Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Compliance Regs You Should be Following that Nobody Tells You About (And Craig Catches a Gator!)

Transcript

Compliance Regs You Should be Following that Nobody Tells You About (And Craig Catches a Gator!) · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

0:14
Craig: All right.
0:15
Craig: We are alive.
0:16
Erin: Hi, welcome back, Craig.
0:18
Erin: It's good to have you back.
0:19
Craig: Thanks.
0:19
Erin: We missed you.
0:20
Craig: definitely some interesting things happening.
0:23
Erin: Oh yeah.
0:23
Erin: Like what?
0:24
Craig: Just almost caught an alligator out with my son.
0:27
Erin: Uh, Better than an alligator almost catching you,
0:29
Craig: Yeah.
0:30
Erin: which maybe that happened to you.
0:31
Erin: I don't know
0:32
Craig: Nope.
0:33
Craig: Nope.
0:33
Erin: so where were you in this happen?
0:35
Craig: Yeah.
0:35
Craig: So we're camping with my son.
0:37
Craig: I think it was called Arapahoe North Carolina.
0:40
Craig: It's by the Neuse river.
0:42
Erin: Oh, wow.
0:42
Erin: That's like inland, right?
0:44
Craig: It's about three hours from Raleigh.
0:47
Craig: Yeah.
0:47
Erin: guess I wouldn't really expect alligator to be there, You said you have a video.
0:51
Craig: Yep.
0:52
Craig: I got a video and a screenshot or a zoomed in part clip of the video.
0:56
Craig: that I'll post
0:57
Erin: Okay.
0:58
Erin: I want to see this.
0:59
Erin: You told us it was 12 foot
1:00
Craig: No, it's not 12 foot, but it's big enough to eat somebody.
1:04
Erin: That's huge.
1:05
Erin: Yeah.
1:06
Erin: There's a couple eight foot Gators around here and it's like, stay away.
1:10
Blake: I was going to ask how big it was.
1:12
Blake: Let us know how capable you are of handling an alligator.
1:15
Craig: Yup.
1:15
Craig: So I guess PTG keeps you safe from Gators.
1:18
Blake: We can always get into the Gator security.
1:21
Craig: right?
1:22
Craig: You never know what you're going to get when you go fishing.
1:24
Erin: That's true.
1:25
Erin: And something else want to talk about today, that's not quite as interesting for most people as catching Gators, but compliance.
1:33
Erin: Always a good Monday opener.
1:35
Craig: Yeah, everybody wants to wake up and talk about compliance.
1:38
Erin: Oh yeah.
1:39
Craig: so I think you guys were asking about compliance regulations that most people don't know that they're subject to.
1:45
Erin: Yeah.
1:46
Erin: I think that's a good one.
1:47
Craig: Sure.
1:47
Craig: So you probably all heard of HIPAA, which is for medical.
1:51
Craig: But I don't think a lot of people understand that there's two
1:53
Erin: Okay.
1:54
Craig: or technically three categories for HIPAA there's, what's called the covered entities, which is the doctor's office, the hospitals what's called the clearing houses, which is the insurance companies.
2:05
Craig: And then there's also the business associates, which is anyone that interfaces or interacts with the covered entity in any way, shape or form.
2:13
Craig: And that could be your, it guy, your it provider.
2:16
Craig: It could be an accountant or somebody that has access to the books, but anybody that could potentially be exposed.
2:23
Craig: To the patient health information or Phi can be considered a business associate.
2:28
Craig: And you as a provider should have what's called a BA or a business associate agreement in place, which Is a legal document that basically says that, Hey, if you ever come in contact with patient information, you're going to keep it?
2:42
Craig: confidential.
2:42
Craig: And you have an obligation to secure it.
2:45
Craig: So you are now subject to the same safeguards as the covered entity.
2:48
Craig: So it's a trickle down effect.
2:50
Craig: So that might be something that a lot of people are unaware of that most people, when I talk to them and they have an it guy that they're happy with, and yeah, Bob's in fixing our computers for the past 20 years, you know?
3:01
Craig: So do you have a BAA with Bob?
3:03
Craig: What's a BAA
3:04
Erin: That's a no.
3:05
Craig: did know I needed one of those, so yeah, so there's definitely risk and liability there.
3:09
Craig: And if you get caught, then you can both be subject to steep fines and penalties.
3:14
Craig: That's one common one.
3:16
Craig: new one that came out is affecting CPA firms and bookkeepers that came out in January of 22, is this year.
3:24
Craig: that one basically is a similar regulation to HIPAA where their safeguards and you have to have policies, procedures, and safeguards in place make sure the sensitive information, the taxpayers that you're working with, you're keeping their social security number, their tax returns and their books confidential.
3:40
Craig: And you have security controls, supporting evidence, making sure that you're doing all this stuff.
3:45
Craig: And it goes back to the same stuff that we've always been saying on previous episodes, around risk assessments, pen tests, and all this evidence that are proving that you're doing what you're supposed to be doing.
3:54
Erin: I just want to throw this in there.
3:56
Erin: Sorry.
3:56
Erin: But isn't it true that tax fraud, especially by cyber or by hackers or bad actors has increased over the years, especially with the advent.
4:06
Erin: A lot of people filing their taxes online.
4:08
Erin: There's a lot of people that have their information stolen.
4:11
Erin: I would imagine maybe that's one of the reasons.
4:14
Craig: Yeah.
4:14
Craig: we're obviously in a climate right now with risk and adversarial threats and, hackers, favorite tools in the toolbox.
4:22
Craig: So what I was saying is that hackers really like keylogger malware as one of their tools and keylogger, malware capture any kind of keystrokes that are, if you're not using keystroke encryption, then the keylogger malware will capture all those keystrokes, including social security, numbers, passwords, anything sensitive.
4:40
Craig: So my point is that yeah, the regulation, they probably are starting to.
4:45
Craig: Hey, look, a lot of the CPA firms and bookkeepers are exposing consumer information.
4:50
Craig: And we're talking specifically about the new regulation that came out in January of 22 that affects CPAs and bookkeepers and any of the intermediate third parties that are involved with the handling of those sensitive tax returns and tax information or financial information.
5:05
Craig: There's also, what's called FTC regulation.
5:08
Craig: Federal trade commission has federal laws around the sensitive data and the safeguarding of that sensitive data.
5:15
Craig: And like I said, we're at a different climate now, a heightened state where everybody is really just, it's a matter of time, no matter what business you're in.
5:24
Craig: You're going to be subject to some type of regulation.
5:27
Craig: I guess the best one that most people were probably familiar with is credit.
5:31
Craig: We got PCI compliance or payment card industry compliance.
5:35
Craig: If you take credit cards, you're subject to PCI compliance.
5:38
Craig: A lot of business owners will not really understand that very well.
5:42
Craig: They'll probably be outsourcing the acceptance of credit cards to maybe a third party provider like square payments or QuickBooks, or some solution that they purchased or that they use in their line of business.
5:56
Craig: But the point is that when you use those solutions, you can't outsource your responsibility for the proper handling of the credit cards.
6:03
Craig: Now they may provide a good platform to keep that information secure, but you as the business owner and you as the business have, what's called a merchant account and you have an obligation and a responsibility to keep that information secure.
6:15
Craig: Now there might be a platform, like I said, that you have it's out of your control.
6:20
Craig: But if you read the detailed terms and conditions, there's typically things that you need to do and you need to, what's called a test too and sign off on it.
6:28
Craig: So what that means is that you would, by allowing your business to accept credit cards, you have responsibility and obligations that you can't outsource, that you must do, and that you must do properly and test and self attest to and sign off on, Hey, you're keeping this information safe and secure.
6:46
Craig: And that's why we keep talking about these assessments and these practice assessments and these pen tests and all this stuff, just to make sure because we're all humans and we don't do everything perfectly every single time.
6:56
Craig: So we need help and we need third parties that are trusted to test all this stuff and, hopefully catch it before an audit.
7:02
Blake: not all PCI two is the same.
7:04
Blake: So like you said using square does not absolve you of your PCI compliance.
7:08
Blake: And obviously the organizing body recognizes that.
7:11
Blake: So there's four different levels of PCI compliance.
7:14
Blake: So for example, merchants that are handling less than 20,000 transactions per year are what's called number four.
7:21
Blake: And then it goes up to level three, 20,000 to 1 million, 1 million to 6 million.
7:26
Blake: And over 6 million car transactions will be at a level one.
7:29
Blake: So, these are things that obviously you have to do.
7:32
Blake: And obviously it costs higher to be a level one compliant, and it does to be level four compliant.
7:37
Craig: Yeah.
7:38
Craig: And as you go up that ladder using transaction volume, the number of transactions, as well as transaction size or average transaction size, let's say your ticket master and your average ticket sales.
7:51
Craig: It's 50 or a hundred dollars.
7:53
Craig: If you do 10,000 sales in a day, you're obviously going to be on the higher level of your mandates around PCI.
8:00
Craig: And they're not going to take with that volume.
8:02
Craig: They're not going to just allow you to sign off and say, yeah, yeah, yeah, we're doing all this stuff.
8:06
Craig: They need the proof.
8:07
Craig: And there's actually a PCI certified assessor that will need to come out.
8:12
Craig: And that's the third party check and audit that you'll have to go through in order to keep your business and keep the acceptance of credit cards at that volume.
8:21
Craig: In that average ticket size, most businesses are probably smaller and they don't have that kind of volume or that average ticket size.
8:28
Craig: So they'll allow you to have less strict regulation, compliance and alignment.
8:33
Craig: But the fact is that you can't outsource the responsibility.
8:36
Craig: everyone needs to properly safeguard this information and everybody should have the mindset of, Hey, look, I'm not only safeguarding it, but here's my.
8:44
Blake: Another one was obviously people that are doing business within the state or have customers within the state of California CCPA.
8:51
Blake: And gDPR.
8:53
Craig: Yep.
8:53
Craig: There's California privacy act.
8:55
Craig: So CCPA, there's also new York's privacy law.
8:59
Craig: different states are now adopting their own levels of privacy and their own regulations that you have to follow.
9:07
Craig: So you've got these more recognized standards and frameworks like NIST, we've talked a lot about national Institute of standards and technology or NIS T specifically in the HIPAA space, it would be NIST 866.
9:20
Craig: And the federal space or defense industrial base, that we talk a lot about those folks are subject to D FARs and NIST, and now the CMMC 2.0 compliance regulation.
9:30
Craig: And you've got different frameworks, even small businesses.
9:33
Craig: They have a framework for small businesses.
9:35
Craig: They have computer information security.
9:37
Craig: The FBI has Seesaw.
9:39
Craig: There's all these regulations.
9:40
Craig: There's all these frameworks that are out there.
9:42
Craig: Most commonly in our country, in America, there's a, what's called SOC two type two for a third party audit that a certified accounting firm can audit a period of time for a business.
9:54
Craig: Maybe your business is small and you want to do business with a larger company or a more mature organization.
10:00
Craig: Those larger companies, they measure the risk of the vendors that they do business with.
10:05
Craig: We have what's called vendor security questionnaire, professional services, where we help a lot of those folks get through the maze of questions.
10:14
Craig: And sometimes it's pretty daunting, 300, 400, 600 plus questions for the business profile, the small business to fill out just so that they could start getting on the approved vendor list to do business with the bigger guy.
10:26
Craig: And when that becomes daily occurrence, where all these different companies are asking you to fill these things out.
10:32
Craig: Oh, and by the way, they won't allow you to rinse and repeat and reuse somebody else's questionnaire, they would not allow that they make you fill out their own questionnaire and they make you fill out the evidence that goes along with that questionnaire.
10:43
Craig: So if you're getting buried with all these different skews or vendor security questionnaires, you may want to consider a SOC two type two or an ISO 27,001.
10:53
Craig: Audit and compliance framework because those frameworks will allow you to no longer fill those things out.
11:00
Craig: And most large organizations recognize that a SOC two type two report or an ISO 27,001 is very powerful.
11:08
Craig: ISO 27,001 is really powerful outside of America.
11:12
Craig: SOC two type two is more common in America, but they are different frameworks.
11:16
Craig: They're very similar, but ISO is more of the global standard.
11:19
Craig: like I said, when the volume gets too high and it's really just, they're starting to bury you in filling these things out.
11:24
Craig: That's when you would consider that.
11:25
Craig: And we can certainly help with those types of regulatory.
11:29
Erin: Do you think at any point, things are going to become more standardized, Where all companies are supposed to follow these rules.
11:38
Craig: Yeah, that's a good question.
11:39
Craig: So I think that N I S T has done a really good job of the new CMMC framework.
11:44
Craig: my hope is that more regulations will adopt that methodology and reduce the need for all these other regulations meaning, HIPAA came out and was signed into law in 1996 by bill Clinton.
11:58
Craig: that was ages ago.
11:59
Craig: look at how much, how different we are from internet and cyber security now verse 1996.
12:05
Craig: Right?
12:05
Craig: So there's no clear guidance around HIPAA.
12:08
Craig: So it's very gray area.
12:10
Craig: CMMC 2.0, for example, could definitely overtake and bolster and better secure our medical offices and hospitals.
12:19
Craig: If those would follow the CMMC 2.0 framework, opposed to HIPAA.
12:22
Craig: it's going to come out of the federal government and it's going to be decision there on standardization.
12:28
Craig: And I do think that that would be a good thing to simplify and help not only, private sector, but also our defense industrial base.
12:35
Craig: And if everyone is following that same framework, it'll make it simpler.
12:39
Craig: And I think more people would actually do it.
12:41
Erin: I think too.
12:41
Erin: One thing that I've noticed, one of the biggest differences between HIPAA, well, really CMMC and a lot of the other regulations, I feel like a big difference is that CMMC really focuses on trying to integrate cyber security into a culture, into the culture of the business, as opposed to just making a checklist you to check off.
13:04
Erin: they try to really get you to understand why you're doing what you're doing.
13:08
Erin: I feel like some of the thing, they always win in that arena, but I feel like thinking behind it is really smart and really more up to date because the checklist approach is just not good enough anymore.
13:21
Craig: Well, I think that's a good point, Aaron.
13:23
Craig: I think it's pretty obvious that checklists and self active station is not good enough anymore.
13:28
Craig: I think that's really the whole reason why the federal government came out with the draft of CMMC version one and basically the big change was you can't self attest anymore.
13:37
Craig: You need these third-party audits and you're gonna have to find a C3 Pao, and you're gonna have to go to the marketplace.
13:42
Craig: Basically prove your compliance.
13:44
Craig: right.
13:44
Craig: And when in November of 20, when the inner role came out and the federal government said, Hey, look, we know defense, industrial base supply chain companies that are out there.
13:55
Craig: We know that you've self attested, but we want to really see who's really has the proof who's able to upload their score to the spurs system.
14:03
Craig: How many of you guys have the 300,000 plus dip companies?
14:07
Craig: How many of you guys have a perfect score of 110?
14:10
Craig: And I think that there's still companies on the sidelines that have still not submitted their score.
14:16
Erin: right.
14:16
Craig: I think there's still confusion around, well, do I need to submit my score or does that apply to me?
14:22
Craig: And I think people are still not educated enough on the responsibilities of, Hey, look, I signed off on that contract.
14:31
Craig: I took that money.
14:32
Craig: What do I need to do?
14:33
Craig: And I think that people forgot or glossed over all of the responsibilities.
14:38
Craig: And that's where I think there's a lot of confusion right now with the DIB on what is the CMMC, why do I need to do that?
14:45
Craig: And then people get hung up on, well, see I'm, I'm sees not really the law yet, so I'm not going to do anything.
14:49
Craig: Well, most tip companies already have a contract.
14:52
Craig: And if you already have a contract, you're subject to the 70 12, 70, 19, 70 20, and NIST 801 71 mandates, and you've already signed off on it.
15:02
Craig: So it's already been done at is the law for over five years.
15:06
Craig: So this is not new information, and I'm not trying to scare people, but the reality of the situation is the federal government does have what's called the false claims act.
15:14
Craig: I know for certainty that the audits have increased, the government is auditing more dip companies.
15:21
Craig: And these people that are just sitting on the sidelines, doing nothing.
15:24
Craig: Are going to get caught and then they're going to be in this remediation period.
15:28
Craig: They may lose their contracts depending on how bad the situation is.
15:32
Craig: They may get penalties and fines, so it's a bit of a mess.
15:36
Craig: So I think that standardization would be a good thing.
15:39
Craig: I think that third-party audits are a good thing.
15:42
Craig: even our company at PTG, we have to get checks from outside third parties for our work to make sure because we're looking to mature and go after the CMMC certification ourselves, so we're not just recommending our clients do this.
15:58
Craig: We're actually going through it ourselves.
15:59
Craig: And I think that it's a good thing to have somebody check to make sure.
16:03
Blake: Oh, think this is a great opportunity to pick Craig's brain.
16:06
Blake: so these compliance regulations are always evolving and always changing other than working with a firm like ours.
16:14
Blake: What are some actionable steps that maybe a company could take to stay current?
16:19
Blake: And up-to-date, to stay current with what's changing because these regulations are always changing.
16:24
Blake: They're always refining them.
16:25
Blake: They're always adding new articles.
16:26
Blake: when I was working with another client of ours, they asked me about that and I was like, good question.
16:32
Blake: Because these are always changing.
16:33
Blake: so other than hiring somebody like us or working with somebody like us how could you summarize that?
16:39
Craig: Yeah.
16:39
Craig: So selfless plug is, stay tuned to our podcast, be sure to subscribe, subscribe to our YouTube channel.
16:46
Craig: Here's the reality.
16:47
Craig: We live and breathe this stuff, right?
16:49
Craig: we're always getting the latest information.
16:52
Craig: We're making sense of it.
16:53
Craig: We're distilling it down.
16:55
Craig: So where are your shortcut?
16:56
Craig: Where are your easy button?
16:57
Craig: Right.
16:57
Craig: If you don't want to use us for whatever reason, the FBI, like I said, puts out Seesaw.
17:03
Craig: Like I said, the nist.gov website, national Institute of standards, technology, nist.gov.
17:08
Craig: They have a wealth of information there, but here's the thing.
17:11
Craig: You can go get all this stuff for free and that's great, but are you really going to be able to read and digest and understand a 300 page PDF from NIST?
17:20
Craig: That's very technical.
17:22
Craig: And even difficult for us to go through and simmer down and make sense, and then translate that language to something that most people can understand.
17:30
Craig: the information is all out there.
17:31
Craig: It's all public, but where that shortcut we sift and sort it, we make it easier to digest.
17:38
Craig: And then we help companies of all shapes and forms get started with this stuff.
17:42
Craig: A lot of companies can go to our website or they can go to the federal government resources and, maybe pretend that they're a defense industrial based company.
17:50
Craig: It could be any kind of business.
17:51
Craig: It could be a construction company.
17:53
Craig: It's still a good exercise for that construction company to go through the self-assessment process for CMMC for example, even though they might not deal with controlled unclassified information, that's not the point.
18:05
Craig: The point is that it's a good exercise from a maturity standpoint to go through.
18:10
Craig: The self-assessment to identify all of the stuff, the policies, the procedures, the security controls on all of your systems and get value from that because every single person and every single business is currently at risk from data, exfiltration, ransomware, and other adversarial threats.
18:32
Craig: There's all new evidence with the whole thing that's happening right now with Russia and Ukraine.
18:37
Craig: There's new adversarial threats coming out all the time.
18:40
Craig: So this stuff affects everyone.
18:42
Craig: Even a consumer can go through free resources and bolster themselves, but it's kind of like diet and exercise.
18:49
Craig: Who's going to wake up and actually do it.
18:51
Blake: I noticed too, a lot of our clients, they don't have too much understanding what they need to do.
18:57
Blake: seems like the biggest problems with them implementing a real-world strategies that make them compliant.
19:04
Craig: Well, like I said, nobody wakes up and says, oh, I'm going to read this 300 page PDF today or on nest and yeah.
19:10
Craig: They might have good intentions and maybe they'll get 30 or 50 pages of it read, but I'm telling you this.
19:15
Craig: I don't know if the last time you guys have looked at this, but this stuff is really hard to digest.
19:20
Erin: I read it every day.
19:21
Erin: Craig, I read it every day.
19:23
Craig: it's bedtime reading, I used the example of exercise because I think it's a good analogy.
19:28
Craig: a lot of people, they want to lose weight and they want to be in better shape.
19:32
Craig: they buy the latest gimmick or into the latest book on, know, the south beach diet or whatever the latest thing is, or the craze, the psychological and emotional buying decision I'm going to buy that thing, that book or that video series or whatever.
19:46
Craig: But their mind is thinking when they make that transaction, that's the easy button for them to get the result that they want.
19:53
Craig: But the reality is they learn really quick, much work it takes.
19:58
Craig: not just going to get pack or, lose all that weight without putting in the work.
20:03
Craig: what I'm saying with compliance and regulation is as a business owner, you as a consumer work that you have to do make yourself better fit for cybersecurity the less fit you are, the more ripe you are for getting hacked or having your identity stolen.
20:21
Erin: I want to kind of add on to that too.
20:23
Erin: If you gave a personal trainer, or if you get a gym membership, just because you get those things or buy an entire video collection of or whatever, you, still have to do the work.
20:34
Erin: Even if you have people to guide you.
20:37
Erin: So working out to lose weight or to get into shape with your cybersecurity, We are an easy button, just like a personal trainer is an easy button.
20:47
Erin: They can't do all the work for you, but they can show you how to do it.
20:50
Craig: So for example, staying on kind of the fitness thing which, cause I think it's easy to understand for most folks, like you ever see the weight Watchers commercials where, you get all the food and you get our meal plans and everything's all kind of laid out for you.
21:02
Craig: Right.
21:02
Craig: All you got to do is eat it and then go do the exercise.
21:05
Craig: so with our compliance, armor.com security training, for example, and our policies and procedures, we've done all of the hard work for all of you guys.
21:15
Craig: 80% we get you there, but you still have to do the last 20 because we don't know what kind of business you have.
21:21
Craig: We don't know all the details of how you'd like to do business.
21:24
Craig: Those fill in the blank answers are for healing for you only to customize and tailor this solution that we've created for you.
21:30
Craig: That's like I said, 80% there.
21:32
Craig: So we've done as much possible work that we can to get you there, but you need to get yourself to the finish line.
21:39
Craig: Now we'll still be your personal trainer in that, and you can hire us for consulting and professional services, and we'll give you that accountability.
21:46
Craig: It will be that, shoulder to lean on for questions and how do I do this?
21:50
Craig: How do I do that?
21:51
Craig: And then we'll meet with you at a cadence that you can afford as well as that support for your.
21:56
Craig: And, we'll get that work done with you and we'll help you, but ultimately it's your responsibility.
22:01
Craig: You're the one that's signing on the dotted line for that self attestation.
22:05
Craig: Or if you have a more modern regulation you're the one that's signing off on that contract to get that contract award.
22:11
Craig: It's ultimately your responsibility.
22:13
Erin: And then I had another question for you, Craig.
22:15
Erin: and I kind of touched on this a little bit last week, but what do you think is something that the us government could do to get everybody into cybersecurity and understanding the importance of cybersecurity hygiene or even just for the dip, right?
22:32
Erin: What are things that you think the government could do to help started more quickly?
22:37
Craig: Yeah, good question.
22:39
Craig: So I've said this before.
22:40
Craig: I think that the federal government has really good intentions and they had great intentions when they came out with the beta of CFMC 1.0, in my opinion, I feel like they diluted it and really lowered the bar to CMMC version 2.0 1.0, had five levels, 2.0, has three levels.
22:58
Craig: I think we have a great framework right now that we can further fine tune and customize.
23:03
Craig: I think the problem right now, big missing puzzle piece, it's, we're not getting enough support from the federal government around.
23:11
Craig: This is what you need to do by this day in time.
23:15
Craig: And this is what's going to happen after this day in time.
23:18
Craig: I'll give you a perfect example when the DFARS Interim Rule came out on November of 20, they said, look, you need to upload your score for yourself.
23:27
Craig: Assessment on NIST and DFARS, it's a negative 2 0 3 to a positive one 10.
23:33
Craig: You need to do this by December 1st is what they said.
23:36
Craig: And then they said, if you don't do the upload and you don't have a perfect score, you have six months of poems, plan of action and milestones, which is basically, I'm going to fix this gap.
23:47
Craig: This is how I'm going to fix it.
23:48
Craig: And this is the day in time it'll be fixed.
23:50
Craig: And you're going to get yourself that perfect score of one 10, but here's the missing piece, the missing pieces.
23:56
Craig: They say that you're not going to get that contract renewal.
23:59
Craig: say that need to show evidence of this stuff, I don't feel Like there's enough clarity around that.
24:05
Craig: I feel like it shouldn't be.
24:07
Craig: This thing, this distant vision in the future, it should be, look, to do this and you need to do it by this day in time.
24:15
Craig: we'll put it two years out or a year out, whatever the timeframe is, we need some day in time that this must be done from and direction clarity from the government.
24:25
Craig: Look, 1st of 23, everyone needs to do this.
24:29
Craig: And if you don't have this, you don't get to participate in the supply chain we need more substance
24:35
Erin: They need more teeth
24:36
Craig: yeah.
24:37
Craig: teeth Correct?
24:38
Erin: really bite into that.
24:40
Craig: Yeah.
24:40
Craig: and I think the same thing for health, like I said, with HIPAA and these other regulations, why not just take this as the opportunity to say, look, if you're a business and you're handling any kind of sensitive information, consumer information, credit cards, birthday personal identifiable information or PII.
24:57
Craig: Let's group it all together.
24:58
Craig: Any PII, Phi, anything sensitive, right?
25:01
Craig: By January 1st of 23, you have to be this level.
25:06
Craig: And if you're a Phi, then you need this other level.
25:09
Craig: And if you're CUI, then you need this other love.
25:11
Craig: My point is let's have a framework.
25:13
Craig: Let's choose CMMC 2.0, and let's say, look, if you're a business, if you want to take a credit card from somebody, you have to do this.
25:20
Craig: And if you don't do it, you can't take the credit card.
25:22
Craig: And I think that we need more teeth in it at all levels of any type of business and the same thing with consumers.
25:29
Craig: If you want to go on the internet and you want to buy something from a merchant, just like, if you want to go and you want to drive a car, it's a privilege to have a driver's license.
25:38
Craig: Maybe it's a good idea to have a cyber license.
25:42
Craig: If you want to go on the internet, you're going to have basic trends.
25:45
Craig: And you're going to be audited and tested and you need to renew it every so often to make sure that.
25:50
Craig: you are being responsible with your information online.
25:54
Erin: that also kind of goes back to something Blake and I were talking about.
25:57
Erin: We had the idea on starting with cyber security, young, like an elementary school kind of thing.
26:02
Erin: Now, out of curiosity, I don't have children.
26:05
Erin: I do have lots of nieces and nephews, but I'm just curious.
26:07
Erin: Do they have any classes like that?
26:09
Erin: When their computer classes they teach in sort of cybersecurity lessons
26:13
Craig: my children are too little right now to be able to comment on that.
26:16
Craig: do know that I have been asked and have done many continuing legal education and many continuing education.
26:24
Craig: For medical and for other colleges and universities, I did a lecture at North Carolina state university a few months ago.
26:31
Craig: So I've been hired to give good information around cyber and compliance.
26:35
Craig: I don't know what the quote unquote basic training is for younger kids.
26:40
Craig: I think it's a great idea and it should be baked into the program, but I don't know what the curriculum looks like for that.
26:47
Craig: Like I said, I think that, especially for young kids, I'll give you an example, with Facebook, in social media, there's all these documentaries out there around how our youth and our smaller and younger kids are getting subject to all these different things like Tik TOK for, and I'm not just calling out sick time.
27:03
Craig: I'm saying Twitter, everything, Facebook, you name it, fill in the blank, social media.
27:07
Craig: It has some damaging effects for growth and emotional.
27:12
Craig: It just all these damaging effects that, and I'm not singling out any of these providers.
27:16
Craig: I'm just saying, I don't think that these providers really knew what these.
27:19
Erin: Right.
27:20
Craig: Could be right.
27:21
Craig: And I think that we all, as a population in society have probably had damaging impacts from mobile devices and just computer, you know,, there's positives and negatives, right?
27:31
Craig: So computers are great to get things done, maybe there's, what's called addiction with mobile devices, it's a real thing, detox of cutting the cord of your phone and constantly checking for notifications and things like that.
27:43
Craig: Is that I don't know what the curriculum is, but I think that that's a great idea.
27:48
Craig: And maybe there should be some federal program that creates almost like a NIST, but a NIST for kids.
27:55
Craig: Right?
27:56
Craig: Like a framework for that, where look, if you have a kid that's this age to this age, you should complete this level of education.
28:05
Craig: And maybe it's an online kind of course.
28:07
Craig: Right.
28:07
Craig: And who knows, maybe we'll create it, cause we have a university too.
28:10
Craig: So that's a good idea that we could create.
28:12
Craig: But my point is that whether it comes out from the federal government, I think that there should be guidance around that and kind of best practices to best educate youth and the young.
28:22
Erin: Something else Blake and I talked about especially with social engineering and, things like that, because there really are real-world consequences.
28:28
Erin: It's not just, oh, it's just Facebook.
28:30
Erin: No, I mean, even look at what was it Craigslist?
28:33
Erin: they had people going around killing other people like this.
28:36
Erin: I feel like got too big for our britches in a sense.
28:38
Erin: And that we are really quick to really take up the internet, but we didn't really think about the consequences.
28:44
Erin: Right?
28:45
Erin: So now we're seeing the consequences play out in the real world.
28:47
Erin: And to me it seems like, and actually, since Blake brought this up, I've really been thinking about it.
28:52
Erin: The biggest solution I see to this is start them young.
28:55
Erin: You said your kids are too young, but I'm guessing if they don't have phones, they probably have iPads.
28:59
Erin: Right.
28:59
Erin: So they touch you touch apps
29:01
Craig: Well, actually, my kids in particular, they don't allow them to use the device unless it's kind of supervised.
29:07
Erin: Oh, nice.
29:08
Erin: Yeah.
29:09
Craig: We don't just give them the device, unless we're like in the car on a road trip or something, we don't really give them free reign of a device.
29:14
Craig: We have measured time with our kit where we're strict with that stuff.
29:18
Craig: Well, and I'm not saying we're perfect either, but I do think it's a good point, but here's the thing I think this stems from, when the internet came out, it was kind of like this anonymized area in quote unquote, cyberspace where anyone can kind of go and quote unquote, surf the internet in an nymity.
29:35
Craig: Right.
29:36
Craig: I'm a privacy advocate but I think that there should be two sides.
29:39
Craig: Meaning I think that like I said, there should be some responsibility at the consumer level, but what if we had followed the quote unquote driver's license responsibility thing, what if in the future, said that.
29:53
Craig: If you want to use the internet, have to have your license to quote unquote surf the internet, and it's no longer a private.
30:01
Craig: You know how we have IP addresses and then things like that, that we get from our internet service provider.
30:07
Craig: Well, what if one day that we all had assigned our own number, kind of like our social security number and that was our identity online.
30:15
Craig: Wouldn't it be interesting to look at it?
30:17
Craig: I'm not saying that I'm advocating for this.
30:19
Craig: I'm just saying that just kind of go through the journey with me.
30:22
Craig: What if everyone had their own IP address and identity online?
30:27
Craig: Don't you think that would have an impact and effect on cyber bullying?
30:31
Craig: For example,
30:32
Erin: Yeah.
30:32
Craig: If your IP address was always the same don't you think it would be safer, like Blake said, if I have an identity or a static IP address that identifies me or my child, and then there's cyber bullying happening and there's supporting evidence that okay, that's this kid.
30:49
Craig: Right.
30:49
Craig: You would think it would impact that.
30:52
Craig: I would think so.
30:53
Erin: Yeah.
30:53
Erin: Yeah, I would think so too.
30:55
Erin: If somebody had access to everything you said and everything you did online, you would probably think about your actions a lot more than if you could be anonymous.
31:04
Craig: Yup.
31:05
Erin: much.
31:05
Erin: So
31:06
Craig: who knows maybe the blockchain could record that or web 3.0.
31:10
Craig: Be that ledger, so to speak.
31:12
Craig: I think it would be interesting though, if we use the driver's license example, if you drive a car, you have to have a license, you have to pass the test to get the license, but you still have freedoms.
31:23
Craig: It's a privilege to drive the car.
31:25
Craig: Right.
31:26
Craig: But you still have freedoms.
31:28
Craig: If you want to break the law, meaning speed, you can, but you have consequence too, right?
31:34
Craig: if you think you're not gonna get away with going 80 miles an hour at a 55, you have the freedom to do that.
31:41
Craig: But if a police officer, scans you with a radar gun or laser gun or whatever, or finds that your car is the one that's breaking that law, they're going to pull you over, write your ticket.
31:52
Craig: So what if we had an internet that was kind of like that in the future?
31:56
Craig: That could be interesting.
31:58
Erin: Yeah.
31:58
Blake: our two big ideas were so obviously when I was going through a high school, they required that we take two languages.
32:07
Craig: I remember that too.
32:08
Craig: Yeah.
32:09
Blake: One of them, obviously English, and then I think I opted for Spanish.
32:13
Blake: what do you think is more useful in my world right now?
32:16
Blake: not only because I'm in cybersecurity, but imagine that if cybersecurity was required curriculum any school, but not only that, and Anna were talking more from younger, more adolescent So we had the ideas like, okay, if your child is old enough to run an application or to choose whatever game they want to play on.
32:38
Blake: For something as simple as saying, okay, little Johnny on this application you click on your game.
32:45
Blake: And of course that, first application would be a VPN or something along the lines
32:50
Craig: In that context, it should be the rules of the game, right?
32:52
Craig: If you want to Excel and get to the next level, you have to abide by the rules.
32:57
Craig: If you don't, then you don't get to the next level.
32:59
Craig: Right.
32:59
Craig: So it should be almost like a rewarding point space system.
33:02
Blake: Our second big idea was, so obviously if you think about this before you buy a car, you have a car facts, right?
33:10
Blake: So thinking about a Carfax for a business, okay.
33:14
Blake: Before I go to this business, This business, my money is their health, their score card here is their
33:23
Craig: Yeah.
33:23
Craig: I actually came up with that several months ago.
33:26
Craig: Cyber score.
33:27
Erin: Well, it makes so much sense.
33:28
Erin: It helps things to become standardized.
33:31
Erin: You know what I mean?
33:32
Erin: If you want to get insurance, you can do all of those things at once.
33:35
Erin: Like Craig was talking about, you have 17,000 different forms that you have to fill out the, say the exact same thing.
33:41
Erin: Well, if you have the cyber score, cyber credit score or whatever you want to call it.
33:46
Erin: Then it's, just right there.
33:47
Erin: Also what I was thinking about if things were standardized, Companies are going to be more to do kind of like what blue shift is doing, what other companies, vendors that we've worked with are doing, which is mapping the controls that they can provide to whatever regulations are required.
34:04
Erin: So, if you have one standardized CMMC for everything, right?
34:09
Erin: Every single vendor that we work with is going to be like, wait a minute, let me figure this out for you guys.
34:14
Erin: Right.
34:14
Erin: It would just really help together.
34:17
Craig: that's what I was saying several months ago.
34:19
Craig: when I thought of that scoring thing, that's where I was going.
34:22
Craig: I was saying, look, if everyone would just standardize on the CMMC and let's say, your score ranges, from a negative 2 0 3 to a positive one 10, that could be one way to do it.
34:32
Craig: But then we started talking about it.
34:34
Craig: Maybe it'd be better not to use numbers like that.
34:36
Craig: And maybe it would be better to just do ABC DNF.
34:40
Craig: that could be a way, but we have the resources and technology to help people increase their score.
34:47
Craig: And I would love to see in the future maybe adoption of our methodology around the scoring system, because look at it from a risk profile.
34:55
Craig: If You're an insurance provider, do you want to ensure somebody that has an F or where your risk of paying out a claim is exponentially higher?
35:05
Craig: Or do you want to give the guy that has, or the girl that has an a on their score?
35:10
Craig: Maybe they get a break on their insurance because you know that your likelihood of a payout is extremely.
35:15
Erin: Right.
35:16
Blake: already, imagine it right now with the Petronella browser bar, whenever you type in like a.com, tells you a plus the minus.
35:26
Blake: So,
35:27
Craig: Yeah.
35:27
Blake: kind of taking the previous idea with our current scorecard idea and bridging the two because, once you access the website, okay.
35:35
Blake: I got a B minus.
35:36
Blake: Okay.
35:36
Blake: Why do they have a, B minus?
35:38
Blake: How do they handle that?
35:39
Blake: Okay.
35:39
Blake: Here's how they scored.
35:40
Blake: And here's why they scored a B minus.
35:42
Craig: Yep.
35:42
Erin: And yeah, and here are some solutions to it would be easier to find solutions for them well.
35:48
Blake: yeah.
35:48
Blake: if you want to use this website, I'm thinking more like in a broader scope.
35:52
Blake: Oh, if you want to use this website, we highly suggest that you use the VPN or use it,
35:57
Craig: What comes to mind too, ironically, is food labeling, you go to the grocery store and maybe you have a gluten allergy or a wheat or a peanut or tree nut allergy, right now with the way that things are labeled, it's a mess.
36:10
Craig: Even with food labeling there's, cross-contamination the labels are not clear, so not only do we need work at a score in cyber, but we needed another things like labeling too, because think it would just be a positive impact for everyone.
36:25
Craig: I think that, you guys said, I came up with the scoring thing, I think these, it would bring clarity.
36:31
Craig: I think it will bring much needed clarity for folks.
36:34
Craig: I think that if businesses had a code of conduct to adhere to, or maybe the government came out with some more guidelines around it, or maybe there's, tax incentives like, look, if you have a better score, we're going to give you a break on T some type of positive impact from and support from the government, I think would be helpful too.
36:53
Craig: But I think that some type of global recognized, or at least north American at the beginning, and then a global recognized standard is much needed.
37:03
Blake: Now that you bring up the food industry, this is just my understanding, because I've watched some of the documentaries on Netflix that talks about the food industry, these huge slaughterhouses and Yachty eats mega monopolies that have people sitting in, acting in government that are making legislative decisions in favor of them.
37:24
Blake: Do you feel like that's the case for cyber security?
37:27
Blake: Do you feel like our cyber shoots.
37:29
Blake: Hygiene on the government level has been stalled by things like that, has it not yet creeped into our industry?
37:38
Craig: That's a really interesting point.
37:40
Craig: I think that my opinion is that everything's affected by that stuff.
37:45
Craig: I'm not going to get political, but you exercise your right to vote, to trust that the person you're voting for has alignment with your values and beliefs.
37:55
Craig: Right.
37:55
Craig: But there's no guarantees that they actually do what they say.
37:59
Craig: Right.
37:59
Craig: And a lot of.
38:00
Craig: Stereotypically speaking when I say this, but when a lot elected officials say one thing in a campaign and then do something else, my point is, I think that, like you were mentioning Blake, there are certain foods that have a monopolistic behavior, certain companies of certain sizes.
38:16
Craig: Yeah, absolutely.
38:17
Craig: One thing I'll reference with the CMMC there is a lot of pushback from the little guys, the DIB, the defense industrial base, the smaller companies and supply chain.
38:26
Craig: there was a lot of pushback around CMMC NIST and D farce in general, saying that it was going to be too expensive and cost prohibitive and nobody would do it.
38:35
Craig: And then they would say only the big primes would do it.
38:38
Craig: If you think about that for a minute, Our company PTG.
38:42
Craig: We found ways to help the little guys to make it affordable.
38:46
Craig: And it really is truthfully affordable to get these scores at a level where your small business can compete.
38:53
Craig: Does it cost money?
38:54
Craig: Absolutely.
38:54
Craig: It costs money.
38:55
Craig: Is millions of dollars for most?
38:57
Craig: No, it's not.
38:59
Craig: Is it a fraction of a cost of your contract?
39:01
Craig: Yeah.
39:02
Craig: It's definitely a cost of doing business.
39:04
Craig: And we believe that it's almost like a minimum effective dose to be able to quote unquote, get your driver's license to be able to bid on these contracts.
39:11
Craig: Right.
39:12
Craig: But absolutely.
39:13
Craig: I do agree that big companies often persuade or for sure.
39:20
Craig: Absolutely.
39:21
Erin: I feel like the government couldn't we give grants, I feel like that would make sense.
39:24
Erin: Right now we have trillions of dollars exfiltrated and trillions of dollars in data exfiltrated by bad actors.
39:32
Erin: Enemy states basically.
39:33
Erin: So to me it would make more sense that these things are not free, unfortunately.
39:38
Erin: It takes time and it takes money even if you do get a cybersecurity firm.
39:42
Erin: So I guess I kind of don't really understand, although I guess in the past, the cost of this has been kind of built in the contract.
39:50
Erin: Right.
39:50
Erin: And a lot of people just haven't used it.
39:52
Craig: It's not the cost of NIST.
39:54
Craig: Really.
39:54
Craig: I view it as you've got this foundation of your business, right.
39:59
Craig: And NIST and you're attesting that you're going to do the NIST 801 71 stuff.
40:04
Craig: But Sadly, I would say that most people don't even know what they signed off on.
40:09
Craig: So they don't realize all the stuff that they were supposed to be doing.
40:11
Craig: I don't think that it was necessarily baked into the contract.
40:15
Craig: I think before signing off on it.
40:17
Craig: It should have been evaluated by the business owner or the stakeholders around.
40:22
Craig: Look, if we want to go after this contract and this contract's worth$10 million, we need to realize that it's going to take us X dollars to be able to fortify our systems and get them up to speed.
40:34
Craig: Just to be able to get this contract.
40:35
Craig: It's an investment from that dip company to be able to then have the access on these opportunities, these new opportunities.
40:43
Craig: And I think that the challenge, especially with the federal government politicians, the challenge is how do we keep freedoms in place and choice?
40:53
Craig: Without being biased.
40:54
Craig: And I agree with that.
40:55
Craig: I'm not saying I want to be told I need to do something in a specific way, I think that that's also where there's the big confusion point around some of this and where people don't know where they can get started.
41:08
Erin: Yeah, absolutely.
41:09
Erin: Feel like if they would just make a big cyber security initiative, and really push it and grant money to people, to businesses, all the businesses, not even just the dip.
41:20
Erin: Right.
41:20
Erin: If we want to really get our cybersecurity
41:22
Craig: it doesn't even have to be grant money.
41:24
Craig: if it was just a tax break?
41:26
Craig: Look, businesses get crushed.
41:28
Craig: our own business gets crushed with taxes wouldn't it be nice if look, you get your score to an, a, you get X percentage off under your taxes to help with that pain and that burden I think that could be a good idea.
41:40
Craig: I'm in favor of grants to but I think the point that I was trying to make is I don't want to be told that I have to do it one specific way because the landscape is constantly changing.
41:49
Craig: We want to sure that innovation continues to happen around XDR and other layers in cyber.
41:55
Craig: And we want to make sure that we have the choice as a business owner.
41:59
Craig: We have the freedom to choose one vendor over another.
42:02
Craig: Obviously we negotiate on our client's behalf, better deals for our clients.
42:06
Craig: So that's why self-disciplined good to go through us.
42:09
Craig: But the truth of that is that we truly have vetted and tested these things.
42:12
Craig: that's part of our mission and our value to make sure that we are that easy button for folks, but that's why we do that.
42:19
Craig: And that's why for the past 20 years we work on not only making those good relationships, but making sure that the stuff that we parked.
42:27
Craig: That it actually works.
42:28
Craig: There's so much stuff in so much money that's wasted and so many promises from a good salesman or salesperson or sales woman that persuades the company on the other end.
42:39
Craig: Oh Yeah.
42:39
Craig: Yeah.
42:40
Craig: This is going to make all your CMMC or HIPAA or whatever the framework is, all your worries go away.
42:45
Craig: This thing, it does it all.
42:46
Craig: It's the silver bullet, but then, there's companies that truthfully are out there that will take your money.
42:51
Craig: I've heard all sorts of horror stories from small businesses just getting ripped off.
42:55
Craig: think that if there was more teeth in it and more direction and more clarity around these frameworks and reducing the amount of frameworks That we have maybe down to just the CMMC or whatever they want to call it, that would make it simpler and easier to understand for people.
43:11
Craig: And like you were saying, Aaron before, there's a lot of crossover, different mappings from one regulation to another.
43:16
Craig: We're all trying to say the same thing.
43:18
Craig: And, one author of one framework might want their, framework to be the global standard or whatever.
43:23
Craig: And that's all great.
43:24
Craig: But I think that if it comes from the government, like the CMMC, for example, I think that could be a good clarifying moment for a lot of people.
43:31
Craig: Then let there be freedoms and competition in the marketplace the solution for this.
43:36
Craig: And again, it goes back to the labeling I was talking about, right?
43:39
Craig: So like if our vendors, Microsoft, and apple, if they all were regulated and subject to this framework and they all were better able to label their products and say, this product is going to meet access control domain and give you X points on your spur score and make it easier to label things better, to make it easier for consumers and businesses to pick and choose products based on how much of a score impact they'll have.
44:06
Craig: I think that would make things so much easier for a lot of people.
44:09
Blake: I feel like this is such a good thing to bring up at this moment, but I think Aaron, it was our statistics podcasts where we talked about percentage of your revenue that goes to security, Let's just say you're a freelance or a self contractor, once you get a check that comes in, you take a percentage of that check and you put it aside and you lock it up in a bolt saying, this is wind tax day.
44:35
Blake: And the tax man comes knocking at the door April 18.
44:38
Blake: And the, so you have a reserve set aside.
44:40
Blake: I think if it comes to mind immediately, I think.
44:43
Blake: Six to 11% of your revenue be dedicated or it security, things of that.
44:53
Blake: It just depends on the data that you possessed.
44:55
Blake: And obviously it's going to be more if you're a government contractor or maybe less if you're selling blankets at the flea market, that's something too that I think people need to understand.
45:05
Blake: And then I even found a deeper diving article 50% of that should be operational and infrastructure secure.
45:13
Blake: And other 20% shouldn't be vulnerability management or security monitoring.
45:18
Blake: Another 16% should be government risk and compliance.
45:21
Blake: And then obviously this one would be unrelated, but application security.
45:25
Blake: Of course, this all depends on the sector.
45:27
Craig: I think that that's really good.
45:29
Craig: I liked that, but I think that people and businesses need to understand that there's a minimum effective dose that whether you're a one person or a thousand people, have to have this minimum foundation.
45:41
Craig: Okay.
45:42
Craig: And then as you.
45:43
Craig: Complexity increases with regulations or sensitivity of data, then you have to have these ad-ons right.
45:49
Craig: So maybe like Blake said, you have these increased percentages, but there's a certain strong foundation that needs to be in place for every kind of business first and foremost.
45:58
Craig: But I think it really goes back to the labeling that we were talking about.
46:01
Craig: I think it's great that every business should have X percentage put aside for this stuff.
46:06
Craig: Right.
46:07
Craig: But I think it goes back to vendors and putting pressure on Microsoft and other vendors to better label their products and services so that we know, Hey, this is a puzzle piece, or this is a contender for giving us X number of points to solve this problem in this domain.
46:24
Craig: And there, again, it also goes back to responsibility of The end user in this case, the business owner or the consumer, the person using the product to properly configure those things, right?
46:35
Craig: Microsoft, Google, they all have these platforms in their cloud services environments.
46:40
Craig: And they all have a lot of mappings that are already done.
46:43
Craig: But again, he can't outsource that responsibility.
46:45
Craig: They're giving you the environment, but you are a professional on your behalf needs to properly configure and continuously monitor and police that environment, make sure things are buttoned up and your scores stay high.
46:58
Craig: But my point is that I think it goes back to labeling.
47:00
Craig: Like, Give you another example with CUI or controlled unclassified information.
47:04
Craig: The federal government in the training that we all took for the CMMC from the CMMC AB to be registered practitioners.
47:12
Craig: And to be an RPO company to help these people, the defense, industrial base clients, well as other businesses of all shapes and forms.
47:19
Craig: The training that we took basically said, the federal government is still working harder to better label and identify CUI.
47:28
Craig: And if they did not label something CUI, you need to treat it as sensitive and secure it.
47:34
Craig: So my point is that there's so much work to be done with labeling of data and all types of sensitive data in all industries, in every single one in health in federal space.
47:45
Craig: And you name it fill in the blank.
47:46
Craig: My point is that labeling needs to be improved on everything.
47:51
Craig: The regulations need to be simmered down a more global standardized system And there needs to be more teeth in it.
47:59
Erin: And there also needs to be more full integration of cyber security.
48:02
Erin: Ever since learning so much about CMMC, that really resonates with me.
48:07
Erin: I feel like instead of having cybersecurity and it kind of off to the side is just out of sight, out of mind departments unless needed, it needs to be a part of the culture.
48:19
Erin: And speaking on that, I just found this statistic.
48:23
Erin: I want you to guess what the average, and you can guess to Blake, craig and BJ, guess what?
48:28
Erin: percent the average company spends on cybersecurity of their total revenue.
48:32
Craig: I think it depends on which sector, if it's finance or banking or whatever it is, but you're asking for a dollar amount or a percentage.
48:40
Craig: Oh gosh, it's probably less than 2%.
48:42
Blake: I was going to say around one, maybe half a person.
48:44
Erin: that's closer plate 0.3%
48:48
Craig: Yeah.
48:48
Craig: 0.3%.
48:49
Erin: of revenue is generally what is spent on cyber security.
48:53
Erin: And we wonder why we have so many packs,
48:56
Blake: think about this.
48:56
Blake: When you go in and incorporate your business, whether you're using legal zoom or insurance service here, and then as you're incorporating your business all these free services like add on services.
49:10
Blake: Oh, I want of America to reach out to me.
49:12
Blake: Oh, I want a CPA firm to reach out to me.
49:16
Blake: Yada, yada, is there not a cyber security there?
49:21
Blake: So that way, white crime was saying.
49:23
Blake: You're building your house with a sturdy foundation.
49:27
Blake: that's probably the thing that's on the back of a startup's mind, Hey, how do I compliance?
49:33
Blake: How do I be secure?
49:34
Blake: How do I secure my customers?
49:35
Blake: the groundwork isn't even late.
49:37
Blake: Of course you have more things to think about being profitable and generating cash flow and all these other things, administrative responsibilities.
49:44
Blake: should go hand in hand with those.
49:47
Blake: And it should still be a part of your core foundation of your business start and focus on cyber security while you're bringing all these other pieces together.
49:56
Erin: Right.
49:57
Erin: And it's so much easier to start it from the ground level than it is to incorporate it after the fact.
50:02
Blake: It's more expensive
50:03
Erin: it's way more expensive.
50:04
Erin: It's way more difficult.
50:06
Erin: So many more challenges.
50:07
Blake: to do it later.
50:08
Blake: Yup.
50:09
Craig: I agree.
50:09
Craig: with that.
50:10
Craig: The service exists.
50:11
Craig: We created it, where that easy button for businesses and consumers to help them with all this stuff.
50:17
Craig: So we exist to help the people provide really good efficient services that have high value, high impact and high security.
50:25
Craig: But what's lacking here is the teeth and the federal government side around standardization labeling, if more people knew about us and how affordable some of this stuff is and how easy we make it, I think just going to be better for everyone, but, 0.3% is obviously not enough.
50:43
Craig: All that investment.
50:44
Craig: Sadly, we don't create all these solutions.
50:47
Craig: We just know the right recipe and the process.
50:49
Craig: And that's why we have patented cyber safety stack of over 22 layers now.
50:54
Craig: And, we have that stack because it's so powerful and we continue to build on that stack because it works.
50:59
Craig: And we know that it's battle tested, and we only use products and services that are battle-tested that go through our process.
51:06
Craig: So my point is that if we get more support from the government around standardization and labeling, it's going to make it easier for everyone and more clear for everyone to understand why they need to take action now and not just sit on the sidelines.
51:24
BJ: You know, what's interesting, Craig, is that as we've talked about before, cause we're always a big advocate of using the right strategic solutions and we've talked about XDR a lot and what's interesting is recently Gartner who, kind of is the trendsetter, right.
51:39
BJ: For cybersecurity reporting.
51:40
BJ: they're definitely considered an authority in the field and the government probably reads their reports and I'm sure that they're a source of, a lot of determined.
51:48
BJ: action government and business alike takes.
51:51
BJ: recently Gartner published a report with us statistic basically an expectation where the Gartner says that they think within the next couple of years, XDR adoption will be at least 40%.
52:04
BJ: But when you really think about it, they're saying 40% of all businesses guys, that's a huge number.
52:10
BJ: Well, what's really interesting here is that think that finally things are going to start to settle and sort themselves out in the right way, because if you just look at.
52:20
BJ: As an example, just our ecosystem, right?
52:22
BJ: Petronella technology group, Craig has worked painstakingly over the years stay in the know on the most important aspects of cybersecurity from building Bulletproof PCs years before the world was ready for the idea to always vetting all these different technology solutions.
52:40
BJ: Well, now again, has put, positioned us in a situation that's very significant because actually worked very closely with a certain XDR solution that we feel strongly is a very good one.
52:53
BJ: And, we're involved in research and development on the machine learning side of this solution.
52:57
BJ: cause I have it in my home as part of the research and development project and I have had to spend so much time, Documenting anomalies with this system in my home, to the point where a lot of time has went into just observing what's happening in my smart home, this is the unknown territory that we're in now because is an AI driven cyber security tool that partners people and technology together because the people have to input the knowledge into the tool and then the tool analyzes then takes action.
53:28
BJ: we've positioned ourselves in a unique spot where we're involved in the actual research and development of this tool being used in the real world in a smart home, for example.
53:38
BJ: And I'm noticing some things that I didn't expect observe.
53:41
BJ: so significant when you add all these little pieces together and you kind of paint a picture in your head of like, where this is all going.
53:48
BJ: Gartner is saying 40%, and that's just on what we know today, that's not factoring in all these anomalies that I'm documenting.
53:57
BJ: Something's happening with this tool, have pages and pages of documentation, of things that I'm noticing.
54:02
BJ: And so 40% could be low.
54:05
BJ: And so this is very important time, a shift in cybersecurity where the people that have been on the cutting edge, because we wouldn't be involved this process with this XDR tool.
54:13
BJ: If we were.
54:14
BJ: Consistently on the cutting edge of cyber security where we always find ourselves.
54:19
BJ: Well, now I think this is really gonna start to be a pathway for people to just what Craig was talking about, finding the right solutions and being able to onboard with them and taking the stress out of it.
54:30
BJ: Why has Gartner's estimating 40% that is such a big number.
54:34
BJ: So they have to have their suspicions about the X factor here, the machine learning part.
54:39
BJ: And we agree with that after what we've witnessed.
54:41
BJ: So this is such a critical time to partner with the right people who have the right knowledge and the right expertise.
54:47
BJ: And they have their hands in the trenches with their sleeves rolled up because this is unchartered waters, and 40% is a big number.
54:57
Blake: Gardner is also the publishing authority that said that you should spend anywhere from six to 10% of your revenue on cyber security.
55:03
Blake: And it as well, they're the same publishing authority.
55:06
BJ: We know this eye, Gartner's like the authority on this.
55:09
BJ: People pay big money to try to even advertise on a Gartner report to get in the limelight with gardener.
55:14
BJ: What I'm saying in a nutshell is that Craig has made very smart decisions has put us at the cutting edge of things that no one even knows.
55:22
BJ: No one even knows what to expect.
55:23
BJ: Right.
55:24
BJ: Cause me, I'm like an anomaly hunter.
55:26
BJ: Right.
55:26
BJ: And I have been so surprised at some of what I've found.
55:29
BJ: It's hard to surprise me when it comes to this stuff, but I have been floored by some of what I witnessed to the point where I get so excited, my hands are shaking.
55:36
BJ: Right.
55:36
BJ: As I'm trying to document this stuff.
55:37
BJ: Cause it's that fascinating.
55:39
BJ: And they're saying 40% without knowing those things is my point.
55:42
BJ: There's a pathway, that's probably just going to sell form.
55:45
BJ: Right.
55:46
BJ: But you have to be aligned with the people who have been there working on this because that's just the way it's going to work probably.
55:52
BJ: I think that there's a light at the end of the tunnel.
55:54
BJ: and I think that we're always going to need the right cyber security people because these tools need the human interaction as well.
56:01
BJ: The human interface, it's very important and, these tools don't work, right.
56:05
BJ: If they're not handled correctly, With the right expertise, the right knowledge,
56:10
Craig: Sorry to interrupt you, but see, a lot of people don't understand that though.
56:13
Craig: A lot of people think that, I'll just go buy this off the shelf.
56:17
Craig: XDR and then the salesperson does a great job of selling them on it's the greatest thing.
56:22
Craig: like I said before, it's not a silver bullet.
56:24
Craig: It's a powerful layer.
56:25
Craig: And it's an essential layer these days, were just saying 40% is a great stat for adoption.
56:30
Craig: But my point is that a lot of the solutions do not have talent managing that hardware and software and Intelligence.
56:39
Craig: And that's where our solution that we chose comes into play Because it marries all that together
56:44
BJ: Yes.
56:44
BJ: Because what it marries together is the understanding of this stuff and the foundational layers, the backbone of this stuff, because what is software, right?
56:53
BJ: Software is can, ask anyone to define what software really is and people are going to think they know, but as they start trying to define it, they're going to get very confused.
57:01
BJ: And they're going to stumble because what is it?
57:03
BJ: What is AI?
57:04
BJ: What is machine learning?
57:05
BJ: What is AI driven?
57:06
BJ: Cyber security tools.
57:08
BJ: Good luck trying to define all that.
57:09
BJ: But the key here is that because of the years and years and years of cultivated knowledge about these things.
57:16
BJ: Now there's a level of awareness.
57:18
BJ: Amongst certain people in this industry where they know what to pay attention to, and they know what parts of the software need attention because in a scientific process, the observer is critical to the process.
57:30
BJ: We're in a very unique time for cybersecurity teams and it's not ironic.
57:35
BJ: It is ironic.
57:36
BJ: Excuse me, it's not coincidental that a few months ago, the government, the federal government went on a huge cyber security, talent hunt.
57:43
BJ: Literally I saw the solicitations emailed out, they're searching for top cybersecurity talent because I think people are starting to understand that people involved in the cybersecurity teams definitely have an impact on how the tools work.
57:57
Craig: Well, not only on how they work, but how do just like in anything that the human is going to use the tool in the toolbox and then hone their craft.
58:05
Craig: right?
58:05
Craig: So there's going to be some people that are better at it.
58:07
Craig: And some people that are not, but as I listened to what you're saying, DJ, I think that we need to create our own Gartner report.
58:13
Craig: the reason, why I say that, no, I'm being serious.
58:15
Craig: The reason why I say that is because I Like Gartner.
58:18
Craig: And again, I'm not putting any reports down in any way, shape or form, but even though Gartner is well-respected, I don't think that it's fair to charge vendors or people to be on the Gartner report, right.
58:30
Craig: To kind of pay to play kind of thing.
58:32
Craig: Like Blake was talking about, with the other industries that you kind of have the top big players that kind of control.
58:38
Craig: I feel like there should be a report that we write that gets published annually or whatever the frequency is.
58:43
Craig: That's not biased and it's objective.
58:45
Craig: Yes.
58:46
Craig: It's all.
58:46
Craig: Evidence-based.
58:47
BJ: just objective.
58:48
BJ: Yeah.
58:48
BJ: That presentation you gave you gave that presentation at a university and it was the perspective of the observer and, your presentation actually was sent to me by Google assistant.
58:58
BJ: Right.
58:58
BJ: But it's really good.
59:00
BJ: It's really good.
59:01
BJ: It put things in perspective for people, that is so critical.
59:04
BJ: Go with the cheapest solution or the one that is offered by a big tech as part of a package deal.
59:09
BJ: I personally don't suggest doing that because this is our unchartered waters and that's not how this stuff works.
59:17
BJ: these tools, these smart tools, they work differently.
59:20
Craig: that's also why we follow that proof of concept methodology.
59:23
Craig: And we back everything up with third-party evidence to, but here's, what's alarming though.
59:28
Craig: What's alarming is the statistic of folks businesses that don't understand the value of even the proof of concept, And we've even seen people that are like, oh Yeah.
59:40
Craig: well, we didn't really budget for this.
59:42
Craig: So we'll look at this next year.
59:44
Craig: That's the wrong approach folks.
59:46
Craig: You need to invest in this now.
59:48
Craig: If you don't think that you've been hacked, you probably have been, you just probably don't have the visibility and the technical understand the human side of it.
59:56
Craig: Right.
59:57
Craig: The human side to see.
59:59
Craig: It's kind of like out of sight, out of mind, right?
1:00:01
Craig: If you don't see any red flags or, any evidence of something wrong, you're thinking, oh, everything's great.
1:00:08
Craig: But when you get that visibility and you look through that lens and you see how look there is something bad happening, and this is what's really happening, here's mitigation of the remediation plan on fixing it.
1:00:21
Craig: More people need to go through those proof of concepts.
1:00:23
Craig: I just don't understand.
1:00:25
Craig: That's what's mind boggling to me.
1:00:26
Craig: More people need to invest more and take this more seriously.
1:00:29
BJ: yeah, it is mind boggling that you can see.
1:00:32
BJ: I can clearly see in my interactions with people, can clearly see that there's basically two sides of this all there's the people that get it and understand the complexity of cybersecurity and the strategy of people processing technology and the right ones, the right people, the right processes and the right technology, because all three are important.
1:00:51
Craig: Well, they're really important.
1:00:53
BJ: It's just about how they're aligned and then some people don't get it at all.
1:00:55
BJ: I literally got an email from someone.
1:00:57
BJ: And they said, literally, they're just going to go with the lowest price.
1:00:59
BJ: And I'm like, I don't know a nice way to say this, but that's not the right way to look at this.
1:01:03
BJ: And you're making a very big mistake,
1:01:05
Craig: and there's always a reason why that price may look cheaper.
1:01:10
Craig: There's something missing that's the fact of it.
1:01:12
BJ: it's a rinse and repeat, Hey, we're going to launch this tool, but we're not gonna pay it no attention and observe it.
1:01:17
BJ: And it's not going to really do anything phenomenal.
1:01:19
BJ: You're going to be able to check a box and say you have it, but how effective is it going to be?
1:01:23
Craig: you can build a house with one guy and a hammer, but if you don't have the miter saws and all the latest technology, right.
1:01:29
Craig: It's going to take you a really long time to build that house.
1:01:32
Craig: So we're not saying you can't go and find your own stuff, but I challenge everyone lists.
1:01:37
Craig: To be more efficient than we are.
1:01:39
Craig: We work hard every day to find the most cost-effective efficient solutions that actually work.
1:01:47
Erin: Well,
1:01:48
Craig: guarantee that you will not find a better recipe than what we've developed and that's our intellectual property.
1:01:55
Craig: I mean,
1:01:56
BJ: I would agree completely.
1:01:57
Craig: With the XDR SOC services that we provide, you can't hire an intern for what our solution costs.
1:02:03
Craig: And if you think you can, that's crazy.
1:02:05
Craig: We do this every day.
1:02:06
Craig: This is our bread and butter.
1:02:08
Craig: live and breathe this stuff.
1:02:09
Craig: We are efficiency experts, not only at managed services, but cybersecurity, all the work that we do around risk assessments and pen tests, we do it really, really efficiently.
1:02:19
Craig: And cost-effectively.
1:02:20
BJ: we're really cyber security strategists, really, because we understand the value that each team member brings to the table.
1:02:26
BJ: For example, we have several layers, right?
1:02:28
BJ: But this one that we're talking about, that Gartner spoke of the 40% adoption rate.
1:02:32
BJ: I remember specifically how we stumbled upon it when you were looking for something like this, because Craig's always keeping us aligned with the cutting edge tools.
1:02:40
BJ: And we were almost going to find on with one and then on a Saturday afternoon Craig message.
1:02:45
BJ: And it was like, hold on.
1:02:46
BJ: I found this and I was like, oh gosh, another one.
1:02:49
BJ: And then I went on the demo and I started getting to know the guy who wrote the algorithms.
1:02:53
BJ: And I was like, whoa, he might've really stumbled onto something here, that right there how do you define that?
1:02:58
BJ: How do you put a value on that?
1:03:00
BJ: The mind that sits there on a Saturday afternoon does what needs to be done to find those gems right.
1:03:06
BJ: And to understand when they do find a jam.
1:03:08
Erin: think too, the other thing is the other vendor that we considered wasn't quite a gym enough.
1:03:13
Erin: Right.
1:03:14
Erin: That's why Craig was looking for a little bit more.
1:03:17
Erin: It was a good solution.
1:03:18
BJ: Yeah.
1:03:18
BJ: It was a good solution.
1:03:19
BJ: We liked it.
1:03:20
BJ: But Craig just failed an intuition that something more was needed.
1:03:24
BJ: Right.
1:03:24
BJ: And kept searching then he found this and after what I've seen, right.
1:03:29
BJ: I won't get into the anomalies.
1:03:30
BJ: So that's a rabbit hole.
1:03:31
BJ: But after what I've personally witnessed dear God, I don't even know what to say about this that.
1:03:37
BJ: You know what I mean?
1:03:38
BJ: machine learning is an X factor and no 40%, you can say that all day long.
1:03:43
BJ: I agree.
1:03:43
BJ: It's going to be at least that, listen, I think there's going to be a scramble get a solution that really, really works.
1:03:49
BJ: And I think 40% is going to be really low not all XDR tools are the thing, you know?
1:03:54
BJ: And that's the critical thing here.
1:03:56
Craig: That's why, I was saying you've got to take us up on the proof of concept.
1:04:00
Craig: We're not making this stuff up.
1:04:01
Craig: you got to go through it.
1:04:03
Erin: There has never been a time that we didn't find something.
1:04:06
Craig: that's.
1:04:06
Craig: Right.
1:04:07
Craig: let's use a medical example, right?
1:04:09
Craig: God forbid, you got diagnosed with some disease or something.
1:04:12
Craig: Right.
1:04:12
Craig: And, the doctor says, oh yeah, you're fine.
1:04:15
Craig: But maybe you just don't feel well.
1:04:17
Craig: Do you stop and take the decision that the doctor said, you're fine.
1:04:21
Craig: Or do you keep
1:04:21
BJ: Saturday.
1:04:22
Erin: Yeah.
1:04:23
Craig: If it were me and I don't feel good and I go to a doctor and my doctor runs all these tests, he says, oh yeah, you're fine.
1:04:29
Craig: You're fine.
1:04:30
Craig: But I
1:04:31
BJ: That's
1:04:31
Craig: don't feel well, I'm not going to stop.
1:04:33
Craig: going to go to another doctor I'm going to go to a specialist.
1:04:36
Craig: are that specialist.
1:04:38
Craig: From for cyber, we live and breathe, cyber and compliance and managed services and managed security.
1:04:44
BJ: the alignment, of people process and technology will never go away because here's the thing people think, oh, the AI tools get so good.
1:04:51
BJ: You're not going to need fiber.
1:04:52
BJ: No, that's not true the alignment of people process technology will always be significant because the technology part, it will not do its best unless it's being observed and handled correctly, updates, patches, observations noting what's happening attention it's science, and it has to be observed.
1:05:10
BJ: the observer's skill level is determined on a lot of factors, their knowledge base, all kinds of things go into that.
1:05:16
BJ: Right.
1:05:17
BJ: You can't go and duplicate what we're doing here.
1:05:20
BJ: You just can't, we're in unchartered waters and we're navigating them we're navigating them very strategically.
1:05:26
Craig: what's always changing and evolving and that's a good point BJ.
1:05:29
Craig: The one thing I'm going to say, is our solutions and our recipe, our 22 plus patented cyber safety stack or cyber security stack that we have.
1:05:38
Craig: We're constantly looking at all those technologies and solutions and we're swapping them out, back in 2013, when there was a spike in ransomware and we were using a certain antivirus vendor and it wasn't detecting anything, we swap it out for a better solution for that layer.
1:05:53
Craig: And we're always making sure that we have the most powerful stack available in the future, who knows what's going to be added to our stack.
1:06:00
Craig: But my point is we don't just stop and say, oh, we've got a stack.
1:06:04
Craig: And then that's in stone.
1:06:06
Craig: We're always looking at every layer of the OSI model and making sure that everything is all encompassed in Clover.
1:06:12
BJ: Our strategy is, streamlined and fluid for sir.
1:06:16
Craig: Yep.
1:06:16
Craig: I started this company over 20 years ago.
1:06:18
Craig: didn't start it as a job.
1:06:20
Craig: I started because I love technology.
1:06:21
Craig: I love cyber.
1:06:22
Craig: I don't necessarily love compliance, but I'm really good at it.
1:06:25
Craig: I live and breathe this stuff because I like it.
1:06:27
Craig: I enjoy it.
1:06:28
Craig: It's not a job for me, and that's why it's to your benefit because I'm doing all the experimentation.
1:06:33
Erin: why you're doing that on a Saturday, because you love it.
1:06:36
BJ: people, it's hard to describe the benefit of a human, right.
1:06:39
BJ: Because we see the benefit of automation and stuff like that.
1:06:42
BJ: But when you think about a human, what are they?
1:06:44
BJ: Well, they literally are conduits of passion.
1:06:46
BJ: When we get passionate about something we really can Excel, and really separate from the pack.
1:06:51
BJ: Passion is like, how do you define that?
1:06:53
BJ: You can't buy it.
1:06:54
BJ: It's not for sale, it's authentic, but when it's fully activated, wow.
1:06:59
BJ: You know, a lot of sparks happen.
1:07:00
Craig: We should probably wrap up here,
1:07:02
BJ: Yep.
1:07:02
BJ: All right guys.
1:07:03
Erin: Let's keep going guys.
1:07:05
Craig: the marathon podcast.
1:07:07
Blake: was a good one though.
1:07:07
Erin: That was good.
1:07:08
BJ: we've only scratched the surface.
1:07:10
BJ: There's so much more to talk about.
1:07:11
BJ: One day, maybe we should do a 24 hour marathon
1:07:13
Erin: All day,
1:07:14
Craig: Oh God.
1:07:15
Erin: I can do that.
1:07:16
Erin: We can do that pretty easily.
1:07:18
BJ: usher in the age of automation with a 24 hour live.
1:07:21
Blake: maybe we can make a technology that livestreams the automation
1:07:25
Craig: Hey, that's a good research and development idea.
1:07:27
Craig: Maybe we need a smart camera to stick in front of your device
1:07:32
Erin: Oh my gosh.
1:07:33
BJ: I think that's actually happening organically.
1:07:35
BJ: That's one of the anomalies I've noted, so,
1:07:37
Craig: But we'll save that for the other podcast.