Ransomware Cybersecurity Fireside Chat

Welcome to Cybersecurity Insights Fireside Chat: Ransomware. Our panel today will be diving into the relevance and the response of this particular scourge that's been plaguing us and showing up in news stories. And today on the panel with me, we've got again Alex and Justin. Alex Rader, Principal at Phoenix 2.0, and Justin Daniels, Corporate cybersecurity and data protection attorney. And I'm Matthew Rosenquist, CISO and cybersecurity strategist. So ransomware, fun topic, and we're seeing it in the news. We're seeing critical infrastructures being hit. It's been around for a long time and it is big business. This year alone, it's estimated to hit or top over $20 billion of impact. And that's money flowing into the pockets, into the grubby little hands of cyber criminals all over the world. And the impacts go beyond just those dollars because we're seeing that the targets that are being attacked are having grave impacts to people that aren't even part of the company or the person that's the victim. You know, the way we see that is when it's hitting critical infrastructures. We saw, you know, a major pipeline get impacted by ransomware, and the pumping functions of the gas pipeline itself actually weren't even impacted. It had to do with their ability just to bill the customers, and because they couldn't bill the customers, they stopped the flow of fuel. We've seen a major meat packing, meat processing plant go down because of ransomware. That can affect, you know, fuel at the pumps. That can affect food that's on our shelves in the grocery stores. We're hearing of attacks hitting water purification plants affecting the water coming out of our spigots at our homes. We're seeing attacks against, uh, electrical grids and even sanitation plants. Again, when we start seeing hitting critical infrastructure, it's not just the, the victim that's being attacked, it's everybody that gets impacted. So yes, $20 billion this year, and by the way, it's probably going to go tenfold within several years after that. I think the estimates are by 2025 or 2035 or something like that, um, you know, well over $200 billion. But again, that's a drop in the bucket. And actually, I personally think that's a little low. So let's kind of dive in here and talk about what are some of the capabilities that we can do ahead of time to make sure that we individually and individually companies and organizations can either reduce the risk of being impacted, right? Being able to prevent those kinds of attacks or on the backend, be able to reduce the impacts if you are impacted. And we have to keep in mind, whatever we do today, we know that the bad guys, they are adapted. They do have tremendous skills and they won't just roll over and die, right? This is big money to them. They are going to cling to this. They are going to continue to be persistent. So it is that adversarial, you know, encounter with a highly intelligent and highly motivated attacker. So let me throw this over to Alex. Alex, from an IT perspective, from, you know, protecting, you know, a company or an organization, what can we do? What are some best practices here?

Right. Well, so Justin, let me just, for folks that didn't see our previous recording on cyber due diligence for M&A, please watch that because it it, I thought it was really well done and came out well in terms of just having your contributions to that exercise, which will come into play at some point for a lot of companies. There's a lot of PE money and funding and everything, and people are coming out of this COVID pandemic and trying to grow. So, you know, the last thing you want is a cyber event. So what can we do to protect ourselves as, as IT? So I wear both hats, right? Phoenix 2.0 is a full-service IT consulting and management firm. But our two big sort of hot-button issues are digital transformation and cybersecurity. You can't do digital transformation if you're going to have a six-, seven-figure disruptive event, right? So all this stuff kind of goes hand in hand, right? But I will take the security hat off for now. I'll speak purely from an infrastructure, day-to-day corporate employee-facing IT blocking and tackling. The things that we really want to see at a minimum depending on the size of the entity, is, uh, backups, right? We want to see the 3-2-1 backup rule, which means you have 3 copies of things. One is a copy that you're working with, one is a copy that's in the cloud, typically accessible, and another copy that's on some storage media, network-attached storage server, storage area network, hard drives that you're rotating, whatever it be, but disconnected from the network in the live production environment, right? So we want to see some semblance of that logic with backups. And we also want to see password management— huge, right? The easiest way for these guys to, to wreak havoc is to get credentials to some sort of an account, which they can from there move laterally, escalate privileges, etc. So password and identity management, which also means multi-factor authentication. So I start depending on client's maturity, I start with those basic things. Where do we get those from? We get those from 2 places that I really like are the Center for Internet Security top 20 controls, which are high-level categorical controls for different things in an IT environment that we should all be doing. And then you have things that are a lot more detailed, like the NIST framework from the National Institute of Science and Technology, which gets— it takes those 20 categories and breaks them down into 100+ different controls, right? And some will be applicable, some won't, based on your environment, but it gives you a checklist to follow. If you're in a regulated industry, you've got something that regulators are asking you to be beholden to in terms of compliance, but that in and of itself will not give you a day-to-day functional kind of security program that you need. It'll just check some boxes so that you don't get in trouble with the regulators, but it really doesn't stop short from the day-to-day mechanics you need. It stops a little bit short of the day-to-day mechanics you need to put in place. It doesn't it doesn't match how you're operating as a business to those controls, right? There needs to be some kind of a function there that says, okay, we have our business, we have our work that we're doing, we need to put some security in place, but how do we do that in a way that people can continue to stay productive, right? And that's why, as we talked about in the other podcast, we often want to split the IT and security function in two. So I just— some things that are at a high level that we could be doing. So again, backups, intelligent schema around backups, password management, multi-factor authentication, and then access, identity access management. Who's accessing what, when, where, and how, and having a strategy, right, around those things. I think that'll get people really, really far.

And referencing NIST and other things, although NIST is, you know, for the small and medium companies, you know, it's pretty detailed and it can be a little intimidating. For the larger organizations, more resources. But so those are kind of the things that you would recommend on the technology side, and those are absolutely applicable to small and medium. What about from the behavioral side, right? We see a lot of attacks coming in through social engineering. Is there something that every organization, small, medium, and large, that really needs to be doing to protect against that ingress point of social engineering?

CIF's Top 20 is something that people will know, but there are other less common but really simpler frameworks or ways of thinking about this. So the Australian Cyber Directorate came out with something called the Essential 8. I like to add 4 more things to it, a couple of which are behavioral. Security awareness training is huge, right? I think that's what you're alluding to, and I was sort of remiss in not lumping that in with the passwords and backup and multifactor authentication. Factor and identity, because I think that's absolutely the critical piece. And that's frankly something that IT can't really make a policy decision on. That has to come from the top down in the business to instill a culture of security awareness, right? The principals and the operators in the business have to say, look, we're going to do some security training. This is a cultural thing, right? We're all going to keep each other safe. It's not really in IT's purview to sort of drive that. We can drive the day-to-day implementation, but it's a cultural mindset that needs to happen at the top of the business. The other things are cyber insurance, really, really important. That's— I would call that a behavioral thing because it has to do with understanding and managing risk, right? Or mitigating and transferring risk by use of insurance. That's a really good tool as well. So those are the big two that come to mind.

Now, Justin, you know, still in this, this whole prevention kind of aspect, you know, Alex is talking about, you know, all these different and tools and behaviors and so on and so forth. How important, from your perspective in dealing with a lot of executives and at that level, how important is their support to be able to get some of these preventative tools and suck up the time of employees and workers with training? Um, you know, what are you hearing and is it important, do you think?

Well, the executives set the tone for the entire organization, so their support and and approval is essential. And, you know, as we talk about ransomware today, I'm beginning to think that the Colonial Pipeline might be the real dividing point because it started to really impact critical infrastructure in ways that people could see. I now have clients who call me and say, hey, I have customers calling and asking me that if I have a ransomware event, they want, me to be liable based on my insurance, not on the typical kind of 3 to 12 month limitation of liability. I have other clients who are now completely supporting me when I say that if the other side can't demonstrate to us that they use multifactor authentication, complex passwords, good identity access management, that's a deal breaker. And starting to see clients support me in that and view things differently. I think that is a good development. I think it needs to accelerate. But I think from my perspective, I think Colonial Pipeline is the one that is starting to have a widespread impact on executives to say cyber isn't sexy, it isn't exciting, it's just essential. And so I am starting to see that. The challenge is we're not seeing it enough, especially with smaller businesses who don't have to your point, the same resources and budget that the larger companies do, but their challenge is going to be, hey, if you want to do business with IBM, they're going to have certain requirements that you have to maintain or you're not going to get to do business with them. So that's also impacting it, but in short, it comes down to if the executive level has buy-in or not, because if they don't, then why should anybody else in the organization pay attention to it? The executives are not.

I mean, but it sounds like at least the, the clients that you're dealing with, and, and maybe it's an industry change, that they're starting to realize, yeah, the, the executives are on the hook for this, um, and that this is, you know, as you stated, this is table stakes now. This is just one of many normal business risks that we have to deal with, whether it be competition or something else. We have to address this, right? Our names and, and, you know, our contracts and everything else, we may be held accountable. Is that what you're seeing as a mind shift? Are we there? Are we just in the beginning of that? Are we at the tail end? Everybody's come to consensus, you know, how mature is that, that line of thinking?

I think it's in its infancy stages to starting to fundamentally shift to where every technology deal that I work on Who owns the data? What rights do they have to use it? How do they share it with other parties? How do they secure it? On almost every technology deal I work on now, that's right up there at the front, and I'm not getting pushback from clients for me to start engaging in what I like to call my cybersecurity proctology exam, because that's essentially what we're doing.

And You know, that visual just won't leave me.

Well, I have a better visual for you. I'm thinking I need the vanity license plate called the Cyber Ass Man. But, uh, you know, seriously, I'm gonna ignore that one for a minute.

Let me see.

Come on, I can't help the Seinfeld reference. I know.

Yeah.

Yes, yes, I know.

Okay, so if, if we do— and Alex, this is kind of to you, you know, if If, if what Justin is saying is right and we are getting that support from the executives, from the top tier, right, there's benefits there. Not only are they, you know, walking the walk, but that means they're probably also opening up the, the coin purse and allowing, you know, more resources, financial and whatnot. So on the preventative side, then, how does an organization leverage that in either their budgets or risk modeling or things of that sort to not take too much, right, and regret it later, but also not, not take enough, right? How does an organization go about figuring out what that right budget is or those asks are?

Well, um, it depends, right? I mean, is if most of the customers I, I want to keep in mind for this are fast-growing startups, lower middle market companies. That's where a lot of the money in the market is flowing into, right into that space. Because I think enterprises have a different story, right? They have an inherent set of skills in-house to talk about IT and security and manage that. There's probably a budget, but what about everybody else? Right. And as enterprise defenses get better, these guys, the bad guys are going to move downstream. Right. Which they're already down there. Right. I mean, the amount of unreported cybercrime that goes on in the lower middle market, SMB market, that just gets swept under the rug, whether the business stays in business or not, is, is, you know, immense. It's hard to underestimate. I mean, Chris Krebs, who is the head of CISA, said, you know, we have no idea of the scale of the problem. And that just tells you when the top cybersecurity guy in the country says that, you know, that's— it's hard to deal with the problem when you don't know the scope of it. But to To answer your question, I want to take a higher-level view. So if you're, let's say, a company $5 to $150 million, right? Let's take that, that slice, sliver of the SMB lower middle market, which makes up kind of a two-thirds majority, I think, or higher of the businesses in this country. Coincidentally, people, I don't think, realize how many of the businesses are small in aggregate. But if you're in a regulated industry, again, that makes it easier because you have some basis for comparing yourself to other peers in your industry in terms of what you can be doing. And that's a good start. But if you, if you're not, if you're not regulated, a privately held, privately held entity, you got to talk to an outside third party, right? You've got to talk to a firm that is information security consulting and management provider. Those folks will offer services like coming in and doing a risk assessment, right? An audit or an assessment of your infrastructure, people, intellectual property, platforms, etc. And they will look at that surface of all those things and tell you What's going on in your industry with your peers, right? There's a lot of threat feeds and the Verizon Data Breach Report and the Record and all these things, CyberScoop, and all these publications that track this stuff, right? And I can quickly go in and look at a company in the vertical they're in and their size and scope and tell them what kinds of nonsense they can expect to happen to them from a cybersecurity perspective. And then from there we go, look, these kinds of incidents unfold as such, right? You're looking at for a percentage of your infrastructure offline for X amount of weeks, we're talking low to mid-six-figure recovery costs. We're talking about— no, there's probably, you know, you're not regulated, so probably not going to be a regulatory fine per se, but you may have class action lawsuits on a privacy front. Now, that's yet to be determined. I will ask Justin to comment on that. So if we're talking about a low to mid-six-figure or low seven-figure event, How much is appropriate to put in place for protection, right? If it's a highly probable and highly severe event, because for most, most of these customers we're talking, that's a severe event, you know, mid to low 7 figures, right? So an InfoSec, to start a basic InfoSec program, we're talking $5K to $25K for penetration testing and vulnerability assessment, right? For certain kinds of entities, depending on how many external properties they have on the web and IP addresses and all that. But that's a decent range. You can rent a virtual CISO for a couple grand a month that will help you put a program in place and keep the people that are delivering the services day-to-day honest. You can get managed detection and response with outsourced SOC for, for several thousand dollars a month. So basically you can put in place a pretty very mature cybersecurity program somewhere. An incident response retainer is $5K a month. That's the lowest I've seen from a very reputable entity. They've actually done this because they want to be helpful and it's not a money-making mechanism for them. They hope to provide proactive security after they help companies recover from a breach. So you can get a cybersecurity program in place for the less of the cost of a full-time employee. We're talking $10,000 to $25,000 a month depending on the size of your company, right? And if you're a large enough entity and funded startup, right, I'll give some examples. Our middle private equity company, you're going to get bought or sold or you're going to buy somebody, right? Middle market, lower middle market company that's backed by private equity or somebody— there are people that are interested in keeping you whole. That's not a lot of money to spend to prevent a 7-figure event. The stuff that I talked— we talked about earlier, the behavioral stuff is basically free. It doesn't cost anything to flip on multi-factor auth for Microsoft Office 365 or G Suite or to, to, to use a password manager, right? The costs are minimal. So that's in a nutshell what we're talking about. And I hope, I hope that's helpful, but I want to also bring Justin in to maybe flesh out what these events feel like. What are we talking about when we say weeks of degraded operating capacity and percentage of your systems offline and mid to low 7-figure impact, right?

So from my perspective, when I deal with the ransomware event You have a few— you have a variety of things going on at the same time. Typically, I have to put the team together because there's no incident response plan. Two, the client doesn't understand that if they even have cyber insurance, who's on their panel, meaning who is the in-network providers, because I'm not on all of the panels because it doesn't make economic sense for what some of the insurance companies like to pay.

Pay.

So they don't even know that. And then on top of this, you then have, how are you dealing with your customers and your employees? Because as we all know, this isn't an episode of CSI Miami where we get the forensic report within an hour and everything's tidily resolved. Doesn't work that way. As I talked about the forensic report, also we have the separate part of the ransom negotiation dealing with law enforcement, and then the other one is, depending on what happens, do you have to have breach notification done on multiple state laws or potentially HIPAA or other ones? Because when you have to do that, that is when you take, from a legal risk perspective, that's when you bring in the rogues' gallery of plaintiffs from individuals under California law, possibly, regulators, who want to have their nose in, state attorney generals. So you're dealing with all of these things, but you're dealing with it under time pressure with incomplete facts and your business is on the line. So I've had multiple ransomware engagements where they took down the entire network. And even though we had backups, a business decision was made because they hadn't tested the backups that they were going to pay the ransom. And then I had one on top of that was the system was circa 2010. I've seen systems as old as circa 2002. And they were going to rebuild the whole system from scratch. So yet that's hiring Alex to come in and rebuild your entire IT infrastructure while you're trying to get your data back and you may not have good backups or if you do, they're corrupted. And so as the snickers by my fellow panelists suggest, this is a 4-alarm tsunami firestorm. And it's made even worse because most of the firms haven't practiced. Even if they have an incident response plan, they don't know how to communicate, who's on first. And so predictably, you have a chaotic and poor response. And you've seen it time and again in the news where you read about companies taking positions. The breach has been handled. This is no big deal. To find out 2 weeks later the CEO is full of you know what. And that's what you have in a ransomware event. And that's why, as I always like to say, once a company has a ransomware event, they are reborn in how they view cybersecurity and they take it very seriously. Unfortunately, we're still in a stage, and it's starting to shift, that they have to experience what I'll call the business heart attack before they realize they have to take much better cyber and privacy care of themselves.

Yeah, they're reborn if they survive, right? The latest metrics that I've seen is between 60 and 90%, depending on the data source and the survey and, and the research, but between 60 and 90% of small and medium businesses are out of business within in a year to 2 years after a major cyber event, and ransomware qualifies as that. So a lot of these companies simply don't survive. And I mean, you mentioned so many things there, it was tough not to smile because, you know, the attackers, they cause havoc. But the simple fact is, if a company isn't prepared or how they— if they respond poorly, it makes it so much worse, right? You had mentioned, you know, companies that don't have breach team or don't have an incident response process, right? So okay, now you're blind and you're just, you know, you're wasting your time, your effort, your resources. You're in panic mode. You don't even know where to start and the damages just increase, right? And the next big domino falls. And did you report the breach, you know, on time? Are now you liable, um, because you didn't do that or you didn't notify? Or now you're served And yet, if you had some of those things, if you had a good breach team and you did test it and you did test your backups and, you know, you have thought about some of these things of what you're going to do when something bad happens like this. And by the way, it's going to happen, right? For every company out there, right? I spent 24 years at Intel. I was the incident commander. For all cyber attacks for what, almost 2 years for the company. And, you know, we had documented processes and they were in paper form as well, just in case the network went down or data store, we could pull those off, you know, open up the books and we knew who was in charge, who was accountable, how do we communicate if these methods are down, we fall back to B or C or, you know, whatever. We've got the call trees if we need to call people's cell phones. We've got the processes, the timelines, and we tested it. We mandated that it had to be tested at least once a year. Now in reality, it was being tested much more often than that with real incidents, and those team members started getting very, very good. My— the people that I would bring into the war room, they knew their role, they knew their timelines, they knew what they had to come in with, they knew what decisions they could make independently versus the ones that they had to bring to me and we would make as a team. And again, the ability at that level— and again, a large corporation, right? So we had the resources to do that. But even a small company, in my mind, has to at least have some of those things in place. And if not, you're risking your company because something like this eventually will happen.

So let's talk about this for a moment. You know, you're saying what companies should do, but there's a lot of things in life we should do but we don't do. So that gets into an area that I— that you and I enjoy talking about, and that is what if the Biden administration said, you know what, as part of doing business with the government, there's going to be these contract clauses in there that you have to meet, and one of them says you will have an incident response plan, and this is You know, you'll tabletop it once a year. Maybe we even participate in it or something like that. And if you don't, this is table stakes. You don't get the business. Or there's a federal law passed that this is what basic cyber hygiene has to look like. And if you can't even do this stuff, you can get tagged with fines, penalties, what have you. And so, um, as much as I don't enjoy being overregulated, I think we've reached a point with cybersecurity that if we don't put stuff in place, this behavior is going to continue because a lot of the small businesses are, I got to worry about getting customers in the door. I'm going to worry about the cyber stuff because if it happens to me, I'm going out of business anyway. So can we get at these issues for our listeners out there? Is you put it in your contracts. If, if Matthew's a critical supplier, then they're going to get the cyber as I said, proctology exam, and he's going to have to agree to things contractually that you can check, or else just say, Matthew, I'm sorry, if your security is not up to par, you're putting us at risk. And these are table stakes now. And, you know, Matthew, what are you going to say if you're a small business? Well, I need the business. Now I've got to really start thinking about security. And so I'm always trying to figure out how can we use market opportunities to try to get people to do the right thing because they have a financial incentive to do it. It's just too much of history teaches us that without some type of legal imperative— and, you know, I love to use the analogy of cyber as the 21st century seatbelt— I struggle to see how we get there.

And I agree with you because right now I don't think the financial incentives are in place to proactively go against these things. And Alex had mentioned insurance. Unfortunately, I see cyber insurance in combination with the lack of awareness of really what the problems are and so on and so forth as a crutch. And people think, oh, I'm not going to invest in security. I'm just going to, you know, transfer that risk over to some insurance clause. And at the end of the day, that's not going to get you really what you want. Because even when insurance is paying that ransom for you, there's a good percent chance that you're not going to get all your data back, or you may not get any of it back, right? And where does that leave you? Well, that leaves you as part of that 60 to 90% of the companies that don't survive. And so we need better education, we need more information out there, and we need those executives to understand not after they've been breached, like you're saying, but beforehand. Hey, this will eventually hit me in some way, shape or form, myself or my suppliers, my partners, whatever, you know, third parties, I need to take a proactive stance.

So Matthew now—

to not only minimize the chance I'm going to get impacted, but also reduce the loss if I am. I have to be able to survive.

So let me ask the two of you a question because we've all debated this online because we're all connected to each other. There's a big push out there that says, hey, We want to outlaw ransomware payments. And so we've debated that and I don't want to do that. But here I'm going to ask you a different question. What if I'm the insurance company and the insurers get together and like, we're not paying all these ransoms anymore. And the insurance company just says this is a blanket exclusion from the policy. Because that's a lot of companies use that as a crutch. And again, Matthew, I'm trying to find other market-based ways to get companies to say, I don't have the backup. The insurance company is going to pay the ransom. Now I got to figure out what I'm going to do, because again, to your point, they get reborn with security. But smaller, medium-sized business, that's the event that's going to put them out of business.

Yeah. Yeah.

And I'll throw it out there and make it known I am 110% behind outlawing the payment of ransom to the bad guys. But, you know, and we can debate that later. I'm sure we will. It's— there's some great discussions around that. But the example that you brought up, you know, well, what if the insurance companies do this? I think it's in direct opposition to their financial model. You know, it would be stupid for an insurance company to go, oh, we're not going to insure that. That's their business. Instead, raise the premiums, right? That's That's the way they operate. So I, I just, I cannot imagine the insurance companies coming together and deciding, because they would have to all decide together, let's go ahead and make that an exclusion, right? Because even if just a handful don't, well then that's where the customers are gonna go, right? So it doesn't work. And so I don't think the financial incentives are there. In fact, I think they would be in opposition to that. Alex?

Well, I will say that there is talk about them doing certain things like raising premiums and parsing out what is a ransomware attack. Remember, some— they went ahead and called something an act of war versus a cybercrime so they wouldn't have to pay the policy. So let's not underestimate the contortions insurance companies will go to minimize. It's all— it's all about the bottom line, I think. And if they see that they're getting hosed because they're paying ransoms at a rate the faster they can charge us premiums, they're going to do something about it. So, but, you know, insurance— my point with insurance was it's just a composite piece of the controls you have in place. It addresses a certain part of this whole thing, but not all of it by any means. That's why you need a program of various things— physical, administrative, and technical controls. You know, mostly technical and governance, right? Physical, you know, that's, that's kind of, you know, if you have a plant or you have devices that you don't want to lose, but Yeah, I mean, you need a, you need a program. So again, based on everything we've said, I don't think there's anybody that's not affected by this, right? Even if you're a small business, privately held in a non-regulated industry, now the CCPA, California Consumer Privacy Act exemptions, the thresholds are being lowered. I hear that now some nonprofits are going to be included as well. Everybody's going to be in scope. There are going to be other kinds of things that will happen with security questionnaires. I have two 2 small customers now that are answering security questionnaires and I'm helping them. One from Silicon Valley Bank, which is a client of theirs, a very large client. And the other one is Twitter, which is a very large client of theirs. And they weren't having to do this a couple of years ago. So in some way, shape or form, you're going to be affected and you've got to have a conversation with probably an external party because you're not going to hire internal resources to manage this stuff for you. That's cost prohibitive, frankly, in the Bay Area market or You know, most places in the country there's a shortage of cyber talent. So talk to an outside firm, have a consultation, and, and in about an hour's time you can get a good sense of what's probable and what's— what are the stakes, right? And again, a lot of things can go wrong with a ransomware event. Just because you have backups and you tested them doesn't mean that it won't take you weeks to recompile and restore all of this data from backups, right? Backups are not, you know, instantaneous, right? You don't just flip a switch and they come on. That's enterprise-level replication stuff that very few people are doing. The other thing is you can pay the ransom and get the encryption keys from the bad guys, but that encrypting decrypting process, never mind the way the mal— shoddy way the malware is typically written, that can wreak havoc on the data too. Just because the guys gave you the decryption key doesn't mean you're going to decrypt and everything's going to come back hunky-dory. That data may be corrupt as alluded to. So there are a lot of things that can go wrong. That's why you really need a program. And, and, you know, the one— I think the most important thing is having legal counsel that you can call. That's one of the— like, I've learned from Justin, the first call is to legal counsel. Don't start calling everybody and telling them what's going on because that becomes, you know, admissible in court, you know, if it gets to that point. So have legal counsel on standby and have an incident response retainer or a cybersecurity firm you can call who's going to take your call and not tell you, hey, we have 20 other people that got hacked that are in front of you, right? So have somebody on retainer.

So yeah, and I would actually flip that. I would always say, but I was the incident commander, always call your incident response first and they should be calling the attorneys and working together. But I guess it's, you know, yeah, if you don't have a commander.

Yeah, if you don't have a commander, then yeah. The attorney is the commander.

Justin, final thoughts?

Final thoughts from me on this topic? Well, there's quite a lot we could say, but I think the most important thing that I can say about ransomware is big lessons learned that I've learned this year are: one, you need to make the investment in your digital infrastructure. Your infrastructure shouldn't be older than my 12-year-old car, but it's rampant, especially in healthcare. Um, multi-factor authentication and passwords, and especially MFA for your remote workforce, has to be table stakes. And the other one, and we haven't touched on this as much, but it's critical, is you have to separate out the IT function from the security function. I have seen too many times where they put IT in charge of security and you end up with expedient IT and a ransomware problem. You have to bifurcate those two functions. So from my perspective, those are kind of the key things that I've been seeing this year that have made a real impression on me. Besides the fact that I think with Colonial Pipeline, I'm starting to see a shift in how the C-suite business owner is thinking about cybersecurity and where it ranks in the level of priority for the business.

Good, good.

Yeah, you know, for me, my lessons learned and, and the big takeaways that I'm seeing with ransomware— it's a big problem. It's not a new problem, by the way. Uh, you know, we, we see Colonial Pipeline and, and other things get hit. You know, the security community's been warning about this for decades, so it's not a big surprise, but it is finally getting to that C-suite and they're— they are surprised even though they've been informed. You know, it is a big problem. It's growing. It's growing 2 to 3x every year and now it's hitting those critical infrastructures, those government services, the utilities and all those kinds of things. So it's now impacting entire nations. So the problem's big.. It's growing bigger. It's something that has to be addressed. The traditional, you know, methods that we've seen in the industry haven't worked. They haven't stopped this massive growth. And yet ransomware has been around for decades. So it's something that we do have to take a new look at. It's something that we do need to be talking about. And many companies don't feel bad, but you're not prepared. Understanding that ahead of time gives you an advantage because that then opens opportunity to bring in the experts to go out and get those insights and figure out what you can do. And you don't want to be the easiest target in your sector. You really don't, right? You need to bring up those preventative controls to be at least on par with your peers, preferably ahead, right? The attackers, the They're looking for easy victims, and there's a lot of them out there, so don't be that easy victim. So proper preparation is very important, but on the flip side, expect that yes, at some point you or a supplier or whatever is part of your chain, right, you're all dependent on each other, are gonna get impacted. So you better have a plan. You better have the controls and the capabilities in place to minimize that damage and loss. Doing backups, great. Do you also test restoration and know how long that's going to take you? That would be even better. Right up your game in these different areas. So you've got preventative, but you've also got responsive. And again, if you know you're gonna need an incident response firm, have them on retainer. If you know that you don't have the proper insights right now to evaluate what you need, go out and get an expert. You know, have that our conversation, pull those people in so that you do have the insights. And this is a board and a C-suite problem. It's gotta be led from that, from the top. If not, it just won't get traction, right? And especially for small and medium and even larger businesses, this is significant. When you get hit. And if you get hit once, chances are you're going to get hit again. You're going to be on the list, especially if you pay. So yeah, we're going to be talking about this more and more and more. But with that, I want to thank Alex and Justin. As always, a great conversation, and I'm sure we will have follow-up discussions on ransomware and whatever attacks that come into the news. Thank you much, gentlemen.

Thank you.

Great job, guys. Thank you very much, as always.