Unspoken Security Ep 26: Let’s Talk about Executive Protection Intelligence

Summary

Highlights

• The fusion of physical and cyber security is essential for modern executive protection. 🔄
• Device security and the use of burner devices are vital for safe travel in high-risk regions. 📱
• It's important to think beyond the executive—assistants and family can be weak links in security. 🔗
• Building a strong relationship with the executive and their circle is crucial for program success. 👫
• Real-life security scenarios often mirror Hollywood thrillers, making vigilance crucial. 🎥

Key Takeaways

• Executive protection requires a blend of physical and cyber security—think of it as a security cocktail! 🍸
• High-value targets aren't just CEOs; think assistants, domain admins, and even family members. 👨‍👩‍👧‍👦
• Device security is crucial, especially when traveling to regions known for cyber espionage. 🔐
• Building trust with executives and their inner circle is key to a robust security program. 💬
• War stories are not just movie plots—they often reflect real and sobering security challenges. 🎬

Overview

Chapters

• 00:00 - 02:00: Introduction to Executive Protection Intelligence This chapter discusses the crucial convergence of physical security and cybersecurity in the realm of executive protection intelligence. It emphasizes the importance of integrating these domains, focusing particularly on the security of devices as part of a comprehensive security strategy. The discussion sets the stage for understanding the complex challenges faced by security professionals today, aiming to enhance the safety and security of individuals within their care.
• 02:00 - 03:00: AJ Nash Introduction and Personal Background The chapter introduces AJ Nash, host of a show focused on topics such as intelligence-driven security risks, digital threats, corporate culture, leadership, and global events. AJ Nash engages with industry experts to discuss current trends, share insights, and confront truths within the security industry.
• 03:00 - 04:00: Podcast Format and Guest Introduction In this chapter, the host AJ Nash introduces the podcast 'Unspoken Security'. He shares his extensive background with 19 years in the intelligence community, primarily at the NSA, and his experience in developing intelligence programs in the private sector for almost a decade. AJ expresses his passion for intelligence, security, public speaking, mentoring, and teaching. Additionally, he reveals that he holds a master's degree in organizational leadership from Gonzaga University, highlighting his dedication to servant leadership.
• 04:00 - 06:00: Defining Executive Protection Intelligence The chapter titled 'Defining Executive Protection Intelligence' centers around authentic and unfiltered conversations featuring incredible guests discussing a wide range of challenging topics. It's likened to an unscripted, raw conversation one might overhear at a bar after a cyber security conference. The podcast encourages debates and allows for arguments and even swearing, aiming to provide a genuine dialogue. In this episode, the host is joined by Jeff Daisley to delve into these discussions.
• 06:00 - 08:00: Threats and Risks in Executive Protection The chapter introduces Jeff, a principal security intelligence engineer at Comcast, emphasizing that his insights are based on his extensive experience and should not be taken as official Comcast policies. Jeff's career spans 16 years in intelligence and security roles in both government and private sectors. He also holds a bachelor's degree in intelligence studies from Mercy University.
• 08:00 - 11:00: Convergence of Cyber Security and Physical Security The chapter highlights a conversation between AJ and Jeff, focusing on the convergence of cyber security and physical security. Jeff, a former star basketball player, and AJ discuss executive protection. They emphasize the unique challenges faced in integrating cyber and physical security measures, particularly in safeguarding high-profile individuals. The chapter opens with a light-hearted exchange about Jeff's height, which adds a personal touch to the serious topic of security convergence.
• 11:00 - 14:00: Challenges in Executive Participation and International Travel The chapter begins with a light-hearted anecdote about standing next to Jeff, highlighting his imposing presence but also his niceness. The main focus of the chapter is on executive protection intelligence. The speaker mentions their background in intelligence and security and notes that previous discussions and webinars have been conducted on the topic. The current format of discussion is described as more laid-back and friendly. However, it's humorously noted that Jeff still arrived exceptionally prepared with 60 pages of notes, indicating his dedication and thoroughness.
• 14:00 - 18:00: Protection Strategies for Family and Inner Circle The chapter discusses protection strategies for executives and high-value targets in today's threat landscape. It emphasizes the importance of understanding the context of executive protection and intelligence to safeguard individuals who are at increased risk. The conversation sets the tone for what constitutes executive protection, focusing on strategies to mitigate risks and ensure safety for these individuals.
• 18:00 - 21:00: Collaboration with Law Enforcement Agencies This chapter focuses on the collaboration with law enforcement agencies in dealing with a spectrum of threats, including terrorism, corporate espionage, cyber attacks, and targeted violence. It highlights the convergence of physical and cyber security measures, and discusses strategies and technologies utilized in executive protection to mitigate daily risks.
• 21:00 - 24:00: Private Sector vs Government Protection Programs The chapter discusses the various threats corporations face in today's environment, including physical threats like kidnapping, assassination, and assault, as well as cyber threats such as data breaches and hacking. Psychological warfare, encompassing reputation harm through public campaigns against CEOs, and insider threats from employees, are also highlighted. The dialogue emphasizes the elevated risk companies experience and begins to explore the protection strategies within a corporate scope.
• 24:00 - 28:00: Building an Effective Executive Protection Team The chapter discusses the importance of protecting high-value targets, particularly executives, by forming an effective executive protection team. It highlights the various threats these individuals face, including physical threats, cyber threats, psychological warfare, and insider threats. The conversation also touches on how high-value targets are defined, emphasizing the need to identify and safeguard these individuals who have access to sensitive information.
• 28:00 - 33:00: Real-life Examples and War Stories This chapter delves into the concept of high-value targets, emphasizing that these targets are not only government officials or celebrities but also include individuals within corporate environments who hold critical positions of influence and power. These could be domain admins or executive assistants who manage crucial schedules and have close proximity to executives, underlining their significance as potential targets. The discussion broadens the traditional understanding of high-value targets, highlighting the importance of acknowledging individuals who might not be immediately apparent yet hold substantial influence.
• 33:00 - 37:00: Importance of Cyber Security in Personal Protection This chapter discusses the importance of cybersecurity in protecting individuals, particularly focusing on high-value targets, including executives and certain high-profile roles in both government and private sectors. It highlights how roles such as executive assistants and domain administrators can also be vital in the security framework due to their access and responsibilities. The emphasis is on understanding who is vulnerable in terms of cybersecurity threats and ensuring appropriate protective measures are in place.
• 37:00 - 41:00: Advanced Tools and Techniques for Executive Protection The chapter discusses the importance of broadening the perspective of executive protection. It highlights the significance of not just focusing on the primary target but also those around them who hold sensitive information or influence. For example, executive assistants often have comprehensive knowledge of an executive's life, including their calendar and finances. Similarly, domain administrators have access to critical organizational information. The chapter encourages considering these aspects in discussions about executive protection.
• 41:00 - 45:00: Importance of Awareness and Training The chapter titled 'Importance of Awareness and Training' emphasizes the need for awareness and training across a broad range of personnel, not just executives. It discusses the significance of identifying individuals who can have the highest impact in mitigating threats, which may sometimes be those closely associated with decision-makers. The transcript notes a shift in the types of threats being encountered, highlighting physical, cyber, and psychological threats, including insider threats. It stresses the importance of understanding digital trends and the increasing cyber threats faced by executives. The chapter aims to deepen the understanding of today's threat landscape and the need for comprehensive strategies to counteract these threats through awareness and training.
• 45:00 - 47:00: Unspoken Security: Personal Anecdotes In this chapter titled 'Unspoken Security: Personal Anecdotes,' the focus is on discussing various cyber threats that individuals face. These threats include hacking by threat actors motivated by financial gain or espionage. The chapter highlights the risks associated with intellectual property theft through data breaches. A significant emphasis is placed on social engineering, particularly involving the human element. It explains how social engineering can manifest in different forms, such as leveraging AI to impersonate a CEO's voice or persona, which can be used for deceptive purposes.
• 47:00 - 48:00: Closing Thoughts and Advice The chapter titled 'Closing Thoughts and Advice' delves into the critical points about influence and information security. It highlights the importance of an executive's ability to influence others and emphasizes leveraging data breaches since 'everyone's information is out there.' The discussion revolves around the necessary steps to mitigate data breaches to reduce concerns and protect against digital threats. The chapter also touches on cyber espionage, targeted attacks, and doxing as gateways to physical threats, urging the need for awareness and protective measures.
• 48:00 - 49:30: Episode Wrap-up and Conclusion The chapter discusses the concept of spear phishing, highlighting it as a targeted cyber threat often executed through specially crafted emails aimed at busy executives or their Executive Assistants (EAs). The emphasis is on how these emails are designed to be clicked on amidst the hustle and bustle, exposing vulnerabilities within these high-level positions. The chapter calls for a deeper examination of such threat vectors within cybersecurity.

Unspoken Security Ep 26: Let’s Talk about Executive Protection Intelligence Transcription

• 00:00 - 00:30 when it comes to that convergence Executives physical security or physical safety rather and cyber security are no longer separate domains they need to be interconnected and the part of this kind of security apparatus and some of these proactive measures do come down to device security welcome to unspoken security the raw and gritty podcast for Security Professionals are are looking to understand the most important issues related to making the world a safer
• 00:30 - 01:00 place including intelligence driven security risks and threats in the digital and physical world and discussions related to corporate culture leadership and how world events impact all of us on and off our keyboards in each episode host AJ Nash engages with a range of Industry experts to dissect current trends share practical insights and address the blunt truths surrounding all aspects of the security industry [Music]
• 01:00 - 01:30 hello and welcome to another episode of unspoken security I'm your host AJ Nash I spent 19 years in the intelligence Community mostly at NSA and I've been building and maturing intelligence programs in the private sector for about eight nine years now I'm passionate about intelligence security public speaking mentoring and teaching I also have a master's degree in organizational leadership from Gonzaga University go zags off to a good start this year and I continue to be deeply committed to Servant leadership now this podcast
• 01:30 - 02:00 brings all these elements together with some incredible guests to have authentic unfiltered conversations on a wide variety of challenging topics it's not your typical polish podcast my dog makes occasional appearances I don't think I'll have one today people argue and debate we even swear here I I definitely do and that's all okay so I need you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cyber security conferences these are the conversations we usually have when nobody's listening so today I'm joined by Jeff daisley
• 02:00 - 02:30 uh he's principal security intelligence engineer at Comcast and while Jeff's an expert who will refer to events and make recommendations based on his years of experience nothing he says today should be interpreted as words on behalf of Comcast or seen as representative of their current operating procedures so that's for all the lawyers out there now over his 16 years in our industry Jeff's had he served in various intelligence and security related roles in sport of government and private sector organizations additionally he has a bachelor's degree in intelligence studies from Mercy University where he
• 02:30 - 03:00 was a star basketball player he is literally the tallest man I know and the only former professional athlete in my circle of friends Jeff is there anything you want to add to that no I think you covered it AJ and definitely glad to be here and have a conversation with you about executive protection so before we go though Jee how tall are you 72 yeah on a good day on a good day 72 and for anybody who's never stood next to somebody who's 72 it's it's wild man it's hard to believe we're the same
• 03:00 - 03:30 species to be honest yeah you you want to feel tiny stand next to Jeff sometime nice guy though super nice guy anyway so today listen we're going to jump in here today's topic is you know let's talk about executive protection intelligence so everybody knows my background is Intel like I said you come from you know a security intelligence space as well and we've had discussions on this before we've done webinars in the past and so it's interesting but now we do kind of a more friendly you know laidback format although to be honest for anybody who doesn't know Jeff must have brought like 60 pages of notes to this thing today he's the most prepared person I've ever
• 03:30 - 04:00 had on the show overwhelming content so it's going to be a lot of fun anyway let's Jump Right In man so when we're talking about executive protection intelligence what are we talking about let let's lay it out for people so they know we're on the same page on what this topic is yeah so kind of set the tone on context here we're going to be talking about everything from Executives to other high value targets that in today's kind of threat landscape are definitely becoming increased Al at risk and
• 04:00 - 04:30 targeted individuals you know these type of threats can go anywhere from terrorism corporate Espionage cyber attacks and targeted violence so it's kind of run in the spectrum of both from a physical to cyber convergence so that's kind of what we're going to be focusing on when it comes to executive protection as well as you know explore some of the strategies technologies that these individuals that were protecting leverage on a daily risk a daily basis
• 04:30 - 05:00 and are um as a result at a heightened risk so when it comes to it we are kind of beginning to talk about you know such things in a corporate environment these can be threats that are physical threats kid kidnapping assassination assault cyber threats kind of data breaches hacking surveillance or psychological warfare this can be you know your CEO public M campaign or reputational harm um as well as Insider threats this is the employee
• 05:00 - 05:30 are the closest Associates with access to the sensitive information so kind of we're going to be talking about that in a nut show to kind of look at ways to kind of further protect these individuals okay so listen there's a lot to get through there right physical threat cyber psychological warfare Insider threat there's a lot there let's back up for a minute though you mentioned high value targets like how are we divining I mean am I am I am I valuable enough like what's a high value Target how are we defining that one yeah so when we look at high value targets this are this can be the Executives this
• 05:30 - 06:00 can be government officials this can be people of High net wealth individual celebrities or really just people who are in positions of power of influence even taking a step further within a corporate environment this can be your you know your domain admins this can be your executive assistant someone who is really maybe maintaining the schedule and has close proximity to your Executives so these are the type of people who are those high value targets Trad in the traditional sense and maybe people that are sometimes not even
• 06:00 - 06:30 scoped into an EP program that should be well it's interesting you mentioned you know executive assistance noain admins right so yeah a lot of people don't think of that right so by the way for anybody who's curious I'm well aware that I'm not a high value Target but uh but there are people that are right and as you said you know these Executives these these high-powered individuals whether you know if it's in the government space maybe it's Flag officers or politicians things like that the private sector the sea level generally comes to mind right but I think you make a good point you know executive assistants domain admins you know there's there's a an expanse to
• 06:30 - 07:00 this that I think a lot of people don't think about is if you can't get to the Target directly the person next to the person can be pretty valuable especially if that's the person who carries you know all the real information right EAS executive assistants they know the whole calendar right they have access to every part of somebody's life a lot of times or they may have all their finances as well you know it's amazing how much people will will trust them or a domain admin has access to an entire organization so I think it's interesting as we go through and we'll have some of these discussions to keep in mind that when we talk about executive protection we got to really kind of expand that out
• 07:00 - 07:30 it's not just the executive it's really about whoever's going to have the highest impact right and and how to get to those folks and that can be the person next to the person so to speak so all right so you talked about physical threats and cyber and and psychologic warfare which I had really thought about till today on Insider threats let's talk about you know where where we're going with these some of these Trends you know rises in digital threats for instance or what the Cyber threats are to Executives you want to go down that path and kind of talk a bit about what you know there yeah so in today's kind of threat landscape
• 07:30 - 08:00 in terms of cyber threats there are the hacking by thread actors who are targeting them for financial gain for access from an Espionage to the data intellectual property that these individuals may have social engineering is a Avenue where it's the human element so this can come in many different ways Um this can come from The Leverage leveraging of AI to kind of impersonate a CEO their voice so it could be even targeting leveraging the Persona of an
• 08:00 - 08:30 executive to influence others so that's something that needs to be kind of taken into consideration as well as the leverage of data breaches everyone's information is out there so how are you going what steps you going to be taken to kind of further mitigate that so it's not a concern but with that you know these are really just the kind of the gateways to these physical threats like I kind of alluded to um the Cyber Espionage that targeted attacks as well as even doxing so the publishing of that personal information to you know enable harm
• 08:30 - 09:00 but you know taking a step further kind of diving a little deeper into it from the Cyber threat standpoint you know these can be spear fishing these can be very kind of targeted crafted emails to kind of have the executive to click they're busy but then sometimes it's their EA who's managing the inbox who's also the one kind of that could be vulnerable in that situation but you know there's a lot of things kind of going on in in that sense that we need to kind of take a look at yeah it's interesting and so yeah I mean you've talked about it like there's a
• 09:00 - 09:30 blend to a lot of this it sounds like right the physical and the Cyber seems like there's a fair amount of overlap you know you've got You' got spear fishing and and social engineering which you know can lead to Executive impersonation as well and and where AI might fit in there but also being able to use that for the next step right whether it's using social engineering to gather the information necessary to create a physical attack right or to understand where somebody's going to be or maybe to understand how to how to get into the location where they're at where do you see this conver
• 09:30 - 10:00 and AI you mentioned too so we got to throw it in at this point where do you see this convergence between you know the Cyber component the physical component you know cyber enabled physical attacks physically enabled cyber attacks you know which is less common and how AI you know sort of ties a lot of this together makes it more challenging for people to defend against some of these things you know where where do you see the the components coming together yeah so good question AJ you know kind of looking at the integrating of cyber security into the executive protection program you know
• 10:00 - 10:30 really just looking at that holistic security approach you know when it comes to this comprehensive strategy um that requires a lot of simultaneous consideration of both the physical and cyber risk so you know when it comes to that convergence Executives physical security or physical safety rather and cyber security are no longer separate domains they need to be interconnected and and the part of this kind of security apparatus and some of these proactive measures do come down to
• 10:30 - 11:00 device security you know let's just say your Executives traveling to China for instance that's known for targeting Executives that are traveling overseas to their to their country what we need to do there is provide you know an executive with a burner device smartphones laptops tablets to ensure that they're not carrying over any kind of intellectual property that's on the device and then also the full circle feedback for an intelligence cycle bringing that device back to the forensics team uh for further analysis
• 11:00 - 11:30 to see if there's anything that was kind of planted or or on that device um and then another component is the data privacy and encryption right kind of implementing encryption for all kind of communication and sensitive data storage to protect against any kind of unauthorized access or potential data leaks from those you know from the executive or the PRI um as well as implementing you know kind of access controls and authentication ensuring that the best cyber security practices
• 11:30 - 12:00 are implemented everything from MFA to biometric verification and secure passwords to safeguard from any kind of access to both physical and also digital environments and then another thing to kind of consider is the remote surveillance and monitoring I'm using digital tools to monitor both physical security cameras and access points making sure that they're secure Wi-Fi networks are secure um so that there is no opportunity for a Cyber attack and real time kind of you know thinking
• 12:00 - 12:30 along the lines of intrusion detection and nwor monitoring well and so a couple things come to mind as you're going through this I mean first of all a lot of these things require Executives that actually participate uh Executives aren't notorious for wanting to follow all the rules right so you know I'll ask you two questions so don't ask this one because I'm G kind of go through two at the same time but I'm curious your thoughts on that on challenges that you either know personally or have seen others experience and how do you get Executives who don't want to be encumbered by SEC right and of you know multiactor
• 12:30 - 13:00 authentication and things like that do you how do how do you mitigate that if they say I'm just not doing that and then you got to you know work around the the boss or whatever it might be but also you mentioned encryption and you mentioned device security right so device security sending burners if you're going to China for instance but at the same time the encryption component could be a challenge because you got to know where in the world you're allowed to use some of those things right as an Intel guy I've done travel briefings for folks and said Hey listen in this country you can't bring anything in encrypted it's a crime you you're going to have an issue you know they're going to check at security ad Min when they're going to make you show
• 13:00 - 13:30 them stuff and it could be even worse so you know how does that figure in is that is that part of a pre-brief going in and some places it's not encrypted but it's hey you know we'll give you a device and just here's the things you can and can't say because the stuff's all GNA be available so I mean how do you handle those two things together getting them to cooperate and working through International laws yeah and kind of when a lot of that stuff is covered you know when when they are traveling to certain locations really conducting a travel assessment looking at everything from like you said if are they allowed to
• 13:30 - 14:00 bring in an encrypted device some countries don't allow that like you like you alluded to but also kind of knowing the environment there knowing any kind of concerns from a logistical standpoint you know you really have to have a whole kind of brief there and prepared for the executive and you know where's the closest hospital medical what do they need to have with them that you know for that individual that predict is there any medication they need but also having contingency plans for you know the rest of the traveling knowing if there's any
• 14:00 - 14:30 kind of major events that may kind of be a concern during that trip while they're while they're in country or anywhere for that matter but when but but kind of circle back also to you know an executive does need to buy into this and you need to kind of instill that level of trust you have to be a trusted Confidant to them you know you are kind of coming into their Circle their family their personal lives and you know
• 14:30 - 15:00 sometimes that's a tough sell but you know there I think that level of building trust starts with such things as you know starting small baby steps and you build from there and some kind of circumstances that could be security awareness campaigns if you get there by and maybe you're going to start sending spe fishing campaigns to them and use that as a learning opportunity when a conversation starting point to kind of build that kind of executive protection program from starting from a cyber standpoint point and and going from
• 15:00 - 15:30 there and also dry runs you can do a tabletop exercise or an incident response drill really kind of in partnership with a corporate security kind of personnel and a corporate environment to kind of train them and show them how to react to physical security threats but from a cyber security Point how do they respond how do they alert to Ransom how do they alert and notify fishing campaigns BC campaigns stuff of that nature well and it's like differently sorry to cut you
• 15:30 - 16:00 off but differently from a lot of things we do with training right a lot of our cyber training is you know I mean you mentioned you know fishing campaigns we do that with everybody so that's that's sort of the norm at least but most of our cyber training is is employees right it's people in the company and we're teaching them you know security physical security cyber security annual training ongoing training whatever it is but in this case it seems like I mean you got a team you got a the protection team has to have their job right and they're they're train and protected just like cyber Defenders are train and protected or physical security you know train and
• 16:00 - 16:30 protected they've got their own thing but you mentioned it you kind of alluded to it it's not just the protectees the executives you know and we talked obviously about the EAS and some of those but also their families sometimes right so being able to actually you know are there different challenges in in finding I mean there's I assume there are and how do you communicate this you know it's not just you're protecting you know the CEO but maybe it's the CEO's wife and three kids of various ages so this is a whole different group of people how do how do you how is that different how do you how do you manage those challenges of having to get multiple people you know finding that
• 16:30 - 17:00 balance between hey you don't want to scare them too much but at the same time you do want them to understand this needs to be taken seriously real things happen I know we have some War Stories we'll talk about later on scary stuff how do you balance that out to make sure that you get the right Buy in from everybody because if the CEO totally Buys in but the CEO's 12-year-old son or daughter doesn't that's that's that's the Avenue right that's the way in the door that's a problem so like how do you how do you see managing those things yeah I mean and from a security apparatus standpoint sometimes you know
• 17:00 - 17:30 those around them are the the weakest link um hor a priy and logically you do need to kind of scope that in but it does open up a lot of kind of privacy concerns and and things that may limit their freedom for their family members and stuff of that nature but you know there's there's different things that you can kind of do um to kind of scope in right you know you can kind of start to consider you know are they going to be monitored um 247 or just when on business hours and business travel
• 17:30 - 18:00 you know you can start to kind of limit it and limit the scope until you kind of get by that trust for the auxiliary members but for an effective program it is kind of essential that you you do begin to the scope of that in know there is a difficulty in maintaining security without making the executive or or the high value Target Target by their public exposure so sometimes um the public versus private life social social media can be a double-edged sword there um so
• 18:00 - 18:30 you kind of s to see you know that auxiliary that family member that person in their core you know if they're not scoped into the program sometimes they can be a vulnerability in that by unintentionally disclosing location or plans and that kind of can put that predict In Harm's Way in some cases and that kind of goes to a thought of you know The Insider threat or or trust issues as well when they are when the pred does you know for instance hire The Lawns keeper or the driver or a
• 18:30 - 19:00 nanny for that instance these close kind of Associates to the predict you need to kind of start to vet them too though you know ensure that you kind of not only doing a assessment or background on them but you know kind of checking in and you know having multiple kind of checks into them what this does is allows to kind of ensure that there's no um it avoids like The Insider threats the you know selling of a the kind of concerns around that and
• 19:00 - 19:30 establishing layers of Security even within that inner circle while respecting the executives privacy so you're starting to kind of ensure that everyone else in that inner circle is is kind of covered and assessed and ensure that they are not an immediate threat from from a background standpoint too so that's I mean that's interesting when you talk about background checks and so like most companies do some kind of a background check right but obviously it's very different here again you're talking about people who have really close ey access and it's not not a
• 19:30 - 20:00 corporate employee necessarily it could be that you know the nanny or the the you know the grounds keeper whatever it is as you said where does it come in you know the connection between the the Protection Team and say you know local law enforcement or federal law enforcement external agencies like how do how do how have you seen that in the past you know building those relationships you know maintaining those relationships how important is that how do those how do those work in real time like how how easy it is it to work with local and national federal law enforcement maybe International too for all the for all the travel how how hard or easy is that to do how do teams put
• 20:00 - 20:30 that together yeah so you know from that perspective you know it is kind of important to kind of put that as a part of your executive protection protocol you know a lot of times law enforcement will always be the first responder they're the quickest to get there um so you need to make sure that you a have a good relationship and B know how to kind of sure let you cont them 911 right but um but you know other agencies can kind of help assist too for international
• 20:30 - 21:00 travel the state department as such kind of ensuring that you check in with them when you're traveling um as well and having those kind of connections even with local enforcement where you're traveling right kind of letting them know like hey you know being able to be able to get in touch with them maybe if if it is a high-profile protect um letting them know that they're going to be in their jurisdiction as well and any kind of steps that may to be taken there interesting so we didn't mention at the open but but you know I I just kind of glanced over the idea that you've done
• 21:00 - 21:30 all this for a long time obviously in your private sector government space as well I mean you worked with the you know us Secret Service so I mean when I when I I glossed over it a bit but Secret Service is kind of everybody knows what secret service does I mean that's protective of the highest value you know targets we have in the country right so but I know you've done a lot of this private sector space too what do you see as I don't know some of the some of the differences between them like is is one group generally easier to get Buy in from like I would assume you know high level the president for instance I would
• 21:30 - 22:00 assume they understand there's threats to their lives right you know high level people at those levels I imagine you don't have to spend a lot of time selling them on the idea that security is a thing right but have you seen you know more or less uptake is it easier or harder with government versus private sector is it just individualized are there are there different levels or Industries where it's easier or harder I I would say you know obviously from a government perspective that's that's an easier sell but when when it comes to um the corporate environment you know I I feel like it is a little bit it goes both ways right but I've had experience
• 22:00 - 22:30 where it is an easy buy an easy sell especially with the increase threat landscape and the high targeting from a cyber perspective um and the cost of the business that they are overseeing so there is an easier Buy in from that perspective to kind of incorpor that into an apep program but you know sometimes unfortunately I've also seen that it is retroactive um something happened where they need you know they
• 22:30 - 23:00 they now they understand the real risk and they're willing to kind of buy and do it now I've also seen that happen multiple times and then that's the trickle down effect right you know from top down within corporations where it's kind of a a mandate for them to buy into it um but on the other other side you know you kind of do have to and some cases have to like I said the baby steps and slowly roll out a program where they might be a little bit more adverse to
• 23:00 - 23:30 allowing folks within the company to kind of dive into their personal life help although you know because you do it's a very intimate personal matter and you know when you kind of begin to scope it in knowing those intimate details about an executive will only further Harden the program by knowing everything from you know the cars the vacation homes their travel plans all that stuff the more that you know the better you're
• 23:30 - 24:00 able to protect them right um but if they're not willing and able to share all those details it does kind of allow you're kind of playing with one hand and doing the best you can yeah I mean that makes sense I mean if you've got a protecte who has a hobby that they're they do you know I don't know they do clay sculptures you know every Wednesday and they sneak away and nobody knows I don't know why that would be their secret but I'm trying to be kind in this case uh you need to know right hey when Wednesday clay m molding night at you
• 24:00 - 24:30 know at this place right I mean it's a predictable pattern for an adversary like every Wednesday night you know our Target's going to be at this location but if they're not willing to share that with you because they're I don't know they don't want people to make fun of for the terrible clay models they make or whatever it is it's you know it's a problem right so like you said you got to be able to build that that trust Factor so that they're able to tell you all the secrets the things they don't want to tell other people I talked about the show being unspoken security we're goingon to talk about your secrets later it's people don't want to share right people people want to hold things back until they've built that trust so in building the the trust building the relationship so I'm curious I mean
• 24:30 - 25:00 you've done this a long time obviously and we've talked about this cyber component this physical component so if you were going to build a team you were going to build an executive protection team today from scratch you could have anybody you want it's like a fantasy draft almost you know I know you'd want me but I'm not available no I'm just kidding but in terms of talent like in types of talent for the Cyber and the physical component you've also got you know this Global geopolitical piece comes into play and all this stuff what would you build like what were the skills you would look for if you were going to put together you know a team I want to ask how big because I'm sure it
• 25:00 - 25:30 depends on the organization but you know what are the skills you're looking to have what what are you looking people to have on your team yeah so that team that dream team would would kind of include corporate security folks with former law enforcement background connection and and kind of the experience of dealing with physical security situations where they need to kind of take action um but from a cyber perspective you would want to kind of partner with a threat int shop as well as a threat Hunter to kind
• 25:30 - 26:00 of assess their external threats that may kind of present there but also when it comes to cyber security you also need a trusted IT professional who can ensure that when they are traveling to certain places and M maintain their their own corporate equipment so you need a a trusted kind of um entity there so I mean it does kind of Run the game there's a lot of a lot of folks that would kind of
• 26:00 - 26:30 incorporate that but I think the most important part is someone who has the soft skills to able to communicate and and be that trusted Confidant to the executive to the high value individual who can also ensure that they have solid relationships with their Inner Circle too and and build their trust and let them know that you are a trusted adviser and have the best interest for them how do you I I said I wouldn't ask how many people and now I'm going to kind of go down that path cuz I'm just curious but
• 26:30 - 27:00 not exactly but so assume you're a Fortune 500 company right so we we talked about high value targets aren't just like the CEO right there several sea levels it could be some admins Etc I assume you don't have a team for each one of them I don't think you're gonna have giant you know you're not have 150 people doing executive protection I would imagine so how hard is it to to balance that out to fragment it out is it are some of the briefings just sort of standardized across the board like we have a bunch of stuff on on the table ready to go we can train people the same way and then just customizing as it comes like how do you how do you manage
• 27:00 - 27:30 that workload when you're dealing with you know could be dozens of of people that are considered part of the program to protect at such a deep level and I can't imagine you're going to have a lot of people to work with in terms of the the program yeah I mean that that's a tough question right that is actually kind of tough to answer because and you know it varies right um it varies on the sense of how intimate are you how much is the company investing into it or how much and into a corporation a corporate executive or even a highet value MH um
• 27:30 - 28:00 individual sometimes it can be very limited because you are so close so you don't want you know the kind of the face of these initiatives may be limited but there will be an army behind it you know whether it be from you know the cyber security standpoint the it standpoint or the corporate security standpoint but you know the the face you know face to face kind of interactions is limited to select few but there are people kind of supporting that individual who's the face got it I mean and the government
• 28:00 - 28:30 side and I don't know if you can share this by the way but like for secret service the high value the high value targets the the protect these they have a team right I mean those don't actually rotate I mean I'm sure over time they do but like if I was you know pick a title in the government which I'm not any of those I would have the same team for a period of time right in that case the the government actually invests and has teams for individuals I assume yeah yeah it's very similar you know where you have individuals kind of very close to
• 28:30 - 29:00 the predi and you know sometimes they are kind of selected by the predi um due to the fact that they have a good relationship and they're kind of leading those teams on that end interesting do you ever see the show House of Cards I sure have it's a good one I'm gonna go ahead and assume that that's not a common occurrence with the and their detail for anybody who hasn't seen the show I I recommend watching yet and if you have and you and you find that to be not an amusing joke then that's on you I think it's hilarious but anyway good show so all right cool so listen we
• 29:00 - 29:30 we've talked about like how to build a program we've talked about the convergence of cyber and physical and and some of the challenges of of extending this protection to more than just your protective you but the family and some of the differences between the corporate environment in the government space but I think what people really want and this is this is a question I like asking you know you more more than anybody probably is let's talk about some some cool things right do you have some cool War Stories you could share obviously not specific names groups companies that kind of thing if anybody's looking for that dirt to the wrong place but talk to me about how you
• 29:30 - 30:00 know when the rubber meets the road we've talked about all these threats and all these risks and I do you have some cool stories that you're able to tell today that you probably Ed to help build some credibility with Executives on things in the past you know what's what are some of the cool things man there there is one that kind of comes to mind it is a historical example takes place in DC it was a financial executive Financial Services executive living in DC and it was a scenario where itive intelligence and an executive protection
• 30:00 - 30:30 program wasn't implemented for this individual fortunately and was not aware that there was a angry mob in the hundreds approaching their their residents at this time that executive was going to go pick up their their child at a key ball game and had left their child Alone um at home so as this mob approached their child was kind of cut off guard there's no future kind of early alert signs to this and
• 30:30 - 31:00 unfortunately it did kind of have to be you know there was no actions that are able to be taken to kind of prevent this law enforcement wasn't kind of there to kind of block it it was kind of really raw unfortunately so lessons to take away from that though you know this these are the kind of things that kind of can give you that early alert having an executive protection program you know removing your P when you can from places online on the open source you know some things
• 31:00 - 31:30 are kind of mandated and and needs to be reported but in those cases such as like political donations right you can use a PO you can use a PO Box you can use different means to kind of mask your home address also to kind of ensure that the the information that you can have removed or expunged that help limit your tech service so that you can't have you don't have Angry mobs coming to your home was that mob like was it it was so was their home I was going to say it wasn't coincidental then they were
• 31:30 - 32:00 actually were specifically targeting this individual yeah they're they're specifically targeting going there for that purpose yeah they're they're they're they're targeting that executive yeah that's not that's not good what I mean listen you've got a few others I think they're really interesting so I'm going to prompt you on some of these examples that I'm aware of at least listen Smart Homes let's use that one as an example right so I I have I've gone all in on well almost all in at least on a lot of the smart home Technologies right so and people have asked like you know is it safe is it not safe how do you handle that like most people I know have something in their smart home
• 32:00 - 32:30 whether it's whether it's just an Alexa or whether it's you know Google or whether they've got you know locks or whatever but the further down that path you go the more you have to worry about the security component so when you talk about executive protection you know what have you have you got any cool stories on that what have you seen in the past or sad stories or scary stories whatever it is on how people have either protected well or not protected their systems well enough and what the risks were yeah I mean from that standpoint when you start kind of talking about technology within the home I mean there's Basics that kind of need
• 32:30 - 33:00 to be implemented right um your home router let's not Leverage The outo of the box kind of default passwords um let's Harden let's Harden these devices a little bit so it doesn't make it easy for adversaries to kind of do very easy kind of scanning for those default passwords and and devices because when that does happen it does put you at risk you have all these devices that are connected and they can be points of vulnerability for an individual or a family especially when it comes to
• 33:00 - 33:30 devices on the doors for Access as as well as you know your home networks so but yeah you know we have seen situations where maybe these um protes aren't really tech savvy and they need to kind of go through you know basic cyber hygiene because you know maybe in their day you know day jobs they hire people to do it for them so you know sometimes that kind of goes into inviting into the home more intimate setting to kind of Ensure that everything's up to standard do you have
• 33:30 - 34:00 uh smart locks and cameras in your house I do have a fortified I do have some cameras around here well done yeah I do I do as well I have lots of discussion with people there's always the debates right about what what is or isn't secure I also do so another one I was curious about because I've seen stories like this is like the the this is movies right about kidnappings you know people use cyber to track down like you know where pattern of Life analysis for instance and where the kids are going to be and where the executives are going to be have you seen any of this is this real first of all do you know anything about it in like real life does this
• 34:00 - 34:30 happen is it common like how do you protect yourself I think you mentioned some of it obviously keeping things keeping your personal information off of social media or at least locked down but I mean is this something common that is something is commonly being protected against with these teams or or is this more of an outlier it is definitely something to be concerned about I I have heard of a lot of scenarios where I mean think about it when these high value individuals are executives are traveling they have they bring attention to them they're kind of easy to SP out
• 34:30 - 35:00 sometimes and if they don't take security seriously if they aren't implementing plans to do so with the right Personnel around them they can be easy targets but with that said sometimes it is not the actual pred sometimes it is from family members that they leverage you know you see it in sports a lot of sports athletes um they'll Target family members unfortunately and so that's something you really need to kind of consider when and why it is so important to kind of
• 35:00 - 35:30 scope in family members and and bring them in to ensure that they are they don't fall victim to such you know kind kind of situations there well it's a good point I mean I had thought about with athletes right so a lot of athletes we have OB baseball I think is far the best example right baseball has a lot of athletes that have come from other countries that have a lot more turmoil economics and and political Etc and and places where kidnapping for profit is is just a really common thing you know I don't want overstated I'm not trying to you know make this some political
• 35:30 - 36:00 discussion but there are places where it's more common than others and we have a lot of folks that happens to be I think our baseball league is is probably most affected by this Latin America has a lot of issues with with kidnap as a business basically as you know as an ongoing Enterprise so you know it's interesting that you mention that because I don't know I don't know if you have any ideas on this I don't know how MLB handles this I'm not going to call them out or anything like that but I'm curious like how do you deal with that when you're when you're talking about hey the family members live in a totally different country they're not with the protecte you know how far can you extend the umbrella to try to protect folks
• 36:00 - 36:30 that are just so far away I don't even know if there's an answer to that one by the way so if there's not I apologize for the impossible question yeah I mean that that is a tough question and and and hope hopefully one that they are taken into consideration yeah you know when they are outside of the US and vulnerable and you know sometimes it's a scenario where someone's coming from a certain situation and they're getting a lot of money and maybe not all the time not everyone around them has the same economic situation and that they do kind
• 36:30 - 37:00 of um unfortunately well yeah I mean you're talking about players that make millions and millions of dollars who've come from places where hundreds of dollars is a really solid living so yeah this just a challenge listen we have that in the US too there people make millions of dollars to get extorted you know in the US or kidnapped too so all right one more technology I'm looking for a case study on because I have I have this but I haven't done anything with it I'm embarrass to say so a few years ago this this tool came out flipper zero which is the super cool little handheld tool for those who don't know and I'm sure most people listening probably do but if you don't you can
• 37:00 - 37:30 Google the term flipper zero it's a really cool little tool you can do a ton of stuff with I have one that's literally still in the box I've had it since they were new and hard to get a hold of and I'm too dumb to know how to use the damn thing but uh but I know you know a little bit about this and how it works in terms of proximity and and some of the risks that go with it yeah this is something that's kind of come out you know it's a red teaming tool but it's become very I want to say very accessible but it is accessible to maybe folks that aren't really in that space But that's also accessible to adversaries and people with with bad
• 37:30 - 38:00 intentions and you know this is just kind of a use case where you know let's just say you have to be in close proximity to the individual for a lot of these use cases but if you're traveling at a hotel and maybe your hotel card maybe they're able to pickpocket it or maybe you just leave it out they can scan it you know get the get access to your hotel or it could be your bi maybe not so much for an executive but maybe an EA maybe someone might have left it on their desk whatever the case might be it's that close proximity use case where
• 38:00 - 38:30 access could be jeopardized as well as other multiple use cases that flipper has but those are two that you know in the case that if someone is kind of tailing someone that could probably potentially have a protect at a moment of weakness where they leave something behind like that well yeah I mean I know you can use it to to clone key fobs for instance for like cars and things like that um which so I guess I mean I guess it's obvious like a lot of people think about you know we see Executives we see high value folks you know politicians
• 38:30 - 39:00 whatever it is and generally people keep a distance there Security's job and I feel bad for the security folks because a lot of times you know especially with politicians they want the opposite right they want to get close to the people they that's part of their gig and meanwhile the the for Secret Service person is trying to keep them from doing that and it's not just about hey you're going to get stabbed or you're going to get shot or you're gonna get attacked or something but it could be something as simple as this you know something could get cloned or copied and and information could be stolen there's a lot of Technology flipper zero is just one that comes to mind but there are others out there where people can quickly you you know steal data from you from your phone from your credit cards whatever it might
• 39:00 - 39:30 be and I don't know if if Executives all understand or or take that seriously which is what makes your job so hard basically yeah I I did have another interesting use case that I kind of wanted to throw out there and it it really kind of highlights the Cyber to physical kind of overlap there and it it kind of comes down it's a feature on Google it's Google's location history it isn't it is an opend feature and I do recommend that you disable it unless you have a good use case for it but what
• 39:30 - 40:00 what this use case that I'm going to present kind of highlights is if an advisar is able to get access to your Gmail maybe your Gmail address and and password and able to get access to your Google account they now will have access to your Google vacation history which tracks you know your movement and kind of does a nice little breaks everything down but speaking of pattern of Life speaking of you know the time and they can really get a good idea of your movements things you like to go to where
• 40:00 - 40:30 you travel to all that kind of stuff so it's something where they may be tracking you without knowing so that's just something that I kind of wanted to you know when you start to think of different ways adversaries May kind of Target you from a cyber perspective which can affect your physical you know kind of security yeah it's a good point I mean I spent a lot of time talking to folks about about turning off Technologies on all sorts of apps Google obviously is a great example right uh a lot of other apps apps that people don't realize can track them they don't notice the they don't bother to
• 40:30 - 41:00 notice the uh the permissions that they give you we download apps and you know you got to look and go why does this app have to know my location why does this app have to know you have to have access to my Cal my calendar or my camera or you know my microphone because a lot of apps ask for all sorts of accesses that don't seem to really tie to what you got the application for and unless you you know dig into it they're they're already there because you've approved it right so I mean that's another good example is you know turning off history turning off some of these tracking features which can be useful sometimes but the the risk
• 41:00 - 41:30 is significant right and I think a lot of people don't don't take that into account so I think that's a really good point so listen we got we're going to start wrapping up here it's I know you know we could go on there's there's a lot of good stories to this there's a lot I mean this is there's layers and layers to this but it it seems like ultimately it's the physical cyber component are are overlapping when you talk about Executives having teams that are capable of handling and understanding all these different sides and going Beyond just the the protect you said the executive to the families to the you know second and third layers
• 41:30 - 42:00 to the technical component to the the corporate admins it's it's a big job right it's a big and challenging job and and I appreciate you being able to come in and talk about it a bit you know at a high level how to build a program and some of things to focus on and also getting into some of these you know use cases and and real life stories so that people understand this is real like this is not a hypothetical this is not a you know fantasy these aren't all movie scenarios and everybody isn't going to have a superhero that's going to be able to save them so we kind of have to proactively protect ourselves but now that we're getting near the end of the
• 42:00 - 42:30 show the last question I always ask everybody uh the name of the show is unspoken security and with that in mind you don't get a pass just because you're a friend of mine so with that in mind you know I need you to tell me the audience which is probably three people you know tell us something you you never told anybody before something that so far has gone unspoken well one thing I would say I I do have a nice little hobby I've done a few acting gigs one of them yeah one of them was for Nike where
• 42:30 - 43:00 I was a body double for Dirk ninski and then I did another one with Adam Sandler Here in Philadelphia where I was it was background work but it was on the movie Hustle um Netflix hustle oh yeah and uh you know I was able to spend some time with with Adam Sandler and Mark Cuban and and everyone who's on that on that set so it's kind of interesting it's something I like to kind of do on on the side but I haven't got any speakers R yet though so you were Dirk noisy's body
• 43:00 - 43:30 double you said like was Dirk taking fouls in are you get are you taking all the charges for him like what what was the reason for eating a body double for for a commercial for Nike it it was and it's really interesting how how long they actually have and how many scenes they have to fill and how long it takes it took like all day um so basically I kind of Step into the things he doesn't want to do H so it was taking fouls then you're getting hacked around yeah exactly but uh it it was definitely it
• 43:30 - 44:00 was definitely interesting though it was interesting is how how tall's der is he 72 as well is he yeah yeah he's like he's 71 71 72 yeah you're taller than Dirk n you actually you actually look down on Dirk nitzki in these that's ni hunch down a little bit for his benefit that's nice I like that yeah and then so I'm gonna ask I don't know if anybody else I assume anybody would so is Adam Sandler you know Mark CU are they cool in person like is is Sandler has reputation as just being a really laidback normal you know guy right I've
• 44:00 - 44:30 seen him do standup I've seen him you know just talk to whatever he seems like he's just like you and me except he has Fame and money but is that true is that how he is yeah it it really is like he was so humble kind of like the person you see and the characters he plays is the guy he is just really down to earth he even he even had his daughter on set so she was kind of like the director for that scene he kind he kind of like let her be the director uh which is kind of cool it was cool to you know see that family Dynamic and then Mark Cuban he's
• 44:30 - 45:00 hilarious super humble funny um it was it was just great spending time with them and he's a cyber security kind of guy too yeah right he came out of our industry right before he he seems to have done a little better for himself and I I I assume it's just coincidental that you uh you body doubled for nitzki and that you know nitzki played for you know Cuban's team I assume that's just coincidental but but it's it's a small world I guess so you you got these guys numbers we can can I get Cuban on the on the show can I get you think you get fan man to come on the show or it was it was it it was a missed
• 45:00 - 45:30 opportunity ah damn I really was hoping like that was going to be the big push right I'm sure you know Mark cubin and Adam Sandler have nothing better to do with their time than than come on you know unspoken security and talk at least Cuban's in the industry but yeah that's fine man I figured you couldn't hook me up but I gotta ask the question you just never know so are you still doing more acting like you you chasing these things you have do you have an agent do you look for these do they just come to you or yeah so like I signed up for like some um kind of agencies I guess and whenever
• 45:30 - 46:00 they are looking for two guy it's a niche yeah like within proximity of Philadelphia or DC I mean the good news is if they need a 7 foot two white guy I imagine the competition is very very small there aren't a lot of guys lining up for those roles right like I can't that gig like go there in stilts I still probably couldn't get it so yeah I found my nits
• 46:00 - 46:30 I found my nits with uh I'm gon to ask listen what scene in Hustle should I be looking for you and I haven't seen it yet it's actually on my list of things to watch interestingly it was it was it was one of the opening it was the opening um scene it was a funeral for the owner of the Philadelphia 76ers um so you know all the everyone all the major main characters are on that set so it's kind of cool to get to meet everyone like Dr J K the jet oh wow like everyone everyone was on the set
• 46:30 - 47:00 yeah that's cool listen that's one of the better like tell us something that goes unspoken stories I've had a lot you know you're this is the I don't know 26th episode I think we've done of this and you know some of them are more interesting others I want to call anybody out some of them are less exciting but this is actually one of the better ones to be honest I mean that's pretty neat you got to hang out with cool people that's a that's a pretty cool hobby that you know in your free time you just go out and hang out with famous people and be the 7 foot two body double that takes a beating for dirk nitzky so he doesn't have to hurt his his knees or whatever anymore uh it's a good it's a good use of it's a good use
• 47:00 - 47:30 of PTO yeah I I I would think so I uh I don't I don't have that going for me unfortunately all right cool listen again I want to thank you I think we're we're pretty much up on time but I want to thank you for coming for coming in on doing this this is you know I appreciate it like you you've got a very cool background a very interesting background you're a busy guy I know that but there aren't a lot of people that have do what you do right there aren't a lot of people that have such a a depth in the cyers space Also in the physical security component I don't know any of them who are also 7 foot2 basketball players who hang out with Mark cubin but
• 47:30 - 48:00 there aren't a lot of guys like you so I appreciate you taking the time to come in and talk a bit about executive protection and what this all means and these holistic approaches you know before I do let you go though is there anything you want to say is there anything we left out is there anything you want to you know talk about any pet projects any plugs anything at all you know that you want to say before before we call it a show no I mean I I think we covered a lot and obviously we could go on and on about this topic and and the important of it but just continue to be D out there um there aren't out there in this
• 48:00 - 48:30 world not everyone's the good guy so let's let's all be mindful of those out there so that they don't take advantage of us and uh take the steps you can to further protect yourself and and Harden from a cyber and physical standpoint it's I mean it's good advice it's a good point you know people who don't think they're at risk are are probably mistaken it's a dangerous world and most of us have something that somebody wants so again I just want to thank you for coming on and spending some time today Jeff really appreciate it for everyone else who's watching or listening if you like the show please
• 48:30 - 49:00 you know like it and give good reviews and make sure you subscribe and tell all your friends and neighbors and and see what you can do to to help grow the show if you don't like the show don't tell anybody ever but feel free to reach out to me I'm happy to take feedback and try to make it better because the show isn't about me the show is about guests and it's about the audience and I appreciate everybody taking the time to listen and watch so with all that said uh it's been great being here and it's been great having you on the show and for everybody else this is another episode of unspoken security that's a wrap for this episode
• 49:00 - 49:30 of unspoken security if you enjoyed this episode follow us wherever you listen to your favorite podcasts see you next time [Music]