Holding software companies liable for (in)security?!? Is this real?

What's going on, friends? Dude, isn't this music rocking today? I could just like continue to listen to it. Restream is rocking it today. Uh, man, it's killer. I just don't want to turn it down. I want to turn it up. Isn't that awesome? It's good to see you guys. Mark Moore checking in. Mark, good to run into you last week. That was super fun to see you, um, at Ride of Boom. I still don't think I've like fully woken up yet. I'm still like really, uh, It's the whirlwind, but man, it was fun. So good to see you on there, Kai. Good to see you as well. I saw your booth over there. You'll have to let me know how Rite of Boom went for you guys. I wanted to come say hi. It was just too crazy busy, but I hope that you guys had an awesome time at Rite of Boom as well. Would love to catch up with you guys. If you don't know what they're doing at Vonohai, really cool stuff going on. Aaron checking in. Aaron, what's going on, my friend? It's good to see you on as well. I hope you're doing awesome. Uh, Ernest checking in. That's right, man, the music's awesome. Hold on, more of this. Heck yeah, it's so good. ZB, what's going on? Perfect music for a warm afternoon in Texas, right? I'm back in Tampa and I'm not gonna lie, the weather is killer good right now. Blue skies, you know, it's a little 80s now, so it's a little— if I got to be a little bougie here, it's a little bit, it's a little bit toasty for me, but, uh, but it's all right. Mark and Um, Kai, good to see all of you guys. Okay, so we got some big, big, big news happening. I am going to cover one piece about LastPass, which just— the hits just keep on coming. Oh my gosh, when is this stuff gonna stop? But we got something big. I'm telling you, Jen Easterly, director of CISA, she has been cooking up some changes. I don't know if she's like positioning her last couple years as CISA director. I'm not even saying she's leaving anytime soon, but like I just wonder if she's like really planting the seeds for some big things that are about to happen. I'm telling you, 2023 is going to be a big year in terms of the cybersecurity landscape as it comes to the federal government's interaction. I'm telling you guys, it's going to be a big deal. Big things are happening. We're going to cover some of the beginnings of this that just came out today and then some rumors that are going to be coming out soon about— well, we'll just— we'll get into it. Okay. So some really big things. It's good to see you guys on chat. Here's what I want you to do. I want you to shout out to me. A bunch of you guys have already done that. Say hi to me. Share this out on, on, on your, on your channels. Just like, hey, I'm watching Wes live. I want to get a bunch of people in, and let's turn a lot of this into a discussion today. Because here's the thing, my friends, I don't have all the answers. Never have, never will. And so I love seeing the comments light up with all of you amazing people as well. So without any further ado, Let me share out my screen. Some really interesting things. So first of all, LastPass, it's like, oh my gosh, when is this gonna stop? This is getting bad. It's like, it's, uh, what's the dumpster fire, you know, the "this is fine" meme. It's like the fires are all around us and this is fine, this is fine, we'll get out of this. So yet another issue, this came out in Security Week. LastPass says DevOps engineer's home computer hacked. Now here's the thing before I even say anything more, How many of you SaaS people out there have a home computer and you're in DevOps and you got a lot of power, you got a lot of control, and you know that if it happened to you, some really bad things could happen? Like, here's the thing, a lot of SaaS companies preach good security but don't do good security. They just have a laptop that they just bought, no controls on it. There's no way to know if something could happen, and you have keys to the entire kingdom there. This is a problem, and this is like the horror story that if SaaS companies could— I'm not speaking about all of them, there's some phenomenal ones out there, but SaaS companies in particular sometimes have the worst security because like, oh, we're all cloud, everyone's mobile, you know, zero trust, so we don't have to worry about it. And this is the kind of stuff right here that's like The stuff of nightmares. Okay, so, so here's what happened. They had a breach before. We know about that. A second attack where an unnamed threat actor— so we still haven't done attribution on who this person was or people were. And then it continues, exfiltration, blah, blah, blah. But look at this. The second incident saw the threat actor quickly made use of the information exfiltrated during the first incident. I got to turn the music down so we can concentrate here. Prior to the reset completed by our teams to enumerate and ultimately exfiltrate data. So some of the things that happened, look at this. The attackers exploited a remote code execution vulnerability in third-party media software package. And you see this planted a keylogger on the employee's personal computer. They were able to capture their master password that was entered. And after the employee authenticated the MFA and gained access to their complete corporate vault. Oh my gosh. Matt Lee, what's going on, brother? Is super good to see you on. Uh, Matt is one of the coolest out there. Thank you for joining, Matt. Um, dude, so like, let's get this straight for a second, all right? So LastPass, a company that's a password vault that stores our passwords— one of the main DevOps guys had a keylogger on his computer, all right, which gave him access— the bad guy access to his vault in his own LastPass. Which then gave the bad guy access to, theoretically, I don't want to say the entire vault for everybody, but you can see that they then got access to the native corporate vault entries and content for shared folders, which contained encrypted secure notes with access of decryption keys for the AWS LastPass production backups, other cloud-based storage resources, and some critical database backups. It's like, oh my gosh. So it's like Inception here, right? They used they used a DevOps LastPass to get access to LastPass. Like, these are the, these are the things that are really scary. These are the kinds of supply chain attacks that, like, I guess if we think about it this way, not to put like tinfoil hats on or anything, but here's a good way to look at it. At some point, one of these password vault companies is going to come under a focused attack like this. Yikes. This is the kind of stuff when a lot of eggs are in a basket, a lot of bad things can happen. Matt's right, like, they are being incredibly transparent. They are disclosing all this. Kudos to them. I'm not hating on them. I'm just like, wow, this is scary stuff, and it's gonna happen. Things like this are going to happen. Bad guys are going to focus on areas where the most damage and the most results can come back. So wow, some crazy wild stuff going on here. Absolutely unbelievable. So I just wanted to cover that for just a minute, right? Just because it is a breaking story. It doesn't seem like we've come to the end of this yet. Pretty wild. All right. So let me, let me jump into this. This comes from The Washington Post and really, wow, there's, there's some big stuff in this. Let me flip this around just for a second so we can get— there we go. That's kind of the way I want it for now. So I'm going to bring chat back in just a second. If anyone says anything, I'll bring it up like this right here. Yeah, from Matt. It isn't Demet Cobbler Shoes. That's exactly right. Okay, so let's talk about this right here. This is pretty interesting. So I'm not saying that— I don't have inside knowledge on this, all right? So I'm not saying that Jenny Surly is like, this is her last hurrah and she's like throwing out nukes, you know, in terms of like big stuff happening. I'm not saying that. Oh, I gotta change my screen. This— you guys can't see this. Hold on a second, let me get this. There we go. And then let me— oh, the joys of Okay, there we go. That's going to be readable. Okay, there we go. So I'm not saying that she's like throwing out her last hurrahs or anything, but I am saying there's some things happening here that are kicking into motion a 2023 and 2024 that's going to be pretty lit up with the future of what's going to be happening in terms of CISA's approach to cybersecurity and mandates and throwing out some thoughts and process that they have that we should all follow. So let's just jump into this. All right. So CISA director hops under the thorny topic of software liability. All right, so before I even jump in, bring Matt's quote up here, right here. We need to hold software and other businesses accountable to make secure code, be transparent, build security and culture of everything. 100% agree with that. And I think Jen Easterly agrees with that. That's why she's bringing this thing out. That's why she's talking about this. That's why this is a big old deal, my friends. But there's a lot of nascent stuff embedded in this that we're going to have to unpack, and we're going to do that in this live stream. Okay, so big stuff coming in here. All right, uh, let's see. So let me pull this in. Look at this, uh, Congress should advance legislation allowing software manufacturers to be held legally liable for the insecurity of their products, and it should be— and it should also shield companies. So it's kind of both ways. It should also, on the other hand, shield companies, give them what we call safe harbor, that develops secure software from legal liability, CISA Director Jen Easterly said. So So that doesn't mean this is happening. She's just giving statements. She's just talking about this. She's just saying, my point of view as the CISO director is like, we should probably start putting some lines in the sand here and say, you know, enough is enough. We got to do some things around all of this. We got to, we got to really start saying it's— we got to hold people to the fire. And I think that makes some sense. Right. But that brings up a whole bunch of topics. That I think are pretty— we got to really think through. For example, who becomes the arbiter of what's good and bad? Who becomes the arbiter of like, you didn't do enough and you did do enough? Those are like big questions we got to ask. So as we jump into this a little bit more, by calling for that proposal, Eastley waded into the toughest of cyber issues to crack. I'm going to show this to you. So Bruce Schneier, if you guys don't know, he's like a Unix-bearded security godfather, right? He's been in the security industry since the '90s, like, like in terms of like really speaking about it very heavily. And so he's been talking about this this for quite some time. Um, they, they mentioned that, right? And then also the Cyberspace Solarium Commission— I'm going to show you this report. So they've been talking about, look, this idea of like liability has been one that we haven't cracked the code on. Let me show this to you right here. This comes right here. You can go get this, just click on that link. It's the, the, um, '22 annual report from Solarium Commission, right? So we scroll down, and what I'm going to do— there's a bunch of stuff that kind of exists here, but what I want to do is you can actually find this pretty easily. The way this works is this, in this executive summary, is they're They're talking about some of the major changes and enhancements to the National Cybersecurity Program that we have in the US and where the progress has been made. So you can see across the board, 25 have been implemented, 23 nearing implementation, etc., etc., and only 2 that have significant barriers. And one of those is what we're talking about, this idea of like, where does liability lie and can we create a minimum around all this? And man, there's so much good chat going on here. I'm just going to bring the chat back up because I think I just got to— I don't know if we can do like 3 screens. We probably can't. So let me jump back into their little mini Wes Spencer. Okay, so we're going to talk about this because, man, so much good chat going on. What we can do is I'm just going to Ctrl+F for this. Watch this. I'm just going to Ctrl+F liability and let's just bring this guy up. So it's not that one. It is this one here. Establish liability for final goods assemblers. This faces significant barriers to implementation. Okay, so we scroll down a little bit more. You can see what they say about this. As was the case the prior year, this recommendation has encountered significant barriers to implementation. Should future events— this is big. All right, listen, this— should future events generate the impetus needed to implement the proposal, Commission staff has drafted sample legislation. What the heck does that mean? Here's what this means. And yeah, whoever, LinkedIn user, I'm guessing that's probably Brad Gross again. We're going to get into this. Yeah. Who is the arbiter, right? How do we know who should deserve safe harbor and who doesn't? We're going to have to talk about that. We're going to get to this. But here's what was is big in that quote I just read is they basically said, look, we've made this as a recommendation that there should be— we should establish these lines of liability. Okay. But we haven't been able to get there, but we're ready to. They're like, we've, we've drafted sample legislation. In other words, we're just waiting for the time to strike. We're waiting for the proverbial major colossal SolarWinds times 10, Kaseya level times 50. Type of attack that everyone says enough is enough. And when that happens, should that event occur, then we're ready to go. Isn't that crazy, Michael? I love the background music too, it's rocking. I was just saying before I even started the live stream, it was just— Link— or, uh, Restream's crushing with the music today, it's so good. Uh, that's wild to me, guys, that it's ready to go and you may see it happen. It's just going to take an impetus, it's going to take an input in to cause this to happen. Okay, so let's go back to the main article here. And if you're just joining us, we're talking about what CISA has said, what Jen Easterly just made some comments that probably are reflective of the stance of CISA, I would assume, around this whole idea of calling for liability. They've tried to do this, they haven't made the progress they've made, but she's definitely, you know, getting into this. So Easterly's proposal commits, uh, comes amid a CISA push for tech companies to offer products that are secure by design, meaning that security is baked into the design process from beginning and secure by default, which refers to products that arrive with secure settings at no additional cost. Okay, okay, how do we unpack this? First of all, there's a lot of questions that probably naturally come in here. What is secure by design? Are we taking like Cloud Security Alliance best practices and adhering to it? I'm okay with that. How do we— like, are we taking— like, someone mentioned SOC 2 before. Like, I don't know that that works, but like, it's you know, like, look, how do we know that it's met the criteria of secure by design? See, this is difficult for us because in the cyber world, we still haven't got to this level of like, how do we know what good enough is? How do we know that it's enough secure by design? Right. That's— now we can, we can usually point to the opposite, right? We can look at some breaches and you're like, oh my, Oh geez, I can't believe this happened. What negligence. Like, we can usually point to that a lot more easily, but this becomes a really difficult conversation. I think most of us— and I'm even trying to keep up in the chat— I think most of us would agree that like, yeah, at a high level, this kind of makes sense, right? Like, we should probably have some level of secure by design. There should be some amount of like, you are responsible as a software provider to do the right things. I think we all agree with that. The question is, what is the limit? What's the litmus test? Where's the— you go from negligence into doing the right things to where you get secure harbor. Where's the line? Who sets that line? I don't know. That, that's a tough, tough question. Government can work to advance legislation to prevent technology manufacturers from disclaiming liability by contract, establishing higher standards of care for software in specific critical infrastructure entities, and driving the development of a safe harbor framework to shield liability from— or from liability companies that securely develop and maintain their products and services, Easterly said. Okay, but again, how do we do that, right? And this gets elaborated. So apparently through this talk, Easterly was asked some questions about this, and she, she went a little bit deeper. I'm going to talk about a couple of these things. One of the things she talked about is like this whole like click to agree, you know, when we have scroll— you look at the terms of service and you're scrolling, scrolling, scrolling, scrolling, scrolling, and you can't even get into like the video game you want to play, the software you want to install, that the cloud platform you want want to get into until you finally get to the bottom. And then the accept goes from grayed out to hit. And you're like, no one reads this. And even if I did read it, what am I going to do about it? Right? That's the stuff she's like, look, that's got to change, right? That's, that's ridiculous. Now, Brad, I could bring him onto the channel. He could probably talk about this way more knowledgeable than me because he's actually an attorney, right? So I don't pretend to be in an attorney's shoes today, but she's certainly pointing about how aggravating all of that is, right? At the same time, it's understandable when a company gets hit by a sophisticated hacker with ties to another nation-state's government. And that's when the idea of safe harbor comes into play, she says. If companies are all doing the right things and still get breached, I think you bring that into the calculus. Okay. You know, here's some thoughts on this that she made. I think we all agree probably that if you get hit by a sophisticated nation-state attack, right, like the government of China comes after you, no one's going to stop them. No one's going to. So they get safe harbor. Okay. I got, I got hit by a systemic supply chain attack going after, you know, eventually, you know, like SolarWinds. There's nothing we could do to stop that, is there? When you look at like what happened to this, I'm just using SolarWinds as an example. SolarWinds 123. Anyone remember that great password they had? So like even this whole idea of like another nation state coming after us, I just granted safe harbor. At what point are you granted safe harbor and are you not granted safe harbor? And also, is she saying— I'm trying not to read too much into the comments. Let me go back to this. Is she saying that if you're just hit by a nation state, you're automatically granted safe harbor, but any other type of attack you're not, and therefore you're automatically liable? I don't think she's saying that, but I think you could read into that from the quote there. Right. I think it's fair to kind of take a peek at that and be like, so does that just mean like if I'm hit by ransomware or if I'm an RMM provider and my RMM gets popped, even if I were doing all the right things, I could show I cared about security, that I'm liable because it wasn't a nation-state attack and it was just like, you know, the next ransomware threat actor du jour. I don't think she's saying that. But do you see how murky and muddy these lines are? I don't know exactly where we get to on this, and I don't know how we implement it. But like, in theory, I'm in favor of this. We should stop allowing these SaaS companies or software providers, especially in the MSP space, but anywhere else as well. Not picking just in the MSP space. This exists in healthcare EMR systems. This, this exists in banking core systems. This exists in factory controls. This is a pervasive problem everywhere of like negligence or inability or unwillingness to do the right things in security and then eventually it rears its ugly head, right? We should stop that. And I think a good way to do that is to say you got liability. If some company down the supply chain got popped because of the things that you were doing, you should have liability in all of this for sure. If I got my concrete manufacturer, I make a really bad batch of concrete and it happens to have, you know, a major issue and a building collapses. I'm just making something off the top of my head. I don't— we all agree that somehow down the line the concrete manufacturer should have some liability here for this. They didn't properly QA it. They knew that it was bad and sold it anyway, whatever it might be like. Doesn't that make sense? So shouldn't it be the same way on the cyber side? I'm just asking. I'm just trying to figure this thing out here as we kind of work through all of this. So she really opened up a can of worms here that I think a lot of us, it resonates with, but We just don't know how it gets handled. Right. She says she hasn't reached out to Congress or industry to gauge interest in the legislative proposal. Well, that's interesting. Clearly not, because if she had, you know, she might get a lot of this kind of feedback, you know, of like, all right, Jean Easterly, what's your process to make this happen? Do we really want a federal government arbiter to come in and dictate what's, what, what's good and not, and what's the— where the line is between negligence and safe harbor. She told reporters she expects to see some of the ideas I previewed today to be in the National Cyber Security Strategy. Now that's interesting. Does anybody know what she's talking about here? So we have very soon— some people are even saying within the week— we, we are going to see President Biden's newly released blueprint, sort of like a policy blueprint of what the national focus and the objectives in the future flag-setting in the field of cybersecurity is going to be. That's a good thing. And by the way, this is traditionally across the board— this idea of national cybersecurity standards is a pretty bipartisan approach because— but, and I'm not here to play the politician side of the house, but both Republicans and Democrats understand that cybersecurity is an attack against the nation itself. So therefore, there is largely a lot of bipartisan support for good cybersecurity. But what's that going to look like? What's going to come out of that? Well, I have to think that Jen Easterly probably has better insight than any of us do in what that blueprint is going to look like. So if she's just tossing that one out there in a talk like this and she's like, you know, I think we've got to start setting the minimums on liability and start understanding enough is enough. Okay. But what that means to me probably is that, well, maybe what's going to come out in the National Cyber Strategy is going to have a piece around liability. So we need to be prepared for that. We need to be ready for that. We certainly do. Let me kind of get back to the comments here. Insuring a SaaS company, that would be all kinds of interesting. Yeah. And there are, by the way, there are even cyber insurance companies that do tech E&O for SaaS companies. Companies. That's the thing, it really exists. Uh, Matt says, I've heard enough execs say to me, Matt, a lot of good money is made on really bleep software. Yep, a whole lot, isn't it, Matt? Like, you and I, if we were to remove— if Matt and I were to have all our non-disclosures and non-ns removed, there's probably a lot of stories that we could tell across the board, whether it's companies we might have worked for or companies that we haven't worked for but we've heard stories about, just across the board. Uh, yeah, and again, I'm not picking on the MSP space. I'm not. I'm talking about other industries I've worked in. It's a pervasive problem. Connor Swalm checking in, what's up? SaaS companies using other SaaS companies, where does the chain end? Uh, he has SaaS on SaaS on SaaS, right? It's kind of like I was talking about the beginning of this LastPass thing, right? LastPass used to protect LastPass. What happens when the main— one of the main DevOps guys gets popped, right? Same kind of thing. So, so here's the thing, I really think that what we're going to see in this national cyber strategy that is imminent is going to have a piece of liability inside of it. Now, I don't know how that plays out, right? Like, do we have to have legislation that comes out that sort of re— um, that sort of like clarifies when we have— when liability in the cyber side is— can, can sort of be determined and when it can't be? Are we just going to see a new focus and judges begin to interpret law certain ways? Now we see more case law come into play that does hold companies more liable for cybersecurity? I don't know. But I will say at this level, just my opinion, I think across the board I'd rather see some disruption here and I'd rather see some fear and worry among CISOs at some of these companies that are like, uh-oh, now I have liability, this is on me. And now I finally have the impetus and the, um, the financial impact to the business to force them to do something more. I'm in favor of that. Like, if that's what it takes to force companies to do more and to finally update things that they know they needed to, how is that a bad thing? Right? We always end up having some friction before we see a good process and we see good changes in anything. Right? So that might not be such a bad thing. Okay. Obviously, we want to work with any of these things closely with the Congress. There you have it. Right. Maybe, maybe there's going to be some petitioning to Congress and probably Congress people are already involved in this national cyber strategy. So it's possible that bills are even being worked on to push into legislation clarification, just like we said. So that's a very interesting statement. Try not to read too much into it, but it's interesting. And frankly, cybersecurity is an issue that's enjoyed bipartisan support, just like I was saying. And we want to continue to have that support. Industry realizes the importance of this well. So I'm looking forward to having robust conversations with both. So is she saying that we're already having discussions with Congress, new bills are potentially being discussed and may eventually be pushed and potentially even passed that are going to change this game of liability? I don't know. We'll see this. Brad Gross checking in. The government's been utterly ineffective in legislating privacy standards for personal information. I agree. It's still a patchwork largely left to the states. Now we're going to give them the power to determine what level of security is sufficient to avoid penalties for software vulnerabilities. Oy vey. So, Brad, that's my thoughts too. Like, again, we're coming back to this with we all agree, like, we're not doing enough. We all agree there should be liability for, like, people that have definitely not done the right things. But we're going to make them— the federal government, the same federal government that just had a major breach themselves with the U.S. Marshals— I'm not even covering that today— they're going to be the ones to do all this. And a bunch of geriatric senators that can't even like use an iPhone without like the major screen enhancements on like blowing up the text like this big, as big as the screen. They're going to be the ones to set all of this. It's a scary thing, isn't it? I'm not sure this is going to be the right answer, but I do support liability because I've seen what's happened to small businesses when they get smashed by ransomware through no fault of their own. You bring my good friend Eric Woodard up and Eric will tell you the turmoil, the lost sleep, the tears, the gray hairs, the lost money that's come because certain companies might not have cared about security the way he cared about security, and that they might not have been impacted the way he and his livelihood was impacted. That's not right. So how do we fix it? I'm with you, Brad. I think that's a tough one here. I'm not necessarily saying that I think the federal government should be the ones to go and just fix all of this because they're probably not going to be the ones to fix it. Well, I agree. Matt Lee saying this is not just about the MSP space. I think this is across the world, just like any technology. First comes the value, then comes the safety. Yeah, exactly right. Mark agreed. I saw that in the ICS and SCADA space. I mean, it's one of the originals to this, right? I've talked to so many in that space, like, you know, we're using like 1970s Siemens technology here. What are we supposed to do about that? They don't care about security at all, and we don't have the budget to fix anything even if they did. I'd rather see one insurance company, hopefully FifthWall— yes, uh, just nail it and grow massive, and they dictate the minefield and cherry-pick the good risks and let the market drive it. So, you know, Tim, that's a great thought. You know, like, I can't share too much of this, but like, yeah, if we ever had the ability to become a carrier on our own, I think we would do a lot of things differently, not just in the underwriting process, but even in, you know, how we, how we look at good and who we work with and what the supply chain looks like. You want another example of that? Look at what Justin Reimann is doing with TechRock, right? Their loss ratios are astoundingly low compared to all the other tech E&O providers for MSPs because they're doing things differently. And I think that's great. I think if we see more and more people band together, it doesn't even have to be an empire of like one carrier. What if a lot of the carriers got together and started doing some things differently, right? What if a lot of the carriers got together and said, this is what good looks like, this is what we're going to do, this is what we're not going to do, this is how we're going to be much more proactive this and we're going to push the industry for the better. I think that's a great thing for sure. Matt Lee saying we should push for an SRO authorized by Congress. Matt, let me know what an SRO is. I don't know the term, so give me some feedback on what that means or what it is, because I'd love to hear more about what you mean by that because I'm actually not sure. Okay, so let's come back now. I had some really good comments here, but how? Because of the push and pull between software companies, that want protections and consumer advocates who want accountability, this idea has been tough to get off the ground. And this is where the bipartisan fight comes from. Both sides of the aisle agree cybersecurity is a pervasive threat to the nation, but there's a split between the two, right? Sometimes one side of the aisle might say, look, we're not doing a good enough job to protect the end users and the small business and those that are impacted. But then the other side of the aisle might come back and say, yeah, but look, man, you know, We, we need to protect companies as well and let them grow and survive and thrive. And you force a bunch of mandates on them to have to go change some things, and costs are going to skyrocket. This whole thing's going to be a mess, right? And we're not protecting business. So I'm not here to like tell you the right or wrong. It's not my position. I'm not a politician, and dear Lord, I don't ever want to be one. But I will be your friendly dictator. I'll happily assume that role. Um, uh, a self-regulatory organization, Brad Gross says. So I don't know, Brad, if you could pop into comments a little bit more of like an ELI5 for us of like what a self-regulation— regulatory organization might look like. I don't know if that's more like à la PCI or something else. I don't think so. Be curious to know what that would look like. Um, so yeah, going back to this, you know, this whole idea of this push and pull— now we're starting to see the fight because we can't come to agreement of what this liability would look like. And that's going to be the rub, that's going to be the challenge. And we may see this in the final 2 years of the Biden administration if they don't get a second term. Again, I'm not pontificating what I think is going to happen there, but it might just be 2 years left for them and they want to push some things in before there's another reelection campaign. And this could be part of it, right? We'll see if she can thread that needle. Good on her, he said. Obviously, this is the Montgomery person I quoted earlier. Further complicating matters, Montgomery said, is deciding specifics like— and like we talked about, when does liability end? When do you stop doing software upgrades? Microsoft supported Windows 7, released in 2009 until 2020. Right. So like, again, When does it— when does it end? So I think this is some really interesting stuff, right? It's virtually— and some other additional things. So this Chris Wysopal, I don't know if you know Loft, like the original guys of LoftCrack, one of those original password crackers in the ancient days and founder of Veracode, really, really well-known company today, had some quotes. It's virtually impossible to clearly and accurately determine a single vendor to blame. Who would you choose to be liable for a security breach? The company that was breached? The vendor of the hardware or software that was compromised in the attack vector, perhaps the vendors of the cybersecurity platforms and tools in place to ostensibly detect and block threats before they can become further successful attacks. Or, Chris, I'll take that one step further. Or maybe should it be the creators of open source libraries like Log4j or, you know, the SSL stuff from before? Are they liable? So like, yeah, this whole stream of liability Where does it exist? Maybe in one breach. I'm just going to throw arbitrary things out there. What if— oops, nail and throwing my headphones everywhere. We're just going to go headphoneless for the rest of this. We don't need headphones. What if— take that example of what if, you know, some breach happens and it was an open source library. Maybe they didn't know that the library is vulnerable. Maybe nobody knew it was a zero day. Maybe they did know and they chose to ignore it. Maybe it wasn't their fault. It was their own supplier and the open source library let the bad guy into the supplier who then got access to the software vendor who then used that to get access to all their clients. You see how messy this can get? Like there's not a true easy solution to this. I think every single incident is going to be unique into its own and we're going to have to figure that one out. We're going to really have to kind of understand what do we do in a situation like this? That's not easy. Going back to some another quote from Chris, it's impractical to think that any software, hardware, firmware can be created that is absolutely secure. The question of liability is arguably too complex for one law to adequately address. I, again, I agree. So there you have it. I'm going to skip by what other people think about. I'm also going to skip by this exclusive, an AI roundtable, the US, EU, and others. That's another topic for another day. It's interesting to see that as well, but I just, I wanted to share this because it's really a big deal. I think we're going to see some stuff happen in the new updates that we're going to see from the Biden administration around the National Cyber Strategy that's upcoming. I'm very eager to dive into it and see the implications. I have to bring some others on like Brad. It'd be fun to have you and Matt on as well. And we'll talk about all of this. But guys, I'm telling you, we're seeing changes. We're seeing the wheels move, the wheels of regulatory enforcement, the wheels of what liability and a re-clarification of what that looks like, the wheels moving of what does future legislation look like when it comes to cybersecurity. Last year we pushed CIRCIA, the Cyber Incident Reporting Act. This year we may see clarifications. And if we see clarifications to liability and they just say something simple like, look, at the end of the day, You're now liable if you do something and you can be successfully sued if you didn't put the right things in place or a breach happened because you had a software patch that, you know, was, was ignored or you had ancient, you know, old software that you chose not to update. We'll see. Or maybe they'll take the flip of it of like, this is the eligibility to get Safe Harbor. If you can prove that you were following software security best practices, if you can prove the nature of the breach didn't happen because you know, it wasn't— it was a zero-day versus, you know, you just had some API vulnerability you chose to just ignore. You know, maybe they'll go the other way of like, who's eligible for Safe Harbor and who's not. I don't know. I do know it'll be messy to start, but I am in favor of messy, my friends. I, I think messy is the way to the future because at least we can work through the messiness and re-clarify and get to a better stage than where we're at right now, which we'd all agree is freaking broken. Okay, let's see what Brad said here. Under an SRO, the organization sets rules that govern the actions of its members. Members agree to follow the rules or get booted out of the organization or get fined by the organization, enforceable by contract, etc. I think Matt is suggesting we establish an SRO for the software industry, but it would require buy-in from the software companies themselves. And see, that's the problem. I think we all agree with this. The real problem we have here is we've been talking forever about how do we get enough of us to band together, maybe inside the MSP space. A lot of opinions. I think we all agree that that would be good, but who and how and when and why and where are the unsolved questions. So I don't know how that happens, but I think it's a, you know, is it CompTIA with what's happening inside of Trustmark? Maybe we're already seeing the genesis of this come out. I don't know. I will tell you this, I, my vote will go to wherever the MSPs go. What the MSPs decide is best, we should adhere to. If there's enough MSPs get together, they're well-respected, they're smart and committed to a plan and process forward. I think the rest of us should follow suit. The RMM vendors, the large security vendors should all say, yep, we're going to follow where the MSPs go because ultimately we're here to serve them. And if we claim to serve them and we disagree with the strategy they're going towards on this, you don't serve them. Right? So I don't know, but I think it's interesting and we may see the federal government push this on us sooner than we need, or maybe they'll push this into us and be the impetus we need to get us to go the direction we need to come hell or high water. Who do you want as your overlords? People friendly to the organization like this SRO or the federal government? I think we all know the answer to that, probably. And then Brad also said, or have legislation that says that software companies must comply with the rules of SRO. Yep. Like a bar association. And I think I've heard— I've heard MSPs talk about that before too. Like, wouldn't it be great if we did have some kind of like standardized— you're going to be an MSP or you're going to serve MSPs in a large form and fashion. You're going to be subject to, you know, the equivalent of our bar association. I don't know how that's a bad thing. You talk to any lawyer, Brad would probably be the first to say, you know, being disbarred is basically the end of your livelihood. That's a big deal. So what would that look like to be dis-MSP barred? That's a big deal. What would that look like to be able to be ineligible to serve your MSPs when that's your business model? That's, that's— it's pretty interesting to think about. Um, Eric Bull's checking in. Eric, thanks for joining, my friend. Eric is awesome. Um, it's important to remember that connected digital infrastructure is only 27 years old, still very early. There's a lot to figure out. That's really well said, is that cyber as a whole and IT, as you know, even from there, is a very young industry compared to everything else. I mean, you could make the argument that, you know, IT in its true form and fashion came out of World War II, and security is an offshoot that really didn't become important until like the late '80s, largely speaking. So it is young. We are figuring this stuff out. We don't have all the answers to this. So yeah, it's, it's good stuff. This is why I got the chat open. I really want to hear from you guys. I got just a couple minutes left before I got to jump to a meeting. But it's, it's great conversation and something we've got to think about because I don't know that we have the right answers, but we're being pushed into doing something, and something is probably better than nothing. Connor checking in: it'd be better to see where the blame gets pushed for the vulnerabilities. It might be that a SaaS product that a vendor used that was deployed by an MSP that creates vulnerability Who does the client blame? Who does the legal process blame? Example: How many vendors that MSPs deploy have used LastPass recently? Yeah, whoo, a lot to unpack. I bring to you questions without answers. I'm sorry for doing that, but I saw this come out. I'm like, I got to cover this one. I got to jump into a livestream on this one because I'm telling you, having been around regulators before in my career, This is how this stuff begins. It is coming. It is beginning. It is moving forward. We do have the attention of the federal government at the national level for cybersecurity all the way down to our industry. It's coming. I don't think it's a bad thing. I think it's a wave that we can't stop it. So we might as well figure out how to ride it. We'll see where that wave takes us. We'll see where that ends up. But I think having smart people like Connor Eric, Matt, Brad, Steven, you jumping in here too. Sorry, not sorry. And many more people. The more we talk about this, the better off we are. This is good for us. It's good discussion for us. And we'll see where this ends up. I'm at bingo. I wish I could stay on longer. Wish we could talk about this more, but I am literally out of time. This has been super awesome. So you know what we're going to do? We're going to crank up the music. That's right. I can't hear it because I knocked my headphones out, but I bet you can, and I bet it's awesome. I'm going to end the livestream here. Thanks for watching this, guys. And if you have thoughts, questions, share this out, add more comments. I'll continue to see them even after the livestream's over. Share this with your friends and add into the conversation, because the more you have to share this, the better off we are. It's not a problem that's solved by one of us. It's a problem that hopefully will be solved by all of us working together in concert. We won't be perfect. We won't all agree. But we'll get there and we'll figure this thing out. Brad saying— or Eric saying, Brad Gross mentioned a couple of weeks ago that as an MSP, if you don't disclose you're using a third-party vendor and you have an issue, you may be liable. Yeah, that's one of those points that could be inside of this as we discuss what's the bar, the line of liability look like. All right, my friends, out of time here. It's been super fun. I will catch you on the flip side. Give me some comments. Leave a like. Share this out, it really does go a long way. Thanks so very much.