Cybersecurity talk with John Demers, Michael Orlando and SAP and Honeywell leaders — 5/26/21

See Evolve!

Today, top security experts on the innovative measures safeguarding our nation's cyber infrastructure. CNBC's Evolve Livestream is sponsored by Accenture. Now here's Eamon Javers.

Evolve Livestream, Innovations in Cybersecurity is what this one is called. Today we're exploring how the ripple effects of the global pandemic have reshaped the security landscape. As cyberattacks become ever more sophisticated, remote work and distributed workforces increase the complexities of the attack surfaces, exposing new vulnerabilities and prompting this uptick in cyber incidents that we've seen in recent months. On the heels of that Colonial Pipeline hack, the SolarWinds and Microsoft Exchange hacks, there is no better time than now to have these conversations. So we start today with a dive into the public sector outlook, and then we're going to discuss how the private sector is approaching this whole new era of cybersecurity risks. So I want to welcome Michael Orlando. He is the Acting Director of the National Counterintelligence and Security Center. And also from the Department of Justice, John Demers. He is the Assistant Attorney General at the National Security Division at the Department of Justice. Welcome to both of you, gentlemen.

Thank you.

And if I could, I'd love to start with a mystery which we saw in the wake of the Colonial Pipeline hack and see if either of you can help us solve that mystery. And the mystery is this. We saw the Colonial Pipeline hack, and then we saw the group behind it, DarkSide, go dark about a week later. They vanished from the scene. We didn't see any of their websites publicly attributable to them operational anymore. And nobody seems to know what happened to DarkSide. So, John, if I could start with you, can you shed any insight on what happened to DarkSide after the Colonial Pipeline hack when they vanished from the scene?

Well, I don't think I'm gonna be able to solve that mystery here today. Thanks very much for having me. Thanks, Michael, for being on too. I do think though, you know, it highlights one of the issues that we have right now with nation states serving as safe havens basically for criminal cyber actors and this increased blending of the threat from sophisticated criminal hackers and nation-state hackers. And when nation-states aren't doing their part to, you know, investigate, root out hacking activity happening, you know, within their borders, then any number of things could have been the answer to, you know, what happened to the DarkSide infrastructure, including that, you know, they're just off renaming themselves. So we'll see.

Right. So TBD on that one. Michael, same question to you. Maybe expecting the same answer, but if you could, do you have any sense of whether U.S. intelligence had anything to do with that disappearance? And do you have any sense of who these DarkSide hackers actually were?

Juan, thanks for having me on the show, and good to be with my colleague from DOJ. You know, I don't— we don't have any sense of that, but, you know, I concur with John's comments that, you know, these ransomware attacks on our critical infrastructure, are definitely a national security threat. As you know, we take down pipelines and hospitals. It certainly creates a risk of life. You know, we do know that countries like Russia and China, Iran and others certainly create safe havens for criminal hackers as long as they don't conduct attacks against them. But that's a challenge for us that we're going to have to work through as we figure out how to counter ransomware attacks.

And John, as you talk about these— as Michael talks about these safe havens that are out there, the big question is what are American companies doing about this, because if anything, they're fueling the safe havens by paying these ransoms and giving the bad guys more resources to work with. How do you sort through the sort of the FBI's recommendation on the one hand that companies should not be paying ransoms to get their data back and the reality on the other hand, which is that companies are paying those ransoms and it's millions and millions of dollars and that's fueling the fire in some ways. But you can understand why individual companies feel like they have to do it.

Yeah, I mean, I do understand that that could be a difficult choice, especially at that moment. And so the question is, you know, what things can you be doing ahead of time so that you're not faced with that impossible choice when your system is actually encrypted and shut down? But, you know, the problem with paying the ransomware payments, in addition to the fact that you are just funding illegal activity, right, you're not just funding the amazing lifestyle of some ransomware hacker, that would be fine. I guess at the end of the day, you buy his yacht, you buy his houses, his vacations, but you're actually funding the criminal activity itself. The second piece is, you know, at the end of the day, you're making a deal with someone who is a thief. And the question for any business is going to be, can I really trust this person to deliver back to me the decrypt key that just does its job, doesn't implant any other malware into my system, and effectively allows me to unlock my system in a shorter amount of time. So it's a real question whether you're going to get what you pay for. You certainly don't have any recourse if you don't.

Right.

And Michael, you know, your background and your role now is counterintelligence, which for people who don't know that term, that means basically fighting spies. And we're used to this world where you have spy versus spy, but so often now what we're seeing in these situations is spy versus CEO. And CEOs don't have a counterintelligence background, a counterintelligence capability. How do you talk to companies about how they need to deal with this nation threat espionage activity that we're seeing? And, you know, especially considering the fact that companies just aren't bankrolled nearly to the scale that these nation-states are? It's an unfair fight.

Yep, great question, and I'm glad you asked it. You know, 20 years ago, foreign intelligence services were just looking to steal government secrets, government technology. Now we have nation-state actors looking to take intellectual property from the private sector and using all the tools to do that. And the private sector and government organizations have to look at security with a counterintelligence mindset, understanding that they're up against paid and well-trained intelligence services that have key technologies and tradecraft to steal from you, both illegally and using legal means to do it.

Right.

We need them to partner with the government so we can help them build the right programs. But also, when you talk about paying ransomware, the real conversation that we should be having is, you know, getting left of the threat. How do we better protect ourselves and build the resiliency to do that? You know, backing up your data, having the right cyber hygiene. We also see, you know, cyber is just one area of concern. You have the insider threat employees who oftentimes are recruited by these foreign intelligence services. Then you also have the supply chain issues. And so organizations need a kind of enterprise-wide security program that goes beyond just locks and doors and focuses on the cyber threats, supply chain, and the insider.

John, how do companies do that? I mean, the cliché in this conversation is always we need a public-private partnership, we need more information sharing, work together better. But what does that look like in real terms? You know, you talk about left of the threat and right of the threat. How about right in the middle of the threat, right when the attack happens? What's a company supposed to do in terms of picking up the phone and calling the FBI? What kind of information do they need to share? What kind of information do they need to protect for themselves? What are their next steps in working with the government?

Yeah, so I think right when the threat manifests itself, you have to have already prepared for that moment. So when it comes to, for instance, your question, Eamon, calling the FBI, you need to know exactly who you're going to call and what their phone number is, and it's already in your phone, right? So you have to establish those relationships ahead of time.

Or on a piece of paper somewhere in case you can't get to your phone.

Exactly. The second part is, I mean, think about your systems. Do not— do everything you can to protect your systems, but assume that someone is going to get in and then plan from there ahead of time again. Right. So someone has gotten in. How easy is it for them to move from one part of the IT network to another part of the IT network? Where is your data on the IT network? Where's the really most critical aspect depending on your business? Where is the most critical aspect of your data? How is that housed? Is that something you can access if you just access the main computer system? So the answers will depend very much by company, but segregation and segmentation of the data to make it harder for folks to move around. And then how do you restore the systems when they're encrypted or they go down to some extent? What kind of backup data do you have that's up to date but offline that you can recreate your own files and you're not counting on a criminal to help you recreate your files by giving you a decryption key after you give them millions of dollars? So all of that thinking has to happen ahead of time in a very, you know, realistically war-gamed-out scenario. And then I agree with Michael, one of the things we've seen, and not in some of these recent cases, but that we see in many cases, is this sort of hybrid insider threat, cyber threat. So the insider who plants malware on his company's computer and then you know, from afar, a nation-state can access that computer system and exfiltrate a whole bunch of data. Making sure that all parts of your security apparatus, your human resources, your law, your compliance, that they're all integrated and planning for events like this one.

And Michael, that insider threat that John's just talking about, that's something that makes companies uncomfortable, right? I mean, because then you're policing your own employee base and trying to figure out who's inside your company trying to cause you harm, you know, from an HR standpoint or just from a legal or moral standpoint, that's kind of a nightmare, isn't it, for companies?

No, I don't think so. You know, a good insider threat program goes well beyond having measures that monitor employees. It's about good HR practices that assesses employees for suitability before you bring them on, not just looking at the talents, And a good insider threat program also goes to educating your workforce so they understand that they could be targeted and what to do if they are targeted by an intelligence service.

So, John, one of the things we talk about when we talk about corrupting your data is this idea of possible threat of disinformation, right? You could not only have your data stolen, but you could have your data changed in such a way that you don't recognize it or that causes your company to make mistakes. That's a huge problem as well. We just saw this study out today from Facebook which talked about the disinformation problem globally, and they ranked Russia as the highest threat in terms of disinformation. I wonder if you agree with that, A, and B, what you think people need to understand about the disinformation threat in America right now.

So, uh, I mean, that Russia is, you know, the biggest disinformation actor globally is not a surprise to me. I, I do agree with that. I mean, it's always tough to come up with the metrics to measure some of these things, but that makes sense. But there are other actors who are catching up. If you look just in the US, you know, the Iranians are reading from the Russian playbook. You see the Chinese increasingly engage in disinformation practices on social media around COVID and other narratives. So, but, but the Russians have been using this for many, many years in many theaters around the world. They have learned it to an extent that, you know, most other countries have not.

Michael, same question to you on disinformation. How should companies in particular be thinking about this disinformation threat, and what should they be doing about it?

Well, you know, I agree with John. It's not just Russia, but it's Iran and China as well. And I think for private companies and organizations and individuals, you really have to vet the source of your information. And then you also, from your own information, put the proper protections in place. You know, always saying kind of left of threat and having those measures there and thinking about how that impacts your organization.

Right.

And but how can you tell, right? If you're dealing with a subtle actor who's gotten into your data and manipulated some things to change your analysis of the world around you, you know, we're all— I'm sitting here looking at a laptop as we're doing this. We're all so dependent on these devices and the data that's on them to make all of our business decisions throughout the day. If you can't trust that data that you're seeing on your laptop or on your hard drive at work, how do you operate a business?

Michael? So I think this all goes back to good cyber hygiene. As John talked about, but there was a number of things in regards to cyber hygiene that we have been saying for years and outside experts are saying is that, you know, for an organization to get onto your computer, your phone, they have to send some sort of malware. And most of that's done either through patches that have not been updated or email phishing. So if you are able to patch your system and screen out those bad emails, you're going to protect yourselves from the variety of the attacks. Of the attacks. And then if you do get hit with some exotic attack, if you're doing the continuous monitoring, monitoring your logs, segmenting your networks, you're really going to minimize what's there and also catch it if it's there as well. And also having those partnerships with the FBI and CISA and your sector-specific partners so you're getting threat information before you have that attack, I think is critical. So you can share information and they can share information with you.

John, we've got just a couple of minutes left here, and I wonder if we can end maybe on a prediction, which is, do you think that DarkSide and groups like it are going to come back? When do you think that's going to be? And what format are the next attacks going to take, do you think, if you had to, if you had to reach out 6 months and make a prediction?

Sure. So, yes, groups like, certainly groups like that will come back. They're already out there. Probably DarkSide itself, those actors that comprise that group, will be back if they're not already out there in other forms operating as we're talking about. I think, you know, what the Colonial Pipeline showed was that things like infrastructure attacks that we often associated with nation-state actors are actually being conducted by criminal actors, and they're the ones who really are providing us with the wake-up call in that area because they don't have the same governance that a nation-state actor will have in those kinds of attacks. And then finally, that we have to figure out how to deal with this problem of criminal cyber incidents where hackers are allowed to, you know, act with impunity, you know, as well as they all do work for a foreign government.

And Michael, last thought from you on foreign governments. I mean, this is such a scary thing that's happening right now in terms of ransomware and these attacks, but we're also seeing this idea out there that these ransomware attacks associated with the criminal underworld, particularly in Russia and around Russia, are not just criminal in nature. They might be a preview or testing of nation-state capabilities. And I wonder if you can leave us with a thought On whether you think the ransomware attacks portend anything particularly ominous or scary when it comes to, you know, nation-states testing their capabilities through this criminal low-level activity.

Well, I mean, I think it's important for your audience to know from those involved in critical infrastructure that nation-state actors are most certainly interested in inserting malware into those systems so that in a time of conflict they can cause disruption to create issues for our decision makers. So I can't necessarily say that the ransomware is a part of that, but regardless of that, this is a real issue that nation-state actors are trying to do that to disrupt our networks. And then they're also conducting cyber operations to steal your information. You know, we're losing about anywhere between $200 to $600 billion in intellectual property just from the Chinese. And so we shouldn't just be focused on ransomware.

Yeah, well, that's a great place to leave it. There's so many other threats out there and so much scary stuff to talk about. But thank you both to Michael Orlando and John Demers. Up next, we're going to get the private sector perspective with Honeywell's Chief Technology Officer, Suresh Venkatarayalu, and SAP's Chief Trust Officer, Elena Kovacsco. So stay with us. Back in a minute.

With a bang, energy and change came to every part of our universe.

Seismic.

Change is all around us, shaped by technology and human ingenuity. We can make it work for you and your business.

Hello, my name is James Lesser, and I lead our global public safety practice at Accenture. I'm excited to join you today for this CNBC Evolve livestream on cybersecurity. The pandemic created an optimal environment for the growth of cyber threats. Lockdowns made more traditional physical crimes harder and more risky. Digital footprints exploded as people shifted to working from home. Governments have and continue to inject huge stimulus packages into economies, increasing the potential for fraud. And all of this on top of the ongoing threat from emerging technologies. The result is an unprecedented opportunity for criminals and nation-states willing to take advantage. So what does this mean for public safety agencies and all involved in addressing the cybersecurity challenge? I see 4 key areas. First, become nimbler. Threats can change rapidly. Make sure your operating model allows flexibility and your organization to move at speed. Second, equip your workforce with the skills, capabilities, and resources to address changing cyber threats. Third, embrace new technology using the powerful benefits of cloud platforms, AI, digital twins, and robotics. And finally, expand and rethink partnerships. Public, private, and third sectors must come together to find new innovative ways to stay ahead of the threat. The cybersecurity challenge is significant, evolving and borderless. But by combining human ingenuity and technology, driven by bold leadership and collaboration, it can be overcome.

And welcome back, everybody. From anticipating client needs to shaping the agenda for a robust internal security plan, our next guests take a proactive approach to cyber concerns. Here now to share their thoughts are Suresh Venkatarayalu. He's the Chief technology officer at Honeywell, and Elena Kovachko. She is the chief trust officer at SAP. And guys, you both heard the government officials talking to us a little bit about that private-public information sharing relationship that needs to happen in this new age of cyberattacks. And I wonder, as you're listening to that as private sector people, whether you think that the advice the government is giving is practical and actionable. And Suresh, Let me start with you. What did you hear from, from those officials and government officials that you talked to in terms of how you can manage that relationship, particularly between Honeywell and the government?

I think it's going to be very, very critical, Eamon, with the security threats that's real, which is evolving every single day. I think we have to come together to really evolve and understand the regulatory requirement and standards and both private and government should come together in really embracing the standards and regulations. And that will help us to design our networks, design our products before we could actually deliver and deploy back within our customer systems. So I think it's a great, great move and everybody are thinking about it. It's proactive. And I think I really welcome that.

Elena, same question for you. And Suresh is just talking about government regulations. You know, when we talk to CEOs and chief executives and high-ranking officials at companies, you almost never hear them ask for more regulation. Is this an area, though, where you think companies are sort of begging the government to regulate more and impose some more standards that apply to everybody, not just the government itself?

Thanks, Eamon. I think partnerships will definitely be crucial. It remains to be seen what form, specific form, the partnerships will take. But what I do want to highlight is that the pandemic year showed to us that organizations are still not prepared for the increasingly sophisticated cyberattacks. We do see, of course, a growing awareness among organizations of various sizes of the need to protect their infrastructure, partner with each other, do those cross-sector partnerships. And we also see the impacts of disasters that are expensive and disruptive. Over the last year, of course, working remotely, trying transformed the attack surface for many companies. And what we learned and what was also highlighted in the first section, we don't really have the luxury to wait until there is a major attack to create a more secure environment, implement our controls, build those partnerships, invest in new technology. And it's really important that we don't neglect the cyber hygiene. Take the steps, be proactive, and invest in security.

Suresh, Michael Orlando was just talking about this idea of counterintelligence and companies going sort of toe-to-toe with nation states. How does Honeywell do that? I mean, do you have a counterintelligence operation? How do you, how do you see yourselves as dealing with these hostile nation states and fighting back on some equal footing?

There are 2 ways that we handle this, Eamon. One is there is a network cyber controls and and capability. The other one is we have segregated our product security, we have a cyber product security chief. So when you really segregate these 2, one is you're trying to protect your network where you can have intruders getting into your infrastructure, getting access to your system, getting access to your data. Second is you're designing a product and these product fits along with your customers and clients in this building, enabling this bigger infrastructure. You've got to ensure that proactively you have inbuilt security features at a software layer level. You're handling the threat from intruding into your system. I think from both aspects, we have been really having both the teams looking at intelligence, processing it, And we have evolved our frameworks both at network intelligence level and at a product security intelligence level. And we have been really watching because end of the day, you've got to watch for the threat and you should be ready with the patches either at a product level or a network level to protect yourself, protect yourself and protect your customers and clients. And that's what we've been doing. It's an evolutionary process even. And we have evolved in the last, last probably many years. And this is not going to happen alone. It also would be through partnership, as Elena was talking about, with our suppliers, with our integrated partners from software, operating system, and infrastructure. We got to do it, but we have been evolving in a very clear form to help everyone here.

Elena, the thing we heard from DNI, the Department of— the Director of National Intelligence, and also from DOJ just now is this idea of an insider threat. You think of the cyber threat as happening externally as people are trying to get into your systems, but they're also warning about, you know, people within your own organization who might be susceptible to bribery, flattery, any kind of motivation. You know, that seems like a hairy area for companies, honestly, to be policing and trying to figure out which one of their own employees might be out there trying to betray them. How do you think about that problem, and how do you think corporate America should be policing it, if at all?

I'm Eamon. So our overall security strategy is based on embracing security-minded culture, collaborating with product development operations to create those secure solutions for the customers. First, we identify security requirements for the customer's needs and ensure that they're met, and we provide the relevant guidance and tools and services to our product units and of course test and monitor our product environments. You mentioned the insider threat prevention. And of course, you know, I think broadly—

Yeah.

Being prepared for a cyberattack is almost like training for a triathlon. You know, with the right structure and tasks and equipment, it's more likely that you'll be successful in reaching— reach the finish line. And companies that invest in cybersecurity, have a structured approach, are already a step ahead and better equipped for mitigating the risks and responding to attacks. Of course, you mentioned some of the elements, but what's also important is to make sure that the overall cyber hygiene is not neglected. And there's a practice that companies follow to keep their systems that peak efficiency, reduce vulnerability to cyber threats. And some of the steps that they could, of course, consider in addition to, you know, insider threat prevention would be installing reputable software, setting strong passwords, making sure that software and systems are up to date, using authentication, encryption, backing up regularly to protect the data and actually prevent or avoid some of the situations that we discussed here today.

And Suresh, we saw this report from Facebook today on Russian disinformation and the disinformation problem more broadly. That is a problem for companies as well as for society generally. From a Honeywell perspective, how do you deal with a threat of disinformation where you sometimes maybe you don't know what you don't know?

You know, I think you've got to segregate into 2 things. One is if you have a product that is data-centric, and then there are systems that you actually built where the systems have a control system software that actually really handle an output or an impact. I would actually say that from an information and data security and control standpoint, Eamon, it is going to be— it's going to be an evolutionary process to ensure that those controls and protection is pretty critical. And I think what happened today, I think could happen, but I think it is going to be an important to segregate between information-centric products and technology, and then the products that, that have a control system that drives an output. These two needs to be really handled very differently, and, and actions and remediations are going to be very, very different right there.

Yeah, Elena, same question for you on, on disinformation. The idea that, you know, there could be information being pumped into your systems as a company or into social media and the media around you in your society. How do companies deal with that disinformation threat, or is that not a problem for companies to consider?

I think that particular scope of problem, I mean, also depends on the industry in which the companies are operating. That would be dependent on the specific scope of operations that companies are working on. But I would like to build on what Suresh was just talking about in terms of the steps that the companies can take. And they're absolutely the steps that Suresh gave examples of, but there are other steps that the companies can take to reduce the overall damage that a cyberattack can cause, reduce the likelihood that the data will be compromised. And of course, some of the examples would be implementing a framework and controls and standards that help reduce that risk, assessing the overall IT infrastructure, the overall infrastructure to find and address potential vulnerabilities, educating the staff on what they can do to maintain security. Of course, everyone has a role to play. We're in this together. And having a structured response and recovery plan towards an attack. And there are, of course, many additional steps that companies can take. But those steps that we just outlined provide a basic and fundamental starting point.

One thing that's on my mind these days is, as I'm sitting here talking to you, I'm literally in my basement in my home office setup with the laptop and the whole jury-rigged thing that so many of us have been dealing with over the past year. But now that we're shifting to a world in which The vaccine is out there. A lot of people are going to be going back into offices. Companies are trying to bring as many people as they can, in many cases, back to the office. Suresh, I wonder if there are particular cybersecurity problems around this idea of going back to the office. We talked last year a lot about what happens in— what the cyber risk is in putting all those people out into their living rooms and dens across America. But are there unique concerns that companies should have and be spotlighting right now as they're thinking about bringing all that gear and all those human beings back into one centralized location again?

No, I think so, Yaman. We're going to be living in a world where all 3 are possible. You're going to have systems and employees back into our in-office in a very secure network. You're going to still have some of the remote employees back at home or elsewhere. We've been really thinking about really protecting our network and access to our infrastructure and data in a very tiered access level. And I think we really have much more stringent policies right now for accessing application data and system. We have been really relooking at our policies today. Again, what should every individual should have access within an intranet or externally when they access the information? I think this is going to be an interesting phase I think we went from everybody within 4 walls and we actually went to externally accessing remotely. But I think we've got to have a hybrid phase. And I think we have, we have been back to the drawing board, redesigning, redeploying the policy. And I think every company should be rethinking and really driving that.

Elena, how are you thinking about that problem? Bringing everybody back, securing it all, making sure you don't bring cybersecurity problems in-house as you bring those people back too.

Thanks, Simon. Absolutely. As Suresh mentioned, I think most companies will be adopting a phased approach. And of course, we do remember that cyber resiliency and cybersecurity depends both on people and processes in addition to technology. And people and bringing everybody back into the office, people are a company's biggest assets. And it's important to have strong, motivated, engaged teams. So of course, educating them on what their responsibilities are and ways they can prevent an attack make for a much more cyber resilient organization.

environment.

And we structure— and companies should structure our policies on providing the right— around providing the right guidance, providing the right tools, and equipping the teams that are involved in preventing and mitigating the attacks with almost a muscle memory in order for them to respond effectively and really prevent, prevent threats from happening in the first place.

Yeah, and I think that's one of the big questions, Suresh, as we talk about this question of the time that we're in right now. We've got this weird pandemic moment that, you know, one would hope is coming to an end, but we've also got this weird uptick in aggressive cybersecurity activity by, you know, criminal organizations, nation-states, what have you. Given those 2 things, and particularly this uptick in hacks that we've seen, what are you doing now that you weren't doing before? And I think Think of this in terms of actionable intelligence for our audience who's watching today. What should they be doing now, you know, in May of '21 that they weren't doing maybe in May of '20?

Yeah, I mean, I'll try to answer this. I have a job, CTO and Chief Technology Officer. We have been having some of this foundation, but I'll tell you how I'm thinking about it. Number one, my product development processes, I have to have security inbuilt. That means I'm designing with security embedded. It's not like an afterthought. That's number one. Number 2, I'm thinking about really creating this awareness and train my entire ecosystem from my customers, channel partners, installers, and cross-functional team in my organization, and also have developers trained at least once a year because things are changing dramatically. The threats are evolving every single month and day altogether. We are deploying a lot more automation. Automation to really ensure that we scale the security in our development aspects. We are embedding the security experts in our product development processes to ensure that we have them deeply ingrained. We have product security chief. We are ensuring that that cuts across the entire businesses and product line. And then we are starting to look at more of this industry standards like NIST, like IEC, and we want to really embrace, evolve, and really deploy those security frameworks and then probably form a consortium, partner with probably government agencies and some of the commercial standards that are already there, help make sure that regulators and standard bodies come together to drive. These are the things that are in my priority list along with my Chief Security Officer and Chief Product Security Officer. We've been really talking about it, thinking about it every single day, and this is going to see a much more uptick in my own time moving forward.

Yeah, and I think we're all going to be working on this every single day going forward. I want to pause here, and this is probably a good place to end because you guys have been more than generous with your time. I want to thank Suresh and Elena, and thanks to all of you for joining us today. Please save the date. CNBC's Evolve Global Summit is coming up on June 16th, so note that one down. CNBC spans the globe from Asia to Europe and the Americas, speaking to some of the biggest corporate leaders and innovators thriving in the new economy and discussing the forces driving business agendas around the world. For more information on that one and to register, please visit CNBCevents.com. Someday soon, hopefully soon, we'll be able to do all these in person again. And until then, I'm Eamon Javers. Thanks so much to everybody for joining us today.