Tall the listeners out there, definitely be careful when you're doing your at-home shopping.

Greg: I think that HIPAA is going to become even more heavily regulated. 

If you take a look at protected health information and its value on the black market, there is a reason why these hackers are going after your medical records. They can fill out false claims. It's really difficult to change your social security number. You can change your credit card number. 

I think that as cybercriminals continue to go after this data, HIPAA is going to kick in more regulations. We're looking at heavier restrictions going forward.

Greg: Podcasts, absolutely. My favorite podcast is, I don’t know if you have heard of it, the HIPAA Critical Podcast. That's a great one.

Greg: That's my number one for sure. I listened to CISO Talks, that's a great one, and CISO to CISO Cybersecurity. 

Greg: I would say that I enjoy hiking, camping, snowboarding, and going to the beach. Luckily, these days I'm living right on the beach. I took advantage of this remote work situation. 

In a few weeks, I'm going to be doing a 35-mile hike on Catalina. I'm looking forward to unplugging for a few days.

Greg: A couple of buddies. 

Greg: My pleasure. Thanks for having me. I hope it was educational.