Welcome to the LCL panel about linguists and entrepreneurship. We have three panelists with us today who have each started their own businesses. And I think I will introduce them in some random order Stephanie Rosenbaum, founded Tech Ed, and she divides her time between Michigan and Palo Alto. And I know she's going to talk about lots of things related to this, but the reason she's here is she got her bachelor's degree at Berkeley in philosophy of language. Yay, go Bears. Actually, actually, that was even it's even more complicated because that was the master's and the bachelor's was was in something called unified science and the honors college University of Michigan. So there you go. It's, it's, it's a dual kind of education kind of right from the get go. Got it. Okay, let me introduce everybody and then I'm going to come back and let Stephanie introduce herself more thoroughly. And so Nina founded a company called pixel loom to help develop websites for others. And last but not least we have Samantha from Memora. And this is her new company that started about five years ago, is that right, something like that. And where she has taken her degree in linguistics and turned it to help industry with quality, how to process and understand and analyze qualitative results to surveys. And I'm sure you're branching out and doing other new things and so we can talk more about all the ways you've grown. So, thank you so much for all of you for showing up and Stephanie tell us, because I think you've been in business longer than most of us. Nina, Nina's Nina's a pretty close runner up. I was tickled to see, but okay, so kind of how did I get into this. I got into this because Margaret need the anthropologist wanted to find out whether in this is now in the 1950s wanted to find out whether anybody who wasn't a PhD electrical engineer could understand these new things called computers. So, you know, this is this takes you back to the dinosaur age but that's what it was. And she got the National Science Foundation to set up a course for teenagers, where at Columbia, where Columbia electrical engineering professors lectured an IBM donated a time on what was then $1,000 an hour computer that Watson labs that used a vacuum tubes. So this is, this is, this is really the dark ages but what it did was get me started in what could what was possible and computing early. And it showed me something very early that took a lot of other people a lot longer to see, which is that they were people that were working in this brand new field. They were people, they were some of the nicest people in the world, and they were some of the worst people, worse communicators in the world. They a language was a computer language language didn't have anything to do with people. So, from that experience, I started going back and forth between the communication world and the technical world. When I worked my way through college, some of some of it was in biochemistry labs, and some of it was working as a content developer. So, when I started my company, it was basically as as translation between engineers, and it was had I started the company just as computing was starting to make its way into the business world. And these people needed translators from from engineering ease into a real qualitative language. So, that was that was a place for it. And that's, that's what I did. Oh, what is I don't know is that the right kind right level of star. I think that's a great place to start. Thank you, Nina. I have the feeling definitely are on our sort of the same generation. I took my first computer class my freshman year at Wellesley College it was taught by professors from MIT who came out on the Wellesley MIT bus. We had to punch cards, we had to punch cards, and they got put on the Wellesley MIT bus and run into MIT to be run. And then you got them back you know and, and you had a syntax error and it had to wait another two days, but there was the terrible time when some of the, the card boxes went to the back of the bus and weren't found for a couple of days. And so it was just a really different way to learn programming than anything we might do now. But I also was at Michigan for my P my masters and PhD in linguistics. And then I worked at Bell Labs in New Jersey doing work that really was sort of related to linguistics it was all the same sort of stuff. And so in the talking about we were working on trying to provide feedback to technical people about their writing with computers, and that went on until the best teacher came and that all got clobbered. And then I worked there for another seven years as a basically as a computer high level computer programmer. My husband just got a job at UCI out here in in Irvine. And Bell Labs was falling apart. It was just a really depressing place to live. I meant to work, because everyone was getting fired. Well, laid off. I mean they were just closing department after department. I didn't believe even though I still had a job. And we came out here and that was a 94 we were using the internet on mosaic, but nobody was. And a few years later in 1999, some friends of mine and I started a company to do websites. And which was pretty, pretty radical at the time. And I'm still doing it. They've all gone by the wayside they've all retired but I'm sort of stuck with this hosting company that I run and I can't say I'm making a lot of money at it at these days but I still have clients that I feel like I have to keep going for. That's that resonate. That's really does. What years were you in Michigan. Before you I think because it was my undergraduate so I was there in the early 60s. Okay, and I was there from 70 to 76. And so by then I was out in California. Samantha, tell us about your, your, your route from linguistics into private industry. Well, hi everybody. My name is Samantha and I am the CEO and founder of member language services as Nancy has sort of already stated. I've been doing this actually for about three and a half years. And I always can remember because I have a three and a half year old son and it's sort of like coincides with his birth. You know, the founding of the company so I know that's sort of like how I keep track of how many years it's been. But so I, and actually, having my son is sort of part of the reason why I was motivated to start my own company I was on the PhD track and I was about to finish my masters.  And so, you know, four years ago I feel like the company culture boom was sort of starting you know we're all of a sudden that phrase and people were talking about you know company culture and how important it is that sort of started. It was right, you know when I was thinking about starting this business and so, you know, coincided well that way where I thought you know linguists study culture through language, all the time, and they have been for decades, right, or socio linguists do. So why can't socio linguists then also study company culture through employee language use. And so at first I sort of looked around to see if someone was already doing this because it didn't occur you know I didn't start out thinking, you know I really want to be an entrepreneur I just had this idea and then I was like oh somebody must be doing this. And I couldn't quite find the exact right fit there, there are of course lots of companies, you know that I analyze survey results but not necessarily using a socio linguistic framework. Right, using other types of language frameworks. And so then I decided well, maybe I should do it.  I can start my business sort of slowly and let it grow organically as like my child grows and be home part time with him and so that's sort of why I started it and how I started it. And now four years later it's, yeah, sort of just a rock and roll and business you know I have clients and it grows every year and it's just a real it's been a really exciting adventure and of course though it has changed some of the things that I'm doing have changed you know from what you originally think when you set out right because you're that your idea that makes us with client needs. And as clients bring needs to your attention you're like, is that something a linguist can do and then of course you want to say yes it is just one because you're a business owner but two because you know as a linguist it's important to be flexible and thinking how can I bring my skills to this challenge that a client has and so that's been part of how my business has evolved over the last four years. Excellent. What do we want to take up next. Stephanie you want to tell us a little bit about some of the issues, well how how has your business changed I guess. Yes, absolutely because it's a big shift right. Yes, it's made a huge shift, because when I started the company, we were basically we were right when I started the company we're writing help systems for mainframes. Right. And then we started writing help systems and user guides and instruction doing instructional design for many computers and micro computers when they came out. But it got increasingly increasingly frustrating in that it's, you can only achieve the matter how good your help system is no matter how good your instructional design is. You can only do so much trying to explain a user hostile system, because what you want to start doing is changing the product or system, so that it's not so to lower the bar for the for the target audience and the user community. So, we realized that, and started, basically, we sent people to conferences we sent people back to school. That was actually when my philosophy of language. Academic background which I thought was never going to be of any use to me whatsoever in in the business world or real life I was studying it because I loved it. That's what I began to realize that that that the all the boundary the edge cases and the boundary things and the fuzzy sets and all the victim time that I'd studied, you know, had an had a place in in the world of trying to organize information and get user interfaces to be better. That's the way from doing pretty much 100% of content design and development with, you know, the attempt of the conversations with developers to say, you know, if you would make if you would change this this way. It would be a lot, you know, people would find it easier and it would only take a sense to tell people how to use it instead of a page and a half. And we certainly did that. And one of the funniest things in fact did was writing a user guide for an early piece of accounting software. We realized they must have had two or three different development teams on it who didn't talk to each other, because about half the commands, you had to enter a carriage return for them to take the effect take effect. Yeah, just took effect the second the string went in. And when we pointed this out, they wouldn't believe the company. They find we sat them to look. And they kind of went, Oh my God. Well at least they recognize that it was an issue if you had not a common syntax for your command line. Yes, yes, commands right. Exactly. Anyhow, so what we started doing was more and more interaction design, more and more information architecture which was we've been doing all along, but more interaction design and a great deal more user research because we realized that it wasn't enough, even for us to say no we know how to make this better. Because we were usually not didn't usually have the same profile, you know the socio part as the target audience. And what we needed to do is get real data about the target audience so from having a practice that was like 90% content design and we now have a practice that's probably 75% user research about, you know, and the rest is split between interaction design and still content design and develop. So it's, it's, but we, it puts us much more central to what's up. Yes, now we now we have the cat the picture. That's all right, but just much more central to where we go. We don't have a small child. We have will, we have willow who needs to be part of every conversation. Of course. So I know you have just thrown out a bunch of terms that we've introduced but I'm going to wait for the audience to ask you to unpack them again and I'm thinking of things like interaction design information architecture, you know, and all that kind of stuff. Okay, that's that's new words they've only heard them for the last week and a half a few times. Okay, and user search. I gave the user research talk this morning but I'm sure there's more to say there. Okay, so what would you like do you want to audience demand something more from us I'll let Nina take a turn and then we'll come back okay. So Nina, how, how did you organize your business to start with you said you had collaborators that you were working with, but now they've fallen to the wayside so it's all you. Can you talk about that kind of stuff or anything that was inspired by what Stephanie said. Well we started with three partners. And we would never have formed the company except for one of them who said she would do sales and convinced me and a friend of mine who was a graphic designer that we could do build websites. Although she's sort of a remarkable person we would get in elevators and she would introduce herself to everyone in the elevator which I just amazing because I'm really high. She eventually left and I got another partner and then the graphic designer left and we got another partner and eventually the other the last two basically retired. So we started out as just a company and then after a couple of years we, we managed to get we switched to being an LLC. So that we could protect our personal assets from any kind of suit or whatever. Because we live in a litigious society. We also had a lot of insurance for a very long time I've dropped it all now but we used to carry a million dollars of insurance. So if somebody's website stopped taking money for their product, you know and they suit us. We would have insurance. The website business changed so much over time. I mean, HTML changed everything. When we started it was hard to do websites and you had to have, you had to have a Mac and you had to have a PC had to have all the different browsers and they all look different and you had to code for all of that. And now none of that matters and there's so many high level programs it's a lot. I mean mostly if we do works websites now we do WordPress. So it's just, it's a very different system but as a linguist, what I found was that computer languages are just another language. And I mean, I learned, as I said I took my first programming class as a freshman and I kept taking programming at Michigan when I was getting my PhD in linguistics. And at Bell Labs I ended up being a programmer. So that was just, it just fell out from the fact that what I liked about linguistics was grammar. I mean, I went to college thinking I was going to major in French because I love taking French in high school and after my first term in college, it turned into literature. I was just appalled because I never cared about I wanted grammar forever. So, I think a lot of linguists who may not know that they could do programming, probably should think about it. So you recommend learning to program. I mean it was so much easier when Stephanie and I were coming along I mean women were programmers or there was no, but I understand now that, you know, it's women are very low percentage of people in computer science now but when we were there it was just normal. I mean, there were a lot more men than women but it didn't matter. I mean, you could at this point then they needed these skills so desperately, the field needed these skills so desperately that, you know, you could have stripes in the tail and it wouldn't matter if you could program. Willow could program. Yes, yes. Almost said that they decided this was too cutesy and I wouldn't say. So Samantha. Yeah, you have more to say Stephanie did I interrupt you. Well, it's just just the, Nina was talking about evolution size wise and I've had sort of a similar thing in that we started with basically with just me, and a couple of contractors, and we grew and we grew and we grew at our largest we had 42 employees. Wow.  And so we started letting attrition take hold. And now we're, we're, we're a much, we're much smaller and doing stuff that's fun for me later in my career and not not management which is less fun for me. Right. Okay. I didn't realize you'd been up to 42 that's oh my God. I don't want to say it was dreadful but it was a challenge. Yes, I would say most of the time most of our huge period. We were some but we've been someplace between 10 and 20. Yeah, and that's what I would have guessed and so tell me Nina what we think. These were real employees, not country. They were. Absolutely. In on the neck. I mean we had an employee for one year and, and I was just so much paperwork. Yeah, I mean now we've we've actually say Wade so that now we're much more heavily contractors, because it makes it a little easier to to flex and, and because we've had built up relationships when you say contractors and and the, and people immediately go oh temporary you don't know that you just grab them from somewhere. No, some of our contractors have been with us for 20 years. Some of our contractors have been with us for longer than that. So it's, it's, you know, they're 1099 folks because we don't necessarily need their particular skill for every project, but it's a very, it's a lengthy and robot relationship. Yeah. Yeah, interesting. Samantha have you tackled the employee or contractor challenge yet. Um, no, I mean I do have. I do work with contractors I work with a developer and I work with a graphic designer. So I, I do have that but in terms of like hiring contractors to help do the analytical work that I'm doing the linguistic work I haven't gotten there yet, but it sounds complicated. It can be. Yeah. Yeah, but a good kind of complicated right because growth is what you hope for so.  I think actually I'm still carrying that million dollar insurance because liability because some of our clients require it. So, there you are. The insurance is one of our biggest expenses actually.  Right, so the labor costs are first and then insurance is another big one. Yeah, yep. But and you'd have physical offices. You know, we gave them up during the pandemic and I think everybody's happier. We had physical we've had we had physical offices for for 50 years and in the middle of the pandemic, we finally said this is ridiculous. They're expensive nobody's nobody's going there where we don't just fine. We don't need it we're working just fine remotely we're scattered around the country anyway. So, so we gave it up. And unfortunately some of the stuff is now still in my library. We added a lot of stuff, but because we've only get you know it's only been six or eight months since we hit the bullet and gave it up, but I think we're all happier actually. Good. So, somebody asks Samantha in the chat. What's your corporate structure. Are you a sole proprietorship or did you pick another. I'm an LLC as well. Yep. So, I think probably probably similar to what Nina is now, not what she started out with if I'm understanding correctly but yep and that's for the same reasons to just the right kind of protections for your assets. And, you know, I think an LLC, a lot of small businesses choose to be an LLC because it's fairly simple and yeah the protections are all there but it all depends on it depends on a lot of different factors what you choose. So, I'm seeing a question yeah. Yeah, I stayed a sole proprietorship for quite a while, and then shifted all the other direction and we're not we're a C corporation. Well, in California, if you make less than 250,000 a year, an LLC is cheaper than a S Corp. And we never made that much so it wasn't wasn't a wasn't hard for us to choose. Okay, yes, yeah, and I think it's really common for businesses to switch to you know you might you start out as something and then as as you grow and as your needs change you can switch. It's always easy to switch everything but usually worth it if you have to write. So how do people find out about your work, anybody and how do they choose you over whoever else might be available. Well, I can start with this one. So I found that, well, okay so the, the problem that I was that members solves is essentially workplace communication analytics, and I put it under the umbrella of people analytics because that's the term that businesses are using a lot. Right so they, they conduct all these people analytics on their workforce, and usually the type of data that they're using is demographic data and performance data.  People analytic data for, you know, whatever their, you know, human resources purposes are right for hiring for performance assessment and things like that. So what my company proposes is that actually language should be another data point in that under that people analytics umbrella. So if you really want to know how your workplace is how your teams are working together and how your employees are performing, you should be using language data from them as well organic language data. And so this is usually when I a new concept for businesses, because even though a lot of businesses have a lot of language data, especially since the pandemic when all of their businesses are recorded right, but even before the pandemic, you know, with just in general online online chat services on internal like internal chat systems, and things like that. They have a lot of usually have a lot of language data sitting there, right from surveys interviews things like that. But they've never considered, you know, using that as a part of their, you know, workforce analysis. And part of the reason for that is because they don't have a linguist on their team right was it's I can't believe that. Well, you know, it's so hard to analyze random language sentences if you're not trained to do that right how can you take you know, just even someone with a general communications degree and say like okay here's 1000 sentences from 500 employees, tell me something about how this team is working together from this data. That's a big task but a linguist can do that, as long as you set up the right research framework, you know, and you're sort of, you know, going by a system that's been established right. Anyways, the way that I get clients is that I have to explain all this to them first right because they don't know they've never considered it they don't even know necessarily that their people analytics are lacking because I'm sort of the one telling them hey you have you have a problem and I'm going to tell you about your problem and then I'll solve it for you. So that's a slow way to grow. Because the problem isn't necessarily obvious to them but once they see the potential of you know all that data that's there and then they realize. Oh my gosh, if we started analyzing language data we wouldn't have to survey our employees every six months, or we wouldn't have to, you know, like bug them, and doing like, you know, check ins as much right we were just collecting the data that's been there every day in the workplace, and, and using that as our metric in a systematic way. And so usually that goes well I have, I tend to have a really positive response in that first conversation and then it's just all about figuring out you know the best sort of project project arrangement but for me that makes that means that I my, my sales process right from the sales cycle I guess you would say from start to finish is slow, because I have to reach out to them. And I usually vet companies ahead of time so I'm always the one reaching out first and doing all of that sales work. I guess I should say that now I'm in year four right and so companies do reach out to me now. But in the beginning, I reached out to them, and I said hey I have this really cool thing that I'm doing I'm a linguist. Let's talk about it. And if they said yes that was a good sign and then you just go for it and propose it, and you get a lot of knows but you also get some yeses and all you need is a few yeses to start. And so I put in something that nobody was talking about before, right, like linguistics for people analytics, because becomes something that people are like oh yeah I heard about that or. Oh yeah you work with so and so didn't you right. And so then it sort of happens that way. So it is a slow process and I don't have do any other kinds of formal marketing at this point, because I've been intentionally sort of growing it a little more organically and as I said I've been home with my children part time. So I wanted it to sort of happen naturally like as I was ready right to transition to more. It's much harder if so you had a really hot sales person, getting you lots of new business, and I noticed Polina has a question and I want to be able to take that and then I'll come back to Stephanie. Hi, yes, hi. I actually wanted to ask what you were kind of describing, but so I will like to make a like a deeper question of like, after you talk with them and then say like okay let's give it. Let's start a trial, or like, how can you fully convince them that your product is worth it. And at the same time, how do you convince people to work for you when you're just starting. I know they would be in different process you will not just try to collect everybody like have 100 employees at the same time that you just started, but I wonder how you start becoming like there's also about like, oh now I need to maybe hire people to help me. This is something that you cannot just do alone. Thank you. Well, I will either Stephanie or Nina take the hiring questions since I've never hired. But I can say that, you know, in terms of like when you're selling something. One, I learned that you never want to give your services away for free. And that's like the bad, don't do that right so no trials no free anything. You know, you want to be genuine and in, and as long as you're, you're fair, you know, I think that's sort of the key thing and the other thing is to have examples of previous work right. And I'm able to say, you know, here's an example of a project I did, or, you know, testimonials from other clients, that's all great. That helps convince the business to go for it. But I think one way to get around giving away things for free is to have some smaller scale project options. So for me, because what I'm doing is brand new and the company's never heard of it and they're like a what's linguistics and I don't think we want you to analyze our like internal company chat, because that's, you know, they have some, like there's just a hurdle to get over there. You know, we can start with something really small, you know, maybe one team, or one person, right or one meeting. And not for free right, but a small project that helps them say like okay we're curious about this we want to try. We do have a budget for people analytics, let's see what linguistics can bring to the table, and sort of have that as part of your proposal process right it's sort of about scope and scale. Yeah. Yeah, definitely. And, and the other thing I think that's convincing in addition to samples work samples which are very, very convincing. The other thing is to have a clear and convincing the correctly convincing proposal that isn't just full of adjectives but makes makes describes the process and helps the people that are read that are reading the proposal, understand what they're going to get and how it's going to work and how it's going to play out because, you know, it is less so nowadays in, in user research and interaction design but you know, 20 years ago, hardly nobody knew what that was either. And we were having to go through exactly the process you describe. Now it's much, much better known. But I would say who. So indeed, as the chat comment said, you were describing business development and the other thing that I've always done is spoken at a lot of conferences because it's a combination of sort of paying forward whatever I've learned I'm, I'm sharing it with with other professionals and other people, and it also makes us visible. So we get, you know, we get a lot of inquiries as a result of that. But even then it's a funnel. And then this is probably a classic sales thing and I'm not a classic sales person but you know, I, I use I'd say I used to talk to 100 people to get to write 10 proposals to one project. And, you know, talking to 100 people can be, it's, it's challenging. But if you don't talk to them, then they can't get to the next step. So you need to do that. Cool. Yeah, that's really well said Stephanie. Yeah, the developing that funnel takes a lot of conversations but it does, it gets easier over time right like the heavy lifting is is in the beginning. And then once you get that funnel started it starts to take off on its own. Yes. And although it and people cycle in and out. So you get where you've got a lot of refer the more you do, the more referrals you get, but then people change jobs and you have a recession.  Yeah, yes, very much so. Ashley, I see you have your hand raised I assume that means you have a question. Thank you, thank you. I've appreciated hearing from everyone. And part of some of the confusion that I've run into with some business ideas is a bit of context and history on how what I'm trying to do has been done. So, I hearing from Stephanie and Nina, it sounds like you're more so saying that the, the, the services that linguists can provide have been being offered for quite some time, but it's a matter of them finally being recognized, but then from I'm kind of hearing that this is kind of something new and completely innovative, and I'm having a hard time finding where, where really the the truth might be there or how I can better approach companies in saying this is kind of how this has evolved over time, and where I'm kind of picking it up. And it's being confused by the fact that there are there are probably 10 different professions that overlap in different ways I've seen some very good visuals about this, about how no content design and development how that overlaps with user interface design how it overlaps with information architecture how it overlaps with with textual analysis, and there's bits of all of these different professions in what we're doing. So, again, it's a, you know, we have a communication challenge to help solve our clients communication challenges. I think, and in adding to not want to add something to what Stephanie has just said, Samantha is providing a service which probably wasn't provided before and exactly this way to an audience that hadn't been tapped before. So Samantha's audience is the HR departments at companies that are big enough to have budgets for this kind of analytics, whereas Stephanie's customers are companies who are developing products that they need to make sure communicate between the developers and the end users. And so that's where she started but she's still in product side and not in HR side. Yes, different clients that you can attract that your business can attract depending on the services you're providing. Does that help? We get an occasional HR client but mostly you're right mostly it's in product. Right. So it's the service or service that that linguists have been contributing to businesses and setting up businesses to help other people. But they've been doing it in a variety of different ways. Right. Yeah, I'll help Ashley. Anna, and to add to that to Ashley Anna. I found that from a sort of textual analysis side that the product world has been is sort of a head right of the company internal world. Right so if you're if you're looking at like products that are out there. You know that you can sort of like purchase for textual analysis to different things or like software products and things like that. Those are sometimes like more advanced than what a company might consider like using internally for you know their own workforce it's sort of like a, I guess, half of what I'm selling is sort of the idea that it's important to apply some of those same approaches right internally and then what the value of that is. So, yeah, like Nancy said the customer or the audience is is different, you know, for the product side and the company internal side. And I didn't even address Nina there so Nina, what size companies or organizations come to you to get help with their website design. We primarily did websites for small companies or single single users.  We did originally. When we first started we were doing quite a few websites for groups at UCI. It was great. It was quite lucrative. But then things got a little easier to do and all the bit and the UCI had a whole UC system had a big budget crunch and so department started using graduate students to do their websites for free. So all that. Well, I don't know if they were free but they didn't get paid anything like what we got paid. Right. And I'm guessing also that that was part of the evolution of universities realizing that they had to control the websites in some way so that they all look like they come from the same organization. So there were higher level standards being put on people. Yeah, that was even later. And there was the push to have them be websites that each. So each department in the, in the big group would have a website that looked similar but they would be able to update it themselves and I'm not even, I mean now it's all WordPress as far as I know. And that's interesting though. We have mostly TechEd has mostly commercial clients but we actually have a lot of hospitals and a lot of universities. And it's mostly for user research so that the colleges, the University of Michigan is one of them but not alone by any means. The colleges have people that as, as Nina says that are doing it themselves. But if they're perceptive they recognize that they still need to be informed by user data. And so they'll come out to us because they don't have staff or they don't have staff for research. So when you do research what kinds of questions are you asking. Okay, we're, we're basically observe well depends on what kind of research, but most of the majority of the research we do is observational. So it's kind of it's kind of applied anthropology, and we're watching we're observing people use whatever it is whether it's the university website, or somebody's software product. And we observe, we observe people and we see what kinds of problems they have using a product or service. And then we, we watch several of them not just one, because people are different or a lot of individual differences. And then we go back to the client and, and we describe and we basically tell stories we describe the problems people had, and, and often will then go on and say, you know if you organize your menu this way. Then people will find the things they're, they're looking for right away, instead of struggling. And that's of course a vastly oversimplified realization, but I mean I remember working with back when they had standalone terminals, no dumb terminals. There was one that that took half a dozen people to find out where the on off switch was was on the back of one of the legs. Oh, yeah.  In fact, there are, there are a lot of companies I can, I can list them and you probably heard of me too, who are saying, we need to make our products delightful. And I would love it if they were delightful but I would love it even more if they wouldn't put all kinds of terrible barriers between the target audience and the product. So, I'm all for delightful let's try to solve the usable first. So that's that's my own hobby horse I think is is don't try to make this because don't try to make it fancy until you've made it work. Right. Right. So, Ashley, I see your hand again, please. Yes, thank you. I did want to say thank you. You're asking me if that did clarify that really did answer my question very well. Okay, all I did want to ask Alex also Alex Johnson I wasn't sure if you were still part of the panel, because in the room, she can talk. You had introduced your, the company that you had and kind of what you were the services that you're providing beforehand. And I was curious how you approached or how the company that you were working with approached clients to do that type of work, where you considered HR, or the different part of the company. Thanks Ashley. So, when you're starting a company I've started my own company called strategic language solutions and I've worked with another boutique, meaning small couple of two people to do work with different clientele and when you're so small you do all of that work yourself. And you are just working your network you're reaching out to people you are connecting with people telling them what you can do for them what problems you can solve. And in our case, my case and with my other consulting work, we don't work with HR and larger companies we find it in our case to reach, it's more effective to reach out directly to two managers and people in C suites who are decision managers and control budgets. So we focus on that level when we are selling our products which are curricula on presentation skills and relationship management skills and leadership development and intercultural communication. So, you know, there are there are many ways to to go about business development but you can't get around just talking talking talking and meeting with as many people as possible to build up that network and to circulate what you can do, and thank you for defining that. Yeah, no I was so glad that you said it because we are having the first linguist in the C suite that I know is going to talk to us next week. Wow, there's a woman who's got a master's from MIT and did her undergraduate there too, who has become the CEO chief operations officer at for technology at Salesforce, and tech writing falls under her purview and she started out in tech so here we have a lot of examples of tech writing and then moving on to other directions within the same company or, you know, to expand to include that as well as other specialties. So thank you for introducing that term I think I've used it already but I wasn't clear that the audience knew that expression. Thank you. Paulina, tell us what's on your mind. Miss Stephanie sorry I have issue speaking to you in English. You were talking about not not like at the beginning like trying not to keep it a fancy to be like working detail like and like with the proposal be very descriptive and give a very good job. I was wondering, particularly Nina and Stephanie that have like a longer career, how has been your way to manage your money without asking specifically how like the amount, but when you start you have a limited budget. Did you have managed to make it work for you to expand your business in a way that is profitable. And then in a way that let you move forward. That's I would like to hear your stories. I had two business partners, and we all three were married to UCI professors who provided health insurance and had incomes.  You know, it was your only source of income and you were going to starve on the streets if you didn't make a big deal of it. And we never did that. We never, we never had to, and I don't think we really wanted to I mean we were doing it sort of. I would say it was a hobby but and we were perfectly happy to make money but we didn't have to make money. And so, since we were partners. Basically we just took the same amount of money out that we made for each of us. And if we didn't make money we didn't take money out of the company. It's not like having employees who have, you have to pay. So it's just different so if you want to be successful I recommend having to be successful. It's a challenge it was it was it is stressful, because you, you hesitate a long time before deciding to hire someone, because you need to try to see the stream of projects coming in, but people don't make up their mind I mean it's, it's sadly still rare for us to get, you know, a year long there are our average project is probably two to three months. So, and you can't predict how long people will take it to make up their minds. So you're talking this is this 100 people talk to and 10 proposals. Okay, now you've got your 10 proposals, and they're all out there and you have no no idea when they're going to say yes or if or when they're going to say yes or no. So, we, there were times that we have actually 15 or 20 proposals actually out as, and none of them had said yes or no yet. So it's still you know all these years later, I still go, if you're going to say no please say it quickly. So there's there's there's definitely stress there. It's easier in the sense of financial stress. It's easier if you have contractors than employees because you don't have to pay them and don't have them. But on the other hand if you're trying, one if you're trying to do professional development with your staff members they need to be, they pretty much need to be staff members and send people to conferences and send them to courses and do continuing education for your employees. And two, if you need to be able to respond very quickly to people with rush projects, those, and then three, if you want your teams to be really embedded together and work really well together. All those things argue for employees. So it's a trade off and, and, as I say we segue it from not never having a contractor to now probably having more contractors than employees. And I think, I think a balance is actually good. You know, if if I were earlier in my career I would still be trying to maintain about an equal balance if I could. So that you're tempering the risk. You're not paying for all the employees to be, you know the horses sitting in the stable eating hay even when they're not racing or whatever. But, but on the other hand you have a continuity. And you have, and you have the fact that you're doing continuing education with them so you know what your people know and, and, and you see them increasing and improving their skills. I know is that does that help. I want to follow up on a different thread that we've been pulling on and that is more on this business development stuff. Namely, are you generally successful at getting a phase two project and a phase three project from the same client. Meet all of us. Yes, anybody who wants to jump in absolutely I mean if it weren't for that, it would be impossible. You know yes indeed I mean our, our, our best client, you know our best projects are the second or third or fourth or 10 project for a client. You know there are some, there are some, some of our clients we've been working for for more than 20 years now. I think that's really important so that means that at the end of your project when you say here's what we learned about this particular thing here are recommendations and should be let's let's check the following things that we didn't have a chance to do before. And when can we start on that. And sometimes it's a big we've got one we were working for one professional society in San Francisco, where there'll be a gap of two years we've been working for them for more than 10 years. And we're not doing a project all the time because they need a year or so did I just one set of research that we've done. So we're typically doing one research project every couple of years but but the continuity is there. Right, so that again is another, you know, balancing act about employees versus contractors if you've already worked for the ACME Society. Now some new staff members going to come in who doesn't know the history. Is that an issue. Yes, even though it's the same department right right yes. Yes, exactly. Now having long time contractors as I do helps that. That's why I'm able to do more with contractors now, because some of them have been with me a lot longer than many of our employees have been right. Anybody else have questions that you would like to address Nina do you have anything more to say about follow on projects. We can have a whole lot of that. All my clients, I'm hosting their websites. I rent a whole server in Michigan.  Right. So it's sort of party or hosting fee. I've always liked the hosting because it's making money while you sleep, whereas everything else was, you know, making money or not, while you're struggling to get something done. Alex, did you have a question. I wanted to, you know, present another kind of encouragement for people who are thinking about starting their own businesses and thinking about business development and how to get that first client with respect to follow on projects because so often, delivering that first product or service is that that test of how you mesh with that company, how you align with that company and the value that you deliver you can put into place some metrics that will help you you can always include feedback you can try to develop relationships with champions within that organization this is why my organization targets the C suite executives who have the budget decision making and also manage teams who they want to develop so we're in the talent development business and getting somebody on your side who can champion your work within an organization with that type of decision making power can also can often lead to those follow on projects and in one or two, you know, very successful cases we managed to get on retainer with the company. This is like the golden, you know, Exactly. Because that means that they're paying you, you know, a certain number per every month to have you just at the ready to work with employees you get constant income that can kind of balance out juggling a portfolio of proposals that are out there and then coming in at various staggered timelines. So just wanted to throw that out there. Yeah, thank you that's a great model and I had forgotten that but I have I know people who've gotten those kinds of relationships going in it. It's lovely, and it may not last that long. I mean, the one example I'm thinking of is somebody who used to work for Stephanie, who's on her own was on her own at that point, and came in. This startup, well, not a startup, I shouldn't say that this company had like transformed itself and said, Oh, we were on this New York Stock Exchange, I guess we should have a customer experience department, which they'd never had, you know, like the CEO was trying to master Photoshop to get the stuff to get it was crazy. Anyway, they weren't they were in business for 16 years and finally formed a customer experience group which included a user experience group with a staff of more than one designer. And so they hired this experienced user experience with professional to come in as the UX manager was saying well how many designers should I hire before I get a research manager in here. How many, how do I get a writer in and when, when should I time that. And so some of those decisions about when to do things how to how to write staff descriptions that wouldn't overlap too much, and things like that so she was on retainer for probably, I don't know, two years or something, which was great because they didn't even call on her for, you know, I think it was quarterly she was getting paid and so I said, When I got there and I know her and I said, Okay, for this quarter can I ask you to do the following tasks because I don't see anybody else calling on you. Can you demo how to do this methodology technique with our, our department staff and so that I got to benefit from the fact she was already on retainer. So that's great. People are getting exposed to these ideas today and I hope that they will have many more opportunities to meet more linguists among the people that are yet to meet that I'm just pulling out of the top of my head, who have run their own UX business or communications business or something. I'm going to talk to Kevin badison who's going to be on the program with me tomorrow morning. We're not talking about his business, although he could have easily been a member of this panel as well. And if you want to grab him at one of the mixers or just message him on I'm sure he'd be happy to talk to you about that he was based in Sweden for a number of years like 30 years, and was working then with European audience largely but occasionally other parts of the world as well and had he had a long relationship with the Canadian embassy or the Canadian business development people in Sweden. Dana Chisnell had her own business for a long time and she co founded a nonprofit that I ended up working for for a while and she's currently with the US digital service but she could talk to that issue as well.  They may not call themselves linguists, because as we've heard from Samantha and others. Linguistics is kind of esoteric. I don't know what linguistics is are. Oh, how many, how many, your linguist how many, right, that's the question. And at right right away you know how naive they are so I think this is another issue is that we don't know how to hide our linguistic skills and knowledge, but we don't necessarily lead with it because it's not terminology that's familiar to the audience. Although Samantha I think is doing a great job of educating her clients to ask for linguistic services. Yeah, I think it's a good balance on to introduce the tech like linguistics as a technical term with something that they are already familiar with because it does give you credibility I mean linguistics and communication. You know, can be described with the word communication but linguistics is also more than that. And so it's important to say, you know my skills here go beyond, you know what you might associate with communication, right. And that's an important value add that you bring as someone who's doing work for a client. Great. So this Aubrey has a question in the chat so if Aubrey want to ask it you want me to ask it either way. It's about data security in some cases case but maybe others have comments about that too. I do see the question. So Aubrey asked, how do you handle the security concerns with analyzing user data. Yes. And so that is that is a concern for some clients. Luckily, when you're when I'm analyzing typically internal communications. So the, the data stays inside, you know the company, and it's only company internal data so you know teams. I typically never analyze transcripts of meetings or you know, things that involve any of like the, the clients clients, right or anything that involve you know another third party. So they're sort of that like restriction. And then it's sort of up to the company I of course have insurance as well. We were talking about insurance earlier in the, in the conversation. But I think you know the way that we handle the security concerns is just with the level of the level of comfort of the client. Some clients want to include a lot of demographic data along with a, with a language transcript because you can learn more. So for example, you know I've recomended that oh I'm sure it's anonymized. And actually, yes, no names, but sometimes it's not anonymous in any other way because they want to know that they need to include that demographic information in order to really understand how their teams are working together I mean, if you have. What's a good example like the only woman on a team. Yes, exactly or to take a random example yeah.  And sometimes it, you know the company does want to know who that woman is because if you, you know, or who that person is, because if you're analyzing the language, you know you want to use that data to improve business outcomes and these are your employees. And that can be important. And so as long as the data stays within the company, usually companies don't have a huge issue with it. But that's another reason why I typically don't analyze email everyone always asked me about email right away they're like oh so email so you analyze emails. And actually not usually because emails are complicated and they go, there's a lot of external uses for emails, right, and you can filter for internal emails only. But typically what we're trying to do is actually you know internal meetings internal chats, things that are truly you know exclusively company internal to keep that secure data secure and private for the company.  That's something that your employer actually owns and so they get to make the decisions about that. Yeah. Yeah. Good. Good. And how aware are the employees of your work. You know, I actually haven't had. I haven't had a lot of employees or people, you know, who are sort of the team members right express concerns about privacy usually like any privacy concerns are sort of addressed with the person who's sort of doing the purchasing or the person that I'm like selling to. And once it's been done, sort of the sale, the teammates who are participating in the analysis or the language that's being analyzed those individuals are usually just really excited about it because it's just something new, you know and interesting. People love to learn about their own language patterns. And it feels, you know, like something special that a company is doing to sort of, I don't know, like really, really, you know, take notice of how their team is performing. Excellent. So thank you all very much. I know that we're coming up to the hour mark and we have another talk that starts on the hour. So if anybody has some closing remarks they'd like to make something that I didn't ask about or you didn't ask one another about be happy to hear some of those. That's a great question that almost that is does is a really nice wrap up question. Excellent. So let's talk about it. I'll try not to pull my headset out again. Hmm. So, are there any so I'm going to read out the question from Andy. Are there any recommendations of where to start when thinking about starting our own business, especially related to our linguistic skills. So, send them off with some fabulous recommendations. I think try. I think think I guess I would say, look for problems that you can address or solve. Think about, think about what needs attention in the context of what you know how to do. Think of examples of experience, think of examples of experiences, which are painful, which could be improved by applying related skills to them. And then, I think I, I feel like one has a better chance, looking for a problem and saying you can solve it, then building a better mousetrap because somebody might not want a better mousetrap. Nina, any closing thoughts. Well, I certainly wouldn't start a website company at this point there. I don't have any and so much as so much easier to do than when we started so I don't know what to say other than that. And I think you're a great example of somebody who started a business to maintain your, you know, interest and lively hood but it wasn't the primary source of your family's income. And I think that's true for a number of businesses that they're not all interested in giant growth. So it may be that Samantha is going to turn into a whole industry, because she's tackling a problem that we hadn't even addressed before from a linguistic point of view. Stephanie's shown a wonderful example of how the growth of your business might be organic because of the changing needs the changes in technology, and so on. So that you've grown, and now you're coming down a little bit.  Are you going to close the business or are you going to sell the business. That's those are indeed some of the upcoming questions, right.  Right. So there you go. I like hard problems. What could I say, great. Well, we certainly appreciate your spending some time with us today. And I'm hoping that if students have the participants in our program have further questions they can be in touch with you in the future. It was a pleasure.


All right. Good morning, everyone. I'm Ray Mitchell. I'm going to talk today a little bit about securing your WordPress website. As a bit of a disclaimer, I'm not a security expert, but a user. And for most of us here at the conference, we're users, whether we are first time here in the word WordPress or hardcore power developers, most of us actually use the platform. In my day-to-day life, I actually have a small web design business out of Winston-Salem in North Carolina, where I work with small businesses and nonprofits to help them with their websites. The reason why I'm talking about security is I had a little bit of a scare on one of my own sites. I saw somebody try to log in. Sorry about that. Oh, very good. Sorry about that. I saw somebody who tried to log into one of my sites with my username. And my username is kind of unique, and I was wondering how they got to my username so it forced me to kind of look and find out a little bit more about how to secure my site and prevent people from breaking into it. So, in order to get started, and again, because this is in the user track, a little bit of background about WordPress. People hear about WordPress and they know about it, but they really don't fully understand the impact of WordPress and the WordPress ecosystem. Right now, WordPress powers about 20% of all sites on the Internet. There's a lot of sites on the Internet. There are sites that have come and gone, but when they look at the technology that powers the Internet, it's about 22% of all websites actually are WordPress-based. And for websites that actually use a CMS or a content management system, over 60% of those sites actually use WordPress. When I'm selling WordPress to my clients, they tell them, you know, it's easy enough for the PTA and the Boy Scouts and the church group to use WordPress, but also it's big enough for big companies as well. So, this is actually a WordPress theme developed by somebody in the WordPress community that they donated to the Boy Scouts. And it's a theme that, you know, your individual Boy Scout group could customize and actually use, but it's a starting point, so literally the Boy Scouts have their own theme and it's easy enough for members of the Boy Scouts, 11 to 18, to actually use as the way to promote their troops. But again, beyond the Boy Scouts, WordPress is used by bigger organizations. Time Magazine and they're stable of companies. Sports Illustrated. Reuters, who produces news internationally. Entertainers, like Beyonce. And this is actually a pretty interesting site because it's very visual in the way the site is laid out, but it's the same WordPress that we all use for our sites. So that's just the loan. His site is powered by WordPress. And again, lots of different entities use WordPress and face some of the same issues that we face as users every day. This I put in because it's a corporate site. It's actually in New York Times, and New York Times uses WordPress for their blogs, but also for their main corporate site. And I found this one to be interesting because every time you load the home page on that site, it gives you a lot of statistics about how people are actually using the New York Times and interacting with their sites and their properties. And all of that is behind WordPress, which is kind of interesting. And no WordPress security talk would be complete without this one. Ashley Madison actually got hacked, or recently, and we heard about the hack last week. It was not a WordPress hack, but it goes to show that one big brands and profitable companies use WordPress, but everybody is subject to potentially being hacked on their website.  How many people have heard this statement? Well, there's no viruses for Mac. That's the reason why I have a Mac. Well, the reason why for so long there were no viruses for Macs is nobody used Macs, right? Until the population of people who started using Macs started to grow, there was no reason to start putting viruses on those machines. Well, with WordPress being so ever-present on the Internet, there's a lot of places and a lot of value in trying to hack WordPress because there's targets there. And if the targets are there, it's worth your effort as a hacker to build something. In terms of WordPress as well, it's almost too easy to use. As I said, Boy Scouts, PTA, church groups, individuals, sometimes bloggers, you know, you can build a website that's actually powerful, communicates your message, gets out on the Internet and does things, and it doesn't take a lot of effort. You can get a hosting package for very little money, use their Fantastico or whatever their one-click install is, and boom, you've got a website. So it's really easy to do. Because it's so easy, people don't really think about it as something they need to work on or maintain. So I build and deliver websites for clients and tell them, well, I offer maintenance and I'll keep your site up to date and make sure everything is up to date. No, that's all right. I don't need that. People see the site is up and it's complete to think that's the end of the game where your website does need continual attention and maintenance.   They're not really interested in your five-page website. The people who are doing this or are looking for scale, if you're like I am, you've got a lot of emails coming into your inbox and those emails are offering products of every type and every sort for every kind of interest you may have.  Well, there's not one guy who's actually finding your email address and sending it out. It's an automated process. The way they do that and why spam is so lucrative, they can send out a million spam messages. If one person buys their 39.95 product, well, they make 35.95 because they're not paying for the resources to send those spam emails.  It doesn't cost them anything but the time to write that initial script to take over your website and use it to send spam. So it's not about the cooking recipes that you've got on your blog. It's about what your blog can do to help criminals in their activities. So there are a couple of different things that may happen. Drive-by downloads or malicious downloads. You always hear people downloading something, you always hear people downloading something and all of a sudden the machine is not working properly. Or as of late, the crypto locker where you may click on something and a pop-up tells you, well, you're being held ransom and once you pay $600 in Bitcoin, you won't get your hard drive back. Well, that's drive-by download or malicious download where they'll use one of your links for a recipe and when people think they're getting chocolate chips, instead their hard drive gets locked. I mentioned email spam, WordPress and most PHP-based hosting has the ability to send mail using the platform. So a hacker may get into your site and use your mail function, the same mail function that may drive your contact form but use that to send out thousands of emails a day and not be able to be traced because it's coming from your server as opposed to their server and whatever nation they may be. SEO spam, a principle of SEO used to be that you needed as many links to your page as possible.  You may not see them as a user, but if somebody comes from Google to your site, then those links will be available to them on your homepage or pages in your site. So as a site owner, you may not recognize that's going on, but you may find out that people say, hey, are you advertising this on your website? And it takes a while before you realize what happened. You may have heard about denial-of-service attacks where thousands of thousands of websites or thousands and thousands of visitors come and flood a website with visitors. Well, typically it's not individual visitors putting in an address on the web. It's using your server and your server capacity to hit that site and hopefully bring it down. And there's also hacktivism. A lot of times the hacking is not necessarily financial, but it may be political in nature. So this is a recent FBI announcement and it actually specifically talks to WordPress. ISIL was defacing sites that they thought they could use to promote their message, right? So it may be sites specifically that they disagreed with from a political perspective, but it's an opportunity for them to get their message out and cause a little bit of havoc wherever they go. So even small sites are actually vulnerable and you can actually go to the FBI site and pick this up if you wanted to read it a little bit more detail. So how do you avoid these things? How can you protect your site? Well, I put it into like three areas that you really ought to pay attention to. It's practicing good hygiene and I always use that phrase kind of tongue in cheek, but really if you do things to kind of keep yourself and your site clean, you stay healthy. So it's the practices that you put in... the practices that you put in... thank you for being a great reminder on the microphone. The practices that you put in place around managing your site become very important.  You should take advantage of the tools and best practices. There are things that can help you manage and maintain your site. WordPress itself is one of those things. Keeping your WordPress version up to date is important in terms of managing your site. But around security, the probably the most important thing is don't put your head in the sand. Don't say, oh, it's too big or it's just too much trouble. You know, you can take actions that actually proactively protect your site. The thing is everybody can do something that helps keep their site healthy. It's very easy. You just have to make the decision that you want to do it. So there are three areas or three steps to securing your WordPress site. The first one is manage your behaviors as the site owner. You really don't want to be your worst enemy by doing things that make the site insecure. You want to make sure that the way you operate and the way you do business is meant with security in mind. The second thing is to control the users that have access to your site. You don't want to let people intentionally in as a user and give them the ability to mess with your site or inadvertently give them the ability to mess with your site. And then the last thing is to do things that actively frustrate the bad guys trying to infiltrate your site. And I put it here as frustrate because it would be like protect your site from hackers or prevent anybody from breaking in. And people talk about that in terms of security solutions just like banks. There's always someone who can break into a bank. There's always someone who can steal money. So what we want to do is really make the task as hard as possible for someone visiting your site with a bad intention. It's like with your home. Even if you don't have an alarm on your home, putting up alarm stickers on the windows sometimes makes the burglars go to other places. Putting an ADT sign near the driveway makes people drive by. You want to make your site look and act as difficult to get in as possible so that hackers will go someplace else. Could you give us a secure password? Secure passwords? And we'll talk about that. Two-factor authentication. We'll talk about it a little bit. But on my sites, I try to use two-factor authentication, which is in addition to having my username, which is a good username and a strong password, I actually use a Google authenticator with my site so that when I want to log in to my website, I've got to press a button on my smartphone that gives me a code that's only good for a minute and it matches the code on the back end of my server. If I don't have that code or I take longer than a minute to log in, I can't get in. I got to request another code. I got to my specific smartphone. So people, you know, even if they knew my username and password, if they didn't have my Google authenticator token, they wouldn't be able to get into the site. So that's one kind of easy measure, relatively easy measure, because it does require one extra step to get into the site, the second factor. But it's one thing that keeps people from, you know, just hitting your login page and getting into the site. All right, so from a site owner perspective, one of the things that I suggest is that you skip the one-click install on most of the hosting packages. It's not very hard to install WordPress as a manual installation from scratch. There's really great instructions on the codex at WordPress. It requires that you have FTP access to your site, so it is a little more hands-on dirty. But one of the advantages of doing that is you know, as part of your process, you're getting the most recent copy of WordPress. Your hosting company, where you're getting your hosting for $1.99 a month, they don't have the same interest in making sure that they've got the most recent version of WordPress. There's other things in the manual install, using the WordPress salts or a secret key that actually makes your installation unique and locks out any other prior user, right? The one-click installs also sometimes use the username of admin. It doesn't make sense for you to use the username of admin. That's typically the username that hackers will try first because that's the default or was the default for so long with WordPress that they figure if people haven't changed it, they can actually get in. And what's interesting, WordPress actually stopped using admin as the default username, but people are still going in and putting admin as one of the usernames because they think it's easy to remember, right? Just making that simple change also helps to defeat attempted entries into your site. The second site owner behavior is one that people neglect or don't do often. It's keep your WordPress core and WordPress plugins up to date. When security opportunities come up, WordPress, for the plugins and the themes in the repository and for WordPress Core, they actually update the software, and it's one way of making sure your site is up to date. One of the things that I do when I'm actually pitching somebody about maintenance is actually look at version of WordPress that they're running, and if it's an old version, I can tell them, you know, since your site was last updated, WordPress has gone through these different updates that you've not applied to your site. Don't you realize you're vulnerable? Let me help you by making your site up to date and getting things where it should be. Well, the hackers are doing the same thing. They're looking for old WordPress installations with vulnerabilities, and those will be the sites that they try to attack. So to defend yourself and defend your site against that, it's keep your plugins, the WordPress core, your themes up to date. And when I talk about themes and plugins as well, be sure that you're using safe themes. You want to use purchase, if you're going to purchase the theme, purchase it from a reliable developer, don't buy a cracked or wears version of a premium theme. You don't know what additional code or what additional backdoors may have been put into a free copy of a premium theme or a free copy of a premium plugin. The WordPress repository has, you know, five-digit thousands of themes, both free and commercial, and I know maybe close to 100,000 plugins that are available. So you can definitely find what you need up to date in the WordPress repository. I talked about this a little bit already. Don't use admin or other easily-guessed usernames. One of the things that I've seen recently is that people are actually using the domain name of their site as their username. Well, if I was going to choose what to break in with, the first thing I would choose would be admin, and the second thing would be the domain name of whatever site it is. So if it's MyCookieRecipes, don't use MyCookieRecipes.com or MyCookieRecipes or some variant as the username. Try to think of something that's unique. And then as the site owner, make sure that you're putting a strong password on the site. Now, a long or complex password sometimes is annoying, but it's not as annoying of having to recover your site after somebody guessed that your password was password. Okay? I got a little video I'm going to play at the moment, but you'll get the idea. I don't know if you watch Archer, but they're always getting hacked at his spy agency. At any time someone can't remember what the password is, it's guessed. Choose the complex password. Things should not be obvious as to what the password is. It takes just a little bit more. Eight digits is a good start. If you were to add two digits to your password, you increase... I don't know the number, but I can tell you what it is. You increase the difficulty of your password by 88 times 88. So if anybody's got a calculator or a quick math, you can see how much more difficult it is every time you increase your password by two letters or two characters, which would be uppercase, lowercase, the numbers, and the allowable special characters. The asterisk, the dash, question mark, and so on. As a site owner, you shouldn't use admin. You shouldn't use a weak password, but don't underpay for your hosting as well. There's plenty of hosting deals out there. We'll host your site for $2.99 a month. We'll host your site for $1 a month. You want to pay the right amount for hosting because if they're not making the amount of money that they need, they're not going to do the system administrator task to make sure that your website is safe. There are a lot of small hosting companies that resell other people's hosting. So it may already be a crowded, unsecured server that somebody else is selling to you and then crowding a whole lot of other accounts onto that. So the likelihood that you can get hacked increases if there's a lot of potentially unsafe sites on your server. So if your website is important to you, be reasonable about what you're paying for the site. Check the reviews on hosting companies to help you determine which companies are good. WordPress has some recommended hosting companies. We've got good hosting companies as sponsors for these events. Those will be some good places to look at for potential hosting.  Please make sure you're backing up your website regularly. Back of the database and the content. There's great plugins available to back up your site. There's free and premium or paid plugins to do it. I use a paid plugin that I like a lot. It saves me a lot of time from working on the site, but it also helps me recover people's sites if there's an issue. It may not be a hack. It could actually just be a file that's corrupted, but it helps me to replace the database and helps me do things quickly as opposed to having to root through each individual file or check database entries to see what might have changed.  Make sure your computer's antivirus is up to date. If you have picked up a malicious file on your laptop or PC and it's a keylogger, well, they will actually get your username and password on all sites, your bank and your WordPress site. So it's important to keep your basic antivirus up to date as well. With regard to the user behavior, make sure your users actually have strong passwords. As an admin, you can grant somebody a password and you can give them a password when you're setting it up and issuing it. But if your site is a membership site or a site where you actually require people to sign in to see the content, people will create their username and their password. Make sure that you are setting it up in a way that people have to choose a secure password. You don't want to do the best in choosing a secure password for yourself and then give one of the people that you signed up ability to access your website with a very weak password. From a maintenance perspective and a site owner perspective, you want to make sure that your users have the appropriate permissions. So a lot of times you'll have a site where maybe a group of people are working or people change positions frequently. Make sure that you remove people who are no longer with the company, maybe no longer with the committee that's updating the website. Make sure you remove their access. If they don't need access to the site, you shouldn't leave a username and password available for that person or for somebody else to hijack and get into your site. And the last thing around user behavior is manage the user roles appropriately within WordPress. There are several layers of user roles all with increasing responsibility. If somebody only needs the user level to read your content or contribute your content, just give them that level. If somebody is an author, give them the author level. If they're going to be editing or publishing other people's posts, they don't actually need the admin level. You just give them the editor level for editing or publishing posts. You don't really need to give people a level of authority more than what they need because that increases your vulnerability. All right, in terms of frustrating the bad guys, this is an important one. There are a lot of tools and techniques that are available to kind of make the task a little bit harder. So what you want to do is limit brute force attacks. And that's one of the things that having a strong password will do. Does everybody know what a brute force attack is? Okay, I see a couple of nods. Let's put some notes. They're essentially trying to brute force their way into your username and password. So say I start with admin as the username. Well, I'm going to try every possible password combination until I get one that works. So username admin, one. Username admin, one, one. Username admin, one, one, one. And continue along that line until they get in. If they had to do that manually, it would take a real long time. But everybody's using computers to do this, so it doesn't really take that long to go in and crack a password. There's also a published list of the most commonly used passwords. So if your username is admin, all I need to do is start going through the list of most commonly used passwords, like password or password one or password one through three or I love you or something else you and just go down that list of passwords. Eventually it's going to get into the site. So what you want to do is actually put software on the site that limits the number of login attempts people get to make before they get locked out of your site. All right? By doing that, that can help protect your site from people who are, you know, actively trying to hit your site with the intention of breaking in. I mentioned two-factor authentication and that's a good simple tool. A lot of other services are doing it as well. Some banks, PayPal offers it. You know, we can do that within WordPress and that's another way of keeping your site safe. Right? You can scan your site regularly from malware. It's important to you that your site is secure, but it's also important to your visitors, the people you're actively asking to come to you, to come into your home to take advantage of the content that you've produced. Well, you have a little bit of responsibility to them as well. So as a site owner, you should actually scan your site from malware. There are a couple of online services that will do that and also let you know whether your site has been blacklisted as well. One of the ones that I use regularly that's free is sitecheck.secure.net and you just put in the URL and it will actually go through your site. It'll check to see whether your site is up to date but also scan for a malicious code as well. I will have to actually tweet out or put the link up sitecheck.secure.net. The company is, if you go to Secure, S-U-C-U-R-I.net S-U-C-U-R-I.net and that URL is, I believe, sitecheck, S-I-T-E-C-H-E-C-K.secure.net. Put in the URL for your site. It will tell you whether it sees whether the WordPress version is up to date. It'll tell you whether plugins are up to date as well. Excuse me. I mentioned the WordPress salt. In your WP config, there are actually... Excuse me. In the WP config, there are actually some long strings of code or text that actually control your ability to log into the site. It's almost like a long cookie. If you actually use or include that in your WP config, it actually ensures that the people who are logged in are the ones that should be logged in. If you feel that your site has been compromised, you can change the salt and it forces everybody who's currently logged in, it locks them out, or actually just logs them out and forces them to actually re-log into the site. That's a good opportunity for you just to, you know, after you've cleaned up a site where you think you might have a compromise, it forces everybody to re-change their password. One of the other things you can do is actually there's a file on the servers, most of them on the Linux servers where your account would be handled, called the HT access file. It's normally a protected file. If you have FTP access, you can go into this file and actually do some small changes in this file to make it harder for people who are visiting your site to actually have access to critical WordPress files. You can actually prevent people from, you know, browsing your directory. You can put in your URL list, the directory where your WordPress files or images are, and then people can actually see the individual sites that are in your file. With these HT access changes, you can actually prevent that from happening as well as restrict access to other files, so that's a good place to do that. All these items listed above, you can do manually, but a lot of the good security plugins will do that for you, and I've got a couple of them listed here. So one that I use a lot is WordPress. WordPress has the ability to do monitoring on your site and actually does some of these changes that prevent people from getting in your site. The interesting thing about WordPress and some of these other security sites is on so many WordPress installations, they can actually see what's happening on a lot of sites at the same time. So if they see certain IP addresses or trying to get into sites and getting locked out, it reports it back to WordPress and it prevents other sites. As soon as they see that IP address, they'll lock it out. So it's a good way of actually using the broader WordPress community to actually protect your site. The company I mentioned previously, Security, they actually have a WordPress plugin that does a lot of the same things and more. Both of them actually have the ability to run security scans, but they actually audit the activity on your site as well. So you can actually see who's logged into your site, what IP address, and when that login took place. So there's a lot of good tools available to you that help you protect your site. I theme security, they actually bought a plugin from another company and continue to improve it. It has, again, some of these ability to make changes to your HT access, to monitor users, to make sure that no one's using the admin password, to enforce that people are using strong passwords. It won't allow you to set a password that's weak on your site. It has integrated two factor authentication. So if you want to use that kind of smartphone or text, log into your site, it's part of those themes. These three themes are all free. They have paid upgrades, but the free versions are more than adequate to secure your site. I did put Google Authenticator down here on the bottom. The plugin appears not to have been updated in some time. You'll see that from time to time and since it's a security presentation, I'll say if the plugin's not been updated in a while, you may not want to use it. This one has been pretty good, so I've not really changed it yet. The core information or the core code behind the plugin may be stable. It's just that you haven't updated it recently. If you don't want to use a plugin that hasn't been updated recently, there are other authentication plugins in the repository or you could use it in security, which includes it as well. There are a couple additional resources that you can read. One of the best resources is the WordPress Codex. The WordPress Codex has a wealth of information about everything WordPress, so for me that's typically one of the first places I go. But the section on hardening WordPress talks through a lot of ways that you can help keep your site safe and secure. I didn't talk about it too much, but it's more of an annoyance than something that actually can be a direct threat to your website. You have got a blog or you're accepting comments. A comment spam typically is one of the annoyances. You can tell that someone read your post or claimed to have read your post and is making a comment that makes no sense. When you actually look at the comments, their URL is for Louis Vuitton purses or for Cialis. That's spam and it's just annoying. Or you're an English language blog, but there's nothing but Asian characters in the blog comment. The information at that particular site is a curated list of potentially spam words, and within WordPress there's an ability for you to block comments that contain certain words. It's a very easy to use list that you just add into the WordPress admin, and if a post uses any of those words, you can choose to have it block as a comment entirely or have it go into the moderation queue for your comments. So it won't actually get onto your website before you have a chance to see it. And it's a good way of preventing people from being annoyed by comments that don't make sense, but potentially clicking on a link in a comment that takes them to a malicious site. And that essentially is the presentation. Slides are available, and if you've got questions, you'll definitely be able to try and answer them. Okay, within the WP config file in your WordPress installation, it has information related to the database where your WordPress, it has the links or tells WordPress where the database is, usernames, passwords. Within that file, that configuration information are long strings of, I guess, complex letters and numbers that indicate when, you know, they act as a cookie in the process that manages the site. Let's see if I can find it real quick. Thank you for that long complex and... Well, here's the thing. You don't need to know... You don't specifically need to know what the salt does, but adding the salt or adding that salt functionality within WordPress makes it just more complex and unique for every time your password is used. Without it, it's possible that somebody can pick up the password and dummy it for your installation. The salt makes sure that the person using it is kind of authorized or authenticated within your installation. Definitely, if you've got one more question, I'll pull it up and we can show it to you. It's a little harder to pull on this for a moment. It's worth doing. Another question? It does. It enables you to change the salt, right? Because you can imagine one of the companies using the one-click install, they've just got one version of the software, right? So every install that's been used by that has essentially the same salt, right? You have the ability to import that unique salt to your installation also. And it's probably because more people are focusing on WordPress security, these one-click installs are probably doing a little better job of making sure the most up-to-date version of WordPress is used, but doesn't always happen. So they may be operating on a version of WordPress that's like one or two versions behind that still has some of the security vulnerabilities in it but are actually installing it on your site as a clean install. The third thing around doing a manual install is when you do the manual install, WordPress will ask you what's the first admin, what's the first username for the admin? When in the old days, it would actually just use admin as the username, this allows you to put in a username that's different from admin, and that also helps you keep the site a little more secure. Yes? They can be in that you don't know why they're actually browsing your site. When I look at my Google Analytics, again, I have primarily US-based websites for services or organizations that do business in the US, but I constantly am getting probed by sites in the Ukraine or Russia or China. You have to wonder why they're visiting my little website. It's not always with the best intent. So those are reasons to secure your website. Some of these security plugins actually allow you to ban certain countries or certain IP ranges from your sites, which is a help to kind of keep your site a little bit more secure. That being said, if your site is vulnerable, maybe they won't hack you from Russia or Tajikistan, they'll actually use somebody's website here in the US to actually try to breach your site. Yes? I guess with all the technology things, you should probably try to use the most up-to-date version. I'm going to suspect that there have been vulnerabilities in the way PHP runs on site. So in most cases, even the shared host will try to keep bringing the PHP versions up-to-date, but it's important if you can. And sometimes, even in the shared environment, you can kind of force what version of PHP that your site runs. And I would suggest doing it because it also will make some of the plugins work better as well. Yeah, it's a big vulnerability and it stayed for a while, but there really is limited reason for choosing admin as your password or administrator if you don't want to choose admin. Don't choose administrator either, because those are the ones that are commonly used to try to get into sites. Yes? It's actually pretty interesting because then also, I'm guessing you'll also see a big spike in the number of views on your site, unexpected. It just echoes very much the reason to try and maintain security on your site. And to be aware, maybe back in the old HTML days, you could have a site, put it up, and forget it, but your WordPress site does require a little maintenance and attention, and it's important that you do go back and keep an active eye on what's going on on your site in order to protect yourself and your visitors. My first hope is that you actually do have a backup copy of your site. That would probably be one of the things that I would consider doing. If you're not backing up your site right now, definitely do a backup to your site. The way that you typically will find out your site has been hacked is if it's a defacement, your site doesn't look like it used to look. You may find vulgarity, you may find images that you didn't put on the site on your site. That's one clue. The other clue is your hosting company may tell you that your site's been hacked. What you'll want to do as quickly as possible is go to them and find out when this intrusion might have happened and look at the log files as to what has been changed and that will give you some indication. You'll typically delete those sites. There are companies that will actually recover your site for you. They'll use a similar process. They will compare the version of WordPress on your site to a brand new clean version of WordTest and actually go into the files themselves and see if lines of code have been changed. They will replace those sites. One of the things you're going to do is install your current installation and reinstall WordPress. The process is a little complex. Again, on the WordPress Codex it actually talks about how you can recover from a hack as well. To that point, if your site has been hacked or if your site is found to be distributing malware, Google will actually blacklist you. Google and a couple of other entities will blacklist your site and you'll actually get a warning. If somebody Googles your site, the listing will actually say this site has been reported as a malicious site or has been hacked. Your search rankings disappear. People don't visit your site. They immediately run because on Firefox browser the entire browser screen turns red. So it's pretty serious. Once you get your site cleaned up you'll want to go into Google Webmaster Tools and actually submit that the site is clean so that you can begin the process of getting people back to your site. Again, there's a change. That is a good point as well. If you get hacked it's like a violation. If you live in an apartment complex and you get broken into you may not want to stay in the same apartment complex if they're not keeping things up. That may be a time to consider who you host your website after it's been hacked. Particularly in how responsive your hosting company is and how helpful they are in trying to address the issue. Any other questions? Actually, one way or one mechanism for trying to manage that is if you use a tool to monitor and update all of your sites if you own multiple sites there are tools that will actually allow you to update WordPress on several installations in time or check your plugins to make sure all your plugins are up to date. I use mainWP there's managedWP infiniteWP so there's a lot of them out there managedWP there's a lot of software programs that will let you monitor and maintain multiple sites if you have multiple sites and it makes it easier and that's I think part of the drudgery why people don't like to update is that you can have a plugin get rewritten every day to a new version and have to go back into your site to make sure the plugins are up to date. These services kind of let you know in advance that something requires an update and then you can go and make the updates to those pages. Actually WordFence actually does a pretty good job of letting you know when plugins are expired as well or there's updates for a site. That's it. Thank you very much.


There were hints yesterday that a suspended central bank of Nigeria, CBN Governor Godwin Imefeli and all the top officials of the bank may face trial after all. This follows the stalling of the plea bagging move between the federal government and the embattled Apex Bank boss. Sources said trillions of Naira were being tracked by a federal agency but only a few billions of Naira was offered as refundable by some of those linked to the suspicious transactions. Imefeli is being held by the Department of State Service as it was guarded that some interceding forces and Imefeli had not made progress on the plea bagging terms. It has also been confirmed that the four deputy governors were dropped because of their alleged complacency when Imefeli was in the saddle at the Apex Bank.