『EP553: Craig Taylor - You Are A Prime Target: Why Bookkeepers Must Understand Modern Cyber Threats』のカバーアート

EP553: Craig Taylor - You Are A Prime Target: Why Bookkeepers Must Understand Modern Cyber Threats

EP553: Craig Taylor - You Are A Prime Target: Why Bookkeepers Must Understand Modern Cyber Threats

無料で聴く

ポッドキャストの詳細を見る

【Amazonプライム会員限定】今ならプレミアムプランが4か月 月額99円。

10月19日まで。※適用条件あり
See what the team at The Successful Bookkeeper has on right now →Bookkeepers sit right next to the money, and that makes them a favorite target for financially motivated hackers. In part one of this two-part conversation, Cyberhoot founder and CEO Craig Taylor explains how AI has changed the threats landing in your inbox, your texts and your phone calls. He also gives you a short list of habits that shut most of those attacks down. Craig started in cybersecurity 30 years ago with a psychology degree, and his focus is on behavior change rather than fear and shame.Chapters[00:00] Why bookkeepers are targets[02:00] Craig's path from psychology to cybersecurity[08:00] How AI changed phishing attacks[11:00] Smishing, quishing and vishing explained[15:00] Safe words and callback verification[19:00] A listener's phishing story[22:00] Are QR codes safe to scan?[24:00] Password managers and passkeys[29:00] Next-of-kin recovery and staff transitionsWhy bookkeepers are a prime targetCraig is blunt about it: "Bookkeeping is the purse strings of the companies you're supporting." If you pay bills, wire funds or manage the financials of multiple companies, you are, in his words, "not just a little one, you're a prime target." Five years ago the attack was a clumsy gift card request with bad grammar. Today it can come from a breached inbox, with perfect spelling, the right branding, and urgency, authority and secrecy built in to rush you past your instincts.Phishing, smishing, quishing and vishingCraig walks through the whole family of scams: phishing (email), smishing (SMS text), quishing (QR code phishing) and vishing (voice). Fake toll violation texts and stickers pasted over parking meter QR codes are everyday examples. Voice is the scariest, because AI can clone a voice from two or three seconds of audio, and a call that sounds like someone you know carries built-in trust. As Craig puts it, the common thread is "getting you to react and do something financially without proper validation."Verify before you actThe fix is the same whatever the delivery method: verify the identity of the requester. Craig's two best tips for bookkeepers:Set a safe word with every client. Never publish it in email or any electronic format. If an urgent wire request comes in by phone and the caller can't give the safe word, "click, they hang up" and move on to an easier target.Call back on a number you already trust. Use the one saved in your phone, not the one in the email, because attackers will swap in a number they answer themselves.Michael adds his own version of this: when someone calls claiming to be the bank or the government, look up the general number yourself and call in.QR codes and a real-world phishing storyMichael shares a listener's story. After an office break-in, she tightened up her security, then got caught by a very good phishing email over a busy weekend and entered her password. Craig says scanning a QR code on your phone is relatively benign unless something is attacking the phone itself, but you should know where the code came from. A menu at a busy restaurant is fine, while a code on a telephone pole is not. If the next screen asks for a credit card when you only wanted an event date, stop.Make this the week you adopt a password managerIf you do one thing after this episode, Craig says, make it a password manager: "It allows you to create unique passwords everywhere you go." A manager only fills in credentials on the real site, so it protects you from phishing pages, and it saves you from changing 100 passwords after one breach. Craig also recommends passkeys, which can't be stolen and reused, and says to protect the manager itself with multi-factor authentication. Both he and Michael use 1Password. Set up the next-of-kin recovery feature so a trusted person can regain access after a delay. It also helps when staff change jobs: the next person can pick up the client accounts the last one managed.Links mentionedCyberhoot1PasswordThe Successful Bookkeeper: thesuccessfulbookkeeper.com (resources and links)Part 2 of this conversation: business-side cybersecurity and preparing your teamAbout the guestCraig Taylor is the founder and CEO of Cyberhoot, a company that makes cybersecurity simpler, more practical and easier to manage for small and mid-sized businesses. He began his career in cybersecurity roughly 30 years ago after studying psychology in Guelph, Ontario, and worked at several Fortune 500 companies, including a large bank, Computer Sciences Corporation and Vistaprint. Twelve years ago he founded Cyberhoot to teach cyber literacy in a way people enjoy, using positive reinforcement rather than punishment and shame.About the hostMichael PalmerMichael Palmer is the host of The Successful Bookkeeper podcast — almost 600 episodes and counting — and founder of The Successful Bookkeeper Global. He's spent over 15 years in the bookkeeping industry, working one-on-one with thousands of bookkeepers across the ...
adbl_web_anon_alc_button_suppression_t1
まだレビューはありません