The 2022 Cybersecurity Landscape

All right, it's Friday, so you know what time it is. It's time for another episode of In Case You Missed It. I'm Dustin Haisler, Chief Innovation Officer for eRepublic, the parent company of Government Technology. Joe Morris is unable to join us today, but filling in for Joe as our co-host is our own Jewel Pattison-Gordon, staff writer for Government Technology. Welcome, Jewel.

Thank you. Thanks for having me.

So Jewel's beats for GovTech are cybersecurity, and as you know, this is October, and October is our National Cybersecurity Awareness Month. And so So as we kind of sat back and looked at who could we bring on to talk about the landscape of cyber, we thought, why not bring on some award-winning cybersecurity leaders and some of the foremost authors on the topic? And so I'm excited to be joined today by Deb Snyder, the former Chief Information Security Officer for the State of New York, and Dan Lohrmann, former Chief Security Officer, Chief Technology Officer, and Chief Information Security Officer for the State of Michigan. Deb and Dan, thanks so much for carving some time out to talk cybersecurity. Thanks, Dustin.

Glad to be here. Thanks.

Awesome.

All right, so I got some toss-up questions for you both. Deb, I'll start with you on this just because everything has changed with the cybersecurity landscape, and I'd love to get your thoughts on how has it changed, or how have you seen it change over the last 12 months, and, you know, what are the most pressing threats you're seeing impacting agencies today?

So Dustin, that's a great question, and a word which changed is that there's more, right? More assets, more access, more connected devices, more data being collected that needs to be protected, ultimately equating to more risk and a new way of thinking about cybersecurity. This current operating model that we're being asked to secure has really changed dramatically. The way we live, work, new ways of doing business, smart devices, cloud adoption, the demand for 24/7, 365, anytime, any device, any format access. The most pressing threats have escalated, I think, in terms of sophistication and resulting damage. There's ransomware, which Dan and I talk about all the time, monetizing access to an organization's assets. That continues to be pervasive. It stymies me as to why, but that's a whole nother— that's a whole nother webinar. Industry reports do indicate, though, that it continues to increase. Tactics are growing in volume and sophistication. They're multi-prong attacks and very, very harsh impact. The key attack vectors and tactics still, you know, are the same: compromised credentials, phishing, vulnerabilities being exploited. So, of course, every organization needs to have strategies in place, but people-related actions continue to drive incidents. I think it was 82% of the breaches reported as involving the human elements. So, whether it's stolen credentials or phishing or misuse or simply errors, The people factor is still there. Critical infrastructure, and of course with midterm elections upon us, misinformation and disinformation campaigns. Dan?

Yeah, Dan, what do you see?

Great list there, Deb. I just add 2 more that, you know, think of the last year. Ukraine, I mean, you know, the whole war there, lots of feedback. You know, we've done some blogs about, you know, how NATO has experienced unprecedented attacks, you know, from around really hitting all Western countries, but the threat landscape with China and possibly what could be happening in Taiwan in the future, and also in Russia, I think. And then the other thing I would just mention in the last 12 months, as we're coming out of COVID hopefully, I know it's still, I guess, officially still in a pandemic, but the back to work people, more and more offices back to work. And I think That has played out in a variety of ways and some unique challenges. Maybe we'll talk about some of those. But great list, Dab. I think you really covered it well.

Yeah. So, and as we look at the primary mechanism, it seemed like over the last year has been really that financial gain, ransomware, social engineering. But we have elections that are happening. And so as we draw closer to the midterms, I'd love to get your thoughts on if there's anything here that's starting to light up from a cybersecurity standpoint with election Dan, let's start with you on this one.

Yeah, I think the answer is certainly yes. I mean, I think we're talking— Deb mentioned fake news, but a lot of it is around where are people getting their stories from, their messages from. I think those are huge challenges. I also think beyond the financial gain, hacktivism, not so much in the US, although there have been some critical infrastructures that have been hit. There's this fear that some of the things going on in other parts of the world could be coming our way soon enough. I mean, certainly there have been some critical infrastructure attacks in the US as well, but Ukraine has been hit much harder. Some other parts of the world have been hit very hard, Australia. So I don't think it's just money. I think it's mainly money though. Certainly money is the top motivator, but absolutely hacktivism, elections, Anyway, our enemies want to disrupt. And so that's certainly a challenge.

Deb, what do you think about kind of the upcoming elections and cybersecurity? Any—

Yeah, here we are again, every 4 or 2 years, whether we need it or not. So yeah, there's already clear evidence of foreign threats to our elections and democratic process. I mean, foreign intelligence entities see our elections as a target of opportunity to undermine confidence in the democratic process, to sow division, to weaken alliances that we have with other countries, and to advance their agendas, whatever those might The Russian attacks were kind of the glaring call to action. They exposed vulnerabilities. Most states' electronic voting and tabulation systems are at least a decade old. Many of the concerns that were in 2016 raised still haven't been fully remediated, even though states have taken steps and local election officials as well to shore up where they can, particularly in the areas of heightened monitoring and response capabilities. But all of that, of course, is as we would say, post-boom, after the incident happens. So with misinformation and disinformation campaigns specifically, I think that agencies have to take steps to provide accurate and reliable information related to the narratives and themes around election infrastructure and related processes and be the authoritative source of information. I think that's the next thing to do.

And Dan, we're also, you know, we're always seeing technology changing. How are emerging technologies like artificial intelligence and deepfakes impacting the cybersecurity landscape?

Yeah, it's a great question. I mean, I think as technology evolves, I mean, in a word, in a few words, I would say it's raising the stakes. And it's, you know, Deb talked earlier about how it's just more of everything. And I think as this technology accelerates, machine learning, automated attacks, the bad actors are becoming better and better using high-tech tools. And simply stated, to be able to keep up, the defenders, the good guys, if you will, we've got to use the same tools. We've got to be aware of them. We've got to really match fire with fire. And so when you start thinking about artificial intelligence and machine learning, looking for scripts, just going through literally millions of lines of code, looking for vulnerabilities, looking for ways into our castles, if you will, looking for that data. Can they get in somehow? And once they're in, where can they go laterally? As the bad actors do that, we've got to have the same or better tools to be able to respond. And so when you start thinking about artificial intelligence, when you start thinking about deepfakes, you know, the tools to be able to find them and root them out and also be able to defend yourself. So I think it's, as Deb mentioned, it raised the stakes and enterprises have got to use tools that use advanced technologies and leading-edge technologies like artificial intelligence, machine learning to be able to detect them because more and more of them are coming at us faster than ever.

What are some of the most important actions that government agencies can take today to try to mitigate this risk?

Yeah, I mean, you know, actions— there's a number of things they can do. I mean, I think we, you know, we're in Cybersecurity Awareness Month, and so when you think about, you know, the standard kind of cyber etiquette list, so, you know, we think about, you know, doing assessments regularly so you know your enterprise, you know where your data is, you know where it's not, you know, is it Which devices is it on? But there's the standard list of patching systems, having an incident response plan, having better planning and having better backups that are tested, that you're actually going to know that they work and that you test them in tabletop exercises, but also full-scale exercises where you're actually not just saying, okay, we've tried this for an hour now, I'm just going to hit the green easy button and We're done, right? Because, you know, Gartner told us recently at one of the conferences I attended in Washington that a lot of enterprises, you know, don't actually do restores of their backups. So, I mean, making sure that you are ready, you know, God forbid a ransomware attack does hit. And, you know, for many of us it has already, and for many more it will in the coming year. Being ready for that. And just one real hot tip, I really encourage people, probably echo this a little bit later, but CISA's got a great website called Shields Up. And so you can go to cisa.gov/shields-up. It's that simple. It's got a great list of kind of the latest threats, the latest attacks that are coming at us, and some practical tips that people can follow sector by sector and then really kind of across the board for all governments. So I would certainly utilize that. But, you know, the basic cyber etiquette Checklist is still relevant for us.

Yeah, that's a great point, and that's a good segue into my next question. And Deb, I'd love to hear your thoughts on this because we have a lot of national standards and guidance that come out, you know, from NIST and CISA and other organizations that, you know, are, you know, really geared at protecting critical infrastructure, federal agencies, but also, you know, a lot of applicability down to state and local too. What do you see with the applicability of some of these federal standards? Are there ones that agencies need to pay attention to, you know, even if they can't hit the gold standard on all of them? Any thoughts there?

Yeah. So I've always been a firm believer— anybody that knows me or has talked to me or heard me speak knows that I believe aligning with NIST standards and guidance is a solid strategy for states and local organizations for several reasons. Given the extensive linkages that exist across all levels of government, statutory and regulatory requirements for numerous programs, the fact that data systems and funding flow downward from federal programs passed down to state agencies and then into local entities where the delivery of benefits and services to citizens happens. In my opinion, although the NIST standards are required and intended, written for federal agencies, state and local agencies are in fact held to these standards. Just ask any CISO or organization that's gone through an IRS or an SSA or any federal agency audit. They definitely expect state and local compliance with the practices and alignment with the standards. So aligning around those standards or common framework like the NIST Cybersecurity Framework to assess your security posture at minimum, to determine where your baseline is, where your current state is, and where you want to be, if you will, from a target state, adopting related standards and recommended best practices, it just helps do a lot of things. It helps assure a common lexicon. It drives organizations to adopt recommended controls and practices. that help strengthen security. Dan, to your point, doing the right things right, right? Privacy reduces risk. It helps demonstrate compliance because the controls are mapped back to compliance standards. So federal regulation trickling down to non-federal organizations and non-federal contractors, I think it just makes sense. There's a myriad of government compliance standards. They can be very confusing. Many of them overlap, and oftentimes organizations aren't sure which apply to them. So using the framework just makes it simpler and easier for organizations to demonstrate compliance.

Yep, totally agree. And, you know, we've been hearing a lot about this whole-of-state approach to cybersecurity. So really thinking about the entire ecosystem that is involved in technology delivery. So how should state CISOs and, you know, even local cybersecurity officials look at collaborating with local partners and those full ecosystem partners here? Dan, let's hear from you on this one first.

Yeah, Dustin, thanks. It's a great question. I just recently wrote an article on this. I mean, we've been talking about whole state cybersecurity for several years now, but I really do think that the time may have come. This is really— it's an important topic. And I think because of one timely thing right now with the federal grants, the cybersecurity grants coming in, that $1 billion dedicated to cyber, 80% of that money has to go to locals. And it's a state plan, and many states are— I just came from NASCOW in Louisville, and more and more states, several states I know, are going to partner with other states. So they're going to actually have regional approaches and not just one individual state. But when you're thinking about what is our statewide plan, how can we as— I'm in Michigan right now— how can we as Michigan, as a state, think about not just the state government and the state agencies, but the counties, the cities, other units of local government and how can they respond. A lot of states are already doing that in the case of ransomware incidents and things, they're sending out teams. They have, like we have in Michigan, a Michigan Cyber Civilian Corps where they help out entities, small businesses, and local governments when they have major cybersecurity incidents or ransomware attacks. So we're already doing some of this. I think it's going to just grow beyond just common contracts people can buy off of, but a whole of state solutions that that maybe are procured once and then the licenses are bought for local governments and they can use those locally. Services that are available locally, things like scanning systems, opportunities to work together on protecting certain types of data. States are by and large custodians of federal data and local governments often are custodians of state data. So really there's so much overlap, so much opportunity to work together. I really do think having a single plan makes a ton of sense. And quite frankly, a lot of these local units of government are not prepared and not ready, don't have the staff, don't have the expertise, don't have the tools to be able to do it themselves. And so I just say, I know this, I wouldn't say a little bit of controversy here, but a little bit of— there's a challenge because just in the way the states like the state rights, the states like to be independent of the feds. Sometimes they like the money, but they want the independence. Locals are the same way. They don't always want big brother telling me how to do my cybersecurity, right? So there is this tension of like, we're the county of whatever, we don't need the state to help us, or we're the city of whatever. So that's a challenge, and yet there often are opportunities to work together. So I think, I do think you're gonna see more and more and more states looking at this as a whole-of-state solution for a wide range of technology problems and opportunities. And I really think the time is now, and I think you're going to see that really exploding in 2023. So I see this as something that's going to be evolving over several years but will only grow.

Deb, what are you seeing here?

You know, as states embrace this larger role, if you will, in collective statewide cybersecurity strategies, they can set themselves up for success by actively and purposefully engaging counties and local municipalities in the conversation. Yes, creating cross-jurisdictional opportunities and feedback mechanisms will help you better understand the needs and establish these shared services and partnerships that Dan talked about. But it has to improve local counties and local municipalities' security in meaningful and impactful ways, right? So there has to be some strategy-minded thinking going on. Dan, you gave an example of collaborating around strategic planning, assuring that local municipalities are included, creating those shared services arrangements, pooling cyber resources and response teams helps ease the talent gaps, right? Working with tribal entities, K through 12 schools, other governmental organizations to offer guidance, share intelligence, and emphasizing the partnerships that can help capitalize on economies of scale while at the same time delivering really top quality and impactful services to municipal governments. Endpoint protection, monitoring, cyber defenses, incident response, statewide cyber awareness training. Dan, I think you touched upon most of those. most of them. But given the current threats, why should every organization go it alone? Yeah, there's small p politics involved, or maybe even big P politics, but I just think that it's, you know, it takes a village.

So, great points on the power of the collaboration and the real need here. And as Dan mentioned, there's a lot of money coming into this situation. What are some of the greatest challenges and opportunities you see coming from the state and local cybersecurity grant program?

Not states not making the effort to get the word out. Not every state had— New York, we were fortunate. We had the county CIOs on speed dial. We had regular meetings. We made the rounds. We have regional events and so on. But some states have not yet made the effort to establish those partnerships or that connective mechanism. Politics, I mentioned, either internal or cross-jurisdictional, can also get in the way. It shouldn't, but it's a reality. Different jurisdictions will have differing views and also different needs, but look for areas of commonality and shared services opportunities. The shared services model makes a great deal of sense. It, it again delivers the talent, the current-day tools, the technologies that our agencies would otherwise not be able to afford, and pooling resources also helps cross-train both the local and the state. I often would reflect on We have no mapping of all of the interfaces or the touchpoints programmatically or system-wise between state, county, and local. If we did, it would probably scare us all to death, but we have no accurate mapping. And, but for sure, we know it's all connected somehow, right? So prioritize investments, think about resources to support longer tail strategies, end-of-life sustainability, things of that nature. But for certain, think together, right? It's easier to maintain You know, kind of collaboration if you're, if you're engaging them on a routine basis. And when it, when it comes to services versus products, it might be easier to maintain services versus buying new licenses. You can get some good purchasing opportunity there too.

These are great recommendations. Are there, is there anything else that states should keep in mind as they think about how to approach this funding?

Yeah, so we talk an awful lot about funding and we still see entities that aren't taking advantage of it, which, well, I mean, Dan, you and I, when we were back, we talked a lot about the lack So here we have this wonderful point in time, never before seen, where all the stars are aligning. Start with a solid planning effort. Think both short-term and longer-term. Consider where services versus products make sense. Again, it's easier to maintain services, for instance, than buying lots of new licenses. Try to make sure that you're always aligning, checking that your funding is aligned with initiatives that have the greatest impact, things like infrastructure that are foundational. And then incorporate data protection and privacy considerations. Privacy is a very hot topic right now, growing concern, lots of scrutiny, emerging laws in many states and at the federal level, hopefully. But all of those things kind of play into that strategic planning.

Thank you. And, you know, something else that's always on the mind is, you know, state and local governments have been getting more— facing more difficulties as they try to afford and qualify for cyber insurance. Dan, you know, given these kinds of challenges, do you expect any new trends in the area? Such as around self-insurance or a potential federal insurance response?

Yeah, thanks, Jewel. I think that cyber insurance is a hot topic right now. It was a hot topic at the National Governors Association meeting we just had on cybersecurity summit in June. And just for the reminder for the audience, you know, we're seeing in many cases lots and lots of stories of basically doubling of the premiums and cutting 50% or more of what is covered. So, and, you know, so basically people talking 3, 4x, um, what they paid before. Now some states, you know, signed 5-year packages and, and kind of still are, you know, benefiting from that, um, almost like getting a bundle with your, with your, uh, internet service provider or something for a multi-year deal or for your phone or something. But, you know, as those policies come, come due, more and more states are just saying we're getting out of this altogether, or we're self-insuring. So, you know, we're seeing a lot of states saying we're gonna do self-insurance, or there are insurance pools as well. So you're seeing some local governments talk about insurance pools. There is talk about federal, you know, federal cyber insurance underwriting. I think, you know, do I see that coming up in the next, say, 12 months? I wouldn't bet on that. I mean, I think that could be in the medium to long term. We could see some things like that. I do think the whole industry is having a big shaking out right now. And it's not just about premiums and coverage and the coverage amounts, because those are going down. It's also just, can I even get coverage at all? Like, insurability, people are complaining about how long the application process is. It used to be 1 or 2 pages. Now, it's 10 to 20 pages. And if you have the wrong answers, they're not covering you. But even more than that, I think the expectation level is ratcheting up. So some of this could be a really good thing. I don't think this is all bad.

Excuse me.

All bad. I think that some of it can be really good in a sense that organizations, a lot of times technology organizations, security organizations have a hard time quantifying, you know, why we need to do certain things to protect our enterprise, to protect our data. And now saying, well, if we want this insurance policy, if we want to get renewed, we have to do these things. That may sound like a bad reason to patch the hole in the roof, but sometimes that might stop some rain from falling through. So, I mean, the reality is there are things that insurance companies are demanding, and there are organizations in the government and in the private sector that are doing that maybe they would not have done had not the insurance industry forced that. So, I do see this evolving. I see groups like Lloyd's of London and other big underwriters changing their rules. I see some insurance companies getting out of it altogether. So there's a lot happening right now, and I think you're gonna see a very different cyber insurance industry 2 to 3 years from now, and a lot of change and a lot of rethinks around the whole cyber insurance market.

Yeah, those are great points. Looking ahead, what are some of the other ways that you expect the space to evolve?

Yeah, I mean, I think states are really thinking about what do they need to do as a minimum level of protection. You know, Deb talked earlier about following standards, things they have to do from a compliance perspective that aren't options. You know, if you're going to meet CJIS, Criminal Justice Information Systems requirements, you have to do certain things. States are used to those checklists or tax records, you know, IRS regs. You know, as you have to, you know, Medicare, Medicaid, certain types of data, things have to be done, checklists. That's a huge, huge area that I think continually evolves. Where I think people would like to go, you know, we talked a lot about state RAMP. State RAMP is like a state equivalent to FedRAMP. There's differences, a lot of differences. It is not mandated in the same way that FedRAMP is for federal systems. But a lot more states are getting involved in groups like State-RAMP so that this assessment of systems from vendors, from the vendor community, doesn't need to be done 50 different times or 250 different times. It can be done and certified and then can be used to say, hey, this solution works, it's certified, we can use that across multiple states, across multiple local units of government. So I see more and more of that happening. I also think there's a push. I mean, I'm hoping, this is optimistic, that maybe some of these regulations can merge. And so you're not having to say, if I'm a state, if I'm a local government, if I'm a big city, I don't have to meet 87 different compliance regulations because people are just getting overwhelmed with the paperwork, quite frankly. It's overwhelming with, you know, a lot of security pros that I talk to feel like we're paper pushers, all the things we have to do to comply with. Can we do some merging of some of these compliance standards? Probably not all. I think there's a lot of turf, there's a lot of fiefdoms that are out there in government that will continue. But I do think that more and more you're gonna see, you know, hopefully StateRAMP and organizations like that help in this whole compliance and make sure that we have standards across states.

So as we think about Cybersecurity Awareness Month, October 2023, What do you think we're going to be talking about then? You know, fast forward a year from today, and what should agencies be doing to prepare for it? Deb, I'd love to start with you on this one.

Yeah, so that's a, that's a great question. Let me, let me consult my Magic 8 Ball or crystal ball, whatever I have here. So, um, yeah, so no projection on where global events will be at that time, but as Dan mentioned, given the current politically volatile events and socioeconomic turmoil that's going on and will likely continue, I think we can see that that will trigger escalating cybersecurity risk. Acceleration, adoption of technology, decisions made in the short and long term can also inflict longer-term pain because of choices made at speed that might bite you down the road. So I think I was reading some recent research that indicated that nearly 75% of all cyberattacks in the past 12 months have been attributed to technologies adopted under duress and with speed during the pandemic. There's no doubt that the pandemic put everything on fast forward, right? Remote work, cloud adoption, business government organizations, everybody moved their data applications and compute to the cloud. That new operating model isn't going away. So my advice on just about a daily basis is that operations and organizations at large should take opportunity to take a beat, take a breath, look over your shoulder, look at what was deployed swiftly and under duress during the pandemic to meet the needs of the workforce and citizens, but perhaps with not as much consideration to cybersecurity as one would ordinarily want. You'll likely find areas that need to be fine-tuned, revisited, tweaked. But in the long run, short-term solutions may not necessarily be appropriate. or aligned with where you want to go, right, 5 years down the road, 3 years down the road. So what we'll be thinking about, I think, in 2023 is how well the current strategies align with the requirements of the next 3 years out. Short-term solutions often require a shift in strategy or recalibration. I think resiliency will stay top of mind. You know, that it's not the organization, the organization that gets an A Is the one that can address speed of recovery, right, that integrates their platform so that response and recovery are integrated, not just doing backups. Risk to critical infrastructure— I'm sure, Dan, you have some thoughts on that— will continue to be an area of grave concern. Attacks are occurring at a more rapid rate, and any gap in critical services creates a risk to public safety, medical care, connectivity, power. catastrophic, long-running consequences. Vendors being targeted, suppliers, I think supply chain risk will still be on our agenda. I mentioned evolving privacy concerns. I think that that's still going to be a turn of the wheel. And this workforce workplace, this new environment that we're trying to secure will, I think, result in a need for enhanced focus on monitoring, visibility, and trust. So all of that's happening now. precursors to what we'll be thinking about next year.

That's a pretty good list. I need to consult your magic 8-ball for future projects.

Dan, what about you?

Where do you think we're going to be in 2023?

That's a great list. That pretty much covered the gamut, but I'll put a little plug in here for our Law Order Cybersecurity. We do it every year in December. We put together a prediction report, not my predictions, but industry cyber predictions. So please come back and visit govtech.com and you'll see You know, the list of all the vendor predictions. I think Dev did a great job covering that. I hate to predict the future because it's hard to predict the future. But I just say this, you know, we don't know— security is covering every area of life. So when you think about cars, you think about autos, you think about, you know, we want to put a man on the moon again, then maybe a man on Mars. You know, there's going to be attacks in space. There's going to be attacks on cars. There's going to be attacks in the home. So in every area of technology, security is front and center. There's a battle there. I just tell everyone, you know, please make sure you turn on the security protections that are already available. You don't use your default passwords when you buy that home Christmas present, Internet of Things device, that toy, which, you know, can, you know, burn down your house, if you will. So be careful, you know, really think about, you know, your protections in whatever area of life you have. Technology is a part of it. part of that. And I think we're going to keep seeing challenges. The last point I'll just make real quick on this, Dustin, is back in 2011 at the Cyber Summit we had in Michigan, Janet Napolitano, who was Secretary of Cybersecurity at the time, said every intelligence report she's read said that within 3 years we're going to have a cyber Pearl Harbor or cyber 9/11. Now, thankfully, that never happened. We never had a cyber Pearl Harbor or cyber 9/11. I can't predict that we're going to have one in the next 12 months. I'm not going to predict that. But I do think that we need to be prepared in the same way you would for a ransomware attack. Hope for the best, but prepare for the worst. So I mean, organizations need to be prepared in their business, in their everyday functioning to like, what if the lights do go out? What if we lost power? How would we respond? How would we respond? I've worked in hospitals that had ransomware attacks that literally were, you know, had challenges with that kind of thing. where they were sending out prescriptions and sending people off to get drugs and that kind of thing with partners when they were hit by a ransomware attack. So prepare for the worst, but hope for the best. And I think we're going to see a lot of change coming in the next 12 months.

Thank you both so much for talking with us. Where can our audience go to learn more about you and your work?

Deb, you want to start?

So yeah, so LinkedIn, Center for Digital Government. I mean, both of those sites have, have what I've been involved in lately. So I would hit those first and then I'm reachable, pretty, pretty easy to find.

Yeah, just add the same thing. LinkedIn for me as well, Dan Lorman. Feel free to reach out. Happy to connect, love to talk to you. And also my blog at govtech.com. I'm a regular blogger at Lorman on cybersecurity. So love to, love to interact with you there. Thanks.

All right, well, thank you both for carving time out of your busy days advising agencies on what to do to prepare for all of this, to help share your insights with the wider government technology community. Really appreciate it, and I can't wait to check back in with you as we kind of look at what's ahead for 2023. Uh, next week, uh, make sure you come back, same time, same place. We'll be back here at 12 Pacific time. We'll be joined by Jeff Cook from Shea and Company. We hope you have a great weekend ahead, and we'll see you next Friday.

Thanks, Dustin. Take care.