Latest / Identity at the Center / #314 - Sponsor Spotlight - Semperis

Transcript

#314 - Sponsor Spotlight - Semperis · Identity at the Center

0:00
That was another one that I thought was surprising.
0:02
And there were a few things underlying that one.
0:04
One is the nature of ransomware attacks has changed.
0:06
It used to be, you know, sort of like not Petcha, we're just
0:10
going to encrypt all your machines and then we we'll sell
0:13
you the decryption keys. But now what's happening is, is
0:18
attackers are exfiltrating sensitive data or data that they
0:23
can get their hands on anyway and holding that for ransom.
0:26
They're, they're saying things like we're going to publicize
0:30
all this information and, and if you don't pay US money for the,
0:34
for the data. So you've got two things you
0:37
have to buy now. You've got decryption keys and
0:40
the get rid of my data key if you will.
0:45
But how do you really know that they're deleting the data?
0:48
Well, yeah. Is there, is there such a thing
0:49
as honor to say, OK, well, I promise as as you're, you know,
0:54
assigned criminals that I will, that I will delete the data that
0:58
you get that you paid me for. This is identity at the center
1:08
if it has anything to do with IAM.
1:11
This is the go to podcast now your hosts Jim McDonald and Jeff
1:18
Stedman. Welcome to the Identity at the
1:26
Center podcast. I'm Jeff, and that's Jim.
1:27
Hey, Jim. Hey, Jeff, how are you?
1:30
Oh, not so bad yourself. Good.
1:32
I'm excited to talk about ransomware.
1:34
How about you? It's always a good time to talk
1:36
about ransomware and that's why we that's why we do this right,
1:39
is to protect people from ransomware, hopefully mitigate
1:41
the risks associated with it. So yeah, let's get into it.
1:45
We've got a sponsored episode today.
1:46
This one's brought to us by Semperis.
1:48
You can visit them on the web at SEMPERI s.com.
1:53
And I want to welcome back Gil Kirkpatrick.
1:56
He's the chief architect at Semperis.
1:58
Gil, welcome back to Identity Center 'cause you've been with
2:01
us before. Yeah.
2:02
Thanks, Jeff. I really appreciate it.
2:04
It's good to see you again too, Jeff.
2:06
So we were talking before we hit record and it was like, Oh yeah,
2:08
it was just on like maybe a year ago.
2:09
And then we looked it up. I was like, oh, it was actually
2:11
three years ago, September of 2021.
2:14
So, you know, people can go back and list of that.
2:16
I'm not sure where this episode will be 315, somewhere in that
2:19
area maybe, but you were on episode 110 like way back in the
2:23
day. So people can go check that out,
2:24
see what's changed. But let's talk a little bit
2:26
about, you know, you and the identity space.
2:29
Rick, Bruce Lee, how did you get into the identity space?
2:31
Because I don't even know if we asked that questions back then.
2:34
Yeah. I don't remember if we talked
2:36
about it or not, but it it. So I've been in, I've been
2:40
building commercial software products for just about 50
2:43
years, which is kind of a long career.
2:47
And my first, the first platform I really worked on in the PC
2:55
networking environment. So in the, in the, you know,
2:58
late 80s, early 90s was, was Banya, Banya networks.
3:03
Now not too many people remember Banya, but it was the, the only
3:07
legitimate enterprise scale PC network at the time.
3:12
There was no bell and Microsoft was sort of off on the side.
3:16
By the few lines. Yeah, exactly right.
3:20
And the the interesting thing about Banyan Vines was it had an
3:25
integrated directory, distributed directory for griebs
3:30
and users and I think computers as well.
3:34
And that was a concept that nobody had really thought about
3:37
before, or at least not commercially anyway.
3:39
And it was largely invented by Jim Altchin, who later became
3:45
AVP in the technology side of Microsoft and drove a lot of
3:50
what became Active Directory. So that's, that's really where I
3:54
started. I build products to help people
3:58
manage their Banyan Vines environment and then did similar
4:03
kinds of things for Netware NDSE Directory.
4:08
And then that's sort of when Microsoft came out with Active
4:11
Directory. I was at a company called
4:14
Netpro. And in fact, we've been working
4:15
with Microsoft for several years before they shipped Active
4:19
Directory in 2000. And we had, we built management
4:23
and yeah, management products primarily for for Active
4:26
Directory. And then since then it's, it's
4:30
been, you know, Active Directory related stuff.
4:34
And then I was the CTO at identity management company in
4:38
Australia that built sort of industrial scale X500
4:44
directories. We did a fair amount of work
4:47
with Open ID Connect and Oauth and those those newer web
4:51
protocols. And then came to some Paris in
4:56
2017, I think it was twenty. Yeah, that sounds about right.
5:02
So do you consider yourself an I?
5:05
Do you consider yourself an identity person or a software
5:08
developer or somewhere in the middle?
5:10
Yeah, somewhere in the middle, I would say.
5:12
I, I, I'm, yeah, I mean, definitely a software guy.
5:15
I think my, my sweet spot is in software design and development,
5:20
but my focus has been on identity related issues for the
5:23
last 20 years, you know, something like that.
5:28
So I'm, I'm very in tune with all of the issues around
5:34
managing enterprise identity and in the last, you know, four or
5:39
five years on all of the ways that identity can be attacked
5:45
and misused. So I've become, you know,
5:48
pretty, pretty knowledgeable in that area as well.
5:52
Well, I'm glad you're here with us.
5:53
And you know, this is a sponsored episode.
5:55
So Sempress is sponsoring this episode.
5:57
So make that very clear. So let's learn more about
6:00
Sempress. I know we we just had an episode
6:01
not too long ago where we talked with Eric Woodruff.
6:03
But let's get your take on, you know, tell us what Sempress is,
6:07
what it does and and that good stuff.
6:09
Sure. So, so Sempress builds products
6:11
for enterprises to improve the security and resilience of their
6:16
hybrid identity platform. So typically that's Active
6:19
Directory and Azure, our entry ID now And the, the basic idea
6:29
is if, if you've seen the missed cybersecurity framework, you
6:32
know, you got those five phases of, of managing a cyberattack of
6:37
identify, protect, detect, respond and recover.
6:41
We try to cover all of those activities related to the
6:46
identity system. So we've got as an example and
6:52
identify and protect, we have a free tool called Purple Knight,
6:57
which is people love this thing. It's astounding how how many
7:01
people have downloaded it and use it all the time.
7:03
But it does a comprehensive analysis of your Active
7:07
Directory environment and your security posture along with
7:11
entry ID and gives you a really easy to use report card about
7:16
how you're doing in different segments of configuration and
7:19
management and gives you suggestive remediations and all
7:24
of that. So people end up, they download
7:26
it, they run it, a lot of people run it monthly.
7:29
They make that part of their monthly reporting activity to
7:33
either IT or security that shows how they're doing as far as
7:37
securing their Active Directory. So that's that's one end of the
7:41
spectrum. Then we have a product called
7:43
the Directory Service Protector DSP, which has that same sort of
7:52
evaluation of your Active Directory configuration, but it
7:55
does it continuously. So you know immediately if
7:59
there's some aspect of your security posture that's degraded
8:02
in some way and you can respond to that.
8:06
And it also logs, it keeps track of all of the changes that have
8:10
made been made to your Active Directory.
8:11
And it does it in a way that doesn't rely on the logging
8:15
system because the event logs are one of the things that
8:18
attackers turn off almost the first thing.
8:21
It actually monitors the replication activity in AD and
8:25
uses that to essentially construct a timeline of of your
8:29
Active Directory history so you can see what things are being
8:33
changed and roll those changes back if you want to do that.
8:37
And then in the most recent version of DSP, we've added
8:43
activity monitoring. So it's actually tracking
8:48
authentication of users and computers against AD and what
8:51
services they're referencing and detects things like brute force
8:56
attacks or password spray attacks or any kind of anomalous
9:00
authentication behavior. Again, with the idea of trying
9:03
to detect attacks that are in progress so that you can then,
9:07
you know, start your incident response and, and remediate to
9:10
isolate the machines or, or disable the users, that sort of
9:14
thing. Then finally we have a product
9:18
called ADFR, Active Directory Forest Recovery.
9:21
And this is, this is probably the product that most customers
9:25
start with, or this is the, this is the product that most
9:30
customers come to us about because recovering Active
9:35
Directory, the entire forest for backup is really, really hard.
9:41
And the likelihood of success if you're just following the, the
9:45
Microsoft playbook is less than 20%.
9:49
I used back in the day, I used to run a workshop where we would
9:53
walk people through the recovery process for AD.
9:57
It gave them a virtual environment with four domain
9:59
controllers and two domains and a a checklist of every single
10:03
command you had to type in to actually make that happen.
10:06
And it was a sort of a 2/3 of a day, 6 hour kind of thing.
10:12
And the success rate was about 20%.
10:15
Even with all of the commands that you need to know that you
10:18
have to type in, sometimes it just doesn't work and you don't
10:22
know why. So you have to start over again.
10:24
So that recovering AD from backup is hard and 84 automates
10:29
that whole process. So it turns what might be a a,
10:33
you know, a many day recovery process for a, for a larger
10:37
enterprise into a couple of hours and six clicks.
10:43
So I think now you're now hopefully people listening are
10:45
starting to understand why we're talking to you and specifically
10:48
about ransomware, right? Because these are these are
10:50
typically the things get broken during that kind of of attack.
10:55
I know we want to go through a ransomware report that you guys
10:57
have, but I have, you know, my own questions around Sempress.
11:01
Where does the company name come from like came up with Sempress
11:04
and what does it mean? Does it mean anything?
11:06
Yeah, so, so it, it, I think so. I was a part of the conversation
11:11
that led to that name. But it came from, you know, the
11:16
Latin, you know, always, always watching.
11:20
And that's, that's sort of the ideas is that that our products
11:23
are always watching your environment to make sure it
11:25
stays safe. And it also sort of relates to
11:28
the Semper Fi and the Marine Corps and, and, and all of that.
11:31
It's, it's not an explicit DoD reference, but it's, it's
11:36
definitely trying to convey the fact that we're, we're always
11:38
there and always faithful and always watching.
11:42
So what is it that you think makes your solution unique in
11:45
the space? Because I imagine you probably
11:47
run into a lot of, you know, jaded IT security people out
11:50
there that are like, Oh yeah, great.
11:52
Another tool right In this type of cyber security space.
11:55
What is it, do you think, that keeps, you know, people coming
11:57
back and why you've been so successful?
12:00
It's our focus on the identity system. 90% of cyber attacks go
12:05
through the identity system in one way or another, either
12:08
through stolen credentials or otherwise compromised account
12:15
session hijacking, doing reconnaissance in Active
12:20
Directory, trying to find potentially sensitive resources
12:23
or, or privileged accounts, elevation of privileges.
12:27
All of that goes through the identity system.
12:29
And for 90% of the world that's Active Directory.
12:34
And we have a, a, you know, a complete focus on securing and,
12:40
and improving the resilience of Active Directory.
12:43
I think that's why we've been successful.
12:45
That combined with we've managed to build a ridiculously good and
12:53
smart team of Active Directory experts.
12:57
I mean, I, I think somebody, somebody calculated this Sean
13:00
Doobie who who runs our, our hip hop podcast and is one of our
13:07
technical experts, I think he calculated we have like 200
13:10
years of Microsoft MVP experience, you know, something
13:14
like that, all focused on Active Directory.
13:16
Plus we've got several guys who came from Microsoft, you know,
13:20
the PFE professional field engineer or Premier field
13:24
engineer environment. So we have lots of very, very
13:28
smart ADP. So 200 years, that's either one
13:31
really old guy or a couple, a couple of old couple, sort of
13:36
old hogs. What is it that you know, the
13:41
question we get a lot is, OK, well, that's great.
13:43
I've got a tool. How do I get the return on
13:45
investment on it? Like what's the way that you
13:46
measure success? Is it, I guess, how do your
13:49
customers measure the success of of the of the purchase of the
13:53
investment that they've made in your tools?
13:56
So, so a really easy description or easy way to explain that is
14:00
with ADFR and forest recovery and you just the simplest way to
14:06
measure it is how, how long does it take you to how much effort
14:12
do you spend backing up Active Directory?
14:14
How long does it take you to recover from backup in a new
14:17
environment? So as if you had a cyber attack,
14:21
how long does it take you to do it now?
14:23
And how long does it take you to do that?
14:24
And now reliably after you have ADFR and it's, you know, the,
14:29
the differences start. Mostly organizations have never
14:35
recovered AD from backup or the ones that have did it in sort of
14:41
a test environment or they did it by taking virtual machine
14:44
snapshots and then, you know, resetting to those which, you
14:48
know, none of those are effective when you're recovering
14:51
from a cyber attack. So that's really all it takes.
14:56
And when we demo ADFR for people who have had the experience
15:03
trying to recover AD from a cyber attack and they just see
15:06
it happen sort of automatically, that's, that's the value
15:10
proposition right there. If you look at something like
15:14
purple lighter directory service protector DSP, you get a, a sort
15:19
of continuous feedback of your security posture in AD.
15:25
So it, it provides you a way of measuring how well you're doing
15:29
and you can use that to basically measuring your
15:32
success. So a lot of people say, well, I
15:33
used to be my authentication security was AD and now it's AB.
15:37
So you know, that's awesome. So I think that's that's another
15:42
way that customers use to to measure their success.
15:46
It's nice to have like, that tangible, tangible scorecard,
15:48
right? Look, mom, I got an A.
15:49
Yep. Yeah, exactly.
15:50
It's, it's exactly right. You'd think it it's kind of
15:53
silly, but if if you're in the identity space or in IT security
15:58
and you need to explain to senior management, you know, how
16:03
are you doing now and how would you improve things like kill
16:06
card's first and and people get it right.
16:08
They they they can understand that AD is bad and AB is, you
16:12
know, not too bad, but it could be an A.
16:14
So yeah, maybe work a little harder that sort of let.
16:17
Me ask you a side question here because I want to talk about hip
16:19
comp next, but is it realistic to get an A?
16:23
Because I, I see a lot of times it's like there are risk
16:25
decisions that get made and maybe something gets sacrificed
16:28
in the name of like a user experience or, you know, a
16:30
business process and there's like risk acceptance.
16:33
But do you think it's realistic to say yes to get all A's on
16:36
that sort of analysis? Probably not I I'd say probably
16:41
not A's across the board probably doesn't make sense
16:45
because the the cost to do that probably not worth the risk that
16:51
it it mitigates. Meaning like the remediation
16:54
steps to like get to that pay on that next level.
16:56
Yeah. Yeah, exactly.
16:59
But I think it's, it's really important to understand where
17:03
you're at. And that way you can make those
17:05
trade off decisions cautiously and say, yeah, we could.
17:10
This this application is kind of a risk because of the way Java's
17:14
handling credentials. But we know that we've protected
17:17
the server. It's on an isolated network.
17:19
So you know, that's OK. We'll, we'll do that.
17:22
Yeah, other layers right to help descend whatever it may be.
17:25
Exactly. Let's talk about hip comp
17:28
because this is something that's taking place in November,
17:31
November 13th of 14. It's in New Orleans, so that's
17:35
exciting. We actually have a discount code
17:37
IDAC POD. We'll get you 20% off of that.
17:41
I've never been to hip comp and it stands for Hybrid Identity
17:44
Protection Conference. What's it like to be there?
17:47
What is it and how many chicken and waffles can I get in New
17:51
Orleans? So I'm going to, I'm going to
17:54
come back to the chicken question because there's
17:55
actually more to that question than you might think.
17:58
So Hip Conf is a conference that we've been sponsoring for
18:02
probably four or five years. We organize it as well.
18:06
It's non, non vendor specific. It's this is not a Sumperas user
18:12
group, it's not Sumperas product pitch.
18:14
It's really all about educating practitioners on the insurance
18:20
and outs of securing your hybrid identity infrastructure.
18:23
And that primarily is Active Directory and and, and try deep.
18:28
We get the the speakers are all either highly experienced
18:36
managers of technical teams in our actual practitioners.
18:42
But the goal is for all these sessions that you go in, you
18:45
learn something and you can take it home and use that's, that's
18:48
sort of what we're shooting for all the sessions.
18:51
Some of the people we've got. So we have a couple of people
18:54
from Microsoft. So Alex Weiner too, runs their
18:58
identity security effort for Azure or well, Azure and enter
19:04
ID is going to be keynoting it. Marty Mobgian's a guy, He's a
19:10
simperis guy now, but he runs our a lot of our incident
19:16
response. He used to run incident response
19:18
for healthcare at CDW and so he has a lot of background on what
19:25
what recovering from a real ransomware attack looks like.
19:29
And other people are we got like Joe Kaplan from Accenture who
19:35
has, he's done everything with identity and Accenture starting
19:39
from, you know, ADFR Active Directory, not the ADFS Active
19:45
Directory federation services through rolling out passwordless
19:51
authentication and etcetera. So you're talking about 809
19:54
hundred thousand people. So managing those kinds of
19:58
transformations of large enterprises, he's got great
20:01
insight into how that process works and where all the, all the
20:04
potholes are. So that's the kind of material
20:09
that we're, we're presenting at hip hop.
20:13
As far as the experiences, it's, it's, it's very technical, you
20:18
know, we, we like to say. You know, 304 hundred level
20:22
kinds of kinds of stuff. It's very welcoming in the sense
20:28
that we've built a great cadre, a great community around hip
20:33
conf. And if you're in the identity
20:35
space, it's not sort of like all the speakers are over there and
20:39
you're sitting over here. It's very it's a very engaging
20:42
atmosphere. So you get to talk with all the
20:44
speakers. We make lots of time for, for
20:46
networking, finding, finding peer groups and, and talking
20:51
with them. And of course, a place like New
20:53
Orleans has a few places that you can go to afterwards, you
20:57
know, and, and after you've met a few people that you want to
20:59
get to know a little bit better so that, that, that works out as
21:02
well. Hey Gil, I'm going to transition
21:04
us into the discussion around the ransomware report, but we've
21:08
talked a lot about Active Directory.
21:11
It's in my perspective that theoretically is true.
21:15
And unfortunately I've seen this in the real world as well, which
21:19
is that Active Directory is kind of the honeypot.
21:22
That's what, you know, getting full control over the Active
21:26
Directory is what the ransomware actors are looking for.
21:31
Or you could say it's they're, you know, it's the chicken and
21:34
waffles recipe all in one. Don't take my chicken and
21:38
waffles, man. Come on, Gillard.
21:42
I mean, why is that true? So for a couple of reasons, what
21:48
is you know, I mentioned earlier that cyber attacks invariably,
21:52
well almost invariably have to compromise the identity system
21:57
in some way. You have to either pretend
22:00
you're someone who you're not and you're be able to get the
22:06
privileges of someone who you're not.
22:09
And it almost doesn't matter which identity platform it is.
22:13
Whichever 1 you have is the one that you have to compromise to
22:15
get unfettered access. The other other reason is Active
22:22
Directory isn't just a catalogue of users, it's it's got
22:27
information about all of the computers and services that are
22:32
running on your network. So it's a great reconnaissance
22:34
tool. So first thing an attacker's
22:38
going to do once they land on somebody's machine that happens
22:40
to be domain joined is is run a query on AD get all the
22:44
computers outlook for all the ones that say, you know, top
22:48
secret sequel server or something like that, you know,
22:50
because that tells them the machine they want to go after
22:53
next. And then the third thing, and
23:00
this is this is something that is kind of interesting, but
23:03
Active Directory is actually a great malware distribution tool
23:08
using using group policy in SYSFALL.
23:11
So you can as an attacker, if you're trying to deploy
23:18
ransomware, you know, globally on the network, one way you
23:22
could do it is drop it in SYSFALL and change everybody's
23:25
log on script to download the the malware.
23:30
So that's, I mean, those are sort of the primary reasons that
23:33
people go after AD. It's it's the keys to the
23:36
Kingdom. It's a great.
23:37
Description without going into all the details and there's many
23:40
ways that people can conduct an attack, but a lot of times
23:45
they're trying to laterally move into different accounts that are
23:50
more powerful. I think they've helped us
23:52
counts, I think service accounts.
23:56
That seems to me to be a major vulnerability.
23:59
I love the idea of somebody listening to the podcast,
24:04
hopefully not driving their car and listening and taking notes
24:08
as they're listening to Gil. So what maybe is a take away of
24:12
something someone can do today to, you know, take a step toward
24:17
being less vulnerable? Tell you the truth, the very
24:21
first thing I would do is download Purple Night.
24:25
It's free and rather than in your environment and I'm, I'm
24:30
going to guess that since most well, your audience is all
24:33
interested in identity, that good number of your audience has
24:35
done that already. Does it require any special
24:38
privileges? You just put it on a workstation
24:40
that's domain joined and run it and get your report card and
24:45
take a look at the, the grades that it it assigns to you.
24:48
I mean, they're just grades, right?
24:49
They're just, you're out there. A is sort of an evaluation that
24:53
we made-up that sort of makes sense.
24:55
But then look at the, the details underneath that about
24:59
things that that purple like found about like delegations,
25:03
insecure delegations. That's a favorite one that would
25:08
enable an attacker to elevate their privileges by compromising
25:12
a member of a group, for instance.
25:17
You know, there's all kinds of things in that report.
25:18
It's it's, it's pretty impressive.
25:20
I'm I'm really pleased with that product.
25:23
You know, one other thing I think about with when it comes
25:26
to why takeover, if an Active Directory is such a beneficial
25:35
thing for a ransomware actor, is that it's so hard to restore
25:39
Active Directory, right? And a lot of times ransomware
25:45
accounts can be taken over, you know, before the event.
25:49
So not having a good backup and restore methodology, like I'm
25:54
not trying to just serve things up easy to you, but this is just
25:58
the basics of running an IT environment is you need to be
26:02
able to have backups that you can rely on at a restore policy
26:06
that you can test on a periodic basis so that you're sure it's
26:10
going to work when you need it. I mean, this could literally be
26:15
the ability for your business to do business the next day.
26:19
I mean, that's exactly right. Control of the Active Directory,
26:23
you can wipe out the e-mail system, You, you can do all
26:27
kinds of things. I mean, there have been real
26:29
world examples of companies unable to operate for a week.
26:36
I mean, Can you imagine your organization being unable to
26:39
operate for a week? So I'm not trying to just make
26:43
it fear, uncertainty and doubt, but these are real risks and if
26:48
they happen on your watch, it's going to be a very uncomfortable
26:51
position. Yep, it's you.
26:54
You pretty much nailed it. It's not.
26:57
Not only is Active Directory a great thing for attackers to go
27:00
after because of what it lets them do, but if they compromise,
27:07
for instance, if they flatmile your domain controllers, you've
27:11
got a real projection on your hands because recovering AD from
27:14
backup is hard. And you can't just, you can't
27:18
just go back to the last backups, right?
27:21
Because those are probably compromised as well.
27:24
You know, they're, they're going to have changes in ACL's,
27:27
they're going to have changes in grid membership.
27:29
So I'll have back door, back door accounts that have been
27:31
added. And you have basically you have
27:35
to do the and even be other changes in Active Directory.
27:39
But there's going to be malware on the servers in Windows.
27:42
They're going to be hacked DLLS and executables that sit on
27:46
those backed up backup images as well.
27:50
So you'd need to recover in an isolated environment on fresh
27:53
installs of Windows that you know are good.
27:56
And you have to be able to recover just the data of Active
27:59
Directory, not the entire binary environment of Windows.
28:04
And if you can't do that, then you can't really rely on the
28:07
system that you recovered. So let's talk about the
28:11
ransomware risk report. We'll finally get to that and
28:15
it's available on some Prince's website, but we'll have a link
28:18
to it in our show notes. And I made, you know, I kind of
28:23
made notes for some of the statistics that really jumped
28:27
out at me. The first one was ransomware
28:31
attacks are frequent and severe. Organizations are facing a
28:34
constant threat of ransomware attacks, with 74% of victims
28:39
experiencing multiple attacks sometime within the same day.
28:43
Tell us a little bit more about that one.
28:46
So the the I shouldn't have been shocked, but when I read it the
28:51
first time, I was. But essentially all
28:56
organizations are being attacked by ransomware a couple of times
29:00
a year. I mean, it just happens
29:01
continuously. It's not, it's not a notable
29:04
event anymore really. It's just one of those
29:07
continuous things that security teams are dealing with, which I
29:12
didn't quite, I hadn't internalized that before.
29:15
So that was surprising. The the other one about, you
29:19
know, suffering multiple attacks in a day was a new one.
29:23
And and then there's also the, you know, paying, paying
29:26
multiple ransoms as well for a single attack, which we can talk
29:30
about. What does that mean to have
29:32
multiple texts? Can you explain it?
29:33
Is it is it literally like different?
29:35
Is it different attackers or is it part of the same attack as
29:38
just multi stage or something like that?
29:40
So it's, it's, it's both. So I know we, we did, we helped
29:45
the company with their incident response and they had four
29:49
separate threat actors in the environment that were attacking
29:52
them in their AD. It was a, it was a disaster.
29:55
It was a complete mess, but I think what happens now that,
30:00
that, that, that, you know, raise aware and, and cyber, the
30:06
cyber attacks in general have been commoditized and
30:10
commercialized. You, you know, as soon as an
30:12
endpoint gets compromised or, and, and there's some back door
30:16
inserted on, on that, on that machine, that IP address gets
30:20
published and sold to whoever wants to buy it to insert their
30:24
own, you know, for another attacker to insert their own
30:26
software. And I think that's, that's one
30:31
of the reasons why you see multiple attacks is, is that
30:33
same IP address has been purchased by, you know, half a
30:37
dozen attackers and whoever gets around to doing it will be in
30:42
the network. And you have multiple attacks
30:43
going on simultaneously. There used to be that I think a
30:48
company would report a ransomware attack or some sort
30:50
of a cyber attack and it'd be in the news and then all the
30:53
attackers would pile on once they saw that in the news
30:56
because you figure, oh, they could compromise and we we
30:58
probably can't too. But now I think it's because all
31:01
that stuff's just being sold, not on the dark web.
31:04
You can. You could buy a 10,000 IP
31:06
addresses and start working on it.
31:10
Yeah, and it also seems to me like, so the, there's a, a sub
31:15
plane that which was around paying multiple ransoms.
31:18
I'm wondering is that you're paying multiple ransoms to
31:21
different people or is it just that you can't really trust you
31:25
the the people that are holding you for ransom?
31:28
Give us $100,000. You give it to them.
31:31
No, we want more. We want $200,000.
31:36
So there there that was another one that I thought was
31:38
surprising and there are a few things underlying that.
31:41
One, what is the nature of ransom where a tax has changed?
31:44
It used to be, you know, sort of like not Petcha, we're just
31:48
going to encrypt all your machines and then we, we'll sell
31:50
you the decryption keys. But now what's happening is, is
31:56
attackers are exfiltrating sensitive data or data that they
32:00
can get their hands on anyway and holding that for ransom.
32:04
They're, they're saying things like we're going to publicize
32:07
all this information and, and if you don't pay US money for the,
32:12
for the data. So you've got two things you
32:14
have to buy now. You've got decryption keys and
32:17
the get rid of my data key if you will.
32:23
But how do you really know that they're deleting the data?
32:25
Well, you mean. Is it, is it such a thing as
32:27
honor to say, OK, well, I promise as as you're, you know,
32:32
assigned criminals that I will, that I will delete the data that
32:36
you get that you paid me for. And that's, that's, I think the
32:39
thing that companies are maybe missing, I think the, the hit
32:41
rate on, on the decryption keys is I think those either fail to
32:46
work or they don't actually get keys like 30 or 40% of the time
32:51
roughly. So already you have to add a
32:54
premium to whatever ransom you're, you're paying for that.
32:59
And even if the attacker say, OK, well, we, we deleted the,
33:03
the data that we had stole it, they've sold it to somebody
33:06
else. And then so now somebody else
33:09
has it. So maybe they're not going to
33:10
publicize it, but somebody else will or somebody else would use
33:13
that and spend more time grinding through it to see
33:16
what's interesting in there and then sell that data.
33:18
It's there is is no honor in this in this scenario.
33:24
So, Gil, I was going to ask about that issue of decryption
33:27
keys. You mentioned that sometimes
33:29
they don't work. I've heard that a lot of cases
33:32
they start they they actually work, but they operate so slowly
33:37
that performing the decryption would take months.
33:40
And so if companies fall back to some other way to get their data
33:44
back. Yeah, there it takes, it can
33:47
take a long time. And the other thing is that in a
33:50
lot of cases when binaries have been encrypted, the way the
33:54
encryption works is it it can actually add a bunch of random
33:59
bits to the end of the file. And when it's decrypted, those
34:03
random bits are still there, they've just been decrypted.
34:06
And so you've got binaries that you've quote decrypted, but they
34:09
still don't load, so you can't run them.
34:12
So even though you've you've unransomed your your your
34:16
Windows machine, it won't boot. OK, so now that we've figured
34:20
out there's no honor amongst thieves, the second, the second
34:26
point that it kind of jumped out to me was I'm going to read it
34:28
off. Business disruption is
34:30
widespread. Ransomware attacks cause
34:33
significant business disruption with 87% of attacks leads to
34:38
disruption like data loss or system downtime, even when
34:41
organizations have disaster recovery and backup systems in
34:45
place and IT. So what is the?
34:47
What is the case is that they have the backup systems in
34:50
place, but they can't restore them.
34:53
Yeah, a lot of times the backups themselves have been encrypted.
34:58
That's, that's one of the mistakes that companies still
35:01
make to this day as they store their backup images on a server
35:06
someplace. And that's, if not the first
35:09
thing the attackers go after, it's maybe the second or third.
35:13
So that's, that's kind of a fail when people do that.
35:17
The other thing is, is a lot of times IT orgs have not gone not
35:23
thought carefully through the process of recovery.
35:27
They think, OK, I've got a backup of the SQL Server so I
35:31
can recover it. Well, it turns out it's not just
35:34
the SQL Server, but there's a whole file system on another
35:37
server that's necessary for this application to run.
35:40
And you don't back that up very often, or you back that up on a
35:43
different schedule. So you've got a database for one
35:45
day in a file system from a different day, and now the
35:48
application's confused and it doesn't work.
35:50
So the whole whole problem of, of recovery from the sort of an
35:54
attack is, is hard. And you, you, you have to work
35:58
through it and work out all the details and actually and
36:02
actually test it. So I think that's another reason
36:05
that people can't recover. So the next one I found was was
36:10
I found the other one that was really interesting.
36:12
Gil, if I could, most companies pay the ransom.
36:16
So 70 and 78% percent end up paying the ransom, 32% paid it
36:23
four or more times. So here's my question.
36:28
Should companies pay the ransom? I I think we get this idea that
36:33
when a ransom is being held because a human being is being
36:36
held hostage, the advice is and I've never been.
36:41
In, of course no. No, don't, don't.
36:45
Screw the hostage. I think what I see on TV is they
36:48
say don't pay the ransom, right. And from what I've heard, most
36:54
public sector organizations don't pay the ransom and receive
36:58
less ransomware attacks maybe because of that.
37:02
But can we really blame companies for paying the ransom?
37:05
I heard there were two casino, large casino operators in Las
37:10
Vegas. I think it was last year the
37:13
faith were hit by the same and I it was more like a social
37:18
engineering. I think it ultimately led to
37:20
ransomware, but one paid the ransom, the other did not.
37:24
The one that paid the ransom never suffered any downtime or
37:28
issues. The one that that did not pay
37:31
the ransom got owned and had a lot of very public side effects
37:36
because of that. So are companies wise or unwise
37:42
to pay the ransom? It's, it's a, it's tough if you
37:47
try to judge it as a, as a mural decision because you can argue
37:52
both, both sides pretty effectively, I think.
37:56
But if you look at it from an economics point of view, what's
38:00
the most effective response for the, you know, the life of your
38:06
company? That's maybe a little easier
38:09
decision to manage because if you have an idea of what it's
38:13
going to take to recover from backup and you have an idea of
38:17
what what the ransom is and what the risk is or what the
38:20
likelihood is that the the threat actors will actually give
38:25
you valid, you know, decryption keys and get rid of the data
38:29
that they stole. Yeah.
38:31
Then you can sort of, you have a framework to make a decision.
38:34
And I certainly wouldn't blame anybody for making the decision
38:38
to pay the ransom, but I think they also don't aren't looking
38:42
carefully at the costs that they're going to incur either
38:46
way they go. And the, and the solution, you
38:50
know which, which is an idealistic solution, but I think
38:52
it's the way it's the way forward is you need to be able
38:55
to recover your systems. And so if somebody you know,
39:01
attacks your environment, well, you just thumb your nose out.
39:04
I mean, you just recover from knowing good backups and, and
39:06
off you go. I mean, if you think about it,
39:08
if you could, if you could recover your entire IT estate in
39:12
15 minutes by pushing a button, well, ransomware is totally
39:17
irrelevant. Then you know who cares, right?
39:19
You don't care. Who cares?
39:21
So I think that's that's the direction you want to move in as
39:24
you want to make your, and this is and this actually brings in,
39:29
this is where the term resilience comes in.
39:32
You can't prevent the attack. I think we're, we're pretty,
39:34
pretty clear on that. But you can make it harder for
39:38
the attack to take on full sort of network wide scale and you
39:44
can make your environment more resilient, which means you can
39:47
recover from that attack more easily and more quickly and more
39:50
effectively. So I think that's how I tend to
39:52
look at that, that decision making process.
39:55
So I wanna, I wanna pick on the second part.
39:58
I mean, 78% paying a can of get. And I think there might be even
40:01
something in the US from like a government, either policy or
40:04
even a law that that they're not allowed to pay.
40:07
And maybe that helps. But 32% paid it four or more
40:12
times in the past. How bad is your security if
40:14
you're like, oh, this is our 4th ransomware event of the year.
40:18
I mean, one is bad enough. Yeah.
40:21
I mean, are these just repeat things?
40:23
I I mean, how do you, how do you quantify something like that?
40:25
Is it the same attack or is there a way to?
40:28
Is it really separate attacks that kind of weak that number?
40:32
I have to look at the at the details of that question and the
40:34
responses because I don't understand that really myself.
40:38
I, I know there are cases where the threat actors are asking for
40:42
multiple ransoms. I know that happens, but I
40:45
didn't think it happened that often and it's mind boggling
40:49
that the same company would be paying multiple threat actors
40:55
for what looks like the same, you know, multiple attacks at
40:58
the same time. That line item, the budget, oh,
41:01
that's our ransomware budget. We know we're going to get hit,
41:04
so we're just going to put money into it.
41:07
Geez, we could, we could spend some time talking about cyber
41:09
insurance and, and how that all relates to this as well, because
41:12
that's, that's part of the story too.
41:16
This next point that I pulled from the report, I thought it
41:19
was interesting it gets into organizations like Active
41:24
Directory Specific Protection. I just wanted to highlight a
41:28
point which is if you are using non AD or non Microsoft systems
41:35
for IGA or privilege Access management or an IDP, but you
41:40
have Active Directory in your environment, perhaps your e-mail
41:44
system is tied to it. You, you know, you still have
41:47
the same risk. So it goes on to say, while many
41:51
organizations have identity recovery plans, only 27% have
41:55
dedicated systems for recovering AD and prime targets for
42:00
attackers. So to me, you know, this is one
42:04
of the points that I've kind of felt for a long time is that
42:08
when you're doing your disaster recovery plan, you not only need
42:13
to think of it in terms of, OK, an asteroid, his heart data
42:17
center or there's some kind of fire that that takes us out of
42:21
business. You really need to be thinking
42:23
about the intentional targeting of your organization and bring
42:28
down your IT systems security. Your Active Directory, Yep,
42:33
that's, that's something that I think IT orgs are getting their
42:37
heads or have gotten their heads around that the, you know, the
42:41
the classic data center fire or, you know, ran a backhoe over the
42:45
fiber kind of disaster recovery scenario.
42:49
That's that's one class of of thing.
42:51
But but cyber attacks are entirely different.
42:54
They're not they're not defined by physical boundaries.
42:57
They're they're it's a logical attack essentially.
43:00
And once you know, even if you're a globally distributed
43:03
company, you know what's I laying on a domain controller, I
43:08
can get rid of all the domain controllers.
43:10
I can do it pretty quick. So it's a different is the
43:13
nature of the attack is entirely different.
43:17
Yeah. And Gil, what I wanted to wrap
43:18
up with was, I kind of feel like from a, if you watch the news,
43:24
we're hearing less about ransomware attacks than maybe we
43:27
were hearing about in previous years.
43:31
Is that the case? I mean, why is that?
43:34
Why do you think it's less than the headlines?
43:37
Yeah, I'm, I'm not sure I, I know why that would be the case
43:41
because certainly the number of attacks based on our survey has,
43:47
has gone up. It's not gone down at all.
43:50
Part of it, it probably has to do with the, the, the, the
43:55
detrimental PR around it that you would rather not say
43:58
anything about it if you don't have to.
44:00
But I think also that's that's going to change in the near
44:03
future because there there's there's some regulations that
44:07
are that have come out of seesaw that effect a broad swath of
44:13
verticals. So I mean, there's probably
44:15
about 15 different vertical verticals for companies that
44:19
that are affected by these regulations.
44:21
What's it called? Cersea the the cyber, Yeah.
44:26
There's like a notification law, right?
44:27
Yeah. So notification if it's a
44:28
certain number of users and certain number of financial
44:31
impact if. You're in a certain industry,
44:32
Cersea, Yeah. And so I think we're going to
44:36
see a lot more reports coming out because of that when that
44:40
regulation goes into effect and that's coming up imminently, I
44:44
think you know, pretty soon. But to ask you to answer your
44:49
question, I, I don't really know why we don't hear about it.
44:51
Maybe it's just not interesting anymore.
44:52
So that's what. I was thinking, that's my
44:55
theory. And you know, I want, I'm, I'm
44:58
glad that Jimmy asked this question because my theory is
45:00
this is we've become desensitized to it.
45:03
Oh, it's ransomware. And unless it's like a major 1,
45:06
like, you know, a pipeline, a hospital or something that has
45:09
like a major impact. I mean, there's clearly a lot of
45:13
attacks happening. They're just not newsworthy.
45:15
And it's like, kind of like, oh, who cares?
45:17
You know, unless it affects me and it's a critical, you know,
45:21
infrastructure thing that kind of makes the news.
45:25
That's my feelings. Like, I feel like this we're
45:26
just become desensitized. And it's just, it's not, they're
45:29
not worth the 15 minutes of fame that they're getting.
45:32
Yeah, and I, I think there's a lot to that because, you know,
45:36
the the news that gets published is the news that gets clicked
45:39
on. And you know, Joe's Animal
45:43
Hospital in in Salt Lake City being ransomware, it is not
45:48
something people are going to click on unless you happen to
45:51
have a pet that you take to Joe's Animal Hospital, you know,
45:54
so that. Even then, I think I like I get
45:57
desensitized like, OK, another breach.
45:59
My data was in it. What am I going to do?
46:01
Change my Social Security number, you know, change my
46:04
name, you know, it's just it's it's some place like, OK, cool.
46:09
Like I'm sure, you know, at this point I would, I would find it
46:12
very hard to believe that at least in the US that no American
46:15
has never been had any of their data in any breach and ever,
46:20
right. Like I think something has been
46:21
leaked. Yeah.
46:23
And what can you do about it? And so much of your data is, is
46:27
owned by, by marketing companies now in some way or another.
46:30
Anyhow, it's, you know, it's, you're probably not saving
46:35
yourself a lot of grief if you, if you go through that, you
46:39
know, try to hide my identity stuff.
46:42
So nobody wants to give the answer.
46:44
So nobody wants to give the answer that enterprises have
46:47
invested in reducing the risk of ransomware attacks and that's
46:53
why they've gone down. OK, they have spent a truckload
46:57
on it and the problem is that it's it's sort of you know, the
47:05
attackers are are, are evolving at the same rate that the that
47:09
the defenders are. It's, it's, you know, and you if
47:12
you look in the future with with the introduction of AI based
47:18
attacks and AI based defense, that at some point we're just
47:23
going to sit back and let the AIS do Duke it out and, and
47:25
we'll see who wins the. Argument.
47:27
Tell me who won. Yeah, and and the and the
47:30
winners will be either NVIDIA or the the power generating
47:33
companies. Yeah, that's a circles down to
47:36
basic blocking and tackling in identity access management.
47:41
It's fishing, it's social engineering of the help desk to
47:46
get me in the front door, reset someone's cred so I can come in.
47:51
And I I sometimes shake my head that we're still here.
47:56
The blocking and tackling thing is, is really, really important.
48:00
I've, I've been saying this for years that if you just do the
48:04
basics well and and diligently, that gets you a long ways.
48:09
You know that that makes it much harder for for you either to get
48:12
compromised or for the attackers to do anything once they've
48:15
compromised an account. That's also one of the things
48:20
that purple light can help you with because it's it's
48:23
essentially a catalogue of all the block, blocks and tackles
48:26
that you need to make. Yeah, here's what you should do.
48:29
Do this. It's like literally a playbook,
48:31
right? Exactly.
48:32
I mean, you really don't have an excuse at that point.
48:33
It's like, well, I didn't know what to do.
48:34
Well, here's a free tool that will tell you that.
48:36
So we'll have a link to that in our show notes.
48:38
I got one thing I want to wrap up on before we shift to
48:41
piloting because I want to ask you about piloting is do you
48:45
think so? I remember which one you guys
48:47
said it, but just now was the investment, there's huge
48:50
investment being made in cybersecurity and specifically
48:53
against this. Is this a case where may not
48:56
everybody's investing in it? So does a big company who makes
49:00
a big splash to say we're going to spend $10 million or $10
49:04
billion skew a number like that to say, oh, yeah, there's more,
49:08
there's more investment that's ever been made.
49:10
But are there, I guess, are there big companies that have
49:13
massive investments that sort of drive that into a false sense
49:17
of, of a rising tide lifts all boats?
49:21
I'm just curious what you guys think.
49:24
'Cause I can't imagine. The the veterinarian, right that
49:27
you, that you use an example, right, The pet hospital, they're
49:30
probably not spending $10 million on cybersecurity tools.
49:33
But for sure a large. Company is, you know, does the
49:37
spend equate to the overall risk reduction to the?
49:40
Industry, it might, it might, you know I mean, I, I, I don't
49:46
think I know enough about the, the the economics of
49:50
cybersecurity spend enough to really say for sure, but that's
49:54
entirely plausible that that some, you know, a relatively few
49:59
companies have spent a truckload of money and that sort of skews
50:02
the, the numbers. Yeah.
50:04
That's that's, I would say likely.
50:07
I do believe that it could be somewhat a case of you don't
50:11
have to be the fastest, you you just have to not be the slowest.
50:16
You have to be faster than the other guy.
50:19
Right. I mean, we both live in the
50:20
mountains, Gale, right? It's it's to outrun the bear.
50:22
You don't have to be the fastest 1, you know, just be fastest
50:24
with your friends that you're camping with.
50:26
Exactly right. Yeah, there's there's something
50:29
to that, I imagine. All right, let's talk piloting
50:32
because you mentioned before we hit record that you've got a
50:34
Cessna bird dog for the idea of piloting.
50:36
I would love to get a pilot's license and just fly all over
50:39
the place. I'm a big fan of it.
50:41
So you're doing what I hope to be doing.
50:43
So if we get more sponsored episodes, we need a whole lot
50:45
more for me to get a 20, that's for sure.
50:47
So I'm gonna, I'm gonna fanboy out over here and say, OK, tell
50:51
me about what it's like. Like you've got a plane, how did
50:54
you get into it? How often do you fly?
50:57
Like what's I think the range of that's probably what, a couple
50:59
100 miles, maybe 3 or 400 miles or more than that.
51:01
Yeah, it's so the. Cruising, it's holding back up a
51:05
little bit. The the bird dog is is a
51:08
military airplane that was designed to built really in the
51:13
Korean War, but used extensively in Vietnam.
51:17
And it was built for forward air control and reconnaissance.
51:20
So it was built to fly low and slow so that pilot and observer
51:25
could see what was going on on the ground and report back
51:27
either to direct an air strike or to direct artillery or just
51:32
to report back on on enemy troop of that.
51:34
So that that was its mission. It's not what you would call a
51:39
travelling airplane. Like it's not going to, you
51:41
know, if you, if you need to make a week weekly commute from
51:44
North Carolina to Dallas, that's not the airplane you'd want to
51:47
do because that would be true. Is that what you're saying
51:51
exactly? But what?
51:55
Actually one of the reasons I moved to Idaho is Idaho is
51:57
really well known for the mountains and rivers and the
52:01
fact that a lot of the rivers have almost no access to them
52:07
either by well, no, no Rd. access for sure.
52:10
But they do have lots of little grass strips that have been
52:13
built either by the Forest Service or BLM or Idaho Fish and
52:18
Game, so that those people can go out and service the areas.
52:23
And those are available for, for pilots to use.
52:25
And the bird dogs, an ideal Backcountry airplane for that
52:29
because it can get in and out of very short, unprepared strips
52:33
very easily. And so that's, that's one of the
52:38
reasons I'm here in Idaho. And one of the reasons I, I got
52:41
the bird dog is, is to spend more time flying in the
52:43
Backcountry, which is, is just wonderful.
52:47
I mean, to answer your other question, I started flying in
52:50
the 80s, but it started out in gliders and ended up doing a lot
52:58
of commercial rides in gliders. So I'd fly people out over
53:02
Massachusetts Bay in a glider. And then, you know, we were
53:05
flying in and out of Plymouth at that time and I got my power
53:10
rating in 95, I think, and been flying ever since.
53:18
So I, I typically, I probably fly every other weekend
53:22
somewhere not, I mean, generally it's maybe within an hour, hour
53:26
and a half, something like that. But there are so many little
53:29
Backcountry strips of Idaho. There's endless places to go
53:32
explore and you land someplace there's nobody around.
53:38
You have a, you know, you know, beautiful Creek, or maybe you
53:42
have the Middle Fork of the Salmon River, the Snake River,
53:45
one of those those kinds of wild rivers.
53:49
You're a trout fisherman. You know, you're all set.
53:52
You're set for life. And you can just you could camp
53:56
or you could just hang out, stick your feet in the water and
53:58
and commute with nature for a while and then wild.
54:03
That sounds so so. Awesome.
54:06
So you mentioned. Being able to like.
54:08
Drop into like a scenario like that, I mean short runway you
54:10
mentioned sort of the short landing and take off like what's
54:13
the I guess give me a sense for like how many yards or feet or
54:18
whatever it is like do you of space, do you actually need to
54:21
take off and land in this plane? So so probably.
54:25
If I'm on grass or gravel, yeah, sort of in the 500 to 1000 feet
54:33
is plenty. If I'm on asphalt, it can be a
54:39
little bit shorter, but none of the Backcountry strips are
54:42
asphalt. So and and the the bird dog that
54:46
I have has has had some modifications made to it.
54:48
So as a, as a, as more horsepower and wings that have
54:53
been specially modified for extra lift and, and for slow
54:57
flight. So it can, it can get down like
55:01
once the wheels touch the ground, I'm probably stopped
55:03
within 100 feet. Wow.
55:07
And a racing. Strike, maybe for speed.
55:11
Aerodynamics. Yeah, there you go.
55:14
That's pretty. Cool, What's the worst weather?
55:15
You've flown in. Give me a hair raising, hair
55:20
raising story. Let's ramp up the drama.
55:23
OK, so the. I So I haven't had any weather
55:29
related incidents other than once flying in a glider.
55:33
I, I used to race gliders when I lived in Arizona and the idea
55:37
would be that you, you launch a bunch of gliders at the same
55:40
time and then you have a, a designated race course.
55:44
So you go to Wickenburg and then go to Prescott and then go to,
55:49
you know, some other place and then you come back and whoever
55:52
goes around the fastest went. So that's the idea.
55:55
And it was a day where there were some big cumulus build UPS
56:01
that we were, we're, we're eventually going to turn into
56:04
thunderstorms, but those also have amazing lift those big
56:08
cumulus clouds. So I was cruising along in, in
56:12
my glider getting closer and closer to the bottom of the
56:15
cloud. And we have the regulations that
56:17
say you have to maintain a distance from the bottom of the
56:20
cloud. So I put the stick forward to
56:23
start descending and going faster.
56:25
But the thing just started sucking me up into it.
56:28
And I was really struggling to not get sucked up into the
56:31
cloud. And once you get into the cloud,
56:33
you have no visual reference and you can't tell up from down or
56:36
left to right. And you end up losing control
56:39
within. Yeah, within 30 seconds or so.
56:43
And I had I pulled the spoilers out to descend, I had the nose
56:47
down. I was probably going 130 or 140.
56:51
And it was just barely creeping down.
56:53
And all of a sudden you hear this huge bang, No idea what
56:57
that was. And I have this rush of ice cold
57:01
water running down my back. And it turns out that it just
57:07
started to rain. It was, you know, a thunderstorm
57:09
that just started. The crack I heard was a
57:12
thunder's clap somewhere. And that water was just leaking
57:17
in through the canopy because it it hit so hard.
57:20
It just poured in through the canopy and got sucked right down
57:23
the back of my shirt. So the bang you're worrying
57:26
about trying to get out of this cloud, the bang and the ice cold
57:30
water running down my back all of the same time was terrifying
57:34
for about 10 seconds. 15 seconds.
57:36
Then I realized what happened and it was OK, so and then you
57:40
got that one well. Enough to be out of the lift.
57:43
From. The from the cloud, I basically
57:44
just, you know, gunned it. Out from underneath the cloud,
57:47
and once I got outside the cloud, it was fine.
57:49
When did you fly again after that or yeah, that?
57:52
Point was lighter, but like, did you like, all right, I'm going
57:54
to take a break for a couple minutes.
57:55
I, I I. Actually didn't fly for a couple
57:59
of weeks after that. Yeah, OK.
58:01
Yeah, Jim, can we? Get an IDAC plane like we'll go
58:05
on it and like is, is that an appropriate business expense?
58:10
I don't see. Why not?
58:10
You'll have to check the. IRS guide for that though, Jeff,
58:14
I have a feeling they wouldn't go for that.
58:17
Sure. Come on.
58:21
All right, Well, let's go ahead and.
58:22
Write it off, though we probably couldn't find.
58:24
That. So unless you do a lot more
58:26
sponsors spotless, yeah, like one every day, that's probably
58:28
the way we have to. Do that.
58:29
So I'll, I'll, I'll talk to our marketing people and.
58:32
And see what we can do to help you out.
58:33
Yeah, Well, well, I'd say let's get let's.
58:35
Get the plug in, then you know, semperissemperis.com, SEMPERI
58:40
s.com. GAIL, thank you so much for
58:42
spending time with us. We're going to have a bunch of
58:44
links in our show notes. Definitely encourage people to
58:46
go check it out. I mean, this is something that's
58:47
almost like a no brainer. You need to have something to
58:50
protect your environment and this is a good solution to do
58:53
that. So with that, we'll go ahead and
58:55
wrap it up for this week. You can find Jim and I on the
58:57
web, idacpodcast.com. And of course, we're always on
59:00
LinkedIn. And then, yeah, our YouTube
59:03
channel, idacpodcast.tv. We'll take you straight to it.
59:05
So want to thank everybody for watching and or listening.
59:09
Gil, thank you so much for your time.
59:10
And we'll talk with everyone else in the next one.
59:15
You've been listening to Identity.
59:17
At the Center, we hope you've enjoyed the show.
59:20
Make sure to like, rate and review, and we'll be back soon.
59:25
But in the meantime, hit the website at
59:27
identity@thecenter.com. See you next time on Identity at
59:33
the Center.