Chaos in Cyber Regulations and Lawsuits

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. Today, we're going to talk about the overturning of the Chevron Doctrine by the US Supreme Court and how it may enable the big firms to reinterpret Corporate board responsibility when it comes to cybersecurity regulation. And I'm going to be talking with Ian Thornton-Trump. Ian is the Chief Information Security Officer at Cyjax Limited and the Chief Technology Officer at Octopi Managed Services. Welcome back to the show, Ian. Thanks for coming and talking about it.

I feel so great. We had a great debate. We covered a whole bunch of different areas and like this one, The CrowdStrike situation, ship, that many customers of CrowdStrike found themselves in is going to rock the industry, I think. It's fair to say. We're already seeing, to set you up on this, we had the event itself. There were some vendors that were, I think, less than charitable in their attacks on CrowdStrike. And I think you and I both realized, took the higher ground and said, listen, You know, the time— this is not the time. The time will come. We'll have a discussion. But right now we need to work a problem. We need to get, you know, all of our national critical infrastructure, a big chunk of it, back to working. That's the current problem. So let's work the problem together in solidarity. And we saw Microsoft and CrowdStrike tackle the problem with the release of a tool to help and bring systems back online. So now comes the inevitable couple things. First of all, we already saw the class action announcement that happened about 5, 6 hours ago from when we're filming this, uh, podcast, brought in the Texas court, which should resonate with a previous large class action lawsuit also was originally filed in Texas. This one is of course making the allegation that we've heard before that fraud was committed against the shareholders because they clearly— there was some sort of security failure. But again, these are allegations. We haven't— we haven't actually seen the claim drafted yet, from what I understand. It's right now in the process of being worked upon, and there will be, you know, the inevitable fallout from that. The SEC certainly investigating And then one notable thing that didn't happen in the wake of other, um, I would say events, you know, if we look back at the story when Mimecast in particular got very upset in the Australian press, they accused them of all sorts of terrible things and said some terrible things about the company. At that point, none of it was proven, right? None of it had gone through court system. So now we have the CEO of a major airline threatening to sue CrowdStrike for the $500 million in losses they have as a result of the cancellation of flights and the continued cancellation of flights. And I am of the position that the pendulum has swung dramatically in favor of software vendors in terms of escaping any sort of accountability for a major disaster, which was You know, they were the patient zero. They admit it. You know, they do get points for transparency. I'm not necessarily going to award points for the gift card solution that was offered by the CEO of CrowdStrike. I think that might have been a bad call. I would perhaps have a word with my PR firm and find out if they were the same ones that talked about the VP in the small oil spill. So that's where we are right now in the wake of all this. I had one person I wanted to talk to about this. Use you because I think we're starting to see a pattern. You know, we saw it with SolarWinds, we saw it with Progress Software and the movement appliance, and now we're seeing it with Brownstone. This is now rising to the level of peril, I think, risk of litigation. The bigger you are, you know, are the—

are—

is it more favorable now than it ever has been for a software vendor to do the bare minimum and not even maybe the bare minimum? Right? And escape any sort of consequences. So that's why I want to have the conversation with you today.

Well, there's a lot to unpack here, right? I mean, the simple fact, anytime there is a big outage, and this was a big outage, we're talking a minimum of 8.5 million Windows systems going to blue screen of death, many of them to be fixed. You actually had a tech have to go out there and put their hands on these devices, which really slows down the recovery time. We're seeing preliminary estimates in excess of $5 billion of losses. We saw impacts to critical infrastructure in the banking sector, in the healthcare sector, in the transportation sector. You mentioned Delta, which was down for, you know, a good part of 5, 6 days. They canceled thousands of flights. Someone early on said that this was probably the biggest IT outage in all of history from a digital technology perspective. So, anytime there's a big impact, I mean, I always see the lawyers just circling like sharks, first off. And I live in the most litigious state on the planet in California. So, of course, if you spill a cup of coffee, there's a lawsuit. If you cause $5 point something billion, yeah, Yes, there's multiple lawsuits. So this is the risk of being so big and successful. And CrowdStrike in this case, it's a behemoth, right? It's one of the big players in there. And it has tremendous rights and permissions obviously on the system enough to crater it. And mistakes were made. Their CEO came out, but then the question becomes, okay, what kind of lawsuits, because we know they're coming. We know class actions are going to be coming. We know all sorts of damages and everything. And there may be issues with their insurance. Their insurance may not want to pay the billions of dollars. They might not want to go to court for the billions of dollars. So this is, this is pretty ugly, right? And that's what we would expect with a major outage. But you're right, I think we have to figure out as an industry, because we are becoming more dependent on digital technologies and services and operating systems and everything else, where do we draw those lines? And where is good enough? Because mistakes will always be made, right? I mean, nothing is completely perfect. There is no impervious system out there to disruption. So there's got to be some, you know, some kind of guidelines. And we have had in many cases regulation determine what those guidelines are. And that kind of helps everybody because that helps insurance say, okay, comply with regulations. The regulators can say, if there's bad actors, we're going to go after them. And the software companies and hardware companies, the tech companies can say, okay, at least we've got a common equal footing. Everybody has to play by these rules and we're going to at least make that. Everything beyond that, we'll put in legal documents, contracts, EULAs, and then fight it out if anybody sues us. But it, you know, with a recent Supreme Court ruling kind of striking down that Chevron Doctrine, to me, a lot of those foundations that everybody kind of relies on, right? That you would bring up in lawsuits, that you would draft your, your EULAs and SLAs and everything else around. It sounds like that's kind of in flux, which adds a whole bunch more chaos and unpredictability to an industry that is already full of chaos and unpredictability. I mean, what are your thoughts? Do you think that this is going to be shaking the foundations whether it be the big outages, whether it be challenges or striking down of the Chevron Doctrine?

You bring up many, many areas. So first of all, software contracts, I think you're going to see the argument that are unduly favorable to the vendor. In a lot of cases, it forces arbitration. One of the key things about arbitration is it's not a public process. It's a Matthew and Ian sit down with lawyers and hammer it out in a dark room. You know, no one would make it, right?

Yeah. Arbitration, right? Mandatory arbitration.

Second of all, the indemnities and liabilities are usually on the customer to access their own business interruption insurance if they suffer any sort of event. Now, if you become the root cause, it's insurance company versus insurance company. It has nothing to do with the customer, right? The insurance company pays the customer that suffered the loss., and then their insurance company goes after my insurance company for restitution. And that, that happens in the background, and that's all part of what's known as a subrogation. Now, this is where it gets really interesting, because most vendors limit their liability to the cost of the software subscription itself. And that has been something that we've had going way, way back to the very beginnings of contract law within the software industry itself. So we're now at a place where, first of all, you're going to have to find a very favorable judge to say, okay, yeah, this is— we're not going to do arbitration because this is how it goes. You come to me, you're really upset, I take your money because I'm a lawyer, and I'm saying, you know what, Matthew, you've got a case here. I'm not going to tell you what your prospects of winning it are, but I gotta first try and figure out how to break out of that arbitration thing, right? I gotta bring it to court. You know, extraordinary circumstances, right? So that's going to be a tough one, uh, because CrowdStrike, being the giant company they are, I think they probably had some lawyers look at their contracts. I'm just going to throw that out there, right? So those are probably pretty tight. Now, CrowdStrike could also be very magnanimous because, uh, they are a, um, a cash-rich company. You know, right now their stock is taking a beating, but you'll buy the dip. I don't think, you know, people were saying this is the end of SolarWinds, the end of Progress Software. That's not the case. Dow Jones and the stock prices and everything like that have nothing really to do with the actual mechanics of what's smart, right? So I don't think it's an existential threat. So, you know, they can negotiate. But, but what I would say, you know, if you're a customer, you're impacted, you want to talk to your insurance company right away and find out if they're going to cover you. For some of the damages that you incur. Like, this is not, you get to rebuild your entire network because CrowdStrike chapped the bag on you and, you know, everything gets to be new in China. That's not the case. And if that's what the intent of many businesses are to do, well, that'll go over really bad. I'm losing my head. One second. So I think where we are right now is we have another problem, and you, you reference the Chevron, um, uh, deference. And the Chevron deference is when there's ambiguity between a regulator and a, uh, a potential defendant, there now has to be a court process where the regulator will have to go to court and convince the court that the, the, that what they're accusing that victim or that defendant of is, um, is, you know, in violation of the regulation. Here's the problem. First of all, what body do you take this through? We know the SEC's mandate is to protect shareholders. There is no customer— I'm going to say customer protections in the software world because you're renting something. Usually you're renting that piece of software, right? So you don't own it. Right? So, so we have these, these weird kind of foundational laws that have been in place since we were developing stuff back in the 1970s. And all of that has moved forward. And I don't think anyone really thought to themselves, like, we are now in such a precarious societal place that a major failure of a provider, and in this case, it was CrowdStrike, but it could be Microsoft, it could have been, you know, another, it could be IBM. In all its, uh, in all its magnitude, where so much damage can be done so quickly. Like, it's head-spinning. And I think, you know, we always talk about how regulatory bodies are like 10 years behind what's actually going on. You know, we already have AI in our daily lives, and people are talking about, oh, we're not sure how should we govern this. You know, it'll, it'll take years and, and litigations where Matthew's company AI attacks over the internet and starts finds out, you know, where my Trustpilot score is, and Matthew's bot starts writing inaccurate AI things on Glassfrog and invents employees for that. Like, we're going to see this happen, man. And we don't have any sort of way right now of, like, oversight. We get crime. Crime is easy, right? Because there's 18 USC code, it spells it out and everything like that. But somehow, when we deal with software, software that can and is proven now to, if it fails, create negative patient outcomes in the case of ransomware attacks on hospitals that end in increased fatality. So we have that line. That line is crystal clear. We have no cause of action. We have no way of moving this into a criminal sphere. Because of the nature of software. And maybe we got to think about that. But finally, I would say to make this even more complicated, and I want to get to the Chevron deference, is that there is now going to be a legal system that when it's ambiguous and cybersecurity being ambiguous to begin with, is going to have to go through a court process where the, where the, the victim company will now be able to plead its case to a judge as well. And if the judge says I'm not convinced that this company showed actual malice or negligence, because that's the standard, then we're done. And we saw that recently in the dismissal for SolarWinds, where almost all the charges were dropped because of two— because of magic words, right?

Well, except for the fraud charges. The fraud charges remain, which were the core of the charges, you know, so I mean, to me, that's kind of a misleading news story because the fraud charges were the most important charges. And I've arrested people for all sorts of things and you pile everything on because you know they're either gonna negotiate out, plead out, or it's gonna get dropped, but you want the core crimes to remain.

And in this case, it did, right?

It was the fraud.

But I think what we were hoping for was to deal with, you know, a legacy of poor security and holding an organization accountable for that. And because of magic words saying, "We submit our financial statement knowing that there is material cyber risk in the business," that's like getting the walk from, you know, first around the home plate, right? Because it doesn't matter what you did in the past, right? And now in the future of, okay, you had this major incident and you've now uncovered in the course of all of that these, you know, these lapses, these in some cases complete absence of cybersecurity, doesn't matter because it's already happened, right? And now you're spending money to fix it. So this is, this is the central argument that, you know, you know, two smart guys trying to get their hands around this. But it's sort of like you build a car, you drive your car down the road, a wheel falls off, and, you know, it's tragedy. And that happened to some of the car manufacturers, right? Right. There's a process, there's a restitution, there's an investigation by the Transport Safety board and any state authority that might have jurisdiction over that particular thing. And the manufacturer is held accountable, right? This part, the manufacturer of the software, it can be, it can be, right?

But yeah, in general, I mean, as you mentioned, it comes down to negligence or fraud. Fraud is pretty easy because we have the criminal statutes on what constitutes fraud. So that one's easy. But when we get down to negligence, which I think is when we tie it back to CrowdStrike, I think all the lawsuits, whether they're class action or individuals, they're going to come back and say there was negligence upon CrowdStrike. And that's so that's how we're going to get out of, you know, all these issues. And that's how we're going to be able to file a class action. And the gravity of the impact and everything else. This is a, you know, it's more than just the aggregate of individual situations. It was cascading failures. Yeah, there's going to be this stuff. The lawyers are going to have some great dancing and stuff in court. And it's, you know, there's going to be books written about how they write these complaints. But I think A lot of what we determine negligence to be comes back to some of those regulations that define it and whether it's defining CMMC, right, or PCI requirements. Hey, you have to have encryption here or there. Well, that was an interpretation, right? And They're constantly changing what that interpretation is. But that's what a lot of the foundations when lawsuits are made to say, well, they didn't do this type of encryption. Therefore, that's negligent and we're pointing back to different various statutes. And so when we look at the Chevron Doctrine that basically says, wait a second, these independent agencies don't have carte blanche to interpret the laws and set these very granular requirements, that kind of shakes the foundations even when we talk about negligence suits. So I think it goes beyond just the criminal stuff. And we're going to have some challenges. I mean, the Chevron Doctrine, it was established in 1984, if I remember right. Right. And it's really that legal test. That says a federal government agency has the ability to interpret a law or statute because they're the experts. So they get to kind of manage those fine details. But the recent Supreme Court, you know, just, they struck it down and basically said that because of some other constitutional, I'm not a constitutional lawyer, I'm not even a lawyer, But some, you know, other constitutional requirements, specifically the Administration— Administrative Procedure Act, the APA, it requires courts to basically oversee that and make sure that agencies don't go off and create some crazy random stuff. So that's now putting in jeopardy all of those very prescriptive requirements, now everybody can challenge that. So if somebody— and let's take the SolarWinds case, or not SolarWinds, let's take the CrowdStrike, right? So you've got all these lawsuits claiming negligence and they are going to cite certain regulations, probably best practices. Well, it's a requirement here or there or in this regulation. So of course, if you're not doing it, you're negligent. CrowdStrike can turn around and challenge, well, maybe that shouldn't be the standard. Just because SEC or FTC or some other agency has said this is what you should do, let's challenge that as a norm. And if you can successfully challenge it, guess what? You've just taken that argument out at the knees. How can it be considered negligent If that isn't even the standard.

You're now into a realm where you need to have like the EPA had the Clean Air Act, right? And it, and generally it's settled law when it comes to like pollution of the environment, right? We don't have the equivalent in cyber of an EPA and a Clean Air Act. We have CISA, which is generally just advisory and doesn't have You know, it doesn't have the authorities the way the SEC has authorities or the FTC. Maybe that's something that the most technologically advanced economy in the world needs to start considering, because how are you going to, you know, enforce laws that don't exist, number one, that are built on foundations from the 1990s, right, and the Computer Misuse Act None of the law that we have right now is applicable to these particular cases, right? You know, you have, yeah.

Yeah. It's too general. They're simply too general and they were designed that way so the agencies could adapt, you know, with it. And we still think they're slow, right? We think they're slow as molasses, but they're a lot faster than actually recreating a law or creating a new, you know, a new requirement coming out of the IRS.

So this is the other thing that I think we need to focus on. It was pretty easy to make allegations about security controls that you said that you had that you don't. That's straightforward, I think, in my mind. And that is the very essence, because it's like if you knowingly did that, that's how you make the fraud case, right? But here's the thing. Can you imagine trying to explain the CI/CD pipeline to a jury of 12 non-software developers and how you should be threat modeling and QAing and testing for smoke testing. Like, this is insanity to try and bring an action, a jury trial. Um, you know, everyone there would need, you know, a second to third year computer science degree to just understand the language.

No, no, no, I completely disagree. We have seen litigation cases of extremely complex cases in regards to DNA and things like that where you explain it in plain terms. But, and that's where you bring experts in, right? Because a jury doesn't have to understand all that. They just have to listen to the expert testimony. So we can have that. But the problem that I think you are highlighting here is you can bring in your expert in and says, this is what a CI/CD pipeline should be. And I'm going to bring my expert in and say, no, that's not what a CICD. And so, okay, so we're at a tie. Guess what? That really goes to the defense. I mean, because you have to prove that they've done, they've been negligent. But if you have some kind of standard you can point to, well, hey, FTC says this, or CISA says this in this document. Well, okay, you got a tiebreaker there, right? So, you know, I'm not worried about the complexity. I'm worried about if there's precedent and standards out there, and many of those standards are an interpretation of a regulation that was designed to be generic. And now what this ruling, I think in my mind, is going to force everybody to do is they're the regulations moving forward to avoid judges doing all sorts of weird things, right? They're gonna have to be more prescriptive. And I'm not sure if our Congress, House or Senate, has the skills to be able to navigate that balance between we need to be prescriptive, but we also have to be flexible because We're going to make this ruling once and it needs to apply for the next 3 decades, right? So we can't be too prescriptive. So I think the legislature is going to have to completely pivot. And instead of being prescriptive on exactly what is required, they're going to have to be extraordinarily prescriptive on what the agency, the boundaries of what the agency will be able to interpret. And I don't see them writing very good regulations right now or in history and being able to find that sweet spot.

The SEC floated that very idea and got shot down, right? The idea that cybersecurity is akin to an accounting control. And that was like, nope, nope, not buying it. Judge Engelmeier, you know, in New York went, eh, it's a reach. You know, just because IT at one time back in the day always seemed to report to the CFO, Doesn't necessarily mean that it's going to need a little bit more. I mean, let's now talk about the impact of this event in some really interesting areas. So I'd imagine that venture capital companies and PE companies now are going to be scrutinizing their portfolio for what is called being CrowdStruck. And what is being CrowdStrike?

It's, do you know, bad when your actions turn into a verb?

And so the question is really going to be now around, can you blow up a Windows box with your software if you do it? Now, the SaaS vendors are going to be all like, not a problem, man. We're in a web browser. We don't do anything. But anybody, anybody putting something on an endpoint, anybody building client software, or, you know, I can think of dozens of different management agents that get deployed, including Windows services themselves. I think we're going to suddenly find that we're living in an incredibly precarious world on layers of bad software all the way from the BIOS up. Like, and then And that brings up the issue of that chain of trust, right? It's like we thought about, okay, you've got top developers, you're a very successful company. You know, how are we going to even determine like if corners were cut? Like what is the standard? Who are we going to put them up against, right? Not Microsoft. Microsoft's got a history of bad patches and blowing up endpoints, right? And no one was talking about taking them to— well, I'm sure people were talking about taking them to court because my Exchange server got blown up. Up, you know, because, you know, exchange servers just randomly do that, you know, but, you know, it's a future, but, you know, it was interesting to me because, you know, shortly in that Azure outage that occurred just recently, right, not prior to the CrowdStrike event, but like recently, I think it was like a couple days ago, you know, at the same time we revoked DigiCert's certificates globally, right? I'm thinking, wow, that's got to be another one of those what happens if a major certificate company, you know, right there puts out a malformed certificate. I think there was precedent though of that happening with Ericsson. If you remember a few years ago, they forgot to renew a certificate and that flummoxed the whole thing. Like, this house of cards that we're on, Matthew, You know, we got trains running on cardboard boxes here.

Yeah. And that brings up a whole nother topic, right?

Yeah.

The fragility of our environment. But, so let me talk a little bit about what you first brought up, right? What are some of the changes that we're going to see coming out of this CrowdStrike issue, right? And especially around QA of software. I think you're right. I think the VCs and the PEs, when they're evaluating a company, they're going to start asking a few more questions around what is your CI/CD pipeline? What is your operational sustainment? Are you using bidirectional communications with agents at the endpoint? What level of permissions and access to the kernel are you using?

The spreadsheet got bigger.

They're going to ask a few more questions. Because they don't want to be the CrowdStrike, right? Yeah. They don't want their investment to go down, especially if it's a small company. CrowdStrike has deep pockets. They're going to be able to survive. A small or mid-sized company, if they did this, they're out of business. They're done. Right. So I think the PMCs, the money are going to definitely look at that. I also think that cyber insurance and regular outage insurance Right.

In trust.

Business sustainment insurance kinds of things. They're also going to add a section in the 400 questions that they normally give, you know, hey, you know, do you do bidirectional this? Do you do updates? Do you test all this before it goes out? There's going to be a whole bunch of questions, but like 95% of those questions, they'll ask them, they'll get the answer, and they won't look at them. They won't understand the answer anyway. But at least they'll have that because again, we're not real mature in processing that and understanding what actual risks that make. So I think we'll take a baby step, but I see this happening again and again, right? And in fact, this isn't the first time that a security update blacked out a huge amount of customers. We saw this back in 2010 with McAfee, a bad DAT update update, right? Cratered the antivirus, blue-screened the systems, and everybody had to go out there and fix these things. It wasn't as big because, well, there weren't that many systems out there, but we've seen this before. So I think we're going to continue to see it again until we reach that pinnacle of some pain threshold where we finally go enough, and that probably is going to be tied to lawsuits. Because again, the regulations aren't going to say it. They're already in their own, you know, chaos swirl. So I see from the industry perspective, yeah, there's going to be some changes. I'm not sure how effective they're going to be in convincing organizations to really do better. And then if we get back to the fragility of, yeah, cardboard boxes, right? I mean, that's what we're all standing on. I think, and I've been advocating online, probably people hate me, but we've got operating system vendors that take the blue screen of death, right? That is a throwback from more than 2 decades ago, right? And I get why it was created. And actually, I loved it when it was created. It was created because of limitations in your hardware, in the software and everything else. And so, if they critical failure was determined, right? That some program was going, you know, doing something inappropriate, jumping to ring 0 or outside their ring. The system said, "Hey, this is bad. I'm just going to lock everything up and stop the damage." And then it was fine given the limitations, but it hasn't evolved. Why hasn't our operating systems been better at compartmentalizing and isolating applications. Nowadays, and back in the day when blue screens were created, you were only running 2 or 3 apps. I mean, that's all your system could handle. It's that, right? You would have to close down your Office just to open up a browser. I mean, but now we are running so many applications. Our operating systems should be resilient enough that no single application should be able to crater everything else. We should be able to contain those things. And yet we haven't done it. It is possible. It takes— ties in with the hardware and the firmware and the operating systems and VMs and all those things. But we should be driving our operating system vendors to get better. They have not adapted to the digital landscape, much less the attackers. And in this case, there was no attacker in CrowdStrike. It was simply fat fingering and oops, we made a mistake.

But if it was malicious, yeah, I mean, the bonus is that once you fix the problem, you got all your data back, right? So as a dry run for a major cyber ransomware, world-ending cyber Pearl Harbor, insert whatever metaphor you like there, I mean, this was a great dry run. I want to go back to lawsuits because to do a lawsuit, you got to be a lawyer. And I will caveat it right now. Do not take legal advice from me or Matthew Rosenquist, okay? Ever, under any circumstance.

We are not lawyers. We are not offering legal advice. Disclaimer, disclaimer, disclaimer.

Here's the thing. Like, your corporate counsel now is going to have to look at their contracts in a whole new light and into the supply chain. Of those contracts, right? Lots of users out there of different pieces to make their product or service in the market. We saw what happens when a major player, you know, has a major issue and the impacts go across. Conversely, if you are one of those organizations, you're going to have to look at something that doesn't make you look like an uncaring baboon when you clearly have a problem, right? And kudos for them to owning it. But the whole idea— the whole idea of like, what does the restitution look like? That type of thing might need to start entering into the T&Cs. Now, I agree with you in terms of insurance companies. Now, like corporate insurance already was a burden for CSOs to fill out pages and pages of spreadsheets. Everyone gets a spreadsheet like Oprah Winfrey. But to this day, to this very day, I know of no false claims action brought by one party against the other party because they said that they had awesome cybersecurity and they didn't. They clearly lied. I haven't heard of any of this. This is why we love arbitration, because it's all secret. Right? But I bet you we're going to start seeing a breakout of lawsuits that go far beyond the daily grind of, oh, you rented this thing, it didn't work out, here's the payment for your rental, we're really sorry. Right? That's the nature of the software industry right now. You rent a trailer to move and it has a flat tire and the company's sorry and they come out, they fix your tire. That's all the restitution that you get, right? You still got the trailer. It still saved your ass for, you know, years and years while that software was installed, right? But now it went sideways. So, you know, are we going to really now try and— I love the expression— are we going to try and crater CrowdStrike because they had this problem and it was just this turn? And this is my cautionary to all the other vendors in that particular area. Don't be throwing stones in your glass house, right? But on the other side of it, CrowdStrike, you're going to be the meme mama at DEF CON and Black Hat. My heart goes out to any of the sales team, the business development team, any of the sales engineers that are going to be trying to continue business relationships in what can only be described as a hostile climate that wasn't made any less hostile by gift cards. Okay. So cautionary tale. That's my thoughts.

No, I agree with you, right? And I mean, the reality is mistakes were made. Impacts were felt. So there needs to be some pain and suffering on the organization that made the mistake. That's just the way life works. So yeah, you know, being a salesperson over at CrowdStrike right now is probably not the choice job. It just isn't. But, you know, what I'd like to kind of finish our discussion on is what good things are coming out of this. I mean, you and I have been pretty critical about a lot of different stuff here, right? But what do you see as that silver lining?

Well, so you're absolutely right on your previous rant about we're still at blue screen. Nothing has changed in 20 years. Why don't we have a more resilient operating system, a more resilient kernel? Maybe we need a shadow kernel watching the kernel, and if the kernel goes sideways, the shadow kernel, you know, takes over. We've got all of these— we've got multiple cores, we've got multiple CPUs in boxes, and it seems like one thing— EAX push— and the whole thing explodes. So that single point That single point of failure that you talked about, I think is the one that is gonna be a really common discussion now, especially in national critical infrastructure, especially when it comes to healthcare. And, you know, for all the Linux boys and girls that are out there, it is your time to shine, okay? Not saying stones aren't thrown, but, you know, some folks made a lot of sense to me and they said, you know, listen, like maybe we need to have, duplicate capability when it really matters on a completely isolated or different operating system, operating environment, yet functionally provides the same capabilities. When it comes to like big things that if they stop or abruptly come to a halt, they don't become catastrophic. That there's a moment where we can stop all the trains, flick up to the backup system, and bring things on safely while boxes are in boot loops. So I guess, you know, this brings up a national imperative because I think we got a valuable lesson for all the money and effort that we put into doing things like segmentation and, you know, deploying multiple layers of security. We're nowhere.

And we didn't do it for the infrastructure.

You know what the old gag is? The famous two astronauts with one astronaut. Throw out with a pistol that says it's phishing. It's always been phishing, you know. So there is a bigger discussion to have because I think what we learned here is two really important things. Business resiliency and BCP are things that we're going to need to be, you know, are going to need to be everybody's responsibility the way they keep saying security is everyone's responsibility, but now it's resilience and BCP and security. I think that's part of the conversation. And we have to figure out how to properly manage supply chain partner risk in one form or another. And that form could be, I am now going to take out a policy specific to my EDR that if it blows up my boxes, I get paid, yo, for my time of trying to fix it. We may have to get to that granular level in cases where that piece of software is so critical to operations. And I think the future for people that can come to the table with the depth of experience that folks you and I have to advise, you know, that, hey, we're in the cloud, but you remember Dyn DNS? Didn't matter if you were in the cloud. You couldn't get to the cloud because the DNS provider got, you know, hammered with— Right.

There's always a weak point somewhere.

That sums up the last, you know, 40 minutes of the conversation. There's always a weak point. And I think that is, that is a great summary. But, you know, the other thing too is it's incumbent upon us to continuously review our threat models and continuously look at what are our points of failure. This one did take a lot of people by surprise, but that's exactly what the bad guys will do is they will want to try and take us by surprise. So lots of lessons learned. What do you think the outcome is though? A year from now, will we still be talking about that CrowdStrike event?

We'll look back on it and hopefully we will be able to talk about some of those lessons learned. And I love the 3 you brought up, right? The fact that there are potential architectural solutions out there that we need to be exploring. And you mentioned several of them. You know, I've seen them in hardware, in firmware. I've worked with operating systems that have looked at this and VMs for failover, you know, separate operating systems, failback to gold builds or whatever. There's tons of different stuff, including isolating of hardware and cores and memory and all tons of stuff you can do, right? So definitely on that. I love the fact that you mentioned, you know, looking at those third-party third-party suppliers because we've been saying this and we've seen all sorts of problems for years and years. And even before that, we predicted this was going to be a problem. This is another problem with a third-party supplier. In this case, it had to be a cybersecurity vendor. But I think there needs to be more visibility there in vetting which ones you have, right? In potentially transferring the risk, like you mentioned, having a separate insurance policy. Right, like GLR. Radical. Goes down. Right. But there's, you know, just, yeah, understanding that risk and managing it. Third-party risk. Yes. We keep hammering it. This is another example of it. And, you know, I think the other thing that I will add is I think this is a wake-up call for all software vendors to take a look at that. Hey, are we doing two-way, you know, telemetry? Are we sending updates? What is our Q&A process? Are we really testing this?

I don't want to have to say, "Chug my beer," right? Yeah.

But, and I think what that will do is that will open up a little bit more funding and visibility and give a little bit more time to those engineers and those architects to say, "Hey, let's look at our processes." And right now we cut some corners. We have some engineering debt in our Q&A space. Hey CEO, I need some time. I need some funding. I need some more headcount. We need to fix this. We don't want to be the next CrowdStrike. And that's going to get traction. I hope, I hope, I'm crossing my fingers. So I think when we look back on this in a year, I think the biggest thing we're going to see is a quiet uplevel of Q&A processes for especially that bidirectional, right? Anytime you're pushing updates, especially if they're incremental updates versus, "Oh, it's a brand new version. Of course, we go through Q&A." That's easy. That's already being done in the most part. But if there's any of those incremental updates or pulling telemetry and we're going to change how we do this, it's got to be tested. You can crater your software and you can crater their operating system. So I think in a year from now, we'll look back and go, hey, that maturity level across all software vendors has gone up and so has the ability for disaster recovery and business continuity. Any time you have a big outage like that, you had to have a crisis. Hopefully there was a postmortem or a post-incident review and you decided, yeah, we've identified more single points of failure. Yes. We've streamlined our crisis process so we can activate faster, we can, you know, respond faster and minimize the downtime. But that takes practice and it takes good policies and procedures. It takes good leadership and the ability to grant that crisis leadership some bandwidth in what decisions they can make right off the bat versus having to wait and get a meeting with the C-suite and get approval to do something. You know, give me a few playing cards that I can automatically throw down because we're in a crisis.

And I think—

I mean, I see that.

I can 100% support that and completely on board with it. I would add to that, to fight off the inevitable lawsuits that come with this major type of catastrophe, what you talked about is critical because it's documentation. It's evidence that you're trying to do everything you can., right? And that way, when a company comes at you and says, "Your company is a pile of cowboy IT, right? Doing whatever they want, whenever they want," you have the evidence to refute that allegation because anyone can make up anything if you've got nothing there, right? And I think we're going to see that. And that also affects that PE, that venture capital, that investment and M&A world. Where if you can't demonstrate that you've got policies and mechanisms, control mechanisms to ensure those policies are enforced, and processes that are documented in logs to prove that those processes were followed, your ass could be hanging out in the breeze.

Mm-hmm.

Don't like that. That's not a good thing. So awesome. Yeah.

Yeah. And I think the lawyers, again, are the ones that are going to win out of this. They're going to win as part of the lawsuits when bad things happen. And they're also going to be a— they've got to now, you know, review all those contracts, all those EULAs and SLAs and everything else. And so you're going to have a lot of lawyers doing more work, charging exorbitant prices. And then I think you're also going to have more cybersecurity experts also in that mix because just as you said, you have to figure out, well, what is that right balance of controls based on our risk? And that isn't something you can just go to a book or you can look up or Google or ask ChatGPT. You need that expertise. You need those miles and those scars to say, yeah, I get this. And not only can I protect us from the previous lawsuits and issues, we can hedge our bets on how the industry is changing and how your competition is evolving and how the regulations are, you know, being interpreted and things of that sort. So I think there's also going to be a need for top experts to weigh in, in partnership with the legal team, in partnership and in support of the C-suite, and then also be able to communicate that to the board because they're going to want to know. So are the PE firms and the VC firms. They're going to want to know. And if it's cybersecurity related, they're probably going to want to hear it.

Yeah, generally that goes better than the head of marketing. I mean, what do you think?

Yes.

All right, brother.

All right. Hey, thank you so much. Great discussion. I always appreciate it.

I love it too. So much chatting with you. And we'll maybe see you in Vegas. Yeah.

Okay. Not this year. I've got a conflict with a client, but we will talk again. And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Ian here to dive into the most relevant, interesting, sometimes controversial cybersecurity challenges, perspectives, and best practices. We'll see you next time.