Episode 41 – The Security Professional We Haven't Trained Yet

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. This is your insider access to the minds driving change in our industry.

So what happens when a cyber incident reaches beyond a screen and affects the systems that we depend on every day? And are we preparing the right people to protect them? Welcome to Executive Checkpoint. I'm Tino Urbina. Today I'm joined by George Simmons, whose work has focused on cybersecurity and critical infrastructure, including the nuclear sector. George has worked with industry and governments on how to turn security plans into protection that holds up to the real world. We're going to talk about the space between cyber and physical security, how to test defense against realistic threats, and why some of the people we need most might come from outside traditional cybersecurity backgrounds. George, welcome to the show. This is our second conversation. The first one we should have recorded was great. How are you?

Good, good. How are you? Thanks for having me on.

It's a pleasure to be here.

Absolutely.

And George, you're visiting or you're joining us from where?

From beautiful Santander, Colombia, Bucaramanga.

Bucaramanga. Oh my God, we were just talking before we started recording that your view is what?

Oh, I have the mountains right in front of me. Yeah, I visited here, it was many, I guess 2 years ago for a vacation. And I think we were just talking about this. It was so beautiful. The people are amazing. The food is insane. And I was like, I'm never leaving. Like, it's just, it's just too beautiful. And it's been, it's been a wonderful experience. Colombian government has been very good to me, allowing me to stay here and spend time in this area.

Very nice. So George, you've been doing, you've been in the industry for quite some time. You're a well-known individual in the industry. You're leading an organization, we'll talk about all of these things. But Everybody starts somewhere. What's, what's your story in the industry? How do you get started?

Yeah, it's, uh, we have, we have to go back very, very far for that story, right? We got to dig a little deep. I've been doing this a long time. But, you know, starting, you know, back in the day, really what I wanted to do is I wanted to be an FBI agent. That was, that was at the top of my list. And when I was in school, I was actually studying English literature because I wanted to take my LSATs. I wanted to go and become a lawyer and I wanted to join the FBI. But timing being what it was, I ended up transitioning out of the military and working for an IT company. And, you know, the rest is, the rest is history, starting out with things like experimental wireless technologies around the Washington, Washington, D.C. Beltway. And then working my way up into networking. And then eventually, kind of an interesting story, we had an opportunity with the company to work with the Nuclear Regulatory Commission. And they basically came in and said, hey, is there anyone in the room of engineers, anyone here know how to write? And so, yeah, I guess that would be me. And that actually created the trajectory into what would become the second half and pretty much the twilight of my career working with the NRC because we spent a lot of time focusing on regulation, administrative law, standards, guides, and that sort of thing. And it's also where we got exposure, myself and my teams, into the industrial environments where cyber was important. And it was really kind of coming to fruition back in around the late, early 2000s, I guess, around 2008, 2009. So being a part of that wave was kind of a very neat thing. We got to see some of these environments that a lot of people don't get to go into, understand an industry that can sometimes be a little misunderstood, but also see how to protect digital technologies in more creative and you know, I guess, holistic ways, as opposed to what traditional cyber might be for, you know, enterprise and larger operating environments. So it was, it's been a fun ride.

So what, what, what experiences changed the way you think of security? Now you're talking about a different perspective. Was there something early on that, you know, you've seen people in the industry having a perception or a point of view that was completely different than yours, or is that a specific time?

Now, it was, you know, back, you know, back in that timeframe, this is when the government would implement these certification and accreditation processes, which in and of themselves were really good, because what you have is this kind of baseline of standards, if you will, and then you evaluate the protect— the levels of protections on these systems according to those standards. And, you know, that's a lot of paperwork at the end of the day. It was, you know, quite a few challenges, not just the amount of analysis and costs and resources that would go into evaluating or building in cybersecurity into these, what you might call off-the-shelf systems, but it also created or emphasized the skill gaps. that were, you know, apparent. You know, the cyber industry as a whole was kind of changing, and we had these kind of growing demands and these growing needs and what have you. And what happens whenever you're in that world is you become hyperfocused on what may or may not be the right outcome. You know, is the outcome documenting and doing the analysis and, you know, identifying risks and valuing those risks and so on and so forth?

Mm-hmm.

And you become a— you become kind of ingrained in the process. What the nuclear industry taught me, it was kind of a mind shift away from that. When the NIST standards, when the cyber standards first came out, they weren't really intended to be, I think in the beginning anyway, a checklist-based, compliance-based approach.

Right.

They were kind of intended to be more performance-driven. In other words, they're guiding you to get to the end state that you want, which is more protection, you know, a safer environment. But over time, it really did become more of a check-the-box exercise. Does it have this? Is it doing that?

Yeah.

And even with that, there was a lot of ambiguity. In nuclear energy, their approach to security is really 2 things. One, it's performance-based, truly performance-based.

Right.

It's what we used to call in the Marine Corps, like commander's intent. I'm going to tell you what I want you to do. I'm going to tell you what I want the outcome to be. But how you get there is up to you. Right?

Right.

And so it's one of the first times where true creativity came into the picture. And the second thing was that, because of the nature of the threats, or the way that it's articulated in the commercial nuclear energy sector, you have a blend of physical and cybersecurity. But to them, it's just security. It's one thing. And that also changed my mindset.

Yeah.

I mean, of course, in the NIST standards, they do have provisions for physical security and the protection of the environment, but not at a scale that I experienced when I started working with these, with the plants in that particular sector. It was fascinating. So it just kind of shifted everything in my mind about what is it that we're trying to accomplish, what is a good end state, and how do we truly eliminate risk? And are there ways to do it that, you know, can save time, money, resources, but still get us where we want to be?

And I think this is the time that I bring that great story you you shared with me in our first conversation. To me, that, you know what, it exemplifies what we're missing sometimes on the perceived nature of what is it that we need to accomplish here, right? Is that, you know, we're talking about technology and new technology comes in, how do we implement it? Well, is it necessary, right? Working in a high-risk environment like the nuclear, you're introducing more risk. So would you care to share that story?

Oh, the clock story?

Yeah, yeah.

Yeah, of course. One of the things that was built into the guides that we wrote in cooperation with between, you know, the government and industry in terms of how you approach or how you address requirements or controls, security controls for these various assets, was the concept of alternative protections. In other words, if you have another way of doing it, as long as it's of equal or better value, go for it. Of course, there's dozens and dozens and dozens of requirements individually tracked and ranked, but one of them had to do with timestamps. When you're dealing with timestamping, what you have is, let's say in the case of a physical security or physical protection system, you have a digital feed and that digital feed would have a timestamp on it. And if you're going to rely on that as an alternative for things like monitoring or even auditing, right, let's say access into rooms or whatever it might be, you need that digital timestamp. And on this team, we're conducting an inspection, and it came up that in order to get a timestamp into the video system, the the video capture system, we'd have to upgrade that system to a digital platform. And otherwise, there was no way to, to add the timestamp capability or function. The idea at the time was, and it was kind of simple but yet a little brilliant, was, well, you could just go to Walmart, you could spend, you know, $5, $3, whatever it is, on a digital clock. You could put that digital clock into the feed And now you have, quote unquote, a timestamp. I'm not saying that's the best way to solve the problem. The point is, is that we, whenever we're looking at implementing protections, especially cybersecurity inside of what I call the hard outer shell and the soft gooey center of a lot of industrial environments, I mean, forget what industry, it doesn't really matter, right? A lot of these, It's better now than it used to be, but a lot of these applications and solutions don't necessarily have embedded security capabilities into them. And so whenever we're looking at ways to implement or address those requirements, these alternative but equal approaches, and then the creativity for how to get to a way of arguing, and look, I've got good alternative methods, let's just go with that.

But you know what, to me, that story illustrates is a really good point of the mindset that we're kind of shying away from is, do you have to introduce more risk for the sake of introducing new technology? No. So thinking creatively kind of opens up this other side of thinking on, you know, staying with what is required yet accomplishing the goal. And in my perspective, it also gives a company the ability to maybe plan their budgets a little better because now they understand what they need. It's just how do we do it in a— you know, phase-out way, you know, finding the, you know, the business side will appreciate that if you're not talking about government. But so I thought that was brilliant. When do you— when you walk in a facility, now that you've been doing this for, for some time, what's the first thing you understand that in your mind truly matters? What's the most important?

Oh, well, that's— yeah, I don't know if it's any one thing. I do find that And I don't know if it's just a kind of a career bias in a sense, but, you know, those who do this work for quite a while, whether you're in a plant or you're at the airport or you're at a restaurant or at a mall, you're kind of designed to look around the environment and understand it a little better. Like the positioning of cameras or the nature of doors, the type of doors, the ingress, egress, ports and stuff like that. Like, how do you, how do you kind of, you know, navigate but also look at the layers of protection that are kind of built into the environment as a whole? One of the first things you do when you go to a site is you're kind of looking for that. You know, I'm driving in or I'm parking or I'm going into a physical access zone or like a, you know, a gate or what have you. What's there? You know, and you can tell from the levels of professionalism, from the levels of coverage, where things are, how things are situated. Generally, you get kind of an early sense for the level of maturity of those programs. And those first interfaces are usually with physical security, right? They're scanning your bags or they're doing a walk around the car or what have you. When you get into the cyber world, right, it's a little different. You don't always get a visual of what's really happening, right? Everything is behind, behind the wire or potentially in the cloud. What I typically look at in terms of whether or not they're in a good place first is the people. At the end of the day, it's a human business, right?

Correct.

And the way that most people approach it, You can tell relatively quickly whether or not— where is it going to be important to focus my attention in order to find the gaps or the things that we can improve upon, mostly by the interactions and the discussions and the interviews or, you know, in the early pieces. But the second most important one, especially when you're in a plant environment, is going out and looking. You know, it's not something that you can articulate through a discussion. You need to go see where the equipment is, what it's doing, how it's operating, the environments that it's in to really understand.

We used to—

we call those walk-downs. Let's go walk down and take a look at it. Let's see where it is.

Mm-hmm.

Do we really— is it where we think it is? Or is it, you know, does it have environmental or physical protections the way we think it does? And then we can validate things like drawings, you know, are the engineering drawings representative of what's actually in place? And by the time you get through understanding the human element and getting into the environment a little hands-on, at that point, you pretty much know what— where things are and what needs to be done.

You know, it's interesting you bring that point that we've been talking about, that there's this separation between physical security, cyber IT, and still exist. I mean, we've been going through this process for many years. But where does the separation between those 2 teams create the most risk in your perception?

The separation? I don't— you know, a good friend of mine, Mike, Mike Shen, once said, he said, you know, going back to what we said earlier, which is there really is no separation between the 2. The concept or the domain itself is security.

Right.

So physical and cyber are, you know, neighbors inside of this domain or this neighborhood of topic or the domain itself. As a result, it's very hard to pull them apart. A good example would be this. In order to achieve good physical security, it requires a very— a pretty sophisticated technical infrastructure to do that.

Absolutely.

You know, back in, you know, 50 years ago, you'd have a guard up on a, you know, with a gun doing visually, you know, monitoring the perimeter. You know, these days it's very different. There's a lot of technology that's doing that. And, you know, cyber plays a part in that as well. The protections for the protections, right? You want to make sure that your physical security systems are adequately protected because of the important function that they perform. At the same time, when we start looking at the requirements around cybersecurity, all these controls and what have you, really what we're talking about are what we broke down into root cause. In other words, if NIST comes out and says, hey, here's a cyber requirement you got to meet, there's a reason for that, right? There's a reason NIST published that control, and there's a reason why it's worded the way it's worded. And usually it's because someone did something wrong. Or, you know, some bad day happened. Oh, we gotta, we gotta write that down, right? We got to make sure that we understand this problem and don't want to spend a lot of money as a result, right? Exactly. We call that root cause. Everything we do for security, whether physical or cyber, has a root cause for why we do it. It's either a lesson learned, or we were thinking ahead. But at the end of the day, what is that root cause? When we start looking at the attack, the, like the, where we start breaking down the threats that we face, right? The attack vectors, the attack pathways, the methods, the tech, you know, the techniques and what have you that are utilized in order to achieve a compromise of a system. A lot of times there's a physical plane to that.

Mm-hmm.

Especially when you get into an industrial environment, right? These are air-gapped many times, and you have to get physical access in the plant to, to do those things. So when we started prioritizing, we found that there is a heavy interrelationship between the physical and cyber. And I'll give you a great example. Let's say if I have a PCN or an industrial environment, And I cut it off from the rest of the world, let's say 100% air gap or a data diode where everything is just moving one direction, physics won't permit anything to come back in, right? Some would say, well, it's 100% air gapped or it's a one-directional data flow, it's just going out. But that's not true. Every air-gapped environment still has a bidirectional data flow happening. It just may not be happening over the wire, right?

Right.

Because you're bringing in things like laptops and you're bringing in things like USB sticks or what have you. Physical security is a huge part of maintaining the, the protection of these systems by ensuring that what comes into the plant doesn't include things like rogue laptops or unauthorized or unauthorized USB or what have you.

Right.

So what a massive role that is. I can put any protection I want into the system, and then in some cases I can do nothing to those systems. There's no inherent security measure I can take because those technologies don't support it. But I could let anybody walk in and just plug in, you know, a mobile device. But that's one of those places, again, where the balance is really good physical security and cybersecurity working together in order to achieve that same outcome.

And, you know, I'm, I'm an advocate, of course. And my concern is sometimes how does that translate to the client, to the end user, to the, you know, leader that still wanted to say and what they know, what they understand, right? The physical guy on the physical side, the cybersecurity guy, the cybersecurity guy. You mentioned at one point in time realistic threat emulation. What does that mean? You know, what the meaningful test reveals versus an audit or a compliance checklist of, you know, things missing?

Well, at one point in time, there was discussions about, and even in kind of just the peer environments, you know, when you're hanging out and having a drink and and discussing, which is if you really wanna achieve a performance-based measurement, then essentially the best performance indicator is the level of resilience a system displays whenever it's under the pressure of an attack or a threat. And the industry has mechanisms for that. We have red team, we have— purple teams, blue teams, we have different ways of, of coming in and doing a kind of a performance measurement of the level— are the security doing what it's supposed to be doing? In the future, what we're seeing is that, you know, the tides are changing a little bit.

Interesting. Right?

What you have is like this, this, this world of technology where data is moving constantly, signals are are constantly in motion. And then you have the human strata, if you will, that are managing it, interfacing with it, consuming it, or whatever the case may be. But now with AI, that's— no, it's shifting in a different direction. AI is becoming that abstraction layer between the technology, the data, and everything else, and the human. And with autonomy, AI is now becoming— having the ability to work autonomously, you know. And so when we, when we look at things like performance measurements for cyber, it opens up a lot of opportunity, but also a lot of risk.

Sure.

Because with AI technology, we can measure the attack surface from the outside perimeter all the way into the attack surface of a specific platform or an asset. with a varying degree of aggression, right? But it's going to be able to do it at a level and at a— both creativity— creatively, but also in terms of technical beyond the capabilities of a human.

Right.

So what does that introduce? Well, that means I now have to have protections that are just as smart as the adversary is. And so AI is used on both sides of the fence, and we're in this new territory for, wait, what does that mean?

Yeah.

It's interesting. I think right now you have a couple of things that are happening. One is a lot of solutions, vendor platforms are doing what I call a vertical integration of AI. You know, you do an upgrade or an update on your system, or you purchase a package of what have you, there's embedded AI already, especially if it's a cloud-based platform. And that's improving the functionality and the working with the data and the signals inside of that tool to make it better for the human. And then we have, um, all the way over to what you might call a hyperscaler, like an Anthropic or—

Sure.

OpenAI or what have you. And there's all these different ways in which AI is kind of introducing itself into the environment, whether covertly or overtly. It's just, it's kind of happening. And at the same time, the outside world, the threats that we're trying to defend against, they also have access to similar or the same tools.

Hmm.

And so there's this equilibrium that's kind of always, you know, in some level of imbalance, like an equilibrium that wants to be but can't quite get there, right? But it'll be interesting to see where that goes. Ultimately, in the long run, I think it will be more of a performance-driven framework.

Right.

It's just to what extent is the human going to be involved in that?

Yeah, you know, we were talking about governance, you know, as a big part of people, process, technology governance when it comes to technology, especially with AI. And that's still such a new thing that not too long ago I was involved in a conversation where we were talking about 2 CSOs asking what portion of the implementation of AI systems in your organization can include you on the table to create the governance that is going to rule your positioning for the technology and then your environment, right? Because the assumption is AI, digital, what is the impact on the physical side? And that is totally shifting in the last couple of months. It's moving so fast, right?

Mm-hmm.

What's your take on that side and that conversation of governance and implementation on environments? Not just as critical infrastructure but elsewhere?

That's a great question. When it comes to governance frameworks and models for technology, I think there's a lot to be applauded for the efforts of the past, you know, finding ways to put constraints or at least some infrastructure around how do we deal with this you know, this, this growing issue. And you look at organizations like the IEC and NIST and ISA and what have you, they've, they've all made great strides in that regard. When we start getting into artificial intelligence, it's kind of a different— it's a different world altogether, right? I think there was a recent mention of even creating a department within the US government to focus nothing but on you know, AI and the potential regulation of it. But regardless, the challenge that you have, I think, or the friction point that you have there is unlike with the dot-com boost and kind of this early stages of the, you know, the technological advances that are kind of moving across that curve, but now shooting into the, you know, more of a vertical line, is how would you keep pace with it?

Mm-hmm.

AI is moving at a rate in which I think it is certainly, if not already, beyond the bounds of human ability to keep pace with it. To at least measure it in a way that you, you could put bounds on it.

Right.

Right. So whoever is going to be responsible for building the regulation is, I think, going to have a, a lot of work on their hands. You know, the moment you think you understand how it's working, just wait 2 weeks.

Yeah.

And it might be completely different. But at the same time, I, you know, we, we do have this kind of tectonic shift that's happening, and it's not just in technology because it's going to govern it or affect all of our lives in some way. So we need to have a, um, a way of at least understanding it, if not, um, ensuring that it, that it's moving in a direction that's for the benefit of all human beings, right? And with that, governments. countries, businesses, but the individual as well.

And, you know, like anything, I think this can be a great example of collaboration between technology and how we implement it and the individual. And you mentioned something that stuck in my mind about people getting into cybersecurity that might have nothing to do with cybersecurity. Share that with us. What's, what's, what does that entail?

Yeah, we ran into this kind of early, early on, when cyber was, was still pretty new. Because what you, what you had is there was no formal education process to go through in order to achieve that skill or attain that credential. And there was a lot of organizations that that came about as a result of that. So if I went to college, I couldn't go get a degree in cybersecurity. It didn't exist back then. But there were certification organizations that offered certifications. And you could get those certifications and it proved your qualification to go do this job.

Yeah.

Your credential, if you will. But what you found is that people in cybersecurity come from every range of background you could possibly imagine. I've worked with CCIEs that were truck drivers in the past and as young as 18 years old, you know, because they were studying in high school. And, you know, from military to, you know, hospitality to what have you, it was kind of a melting pot, right? In, in the many years that I've been doing this, what I find is that While you can train skills, I can train anybody on skills, how to use a tool, how to understand the concepts behind what's happening, but there are some things I simply can't teach, right?

Yeah.

And it goes back to what we were talking about earlier in that it's still a human business, right? There's still a customer trying to solve a problem and there's still experts that, you know, are available to come in and help solve that problem, but it's still a human business. So I was giving— I think I told you about this. I was giving a talk at a conference at a university. And the question— I was explaining, you know, what I do and just the concept of cyber, especially in terms of industrial environments. And one of the students raised their hand at the end and had a question about, well, as an employer, what do you look for? Like, what is it that, what is it that you, I guess it separates the stack of resumes in front of you or what have you? And this was the last time I was invited to speak at that university because to me, Interesting. because the human element is so important. I said, well, I think, I think those that have the most promise in working in a new domain like cybersecurity are going to be either those that come from the hospitality industry, right? In other words, you're, you're accustomed to working with difficult people and finding a resolution to that, right? You're incentivized to do that. And we often— it's a people business. So sometimes there's conflict, right? And the other one was musicians. Some of the best—

Interesting.

Cyber operators that I've worked with have a musical background.

And what I—

the way I look at it is I consider it creative coding. You know, if you can read and write music and play an instrument, that kind of changes the way you see the world or filter the world around you. And when you're taking— when you're performing a job or you're working in a role like this, And going back to the discussion on alternative protections and finding creative ways to solve the problem, those who are naturally creative have an advantage in this world over others. Again, I can teach a skill.

Yeah.

If I can take someone who understands people and is creative, has a creative mindset, then there's 1,000 ways to get you to becoming the best in our, in our industry to teach you the skills to get there. But those things I can't teach.

So yeah, I think for anybody listening that is looking for a career change in an environment or a profession that is growing, here's your, here's your sign, right? Yeah.

You know, it's, it's not necessarily cheaper, right? Because it is expensive. It's an expensive endeavor to get certified to do work in this field, especially from an engineering perspective. But I will say that there's also an economy of competency that comes with that. In other words, You know, when you have organizations like SANS or what have you and you move through their curriculum, you come out at the other end of that a lot smarter and capable than when you first entered, but there's not a lot of fluff. You know, it is a linear model. And so there's the value of the education in the technology market, I think, is unparalleled. When you start comparing it elsewhere. But I think university systems are quickly catching up. Nonetheless, I'm not— I'm never going to argue that education is a bad thing, right? What I would often tell my kids and others is pick your 4-year degree that you enjoy and then go do the thing that, you know, you guys—

That's great advice. Tell my kids the exact same thing. It's just Things are moving so quick that why not get the experience, get the certification, and then move on to whatever else you need. Well, George, let me ask you, um, I know that, um, the future is unpredictable, but it seems to me that you have a pretty good hold on how things are going and where they're going. What do you foresee in the next 3 years as an industry? You know, you're the CEO of a growing brand. What's your view of the future, the next 2 years for cyber, cyber and physical security?

Yeah, that's a great question. You know, what's it going to look like in 3 years or 5 years from now? And my mind is kind of built to measure things in terms of 5 and 10, like by decade, right? Because a lot smaller, slower than it did.

It did.

Now, I think the main things that are going to be, or the things that will be at the forefront over the next, let's say, 3 to 5 years, is still going to— is still a big focus on AI. And the reason for that is because every company, I think, even those that are owner-operators of large industrial environments. I think they're under pressure to find ways to leverage the capabilities and the benefits of the technology, notwithstanding the hesitation that a bad day for them is a really bad day for everyone, right?

Right.

Not just shareholders, but it can have implications all the way to the loss of life. So I think that that's really the biggest friction is how safely can we integrate artificial intelligence into these processes within the plant that govern key functions like safety functions, if you will. That'll be key. And the second thing is it's gonna shift, I think, how we measure skill sets in individuals.

Right.

And so now you, you can go the traditional training route, but where this generation of engineers are augmented with AI, right? And so that makes a very powerful combination when you have a skill set and then a superhuman skill set, kind of like the Borg, right? You know, kind of unified into, into one instrument. And how that's gonna play out is kind of a big unknown. But my hope is that it's going to make— it's gonna streamline, save costs, and ultimately make us safer, you know, and open up opportunities for economy of scale for building more protection into these environments and getting the value out of these tools that before just couldn't do with only a human in the loop.

Right. Well, this was faster than I imagined. I think we can spend another hour talking about pretty much everything else. But George, thank you for joining me today. I admire the perspective, such a unique perspective. What will be the one thing that you will— first of all, before we go there, If someone wants to reach out to you, continue the conversation, but maybe seek out some of your professional advice, where can they find you? What's the easiest way to engage with you guys?

The fastest way, I think, to get in touch with us, you could go to our website, right? That's the number one, clearpath.com. But, you know, reach out on LinkedIn, and we'll connect that way. Yeah. it's also very, very easy.

Excellent. And words of wisdom, George, when you started your career in cybersecurity, that young guy that, you know, didn't know what was anything in the industry, what would you advise that young man knowing what you know today?

I think first it was When you're entering into a career early on and you come into an organization, it's helpful to look around at what people do, and not just at your level, but at every level of the organization, and see whether or not that's where you want to be. So you're always looking for what is that next step, and then reverse engineer, what do I have to do in order to become that person?

person.

Almost every single time, though, the key part of the formula is put yourself in situations where there's a problem to solve. And the harder the problem, the more the opportunity. And some would say, well, find ways to innovate or to find ways to make things better around you. I think those are important, but they're kind of an orbit around the, tell me what your biggest issue is and what the biggest problem is and let me go solve that for you. And early on in my career, that— I can't tell you how valuable that was, right? And it's paid off in spades over time. So no fear, just go after, go after the things that no one else is willing to go after. Or they go after those problems that no one else seems to know how to solve and find a way to do it.

Wow, that's fantastic. I'm taking notes on that one as well. Well, George, oh, it's a pleasure. I have to say, I need to go visit. I need to confirm that it's beautiful where you are.

You're always welcome. Hey, jump on a plane, man.

We'll, we'll hang out. Absolutely. Thank you, George, for joining us and sharing your perspective. And For those of you watching Executive Checkpoint, stay informed and stay secure, and we'll see you on the next Checkpoint. Next Checkpoint.