Trouble in Techland The Aurora 7 Breach

What is up, my friends? I have news for you. There is trouble here in Techland, and I don't know about you, Bob, but, um, we got some problems to solve today. What do you think?

Oh yeah, yeah, I can't wait, I can't wait, because quite literally the, the people who are joining this here have no idea what we're about to dump them into. So, you know, which is, you know, that's typical IR game. That's typical IR game sort of stuff to kind of get dumped into the deep end. But yeah, I'm looking forward to seeing how we kind of navigate through this, how the team navigates through it.

So I'm excited.

Yes, as am I. If you have never been to Trouble in Techland, welcome. This is an Empath and IR Game production. It's super fun. What we do is we take some kind of incident of of real kinds and real making. We typically, well, except for last time. Last time we did a Star Wars-themed vlog.

It was super dope.

Man, that was really great. We had a whole bunch of people on the Empire side and the Rebel side basically going after each other. It was really, really cool. It's a fun way to just show how you can have fun but also learn at the same time. But today we're going back to a real incident. We changed the names and the faces of those involved and we're gonna work through it. And this is gonna be a lot of fun today. I've got a whole bunch of guests on today. I think one of the best ways to do these is participate with the audience live. So make sure you're chatting in, you're talking. And then also, we'll do intros in just a second, but we've got a great crew of guests that are going to participate with us today. And it's going to be super fun. So Bob, what do you think? How should we get started? Do you want to kind of intro to who iRGame is, and then we'll go to each of the guests and let them say hi?

Yeah, yeah, that's fine. So for those of you who don't know me, Bob Miller, I am the CEO and founder of IR Game, and IR Game is an incident response online multiplayer exercise system, which you'll get to see here in just a minute what that actually means. But it's designed for people to be able, like managed service providers or CISOs, to be able to run exercises for their customer base. And we also run games for those same people if they want to get themselves exercised by somebody like us, then we do that as well. But that's really what it is. It's a tabletop exercise, but it's online and multiplayer and digital. So that's what we do. So please, by all means, let's, let's let them introduce themselves.

All right, let's do it. So I'll start top left of my screen, the one and only, my good friend, Maak Brown. Maak, how are you?

Good. How are you?

Excited?

Friday, we're almost done.

Yes.

Yes.

Am I, Bob, am I supposed to introduce myself as my new player role, which I have zero background?

You should do both.

You should do both. Yeah.

Okay. My name is Mackenzie Brown. By day, I am not Batman, apparently. I work at PointNet, VP of Threat Intel. But today, I am the CFO. I am financial, which everyone who's ever known me to have a bank account is probably a bad idea. So, we'll see what happens. I don't know. I have a good background in IR, so I know how much it costs anyway. I think I can handle this.

I love it. Mack, thanks for joining us today. Really glad to have you with us. Let's go over to Peter Just. Peter, what's up?

Hi, good to be here. Peter Just, I'm with Delcor Technology Solutions. I'm the director of integrated systems and operations, and I am playing the part of the lawyer.

Woo-hoo!

So I will add no value whatsoever. Instantly everybody puts you in a bucket right away. You're the most popular.

Yes. Thank you for playing the part of an attorney. We are glad to have you with us, Pete. Thanks for joining and super glad to have you on. Let's go over to my good friend, the Kentucky Hawaiian, the only Kentucky Hawaiian that must exist, Jordan Silva.

Has that ever been said in the same sentence before? No. That is out—

It's accurate.

It's accurate, though.

Yeah.

Or is it Hawaiian Kentucky? I don't know. I don't know which one is first.

Hawaiian first. I even have Hawaiian words behind me. It's fine. It all works out. No, I'm Jordan Silva. I'm director of managed services over at Mirazon here in Kentucky. And today I get to be an HR person and it'll be the first time I'm on this side of the HR relationship. And I'm really excited. I have my PIP forms ready and I have the pizza place on speed dial. So I think we're going to have a great day.

I love it.

What could possibly go wrong? HR role.

I love it. Nothing could go wrong.

It's going to be great.

Next up, we've got Nick. What's going on, sir?

Hello, everybody. My name is Nick Opolenik. I am the Technical Services Manager for Pegasus Technologies out in Pennsylvania. Today I am playing the role of the medical person.

I love it.

The medical, like the doctor.

Yeah.

That's all he's got.

We're gonna find out.

That's literally all he's got. Really excited to find out.

Well, once again, what could possibly go wrong with playing a doctor in real life?

I love it.

I, we, we, all our hope is in you, Nick. Don't, don't fail us.

No, I got you. I mean, as long as I have a couple test patients first, we should be good.

Perfect.

Well, in line of test patients, we're going to line up this test patient right here, the one and only cyber farmer, Jesse Miller.

I got my cow shirt on. I think I told everyone that. Um, hey everyone, Jesse Miller. I usually say this in reverse, but I'm going to flip that today and say I farm. So what am I doing here? Uh, I actually run PowerPSA Consulting and have created what I call the Power Grid VC/SO system. Short story, what we do is help MSPs take this VC/SO strategic advisor cybersecurity risk management thing and demystify it and turn it into the spearpoint for revenue in their cyber program. And I do run a farm. So if you're on LinkedIn, check out the hashtag #cybersecfarmers. I make these parallels between farming and cybersecurity. It's kind of a fun game mental exercise that I try to do. And today I agreed to play the CEO. I don't know why I did that. We're all in a lot of trouble. Let's put it that way.

You will be a fine CEO and this whole ship will go down with you if you fail us. So, yes, much rests upon you, Justin Farmer. I love it. Well, let's go over to my friend Lincoln over from Petra, the Rock. What's going on, Lincoln?

Hello, hello.

My day job is head of community here at Petra, so I'm very used to going through these incidents and what do they say in Fargo? The request of the survivors, the names have been changed and outta respect for the dead, the rest has been told exactly how it occurred. So I'm used to throwing some black bars on this. Today I'm playing the role of Nathan.

So whoever he is, that's who I am today.

That took a minute to— I forgot what you meant by that.

Maika, you've worked a bajillion incidents. That's probably not far off from real life, is it, when an incident comes up and whoever, "I'm out.

See y'all." Yeah.

Yeah, yeah. Someone's gonna get pissed off and reject it.

I love it. Well, Linda, thanks for joining. And on behalf of Nathan, thanks for being with us today. And last and by no means the least, we have got my friend Victor. Victor, what's going on?

Wes, it doesn't sound like you know me very well because I am the least here in this tabletop exercise. But no, aside from that, my, my notorious past has to deal with Bob Miller. We've known each other since pre-2000, so there's nobody here I think that is younger than that. So that's cool because sometimes there is. Um, but no, I have a long and storied history of being an owner of a small MSP that served our local community, and then about a year and a half ago got gobbled up by a bigger MSP, which wasn't the exact, you know, dream scenario that I thought it would be. And so now today what I'm doing is I'm more focusing on getting back to more of a consultative nature of the entity. And of course, that has to do with AI and cybersecurity. And now that AI has cracked open a whole new spectrum of stuff we need to be aware of for cybersecurity, it's exciting. And so there's a lot of interesting information that we got to propagate to the people, make them aware. And this way is one of the more fun experiences to actually show that. Um, so with Bob, what I'm trying to do right now 'cause the last time I took one of these is over a year ago, Bob, I think. And just to see what's new on 'em. And then also having that information, being able to spread the knowledge to the people I talk to about, hey, you don't know these things and here's a great way to get to do it. So let's do it.

I love it. And you say you're not important. You've suddenly become the most important person on the call because I need blackmail on Bob. So you and I will be meeting up later. Anyone who's known Bob Longo—

If we're gonna compare truckloads of blackmail, My truck's a hell of a lot bigger on Vic than Vic's is on me.

Oh, yeah.

No, no. We'll find out about that.

Bob's got at least 5 buried. I could, but yeah, Bob's got about 5 bodies I can help bury him, and then I might be up to the point where we're even on things.

So yeah, he's got credit.

We shall find out about that soon enough. Well, Bob, I think we are ready to jump into the game. So for those of you that are watching and listening, I want— we want you all to participate. Join in with us. Bob will share a screen so we can kind of see what we're working through here. And for you in the audience, give feedback. And what we've asked for all the participants is they're going to do what they want to do best according to their role. So you may actually see someone do something that maybe is not the right thing to do from a security perspective, but their role would probably dictate that. And they might, they might go that direction. Maybe they'll take audience input. But this is really more about having fun than like getting the highest score, so to speak. So, Bob, let's jump in. Why don't you get us on the playing field today?

Yeah, I'll do that. So Vic, I don't know if you notice on the right-hand side, there's backstage chat. There's some instructions in there.

Yeah, it's, it's not spinning. It's just sitting and spinning. It's not actually coming up for me. And I've moved a couple of times to try to get it.

Do we want to all tell them together? Refresh your browser. It's going to knock you off. You're going to come all the way back and then, and then the freaking chat will work like it's supposed to. So very good process. Yeah, it's a, it's a, yeah. So I'm going to, I'm going to show the screen now. I'll go ahead and get that going while he's doing he should be good. He should be able to, since he has done it before, he should be capable of.

All right, I'm in and I can see.

Okay, so if you scroll up a little bit, Vic, you'll see the instructions for you, right? There's a, there's a URL right up there. It says Vic, use this URL, and Vic, use this login. So if you'll do that.

All right, I got a Simulator 5001. We don't know who you are, so let me put in my There you go. Good job.

All right. So, okay.

Yeah.

Oh, everybody can find an invitation to this. Well, that's type the whole, you type the whole email address, user05. Yeah.

Oh, dumb. I'm dummy.

Okay. Well, we know that anyways, but well, I figured it was a short between the floorboard and the keyboard, but I figured you'd get there. So no worries. Bob just nods his head and says, mm-hmm.

Yeah, that's par for the course.

Yes, Vic is playing the wrong green.

All right.

Okay, I'm in.

Okay.

All right.

I'm about to kick us off. Everybody ready to go? Ready or not, here we go. So, all right. So Monday morning, Dr. Elena Vargas, Chief Executive Officer of Nova Trials Research Solutions, arrived in her office excited about their latest $47 million Phase 3 oncology trial partnership. So whoever's playing medical should be feeling really good right about now. So code name Aurora— well, certainly the CFO should be feeling great at this point.

Oh no.

Code name Aurora 7. Her assistant Jennifer knocked, urgently reporting that Dr. Sarah Mitchell from data management had discovered someone had accessed her email account over the weekend and downloaded several clinical trial documents. So Elena realized that there were some implications involved in this. So she, uh, Dr. Mitchell managed some of their most sensitive oncology trial data. Her account contained patient information, protocol designs, and the competitive intelligence that could be pretty devastating. So not only that, there's some potential Health Insurance Portability and Accountability Act, or HIPAA, violations hung in the balance if someone really got in there and saw anything, right? So Elena, the CEO, immediately called an emergency meeting with Sanjay Rowe from tech, who's the chief tech and security officer, and then Dr. Jurgen Hoffman, who's medical, chief medical officer. As they gathered in the conference room, this team began to work to determine if this event was in fact a breach of protected health information. What immediate steps should this group— now remember, we're playing this group, that's all the information you got right now. What immediate steps should this group take to assess the scope of this?

This is a pretty big question, isn't it?

Well, yeah. I mean, you've got somebody who's got a lot of sensitive information and has determined, or at least figured out, that someone got access to the email account.

So are we a publicly traded company?

That's just a, that's just degrees of pain you're talking about, right? I mean, at this point, right? I mean, at this point, So let me ask you this, Jesse. What would that— what would that mean if we were a public sector?

Materiality triggers notification rules.

So if we've determined it's an incident, though, right?

Not correct.

Yeah. Okay. Yeah, exactly. So we're not exactly sure.

Assess the scope of the event. To assess the scope of the event, I'd want to know— it sounds like there was material information leaked, but I'd want to know what information was actually accessed. So that's what I'd want to know.

You want to try and verify it, right? Anybody else on that question? Nobody from finance?

Well, I'm still impressed with the $47 million.

That's—

you're still counting the dollars. Fair enough.

I mean, I agree. I'd want to know what was accessed, but I would consider this an incident if it was downloaded. I would want to determine what system it was downloaded on. If it was an external system, then absolutely a breach.

I got a feeling we're going to get more of that information as we go, for sure. So in a case like this, when it's something that could be this sensitive, who would be some of the key stakeholders that you'd want to make sure was notified within the first hour? Right now you've got the chief medical officer, the CEO, and the technical person. That's who's in on the conversation at the moment. Are there any other stakeholders you might—

Legal.

Legal and compliance.

Yeah.

Okay.

Yeah.

Finance.

So this is a— this next question is a good one because, you know, already we're talking about compliance issues, right? So in general, what obligations— and depends on what this group is used to— so what obligations should you consider regarding HIPAA? And whether this is CMMC 2.0 or PCI DSS, What considerations should there be regarding data protection when you're talking about sensitive data, then when you've got regulatory requirements?

Well, there's a disclosure requirement that we need to be, be aware of. So if we believe there's an actual breach, we have to start a clock to determine how long we have to disclose the information.

Yeah.

So as the HR person, who gets to own the clock? I'd like somebody to show me their clock.

That goes back to the data. We have to confirm that that's correct. Patient was actually exposed. And so the clock doesn't start until we have determined that.

But yeah, as the CEO, you guys told me you were de-anonymizing all our trial data. How did they get patient data? That's what I wanna know.

We'll, we'll put that sticky up on the wall cuz we gotta get that question answered. Yeah. So there, so like when you're during an event, and this is a real question, right? How do you kind of balance transparency with the need to protect the investigation, right? That this has to go internally, you know, right? Because you're not trying to start a panic, but you do need to investigate. So how do you balance that?

I would certainly question why the person doing data management was the one who was also the lead, who was violating, who was violating the fastest.

I looked at their recent security awareness training and it looks like that whole department has skipped theirs for the last 6 months.

Yeah.

May, may have been a problem. All right. So we're in, we're, we're in an allocation round down here. So those of you that haven't played the game before, you've got your role up in the top right. So you, you know what your icon looks like down here below. There are challenges. So if you hover, you know, we got determined if the contract, uh, contact cyber insurance to open a claim, determine if we should contact cyber insurance. Leadership convenes an emergency meeting to assess the situation. So those of you that have a role, you need to be— what you do is on the right-hand side where your icons have a little number next to them. If your icon's there, so the CEO has a task in this first challenge, as does HR. So for you, Jordan, for you, since it's your first thing, you have to click left-click on your HR icon that's on the right that has a little zero by it.

Excellent. And I pick one of them?

You pick— well, when you say pick one of them, you just— oh yeah, you've got, you've got stuff on both of them. So yeah, you can do it. Yeah. Which ones should you work on?

And by the way, what I think it does is it forces us into theory of constraints, right? We typically, we can't do everything all at once, always, all the time. And so this really kind of helps us focus on which of the most impactful income outcomes should we pick. Or again, sometimes according to your role, sometimes your role may demand a certain outcome based on what your responsibilities are.

Yeah, for those of you that haven't played it before, every time you, you can click more than once in a place, and it assigns 25 tokens each time you click there. OK, so you can stack those. So for the medical, the who's playing medical, you can add more to that line down there. Well, you could. You'll know next time you can stack. Every time you put, every time you click on it, it'll 25 tokens for each time you click, just so you're aware. The initial investigation, uh, revealed some details that suggested a sophisticated targeted attack. Sanjay's team discovered Dr. Mitchell's account has been accessed from the Netherlands using legitimate credentials at exactly 8:48 AM Pacific time on Friday. The attacker had worked with precision, accessing 50 emails related to their Aurora 7 oncology trial in about 8 seconds. So somebody knew what they were looking for is what that tells me. Alicia, who's finance CFO, raised the critical question everyone was thinking about, HIPAA implications. Dr. Hoffman, that's interesting coming from finance. I, I can tell you why finance was saying that because they know exactly what the HIPAA penalties are related to those things. So I'm pretty sure that was top of mind, right? Dr. Hoffman confirmed, you know, their worst fears. The Aurora 7 files did contain patient identification numbers, treatment protocols, Safety data. This is definitely protected health information.

So does this mean Sarah gave away her credentials? It says legitimate credentials. Did she give away?

It certainly, it certainly implies that at some point her credentials were harvested and that's, that's what it implies. But you're, you're not wrong. That could have been the other, although I would gotta say if she did that and then ran in the room and said, hey, my credentials.

Yeah.

I mean, you know, maybe not the brightest plan, but anyway, it's possible. So the room, the room got really quiet. CEO made the decision to contact legal immediately while implementing a security lockdown on the clinical trial systems. They're now facing a confirmed incident of protected health information with some, you know, now we're gonna deal with what's, what are the real regulatory, legal, and reputational consequences? So how do you determine if this, let's talk about how do you determine if an event really constitutes a reportable incident when you've got this sort of situation. I think this one can be, is pretty clear, but what, what should be the, you guys all know this, is that when you coach people on this, when, because a lot of people have this question, when does an event really become an incident? That's a good question to ask.

Once validated, usually. If I weren't an HR person, my answer would be once you've confirmed true positive and you've defined that an event was real and it wasn't just a a false alarm, it becomes an incident generally.

Yeah.

Jesse, how do you explain this to people when you're, when you're talking to them from a CISO standpoint?

Yeah, I say an event is a probable, a probable access or attacker foothold of systems. An incident is a confirmation that the foothold was realized and/or files that were not marked for public dissemination were accessed.

Yeah, Mack, I mean, you were on the dark team at Microsoft. I mean, how would you, how do you kind of describe this to people when an event becomes an incident?

Well, certainly using those terms loosely can be dangerous, but good thing we have a lawyer in the room and the lawyer would be the one to say, don't use the B word, being breached.

B word. Yeah.

Don't say the B word until you've actually confirmed that data's been accessed at that point. But yeah, I mean, when it's a security event, there's events that happen all day long. Your SOC's looking at security events. It still could be known malicious, but really an incident is when that unauthorized access, as we were saying early, the unauthorized access has been confirmed.

And—

Yep.

I think that's what really matters is that it's when unauthorized access has been had, change of control, and either data or or asset network assets has been had. Anytime someone outside of the organization has affected a change, has gained access and/or affected change in the, in the organization, then that is when it converts over from an event to an actual incident, right? Because that's, those are, those are unapproved actions that are occurring. So yeah.

It doesn't even have to be somebody outside of the organization, right? It could be internal as well.

It could be internal unauthorized activity. You're right about that.

Yeah, I was just gonna say that.

That's good.

There you go. Uh, what is a tactic for securing potential compromised accounts without disrupting ongoing trials, right? Because these, these are medical trials, so this is not like you're making headboards for, for beds or anything, right? This is like ongoing medical trials, and some of them, there's some question right now about integrity. So how would you— what would be a tactic for trying to secure the ones that you were concerned about but not bring the whole thing to us all.

It's probably largely dependent on how good your hygiene was prior to this. Like, if you've locked your lab and your trials down to whether, you know, physical access, um, yeah, you know, the corporate network is coffee shop and the lab trial has its own contained network, then you can very confidently say, okay, we're going to shut down lab computers and that's it.

But we're gonna have 'em.

I mean, first we need to reset the CEO's password if those are the ones whose credentials were harvested.

It was, um, it was a data, she was a data manager. That's who that was.

Oh, whoever's, yeah.

Credentials, it was kind of worse actually.

Yeah.

Kind of worse.

Yeah.

See, usually, usually don't let the CEO play with the really dangerous stuff.

Right.

But yeah. You guys are in an allocation round, so you've got a minute and 30 seconds. CEO, you got any priorities on that list of challenges that you think people should be concentrating on?

Yeah, I think I, like, to me, I want to determine if we need to contact cyber insurance. I mean, it seems like we do, but whoever can add to that, is that HR or what's that?

HR's got all, all Jordan needs to do is allocate one more on that top challenge and he will take care of that. Medical's already on top of reviewing patient safety models.

And we've got legal involved, correct? Or based on the scenario, legal hasn't been involved because I would always call before I call insurance.

Yep.

Yeah. Well, that, that, that particular line item was saying to determine if you need to get insurance or not. So that should include legal conversation with them.

Right.

Uh, looks like legal's already allocating.

That's good.

Yeah, I would say, uh, Go ahead.

Secure, secure clinical trial data systems seems to be top of mind to me as a CEO. We want to make sure that our IP isn't walking out the door. That's the lifeblood of our company.

So, Jesse, I'm ready for my promotion then, Mr. CEO. I put a lot of resources into that.

Went right to it.

I went right to it. Lock that Sit down.

You know, Wes, you talked about the theory of constraints, and this is really hard because in the beginning parts of an incident, that kind of like adrenaline dump and flood of like, what are we doing? Like, waste a ton of time. And so you see, you have this, should we contact insurance? Should we assess the situation? There's a lot of resources going into those right now, and those aren't done yet.

So, yep.

Yep.

You're having to split your attention, right? So, and, and, and that's the whole point. What Jesse's saying is, look, that's the reason there is such a thing as called an incident command. Commander, right? Because someone has to direct the activities of everybody. So, uh, Elena convened an expanded crisis team including Rebecca Kim from the HR and Claire Oakfort from business development. The overnight analysis revealed that the attacker bypassed standard security measures because Dr. Mitchell's account was one of the legacy accounts that hadn't been migrated to their new multifactor authentication protocol. So they record Yeah, Jordan, some things are becoming less mystifying about this whole thing. HR raised an immediate concern about employee communication as the research staff was asking questions and rumors were beginning to spread about the Aurora 7 trial. Meanwhile, Dr. Hoffman, uh, Medical reported that the principal investigator at Duke Medical Center was now concerned about patient confidentiality and needed to know if they're— if they should notify their institutional review board. So the CEO realized they were dealing with a cascade of stakeholder concerns here. So, Jesse, that could impact not just Novotrials' reputation, but the ability to continue managing critical cancer research at this point, right, that patients desperately needed. So the incident has expanded beyond simple security email incident into something a lot more complex affecting multiple constituency. So how important is a communication plan part of an IR plan and what should be in it? So number one thing you should consider, number one thing everybody should consider, by the way, but go ahead.

I was gonna say, make sure, I mean, somebody mentioned it earlier, but it's, hey, make sure we don't start using the word breach when we're communicating with people.

Yeah.

If somebody calls and asks about it, you just say, not sure, let me, uh, let me check and I'll get somebody to get back to you and or hang up on them.

We did a whole workshop at Write a Boom on communication in IR, and it was so valuable. One of the things I heard back from people is we spend a lot of time on the machinery of IR, meaning the forensics, the response, the SOP. We don't really spend a lot of time on the people side. And that's definitely something that— and the communication side and the soft skills side. And those are things that I'm sure, as Matt can tell you, pretty dang important.

Yeah.

Yeah. Put drama down.

Well, I'll tell you right now, the thing that gets— the thing that I— because I get asked what will get a company in the most trouble during an incident than anything else? What's the more prevalent thing that'll get you in a bind before anything else? 100%, it's your communication. Both when, when I say what should be in it, both your internal communication process and your external communication process. If you don't have those nailed down, you will get your ass handed to you. It, it, it's just a matter of time before somebody says something they shouldn't to the wrong person.

And, and in this incident, now we have Duke Medical Center that's now concerned. So now we have a very well-known medical, uh, organization, university that this is not going to end well at this point.

I can't remember if we have anyone in the role of a comms person per se, but we certainly are concerned about like flow of information internally in the event media reaches out too, because if it goes public, then the time in which we notify, right, per HIPAA violations, is going to impact us as well, right?

Or slap on the wrist. We're about to get into that. You're right about that. And I'm, I'm playing your comms role for you right now as far as allocation is.

Then we're covered.

Okay.

No, because I don't know what the hell I'm doing. So let me ask you this because Jordan, this is right up your alley. What are some tactics for handling rumors during an investigation?

Be intentional about just communicating, right? It's, here's what we know. And like the longer you wait to communicate, the more people will make up a story, right? Like data will leak. Everybody has friends. Everybody has friends in the IT department that realize they're up late working all night. Like somebody's gonna know something and humans fill the void. If you want people to know the right information, you tell them the right information. And if you tell them no information, they'll make it up and tell other people.

So yeah, isn't it funny how they never make up a happy story either? They never make up a unicorn rainbow story, right?

They were just like, yeah, must be the worst. And then because they don't, they don't know the right words, right? Like there's nuance in security. They just use the words they do know. So they're going to say we got hacked and, you know, there was a breach versus there was an event and we're investigating it to understand what happened. People who aren't in incident response don't know the nuance of the words. So you have to teach them the right words to use and parrot basically. And then you're good. Yep. All right.

Another allocation round. We can keep talking.

Oh man.

You picked CEO.

I will say on the comm side, oftentimes the attacker is going to handle that for you. Because a lot of these incidents, we see a ton of sent out emails.

So true. Yeah. Yeah, go ahead. Yeah.

So looks like we need to secure those trial data systems. I think that's still my, my top priority as a CEO. And then the leadership meeting. To assess the situation. Those would be mine as the CEO.

Yeah.

Oh, and securing all the— and securing the critical— the clinical data systems. Those are the 3 that I'm looking at as CEO.

Anyone else? In other words, you're just trying to stop the bleeding. Is that probably a good way to say it?

Yeah, well, that would be it.

You can't— you know, to use a military terminology, you can't begin, um, uh, triage until you stop the bleeding. Right? So there's truth to this.

That's absolutely correct.

The, you know, back to the comms thing, Bob, one thing I encourage people to do, what I see a misstep, I think sometimes is like they publish the entire incident response plan to the entire organization and have everybody sign off on it. And then users have no idea what to do with that. So I really like a separate plan for end users, like an incident guidelines or whatever you want to call it. Where that includes, you know, don't talk to the press. Here's where you send people who have questions. Don't mention it to family members. I'll never forget I had a family member reach out a couple of years back and they're like, hey, you're a cyber guy, right? My buddy's working at this place and it was a big company and they're going through a breach right now and he hasn't heard anything in the last 3 days. And I look and it wasn't even public. And I go, yeah, he shouldn't be talking to them about that.

No communication plan. Yeah. I mean, so Jesse, the advice that I always give people is, look, it needs to be part of your employee handbook. And it needs to already be kind of spelled out that when the organization says, hey, we're putting ourselves in an investigation mode, that in the handbook it says, here's what you can say when we're in investigation mode, here's what you can't say, here's who you route it to if you don't, you know, if someone calls or talks to you. Just something as simple as that could cut that, could cut that down significantly.

Right.

Um, but you gotta have that ahead of time.

Yeah.

And you do need to train on it. It's absolutely right.

And The more hands you have mixing the pot, the more difficult this gets. Because let's be honest, a lot of your just regular day-to-day employees, they don't care about the company enough to where, like, they hear it, they're gonna share it. I don't care if I'm supposed to say it or not, I'm gonna say it anyway. That's a real thing.

Yeah, they need to be— they need to know the ramifications. Exactly right.

We're not touching on the reviewing patient safety. I did add some resources there because I think while it doesn't have reputational points or revenue points, I think it's still gonna come in handy when correctly done HIPAA violations and HIPAA processes.

I would agree.

Since we're in healthcare and all.

Since you're in healthcare and all. The situation escalated— oh, escalated.

Okay.

When Claire received a concerning call from Meridian Life Sciences Fund, Nova Trials' lead investigator, someone had anonymously contacted them with detailed information about the company's cybersecurity problems. And suggested they should investigate their investment. This wasn't, this wasn't random. Someone was systematically trying to damage their reputation with precise knowledge of their investor relationships and their trial portfolio. So meanwhile, legal and the compliance officer, chief compliance officer, had been working with their HIPAA attorney. Funny you should say that, Mac. So there we go. Working with their HIPAA attorney on the legal analysis. The clock was ticking. They had 72 hours to determine if patient notification was required. The legal implications were becoming much more concerning. Finance raised the critical financial implications. The cyber insurance policy had a 48-hour notification, had a 48-hour notification clause.

Oh, snap.

Yeah, but premature reporting could trigger mandatory disclosures that they weren't really ready for. At this point. The team faced con— you got— has now got a complex problem of legal, financial, and reputational risk, and really not at this point have a clear path forward. And all that pressure keeps mounting. So how do you, how do you handle— so this is a question that all of this is going on. How do you handle external pressure during an active investigation? Whether it be, let's say it's an investor or a board that all of a sudden drops in your lap while this is all going on.

Are we 48 hours in?

We're Tuesday, it was Monday. We're getting close.

Yeah.

You know, I would say we're getting close.

We had one overnight already, so we're, we're day 2. Yeah.

But it, it has to do with when, from the time, you know, you were actually breached. So it's, you know, again, we don't have to split the hairs too much, but we're definitely close to the, to the—

Well, I think investors and board members are gonna care about what actually happened. And so not just Is it contained? But have we started forensic analysis to say this is the data that was taken, this isn't what was taken, this is what we've done so far? And so, they're going to care about, is the— has the bleeding stopped? And where are we at in the investigation to determine exactly what happened?

Also, to your point as well, board members have a fiduciary responsibility to the company. And when we talk about this from a healthcare company, they actually have— there are legal requirements on top of them. So they actually have authority and the right to need information to help make the right decisions. An investor actually doesn't unless they happen to have that board seat. And so this is one of those things where you just have to make the very difficult decision sometimes in triage to say, sorry, investor, I will get to you later. You are at the bottom of my priority. But board members do because they have a fiduciary responsibility.

That's a big, big, big deal.

Yeah.

Yeah.

And we're starting to see, you know, negligence and, you know, there's going to come a time when we will see board members held responsible. We actually have seen some of that and CEOs responsible over the past few years for negligence and cyber incidents.

That's going to only increase. You're right about that.

Oh, yeah.

Yeah.

Yeah. You just have to be granite in a lot of ways and just say, hey, listen, I can't help you right now. I, you know, well, there you go, Joshie.

That's the real deal, right?

I love Josh Hovingh's thing about like people working in food service because I waited tables too. And like when it's slammed during rush, it's a similar type of feeling, you know?

Yeah. Yeah. So they, this again, another one of those things. What is the process for coordinating legal compliance and insurance requirements? Because you can see now we've got a bunch of plates in the air, what's kind of a tactic that can be used to coordinate those? Because you, they're all, in some cases they may even have competing, competing motivations at the moment, right? So you gotta have some way of coordinate those.

Well, I think legal and compliance need to take a coffee break together and they need to sit in a room together specifically.

Get them out of the way. Get executives out of the way to go focus on how are we communicating? Who are we working with? What disclosures are we ready to make? Clarity on what the risk is in that 48-hour timer. Is it full forfeiture of insurance? Is it a penalty? Is it like, what is the detail of that? Because, you know, if it's, hey, we're fully forfeiting your insurance policy, uh, that company goes out of business if it goes the wrong way, frankly, right? If it's— you don't meet that clock, if it's, you know, there's a penalty there or some other limited insurance, like knowing what the financial gap is, but continual focus on the getting information and giving the technical team room to keep moving and kind of understanding what the limit is on the insurance side, right? So some insurance policies require known third-party entities to manage the forensics and incident response. Some require that you can do it yourself, but you have different caps. So I think there's questions there. A lot of policies will give you, you know, 1/10 of it if you're using your internal team and the full coverage if you're using a third party. So I mean, is our team at this point really just looking for basic triage of the incident and maybe some isolation activity, or are we actually prepared to move forward? Like, what is the documented incident response plan here?

Yeah. But by the way, that allocation round started, so I'm, you know, You guys know there's no, there's no pause button.

So I think we're trying to juggle between containment and actually doing containment before we've done any investigative work. And then we don't want to report to insurance and or the board until we have enough investigative work completed. So we have more information and visibility because otherwise if it's not contained, then we don't want to enact an actual IR team to go in and pull it apart.

Yeah, it's a very sound financial decision you're making there.

Thank you.

But don't call the cops. No one has invested resources in calling the cops.

I was just going to say, as the CEO and what Wes just said, I want to CYA and make sure I reached out to law enforcement. So I'm going to do one of those.

Chris Lair tells the story of one time an incident he was dealing with before they got brought in, the company called the cops straight away. And no joke, the police came and confiscated all of their server equipment.

Oh, wow.

And they were like, Chris comes in, he's like, are you kidding? They're like, why did you do that? And they said, because they're cops and they asked for it. We gave it to him. He was like, oh no.

I mean, on the upside, it's an easy day for the IR team. All the stuff's gone.

I don't know if it's easy. It's a different day for the IR team. I don't know how easy it is.

Law enforcement's IR team is working.

Who is medical? We just need one to close out the secure clinical trial data systems.

Hey, look at that.

CEO, nice.

And then I'd like to focus on y'all hands.

By the way, if you're medical, and since I know you haven't done it, if you right-click, you can take one of your clicks away and you could put it somewhere else if you wanted to.

Oh, okay.

This is the first time we've had a CEO role actually giving out advice. I love this.

Nice job, Jesse.

Maybe you are a CEO after all.

Thank you.

I will tell you, Jesse's—

and we need to get this all hands on these.

Yeah, remember, we're talking about 4 of these and he knows how to, he knows how to roll now.

So we know how to point our fingers at him though when this goes south.

Yeah, okay, it's a dangerous game.

Yep, moves on, doesn't it? No pause button. So Elena arrived early.

Exhausted Sanjay.

Yeah, to find— yeah, Sanjay exhausted with mix.

So now we're on day 3.

So yeah, morning of day 3. Yeah, they felt that they had successfully contained the immediate threat and were going to implement additional security measures across all the clinical trial system. Funny how that's a uniform sort of a thing, right? However, the bad news was actually kind of really bad. The attacker had been in the system for at at least 3 weeks before the data exfiltration, conducting reconnaissance and mapping their network before identifying high-value targets. So Dr. Hoffman brought additional disturbing intelligence from colleagues at other clinical research organizations. Two other companies had reported similar intrusions in the past month, all targeting oncology trials with the same precision and speeds. The realization is they weren't dealing with an opportunistic cyber criminal, but it looks like an organized corporate espionage targeting the clinical research industry in general. So Marcus Lee's— yeah, Marcus Lee's COO raised some critical operational concerns. They had 14 active trials running that could be impacted if they couldn't demonstrate improved data integrity, affecting all 3,000 patients whose treatment could be delayed. The incident had evolved from a security incident into a potential threat to patient care and medical research continuity. How do you manage the stress and fatigue during an incident?

So that's a real one, right? Liquor? Like from a human perspective, we're on day 3. You have to start paying attention to rotating engineers. They're gonna start missing stuff if they're too tired. You have to start making sure people are fed, watered, and bathed. Like, just general human stuff starts kicking in after that first 24 to 48 hours. Like a lot of people will push through that first 24 if they need to, but by day 2 you're making mistakes. So you gotta start forcing people to go to bed and get offline and get people in to cover it. And communication from the, like the incident commander has to ramp up. When are check-ins? When are, what are the tasks? So a lot more task management has to start coming in and like as it gets this late into it, it's a lot more asynchronous. We're probably not all sitting on a bridge for, Hours 48 through 72, like the first 24, were probably a bit more task-based and broken up and, and just checking in in an irregular interval.

Yep.

Anybody else on that one? Because this is a big subject.

One thing I teach all my techs to do is to breathe. There's a right way to breathe, the wrong way to breathe. And I, as an aside, I own a martial arts school as well. So breathing is a very important piece of that as well. And so I go over that in our monthly meetings. We spend 2, 3 minutes at the end of each monthly meeting with my techs going, all right, we're going to practice breathing. Because when you get stressed or when something bad is happening externally, the only thing you can control is your breathing. And if you're able to keep that going and keep yourself nice and calm, in that aspect, everything else just falls into place. So from this perspective, as we're going through all these, it's gonna be, hey guys, remember, remember to breathe and to breathe correctly. Not those shallow chest breaths, but those nice big belly breaths. And that makes a big difference. All right.

So what information should you share with industry peers if you got something like this going on and this is an ongoing threat? Mac, I'd be interested to know what you think on this one for sure.

I mean, definitely the two other companies reporting similar intrusions I think are important contacts to have. And I would squeeze in my legal rep to have some sort of MDA in process to sit down with them and exchange what information they can exchange because there's probably going to be similar attack paths if they are targeted all the same way. And that information can you can go over to the IR team internally to verify all compromised systems and accounts and if there's any other way they're getting in. Also, this does help reputationally a bit because then it looks like a larger espionage-based incident. But we probably want to bring up to future thought is any sort of class action lawsuits and things that come on just past even the HIPAA HIPAA fine, there could be larger legal implications since there are more companies involved.

And also, given the apparent sophistication and potential nation-state, we're not ready for that yet, but it looks like we're going that direction. That also changes the involvement of the federal government too.

Yes. Now we might want to actually call the cops.

Yeah, I'm glad I reached out.

Yeah.

Well, no one— so let me ask this question while you guys are allocating. How do you know which— so how should you determine what sequence you should call law enforcement in, right? Because there are different levels of law enforcement for different tasks. You know, one of your incident response responsibilities is to figure out which organization you need to call and when for wherever you live, right?

Right?

Give you an example. Sometimes if it's a business email compromise and money's involved, you're gonna want to get to the FBI as soon as you can. But sometimes your regional FBI office requires you to open up a local law enforcement report before it can get relayed to them. Sometimes they don't. So knowing who to call and when is a big deal for sure. All right, Jesse.

Um, all right, so there's—

feeling, it's feeling real, isn't it, Jess?

Lot of things on this list. Um, I think the all hands to go there— oh, that's legal, sorry. If we get legal to throw their, their 3, throw 3 on that, that'd be great. Um, and I, I mean, I always want to go to clients.

We have this Go ahead.

I was just saying I hit up the work with insurance and IR team because we definitely have surpassed the 48-hour thing. I don't think there's a notify, right? Am I missing the notify insurance? That's the only insurance one I see.

Not yet. Yeah, I missed it.

Wait, so we're past 48 hours. We definitely should have our forensics back from Petra by now, right?

Lincoln, I was going to bring this up. Yeah, at some point. Keep going, Jesse.

We have the work with IR team to determine data access. It looks like we can close that one out from tech, tech and medical.

I've got two on tech.

Would you like me to reallocate?

What's the other one on?

Deploy and configure intrusion detection system. I got two on that as well.

Yeah, let's, let's pull those for right now. Okay. And, uh, if we— the client relationship management outreach, because they said they're going to pull those trials and that could affect patient data, patient health, as well as just our reputation. So if we can get comms to help me on that, we can close that one out right now and nip that in the bud.

For tech, I've reallocated 3 to the forensic analysis and 3 to the work work with our team.

Beautiful.

All right, Jesse, what'd you say your comms— what was the second? What was the one you wanted layered on?

Uh, client relationship management outreach. Second from the bottom.

Got you covered.

All right.

I put one—

get all—

I did, I did one comms on file HIPAA breach notification because it only needed one to close it out. Do you want me to—

one to close it?

Yep. Yep.

Looks good to me.

Legal, legal's already allocated to the other one. So maybe, maybe just— yeah, legal's already allocated to that. So maybe just move those all to client relationship management.

Yep. Very good.

Management outreach and hit it on the next one. I'm taking a risk here, by the way.

Look, that's how it actually— that's how it actually works though, right? I mean, that's the situation you're in when you're trying to make these decisions on the fly. You have to use your best judgment, right? So that's just how it works.

So we still got 2 available for legal.

Yeah, where should I put it?

Yeah, Jesse, that's—

you go with, uh, Let's go with conduct forensic analysis.

Mm-hmm.

That'll get us close at least on that.

Nope.

Nope. Nope. Ah, the break, the, the breakthrough came from Maya Chin, chief science officer, scientific officer, um, who had been analyzing the pattern of data access during the breach. The attackers hadn't stolen random information. They had specifically targeted the Nova trials adapted trial design —biostatistical methodologies, suggesting they understood the competitive value of that particular intellectual property and proprietary approaches to the clinical trials. So they were very targeted in what they were after, it looks like. Sanjay added a technical dimension that made the situation a little bit more concerning. The attacker had modified— oh, the attacker had modified Dr. Mitchell's email configuration to add suspicious domains to her safe sender list. Exploiting their phishing simulating training infrastructure to pull this off. They had turned Novotril's own security training against them by making malicious domains look like legitimate training domains from the vendor.

That is really impressive. Never came up with that, Bob.

Well, now that you mention it, this actually came from Petra Security. So this actually happened. And what they did is they added malicious domain. They got into the training. They actually got into the training, phishing training system, got in through that mechanism. So that tells you a little bit more, Jordan, about what happened. They were able to kind of get into that because it wasn't MFA, right, for this particular account. And then they added these domains to the training simulator to be valid domains because you know how this, you know how phishing training works, right? You make these fictitious domains that are okay. That get passed through, and they use that to get things out. Wow. That is really cool. That is, that is a real thing. That is not Uncle Bob making shit up. That is literally a real thing. And that was Petra Security that actually diagnosed this and contributed that. So, so the team realized they were with some adversaries who understood both the clinical research and the advanced cybersecurity tactics, obviously. And that sophistication, uh, that sophisticated attack suggested advanced persistent threat actors with specific knowledge of their business and operations and security infrastructure.

So, or the insider threat, like I mentioned earlier.

Well, we have not, we have not, to your point, Jordan, that is exactly the right kind of questions. Like, wow, that seems like an awful lot of information. Yeah. For somebody to pick up by looking through the keyhole from outside of building.

So maybe Sarah should have got that raise she asked for. Yeah. Or, yeah.

Or, or me, or, yeah. Or maybe the janitor was looking under keyboards and found passwords or something, right? Something. So how do you, how do you protect intellectual property when you've got things like these cybersecurity threats? Do, do you treat those differently or? Absolutely. Go ahead, Matt, because I knew you, I knew you would have an opinion on that, right? I mean, how would you, Given from a practical standpoint, if you've got intellectual property, what would be the right kind of property?

I would just put in a full zero-trust model, have it in its own segmented location, have the most amount of access controls you can apply and least privileged attached to it, have some sort of internal monitoring on every time it is accessed or data's moved, and, you know, have really an independent monitoring process put on top of it entirely.

I'd be curious who the data is being shared with also, right? Like, I don't imagine they're, they're doing a study in isolation. So the data is probably being shared with a lab somewhere or a statistical analysis group or, or something. So what are the mechanisms that that data is being shared? Who knows that the study is even going on? I mean, we're working with, you know, Duke University clearly had information. They, they were aware. There's investment groups that are backing it. So, like, what amount of data is being sent out intentionally, and is that leaving an opening for somebody to come in and get more or to learn about all this stuff? Like, the bypass, like, the using the security awareness training platform, that's pretty easy. That's like most of them are like TXT records and DNS at this point that say, "Hey, I've authorized your domain via this very public methodology." So learning things like MFA methodologies and phishing attacks phishing awareness and all that, because so many people are using public TXT records now to validate domain ownership, it's really easy to understand what tools a lot of organizations are using. But the actual data familiarity is, like somebody mentioned, nation-state, that's usually the, that kind of attacker. I mean, yeah, it's gonna be obviously an APT, but that's a lot of very specific knowledge to understand how to pull the right stuff out of what, to most people is probably just big scary data, right? Like, I wouldn't know what data mattered in that situation.

Jesse, you're up. All right.

All right, team.

Oh, now we're a team. Y'all are serving me now, so.

So yeah, let's close out the forensic analysis. Then we can know exactly what happened and working out and with the IR team to determine the deck time. Past that, let's close out their client relationship management outreach.

So you need legal on that conduct forensic analysis so that you need legal on that one, right? To close it out. Yeah.

Legal on the forensic analysis. And then I think, well, gosh, we're, we're about to. Yeah, you know what, because we don't know, you know what, as CEO, I can, I'm going to work with general counsel to say I legally wasn't 100% sure there was a breach until the forensic analysis was completed. So I can defend that in court.

So that's what we're going to stick with. All right. I, what else? Oh, yes. So communications-wise, I finished the client relationship management outreach. Because that was a priority last time. Then what do you want comms on next?

Yeah, let's see here. Comms.

Uh, at what point do we care about our investors?

I was just gonna say, I would say at some point when the flames aren't licking the ceiling is when I would start worrying about them. Yeah, yeah, sure. Any minute now, I think.

I think, yeah, that the comms plan For sure, communication plan. All right. Oh, now we gotta— now we got this brief pharmaceutical clients and security measures one. That's the one probably that's gonna get us, isn't it, Bob?

Uh, I also love that so far we haven't even talked to our employees yet.

Where is that? Very top.

Oh, that's the all hands, isn't it? Yeah. Oh, the all hands. Oh yeah. Oh, we have worked on it.

Sorry, I think when I saw it, I just saw the red at the— well, it ain't finished. Point. Lots of people have worked on it, but if we can—

the legal group for the norm has concerns.

We can close out review patient.

I mean, are we allowed to reallocate some of our resources Yes, you can.

You can right-click. You can right-click on your item. Yes. Yes. Yes. You can move them. Yeah. 100%.

Yeah. I do think we need to get that all handcrafted at this point. We're 3 days in.

Yeah. Yeah. Agreed.

So when do we want to—

If there's anyone that has anything left. So I, I have—

If anyone has anything left, I would say go for it.

I have 3 medical left, but I'm kind of torn on which way we want to go with it.

Do we want to— There's 51 seconds to figure that out. So I would dump— We should—

Patient safety monitoring.

Yeah, you can do that second one.

We've already put— What about continuing work?

We're trying to keep these contracts in place.

IR team. Yeah, we need to close out some of that IR stuff.

Yeah, I got, I got that one too.

So Oh no, he's got that one. He's got one allocated there. Yeah.

Let's file the HIPAA notification.

Yep. Correct.

Yes. 18 seconds.

All right. That's right.

Sign in if you haven't.

Yeah. Looks like everybody's allocated except the CEO. I guess because, um, Jesse, I don't know if you been allocated. CEO has worked with insurance.

IR team left. Boom. Wait, we're done. 28 seconds.

Oh, well. That's the problem with being a CEO. Not only you gotta give direction, you gotta actually jump in too. So, so Elena called an all hands meeting.

I think I sent one or two.

Yeah. All hands meeting to address growing employee concerns and rumors circulating throughout the company and the tight-knit clinical research community in the leadership team needed to be transparent with their staff while protecting the investigation, recognizing that employees were both their first line of defense and potential targets for social engineering attacks. So during the meeting, Dr. Hoffman addressed patient safety concerns, explaining that the primary obligation was to protect that patient data and ensure trial integrity while all the safety monitoring continued without interruption. However, several employees raised concerns about their personal devices and home networks, especially those working on the company's decentralized trial platform, Nobusphere. That sounds like a really cool piece of software, decentralized. Rebecca, HR, had prepared talking points that balanced honesty with operational security, acknowledging the incident and explaining protective steps without providing details that could compromise the investigation. The challenge was maintaining transparency while ensuring employees didn't inadvertently provide information to potential attackers. So what are some of the best practices to help educate employees about security threats in general?

Well, clearly not the security awareness training infrastructure.

Well, the phishing, I would say the phishing training might be suspect. I'm just saying that that's a possibility.

You're like, we want you to do the training, but also it's been compromised.

I think the spirit of what you were trying to accomplish was, you know, was there, but I mean, apparently the mechanism had a flaw. But yeah, what's some other ways to do that? What are other ways to do it?

We're doing one right now. Small.

I think connecting it back from security threats to the whole backbone of healthcare and patient safety and intention, even though they're probably gonna think more of the overlord board members and investors, but, you know, that security directly ties to the full CIA triad for healthcare, for a hospital, and for the patients that they serve. So, it applies to all employees and the importance of their job.

Yep.

You know, this just occurred to me, Bob, and it's probably something you're working on, but it would be awesome to do IR, little mini IR games for employees, like, oh, an attacker got access to your, sim swap and got your bank account and you, do you tell your friends and family they got access to your health insurance? And they would understand all this is what a breach does. I don't know, it'd be kind of cool.

We've got it. Well, we can talk about that later. We've got a blitz that we actually do that with. All right, so what additional protections are needed for employees working remotely? Remember, they're working on a decentralized trial platform. Yeah, right.

MFA accounts, apparently.

I like what Max said about the ZTNA. Yeah.

Yeah, it needs to be something more than standard MFA, right? I mean, if it's something that— especially with a medical organization, you can't just leave it at VPNs and MFA. MFA tokens are too easy to get ripped off.

It's just— yeah, some IP whitelisting, some conditional access policies. Investing in some stricter ITDR detections.

Personal devices.

Is there a MAM policy? Yeah, even going back to the old school, you know, having certificates registered with MAC addresses. I mean, there's lots of ways to do this. It's not like impossible to do. You just have to be— you can't do what comes off the shelf. You're going to have to— Yeah, someone in the chat mentioned asset management. It's like knowing what you, you can't, you can't protect what you don't know. Yeah. This sounds like a mess. Yep. Yeah. So how do you handle media inquiries while an investigation's ongoing?

It's really easy. You say, hey, here's my public, my PR person, and they handle it.

Yeah.

Legal prepares a statement of what we can say and what we can't say, and then the PR manager handles any outreach inbound and outbound.

And cyber insurers often provide that at this point, depending on the policy. So if your organization doesn't have one, they will usually assign like a crisis manager or some type of communication manager for you to sort of validate that. So it's one of those parts of IR planning is understanding what exactly do you get from a resourcing out of your cyber policy? Because most businesses are— most smaller businesses especially aren't going to have a a comms person and a PR person, and their legal is going to be a third party. So there's delays there. But checking in with your provider is— and knowing what resources they give you helps speed up a lot of this stuff.

I think making sure we're also still talking to those other companies that are correlated back to this breach. Yeah. Attribution across all of them, then there's, you know, more to be able to protect and keep locked down information-wise.

And to your point earlier, right, like sharing of IOCs is really important. Like, if they did an investigation and they were able to find, you know, specific tools that were there with a dwell time of 3 weeks, somebody had a lot of time to do stuff. And we know they're a sophisticated attacker, so they're probably not clumsily, like, installing TeamViewer somewhere. They're probably, you know, living on the LAN. They're doing something that has probably been able to silently discover for 3 weeks. You know, it's where it's a mature organization. There's probably legitimate security controls in place. So the simple attacks probably would have been stopped. I'd be very— yeah. So I mean, figuring out what they previously would be good.

Yeah. We've got to assign our roles here, folks.

Yeah, go for it.

The, the investor communication plan can be closed out. Okay, so let's see. Comms and finance on that.

Yeah, there you go.

That's good. Medical. Where? Where is medical? Medical is—

we have pharmaceutical clients on security measures as an open one.

Still have The HIPAA breach notification, does that—

that's, that's, yeah, that's one that should happen for sure.

60 days for that though. I would not be worried about that ahead of other ones currently.

Oh, okay. What about notify principal investigators and research sites?

That is probably worthwhile because you want people reporting any suspicious activity pretty quickly. So if they're noticing any other activity, data movement, data change that we haven't already caught. Like, we found one source of exfiltration, but we don't know that there's not others. Yeah, anybody touching that data is probably something we need.

Yeah. I think— I think from a suitable client, so that can wait a minute.

That's the one I thought was most important, because isn't that the one that said they won't continue the trials if we don't— Can't prove integrity of our data.

Smart.

I think you're right. So let me take one away from here and put two up there.

Yeah.

I'm just gonna throw out a general principle for folks, cuz so we, when we, if we're running outta time and you're not clear, I think the first thing that you can do is look at if there's anything you can close out.

Yep.

With, with, uh, ease, send it to those, right? That's just as in my role as CEO, so we can get in, so we can get a little more decentralized with our work.

Yeah. Completing tasks is critical. There's less juggling, less administrative overhead to managing tasks, like in real life, right? Close out tasks so there's less tasks to track, and that makes you faster just in general.

Yeah. Yeah. Yeah. I, I can tell you Uncle Bob's rule. Don't leave anybody in the resource line if there's someplace to put them.

Yeah. Regardless. So yeah, everyone just send it, I guess.

Yeah. Right.

Legal, if you have any, free legal ones.

Oh, you already got it. Everyone. There's your—

you got, yeah, you got, you got what, you got what I was going to ask for. So perfect.

You good? Looks good.

HR's got one, but they might be all used.

They may be where they need to be.

Yeah, I know they're not. Update incident response procedures.

3, 2, 1. Technical investigator reached a critical breakthrough. Work with external forensic specialist. Trace the sophisticated email configuration changes that enabled the phishing campaign the attacker had used. Dr. Mitchell's compromised account to add those malicious domains. Oh, so that implies that they went in and did that after they got in. So that's interesting. So they compromised the account to add those malicious domains. So they recognized that after they were inside of the WireMac. That's interesting, isn't it? So alongside legitimate phishing simulation domains and created a perfect cover for security tools couldn't distinguish from the authorized training emails. So that's what they did when they got in. They found out, oh, these people use a phishing training mechanism. Ah, that means they probably have a whitelisted domain list that I could stick stuff in. Let's look at their email configuration and took that path so that emails going out then wouldn't get picked up by any of the EDRs or anything. Luis Hernandez identified serious vendor management implications. They're phishing simulation provider, obviously. Cyber Cyberware training solutions manage these domains lists for multiple clients, including NOVA trials. Oh, so that throws another curveball in there. Yeah. Okay. The attacker. Yeah. If the attacker's compromised the vendor's infrastructure, this could impact dozens of other organizations.

Oh snap. It's a supply chain attack now.

Yeah.

The attack method suggested the threat actor checkmark of using an MSP.

It had intimate knowledge of their security training system. So, okay. Anyway, so that was the best decision they made.

Yeah. Claire.

Claire identified the immediate business impact. 3 major pharmaceutical clients had registered detailed security briefings— had requested, sorry, not registered— had requested detailed security briefings before signing new contracts. In other words, they were not going to sign them until they had some detailed security briefings as their reputation for data protection was directly tied to their ability to win new business. The team realized they needed to expand their response beyond NOVA trials to include some industry-wide coordination and vendor security assessments.

Yeah.

How do you coordinate with vendors when their infrastructure enables attacks against your organization? I can't wait to hear what you got to say on this subject. Yeah.

When their infrastructure enables attacks against your org. Yeah. Yeah. It's almost like a disclosure process, but in reverse. Yeah. Unfortunately.

Yeah, this gets pretty complex, right? Because, I mean, you're using them as— and sometimes it's a vendor you just can't get rid of. That's not an option.

I think if we're already working with law enforcement, I assume since we're putting resources to it, that would be a good option as well as having law enforcement reach out to them and say, hey, ongoing investigation between these victim organizations, we believe you might— you may be the source. Because I feel like if we have our lawyers send something to them, they might say kick rocks, this is a little bit too reputational. Yeah, I see. Yeah, yeah.

The other issue is like a lot of organizations don't have an easy way to escalate real problems like this via a standard support channel. Like if you, and we've dealt with it with vendors before where we've had to contact them and say, "Hey, your tool is being, it has a vulnerability. We need you to help us investigate this because there's an active incident." The help desk on their side does not have an SOP for, If someone calls and says our tool has been compromised, do this kind of escalation. So you just have to really hope you get to somebody that works actually for the company and has the ability to escalate or talks to them or you find another path. But to Max's point, like, good luck on a weekend, after hours, on a holiday when most of these breaches take place.

Oh yeah. It is Thursday afternoon. Yeah, I would definitely check and see if they have some sort of disclosure disclosure policy on their website, and then that may have at least some sort of contact if you can't leverage law enforcement.

Yeah, yeah. I've been, um, I've been watching the chat, and Jeremy was bringing up— he was bringing up the, the kind of an important thing since this was an email, since this is inside of the email wire, you know. He was bringing up the fact that maybe you need some out-of-band communication, right? Because anything that you're sending via email is obviously susceptible to people tracking it, right? So he's making a good point that, you know, you should also have, you should have an out-of-band way of communicating. I mean, you know, lots of examples. You could use Google Chat, you could use Signal. As far as I'm concerned, if Signal's good enough to launch an attack on another country, it's probably good enough for this. So I mean, I don't wanna use that. Go ahead, Jesse.

Well, I was just going to say, especially in pharma, you— this— I think this— our company is what's considered a contract research organization, right? We're doing research for other pharmaceutical companies. The one piece of leverage we have is that it's really hard to change those relationships, meaning it takes years to switch. So, uh, I think to me as a CEO, current customers are kind of locked in.

Sure, they have some side cost in their whole business, is more problems for—

I'd— as a—

yeah, yeah, I would say that. I, I can understand the logic around that. I mean, and what, Jesse, what you're really saying is that every business has levers, right? And there are certain levers that, that, that are— that, right? That are, they're gonna be different. They're all like snowflakes. Every company's a snowflake. So depending on the levers for that company, like you just said, you made a judgment call going, well, you know what? But this is a long lead time item. So maybe it takes less precedent over something that's a lot more close and, you know, close into the chest. Like you said, getting, getting whatever business that was in the pipeline on the books may take precedent over trying to go back and make sure you, because you're gonna have time to get that trust back. With the existing customers. But, but right now you need to be worried about making sure that you continue business, right? So I can see what— by the way, it doesn't matter whether you're a pharmaceutical company, you could be any kind of company. The point being is you need to know what your main levers are for your organization and understand, and this goes back to a business risk analysis, right? You need to know how to do that. You need to know what the, the critical things are. Go ahead, Jesse.

No, I was just going to say we're in assignment mode. So if anyone has questions, I think, yeah, I'm, I'm putting my time into establishing secure communication channels with law enforcement because it seems like at this point it is a nation-state sophisticated coordinated effort. We could probably benefit from any threat intelligence they may be able to share with us.

So I was going to ask—

legal has a couple they want to throw at that.

That'd be great.

Like, yeah, for a couple at that as well, and trying to close out the HIPAA breach notification so we don't get in trouble for not—

so, Matt, Matt, what I would tell you on that one is that you, you don't have a task in that established secure communications with law enforcement.

I don't think I have any tasks left.

Okay, well then, then your, your job is done, right? Then you can put it wherever you want. Yeah.

Oh, I don't want to review and update vendor contracts. Vendor.

You know what, I don't know anybody who ever does.

As part of the answer, do I win?

I feel like I'm more concerned about the HIPAA breach.

I, by the way, good point, you know, do vendor contracts, you know, I, this is kicking the top off a big ant bed, right? But I mean, you know, do your vendor contracts need to be reviewed? In the case of somebody like a supplier that has a third-party compromise. Just gonna— I'm gonna leave that. We're missing just one.

Oh, I see what you're saying. All right, I'll look in a little bit then.

45 seconds.

I don't remember, did we have any kind of ransom note or extortion note or any of that stuff?

Not at all. All they did, they got in and then, you know, then they Apparently someone made a call and said, hey, you should go investigate your investment. You know, but you know what that sounded like to me? It sounded like a diversion.

I mean, maybe, but like, so I'm just thinking back through, like the game called out specifically that the data was stolen, had competitive advantage. And that doesn't say nation state. That says somebody understands what's of value. And if they were going to do double extortion, they wouldn't want that released. So if you weren't going to pay the ransom, releasing that data would also have the you know, like just as a competing hypothesis. What if instead of nations— because nation states want information and influence, there's not a lot of influence in the data that got stolen. There is financial, uh, advantage. And so the two things that you, you get there are a competitor steals it directly and gets direct advantage from the information, or an attacker who has a financial motive steals it and threatens to release it to your competitor that causes damage, so you pay up to whatever that damage is worth. Like thinking through attacker profiles, nation state doesn't really fit.

Hmm.

Hmm. The only counter I would say to that is that especially China loves to steal pharma and— So that's IPs.

So yeah. Yeah. But why wouldn't they steal the rest then? Like if like it was a very specific data set though. I mean, I guess for anything, but you're right. There are nation states would have value there. But it doesn't seem like financial motive beyond— like, they didn't steal patient— I mean, they stole patient records, but they stole statistical analysis of the data. They didn't steal—

right. They got the patient data because it was part of the trial data, which they needed to validate that the trial was doing something, right? So that's, that's why they got the— they didn't— so they weren't after the patient data. They were after the trial data. That's what they were after.

Yeah. And that's, that's competitive motive. That's financial motive. That's not information motive. And So nation-state is always information or influence, or usually.

Yeah, I mean, they just, they just made a big-ass mess. Right.

We need to start looking at all our contractors and where our manufacturing facilities might be coming from. Yeah.

Or just traditional ransomware gang that hits this vertical. But it's not ransomware, it's extortion.

So yeah, I feel like, I don't know if it could be, it's smells like APT, but also I see what you're saying. Like, it does feel—

I need to give you guys this information. Am I sharing my screen still?

No, it died on us. Okay.

All right. All right.

I'll, I'll get it. I'll try to get it back. It did, it did a, it did a hiccup. So yeah. Here we go. I'm back. Uh, as the week drew to a close, uh, Elena reflected on the complexity of the modern security threats, cybersecurity threats, recognizing that the un— They had uncovered not just technical vulnerabilities, but systematic challenges in protecting their sensitive data. So Sanjay reported successful containment of the immediate threat with all the email configurations reset, mandatory multi-factor authentication implemented, and real-time monitoring of configuration changes established. That, that's useful. That would have been good. Dr. Hoffman provided the regulatory update that they had filed the required incident notifications to the Department of Health and Human Services. Under 500, that's a win. Yeah, based on their approximate— yeah, their analysis, approximately 230 patients had their protected health information potentially exposed. The legal obligations were being met, but the long-term implications, you know, were still going to have to be assessed. So finance reviewed the impact. Their cyber insurance would cover most of the response costs, but they face significant investment in enhanced security measures and potential client remediation expenses. The team began planning for some long-term recovery since they at least were contained and, and, you know, getting to the end of that sequence and, and the immediate, the remediation. Oh, what are you doing to me? Oh yeah. I can tell.

I can read the question if you want, Bob.

Go ahead, please. Please go right ahead.

All right. I love this question, by the way. How do you measure the success of an incident response effort?

It's like, hmm, I don't know, maybe.

Yeah, lack of fistfights. No, um, I think if you're allowed to, if you can complete the incident with sufficient answers, it was generally a good response. Like, yeah, it meant you had the tooling in place to get you the data you needed to do the response. If, if the entirety of the incident response is, "We don't have logs for that," is not a very sufficient and successful incident response.

I think clear role processes were executed. I think everyone knew exactly what their job was so they could save time putting, you know, resources, how this game's designed, towards what their role is as fast as possible.

Jesse, can you share your screen? 'Cause give Jesse the ability to share your screen. Yeah, hang on, let me do that. 'Cause I don't know what's going on with mine all of a sudden.

Screen, Chrome tab. Actually, I'm just going to do window share.

All right, you guys got it? Yep. Yep. Yeah. Yep.

Yeah, I think I like what Max said there, like the fact, like the chaos quotient. What's the chaos quotient? It was, if it was lower and the company, if the company can recover in less than a year, I think that's a pretty successful incident response. I'm reading this. I mean, all things considered, I consider that reasonably successful, right? Yeah.

Yep. Exactly. Uh, what? Go ahead.

I'm going to say it's important to measure, like if you're measuring incident response to not get that confused with the security itself that was in place, right? Like you can't judge incident response by saying it was bad 'cause there was an incident. Like you're judging, you can judge the security and, and do lessons learned there, but you have to separate the two, right? Like they're, they're different tasks, different people typically. So if you're measuring incident response, don't assume that, I mean, there was an incident, that's the de facto if you're measuring the response.

So. Yeah. So what, go ahead there.

Cause I think that is a big thing. Uh, success marker of these attacks is do they happen again? Right. Is you never want an incident, but that lessons learned step should inform the full cycle back into how are we hardening our network to make it not happen again?

Yep. That's good. Yeah. So what changes are needed to prevent something similar like this happening again?

Third-party risk management.

Yeah, I mean, that's true, right? Understanding the security profile of somebody that you're doing business with, for sure.

Did we find what the root cause of the credential leak was?

No, we have not yet. You know, not exactly.

Like, third-party risk management, yes, but the third party was used because somebody had already broken in.

Like, Like, and that account had no MFA on it. It was a legacy account. So you have configuration standard minimums here.

That's the real issue. It's like the root cause here was a legacy account with no basic security implemented on it that also had access to make changes to a system. Like, given that circumstance, any vendor would have been in a bad spot, right? That wasn't a vendor problem. That was an internal access control problem and separation of duties problem, probably. Probably in, uh, configuration management problem and audit problem.

And yeah, just it turned out later that the, you know, that whoever, somebody had got into those vendor systems as well and was working this magic on other people. So, you know, when you got something this sophisticated going on, you just can't tell, right? I think that's the real point is that when you got this much different telemetry coming in, it's very difficult to tell exact. You're not always going to know exactly what the hell happened. You know, really? Yeah. Yeah.

What, Bob, can you help me with the employee morale and productivity?

I could if I could, you know.

Oh, you don't have your thing. That's right. Yeah.

Well, I'm going to see if I could get it back.

Yeah. How the game has random injects. I think we've had an inject that kicked Bob's roll.

Yeah. Yeah. Comms quit. Like, we were—

Bob had enough. One that I am very sensitive about too. By the way. Okay, I got it running again. I'll get it back on. We need some comms, basically. Yeah, I'm coming. 40 seconds, see if I can get it done. No pressure. All right, which line are we after? Address employee morale, I believe. Okay. Yep. 23 seconds. All right. Okay. I loaded in there. I got it.

We still got 4 legal left and 1 med.

4 legal. Legal, go. Legal, hit that all hands security briefing. Then we'll be, we'll be done with that. That'll help the employee morale as well.

We finally talked to them.

Listen, as CEO, we're—

as CEO, CEO. All right, Friday afternoon, let them eat cake.

He just had to break the news.

The final crisis team meeting focused on lessons learned for future preparedness. Alaina, the CEO, addressed the group with a mixture of exhaustion and determination. Uh, you feeling exhausted, Jesse? You feeling— I think you're probably exhausted. Uh, she, she emphasized that they weren't just a clinical research organization but custodians of sensitive patient data and valuable intellectual property in an increasingly dangerous digital environment that fundamentally changes, uh, has to change their approach. Dr. Jin— Dr. Chen presented the research continuity assessment. All 14 active trials remained on schedule. That was good. With maintained patient safety and data integrity throughout the incident, while therapeutic development programs continue without interruption. Rebecca from HR noted that the staff confidence had actually increased due to the transparent communications and decisive response, with several employees volunteering for, volunteering for additional cybersecurity training. That's when you know you've done something right, HR. So that's a good job. Marcus raised the need for operational transformation. They needed to redesign business processes to assume sophisticated attackers would target them, making security an integral part of everything they did rather than an afterthought. So the team committed to emerging from this crisis stronger more secure organization, better prepared to protect patients who depend on their research. So how do you transform a security incident into an organizational improvement? Yeah, it's a good question. Well, I'll call out an easy one here.

The attacker was in here for 3 weeks, right? Yeah. That is an absurd dwell time.

I know it's an advanced persistent threat or or whatever we want to call it. It's really not though. Yeah, that's what I was going to say. I was going to let Mac talk about that a little bit too. Go ahead, go ahead, keep going though.

Yes, they were in for 3 weeks. I mean, they, they didn't do a lot of that. I mean, they didn't compromise a lot of systems. They didn't make a lot of noise from what I'm gathering so far. Um, they— it's— if it is supply chain, then they— it's pretty sophisticated. So 3 weeks, especially if it's targeted like this, that's, that's not bad at all, in my opinion. It's not bad if it is targeted. If we do determine it's nation state or attribute it to an APT, then, you know, they want to stay quiet. They want to get a, like, maintain persistence. Especially if it's coming from a competitive nation state group, then they may want to maintain persistence as long as possible, and they did it in a really intelligent way.

Yeah. The, the way I've reading and reading through this and going through it, and because again, it was new to me, you know, until we had a conversation with Lincoln and Petra, the, the interesting thing about this was it hit more than one organization pretty much at the same time. So it was coordinated, right? And they were after some very specific things. I was, I was actually pretty impressed that it only took 'em 3 weeks to get in there. Make their observations, and then, then in one lightning strike, kind of do it, and within sort of a very short period of time, do the snatch and grab and get what they wanted and get out of there, right? That was, um, which, you know, that's a very sophisticated, coordinated, planned thing. So I think that lends to Matt— what Matt's talking about is this: they knew what they were doing, and they knew how not to make a lot of noise, you know what I mean, and how to be very quiet. But I think the better, bigger question is, is On average, and Mac, I'd be interested to know this answer. On average, what's the average dwell time now compared to what, you know, I mean, just an average nowadays? Oh, average dwell time.

I think we're looking at like under 24 hours. It's definitely shifted. But again, it depends on the threat actor. So, oh, there's, you know, you still see things like initial access brokers and people, it's not considered dwell time. No, that's right. But it, it does constitute a little bit as maintaining access and a foothold in an environment long-term.

Yeah. Yeah. I think that's the thing everybody needs to understand and why doing exercises like this matter so much now is because with automation and AI, the amount of time it takes for them to get in and compromise something and get out has dropped sharply, just like Matt was talking about. So you're, you're not gonna, the tools have a hard time keeping up with that. So the only thing that's gonna make you more resilient is that you're trained on spotting and responding, you know, right? Especially ransomware operations.

I mean, they can get a lot done in 6 hours if it's targeted and they know what they're doing. Mm-hmm. They, so the more, the whole like concept of defense in depth sort of applies to that because it's not there to completely mitigate, but it is there to stop. Slow them down and give them the gaps that they're going to meet eventually.

And set up little wires for them to set off alarm bells, right? Like, the more things they have to guess their way through, they're just bound to make a mistake by chance versus, like, it goes back to familiarity. If, you know, if you're using an EDR that everybody else uses, they probably have a great way to use that EDR. They might know a bunch of familiar firewalls, but, you know, there's, if you have 10 layers, there's infinite combinations of that. Maybe the attacker doesn't know all the combinations. They know 3 or 4 of them really well and they get tripped up on the 5th. So yeah.

All right, Jesse.

Yeah, I'd like to see that all-hands security briefing get closed out if we could by legal.

So that's legal. Need to drop 3 on that line. Legal.

Rotate passwords and enable MFA, I think, is a great step for technical to hit. We just need 1 or 2 on that from technical. And then you could drop your remaining resources to reset and audit all email configurations. So that's a good idea.

Got 2 on rotate already. And let's see, where's the reset?

Where is that? About halfway down here. Mm.

Yep, and I got 2 on that too. So that should close it out.

Comms. Comms, if you can hit the— oh wait, where is it? Oh yeah, and principal investigators and research sites. Legal, if you can put your remaining resources on that research sites one at the bottom.

Principal, principal.

And then finance looks like you have IR counsel. You can close that one out. Okay. And also the financial impact report.

So for medical, I— the only thing I had left was the Kappa. I threw all 4 at that that I had remaining. Perfect. But guys, I do have to— off and go to my 2:30 meeting. But this is a lot of fun. I thank you, everybody.

Thanks, Nick.

Nick, you killed it, man.

Thank you, dude. Thanks. Thank you. Absolutely.

Appreciate it. All right, bye, everybody. See ya.

Have a good Friday.

Medical's left the room.

We don't have I can do it. I can do it for them anyway.

In the medical investigation. I've listened to a few podcasts, guys.

I think I got this.

Also true to life in real incident response. Somebody has other responsibilities that they need to account for.

I'm sorry, guys. I have to point out that, you know, That tea time just won't wait.

As a team, have assigned our resources with time to spare. Look at us. All right.

It only took to Friday afternoon. Yeah, man, you're rocking and rolling. That's absolutely right. That and the allocation rounds get a little longer as it goes. But, but to your point, everybody was on point.

So I don't remember, Bob, do we individually get scored? I am concerned about my annual bonus. Bonus.

Well, it would be an HR violation to violate, you know, each individual's performance.

So, I've been judging everybody individually this whole time.

As you should be. All right, so one, you know, one question that's of interest. So what's one thing anybody's taken away today, so that you're taking away from this There's more to do than there are resources.

Yeah.

Yeah. And you only have so much time to do it in. There is a ticking clock that does not stop.

And you may have to do someone else's job. Yes.

And you may skip some steps because it's better to reallocate those resources to a different step that has a greater impact on the whole situation.

Yeah, that comes to coordination too, right? So yeah. And board members are more like investors. Yes. Go ahead, Jesse.

I really like Wes's point about the fiduciary and non-fiduciary responsibilities because like we tend to kind of look at like the money people, the investors, the board members, all that is like the same bucket. And so I think that's important to maybe understand that ahead of time. So I thought that was a really A cool point to bring up.

Yeah.

I agree. My big takeaway is how hard this is not going in with forensics, right? Like the not knowing if it's compliance risk with HIPAA or an IP risk with a nation-state actor or competitor. But just fumbling around in the dark, you make it really hard in those first few steps.

Yeah. Yeah. That's exactly right. I mean, and I mean, it does not, for those that have been in an incident before, they realize this is how it really goes down. I mean, this is how it really feels. You don't know what you're up against.

You don't know what's— it's not a linear— yeah, things are not linear. Things are not, um, right. Uh, there's sometimes there's more art than science to it, and there's a lot of rolling dice, making the best judgment that you have with the data you have, knowing that you may change.

Yeah, yeah, make your best decisions. They're not always good decisions.

Do we have a final score?

To that point, I will look real quick.

Yes.

Yeah, 365 out of 562.

So what's the best score you've had?

Well, and why was it ours?

Well, these scenarios— I will tell you this, it's inside baseball, but in general In general, you, you are, you should be able to, with the right allocations, you should be able to complete about 75% of the challenges that are there because that's kind of reality when you go and look at, you know, how it all kind of shakes out. But that's with everybody hitting the exact, you know, the exact timing, the exact allocations all at the same time. So in this case, you guys were around 60%, something like that. Close, not, not— yeah, passing. Room to improve. You may ever remember that, like, that was on my report card a lot. Room to improve.

All right, that was fantastic. Uh, Bob, thanks for, uh, running that with us. It's always a fun learning experience. And, uh, to all the folks in the community that joined in and watched and sending comments. Fun to see all of that. Really appreciate that. We'll have another Q4 Trouble in Techland sometime. I don't know if we've got the date for it published yet. If so, Princess may pop it in chat, but otherwise stay tuned and we'll have that in there. Bob, why don't you take us out?

Yeah, man, look, thanks everybody. And Jordan, it was a pleasure having you for the first time, man. That was great. You can absolutely depend on getting drafted again then because you were, you were great. So, and next time I'm picking, uh, medical, it won't be the same thing. That's even better.

I hope that has nothing to do with medical.

It'd be great. Mackenzie, I'm thanks for doing this honestly, because Mackenzie was in one of the very first ones. In fact, Wes, I don't remember the first one we did. She was in the first one. So, and she has since learned how to scroll and everything.

So, wow. I didn't know you had a scroll.

Mr., Mr. Miller, Jesse, thanks as always, man. I appreciate you doing that. Peter, it was great having you. Um, thanks for taking part in this. I hope it was, uh, beneficial to you. Lincoln, thanks to PetroSecurity for actually giving us the telemetry that allowed us to kind of create this scenario because it did have a whole lot of curveballs in it. So it was interesting. This was actually derived from a real incident. So that's, that's what's important. So, so thanks everybody. And yeah, we're looking forward to having you all next time. If you guys are interested, you can always— we have a free end of the month game, by the way. It's coming up next week. You can go to irgame.ai and sign up and jump right back in there. If you just haven't had enough terrorization for one event, then you can do it again, jump in and take part. So, but we appreciate it. Wes, I'll hand it back.

All right. Thanks everyone. Hope you all have a great weekend. Tell your boss I said you can just take the rest of the day off. Y'all crushed it, and, uh, hope y'all enjoy the, the, uh, the, the two days off. Thanks everyone for joining.

We'll see you soon. Bye, Vic. Thanks too.

Hey, thanks for facilitating. Hey, it was great, guys. Had fun. Appreciate it.

Thank you. Thank you.

All right, guys. Thank you.

Bye-bye.