Latest / Choppin’ It Up by Bloomberg Intelligence / Cyberattacks Are a Growing Restaurant Concern

Transcript

Cyberattacks Are a Growing Restaurant Concern · Choppin’ It Up by Bloomberg Intelligence

• 0:20
  Speaker 1: Welcome to Chopping It Up. I'm your host, Mike Haleon,
• 0:22
  Speaker 1: the senior restaurant and food Service analyst at Bloomberg Intelligence.
• 0:27
  Speaker 1: I've got a great guest today. I'd like to introduce
• 0:29
  Speaker 1: Deborah Nika, Senior manager of Cybersecurity and Privacy. She's also
• 0:34
  Speaker 1: the privacy services leader at Cone Resnik and she's also
• 0:38
  Speaker 1: been named Top twenty five women in Food Service and Hospitality.
• 0:41
  Speaker 1: Thanks for doing this.
• 0:42
  Speaker 2: Deborah, Thank you so much for having me on. Excited.
• 0:45
  Speaker 1: Yeah, this is this is cool because this is a
• 0:47
  Speaker 1: topic that's, you know, become increasingly important. You know, I'm
• 0:52
  Speaker 1: old enough to remember when investors didn't really care so much.
• 0:57
  Speaker 1: You know, I remember trading stocks in the early two
• 1:00
  Speaker 1: thousands and Target or Walmart and somebody would have a
• 1:03
  Speaker 1: security breach and you know, the stock would trade down
• 1:07
  Speaker 1: for about five minutes and then I would go back
• 1:09
  Speaker 1: higher than when it was traded prior to the news,
• 1:13
  Speaker 1: and it was just kind of people thought it was
• 1:15
  Speaker 1: a cost of doing business. But things have changed a
• 1:18
  Speaker 1: lot over the last two decades.
• 1:21
  Speaker 2: Yeah, I mean, you know, it's we're not living in
• 1:24
  Speaker 2: that world anymore. Unfortunately, we live in in a economy
• 1:28
  Speaker 2: where a breach is no longer blip on the radar.
• 1:32
  Speaker 2: A cybersecurity or privacy incident is you know, tip of
• 1:36
  Speaker 2: the iceberg, and everything that comes, you know, under the
• 1:39
  Speaker 2: water that you don't see is you know, loss of
• 1:42
  Speaker 2: investor confidence, loss of consumer confidence. And it really is
• 1:47
  Speaker 2: not a fun place to be having to crawl back
• 1:50
  Speaker 2: up and refresh your brand image and capability.
• 1:55
  Speaker 1: Yeah that's great, and so can you I guess before
• 1:58
  Speaker 1: we really dig in here, can you please tell the
• 2:00
  Speaker 1: listeners a little bit about your background and the cybersecurity
• 2:03
  Speaker 1: practice at Cohen Resnik.
• 2:05
  Speaker 2: Yeah, so I am. I am a self you know,
• 2:09
  Speaker 2: I am a data geek. I am so excited about information,
• 2:14
  Speaker 2: and you know, spend the very early years of my
• 2:16
  Speaker 2: career decades ago, wanting to be an academic librarian. I was,
• 2:21
  Speaker 2: I was really going down the path of like I
• 2:24
  Speaker 2: want to sit in a crusty old library and just
• 2:27
  Speaker 2: like go through archives and books all day every day.
• 2:31
  Speaker 2: And living in New York City, you really quickly learn
• 2:33
  Speaker 2: like that's not sustainable. Like I could be a librarian
• 2:38
  Speaker 2: and eat beans, or I could like take this knowledge
• 2:41
  Speaker 2: that I've built up and figure out how to you know, pivot.
• 2:45
  Speaker 2: We love that word pivot right, pivot into the corporate space,
• 2:49
  Speaker 2: and it was the earlier days of what today we
• 2:52
  Speaker 2: known as big data and really the early start of
• 2:57
  Speaker 2: companies figuring out, hey, we have all this information and
• 3:01
  Speaker 2: how do we use that information to make data informed decisions? Right?
• 3:05
  Speaker 2: Gone are the days where an executive licked their finger
• 3:08
  Speaker 2: and like put it up in the air and to
• 3:09
  Speaker 2: figure out which way the wind was blowing on a deal. Right.
• 3:13
  Speaker 2: So my career has really followed that data life cycle, Right,
• 3:16
  Speaker 2: how do we collect information, how do we curate information,
• 3:19
  Speaker 2: how do we use information and flow it through our
• 3:23
  Speaker 2: technology systems? How do we use that information to make
• 3:27
  Speaker 2: data informed data informed decisions? And then, you know, ultimately,
• 3:32
  Speaker 2: after a what I'll call a big Brother moment mid career,
• 3:36
  Speaker 2: I was like, hey, we've got to really do more
• 3:38
  Speaker 2: about protecting the data, right and protecting the people that
• 3:42
  Speaker 2: are ultimately the ones that are impacted in that you know,
• 3:46
  Speaker 2: by that data. So four years ago, I mean it
• 3:49
  Speaker 2: started way earlier, but four years ago had the great
• 3:51
  Speaker 2: privilege of coming over to Cohen Resnik part of their cybersecurity, tech,
• 3:55
  Speaker 2: risk and privacy practice and our you know, our mission
• 4:00
  Speaker 2: in market if you will is to help companies understand
• 4:03
  Speaker 2: that cyber and privacy don't need to be scary, if
• 4:07
  Speaker 2: they don't need to be these unattainable only technology driven capabilities.
• 4:12
  Speaker 2: But how do you use cybersecurity programs? How do you
• 4:15
  Speaker 2: use competency around privacy, compliance and management to actually drive
• 4:19
  Speaker 2: value in your business? Right? So if it's a transaction, right,
• 4:23
  Speaker 2: how are you preparing your company to make sure you're
• 4:26
  Speaker 2: getting great valuation? How do you make sure that you're
• 4:29
  Speaker 2: prepared to answer the hard questions of the underwriters of
• 4:34
  Speaker 2: how are your systems and how are your data secure?
• 4:37
  Speaker 2: How are you running your business? How are you growing
• 4:39
  Speaker 2: your business? How are you sustaining that growth? Cyber and
• 4:42
  Speaker 2: privacy are front and center to that equation. But before
• 4:46
  Speaker 2: we go any further, I think it's one of the
• 4:49
  Speaker 2: places I really like to start and chatting about this
• 4:52
  Speaker 2: is what is cybersecurity? What is privacy? Because when we
• 4:57
  Speaker 2: say cybersecurity, I can guarantee you half more audience is
• 5:00
  Speaker 2: going to think of a hacker sitting in a room
• 5:03
  Speaker 2: somewhere at night, tugging red bulls in a dark hoodie, right,
• 5:08
  Speaker 2: trying to crack code. And it's not that cybersecurity. There
• 5:14
  Speaker 2: are three main tenants of cybersecurity that we call the
• 5:17
  Speaker 2: CIA triad. Confidentiality, so information in your ecosystem is being
• 5:22
  Speaker 2: maintained in a confidential manner. Integrity that the information in
• 5:28
  Speaker 2: your systems can be relied upon. This is extremely important
• 5:33
  Speaker 2: for public retreated companies, especially when you get into things
• 5:36
  Speaker 2: like Starbine z Oxley, compliance and availability that your systems
• 5:40
  Speaker 2: are available when you need them to be right. And
• 5:44
  Speaker 2: then we layer on this wrapper of privacy, which historically
• 5:48
  Speaker 2: legally has been defined as the right to be left alone. Right,
• 5:52
  Speaker 2: But for companies that means you know, when, how and
• 5:55
  Speaker 2: to what extent can you use the information that you've
• 5:58
  Speaker 2: collected about your customer, about your population, about your consumers.
• 6:03
  Speaker 2: So you know, love, I always love to lay that
• 6:05
  Speaker 2: out because it really helps contextualize when it means, when
• 6:08
  Speaker 2: it means bringing this into your business, How does this
• 6:11
  Speaker 2: actually impact the decisions that you might be making about
• 6:14
  Speaker 2: a new business line, a growth of business line, an
• 6:16
  Speaker 2: investment in the technology, an investment in a membership rewards program, right,
• 6:22
  Speaker 2: putting an app out there to let folks, you know,
• 6:25
  Speaker 2: order ahead, So it makes an impact.
• 6:30
  Speaker 1: Cool, and so you know, there's there's a few different
• 6:33
  Speaker 1: types of cyber attacks. You know, I guess if you
• 6:35
  Speaker 1: could talk about them a little bit and maybe what
• 6:39
  Speaker 1: what customers should be particularly worried about right now. You know,
• 6:43
  Speaker 1: I think I've read something recently about ransomware attacks being
• 6:46
  Speaker 1: up over one hundred percent year over year, uh, and
• 6:49
  Speaker 1: things of that nature. So I guess maybe the the
• 6:53
  Speaker 1: you know, biggest issues are may depend on the size
• 6:56
  Speaker 1: of the company, But if you can kind of give
• 6:58
  Speaker 1: us some color on that would be.
• 7:01
  Speaker 2: So. So ransom I would definitely say ransomware is what
• 7:04
  Speaker 2: we're seeing get the most, the most news coverage, if
• 7:07
  Speaker 2: you will. Right, So, ransomware in simplest terms, is your
• 7:11
  Speaker 2: systems have become unavailable a threat actor. Right. It can
• 7:15
  Speaker 2: be somebody who is out there for monetary you know,
• 7:19
  Speaker 2: monetary gains. They just want to access your system to
• 7:21
  Speaker 2: be able to get paid. That that that that ransom, Right.
• 7:27
  Speaker 2: It could be political, right, It could be a activist
• 7:31
  Speaker 2: that is not in agreement with something that you've said
• 7:34
  Speaker 2: or put out there in the marketplace, which we see
• 7:37
  Speaker 2: impacting right our our industry today. So somebody comes in
• 7:42
  Speaker 2: takes over all of your systems, a system, a critical
• 7:45
  Speaker 2: financial system. The point of access into your environment and
• 7:50
  Speaker 2: doesn't let you doesn't let you back in until you've
• 7:53
  Speaker 2: agreed to pay a fine, right, or a fee or
• 7:58
  Speaker 2: some sort of cost value. The other thing we're seeing
• 8:01
  Speaker 2: a lot, interestingly enough, is the theft of intellectual property. Right.
• 8:06
  Speaker 2: So we live in a very fluid marketplace. Intellectual property
• 8:10
  Speaker 2: theft doesn't really get that much airtime, but it is.
• 8:16
  Speaker 2: It is especially especially important. I I worked with a
• 8:21
  Speaker 2: company a few years back, and this was a transaction.
• 8:25
  Speaker 2: So you know, we said, okay, what's your what's your
• 8:27
  Speaker 2: crown jewel? Right, what are you the most afraid of
• 8:30
  Speaker 2: would get exposed? And they're like, there's only one there's
• 8:33
  Speaker 2: only one thing that we're worried about. I said, okay,
• 8:35
  Speaker 2: what is it? And they go our recipes? Like, if
• 8:39
  Speaker 2: our recipes walked out the door, we're out of business.
• 8:45
  Speaker 2: There's absolutely no reason for us to continue getting up
• 8:47
  Speaker 2: in the morning. Right. So, where we normally think of hey,
• 8:52
  Speaker 2: hackers coming in, our threat threat actors coming in, they're
• 8:54
  Speaker 2: taking over our financial systems, they're taking over our employee data,
• 8:58
  Speaker 2: they're changing numbers in our finance system. So we're actually
• 9:03
  Speaker 2: paying them when we think we're paying a vendor or
• 9:05
  Speaker 2: our employee, right, this company was like, hey, if this
• 9:08
  Speaker 2: recipe gets out the door, we're done.
• 9:11
  Speaker 3: Yeah.
• 9:11
  Speaker 1: It's literally their secret sauce.
• 9:13
  Speaker 2: Literally, and you know, like I'm a native New Yorker,
• 9:16
  Speaker 2: we're very, very you know, proud of our pizza industry. Right,
• 9:20
  Speaker 2: generally speaking, can you imagine if your favorite pizza place
• 9:23
  Speaker 2: all of a sudden had like a new dough recipe,
• 9:26
  Speaker 2: new sauce recipe, like the whole nine yards, Like, I'm
• 9:29
  Speaker 2: not going back there, yeah, right, And you can say
• 9:32
  Speaker 2: the same thing up uphill right for larger industries, right,
• 9:36
  Speaker 2: if you're gonna change something and all of a sudden
• 9:38
  Speaker 2: you're like, hey, that's what we made money off of.
• 9:42
  Speaker 1: First thing that came to my mind was the Kernel
• 9:44
  Speaker 1: secret recipe. It's worth a lot, man, it's worth a lot.
• 9:50
  Speaker 1: Oh yeah. So, in addition to restaurant companies, what other
• 9:54
  Speaker 1: types of clients are seeking your help? Other industries, other
• 9:58
  Speaker 1: verticals who seeking your help?
• 10:01
  Speaker 2: Yep. So so where our team very proudly is industry agnostic.
• 10:06
  Speaker 2: What I focus on day and day out is what
• 10:08
  Speaker 2: I'll call the hospitality adjacent companies. Right, are manufacturing firms
• 10:14
  Speaker 2: that are coming in and maybe you know producing producing
• 10:17
  Speaker 2: items our consumer retail company. Real estate. Everybody always forgets
• 10:23
  Speaker 2: that that real estate is a bigger market than just
• 10:27
  Speaker 2: the you know, the industrial real estate side of things.
• 10:31
  Speaker 2: A lot of noise being made, especially in states like
• 10:34
  Speaker 2: Illinois on biometrics, Right, what does that mean for the
• 10:37
  Speaker 2: smart building space? What does that mean for real estate
• 10:40
  Speaker 2: companies that are putting technology in to help them manage
• 10:45
  Speaker 2: from afar technology companies a lot of noise today.
• 10:49
  Speaker 3: Right.
• 10:49
  Speaker 2: We saw Apple and the Google play Store start putting
• 10:54
  Speaker 2: controls in place around what kind of applications security posture, hygiene,
• 10:59
  Speaker 2: privacy posture and hygiene could be put out there. And
• 11:03
  Speaker 2: then of course, you know, we can't ever forget that
• 11:06
  Speaker 2: the financial services industry spend a good amount of time
• 11:11
  Speaker 2: they're doing cyber privacy diligence in support of transactions. Right,
• 11:17
  Speaker 2: So what is a potential company's potential acquisition look like
• 11:23
  Speaker 2: from a cyber security lens? Right? What kind of risk
• 11:26
  Speaker 2: is present in their environment? What does that look like
• 11:29
  Speaker 2: for uh, the the you know, let's call it private
• 11:33
  Speaker 2: equity company that that's that's going out and buying them, right,
• 11:36
  Speaker 2: that the risk comes with it? How does that impact
• 11:39
  Speaker 2: the reps and warranties insurance. How does that impact money
• 11:43
  Speaker 2: that that may be set aside an escrow uh to
• 11:45
  Speaker 2: cover potential potential liability obligations. Uh. You know, especially in
• 11:51
  Speaker 2: consumer and hospitality, they're very they're very people centric industries. Right.
• 11:58
  Speaker 2: Nobody wants to be the company that bought the other
• 12:01
  Speaker 2: company and all sudden to find out that, hey, there
• 12:03
  Speaker 2: was a breach of a million records of personal information
• 12:08
  Speaker 2: and we're doing business in California and all of a sudden,
• 12:11
  Speaker 2: you're you're running a foul of the AG's office in
• 12:14
  Speaker 2: California with CCPA and cpr A. Right, there's a lot,
• 12:19
  Speaker 2: there's a lot of contentious conversations that are happening of
• 12:23
  Speaker 2: what is the obligation of covering that risk in the transaction?
• 12:27
  Speaker 1: Okay?
• 12:27
  Speaker 2: Cool?
• 12:29
  Speaker 1: And so you know, are you seeing you know in
• 12:32
  Speaker 1: the research that consumers are significantly changing their behavior following
• 12:36
  Speaker 1: cyber attacks And I guess, hows how's that changed over
• 12:38
  Speaker 1: the last decade or so?
• 12:39
  Speaker 2: Yeah? Really, really good question. So the greatest shift that
• 12:43
  Speaker 2: we've seen is in upfront conscientiousness by the consumer. Who
• 12:47
  Speaker 2: am I getting into business with? You know? What are
• 12:52
  Speaker 2: they doing with my information? Is this brand doing right
• 12:55
  Speaker 2: by me as a consumer. A lot of we all
• 13:00
  Speaker 2: remember the days of the Target breach, right, and most
• 13:04
  Speaker 2: forget that Target was breached because of their HVAC system. Right.
• 13:08
  Speaker 2: It wasn't that Target went out and willingly did something
• 13:11
  Speaker 2: that was running a foul of their of their customers.
• 13:15
  Speaker 2: A big Target fan here, This is not this is
• 13:17
  Speaker 2: not a knock on Target, right, this is the reality
• 13:19
  Speaker 2: of the world that we live in. And you know
• 13:22
  Speaker 2: the response was okay, well, Target was required right to
• 13:26
  Speaker 2: go out and get credit monitoring service for their customers.
• 13:30
  Speaker 2: Most people still think that it was Target's goodwill. But
• 13:33
  Speaker 2: they went out, I got credit service monitoring for their customers.
• 13:35
  Speaker 2: That's not the case. They were required to do it, right.
• 13:39
  Speaker 2: But today we very much still see this conscientiousness by
• 13:44
  Speaker 2: consumers to say, you know what, I'm not going to
• 13:47
  Speaker 2: opt in. I'm not going to download an app that
• 13:51
  Speaker 2: is knowingly using my information. We're seeing a lot of
• 13:54
  Speaker 2: it now, right with the way that there's this conscientiousness
• 13:58
  Speaker 2: of how is big tech using our information? How are
• 14:01
  Speaker 2: they monetizing my information for their own their own purposes.
• 14:07
  Speaker 2: In a post ro v wead world, right, there was
• 14:11
  Speaker 2: a lot of a lot of light that was suddenly
• 14:13
  Speaker 2: shown on well, there are all these these apps that
• 14:16
  Speaker 2: help women, and what are their practices around cybersecurity? How
• 14:21
  Speaker 2: might my information be compromised there? So there's certainly this upfront,
• 14:26
  Speaker 2: you know, conscientiousness, and on the flip side, right, there's
• 14:29
  Speaker 2: a lot of brain reputation that that is impacted when
• 14:32
  Speaker 2: the own no moment happens, not if the owned no
• 14:35
  Speaker 2: moment happens, but truly when, right, what did the brand
• 14:38
  Speaker 2: do to protect my information? What was their social contract
• 14:44
  Speaker 2: that they had with me? What information did they give
• 14:48
  Speaker 2: me in their privacy policy, their terms and conditions upfront
• 14:51
  Speaker 2: about how that information they were collecting about me it
• 14:54
  Speaker 2: was going to be protected. So we are seeing a
• 14:57
  Speaker 2: little bit of a shift. We're seeing a lot more
• 14:59
  Speaker 2: noise come out when a brand is impacted. And the
• 15:03
  Speaker 2: reality is in the marketplace is that we're no longer
• 15:07
  Speaker 2: living in a marketplace where there's only one makeup store,
• 15:09
  Speaker 2: or there's only one retail shop, or there's only one
• 15:12
  Speaker 2: shoe store that you that you can shop in. Right,
• 15:14
  Speaker 2: so brands have to take that proactive stance of saying
• 15:18
  Speaker 2: we are in custodians of this information. We have built
• 15:21
  Speaker 2: this reputation in the market with our customers. We have
• 15:24
  Speaker 2: to do right by protecting this information, using it with fairness,
• 15:28
  Speaker 2: using it with transparency, because the reality is that if
• 15:31
  Speaker 2: our clients want it to walk away, it's going to
• 15:34
  Speaker 2: be that much harder for us to reacquire that client.
• 15:37
  Speaker 1: Yeah, more costly as well. Yeah for sure. Yeah, it's
• 15:40
  Speaker 1: really really interesting. You know, I think there's definitely been
• 15:43
  Speaker 1: more attention paid to it.
• 15:44
  Speaker 2: Right.
• 15:44
  Speaker 1: You have have people in the media, you know, looking
• 15:48
  Speaker 1: at you know, TikTok terms of service and things of
• 15:51
  Speaker 1: that nature, right, And so I think I don't know
• 15:54
  Speaker 1: if it's hurt their user base at all, but you know,
• 15:56
  Speaker 1: you have people definitely more cognizant of what's being cappedured, right,
• 16:00
  Speaker 1: and what's being used and how it's being used. So
• 16:03
  Speaker 1: I think that's a good thing. And when anytime, consumers
• 16:06
  Speaker 1: are willing to educate themselves, right, So, what are the
• 16:10
  Speaker 1: main vulnerability points both at the restaurant level and at
• 16:13
  Speaker 1: the corporate level.
• 16:14
  Speaker 2: Tough question, and I hate to sound like a consultant here,
• 16:17
  Speaker 2: but I'm going to give the first consultant answer, which
• 16:20
  Speaker 2: is it depends. It depends what the ecosystem looks like.
• 16:25
  Speaker 2: I'll say that, you know, even up to like four
• 16:28
  Speaker 2: or five, six years ago, when we had these types
• 16:31
  Speaker 2: of conversations with brands, it was like, oh, well, I'm
• 16:34
  Speaker 2: PCI compliant, my credit card data is safe, and you're like, okay,
• 16:38
  Speaker 2: that's fine, and I am so happy that you got
• 16:41
  Speaker 2: through the PCI questionnaire, which is like totally counterintuitive. Let's say,
• 16:51
  Speaker 2: but now we're beyond credit card information, right, and I
• 16:56
  Speaker 2: think that what the what the questions are now that
• 16:59
  Speaker 2: these companies should be asking themselves, especially in a post
• 17:03
  Speaker 2: COVID world, is what does your technology landscape look like? Right?
• 17:08
  Speaker 2: Are you using cloud based platforms to support your orders
• 17:14
  Speaker 2: your fulfillment? What does that look like? How are you
• 17:17
  Speaker 2: how are your restaurant locations or how you know, how
• 17:20
  Speaker 2: are your store locations interconnect one another? What does that
• 17:23
  Speaker 2: that mesh of network look like? How are you granting
• 17:27
  Speaker 2: access to your systems? How is your customer interacting? Right?
• 17:32
  Speaker 2: Are they coming in making a purchase and that purchase
• 17:35
  Speaker 2: is being shipped? Are they coming in making a purchase,
• 17:37
  Speaker 2: the purchase is going out the door with them? Are
• 17:39
  Speaker 2: they ordering ahead for pickup? Right? So this this you know,
• 17:45
  Speaker 2: night what we'll call ninety percent reliance on technology has
• 17:48
  Speaker 2: really changed the game of where you need to look
• 17:50
  Speaker 2: for the technology related risks. Your apps? Right, who's developing them?
• 17:55
  Speaker 2: Are they developing them in a secure manner? Are they
• 17:58
  Speaker 2: are they being updated? How is information that you're collecting
• 18:01
  Speaker 2: about your consumer being protected and used right through that app?
• 18:06
  Speaker 2: Again above and beyond just credit card information? Right? How
• 18:10
  Speaker 2: are you granting maintaining access to your point of sale systems?
• 18:14
  Speaker 2: What kind of point of sale systems are you using?
• 18:17
  Speaker 2: Are you are you pushing the you know, are you
• 18:20
  Speaker 2: pushing onus onto your vendors to make sure that they're
• 18:23
  Speaker 2: behaving and coding and developing their own software in a
• 18:26
  Speaker 2: secure manner? Right? How is it information going from store
• 18:30
  Speaker 2: location back to HQ? Right? What is your what is
• 18:33
  Speaker 2: your cyber hygiene, privacy hygiene and posture look like at headquarters? Right?
• 18:38
  Speaker 2: And that is logically right? How are folks get how
• 18:42
  Speaker 2: are folks interacting with your systems? How are they getting
• 18:44
  Speaker 2: into your buildings technologically? Right? What controls do you have
• 18:48
  Speaker 2: in place around your technology systems? Again? How are you
• 18:51
  Speaker 2: working in partnership with your vendors to make sure that
• 18:54
  Speaker 2: that if you're if you're using a cloud based system
• 18:57
  Speaker 2: and you're like, oh, yeah, you know so and so
• 18:59
  Speaker 2: companies responsible for security because they're providing me this platform.
• 19:03
  Speaker 2: Guess what, buddy, read the fine print because that risk
• 19:06
  Speaker 2: transfer that you think that you're making is not really there. Right.
• 19:09
  Speaker 2: There are obligations that you've got on your side to
• 19:12
  Speaker 2: make sure that you've got appropriate controls in place. How
• 19:15
  Speaker 2: are those systems interacting with one another? Right? What does
• 19:20
  Speaker 2: that interface look like between your systems? How are you
• 19:23
  Speaker 2: educating your people and your users to maintain a sense
• 19:28
  Speaker 2: of cybersecurity hygiene? Right? You know one of the latest
• 19:32
  Speaker 2: statistics out there is sixty five percent of cybersecurity incidents
• 19:37
  Speaker 2: start with your people. Somebody click the link that they
• 19:39
  Speaker 2: shouldn't have, right, and we're we're a click happy bunch humans. Right,
• 19:45
  Speaker 2: So are you educating your people on hey, don't click
• 19:47
  Speaker 2: the link. If your finance team is getting requests for wires,
• 19:50
  Speaker 2: are they calling the person to confirm that it's a
• 19:53
  Speaker 2: legitimate request? The account number has not been has not
• 19:57
  Speaker 2: been compromised in an email transit? Are you? Are you
• 20:02
  Speaker 2: doing technical testing of your boundaries? Right? Are you having
• 20:05
  Speaker 2: an objective third party come in and look at at
• 20:08
  Speaker 2: all of this And I think the other piece that
• 20:10
  Speaker 2: really really gets lost in all of this is are
• 20:12
  Speaker 2: you empowering your information security and your privacy teams to
• 20:17
  Speaker 2: do what they need to do? Are you giving them,
• 20:20
  Speaker 2: you know, the monetary support. Are you giving them the
• 20:22
  Speaker 2: right human capital to be able to do this? Are
• 20:25
  Speaker 2: you giving them a seat in the conversation to say, hey,
• 20:28
  Speaker 2: here's where we are today, Here's where we need to
• 20:31
  Speaker 2: be in the future to meet all the obligations that
• 20:34
  Speaker 2: we're putting out there. Right. Are you educating your board again?
• 20:40
  Speaker 2: You know, the SEC has proposed proposed rules out there
• 20:44
  Speaker 2: for publicly traded companies that you know, in the future,
• 20:47
  Speaker 2: should these rules pass, you're going to have to have
• 20:49
  Speaker 2: board educated members, right, really be aware of what what
• 20:53
  Speaker 2: does cybersecurity mean? Right? And and you've got to be
• 20:56
  Speaker 2: able to train your board on what cybersecurity risk look
• 21:00
  Speaker 2: like for the company. So I think where we talk about,
• 21:04
  Speaker 2: you know, what is the vulnerability to a brand? What
• 21:07
  Speaker 2: you know, you've also got to really weigh what the
• 21:08
  Speaker 2: impact is going to be. Right. You could have let's
• 21:11
  Speaker 2: say a single location Wi Fi go down, it sticks, right,
• 21:18
  Speaker 2: It could be malicious intent behind that, it could just
• 21:20
  Speaker 2: be the fact that it's Wi Fi and it's not
• 21:24
  Speaker 2: always going to be friendly, right, But what if your
• 21:27
  Speaker 2: critical application goes down? What if your CRM goes down?
• 21:30
  Speaker 2: What if your order payment system goes down? Right? And
• 21:33
  Speaker 2: it is a threat actor? You know, what does it
• 21:35
  Speaker 2: mean for your business to be out of you know,
• 21:38
  Speaker 2: out of technology service for four hours, for eight hours,
• 21:42
  Speaker 2: for three weeks? How many dollars are not coming in
• 21:45
  Speaker 2: the door because of that? Right? So you've really got
• 21:48
  Speaker 2: to understand what are your crown jewel systems, What technology
• 21:51
  Speaker 2: do you need to keep safe? And what what investment
• 21:55
  Speaker 2: are you willing to make as a company to make
• 21:58
  Speaker 2: sure they stay safe.
• 22:00
  Speaker 1: Yeah, that's great. And you know what I found when
• 22:04
  Speaker 1: I was doing a little bit of legwork before we
• 22:05
  Speaker 1: spoke that was interesting was like how much they spoke
• 22:08
  Speaker 1: about employees and protecting employee data, right, because I've just
• 22:14
  Speaker 1: been thinking about you thinking about it at the consumer level, right,
• 22:17
  Speaker 1: and the credit card data and the loyalty data and
• 22:21
  Speaker 1: all that kind of stuff, But obviously securing employee data
• 22:24
  Speaker 1: is important too.
• 22:25
  Speaker 2: Right. So without naming names of brands, because I feel
• 22:30
  Speaker 2: for the brands, irrelevant of size of these companies, I
• 22:33
  Speaker 2: feel for the brands that are dealing with this. The
• 22:36
  Speaker 2: state of Illinois gifted us some new laws around bio
• 22:41
  Speaker 2: biometric information. Right, So I think you're spot on. When
• 22:45
  Speaker 2: companies think about data, we're always thinking about consumer We
• 22:48
  Speaker 2: really also need to include employees in that. And the
• 22:51
  Speaker 2: reason I bring it up is because it is not unmanageable.
• 22:55
  Speaker 2: Again speaking in broad strokes here, I don't want to
• 22:57
  Speaker 2: throw any any companies under the US on this. Right.
• 23:03
  Speaker 2: When we think about employees, I'll give you this scenario.
• 23:07
  Speaker 2: An employee walks in the door. You're using, you know,
• 23:11
  Speaker 2: upper right quadrant technology for your employee timekeeping systems, and
• 23:17
  Speaker 2: your employee comes in, they scan their thumbprint, they've clocked in,
• 23:21
  Speaker 2: they work the shift, scan back out, end of day. Right,
• 23:27
  Speaker 2: How are you protecting that information? Are you? Did you
• 23:29
  Speaker 2: give disclosure to your employees that you're going to be
• 23:32
  Speaker 2: using your biometric information to do this? How are you
• 23:36
  Speaker 2: maintaining the security of that information that you're collecting. How
• 23:41
  Speaker 2: are you maintaining information that your employee and their health
• 23:46
  Speaker 2: care status? Right, especially if in the restaurant industry world, right,
• 23:50
  Speaker 2: if there's a health matter that's being investigated related to
• 23:54
  Speaker 2: an employee. So there are all these laws that are
• 23:57
  Speaker 2: very specific to employee data. I am not into I
• 24:00
  Speaker 2: don't want to ever be a labor attorney. I give that,
• 24:02
  Speaker 2: I give that that group of specialists great great respect. Right,
• 24:06
  Speaker 2: but what are you doing? And do you understand the
• 24:08
  Speaker 2: complex environment that you that you're operating in about that information? Right?
• 24:15
  Speaker 2: You know, Illinois, California. You know there are states that
• 24:18
  Speaker 2: are really making it easy for businesses to operate, and
• 24:21
  Speaker 2: there are states that make it a little bit tougher.
• 24:23
  Speaker 2: And you've got to really do the work to understand
• 24:26
  Speaker 2: what are our obligations And a lot of it really
• 24:30
  Speaker 2: comes down to how are you informing your employees about this? Right?
• 24:33
  Speaker 2: What does that look like to inform you employees? Here's
• 24:36
  Speaker 2: the information we've re collected about you. Here's how that
• 24:38
  Speaker 2: information is being used, Here's where that information is stored,
• 24:41
  Speaker 2: Here's how it might be shared. Because it's not just
• 24:45
  Speaker 2: you know, the yester year of Oh, we're collecting employee
• 24:48
  Speaker 2: information so we can send it to our our you know,
• 24:50
  Speaker 2: the company that does our health insurance. Right now, all
• 24:53
  Speaker 2: of a sudden, you're saying, Okay, we're collecting really sensitive
• 24:56
  Speaker 2: information about an employee, and maybe we're using AI to decide, Hey,
• 25:02
  Speaker 2: this person works this shift and that person works that
• 25:05
  Speaker 2: shift because of X y Z capability. But there are
• 25:09
  Speaker 2: inherent biases to a lot of this that I think
• 25:12
  Speaker 2: that our industry, well the technology industry least, is still
• 25:15
  Speaker 2: fleshing out. But I will say we're seeing a lot
• 25:20
  Speaker 2: creeping up, especially in Illinois. What does it mean to
• 25:25
  Speaker 2: use employee information appropriately even if it's for legitimate business practice?
• 25:32
  Speaker 2: And you know where can companies start getting in trouble?
• 25:34
  Speaker 1: And you mentioned the employee data being upper right quadrant data.
• 25:38
  Speaker 1: I'm not familiar with the quadrants. I can kind of
• 25:41
  Speaker 1: maybe back into a guest there, but if you can
• 25:43
  Speaker 1: kind of talk about the quadrants a little bit, talk
• 25:45
  Speaker 1: about what the upper right quadrant means for you know,
• 25:50
  Speaker 1: you know us layman.
• 25:53
  Speaker 2: So oftentimes when I talk with businesses and we start
• 25:57
  Speaker 2: having conversations of hey, we're finally out of COVID, right,
• 26:02
  Speaker 2: We're finally back to a world where we can make
• 26:05
  Speaker 2: technology investment. We're like, we're gonna go look at Gartner,
• 26:08
  Speaker 2: We're gonna go look at Forrester, and we're gonna pick
• 26:10
  Speaker 2: like the top leader, right. The leader of this is
• 26:14
  Speaker 2: like the best tool or application that we can get
• 26:19
  Speaker 2: in the space. And this is this you know, Gartner
• 26:21
  Speaker 2: leading or Forrester wave leading technology is going to solve
• 26:25
  Speaker 2: all of our problems. You know, I'll context I'll contextualize
• 26:29
  Speaker 2: them saying Gartner and Forrester are great resources for information. Right,
• 26:32
  Speaker 2: They're fantastic. I use them quite a bit. But you've
• 26:36
  Speaker 2: got to then say, Okay, we're making this investment technology
• 26:38
  Speaker 2: we're going with you know this this this hr information system, right,
• 26:45
  Speaker 2: but what does that mean for your business? You're making
• 26:47
  Speaker 2: this gigantic investment. These these tools, technologies, applications are not cheap, right,
• 26:54
  Speaker 2: How are you then deploying that in your environment? A?
• 26:57
  Speaker 2: What technology risk are you introducing to your environment by
• 27:01
  Speaker 2: doing this? B? How are you setting appropriate controls of
• 27:04
  Speaker 2: who's got access to what information is it? Is it?
• 27:08
  Speaker 2: Com measure it with the job that they were doing? Right? See?
• 27:12
  Speaker 2: How are you giving people appropriate disclosure about what information
• 27:16
  Speaker 2: you're storing about them? Right? How are you integrating these
• 27:21
  Speaker 2: systems with other technologies that are that are in your environment?
• 27:25
  Speaker 2: And I think the big one, which is which is
• 27:28
  Speaker 2: let's call it one of the largest emerging issues in
• 27:33
  Speaker 2: cyber and privacy is what kind of onus are you
• 27:36
  Speaker 2: taking on because of this third party? Right? You got
• 27:40
  Speaker 2: you went out, you spent half a million bucks on
• 27:43
  Speaker 2: a system that is, Oh, but it's great. It's SaaS
• 27:46
  Speaker 2: solution and we don't need to have a server form
• 27:49
  Speaker 2: anywhere supporting it. And this vendor is going to do
• 27:52
  Speaker 2: all this maintenance and they're going to support it for
• 27:54
  Speaker 2: us and we don't need to worry about like backing
• 27:56
  Speaker 2: it up or disaster recovery or you know, UX and
• 28:00
  Speaker 2: U I updates. It's fantastic. Right, But somewhere there's a
• 28:03
  Speaker 2: paragraph in your contract that could say, hey, we reserve
• 28:07
  Speaker 2: the right to use this data that you're uploading as
• 28:10
  Speaker 2: we see fit. Right, what kind of exposure did you
• 28:14
  Speaker 2: just introduce to your business because of this third party? Right? Alternatively,
• 28:20
  Speaker 2: right on the extreme opposite side of the example, we'll
• 28:24
  Speaker 2: get cases where the company is like, look, we just
• 28:27
  Speaker 2: need something. I googled first to ad that came up.
• 28:30
  Speaker 2: We went with them, and oh, by the way, we
• 28:34
  Speaker 2: got like the first year free for I guess right,
• 28:38
  Speaker 2: and it's great. Right, And then very similarly, like you know,
• 28:43
  Speaker 2: you're like, okay, we'll review the contract for you from
• 28:46
  Speaker 2: a cyber or privacy perspective, and the contracts two pages
• 28:52
  Speaker 2: right and a full page of it says, by the way,
• 28:55
  Speaker 2: you got this free year because you're giving us access
• 28:58
  Speaker 2: to use your information turn around and sell it to
• 29:01
  Speaker 2: another customer. And that's why you're not paying the ninety
• 29:04
  Speaker 2: nine ninety nine a month in twelve equal installments, right.
• 29:10
  Speaker 2: And what happens with those with those smaller mom and
• 29:12
  Speaker 2: pop companies that are that are out there is they're
• 29:16
  Speaker 2: not doing the due diligence to make sure that that tool,
• 29:19
  Speaker 2: application technology right and naven what you will is secure.
• 29:22
  Speaker 2: They're not helping you to shore up and mature your
• 29:26
  Speaker 2: own cybersecurity hygiene because they're introducing right a mode into
• 29:33
  Speaker 2: your environment where this is living. They are they may
• 29:38
  Speaker 2: or may not be acting above board in terms of
• 29:40
  Speaker 2: what the data sharing. The data sharing is behind, you know,
• 29:46
  Speaker 2: behind the scenes, and all of a sudden, right this
• 29:48
  Speaker 2: thing that you were like, oh this is great, we
• 29:50
  Speaker 2: got out of paying ninety nine ninety nine a month, Well, hey,
• 29:53
  Speaker 2: guess guess what you just took on from a risk perspective, right,
• 29:57
  Speaker 2: So there's there's a lot of the lot of you know,
• 30:00
  Speaker 2: obligation that companies have that doesn't always get seen of
• 30:03
  Speaker 2: What does there look like to manage proactively manage their
• 30:08
  Speaker 2: their third party risk? Right, and especially in hospitality and
• 30:13
  Speaker 2: especially in in in the food industry. Food companies should
• 30:19
  Speaker 2: be doing food, They're not. They're not technology companies, right,
• 30:22
  Speaker 2: So the likely, the high likelihood is there's a lot
• 30:26
  Speaker 2: of these tools in their ecosystem, right and likely not
• 30:30
  Speaker 2: getting looked at.
• 30:31
  Speaker 1: Is there a way for them to negotiate, to negotiate
• 30:34
  Speaker 1: out some of that that third party risk?
• 30:36
  Speaker 3: When when yeah, absolutely absolutely, Again, I'm not not attorney,
• 30:42
  Speaker 3: not legal advice, but consult your friendly neighborhood attorney in
• 30:46
  Speaker 3: a space.
• 30:48
  Speaker 2: The other thing that companies really should be considering is
• 30:50
  Speaker 2: what does their data sharing agreement look like with these
• 30:53
  Speaker 2: with these vendors, are they are you know, are companies
• 30:57
  Speaker 2: setting out the appropriate rules of the road based on
• 31:01
  Speaker 2: their business there, the jurisdictions where they're, where they're conducting business,
• 31:06
  Speaker 2: their type of end consumer. Are they setting out the
• 31:09
  Speaker 2: right rules of the road with these vendors saying here's
• 31:13
  Speaker 2: how you may or may not use information, right, here's
• 31:16
  Speaker 2: how you here's how you are obligated to help us
• 31:21
  Speaker 2: in the case we have a need around this information,
• 31:24
  Speaker 2: especially for the companies that are required to be GDPR compliant,
• 31:28
  Speaker 2: especially for the companies that are required to comply with
• 31:31
  Speaker 2: CCPA CPR, companies that are operating states with emerging or
• 31:38
  Speaker 2: newly enacted privacy laws. This is going to become critically important.
• 31:44
  Speaker 2: Understand what your data sharing landscape looks like, and the
• 31:50
  Speaker 2: risk around third party is front and center and that conversation.
• 31:54
  Speaker 2: Understand Yes, you as a company, you're collecting information, you're
• 31:58
  Speaker 2: using it right for again fully legitimate business purpose, but
• 32:03
  Speaker 2: then you're sharing it right and you may not think
• 32:06
  Speaker 2: of sharing it in that way, but ultimately that that
• 32:10
  Speaker 2: is what it looks like. Right, you are sharing information
• 32:14
  Speaker 2: with your technology platform. What are the appropriate rules of
• 32:19
  Speaker 2: the road for that platform to be able to use
• 32:22
  Speaker 2: your data?
• 32:23
  Speaker 1: Okay? Cool? And you know, can companies also ensure some
• 32:27
  Speaker 1: of their risk against cyber attacks and third priority risk?
• 32:32
  Speaker 2: I love that question. I spend a lot of my
• 32:36
  Speaker 2: time talking about that question. So cyber insurance is incredibly expensive,
• 32:44
  Speaker 2: it is harder and harder to get. There are more
• 32:48
  Speaker 2: and more exclusions being put into policies. So yes, you
• 32:53
  Speaker 2: can go out and you can get it. It is
• 32:55
  Speaker 2: not a set it and forget it. Most cybersecurity insurance
• 32:59
  Speaker 2: pols today are very descriptive of what capabilities a company
• 33:08
  Speaker 2: has to have in place in order for the cyber
• 33:10
  Speaker 2: insurance policy to be effective and cover a potential breach loss,
• 33:15
  Speaker 2: whatever it is. So most of the time you speak
• 33:20
  Speaker 2: to folks and they're like, no, I don't need to
• 33:21
  Speaker 2: do anything. I have cyber insurance and it'll be great.
• 33:24
  Speaker 2: And then the oh no moment happens because again nobody
• 33:26
  Speaker 2: is immune from an oh no moment, and they go
• 33:29
  Speaker 2: to their cyber and share and they're like, hey, I
• 33:31
  Speaker 2: have to pay like two million dollars if ransom right
• 33:35
  Speaker 2: to get my finances the back. The cybernture is like, no,
• 33:38
  Speaker 2: I'm not covering that. It's like, what what do you mean? Like,
• 33:41
  Speaker 2: we've been paying you a hundred thousand dollars right for this,
• 33:46
  Speaker 2: and cybernture is like, well, you didn't have any proactive
• 33:50
  Speaker 2: controls in place. You weren't doing your job in making
• 33:56
  Speaker 2: sure that you're authenticating traffic that's crossing network. You weren't
• 34:01
  Speaker 2: doing annual risk assessments to understand where you might have
• 34:05
  Speaker 2: cybersecurity risk exposures. You weren't doing a good job at
• 34:09
  Speaker 2: managing your third party risk. And even though you had
• 34:11
  Speaker 2: a great CRM platform that you paid half a million
• 34:14
  Speaker 2: dollars for right two years ago and you finally got
• 34:17
  Speaker 2: the implementation, and that's where the vulnerability came from. You
• 34:21
  Speaker 2: didn't do enough to proactively understand what your cyber risk
• 34:25
  Speaker 2: landscape looks like internally and to mature your capabilities to
• 34:30
  Speaker 2: mitigate those risks. So, yeah, cyber insurance is available out there,
• 34:35
  Speaker 2: but there is a large obligation that's still put on
• 34:38
  Speaker 2: companies to have that oh no, right file ready if
• 34:42
  Speaker 2: you will. Hey, we've been doing every year, we've been doing,
• 34:45
  Speaker 2: you know, an objective you know, cybersecurity risk assessment. We
• 34:49
  Speaker 2: understand that we have areas that we can mature, but
• 34:52
  Speaker 2: we've got these baseline competencies in place. We're making sure
• 34:56
  Speaker 2: that folks are accessing our network in a secure manner.
• 34:59
  Speaker 2: We're using multi doctor authentication for people coming in. We're
• 35:02
  Speaker 2: doing proactive scanning of our network to detect any any
• 35:06
  Speaker 2: potentially malicious activity. You know, We're doing annual penetration testing
• 35:11
  Speaker 2: to make sure that that the walls around our castle
• 35:15
  Speaker 2: are intact. We're educating our users with security awareness training.
• 35:19
  Speaker 2: We're training our leadership to be able to identify spearfishing
• 35:23
  Speaker 2: and you know, whale fishing. And if you have those
• 35:27
  Speaker 2: in place, you're in a much better position to go
• 35:31
  Speaker 2: to your insure and say, look, the own no woman happens.
• 35:35
  Speaker 2: We need help, you know, we need hey, we ensure,
• 35:37
  Speaker 2: we need your help being able to engage a an
• 35:40
  Speaker 2: incident response team or a ransom you know, uh recovery
• 35:44
  Speaker 2: team and somebody's got to go figure out how to
• 35:46
  Speaker 2: buy bitcoin for me to pay this ransom. Right, But
• 35:49
  Speaker 2: we did everything that we were supposed to do, and
• 35:51
  Speaker 2: the own no, theman still happened. And in those cases,
• 35:56
  Speaker 2: the insurers are looking. You know, it's a more favorable
• 35:59
  Speaker 2: outcome for the most part. Now that's not written in stone.
• 36:03
  Speaker 2: There are some insurers that are better than others. I
• 36:06
  Speaker 2: will not name names here, right, but but that's really
• 36:11
  Speaker 2: where we try to help folks understand. You could have
• 36:14
  Speaker 2: a great cyber insurance policy. That doesn't mean that you're
• 36:18
  Speaker 2: fully protected.
• 36:20
  Speaker 1: Okay, cool, cool? Yeah, And I guess in terms of
• 36:23
  Speaker 1: the insurers you you recommend, I guess we have to
• 36:27
  Speaker 1: pay for that.
• 36:33
  Speaker 2: You can we could we could have a one on
• 36:35
  Speaker 2: one a lovely one on one chat on you know
• 36:38
  Speaker 2: what that space looks like. But I'll refrain from publicizing
• 36:42
  Speaker 2: too widely my my fearing.
• 36:45
  Speaker 1: So what should a restaurant chain do if they suffer
• 36:47
  Speaker 1: a cyber attack?
• 36:49
  Speaker 2: Engage a good attorney. I say that tongue in cheek,
• 36:54
  Speaker 2: but you know this is really where your service providers
• 36:59
  Speaker 2: that you have relationships with come into play. So most
• 37:03
  Speaker 2: of you know, very very you know openly your attorney
• 37:09
  Speaker 2: is going to be critical in a lot of this.
• 37:11
  Speaker 2: There's going to be a lot of conversations that happen
• 37:13
  Speaker 2: of what do we know, what don't we know? And frankly,
• 37:19
  Speaker 2: attorney client privilege is going to be very helpful right
• 37:24
  Speaker 2: until you get your feet under you. Obviously, there are
• 37:27
  Speaker 2: obligations in certain jurisdictions to let h you know, an
• 37:31
  Speaker 2: Attorney General's office know if you're if the cyber event
• 37:34
  Speaker 2: that happens is a data breach and there's a disclosure
• 37:37
  Speaker 2: of uh personally that the fiable information right, there are
• 37:40
  Speaker 2: obligations there. You know that is again, we're a really
• 37:43
  Speaker 2: good attorney in the space in the room is going
• 37:45
  Speaker 2: to help you through that process. Your cyber insure if
• 37:48
  Speaker 2: you've got cyber insurance in place will be dramatically and
• 37:52
  Speaker 2: drastically helpful in terms of getting boots on the ground
• 37:56
  Speaker 2: to help you get you know, systems back to help
• 37:58
  Speaker 2: you understand how how you know what is the breadth
• 38:02
  Speaker 2: and depth of this cybersecurity incident to your environment? You know,
• 38:06
  Speaker 2: if it's if it's an internal you know, insider threat,
• 38:10
  Speaker 2: it's a you know, totally different game. You're getting departments
• 38:12
  Speaker 2: like HR involved. But leading up to this, you know,
• 38:15
  Speaker 2: the cyber incident, the point of cyber incident is not
• 38:18
  Speaker 2: the time where you want to be figuring this out.
• 38:21
  Speaker 2: You want to do a lot of this planning for
• 38:24
  Speaker 2: the own no moment before it actually happens. So we
• 38:28
  Speaker 2: always make the recommendations that on a regular basis, you
• 38:32
  Speaker 2: should be simulating, right, even if it's a table top event,
• 38:35
  Speaker 2: you should be simulating these discussions. Sit folks in a
• 38:39
  Speaker 2: room and that includes your CEO, that includes your investor relations,
• 38:43
  Speaker 2: that includes your your legal team, that includes you know it,
• 38:46
  Speaker 2: if your insurer is proactive, your you know, your cyber
• 38:50
  Speaker 2: and ensure and talk through, Hey, here's a scenario, how
• 38:54
  Speaker 2: are we going to respond to this? How are we
• 38:57
  Speaker 2: going to get to the other side of this moment,
• 39:00
  Speaker 2: because there is light at the end of the tunnel.
• 39:02
  Speaker 2: At the end of the tunnel, a cyber event is
• 39:04
  Speaker 2: not the end of your company. Right, So you know,
• 39:09
  Speaker 2: if you feel that there's capabilities in house to lead
• 39:12
  Speaker 2: that in house, do it partner with a third party. Right,
• 39:15
  Speaker 2: and shameless plug for our team here, Right, We do
• 39:17
  Speaker 2: these regularly. Right, We're sitting down with with with the board,
• 39:20
  Speaker 2: We're sitting down with the incident response teams to say,
• 39:24
  Speaker 2: how are you actually going to respond to this? What
• 39:26
  Speaker 2: does this mean to be able to go out to
• 39:28
  Speaker 2: the market and say, yes, we brand ABC that is
• 39:31
  Speaker 2: a publicly traded company in this many states. Here's what
• 39:34
  Speaker 2: happened to us, Here's what we're doing to respond to it.
• 39:36
  Speaker 2: Here's how to you as a consumer. This may impact
• 39:40
  Speaker 2: you if there is a data breach. Here's how your
• 39:42
  Speaker 2: information what types into and how your information might have
• 39:46
  Speaker 2: been exposed. But look at your partner landscape to help
• 39:51
  Speaker 2: support that that response. It should not happen in a silo,
• 39:56
  Speaker 2: and it certainly should not be you know, that cyber
• 39:59
  Speaker 2: event or you know, the privacy beach event should not
• 40:02
  Speaker 2: be the point where you're figuring it out.
• 40:04
  Speaker 1: Yeah, by then it's too late.
• 40:06
  Speaker 3: Right.
• 40:06
  Speaker 1: Oh yeah, all right, So how is cybersecurity impacting loyalty programs?
• 40:13
  Speaker 1: And do you think privacy and data concerns are going
• 40:16
  Speaker 1: to slow down the shift to one to one marketing?
• 40:19
  Speaker 2: Yes? So here's here's kind of the you know what
• 40:25
  Speaker 2: we talk about when it comes to loyalty programs. Loyalty
• 40:29
  Speaker 2: programs are great. I and myself will say that I
• 40:32
  Speaker 2: love my loyalty programs. I love getting to know that
• 40:35
  Speaker 2: my tenth pizza is free. And I'm not going to
• 40:37
  Speaker 2: name the brand, but we all know, right, I love
• 40:40
  Speaker 2: my tenth pizzas free. Right. But the reality is, to
• 40:43
  Speaker 2: sign up for a loyalty program, you're giving them a
• 40:45
  Speaker 2: lot of information about yourself. So let's first talk about
• 40:49
  Speaker 2: from a consumer perspective, right way, whether or not the
• 40:53
  Speaker 2: loyalty programs really worth it. Right if this is an
• 40:57
  Speaker 2: ongoing brand that you have an ongoing relationship with, Yeah,
• 41:01
  Speaker 2: maybe you want to say, okay, look if I you know,
• 41:03
  Speaker 2: if I give my information, I get my tenth pizza free,
• 41:06
  Speaker 2: I get twenty percent off my my my purchase of
• 41:08
  Speaker 2: you know, linens and whatever. All right, totally at it.
• 41:13
  Speaker 2: Let's say this is a brand that it's a one
• 41:15
  Speaker 2: and done. You're on the road, you're grabbing a soda,
• 41:17
  Speaker 2: you're grabbing a coffee somewhere to rest stop. Right, what
• 41:20
  Speaker 2: does it look like for you to actually give that information? Right?
• 41:22
  Speaker 2: Is there an ROI for you for doing that? So
• 41:26
  Speaker 2: I don't wanna I don't want to ignore the fact
• 41:30
  Speaker 2: that a consumer plays a really big role in this
• 41:33
  Speaker 2: relationship right on the marketing front. Now, let's go to
• 41:36
  Speaker 2: the company side of this. Right, So companies are looking
• 41:40
  Speaker 2: to say, Okay, we want to understand better who our
• 41:42
  Speaker 2: consumer is. We want to figure out you know, we're
• 41:45
  Speaker 2: we're piloting products, let's see who buys my membership perspective,
• 41:49
  Speaker 2: We're using this to maintain customer loyalty, right, to increase
• 41:53
  Speaker 2: customer lifetime value for us. You know, gone other days
• 41:56
  Speaker 2: where we can just put cookies and pixels on our websites,
• 41:59
  Speaker 2: right and have at it. Because again, thanks thanks right
• 42:03
  Speaker 2: to the powers that be for disallowing us to do that. Right.
• 42:09
  Speaker 2: But you're collecting as a company, massive amounts of information
• 42:12
  Speaker 2: about people that they may or may not understand the
• 42:15
  Speaker 2: impact of. Right, So how are you going to collect
• 42:19
  Speaker 2: information about your user base? How are you going to
• 42:21
  Speaker 2: aggregate that information? How are you then going and buying
• 42:25
  Speaker 2: let's say consumer sentiment information to layer on top of this, right?
• 42:29
  Speaker 2: How are you potentially using deal location data as an
• 42:32
  Speaker 2: additional layer here? Right? And what does that mean now
• 42:35
  Speaker 2: to that massive data set and aggregate instead of just hey,
• 42:39
  Speaker 2: you know Debra Nica who lives in xity and meets
• 42:41
  Speaker 2: the demographic measurement, right now you're like, hey, Debra is
• 42:45
  Speaker 2: more likely to buy you know, shoes A versus shoes B,
• 42:48
  Speaker 2: and she's going to she's more likely to go to
• 42:50
  Speaker 2: store one versus store two. Right, So, now that data
• 42:53
  Speaker 2: set has become a lot larger and a lot more
• 42:56
  Speaker 2: risky for your company if a cyber event topic. Right, So,
• 43:01
  Speaker 2: I think a lot of what the what the loyalty
• 43:04
  Speaker 2: program you know, is showing us is yes you can
• 43:07
  Speaker 2: do it, Yes you can do it in a smart way.
• 43:09
  Speaker 2: But you've got to be really really measured of what
• 43:13
  Speaker 2: is it that you're trying to push out there to
• 43:16
  Speaker 2: your customer and how much risk and you know, are
• 43:20
  Speaker 2: you taking on and is that ROI is still going
• 43:22
  Speaker 2: to be worth it at the end? I still am
• 43:25
  Speaker 2: I'm going to age myself for a second, But I
• 43:27
  Speaker 2: remember the really really early days of like the shop
• 43:29
  Speaker 2: right card and key card beef. Anybody they'll put on
• 43:33
  Speaker 2: the little key card right, and it was like, well,
• 43:35
  Speaker 2: like you want to the point you have to like
• 43:36
  Speaker 2: go into the store right to swipe your card, and
• 43:41
  Speaker 2: that is not the shopping experience reality. Right, I'm biased.
• 43:45
  Speaker 2: I'm in New York, right, and I'm not. There's there's
• 43:47
  Speaker 2: no shop right where I live. I missed my little
• 43:50
  Speaker 2: membership card, right. But now, what does it look like
• 43:52
  Speaker 2: for me to have a loyalty program for a supermarket
• 43:55
  Speaker 2: that I am going to right, or an online grocery
• 43:59
  Speaker 2: service that is kind of my way? So I think
• 44:01
  Speaker 2: that there's a great from business perspective, there's a great
• 44:04
  Speaker 2: utility for the loyalty program. It's also going to impact
• 44:08
  Speaker 2: the breadth of your security, right. So so we look
• 44:15
  Speaker 2: at this from the lens of you as a company,
• 44:18
  Speaker 2: have certain information assets that you're going to use to
• 44:21
  Speaker 2: drive value for your company. You're gonna support revenue, You're
• 44:23
  Speaker 2: gonna put the loyalty program out there the own no
• 44:26
  Speaker 2: moment happens or the own no moment is about to happen. Right,
• 44:31
  Speaker 2: you have one hundred million pieces of data in your ecosystem, right,
• 44:39
  Speaker 2: every every one of those, every piece of that of information,
• 44:42
  Speaker 2: there is an exposure point for you. So let's say
• 44:46
  Speaker 2: the own moment happens. We have fifty states in our
• 44:50
  Speaker 2: in our country, every single state has its own data
• 44:53
  Speaker 2: breach law, right, none of which are the state you're crazy, right,
• 44:57
  Speaker 2: we have great precedent here for why privacy laws are
• 45:00
  Speaker 2: day by state, right, because we couldn't get it right
• 45:01
  Speaker 2: with data breach, so why should we get it right
• 45:03
  Speaker 2: with privacy right. So there are thresholds of in each state,
• 45:10
  Speaker 2: because a threshold that says, you know, all it takes
• 45:13
  Speaker 2: is one person's record to be breached and that is
• 45:16
  Speaker 2: going to trigger you to have to inform your attorney
• 45:19
  Speaker 2: general's office, and it's going to trigger some sort of
• 45:21
  Speaker 2: requirement for you to respond to this bridge. Other states
• 45:25
  Speaker 2: are like, nope, it's got to be over you know,
• 45:27
  Speaker 2: five ten thousand whatever it is records for it to
• 45:31
  Speaker 2: actually trigger a response for you to need to do something. Now,
• 45:34
  Speaker 2: let's say you have a loyalty program and you've got
• 45:38
  Speaker 2: you know, you've got this hundred million data points, right,
• 45:41
  Speaker 2: and you've got all these records about people. What does
• 45:43
  Speaker 2: it mean in that Oh no, woman, how much of
• 45:45
  Speaker 2: that information is actually a value additive information that you
• 45:48
  Speaker 2: are utilizing to support business? And how much of that
• 45:52
  Speaker 2: is information that you were collecting because you could, because
• 45:55
  Speaker 2: you could take on that information? And what does that
• 45:59
  Speaker 2: mean in protecting it? Right? Are there appropriate controls around it?
• 46:04
  Speaker 2: Is there a locks on the treasure box of this
• 46:07
  Speaker 2: treasure trove of information? Right? Or it's information that ultimately
• 46:11
  Speaker 2: exposed you to requirements and to cost of responding to
• 46:15
  Speaker 2: a breach and you know, cost of responding to the
• 46:19
  Speaker 2: impact of you know, brand erosion in that own a moment.
• 46:24
  Speaker 1: That's great, thanks and you have time for one more.
• 46:28
  Speaker 2: I have time for one more?
• 46:29
  Speaker 1: All right, good stuff. So last question, are ESG investors
• 46:33
  Speaker 1: placing a focus on cybersecurity? Are they focusing enough on cybersecurity?
• 46:39
  Speaker 1: I'd imagine this is probably a big part of the
• 46:42
  Speaker 1: governance piece of ESG.
• 46:43
  Speaker 2: Oh yeah, So we're seeing a lot a lot of
• 46:46
  Speaker 2: conversations happening from an ESG lens on this. So cybersecurity
• 46:51
  Speaker 2: is certainly from a governance lens, and then privacy from
• 46:54
  Speaker 2: a social lens. Right. So I'll say that that for
• 46:59
  Speaker 2: the most part art right, unless a fund is purely
• 47:02
  Speaker 2: an es G play. Right. There are still i would say,
• 47:07
  Speaker 2: conversations that are emerging in this space, right, But there's
• 47:10
  Speaker 2: a lens that says we have to report out, we
• 47:13
  Speaker 2: are required to report at out on our ESG activities,
• 47:17
  Speaker 2: and we're going to use cybersecurity or privacy as a
• 47:21
  Speaker 2: means to quantify ESG for us. So what we see
• 47:27
  Speaker 2: a lot of the time is there's this focus on
• 47:30
  Speaker 2: what does cybersecurity mean and how can cybersecurity hygiene be
• 47:34
  Speaker 2: used to inform that governance metric? And from a privacy perspective,
• 47:39
  Speaker 2: how are companies you know, how are are let's say
• 47:42
  Speaker 2: called up a port code right in this example? How
• 47:44
  Speaker 2: is a portfolio company maintaining the privacy standards of you know,
• 47:51
  Speaker 2: of their their consumer base, of their of their data
• 47:54
  Speaker 2: in order to really understand this social social contract aspect
• 48:01
  Speaker 2: with their customers. So I think that there's a there's
• 48:03
  Speaker 2: a really I this is personal opinion, right, I think
• 48:07
  Speaker 2: that that we're going to see an increase in a
• 48:09
  Speaker 2: in a lot of these types of conversations. I think
• 48:11
  Speaker 2: that as we see more perforation of you know, e
• 48:16
  Speaker 2: s G based funds, we're going to see a lot
• 48:18
  Speaker 2: more traction in the conversation of you know, the seat
• 48:24
  Speaker 2: at the table that that cyber and privacy you know
• 48:28
  Speaker 2: have in that value edit creation.
• 48:32
  Speaker 1: Very cool. Uh, that was awesome. I learned a lot.
• 48:37
  Speaker 1: Is there is there a best way you know, in
• 48:40
  Speaker 1: an email you'd like to share something like that, best
• 48:42
  Speaker 1: way for our listeners to get in touch with you
• 48:44
  Speaker 1: if if they have any questions.
• 48:47
  Speaker 2: Yeah, absolutely so. Always happy to chat and geek out
• 48:50
  Speaker 2: about this, Debra cofres dot com. Happy to to chat
• 48:56
  Speaker 2: with you. Uh, I am going to say, feel free
• 48:59
  Speaker 2: to Google because Google is still very much one of
• 49:02
  Speaker 2: our best friends. Cohen Resnick Cybersecurity, tech risk and Privacy team,
• 49:06
  Speaker 2: and we're always happy to have a chat, have a thought,
• 49:10
  Speaker 2: you know, a moment of thinking and sharing and looking forward.
• 49:14
  Speaker 1: Awesome. Well, thanks for doing us, Thanks to our listeners
• 49:17
  Speaker 1: for listening it, and have a good day everybody,