Simply Solving Cyber - Todd Wilkinson

Welcome to Simply Solving Cyber. I'm Aaron Pritz.

And I'm Teddy Guzik.

And oh my gosh, Teddy, we are on— it must be almost our 10th episode. Hard to believe that we're already in double digits.

Coming up on it.

Happy 2021. I'm not even going to edit that out. It's been one of those days. So we are happy to welcome to the show Todd Wilkinson. He's the chief information security architect at Elanco Animal in Greenfield, Indiana, although I think they're about to move more central to Indianapolis. Is that right, Todd?

Yeah, that's right. We've acquired some land in downtown. So over the next couple of years, we'll be picking up and moving down downtown on the water.

Yeah, no, I'm excited. I think that's the GM stamping plant. I'm excited that that space has had several offers and several big ideas that never really came to fruition. So that's exciting that you guys are able to make something cool out of that.

Yeah. Still waiting on the exact timeline, but I know that'll shorten my commute. Yeah.

Well, and even if you knew the timeline, you probably couldn't tell us, you know, because you're in data protection and you got to keep the confidential information to yourself.

All secret.

Awesome. Well, Todd, thanks for joining us. I know you've had a 20-some-year career across several companies, but I always like to start these shows kind of getting a little bit of the backstory about you and how you got into cybersecurity and maybe some of your journey along the way that's helped to formulate what you're doing today.

Yeah, yeah. Mine's a— I don't know if this is a normal story or a little bit of an outlier, but I stumbled into it is probably the easiest way to describe it. I got into IT early in my career out of college and even had some background in school, but my first job was a data center and network provider that focused on universities and K-12.

Oh, cool.

And early in that, I hired on, I was a system analyst, keep these systems up and running, build out data centers, support the infrastructure. One of the uniqueness about this particular role they had, one, they said, Todd, take care of this root server. It's G, just keep it up and running. And I'm young, I don't know what that is.

It was a letter.

It's a letter. And come to find out was one of the root DNS servers for the internet. Wow. Gave it to this 21-year-old kid and said, make sure it stays up and running. The interesting part about that was at the time serving this particular set of universities, there was no firewall in the network. There was one parked off in the corner for a small set, but—

Was that just universities very open, lots of external access? What was the reason?

Yeah, universities at the time, many would consider a firewall in front of what they were doing was a violation of their freedom of speech if you take it all the way to the end. So there was a lot of resistance at the time, real resistance to a firewall. Let's be honest, the early ones were terrible anyway. So you put it out there and it just would make, make life difficult. But that, that ages me a bit. But what you learn from that, just doing basic systems administration and engineering, is that you had to secure these things without a firewall. And you learn a lot of techniques. You learn a lot of things when you sit there and you watch North Korea just, just pounding on your systems.

Oh, interesting. So you were seeing that even —24 years ago, 25 years ago.

Even back then, you'd see a lot of these things come from that part of the region, even at that time. So it's been going on for a while. Now, this was the early days, but, you know, this is old school, but port knockers, if you can remember those, you can open up a port on a server to come in through port. I mean, that was— those are some of the things you do. What that got me interested in, just security as a practice. But my career continued on in a traditional, more infrastructure route for the next few years. But that That was what triggered information security early on, I think, kind of got me interested. Got it.

So why did you have that experience? I won't try to generalize. I'll go ahead and generalize. There are some IT people that maybe stray away from security because it gets in their way. Beyond that specific moment, how did it set in for you that it was important and you were going to bake it into the, you know, your IT journey as you went?

I found at the time I could tie security to stability. And what that meant for me was I was not getting calls in the middle of the night. Oh, that's important. And that's important at some point. So, if you get a system secured, you know what's going on, you lock it down, you understand how it's working, to me, that tended to lead towards you'd get less calls at night and the weekend.

So, it was all about your sleep time was basically the motivation.

For somebody young in their career, that's important, let's be honest. Selfishly so, that is something you learn. I would say it is interesting when you're looking at an entire segment of the internet and be able to see that traffic and how it flows. It gives you a different perspective into what's going on. It wasn't just, I've got a server over here. Sure. It was a whole, whole segment of the Northeast that you're getting to watch and see that traffic occur. So that was fascinating at the time.

Nice. So how did you traverse through IT and infrastructure? How did you build upon that interest in security? And then how did you ultimately end up in an official security role?

Yeah, that's, that one's probably the more interesting story for sure. But yeah, I think the first job gave me that background, so I understood it a little bit. But as I left that role, I had my own consulting company for a few years in the Annapolis area, really focused on helping companies get on the internet. So again, that ages me just a little bit at the time, but I would help them get online, set up firewalls, do some of the basic things, just to answer the question, how do I get on the internet? And then I took a role at Eli Lilly and Company. That's a full 21 years ago now, if I really do the math correctly. And that was as a systems analyst role, standing up much of their infrastructure on the platform. So Linux systems and servers and routers and things like that. More traditional nature at that point, but you start to focus on internet systems again. How do you secure these things? How do you build them? And there was an opportunity at that point in my career to still focus purely on security or take some roles to understand the business of the company. What I found was I wanted to know why I was there. I wanted to know what they did. Makes sense, yeah. And so I started to actually deviate from security and spend more time on traditional architecture, get out in research and development and some of the manufacturing commercial spaces to understand what does this company do, what are the products they make, and how does IT influence that? That continued on for a few years, and then I eventually took a role out in the Animal Health Division as part of acquiring some companies and build out their product portfolio, their digital product portfolio. So that was acquiring, again, digital products, data analytics. What I found was many of those didn't fit well into the enterprise portfolio. So I had to pivot back out and go get my own data center space and open cloud space. And early in that career, and that started to tease the, I've got to get back into security and focus that.

You owned it end to end. So you had to figure the whole spectrum out.

Yeah. Yeah. To get somebody to make sure those firewalls and load balancers and, and, and application firewalls and, and were all configured and built well, or built well. And I'm trying to think the number of that. There's several dozen applications we launched at the time, from iOS applications to custom-built websites that we built in, in the space that I had. But that was very much at the time, you're on your own, you had to build your own security program for, for my particular space because we In that role, I was outside of the enterprise space, if that makes any sense. That career then got into product development, even into chip development a little bit in some diagnostic spaces. And what I found, I was embedded at the business at that point. So I had an IT background, I had IT applications, but I spent more of my time embedded with the folks out selling products out in the field on customer sites.

Would you say from a data analytics standpoint, or were you fully into a business role at that point?

Uh, it was probably 50/50. Okay. Um, I spent, uh, half of my time building out those data and analytics applications that the company spent a lot of time in, but the other 50% of that time I was actually sitting in front of customers out in the field, helping them use the products or understanding where we need to go, or in some cases actually part of that, the sales practice, which is really a fascinating role because you start to understand Why are you really here? And you get to understand what the company is doing. Yeah.

One question, and Teddy, you might want to probe a bit on this, and I want to pause it here because not all IT people kind of have this drive to go talk to the business, to be the business. And some of it's a personality thing, some of it's a background and approach to how you work with people. But how do you tell some of your young mentees how do you sell them that that's important or do you sell them that that's important?

That's a good question. And I think the answer of who it's important to maybe depends a little bit on the personality. Sure. But for me, and I think for others, there's definitely a space to engage with the company you work for or the customers you work for and really stand up and recommend, not only wait for them to tell you, here's what I need, but to dive in enough so you can get ahead of the game and go, I think you need to head this direction with your technology choices or your product or what you offer the customers. That one gets you a little bit closer to the seat of the table, what's happening. And you're not just waiting for somebody to tell you, hey, I need you to deliver this or I need you to build something or we need this, but you can much more quickly pivot towards, hey, I know you're asking for X, but 'Hey, how about Z? I've got something here that's a better option for it because I think this is how you can deliver it or this is how you can sell it and this is why.' And I think they'll react to that. That gives you credibility that's hard to get otherwise.

Kind of allows you to start thinking for yourself rather than acting like a robot and just doing exactly what your boss tells you or your manager.

Yeah, there's— I was making some notes before this. I have at least in my role, when I start to look back, what are some of the wins or what are some of the markers in my career where I garnered a bit of credibility with the people that I worked with? And as I look back, I have several where in some of these cases, I stood up and said, "No, that's not the right thing. Just no, we shouldn't do that.

We should do something else instead." Be bold enough to state your opinion. Yeah.

And it wasn't the, "No, I don't want you to do that." It was more, "I think you're making the wrong choice and I've got something else we should offer." And one, that's a scary thing to say. It really is.

Especially the first time you do it.

Yeah. Yeah. And actually the person that hired me out there, I think I had been in the role for 6 weeks, sat me down and said, "I need you to do this, this, and this." And there was this— in my head, I recall it as staring at him for 30 seconds before I said, "No." It was probably 5 seconds, but it was this moment of, "No, I don't think you should do that. I know I'm new here, but this doesn't make sense. I've been out. I visited this customer with you. This is what we should do instead." And what that turned into, all right, I think you're right, but I need you to actually sell it to the customer.

And that's an interesting twist. That's empowerment because you stated your case, you held your ground, you got the buy-in, and then you were empowered to go pitch that, right?

Yeah. So to anybody entering the field, whether it's IT or information security, I think a big portion of what I've learned, what I think helped is spend time understanding who you're there to serve and really get engaged and get as close as you can to the business and the community that you impact. Yeah. Because that helps you move quicker. And when it comes to security, the connection point there is everything in information security is really a conversation around risk. When you really get down to it, you've got to decide where to invest, where to spend your money, what to fix, what not to fix, and understanding those connection points of risk matters.

We were chatting a little bit before we started recording here about how do you get the business to care or do you know why that you don't think the business cares? What's your thoughts on that? What have been some of your approaches to get more buy-in from the business other than being in their shoes and learning what they're trying to do and trying to help them solve problems? But what's your thoughts there?

Yeah, good question. Everybody's inundated with a ton of information on things they should do or need to do or need to pay to. White noise, right? Yeah, there's, there's the white noise. We all get that. Helping hone that message on what they need to pay attention to matters. I think the connection to that when it comes to information security is leading in with there's a challenge here, there's a problem, but also bringing to the table these are the issues I believe you need to focus on and keeping that list as short and as concise as possible. And in terms that they understand, it's not always necessarily a dollar value. I mean, we say executives understand dollars and cents and why that's true. The connection to either a specific product or a business practice that needs to change, um, or a business process, that's the one that they really hone in on because they can visualize, okay, what, who do I need to ask to be either behave differently or where do I need to spend time or money to make something happen? Right.

Not getting lost in technical mumbo jumbo as well.

They could care less. Right. That helps you if you can walk in with what do I need to do? Right. When do I need to do it? And if you can even paint the picture of how do we need to do it, that helps.

I haven't said mumbo jumbo. Been a while. I think I might bring that back into the weekly vocabulary. I kind of liked how that rolled off the tongue.

Well, 2021 is going to need some new terms. So maybe we can— Yeah, let's start.

Yeah, we should definitely move on with new terms in 2021. I think another thing that you had mentioned to me a while back is the question of who pays, like from a business sponsorship standpoint, who's paying the bills, who are your sponsors? How does money matter in business buy-in and getting what you need to get done what you need to get done.

Yeah, that I have found it is helpful to understand where that money's coming from because you've always got those capital one-time expenditures that you can go after and say, we need to make this one-time investment. But many times there's the ongoing fees with that. And is it knowing, is it coming from a customer? Like, I need you to pull money from revenue from a particular product. That's one avenue of who you may need to talk to versus it's a one-time expenditure that might need to come from some different account. So, if you can be really clear about I'm spending this money, but I think this is who should be paying for it. That helps clarify the message. You can walk in with a, who do I need to get the right to check and who do I need to get to continue to pay that check?

And I think that's, that's really important because as InfoSec professionals, you know exactly what you need to do to fix it. But it's how do you prioritize that stuff? How do you find that money for that particular issue and how do you fix it? In that regard. So, I guess piggybacking off that, how do you prioritize that risk and how do you present that to whoever it is that you're trying to get that money from?

Yeah, fair question. In my path, what I've found usually it's connecting it to who's it going to impact. So, who's going to walk in the door of a particular leader or business area? Like, if you're going to get a phone call from somebody, Who do I think that phone call is going to come from? If that makes any sense. Is it a customer? Is it another executive? Or is it a regulator, for example? Getting a sense of who might be delivering that message, first of all, helps them go, okay, now I know where this might be coming from. Then help me understand, is it really going to happen? Yeah. And that likelihood conversation that we all have to deal with, that is, you know, is it really going to happen? Is it a guess? But if you can give them a number of, hey, I think this is going to happen, I think it's going to happen the next 18 months. And I think this is the person that might be calling you if something does happen, that, that personalizes it in a way that, that helps you have a conversation of how quickly do we need to react here?

Yeah. Which one of those people do you think in your experience overall is the most effective in terms of who's going to drive the most change? Is it the regulator? Is it the customer? Is it someone internally?

Yeah, you have for, and this is maybe just the space I've been, usually it's, is it going to impact the customer? At the end of the day, is it going to impact the people that we serve? There are always regulatory decisions or needs or laws that come down, but those, you have to translate those into, and how do you meet the regulation? And that can be done a bunch of different ways. But the ones that are most effective is a customer's. And when I mean customer in InfoSec, a lot of times we say the customer is somebody else in the business, at least in my experience. Sure. That's how it's been. But if you can drive that back to, no, you're going to get a phone call from this person or this particular audience that matters. We all have regulatory requirements that we have to meet, and those are the things that are just done to you.

And frankly, those are usually like the bare minimum too. Yeah, absolutely.

And probably 10 years behind. Yeah, exactly. Yeah. Todd, I've got a question for you from another industry, and I want to explore or unpack if there's any parallels to life sciences. So we've been doing a lot of work in CMMC, Cybersecurity Maturity Model, which is the DOD new expectations, although they're not new. It's just repackaged into a framework to— and an attest model to get people to do the bare minimum, to Teddy's point, for any federal work that, that either is through a subcontractor or prime with, with the government. So a question I have is, I think especially as now these minimum expectations are going to be required to get new work, companies that are adopting earlier, I think, can get an early competitive advantage by getting, you know, through the race the quickest because then they're going to be eligible for more work. They're going to be able to expand out. How do you think within your experience or your sector, is there a play to make cybersecurity a competitive advantage or is it a cost or a right to operate, need to do business to protect what you're trying to do?

Well, I think just in the recent news, it can become a competitive conversation. So I don't like treating cybersecurity as a right-to-operate focus because you end up to try to meet compliance standards. Checkboxes. Yeah, you're trying to check boxes and you will forever chase those checkboxes. So I think there's a couple different frameworks, but within all of those frameworks, there's a list of things of, hey, nail these 10 things and nail these 10 things well. And if you can get to those, and I just made up 10, but you've got the cyber, you know, the top 20. Yeah, take your pick. But if you walk in the door and say, hey, can I consistently show that I'm patching across the enterprise? Great. That's a big win. Get to that conversation. Can I consistently show I've got some sort of hardening program across the enterprise? Great. Fantastic. If you can start to nail some of those basic fundamental items, then you can start to shift the conversation of, okay, now how can we start to add value to the core business? How can we start to address customer questions that can come in. And I can tell you without question, I have had numerous conversations with customers about cybersecurity, enough to know that they care. They don't always know the questions they can ask, but at the end of the day, once somebody will say, is my data safe? And can you show me that it's safe? And a particular standard doesn't help that conversation. But it's, it's how do you, how do you reflect that? So I think your question was, maybe I need to repeat that, was, hey, how do you How do you add it as a competitive value?

Can you ever get your business to view it as a competitive advantage to increase, you know, everyone's in business to grow it. Can cybersecurity done well help you grow your business?

I believe the answer is yes. Sure.

It was a rhetorical question, but I knew, yeah, I knew you'd get there.

Yeah, yeah, yeah. I'll get there. I do know they care. I do know they ask questions and how you can quickly show them in a way that you can communicate it. And I, I spent a number of time looking at security policies for different products. We buy a lot of different tools. And a good swath of them, you say, okay, let me, how do you secure our data? And it's very hard to find that. But there are some products out there and some companies I've seen, they've done a really good job articulating, these are the core things that we do. And it is not a long attestation program. It's usually, these are the 5 or 10 things that we do to show you how we secure your data. And that makes a conversation of where my information is going, How are you securing it? What are you doing with it? Yeah. Just ask, answer those 3 questions. Where does it go? What are you doing with it? And can you show me that it's safe?

Yeah. I've got one last question that I want to turn it over to Teddy to do his typical topic, which is to get into how do you advise young people, you know, getting into cyber and the like. But you mentioned the top 20 controls and getting the basics right. So one thing across entire industry, I think a lot of times the early controls are the more boring controls. I'll just go ahead and say it. Like, for example, control 1 and 2, asset and software inventory. Everybody's favorite. Yeah, well, and it's absolutely the opposite of the favorite. And a lot of times it's not done or it's not done well. Coming from infrastructure, managing a lot of assets, what is your vibe on that? Do you still believe that those are the number 1 and 2 controls Or is it okay to skip past that and head right down to the, you know, detect and respond and kind of the cool, fun things that I think everyone gets a little bit more excited about?

Yeah, no, that's— I'm chuckling. I don't know if that came across. So I'll share this perspective. In my infrastructure roles, the ask from security was, what's your asset inventory? What's your database? How up to date is it? I'll be honest, that question irritated me a little bit.

It did. It did. It irritated me. It's okay. It's okay. Because one, I knew what I had. How do you really feel, Todd? Yeah. Yeah.

I knew what I had. Yeah. I knew where it was at. Yeah. And I knew what was going on. Good. I could say that at all times. I knew what was happening out there. Now I flip my role into more of an enterprise cybersecurity, what is going on with everything? And the question is, what do you have? Well, that's— I don't own everything. So now I have to empower others to do that. And the conversation does flip.

So— And probably consolidating the intel, I'm curious on when you said you knew all those answers to the questions, did you know it in your head or was it somewhere where others could find it? Because I think now in your current role, you need it somewhere where others can find it, whether they're working a cyber incident or trying to figure out which applications to apply controls to. This is a universal problem I almost see everywhere.

Aaron Pritzker. Yeah, it was both. I had it in my head and I also had a list and inventory that was both real-time and had information. Well, good for you.

You were ahead of the curve.

It was good. That doesn't mean that somebody else could consume it because now if you're looking at the enterprise, well, I don't need 150 different ways of consuming data. I need to build some sort of standard with that. So I am finding that they're— really the answer is both. You need your application owners and your system owners to know what I have. But you also do need a way to pull that information up and centralize it. So you can— your SOC can respond if you've got one of those, and you can answer some of the basic questions. I will share this. Finding more and more different vendors, different government agencies are all coming in and they're asking the same question: can you reliably produce some sort of asset database? And that is a consistent question that I see coming in from the outside. So, that does need to be met. What I am finding is you starting to secure more assets, having that list in some form, it does not have to be perfect, but in some form that you can reliably say, "This is what I've got out there," gives you enough of an edge to dig into that and start pulling information out that you can go, "This is what I've got in my house." Now, Todd, if you could make that fun and exciting, I think you could be like a, you know, a hundred—

you could be a titillionaire, a billionaire. Oh, yeah. You could win out. Elon and Jeff. There might be something there.

I think we got to work on how to make that entertaining.

Yeah. So before I hit on the normal career questions that I have, I was curious, do you have an example of when security has provided value to the business or when business has taken a particular interest in cybersecurity from any number of the tools or the results that you've come up with or getting involved?

Yeah. Yeah. I can't give specific examples, but I have numerous times had our own customers pull us aside and pull me into a room or a conversation. I need you to lay out how you're actually doing this. I need you to lay out and tell me how are you securing your information or what's your approach to protecting it? Because we're in the business, we've got information that we have, we've got information that our own customers share with us, and regulatory bodies are the same conversation. But I can tell there is an increasing theme where the people that buy goods and services for us or from us are stepping in and asking, show me, talk to me about how you're doing it because my privacy does matter. My security of my information does matter. So I wouldn't say I saw that a lot 5 years ago, but the last 3, 4 years, it's starting to come up more and more. And that's— I don't think that's going to change.

That's great news. That means our jobs aren't contingent on regulation.

That would be a nice new future. Yeah.

Now, our challenge as InfoSec professionals, this is the interesting piece, is the question is, show me how you secure my data. Yeah. Show me that it's safe. Right. And we all know it's a measure of risk at the end of the day. But the question comes in is, you've made it safe and secure and unhackable. That's, that's, that's what we hear.

The moment you say unhackable, it will be hacked.

So, yeah, yeah, there's, there's that, the knock on wood type of conversation there. So I think as professionals and public speakers, we've got to figure out how to communicate that to everybody. And it's going to be different depending on the audience. Yeah, it makes sense.

And I know we're, we're running low on time and this isn't really one of the things we discussed before the conversation, but I think this is a question that most people that would listen to this podcast are interested in. And what are your thoughts on SolarWinds?

I thought we weren't unpacking breaches, Teddy, but I'll allow it.

This is a particular one that I think is interesting. I've had a lot of clients have a lot of issues, especially over the holidays.

It was— yeah, yeah. The— well, the timing was terrible, right? But it's never going to be perfect. This is the— I mean, that was a shock to the system. We've got a core vendor that is embedded everywhere, that many times our protections are, I'm buying the service, I assume you've secured your supply, and I've got that in a contract. I've met those metrics, right? But the reality was it just wasn't. And the part I worry about, and the part that I think bothered me about SolarWinds, is that it was so big and so much that there was a bit of, I'm searching for the right word, but it was just too much and overwhelming for people to tackle. So cybersecurity professionals know what to do with this and what we need to look for and how to start digging into assets and look for IOCs. That part's covered. But from a messaging perspective, it feels like it's just a shocked infrastructure. It's like, well, if I can't even have some of my major vendors secure themselves, What, why do I bother? That I worry about that in the back of my mind, that that's not going to have a negative effect. And that part, I'm a little bit bothered by the whole situation. But yeah, I mean, we've, we've been talking about supply chain attacks for a while, and they've— there's been a couple ones out there with, with other vendors or other open source solutions that are just almost fun and entertaining, but they're caught quick. But this, this one's a shock to the system, and I think we'll all react, but It was a bit overwhelming for everybody. And that's, that's the part I worry about because it just will wear people down.

Yep. Agreed. In terms of career, someone's just out of college, right? COVID times, maybe it's been a difficult time trying to find or even switching positions from somewhere else. Do you think it makes more sense to go into the business side of things, the IT side of things, the security side of things? Obviously there's a there's not a correct answer there, and everyone—

if you had to do it all over, what would be the order of best operations, most efficient, to get to where you are, effective, efficient, all of those?

Well, I, I think a multidisciplinarian is, is a better approach personally. In, in most cases, there's, there's always the, the theorist and the researchers that we need to have, but I think having a multidiscipline background is helpful. So one So much of cybersecurity really is tied into the core, just understanding IT and systems and engineering at the core, having some background just to know how those things work, you know, how the firewalls work, how systems and operating in the cloud works. I think that still matters. You've got that core fundamental. So my personal advice is, one, understand those pieces, you know, know how to install a system, know how patching works, because many times you've got to interface with the people that are doing the work. And if you understand how it works, and you can communicate with them quicker, you, you gain more credibility, and you're able to maneuver faster. So that's, that's kind of the baseline, understand how those work. I do think having cybersecurity and that ability to embed yourself in the business and say, hey, take— if you've got a company that's big enough, and you can take a tour in the business and say, hey, let me get outside of the core IT or core InfoSec and align yourself with your product groups or your commercial divisions. I believe that's a helpful background to have. It gives you those connections and the fundamentals of what it is that you do. But more importantly, this was— I don't want to say I learned this the hard way, but I had a lot of positive coaching and some people that took me aside and said, I'm going to help coach you so you can engage with the business directly. And what you find is you've got to remove a lot of the cybersecurity or the technical terms. Sure. Keep those to yourself and really start to hone your practice on how do I communicate to executive quickly and in under 2 sentences, because there's only so much time, time to be spent. So what's the saying?

Be brief, be bright, be gone. Yeah, which is maybe not how I'm communicating right now, but yeah, no, you're good.

So don't try to be a show-off with all the knowledge that you have.

No, it does not, it does not help. I remember this moment, I, I wrote a really long email. We we had a problem and we had some particular systems that were impacted. And I wrote this really long email and it was to somebody, it was like 3 cubes. And I was very nervous about what had happened. So, I was trying to kind of show the whole history of everything and basically stood up, walked over and said, Todd, you could have just sent me 10 words and said, I got this.

Let's go grab a coffee. We'll have it taken care of.

I was like, well, that was— That was 90 minutes spent sweating on this really complex email when it should have just been, "I got it." My personal litmus test now for communicating is we're all on iPhones and cell phones most of the day. So, if your email, if you have to scroll your thumb more than once, it's too long. Yeah. Yeah.

What's the tweet version of that? Yeah. Yeah.

I know it sounds terrible, but you get one thumb slide on the email.

Awesome. Well, Todd, it's been awesome talking to you. Learning a little bit how you got where you're at, what some of the things you'd advise to the young or career transitioning people. Really appreciate talking to us and hope you have a good rest of 2021. Thank you. Thanks, Todd.