Latest / Tech Talks With Kinsoft / Boston Scientific - One Network Box, Two Weeks Without Shipping, and Nothing Encrypted

Transcript

Boston Scientific - One Network Box, Two Weeks Without Shipping, and Nothing Encrypted · Tech Talks With Kinsoft

• 0:00
  You know, usually when we talk about a massive
• 0:02
  corporate disaster like a bank heist or something,
• 0:04
  there is this expectation of, well, obvious destruction.
• 0:08
  Right. Like it's highly visible. Yeah, exactly.
• 0:10
  You picture the blown open vault, the alarms
• 0:13
  blaring, the empty safe deposit boxes. The authorities
• 0:16
  walk in, point at the giant hole in the wall
• 0:19
  and say, well, there it is. That is what they
• 0:21
  took. There's a clear crime scene, an obvious
• 0:24
  point of entry and a quantifiable loss that,
• 0:27
  you know, everyone can immediately understand.
• 0:29
  But imagine you arrived at that exact same bank
• 0:32
  and the vault was perfectly intact. I mean, not
• 0:35
  a single dollar missing. No alarms tripped. Right.
• 0:38
  No alarms. The safety deposit boxes haven't even
• 0:40
  been breathed on. But the bank manager was so
• 0:43
  spooked by like a shadow near the back door that
• 0:46
  they intentionally welded the front door shut.
• 0:49
  They turned off all the ATMs. Yeah. just stopped
• 0:52
  letting anyone make a withdrawal or deposit for
• 0:54
  two entire weeks. Which would effectively crash
• 0:57
  the bank's operations, right? I mean, it would
• 0:59
  cause a massive financial panic. Completely.
• 1:02
  Even though the robbers themselves didn't actually
• 1:04
  steal a single cent or break a single lock. It
• 1:07
  completely flips our traditional understanding
• 1:09
  of what a security breach actually looks like
• 1:12
  in practice. And that is exactly what we are
• 1:15
  getting into today. Welcome to the Deep Dive.
• 1:17
  We are thrilled to have you with us as we explore
• 1:20
  a cybersecurity incident that defies absolutely
• 1:23
  everything we have come to expect about how cyber
• 1:25
  attacks work. It really does challenge all the
• 1:28
  assumptions. It does. So our source material
• 1:31
  for this deep dive comes from a September 25th,
• 1:34
  2026 catch -up edition of Tech Talks with Kinsoft.
• 1:37
  And our mission today is to understand how a
• 1:39
  massive global medical device maker lost two
• 1:42
  weeks of manufacturing and shipping. They completely
• 1:45
  tanked their quarter. Yes. And yet no data was
• 1:47
  stolen and no files were encrypted. Okay, let's
• 1:51
  unpack this. Well, it requires a fundamental
• 1:54
  shift in perspective. You know, we have been
• 1:56
  conditioned by the media and by past high profile
• 2:00
  incidents to associate cyber attacks with digital
• 2:03
  hostage situations. Oh, totally. We expect ransomware
• 2:06
  extortion. Exactly. We expect leaked databases
• 2:09
  and ruined hard drives. But this case reveals
• 2:12
  a completely different kind of vulnerability.
• 2:15
  Which is what makes it so fascinating. Right.
• 2:18
  It's one where the sheer fear of the unknown.
• 2:20
  And the actual protocols designed to protect
• 2:23
  a company become the destructive mechanism itself.
• 2:26
  So the company at the center of this is Boston
• 2:29
  Scientific. And to really grasp the gravity of
• 2:31
  a two -week shutdown, you kind of have to understand
• 2:33
  the sheer footprint of this giant. Right. This
• 2:36
  isn't some niche regional supplier with a warehouse
• 2:39
  in the suburbs. Not at all. I mean, they are
• 2:42
  based in Massachusetts, but they have roughly
• 2:43
  59 ,000 employees. Spread across more than 120
• 2:48
  countries. Yeah, and according to the HIPAA Journal,
• 2:51
  their medical devices are used by around 48 million
• 2:54
  patients every single year. We are talking about
• 2:56
  critical, life -altering hardware here. Specialized
• 3:00
  cardiac stents, advanced surgical products, neurological
• 3:03
  modulators. Stuff you kind of need. Right. These
• 3:06
  are devices that hospitals literally cannot function
• 3:08
  without. And crucially, most of what they sell
• 3:11
  is single -use. Like, the surgeon opens the sterile
• 3:13
  packaging, uses the device during a procedure,
• 3:16
  and then it is disposed of. It has to be replaced
• 3:18
  by a brand new one for the next patient. Exactly.
• 3:21
  So it is this high -volume, constant -flow supply
• 3:24
  chain. Because hospitals do not have the physical
• 3:27
  space or the budgets to stock infinite supplies
• 3:30
  of these specialized, single -use devices. They
• 3:33
  operate on a just -in -time inventory model.
• 3:36
  Right. They rely on a steady, mathematically
• 3:38
  predictable rhythm of shipping and fulfillment
• 3:40
  from the manufacturer. If a product is delayed,
• 3:43
  surgeries get canceled. It is really that simple.
• 3:46
  So keep that incredibly fragile, high stakes
• 3:49
  rhythm in mind as we look at the reality of this
• 3:51
  disruption. The pressure doesn't just build overnight.
• 3:54
  It compounds. It really snowballs. Based on U
• 3:58
  .S. time, on August 25th, an alert pops up. Boston
• 4:02
  Scientific detects what it broadly calls, quote,
• 4:04
  system availability issues, unquote, across parts
• 4:07
  of its network. And they trace it to an unauthorized
• 4:11
  third party. Right. They immediately begin containment
• 4:14
  protocols and bring in the cybersecurity heavy
• 4:16
  hitters CrowdStrike to investigate. And within
• 4:19
  hours, this digital anomaly translates into physical
• 4:22
  paralysis. Yeah. Over in Ireland, local media
• 4:25
  reports that staff at Boston Scientific's massive
• 4:28
  court campus are suddenly sent home. What's fascinating
• 4:31
  here is how the physical manifestation of a digital
• 4:34
  threat is just so immediate. Yes. An analyst
• 4:38
  in a security operations center sees an anomalous
• 4:40
  connection. And thousands of miles away, real
• 4:43
  people are walking out of physical manufacturing
• 4:45
  plants. The assembly lines building pacemakers
• 4:48
  just halt. The sterilization chambers power down.
• 4:51
  The lights are essentially turned off. It highlights
• 4:54
  how utterly tethered the physical manufacturing
• 4:57
  world is to its digital nervous system. Because
• 5:00
  without the network to tell the machines what
• 5:02
  to build or the shipping software to print the
• 5:04
  labels, the factory is just an expensive empty
• 5:06
  shell. Exactly. And over the next week, the momentum
• 5:09
  of the crisis just snowballs. It is not a matter
• 5:13
  of simply turning the servers back on the next
• 5:15
  morning. No, it takes until September 3rd through
• 5:18
  the 5th for shipping to even slowly start resuming
• 5:21
  from their major distribution centers. Right.
• 5:23
  The sterilization sites finally come back online.
• 5:26
  And manufacturing slowly spins back up. Because
• 5:29
  restarting a global manufacturing operation is
• 5:31
  agonizingly complex. It isn't a light switch.
• 5:34
  Not at all. When you sever a network unceremoniously,
• 5:38
  Databases get corrupted. Inventory systems lose
• 5:41
  sync with the physical warehouse shelves. Robotic
• 5:43
  assembly lines have to be recalibrated. Yeah,
• 5:46
  and software has to be carefully, methodically
• 5:48
  brought back online, segment by segment. You
• 5:51
  have to ensure the intruder isn't hiding in a
• 5:54
  reboot script. It's like a massive global train
• 5:57
  network slamming on the emergency brakes, all
• 5:59
  at exactly the same time, you know? Oh, that's
• 6:02
  a good way to put it. Like the sheer violent
• 6:04
  inertia of stopping is one thing. But getting
• 6:07
  it going again, you have to manually inspect
• 6:11
  every single mile of track. Coordinate every
• 6:14
  single automated signal. Yeah, and slowly build
• 6:17
  up the steam before those incredibly heavy trains
• 6:19
  can start moving safely. And while they are slowly
• 6:23
  getting those trains moving, the financial reality
• 6:25
  sets in. Right. On September 7th and 8th, the
• 6:28
  pressure culminates in a formal material cyber
• 6:31
  incident report filed with the SEC. They have
• 6:33
  to officially warn Wall Street that this disruption
• 6:35
  is so severe, they are going to miss their financial
• 6:38
  guidance for the quarter. And for the entire
• 6:41
  year. And with a new outlook scheduled for October
• 6:43
  28th, Quartz reports that shares fell over 4
• 6:47
  % on the news. Though, to be fair, the stock
• 6:50
  was already navigating a rough year for unrelated
• 6:53
  macroeconomic reasons. Sure. But finally, on
• 6:56
  September 9th, two full weeks after the initial
• 6:59
  alert, order fulfillment, manufacturing, and
• 7:01
  shipping are declared fully restored. Two weeks
• 7:04
  of severe operational degradation. Yeah. Normally,
• 7:08
  when a massive enterprise goes dark for half
• 7:10
  a month, we assume the attackers utterly destroyed
• 7:12
  the internal infrastructure. We assume the servers
• 7:15
  are melted slag and the databases are scrambled
• 7:17
  with military -grade encryption. But the forensic
• 7:19
  investigation tells a completely different story.
• 7:22
  CrowdStrike finishes their analysis by September
• 7:24
  18th, and the summary goes public on the 23rd
• 7:27
  Australian time. And the findings are defined
• 7:29
  entirely by what did not happen. Yeah, this part
• 7:32
  is wild. the investigators proved a massive almost
• 7:35
  confusing absence of malicious activity they
• 7:38
  found Absolutely zero evidence of data encryption.
• 7:42
  No activity in Microsoft 365 or their corporate
• 7:45
  email. Right. No interactive access to HR systems,
• 7:48
  manufacturing systems, industrial control systems,
• 7:50
  or research and development. There were no application
• 7:53
  -level logins to massive enterprise tools like
• 7:55
  SAP, Salesforce, or any of their cloud apps.
• 7:58
  And the absolute biggest sigh of relief, no patient
• 8:01
  or customer data was accessed, staged for exfiltration,
• 8:04
  or taken. Even the existing implanted heart devices
• 8:07
  out there in the world and their monitoring systems
• 8:10
  were completely untouched. Though I think new
• 8:13
  activations for cardiac remote monitoring were
• 8:15
  temporarily disrupted. Yes, temporarily. But
• 8:18
  overall, the environment was pristine. Aside
• 8:20
  from the initial unauthorized entry at the perimeter,
• 8:23
  the attackers did nothing. In technical terms,
• 8:26
  there was no lateral movement. Okay, so lateral
• 8:28
  movement being the attacker's ability to hop
• 8:30
  from the initial break -in point over to the
• 8:32
  really valuable stuff. Exactly. When an attacker
• 8:35
  breaches a network edge, they usually land in
• 8:37
  an unprivileged zone. To do real damage, they
• 8:41
  have to move laterally. Meaning they search for
• 8:43
  internal vulnerabilities, steal administrative
• 8:45
  credentials, stuff like that? Yeah. And hopping
• 8:49
  from server to server until they reach the quote
• 8:51
  -unquote crown jewels, like the customer database
• 8:54
  or the core financial systems. So in this case,
• 8:57
  the attackers essentially broke into the foyer,
• 8:59
  couldn't figure out how to open any of the interior
• 9:01
  doors, and just stood there? Pretty much. Furthermore,
• 9:05
  no credible threat group even claimed responsibility.
• 9:08
  Really? Nobody tried to take credit. Well, the
• 9:10
  HIPAA Journal actually had to issue a correction
• 9:12
  after initially linking it to a ransomware group
• 9:15
  called Shiny Hunters. Oh, right. And a separate
• 9:18
  claim by a pro -Russian hacktivist group was
• 9:21
  completely unsubstantiated. There wasn't even
• 9:23
  a known CVE, a common vulnerability and exposure,
• 9:27
  linked to the breach. Wait, hold on. I'm looking
• 9:30
  at this list of untouched systems. If no patient
• 9:34
  data was stolen, no files were encrypted, no
• 9:36
  ransomware deployed, and the cloud apps were
• 9:38
  perfectly fine, why on earth did the company
• 9:40
  panic and stay down for two weeks? It's a great
• 9:43
  question. I mean, why suffer all that financial
• 9:46
  damage and shut down the Cork campus if the attackers
• 9:48
  were just standing in the foyer and didn't actually
• 9:51
  break anything? That feels like a massive overreaction.
• 9:54
  It seems like an overreaction until you understand
• 9:57
  the reality of incident response. In today's
• 10:00
  threat landscape. The most devastating operational
• 10:03
  damage isn't always caused by the attacker's
• 10:05
  weapons. Okay, what do you mean? Sometimes it
• 10:08
  is entirely caused by the victim's shield. Meaning
• 10:12
  Boston Scientific essentially did this to themselves?
• 10:14
  Like they caused their own outage? Yes. The two
• 10:18
  -week outage was the direct result of the company's
• 10:20
  own defensive containment strategy. Wow. When
• 10:24
  a security team detects an active, unauthorized
• 10:26
  intruder inside the network, But they don't yet
• 10:28
  have perfect visibility into how deep the intruder
• 10:31
  is or what their intentions are. The standard
• 10:34
  responsible playbook is to immediately sever
• 10:37
  connections. You pull up the drawbridge to prevent
• 10:40
  the lateral movement we just talked about. Exactly.
• 10:42
  You lock it down. Which explains why the CEO,
• 10:45
  Mike Mahoney, stated publicly that all plants
• 10:48
  and distribution centers globally were shut down.
• 10:50
  Not just the specific server that was breached,
• 10:52
  but the entire global physical operation. Right.
• 10:56
  And that happens because of how enterprise networks
• 10:58
  are architected. Modern companies operate in
• 11:01
  a hybrid environment. They have cloud systems
• 11:04
  like Salesforce for customer relationship management
• 11:06
  or Microsoft 365 for email. Which are hosted
• 11:10
  off -site on external servers. Those were perfectly
• 11:13
  safe. But the foundational on -premises systems,
• 11:16
  the localized servers that actually run the factory
• 11:18
  floor manufacturing robots, manage the physical
• 11:20
  warehouse inventory, and process real -time shipping
• 11:23
  orders, those are tightly interconnected. Yes.
• 11:26
  So when the security team realized the intruder
• 11:28
  had touched the on -premises network, they intentionally
• 11:31
  shut those internal systems down to ensure the
• 11:35
  attacker couldn't use them to pivot or deploy
• 11:37
  ransomware. It's like finding a tiny leak in
• 11:40
  the plumbing of your guest bathroom, so you run
• 11:42
  down to the basement and shut off the main water
• 11:43
  valve to the entire house. That is exactly what
• 11:46
  it is like. The house is completely safe from
• 11:49
  flooding, which is great. But now nobody can
• 11:52
  take a shower, you can't run the dishwasher,
• 11:54
  and you can't wash your hands for two weeks while
• 11:56
  you wait for the plumber to meticulously check
• 11:58
  every single pipe to confirm the leak was just
• 12:01
  a loose washer. The cure, in the immediate term,
• 12:04
  genuinely feels as debilitating as the disease.
• 12:08
  If we connect this to the bigger picture, it
• 12:10
  exposes a critical vulnerability in business
• 12:12
  continuity. Yeah, because Boston Scientific successfully
• 12:15
  survived the cyber threat. They protected their
• 12:18
  data, but their revenue stream took a massive
• 12:20
  hit. It demonstrates that knowing exactly which
• 12:23
  on -premises systems your physical business genuinely
• 12:26
  cannot function without is a critical map every
• 12:29
  company needs to draw before an emergency strikes.
• 12:32
  Because the business impact of throwing that
• 12:35
  main water valve is brutal. Oh, absolutely. Analysts
• 12:38
  at J .P. Morgan pointed out a really harsh reality
• 12:41
  for the medical device industry. Remember, these
• 12:43
  are single -use devices. Right. If a hospital
• 12:46
  has a specialized surgery scheduled for Tuesday
• 12:47
  morning and your shipping is halted so the required
• 12:51
  stent doesn't arrive, the hospital doesn't just
• 12:53
  put the patient on hold for two weeks. No, they
• 12:56
  pivot to a competitor's product or they utilize
• 12:59
  an alternative method. So that sale isn't just
• 13:01
  delayed until Boston Scientific gets its servers
• 13:03
  back online. That sale is lost completely. Right.
• 13:07
  The company hopes to recover some of that revenue,
• 13:10
  but a massive chunk of it simply evaporated because
• 13:13
  the factory was forced to hold its breath. Business
• 13:16
  leaders, not just IT departments, have to be
• 13:19
  deeply involved in network architecture decisions
• 13:21
  for this exact reason. Yes. If your critical
• 13:25
  order fulfillment server sits in the same blast
• 13:27
  radius as a vulnerable edge device, your entire
• 13:31
  global revenue stream is at the mercy of your
• 13:34
  own containment protocols. Which brings us to
• 13:37
  how this all started. How did these ghosts even
• 13:40
  get into the foyer in the first place? It wasn't
• 13:42
  an employee clicking on a bad link in a phishing
• 13:44
  email. And it wasn't a stolen laptop left in
• 13:47
  an airport lounge. The initial vector was an
• 13:50
  external facing network management device. We
• 13:53
  don't know the specific vendor and we don't know
• 13:55
  the exact software flaw, but it was essentially
• 13:58
  a piece of hardware sitting on the edge of their
• 14:00
  network. Right. They ended up decommissioning
• 14:02
  the device entirely, blocking the attacker's
• 14:04
  infrastructure, resetting all global passwords,
• 14:07
  and hardening the environment. Because these
• 14:09
  edge devices, routers, firewalls, load balancers,
• 14:13
  VPN gateways, they are the new front line of
• 14:16
  cyber warfare. A VPN gateway, for example, is
• 14:18
  literally designed to act as a door between the
• 14:21
  wild open internet and the secure internal network.
• 14:24
  It has to face outward to allow remote employees
• 14:27
  to log in. Kinsoft's main advice in the source
• 14:29
  material is incredibly adamant about this vulnerability.
• 14:32
  These edge devices must be patched obsessively.
• 14:35
  They require mandatory multi -factor authentication,
• 14:38
  or MFA. Yes, and critically, the management interfaces,
• 14:42
  the secret portals used by IT admins to actually
• 14:45
  configure the device settings, should never be
• 14:47
  exposed to the open internet. They should be
• 14:50
  hidden behind another layer of security. Here
• 14:53
  is where it gets really interesting. This wasn't
• 14:55
  a sophisticated, highly coordinated, Ocean's
• 14:58
  Eleven style heist. No. It was a boring, likely
• 15:02
  forgotten network management box just sitting
• 15:04
  out there on the internet that brought a 59 ,000
• 15:07
  person global giant to its knees. It's the digital
• 15:10
  equivalent of investing millions in vault doors
• 15:13
  and laser grids, but leaving the basement window
• 15:16
  unlocked. Exactly. Because attackers use automated
• 15:19
  tools to constantly scan the entire Internet
• 15:21
  24 -7, looking specifically for those unlocked
• 15:25
  basement windows. But the real triumph of Boston
• 15:27
  Scientific's response, the only reason this story
• 15:30
  doesn't end in a catastrophic regulatory nightmare
• 15:33
  regarding data privacy, comes down to something
• 15:35
  equally boring but incredibly vital. Which is
• 15:39
  logs. Network logs. Yes. CrowdStrike was only
• 15:42
  able to confidently announce that no data was
• 15:44
  taken because Boston Scientific had the meticulous,
• 15:47
  comprehensive network logs to mathematically
• 15:50
  prove it. OK, but how does a log actually prove
• 15:53
  a negative, though? How do you prove someone
• 15:54
  didn't take something? Think of a log like a
• 15:57
  highly advanced digital turnstile combined with
• 16:00
  a security camera. OK. It doesn't just record
• 16:02
  who enters a room. It records exactly how many
• 16:05
  bytes of data they interact with and, crucially,
• 16:08
  how many bytes of data flow back. out of the
• 16:11
  network. Right. A central logging system, often
• 16:14
  called a SIM, aggregates all this traffic. If
• 16:17
  the logs show an unauthorized IP address connected
• 16:20
  to a server, but the outgoing traffic log registers
• 16:23
  zero bytes of data transferred back to that external
• 16:25
  address, you have mathematical, forensic proof
• 16:29
  that no files were exfiltrated. Wow. And without
• 16:32
  that undeniable mathematical proof, it is a totally
• 16:35
  different reality. It is the legal difference
• 16:38
  between telling your customers nothing was taken
• 16:40
  versus we have no idea what they took. Right.
• 16:43
  Under strict regulatory frameworks like Australia's
• 16:46
  Privacy Act, mentioned in our source material,
• 16:48
  if a company cannot definitively prove that data
• 16:51
  wasn't taken during a breach, they are legally
• 16:54
  forced to assume the worst. They have to declare
• 16:56
  a notifiable data breach. That means alerting
• 16:59
  government regulators. Directly contacting 4
• 17:02
  .8 million patients. facing potentially massive
• 17:05
  financial fines. And suffering catastrophic long
• 17:09
  -term reputational damage. All because they lacked
• 17:12
  the data to prove a negative. Keeping those logs
• 17:14
  actively saved them from a regulatory apocalypse.
• 17:17
  It really did. It allowed leadership to stand
• 17:20
  up and say, with receipts, our patients are safe.
• 17:23
  Which perfectly sets up how they handled the
• 17:25
  public communication of this entire mess. Yeah,
• 17:28
  this case is actively being praised as a masterclass
• 17:30
  in crisis communication. It serves as a textbook
• 17:33
  model for how corporate transparency should function
• 17:36
  during an active crisis. It closely mirrors the
• 17:40
  continuous disclosure obligations that ASX -listed
• 17:43
  public companies are held to in Australia. Right,
• 17:45
  because usually companies try to sweep these
• 17:47
  incidents under the rug, or they wait until late
• 17:50
  on a Friday night to release a vague, jargon
• 17:52
  -filled statement hoping the news cycle just
• 17:54
  swallows it. But Boston Scientific played it
• 17:57
  entirely straight. First, They filed a voluntary
• 18:00
  disclosure with the SEC on day one. They didn't
• 18:04
  even know the full scale of the problem yet,
• 18:05
  but they immediately raised their hand and said,
• 18:07
  something is wrong, we are actively looking into
• 18:10
  it. From a leadership perspective, that is a
• 18:12
  difficult decision. The stock market fundamentally
• 18:15
  hates uncertainty, and admitting a breach before
• 18:18
  you have all the answers guarantees a short -term
• 18:21
  hit to your valuation. But they kept going. Step
• 18:24
  two, they provided regular, ongoing public updates.
• 18:28
  They didn't go dark for two weeks while the factory
• 18:30
  was down. Right. Step three, once the financial
• 18:33
  reality actually became clear, they filed the
• 18:36
  formal material incident SEC filing, admitting
• 18:39
  openly they were going to miss their financial
• 18:41
  guidance. And finally, step four, they published
• 18:44
  the actual forensic summary from CrowdStrike
• 18:46
  at the end, detailing exactly what the attackers
• 18:49
  touched and, more importantly, what they didn't.
• 18:51
  What stands out to you about how this was handled?
• 18:54
  Think about how you usually hear about corporate
• 18:57
  data breaches as a consumer. Yeah, it usually
• 18:59
  involves a leaked memo or an investigative journalist
• 19:02
  forcing the company to admit a failure months
• 19:04
  after the fact. Exactly. What stands out here
• 19:07
  is the realization that early honesty builds
• 19:10
  resilience and trust. Yes, the market punished
• 19:13
  their stock price in the short term. But by controlling
• 19:16
  the narrative with verified facts, rather than
• 19:18
  letting rumors and panic fill the void, they
• 19:21
  protected the long -term integrity of their brand.
• 19:23
  Patients and doctors still trust their medical
• 19:26
  devices because the company proved in real time
• 19:28
  that they prioritize transparency over saving
• 19:31
  face. It's the exact same dynamic as hearing
• 19:34
  bad news from a friend directly versus finding
• 19:37
  out they lied to you from a third party. Oh,
• 19:40
  absolutely. You can usually forgive the mistake,
• 19:42
  but the cover -up destroys the relationship permanently.
• 19:45
  And by publicly releasing the CrowdStrike forensic
• 19:48
  summary, they actively contributed to the collective
• 19:50
  defense of the entire medical device industry.
• 19:53
  Oh, that's a great point. Other massive enterprises
• 19:55
  can look at that specific report, identify that
• 19:58
  they use those exact same network management
• 20:00
  devices, and go secure their own perimeters before
• 20:03
  the attackers scan them next. Exactly. Well,
• 20:06
  we have covered a massive amount of ground today.
• 20:08
  We've gone from a global manufacturing shutdown
• 20:10
  to the intricate architecture of network logging
• 20:13
  and the psychology of corporate PR. So what does
• 20:17
  this all mean? Let's distill the core takeaways.
• 20:20
  Right. First, the edge of your network, those
• 20:23
  incredibly boring external routers and VPN gateways,
• 20:26
  they are your biggest liabilities. They are the
• 20:28
  unlocked basement windows. Second, you do not
• 20:32
  need a terrifying ransomware infection to suffer
• 20:34
  a catastrophic business outage. Your own defensive
• 20:37
  containment protocols can be just as paralyzing
• 20:40
  to your bottom line. And third, having exhaustive,
• 20:43
  unalterable network logs is your absolute only
• 20:46
  defense against regulatory nightmares. Logs are
• 20:49
  the only mechanism you have to mathematically
• 20:51
  prove a negative and save your company's reputation.
• 20:54
  It demands that we completely redefine what readiness
• 20:57
  actually means for a modern enterprise. It really
• 21:01
  does. And that brings us to our call to action
• 21:03
  for you listening right now. Think about your
• 21:06
  own workplace, your own company, or even your
• 21:08
  personal home network setup. Do you know what
• 21:10
  single point of failure would grind your entire
• 21:12
  day to a halt if you had to physically pull the
• 21:15
  plug to stop an intruder? What is the one core
• 21:18
  system you genuinely cannot run without? And
• 21:21
  is it sitting dangerously close to an exposed
• 21:23
  edge device? It is a map worth drawing today
• 21:26
  before the alarms actually go off. And as you
• 21:29
  map that out, consider this final thought. We
• 21:33
  started today talking about the bank manager
• 21:35
  who locks the doors to protect an untouched vault.
• 21:39
  effectively bankrupting the business in the process.
• 21:42
  As cyber threats become increasingly ambiguous
• 21:45
  and our automated defensive containment protocols
• 21:48
  become more aggressive to match, we have to wonder,
• 21:52
  will the most destructive, expensive cyber incidents
• 21:55
  of the future actually be caused by attackers
• 21:57
  at all? Or will they be caused by companies being
• 22:01
  forced to completely paralyze their own operations
• 22:03
  just to prove to the regulators that they are
• 22:05
  safe? Now that is a thought to keep you up at
• 22:09
  night. The shield becoming heavier and more dangerous
• 22:12
  than the sword. Thank you for joining us on this
• 22:14
  deep dive into the modern mechanics of cyber
• 22:16
  warfare and corporate resilience. Keep questioning,
• 22:19
  keep learning, and we will catch you next time.