What do Americans fear the most? Cybersecurity?!?

Man, what's going on, my friends? It's Friday, you know what that means— the end of the week is here, at least we expect it. You know, here's the thing about being in cybersecurity. You can't really ever say that like Friday comes and Saturday and Sunday you're off. Like the second you say that, something hits the fan, right? Like that's always the truth. So like we're always like, hey, let's go have a great weekend and just hope and pray nothing happens. I will say usually it's holidays that bite us in the rear. Am I wrong? Am I not wrong? How many of you guys remember 2 years ago, the July 4th weekend? What a lot of fun that was by our friends at the Big K. I can say all day long I lost a weekend and a holiday over that, but I know friends, good friends, that nearly lost their businesses over it. So I wanna be cognizant of that, but I also wanna say holiday weekends are typically a pretty scary time for people in cyber just because you always wonder, is there something that someone's sitting on here? Is there something that like, you know, could happen here that we're just not ready for. That's part of just being in cyber, right? What a great way to start a weekend, man. That's just what you want. Many of you guys are probably listening on your way home or like, well, you're getting ready to like do something funny. Like, just what I wanted to hear, Wes. Well, that was encouraging. Just scaring me for the weekend. Sorry, not sorry. Let's just hope that doesn't happen this Easter weekend. I wish all of you a great Easter. What we're going to do today is we're going to dive into some really interesting news. First of all, Are you kidding me? Is it really true that from a cybersecurity perspective, that is now like one of the most, one of the things that American citizens fear the most? Like more than nuclear holocaust? Be patient. At the end of the livestream, I'm going to cover some shocking news. I know, sounds clickbaity, doesn't it? But it's true. It's from a reputable news outlet and a really reputable study group. I'm going to show you some data you probably haven't seen before. It's really interesting. We're going to cover some news about Microsoft and some things they're doing that is really kind of interesting that no one else that I have seen, at least in a long time, something very rare, we'll just say. They've been granted some authority that, uh, it's pretty interesting. We're gonna cover that. We're gonna jump into the crackdown from the FBI on the Genesis market. I'm going to show you a little bit more on that. And then we're also going to begin with today's beginning news on what the US is doing with regards to some potential action against Kaspersky. All right, so it's gonna be interesting. Now there's a whole bunch of you listening. Right there, right there is the comments. It's strangely empty, I don't know why. Maybe it's just because we're doing a Friday afternoon livestream instead of like a morning one that I normally do. So jump in, be polite, say hi on the livestream. I already see a bunch of you on here. Jump in and say hello, all right? Would you do that? And if you're watching this later after it's been produced, no problems, share this out with your friends. Tag someone that you think would like to see this. Just tag them and say, hey, this is a great livestream, you should watch it too. Because the cool thing about LinkedIn livestreams is they go on and just live for a really, really long time. Okay, so I'm going to turn that off and let's jump into some of the latest news. I'm going to share out my screen here and let's go ahead and talk about some interesting things here. First of all, I think what I'm going to do is I'm going to resize some things just a little bit here so I can have a better view and you can see me equally as well. There we go. Okay, so let's Let's talk about this. First thing, is the US really going to take action on Kaspersky? Really? We'll see what happens. But according to Reuters, they say the US Department of Commerce is potentially weighing an enforcement action against Kaspersky because they're Russian-based. Now, an enforcement action has authority, right? It's not just sort of like a memo or a letter. An enforcement action can actually force the government to operate in certain ways, potentially blackball the use of something, which they've already done. The federal government has blackballed the use of Kaspersky altogether. It is completely banned. It is— you cannot use it in the federal government space. But what could this enforcement action look like? I don't know. I don't think it would include any kinds of fines or anything like that. That doesn't make any sense because we're not aware of anything directly that's happened from the federal government's perspective, right? Like, like there's no damages. I don't think anyone's even saying that. But the fact that they're based in Russia and headquartered in Russia, we'll just see what happens. You know, it'd be pretty— it'd be a pretty big precedent if we were to see an enforcement action banning the use and sale of Kaspersky in the US. Like, I don't know if it'd be that aggressive. I highly doubt it. But we're going to pay attention to this one and see. This follows on the heels— heels— heels— heels— heels— I think heels, of course, of what the same kind of messaging that the federal government's thinking about doing when it comes to TikTok. I mentioned this on LinkedIn a week or two ago. It seems like a lot of grandstanding. Are we really that concerned with TikTok when we have really terrible privacy regulations as a whole? And, you know, maybe we're just picking on a company that we think we can win on just to get the votes when there's really a lot of other problems that are much deeper in cybersecurity and privacy than just what's happening with one company in particular. TikTok makes you think, doesn't it? So we're going to follow this one. I'm going to skip by this for now, but just follow this one. It's an interesting one. We'll see if this carries any kind of authority, any kind of weight, and if that has any, uh, importance, um, larger to speak. So we're just going to see what happens with this one. Next one, this one happened yesterday, actually a few days before, but the— it was covered in the news yesterday, and it's a pretty interesting one. So many of you are aware of these darknet markets. In fact, a long time ago I even did a YouTube video, like way back in 2013, of the The Rise and the Fall of the Silk Road. This was the world's very first darknet market. And so market, like these darknet thing, these markets have been around for a decade now. Isn't that crazy? Like I remember when they first came out and I did that. By the way, let me just show this to you. I'm just gonna bring this up. YouTube Rise Fall Silk Road Wes Spencer. It should come up even my mistitles. Yep, there we go. So I published this sucker way back when I was a professor of security, like way, way back in 2013. This thing has now gotten— I can't— I gotta say, I gotta expand it here to see. This thing has gotten a whole bunch of views, like something like 500,000 views, some, some crazy insane number like that. I don't even know why it's coming up, whatever. But I did this, I did this a long time ago on my channel because I was just really interested in like what these darknet markets look like. And as soon as I produced the video, I hit a speaking circuit and I spoke at conferences all over around this darknet market. But here's the thing, today's day and age, like darknet markets have really become sort of passé. They've sort of become— we're aware, everyone in security knows that darknet markets are a thing. Like, it's not, it's not special, it's not mind-blowing, it's not like, what, are you kidding, darknet markets, whoa, tell me more. But what is interesting is the evolution in these markets. See, it's a cat-and-mouse game where, uh, bad guys are spinning up a new market. It has new capabilities, maybe new services to offer. Bad— the good guys, FBI, DOJ, others are coming after them. Sometimes we see the shutdown of these markets In some cases you see arrests that are coupled with it, and that causes like what I've called before this diaspora, right, of all of this, oh no, these markets are shut down, and criminals just spin up a new one. So the thing is, yeah, you shut them down, it might have a temporary reprieve, but they're just going to create a new one. It's infinite, especially in this day and era of Tor, right? You can't really truly ever fully shut this stuff down. So why am I talking about this, the Genesis Market then? Why is this one interesting? Well, a couple different things. Um, even though it was shut down Apparently the, the, the Tor, the, the Onion website, the Onion version of it in Tor, it's actually darknet, is still alive. So the clearnet was taken down according to threat researchers. The Tor side is still up. You can click right here and see this. I'll just bring this up for you so you can see. Here's an— here's a tweet from a security researcher, Alpha Centauri 3, that's showing, yeah, it looks like it's still up and online on, on Tor. So they haven't managed to shut that down yet, at least Not from what I've seen. But what's more interesting is the fact this thing is called Operation Cookie Monster. No, I'm kidding. I'm hungry. It's Friday. I do think it's an awesome name. When I'm elected dictator, I'm going to be the one responsible for naming all of these awesome hacker operations. And it's going to be stuff like Operation Cookie Monster or, I don't know, Operation Dictator's Helicopter. It's going to be some great names like this. Right. But here's what's more interesting. This thing has been around since 2018. And what it does is it's— it has some innovations that I want you to see because they're pretty unique. And we're going to see more and more of these darknet marketplaces spin up that have some of the same things. So I'm going to skip by this, but they have had malware that's been detected in the US. It sells all kinds of stuff. Here's some of the nasty stuff that it's leveraged, some of the tools that they support and sell. And what's interesting, if you look at what the US Treasury said, they called DOJ— DOJ called the Genesis Market, one of the most prolific initial access brokers in the cybercrime world. Now, what is an initial access broker? This is a really important thing to talk about. One of the things that Genesis Market did was they didn't just sell like malware and just sell like how-to guides and just sell drugs, you know, like the old school darknet markets. It's much more than that. They were known as an initial access broker. And so when you look at the supply chain of cybercrime, One of the things that you see is there are certain threat actors that are involved in getting access and then selling that access. And there are certain other threat actors that are— they're not interested in spending all the time trying to find access. They just buy it from somebody and then run the ransomware. In other words, you have skill sets of bad guys, just like you see in the, the, the, the, the, the world of good guys. You have different kinds of security professionals. So initial access brokers, these are the folks I shouldn't even say folks because I use folks in like a good way. These are the bad guys. These are the miscreants that get access to a computer or an account, and that account may have a lot of value. It may have very little value. And based on the value of that account, it is then sold to bad guys that want to operationalize it. So in some cases, that access can be sold for just pennies. In other cases, that access could be sold for maybe tens, fifties, hundreds of dollars for a single account based on what the account has access to. And this is why, by the way, we've seen such an increase in cyber attacks is because we have this specialization among these bad guys. And so you have those that are responsible just for getting the access and they want to sell it off to a ransomware operator or a, you know, like a business email compromise outfit who can then leverage it and do other things with it. So just like you have a supply chain in the good guy world, we have a supply chain in the bad guy world.. And so I don't think a lot of people understand that. So looking back at this just a little bit more, going into the, the, the Genesis market as a whole, it was a key resource used by threat actors. Besides credentials, Genesis also peddled device fingerprints, which include unique identifiers and browser cookies, so as to help threat actors circumvent anti-fraud detection systems. So one of the things that's happened in this cat-mouse game is this: we, we've had a lot of like, uh, computer systems that are basically like, look, You may have someone's username and password, but with MFA and then also just checking on your like session cookies, we've seen that this doesn't look like it's you, so we're not going to allow the login. And so one of the things that bad guys have done is a way to circumvent this is they also give you access to that user's not just their credentials like username and password to a site, but also their cookies and their session information so that when you connect to these sites where the initial access brokers have stolen your data, they're also stealing not just your identity but also your session information. So therefore, all the fraud stuff that a lot of these websites have, like banks especially, it bypasses in some cases those things because it looks like it's you. The bad guys didn't just steal your data, they stole your session information as well, which is pretty wild stuff. This is pretty innovative, right? So if we go on here, I'm going to show you kind of how this whole thing works. It shows right here the packages of stolen information harvested from infected computers can go from 70 cents to hundreds of dollars. You can see a screenshot here of some of these things being sold. And then they mention here that when you buy— sometimes when you buy these credentials, this access, it comes with a custom browser. And this is where it gets interesting. I'm going to show you this. I want you to see it. So this comes over from humansecurity.com if you want to check this thing out. And they actually covered this way back in 2020. This is something that not a lot of us ever have like looked into. At least I personally haven't dove into it as much. And so I'm going to scroll down. I want to show it to you. So this right here is the Genesis Market. And what they do is they package for you this thing called Genesium. It's, or Genesium, however you want to say it. It's a, it's a, it's sort of a custom version of a Chromium browser that contains those anti-detection features. It contains all of the fingerprinting. So you can see a screenshot of this right here where it shows you how to get this thing set up, how to download the browser, how to set up the cookies and the session information that you stole along with the username and password so that you can bypass some of those anti-fraud capabilities. So if you're interested in looking into this more, check this article out. It's from humansecurity.com. Just search for the Cybercrime Starter Kit and it'll come right up. It's a pretty interesting thing to look at. So also on the, on the hills— I keep saying hail, hails, hills, heels, one of these H words— on the hills of this, we also have seen, again, once you see a shutdown of a marketplace, you're going to see more spin-ups. They mentioned the takedown of Hydra, which I've covered before, in April of 2022. And then from that shutdown, here come a bunch of other ones: Mega, Blackspurt, Solaris, Kraken, OMGOMG. Again, these names are great, right? These bad guys apparently are better at naming their marketplaces than, than we good guys are. I don't know. Um, if you're watching, you have the ability to comment. Give me a list of— give me a name of what you would call your darknet marketplace. I get— again, would call mine the Dictator's HQ because that's just would be the coolest name ever. By the way, if you ever find a darknet market called the Dictator's HQ, I promise you, Your Honor, it was not me. I'm just saying it in a live stream. It wasn't actually me because that day is going to happen, right? Someone sees this and they're going to be out to get Wes Spencer, right? No, I joke. So, so Styx is one of the new ones that's come out. STYX. Pretty interesting. Bleeping Computer covered this just a couple of days ago. Here it is. Styx. Innovation Marketplace. How interesting is this? I haven't dove into— a lot of times I do get into these just as a researcher, just I get into these darknet markets because they're fun. I haven't gotten into Stix quite yet, but here is a screenshot of it from Bleeping Computer so you can kind of see some of the things that are being traded. SIM cards are pretty interesting to me, so there's a lot of things being bought and sold and traded. Look, if you get access to one of these as like a researcher like me, just to look— please don't buy and sell, it's illegal. Just look, just, you know, just look around. Just like what you see here, they're just looking, they're just showing you some of the things it has some of the information. I don't know that that's actually Joe Biden's passport. It says they appear to have it. I don't know. Anyway, the purpose of today's live stream is not to cover Styx. If you guys want me to cover Styx in more detail, I will. My point is that after this shutdown of Genesis, now we see a new one called Styx. It'll be interesting to see what Styx does and see if it gets traction. But this is what happens. We shut one down and more come alive from there. Okay, so let's move on to the next article. This one's really interesting. Microsoft and cybersecurity firm Fortra go after top hacking tool. Now, on a previous live stream that I did about 2 weeks ago, I covered Fortra. Fortra is the maker of a software system that got smacked and got hacked in a supply chain attack just recently. And ironically, they also are the creators of Cobalt Strike. And so they've been in the news a couple of times of late with some really bad PR. First of all, anytime people hear Cobalt Strike, you know what's amazing? They immediately think it's like a bad guy's tool. And I'm like, no, no, did you know Cobalt Strike is actually like a pen testing tool that's been developed for like good guys? Bad guys are just taking use of it. They've taken so much bad press that people hear Cobalt Strike and they're like, yeah, that's a bad guy tool. It's only— it's made by bad guys for bad guys. I'm like, no, no, no, no, no. Nothing could be further from the truth. So they've taken their licks. And then one of their like help desk or software platforms also had a pretty significant zero-day and it ended up in CISA's known exploited vulnerabilities list. And so, man, they have taken some hits lately. So this is an interesting one. It kind of goes into their favor. So this involves Microsoft, Fortra, the company that makes Cobalt Strike, and the Hellfire SAC, which is awesome, by the way. I love Hellfire SAC. They used to be a huge partner of ours. Back when I was at Perch. Health ISAC is an information sharing and analysis center specifically for the healthcare industry. So really amazing people there doing really great work. And they three together have been given some authority to do some interesting things. I'm going to scroll down here. Here it is. On Friday, the U.S. District Court for Eastern New York awarded a court order. Listen to this, a court order for those organizations, Fortier, Microsoft, Hisac, a court order to allow them to seize domain names where malicious actors have been storing and sharing malicious versions of Cobalt Strike. Isn't that crazy? So basically what this means is this: they now have the authority, at least in the US, to do takedowns, to go to domain registrars, to go to hosting providers and say, here's my court order. You will take this domain down as it's been known to be serving malicious, nasty around Cobalt Strike, like actual malicious versions. I think that's pretty astounding. I'd be curious to know what you think. Court orders going to private organizations with the authority to do domain takedowns, that's kind of interesting. We don't really see a whole lot of that happen all the time, do we? So they also have the ability— they'll notify where they don't have jurisdiction, Latin America, EU, about the same thing. Now why is this useful? Because many of you might be thinking about, okay Wes, that's cool and all, but the issue. The issue is that that's only in the US. And why does that matter? All someone's got to do is host these malicious websites somewhere else. Well, remember, with a lot of proxy firewalls, one of the things that many people do is just a regular piece of hygiene, is they disallow connections to like foreign countries. Not exclusively, but to places that just could be more nefarious. Places like, why would you need to go out to, um, I'll just name a country like Uzbekistan. I'm not saying they're like malicious, but I'm just saying you have no need to go out there. So we're just going to block traffic to Uzbekistan. Pakistan. So the idea here is this: if the court order allows Microsoft, Forza, and also for what's-her-name, for, um, for, for HISA— sorry, if it allows for those— I think I said Forza, I meant Fortra, by the way— if it allows for them to have takedowns in the U.S., then that allows people that are blocking via GeoIP for other countries to potentially— it makes it a more effective control. I don't know if that makes sense or not. Maybe I'm talking myself in circles, but I think that's an interesting take. I think it's interesting because it gives the capability for us to make some of that GeoIP blocking more and more useful. Because sometimes what bad guys will do is they will host malicious content in the US or in the UK or Canada or somewhere like that, because to a GeoIP blocking firewall, that's friendly countries, right? So, so it's just— it gives us a little bit more power. I'm not saying it's going to solve anything, but I think it's really, really interesting. So they received a temporary restraining order against those violating the copyright of their programs, making it easier for them to seize and shut down malicious versions of the software. So that's one of the ways this is happening, right, is they've got a restraining order that they can then sort of universally use anywhere they've determined that, that malicious software is, is, is, is present, especially— well, I guess essentially where they have authority, being the U.S. And then of course they can notify other countries and hopefully they'll follow suit. Big picture here from Axios: it's rare for private companies to turn to the court system to target malicious hacker tools and tactics. And that is rare. Care. So that's why I'm covering it today in this news. I think that's shockingly interesting to see, uh, them have the capability. And I'm curious to know, will we see more and more of this capability over time? Will we see more and more times that court orders are given to private companies to take action on their own hands? Brings up a lot of questions. Is that even a good thing? What happens if they take that too far? What do those court orders potentially allow? Could they be spoken in broad and various ways. Could Microsoft potentially use that to shut down some of their competitive stuff? Could they go after AWS and say, you're going to take down this, this, this, this, and this because we think it's got, you know, access to Cobalt Strike? And really it's just— they're just— they're going after their competitors. I'm not saying that's happening. In fact, I don't think it's happening. I wouldn't imagine it would happen. But you just have to wonder, do those restraining orders take things too far? I don't know. What if we see a pickup in this precedent and we see more and more of these court orders being given out ad nauseam? Could we see one company go after another over these kinds of things? It's just something that's worth discussion. I'm a fan of Microsoft and Fortra and HISAAC being able to have the takedown capabilities where it should be used. But with great power comes great responsibility, or so Spider-Man's aunt told him, right? So So you just have to wonder about that. I'm not sure. It just— you just wonder if it could be taken too far. All right. So last thing I wanted to share, and it's an interesting one, and it's one that's going to shock you. It's one you— I guarantee you haven't heard before. And it's one that I saw this. I'm like, really? Is this really true? This comes from The Hill. And not just The Hill, they're citing some very interesting study data. Americans now fear cyberattack. More than a nuclear attack. Oh boy. As a security person, I want to clap this and say, yay, hooray. But as a realist, just an American citizen, I don't know that I agree with this. I mean, what's more devastating? I think we would all agree a nuclear attack So wouldn't that be what we would fear more? I suppose fear isn't always rational, though, isn't it? Sometimes fear is fear because it's something that's irrational. For example, there is a fear of like the depths of the ocean. I forget what it's called, like thalassophobia, I think it's called. And people see the depths of the ocean and they're like, I'm super scared because I don't know what's down there, right? Is that a rational fear? Largely, it's irrational. Rational. Many people swim in the ocean, even deep in the ocean, and they're just fine. So fear isn't always rational. Sometimes fear comes from the unknown, and I think that's what's happening here. I don't think that the fear in particular is because we think that a, that a cyberattack would be more damaging than a nuclear attack. I think it's because the sentiment seems more likely and maybe citizens don't know the impact of what a cyber attack might look like. I'm not quite sure. James coming in here saying, I think the cyber attack is more likely than a nuclear attack, and that's why people have that fear. James, I think you're on to something here. I think that makes a lot of sense, is people just look at the likelihood of it, they look at what's happening around them, and they're starting to finally wake up. They're starting to start to say, I've heard about these cyber attacks, I've been impacted by them, a 'a friend of mine has been impacted by them. They're pretty nasty things. I sure hope they don't happen.' Isn't that a wild break from the norm? I mean, for years we security people have said, 'Oh, business owners, they don't care. I'm not a target. No one's coming after me. No one wants my data. No one's gonna do anything, you know. I'm, you know, why would they come after me?' But I just think that's interesting. So let's dive in just a little bit more into the data here. And let's see, there's some interesting things here. So first of all, um, some— let me just— I was hoping I could get this view better, but we're just going to use this one. Okay, so cyber fears have outflanked concern over climate change, immigration, terrorism, and nuclear weapons. Now I will be the first to say, probably every one of those— climate change, immigration, terrorism, nuclear weapons— are bigger threats and bigger issues than cybercrime. And here I am as the cyber is a cybersecurity person, right? So I'm just— again, I'm shocked by this. Very shocked. This data comes from a 2023 Gallup poll. So we all know Gallup, right? They seem to tend to have a lot of credibility. And a 2022 Pew Research survey that comes at a time when cyberattacks seem to be everywhere and nowhere. And I think that's a really interesting comment that Hill made, is they are kind of everywhere and nowhere, aren't they? We're always reading about a new cyberattack and yet nowhere in the sense of like like many, many times we just sort of go on our day. And so I'm just shocked that Americans would be pretty concerned about it. Most Americans would be hard-pressed to name a recent act of cyberterrorism that claimed American lives or plunged the nation into economic chaos. Pause on that, pin that one. I'm going to come back to this one in a minute, okay? Because I don't fully agree with what The Hill says here, but we'll come back to that. Remember, this is just a journalist combining quotes and articles and data and statements and then looking at the study data. Right. So we'll come back to that one in just a minute. But we go down in the recent— in the Gallup poll published last month, 84% of respondents rated cybercrime as a critical threat, ranking it above 10 other global fears, including tourism, global warming, all the other stuff we mentioned. Isn't that wild? I guess we are starting to see a shift. We are starting to see a movement. We are starting to see a difference among public sentiment. The question is, will that public sentiment cause change or will they still be like, yeah, but I'm still not paying for more security. Yeah, but I'm still not going to do anything. It just makes you wonder if you're an MSP listening today. I'd be really curious to know in your conversations with your clients as you— I encourage you to present this data and I'd encourage you to ask those clients are— is that you as well? What would a cyber attack look like for you? Why do you think everyone is so concerned? Why do you think this is one of the top fears of the nation? And get them talking about it and then ask them, what are you doing about it? If everyone else is concerned and you're concerned, shouldn't you be taking action on all that? Shouldn't you be doing something about it? I think you probably should, Miss Client. So it's interesting. Fear of cyberattack cuts across party lines, which partly explains its standing as the nation's topmost fear. That's very true. One side of the political aisle cares a lot about the environment and global warming and climate change. One maybe less so. One cares a lot more about, you know, I'm not going to get political, right? But you know this, all those items I listed, different sides of the political spectrum care in different ways. Yet with when it comes to cybersecurity, Interestingly, both sides tend to care pretty equally about this. So I think that's an interesting perspective. It's one of those big national level conversations that both sides of the aisle tend to have an agreement upon, which is really interesting in our, our political climate, isn't it? Very, very interesting. So going on, Lewis joked, I wish Gallup would do a poll on how many people think Terminator was a documentary. I thought that was pretty funny reading through this article just because you know, some of these, some of these people they quoted just don't really take this serious. And look at this. Some experts, Lewis included, sense that the national fear of cyber warfare is overblown. He puts the long odds on a military cyberattack against the United States by one of its enemies. In other words, Lewis thinks, meh, this, it could happen, but I think this is overblown. Now, I will say this. One thing from the insurance side of the house is one thing that insurance cares about are like big cataclysmic events, you know, like a big Category 5 hurricane smacking Tampa, something like that. When it comes to cybersecurity, they are petrified and worried about a big global cataclysmic cyber event. To date, that has not happened. You take SolarWinds, You take some of the big breaches from the past, like the OPM breach, the Equifax breach. You take the Kaseya incident, you take all these things that have happened in the past. Not a one of them have added up in damages to what insurance would call a big systemic cataclysmic event. It's never happened yet in cyber. Never, period. It just hasn't. And so some people, that's why they like Lewis here. It's why they take the long odds and they say, eh, from my perspective, it could happen, but it hasn't happened yet and therefore it probably won't happen. The Russians or the Chinese, they're not going to do a cyberattack unless they think war is imminent. From a government perspective, so far that's been true. And he did a livestream several months ago. If you're interested, DM me, I can get you access to it on— we're actually seeing this happen. We're seeing cyberwar in Ukraine. As a complement to kinetic war. And this is the very first time we've seen the two happen in a, in a very organized event. We've been talking about since like the '70s and '80s, what would a cyber war look like? And I think what we're learning is a standalone cyber war is probably very unlikely, but cyber warfare as an attachment to physical conflict, kinetic warfare, is a guarantee. And that's what we need to be ready for. And even the motives in the TTPs, the actions taken by these bad guys in a, in a cyber war, are much different. They're not going after money, they're not doing ransomware. They're literally smashing and grabbing and destroying. They're getting access to systems and removing them and just doing as much disruption as they can. That's the, that's the idea here, right? So some pretty easy metrics here. Has anyone ever died? Lewis says no. Has there ever been any economic social disruption? No. All right, Lewis, you're over your skis, buddy. Who is Lewis again? Lewis is— I got it. James Lewis, a senior vice president of the Center for Strategic and International Studies. All right, James Lewis, you don't know what you're talking about. Unfortunately, you are incorrect. I read that. I'm like, wait, but do you really say that? So I can, I can buy Lewis's argument here on the first statement. But Lewis doesn't know what he's talking about here. As proof, look at this right here. This came in and this— I don't mean to make fun of this or in light of this, but it really happened. This comes in from Wall Street Journal. Hospital hit by hackers. A baby in distress. The case of the first alleged ransomware death. Many of us covered this. Many of us had been saying this is an eventuality that is going to happen. Well, it happened in 2021. A hospital was hit with ransomware. Their systems were down, leading to some of those technology outages, leading to a death of a baby, of an infant. Super sad. Heartbreakingly sad. Let's just take a moment and understand there is a connection between what these bad guys are doing and human life at stake. Can we just, can we just let that sink in for a minute? Now, that may not have happened a lot, but Louis is wrong. Has anyone ever died, Louis? Yes. Not no. Yes, it has happened. And in theory, it could happen again. So it is something that we should care about. In fact, that entire ransomware— I think it might have been Conti. I'd have to go back and look. But that entire ransomware attack led to many of those ransomware outfits realizing, whoops, we stepped too far. And many of them would then say, we're not going after health care. And if we accidentally hit you with ransomware in your health care, let us know and we'll give you free— we'll give you a free recovery key. We will not charge you. I'm not saying that bad guys have a heart, but I am saying they recognize that they went too far. So this is where I think this quote here is incorrect. Like, I don't think— I don't think that he knows what he's talking about. People have had their lives lost, at least one definitively, from an actual attack. Right. So the rest of the article goes through more data on this, and it does cover some of the more systemic Colonial Pipeline. Some other attacks have happened. And I do agree, in the past, We haven't seen the cataclysmic event. So it's interesting that American citizens fear this more than other things. It's very, very, very interesting. Some quotes coming in here. Let me, let me dive into this one. I think the image of cybersecurity is painted the wrong way for the average user, and the cyber community needs to do a better job of having more frequent conversations about the realities of what happens so that people understand they're part of this shared responsibility. Sagar, that is very well said. I completely agree. So let me just take a pause here because that quote was just so good. So often I think what we do struggle with this, because we as security practitioners struggle with getting buy-in from our executives, we default to scaring them and we default them to like, oh, look at all this bad stuff and what's going to happen, and you're going to get hit and hacked and your life is going to fall apart, blah blah blah blah blah. And they're like, oh, I've heard it before. The first time you said that to him, it scared them into action and they did something about it, but nothing happened, and now you're the boy that cries wolf. And now they're like, yeah, whatever, the security guy's always going to say what the security guy's going to say, and I just don't care. I'm just— I don't— whatever, I don't believe it. And that goes right to what Sagar is saying here, is that image is painted the wrong way. We're actually discussing this in an incorrect way. We should be entering into this from the perspective of risk. What's the risk posed to our organization? What is the right outcome to address and deal with that issue. How do we handle that risk? Do we mitigate it? Do we transfer it? Do we accept it? How do we communicate that risk? What do we do about— what's the likelihood of this? These are things from a boardroom discussion that we should be having as security people. So very well said, Sagar. Really well said. In fact, that's the entire reason that I created Empath Cyber. Empath is exactly about that so many of us struggle with the cybersecurity conversation. We don't know how to bring it into the language of our decision makers and speak that language of risk. If you're curious, you want to know more about that, reach out. empathcyber.com/join. Jump right in. Just to make Matt Lee mad, here is a QR code. You can just scan that thing right there and it'll take you right in. If you don't want to scan it because Matt Lee has taught you well, empathcyber.com/join. Would love to have you in because that's specifically Very well statement by Sagar. Very, very well state, uh, a good statement. And that's exactly part of the problem. I completely agree. Okay, so going back into this, we're about to close here, um, but I just thought it was really interesting, some of the data that was in this. And I found it staggeringly interesting that according to Pew, Pew Research, this is— Americans fear this more than anything else. I'm curious if you have any thoughts on this. Fire them away in chat. I'd love to know kind of what you think about this. Does it shock you? Does it surprise you? Does it not surprise you that the American sentiment is that a cyberattack is an imminent, scary thing and it's more, more imminent, more scary, maybe imminent, not the right word, but at least more fearful than a nuclear attack? I think that's wild. And then I'm also curious to know, do you think that will move the actions and opinions and budgets of decision makers. If you're an MSP today, does an article like this hold sway? I would, if I were in your shoes— I mentioned this earlier— what I would do is I would absolutely bring this conversation into a discussion with my MSP friends. I mean, my client friends. If I'm an MSP, I'm going to show this article and I'm going to say, do you fear this as well? It looks like everyone else does. It's okay to be in a group of fear, right? It's okay for you to be like everyone else. The question is, what are we going to do about it? The question is, how are we addressing and handling this? We can't stop all cybercrime. We can't keep our organization from never being hit, much as we might want. That's impossible. True 100% security is impossible. But what we can do, Ms. Client, is we can address this risk and tackle this fear by doing the right things. What are the right things, you ask? Well, it's things like building a mature cybersecurity program. I would love to talk to you about how we do that. It starts with a risk assessment. We'd love to look at your organization, love to ask some questions and get an understanding where you're at. You're going to come out of this risk assessment with 2, 3 things that we may want to work on in the next quarter. Those issues that come up are not ones that I make up. Up. Our risk assessment is built and based on a really great cybersecurity framework like the CIS Controls, and that framework is guidance that's been created by thousands of people that have put millions, maybe hundreds of thousands of hours into its creation. We follow that best practice, and what comes out of that will be something that can measurably increase your organization's ability to reduce the likelihood of an attack. And when that attack happens, you'll be able to deal with it in a far more cost-effective way, allowing your business to recover quickly, to suffer less damages, and to ultimately get on its feet faster and quicker. As much as I would love to tell you that you do these things, you'll never get hacked. You can never find a doctor that will tell you if you get a CAT scan every month that you'll never get cancer. Doesn't work that way. But doing the right things in health lead to a better life. Doing the right things in cybersecurity lead to a better hygiene and a better position for your organization to be sustainable and successful and scalable in the future. That's how we discuss it. So I'd love for you to take a look and I'd love for you to have a conversation with that article and I'd love about that article with others. And I'd be really curious to hear what your clients think about it. So there we have it. Scott jumped in at the end and he said he is surprised. I hear you, Scott. I'm surprised too. It is a very, very interesting article that was very interesting, very shocking to me. So we'll kind of see what happens and we'll see if the sentiment leads to the changes in actions. Speaking of changes in actions, our Friday is here. So if you're still working, tell your boss, I told you, you are done for the day, that you've listened to a great livestream, you've got your learning on. And you've earned yourself a nice weekend. Let's all band together and let's hope that this weekend is a great one, that while it is a holiday weekend, let's hope that all things are smooth this weekend and that nothing major happens. As we kicked off this livestream, I hope you have a great Easter. I hope you have a great time with your family. Hope you have a great weekend. Until next time, my friends, I am signing off. I will see you later. Thank you so very much.