Today on our Tech for Business podcast, we're joined by Todd, our COO and CISO, and Nate,
our Director of Cybersecurity and BCISO. About a month, probably two months by the time this
podcast comes out, CIT had our Tech Fair. We're both of you presented and networked.
So my icebreaker today is, what is your favorite part of Tech Fair?
Why everybody can stick for me. Todd is listening to himself talk the entire time.
What kind of fun than that? I think that actually has to be mine because I gave the most number
of presentations during the Tech Fair. So on a serious note, it's actually education back to
those in the industries. It was so much fun being able to just communicate. And the questions that
came out of it were phenomenal. And it's stuff that organizations deal with every day. We have a
lot of these answers, but unless you ask them, either we'll just talk about it on a podcast
because we just want to continue talking. But it was fun actually being able to look at people
and answer their questions and help try to drive those business decisions.
Yeah, I tend to agree. I mean, everybody likes to tell me I like to talk, which I do.
Don't get me wrong. Love it. But getting to do it in person makes a difference. So we do a lot of
these podcasts. And the reality is I get to talk to the group that's on the podcast, but you don't
get any real time reaction to it. So you're kind of hoping what you put out there means something
that makes sense. And it's helpful when you're doing it in person, you can see if somebody's
with you or not. Right. So it's a different thing. It's a different conversation, especially if you
can do them one on one that they're way more enjoyable. When there's a big group, I like to
crack jokes and try and make people laugh. So I keep them away. But other than that, the best part
is just being able to communicate. I think Ariel had asked me why I got into cybersecurity on a
podcast previously. And my answer was because I get to help people fix problems and that that's
ultimately what's meaningful to me. And I get to do that in person. It's great.
Here in Kelsey, what's your favorite part of the tech fair? Us being we didn't present, but we
were definitely there in the background. Yes, we were in the background working hard. I would say,
you know, really just seeing the people along the lines what Todd had mentioned, I mean, us on the
marketing team, we're sending out the emails and we know that's Todd from CIT. But when you get to
see him in person, like, you're like, Oh my gosh, now I know who you are. And then we get to have
that interaction and talk with them and really make sure that what we're doing from the marketing
department is hitting home with them kind of along those education lines. So for me, I love seeing
the people. Sorry, quick interjection. Tara, I also completely agree on that was we see names
associated to companies all the time. And we email and communicate all the time. But seeing
that face is drama. 100%. I love all the people, people on this podcast, not saying I'm not a
people person, which I feel like Todd's probably sad, she's going, but I do really enjoy that as
it being an in person event that we get to select cool venues. So this year was at the
Huing Hotel, so it was cool to be able to go and experience it in a space that wasn't just
our office or right a conference room that we were like, this was also a cool experiential.
And then we did have an app this year that we had people gamify, do points and the photos that
they took made my entire day. I think at some point, somebody like folded a mini swan and they're
like, find this one. And I was like, you are my type of people. The people are like, this has
nothing to do with the conference, but that's my favorite thing. So seeing the little creative
fun moments that came out of people interacting with things, that was probably my favorite part.
For sure. I was going to say that too. I really interacted with people on our app and got to
communicate with some people and saw their name throughout the day. So which actually brings
us to what we're talking about today. We have got some tech fair attendee questions specifically
about our cybersecurity course presentation that Todd and Nate gave. So we had so much interaction
with this. We are going to have a second part. So today we're kind of focusing mostly on kind of
MFA and passwords seem to be a lot of the questions. But our first one is actually about
Sentinel one and someone asked about specific examples of Sentinel one kind of saving a client
from that other software didn't stop. Yeah, I don't know if they have examples you'd be comfortable
sharing. I've I'm going to do a selfish plug and say go check out the last episode or two about the
respond to the security incidents. I had one of my incident response leads actually joined me on
that podcast or I joined him whatever way you want to look at it. But we talked about a lot of
different security incidents that we dealt with. And Sentinel one did come up plenty of times in
that. So there's there's plenty of endpoint detection or response or EDR solutions. You know,
it's obviously I would love to have you be a part of CIT's you know the environment there because
we do see a broad range of threats and we should constantly try to push down new protections on
those and manage it. But with that EDR solution, we have seen plenty of threats come through from
there. So for example, I think one of the first customers we ever put on Sentinel one was they
downloaded a malicious macro and we quickly identified that it was nefarious. And it was
progenized, which means you know kind of the horse coming through the building and then it
unlocks kind of the chaos is it was weaponized to do remote connections outside of the network
introduce ransomware everything like that. So we were able to stop something like that. We've had
cases of someone where it didn't quite identify like the initial cause of that. So I'm a little
on a mystery of that complaint. But once someone was on that system, we saw things like downloading
Mimi cats Mimi love these are all tools dedicated to capture admin credentials, and then compromise
the rest of the network. It was trying to also download browser credentials. So if you're in
the browser saying save my password for me without using some type of password manager,
it's stored in there and it's easily accessible to attackers. So that's another tool that they used.
So we can kind of get into the password manager discussion later, you know foreshadowing. But
one of the other things was I really recall that one because we even had the threat actor trying
request an uninstall of the tool because they tried downloading tools to rip off the edr
solution that has a timbre protection so you can't do that. And then they got stuck after
everything was getting blocked and they said, Can you please just uninstall this? Obviously,
we said no, and we isolated the entire device off the network. That's the fun one. I have
plenty more examples of just stuff going on, but it's a phenomenal tool. Yeah, I think the real
question is so backing up a little bit for those that weren't at the tech fair, essentially that
the chorus meeting was there's a couple of things that we feel like you absolutely need to be doing
absolutely need to be doing for your cybersecurity. EDR with a bullet and MFA or one, one, one a
by B, one, one, two, whatever you want to call it. And so that was kind of where the conversation
started. And in our opinion, it really is a non-negotiable you need to be doing that. But
which I think we've talked about before, but really that's the question, right? Does it work?
And the answer is yes, it absolutely does work. We aren't just slinging products for the sake of
slinging projects. As we mentioned at the very beginning of this, the whole point of this is
education. So very valid question. But it is one of the few security tools where your expectations
are usually exceeded. A lot of times you're like, why hope this is working? And then if you don't
get an alert, you're like, well, did it do anything? Did I spend my money wisely? And the answer was,
yes, you did. It is the right tool. It is the right solution. And it should be doing it.
The one thing that I'd add on to what Nate's talking about too is making sure that it's not
just a tool it's plugged in and you're just hoping it works. I still think, in my opinion,
you need to have somebody paying attention to what's happening on there. Because those are
some pretty advanced attacks that Nate's referring to, whether it's Meemecats or other.
There's a lot going on. Somebody should be looking at that and validating it. And if you're just
waiting for the tool to pop up and go, oh, hey, by the way, I took this device off the network,
you probably want to be slightly ahead of that. Sorry, Lasing. I know that this question is
specifically about the examples that we've seen. The one thing that I did want to say is,
if you don't have it, you're already behind the game. Even the federal government has requested,
or sorry, not requested and mandated this across the entire federal suite of devices.
If the federal government has already told everyone that this is required to be implemented,
they are one of the slowest moving components of our country, I guess, already behind the game.
Right. And so we saw the federal government make those requirements. We saw insurance make those
requirements. If you're still not on it, you're about two years too late so far. So that's kind
of the criticality of this. Yeah, I mean, I'll throw some statistics on that too. So we had a
conversation with one of our partners about it. And just to kind of give you some insights as to
what's going on. And this is kind of getting back to the real world, things that are going on there.
The adoption rate for CIT customers is roughly about 75%. That's just a real rough number.
But to me, that's not high enough. I'd like to see it like well into the high 90s, but we're
doing fairly well. Industry-wide, which is the partner's feedback, as they're saying, it's probably
closer to 30% or 40%, which they think is incredibly low. And I would agree with that.
The reason why I said the real world example is, we used to deal with a significant number of
security incidents at CIT prior to being very heavy on the front end of EDR, EDR, EDR. And it has made
a significant difference. We still deal with them, but the vast majority of issues that we're running
into are either not related to a tool set that would, tool set like EDR would handle, or they're
ones that don't have it. And that's significantly the major difference. When we're not seeing something
that, an example of something that would be outside of EDR, you're typically looking at an account
takeover or something along those lines. So I know on other podcasts, we've kind of mentioned the EDR
and MFA is the one to punch. So kind of move it into that other part of it. We had a couple
questions about MFA specifically. And the first one is, is it getting too easy and simple? This
person wrote in users' muscle memory and human behaviors by leaving secondary devices unlock,
mitigate security measure. What can we do against user error?
Throughout the computer.
Real briefly, I'll expand on it just real briefly. MFA is a tremendous tool set. It works extremely
well. There shouldn't be any way. There shouldn't be any real surprise that threats keep evolving
and that they change tactics. So once you start to block something, they get a little more clever
and they find new ways to attack them. So you are seeing MFA starting to evolve as well. So you're
getting into a lot of things that are much harder to break. We can get into FIDO2 in a little bit,
but some of the stuff that you're doing is trying to find MFA that's fishing resistant as the new
term. And so a great example when you talked about the muscle memory stuff that we've seen in the past
is we've had examples of doing a penetration test in the past. And the tester tries to log
into something. They get stymied by an MFA and they're like, well, what the heck? I'll give a shot
anyway. And they try to push the MFA and just see what happens. And unfortunately, somebody gets a
push MFA in their phone and they're like, well, I'm logged in. That's really weird. Yep, I'll accept
that. And then the pen testers like, cool, I'm in. So don't do that. That muscle memory doesn't
make sense. Slow down just a little bit. Yeah. And we see that unfortunately time and time again.
This past week, I don't know what it was, but we saw a massive tick of email compromises.
And in most of those cases, it was multi-factor that was already enabled. It was the user just
accepting the push, accepting the code, typing into a fraudulent website, which then passed the
login off to someone else. In the past, we've seen things where someone said, I'm going to make the
super secure. I can't log in outside of the office. I'm going to send all the calls to my desk phone
so I can only accept it while I'm at work. Then they go hit one or a number and accept it anyways.
If you go take a look at the statistics for any type of compromise, in over 90% of cases,
it requires some type of human interaction, right? It is the tools, the technology is consistent,
and it only does what it's told. People are often unpredictable. Now they can be great of
giving you a heads up notice of things like, I'm getting notified a lot for these multi-factor
requests. I think something's wrong. And then you can go dig into that. But in my opinion,
it's getting too easy. That's why we do see an industry shift to extra validation. So,
if people are going to listen to this and say, this is getting ridiculous, but we're moving
from two factor authentication to third factor authentication. So you put in your username,
you put in your password, you put in the multi-factor code. Now what we're starting to see,
Microsoft has already started pushing it recently. Okta has it, is after you hit yes, this is me,
it asks you, there's three numbers on the screen. Hit the appropriate one that's on the screen as
well. And you have to confirm that number to validate that it is you. So it continues to decrease
at risk. I don't love that approach overall. That's where we tend to see things go more
passwordless altogether and say, no more passwords, it's tied to a user and a device. And if one of
the two don't match up, then grant access. So we've got plenty of podcasts already about zero trust
and device trust and everything like that. That's the route we're going. Eliminate the password,
have the depth of the password through it and say, there's a user, there's a device,
they have to be matched together. And then you can put additional layers on top on the background.
Remote passwords. Yeah, one thing I just wanted to, I smirked when Nate said, yes, it is getting a
little too easy and you're kind of bypassing MFA. It's kind of ironic because again, industry-wide,
the adoption of MFA is extremely low still. So you're still in that 40% range for adoption.
And yet we're getting to this point where we're trying to mature it.
Nate did mention it is a little more inconvenient, which is kind of funny because a lot of people,
the ones that haven't implemented as they find MFA to be inconvenient, well,
that is true. It can be, that's where the push thing kind of removes some of that friction is,
it just pushes it and says, hey, is this really you? And you say, yes, well, unfortunately,
people are hitting yes when it's not them, which is why you get that additional layer,
which hopefully would be a catch and go, whoa, wait a second, I don't have that number on my
screen. But it does get rid of that. Ultimately, where I was going with that, it is convenient,
is what's more inconvenient losing access to your email credit card information.
We can kind of go from there. There is a layer of risk, certainly understand that. And to some
degree, you're kind of going, well, it's really highly unlikely that it's going to happen to me.
Well, it's a lot more likely than if you're going to play the lottery. And I'm guessing a whole
bunch of people played the lottery when it was $2 billion. So slow down, think about your MFA.
It is definitely something that should be there. The one other thing that I wanted to throw on
there, Nate was kind of alluding to it currently. And I want to stress this as currently, because
who knows what will end up happening. Currently, the only way that most attackers say they can't get
into a system is with some sort of physical device or some sort of additional token. And that's kind
of where we're seeing the industry going. So most people that are in cybersecurity are aware of who
Kevin Mitnick is. And when he did his presentations, he says, that's the only thing he can't get past.
Because if you don't have it, you couldn't get in. So it was a physical token that you had to have
in your hand. It wasn't a push. It wasn't anything else. That is inconvenient because now, you know,
people are carrying around on their key chains or whatever. But it is extremely robust security as
well. And I think that's why we also see a giant shift in the industry focus on this as well,
is saying, you know, the username, the password, the multi-factor, the second, third multi-factor,
whatever it is, right, it's becoming just too much, right? And so that's why we see this device trust
coming into play is you don't need to make it extremely complicated to say, now we need, you
know, a key that you're carrying around with you or anything like that. We're seeing a fundamental
shift across the entire industry. For those that are technical, it's called Thaido, you know, which
is, you know, hardware-based authentication to websites. So it's not quite adopted across the
entire industry at the moment, but we do see that happening. And so a lot of these websites, we see,
you set this up on your device, it's trusted. You have maybe some single sign-on across all your
enterprise organizations. And then it starts tying both that device to that employee. So for the
employee, it's actually easier to log in to everything, but it increases the security posture
of your organization. So that's the really important part is don't just throw hardware on top of the
existing problem. It's a fundamental shift over to this approach, all right. That could be a whole
different podcast. I won't go too deep into that. So that's just the same thing. Something I'm very
passionate about, holding a lot. For sure. I was going to kind of jump into this because somebody
asked about geo-fencing and my very limited knowledge. Is that something that you see coming into MFA?
Do you feel like that's a good idea? Or is it just another one of these hoops to jump through
that's not really worth it? I'll be blunt. It's a band-aid to the problem. Now there are
limitations saying you need to retain access to your implementations and access to your systems
within geographic boundaries. We do see that across some of the regulations. All of the
factor it has to do is just come VPN into that organization. We're in the United States. There's
plenty of VPNs all around that you can hop into. You just hop into there and then try and log in.
So it's a band-aid. That's where that device trust and the password list and user trust all
start to play into a bigger conversation. I was going to add to that, but I don't think we really
need to. I think the answer was it was good and clean. The next couple of questions are about
passwords. I know we've been talking about password lists. We might just say your ideas
things move this way. Do you recommend password managers? Is there anything specific you would
recommend for small and medium businesses? That was a big question people had at the Tech Fair.
Yes. Thanks for coming to this podcast. Thank you very much.
We're done. The answer is yes. I recently got a new phone and I was doing my transition from my
old phone to the new phone. As I was going through it, I was like, wow, I've got a lot of MFA out
there, which is a good thing. But if I didn't have my password manager, just for additional
context, I think at 20 some MFA is later, I was like, wow, this is kind of a pain in the...
Anyways, I have way more passwords than I have MFA. The MFA is around the stuff that I care about,
which is all the good stuff, my work, my personal, my emails, my credit cards, etc. But I have so
many passwords and I do try to do the whole news only a unique password for every individual site.
I don't know how you do that without a password manager. There are pluses and minuses and I'll
let Nate expand on it again. But some of the things are going to be a lot less robust. I think we did
a password manager podcast a year or two ago already. But when you got into it, one of the big
things that comes up is should I use the password manager in my browser? And we said it's least
secure, but it's way better than using winter 2023 exclamation point on all your sites.
So I would do something is better than nothing. There are a lot of good ones, especially... I like
to do this for a personal individual. For your own personal, there are tools out there that are not
for pay like LastPass has one and we can get into the LastPass stuff in a bit. But there are tools
out there that are available for you and using them is better than using a n theory notebook is
super secure because it's in your house, but it doesn't go with you everywhere you go.
Yeah, it's just a giant rest conversation. You have the notebook. What happens if you have a
house fire? It's gone. Or you went somewhere, you're on vacation, whatever. Yep. Now you can't
access any of your websites. I recently had a death on the family extended. We can get into
anything because that person withheld all that and we spent months trying to deal with the outcome
of that. I have a password manager. It has emergency access. After a grace period, just in case my
wife does get compromised, then it'll automatically grant access to my password vault. And then she
can just continue dealing on with whatever stuff that she needs in case I'm gone. There's a lot
of benefits that you can tie into this. Now, the one common concern is if all my passwords are on
some third party service, do I run the risk of them being compromised and gaining access to all my
passwords? Yes. Right. I want to disregard that. They put a lot of effort into encrypting those
and everything like that. We've seen password managers on the pass get compromised. They tend
to not to lose the actual password themselves. It's more of an encrypted vault that someone then
has to go spend significant time cracking. If you just rotate your passwords in that, you're safe
again. There's a plenty of statistics out there and they all range a little bit depending on their
surveys. But most of them tend to land between an average person has 100 to 250 different accounts
that they manage online. I just pulled up my own personal password manager. I have 289 today.
I don't know any of those passwords because they're all completely randomly generated. I only have my
one main password to log into my password manager. Strong multi-factor authentication to try and get
into that. The risk of having a unique password on every website greatly diminishes the risk
because what happens if someone gets into your email? It's likely a shared password with your bank
or whatever it is and they can quickly navigate, which leads me to just one quick final thought
about password managers and just a little hint of info. Please make sure that the strongest things
that you put protection around are your email and your financial institutions because if they get
into your email, they can just initiate password resets to any other application because that's
the central repository for all your accounts. So protect those as much as you can.
Yeah. Now, again, I think they covered that extremely well. The one thing that I would add
on to him too is he had mentioned the comment of, well, then you just go reset it and it sounds like
an unsurmountable thing when you throw 200 plus passwords you got to do, but actually the password
managers do a very nice job of helping you with the resetting process. They'll take you to the right
site, 90% of the time, they'll take you right to where you need to go. They'll fill in your old
password for you, prompt you for a new one. They're extremely well done. They have done a really nice
job with the password managers and they aren't nearly as scary as they seem to be. It's really not
that much work. Yeah. And for those that are still concerned about some type of third party
offsite in the cloud, there are on-premise password managers as well that you can use.
If you still want to manage that, you have to do a couple extra groups to be able to use that on
other devices, but they've already thought of that concern as well. So we're going to zoom out a
little bit. We've been talking very detailed about each of these cybersecurity cores and
we had a few questions about a little bit more like business side. So I'm going to just ask all
three of these because I feel like they kind of fit together. We had a lot of questions about
budgets when it comes to these cybersecurity cores. What is the recommended budget that you
would expect to spend on this, which is a hard question to answer? How do you justify these
things in your budget and then how do you break that down for your C levels? I know that was a
lot, but... Yeah, you're asking two security guys. So 100% of the company revenue needs to be dedicated
to security. Perfect. Yes. Yeah, I think that the answer seems like it would be simple as
know your audience. So for example, our CEO is very security conscious and rightfully so. We
got a big responsibility and so forth, but he's with us. So when we come to him and we're adamant
about something and we show the value of why we need to do it, he's very accepting to it. It means
we don't have the ability to just say we want anything and everything and he's going to sign
off on it, but he is very receptive. So for us at CIT, it is pretty easy to kind of move things
along as long as we can make our case for it. If you look at, you can go out and search,
Google will help you. You can go say, what does it look like for my industry? And you'll find
numbers. A lot of times you'll find the numbers tend to go all over the place and I just had the
biggest lightning strike right next to me. So if I go offline here in a second, I apologize.
But in my opinion, that varies so much because there are a lot of nuances that go with companies,
right? It's big size, location, etc. etc. And so ultimately, the answer for me is going to
largely depend on what your appetite work is. And it's also going to depend on your industry,
right? So if you're in healthcare finance, those kinds of things you're going to have requirements
and you really unfortunately don't have a lot of wiggle room on them, you will work with other
customers that will say, if you don't do X, you can't have Y. So if I don't invest in my EDR,
I may not get this agreement. In which case you can kind of look at it and go, gosh, I'm going to
spend $2,000 on this product, but I'm going to get a $500,000 agreement out of it. That's
worth it. Move forward. It's a pretty easy conversation. Now, it could be a lot more
complicated than that too. But again, those risks, conversations are how I would typically
start to approach it and start looking at it. Most ransomware attacks you're looking at in the SMB
market, which is small and medium size, you're looking at about $250,000 ransom or event in
your offline for two weeks. So now you start to build your budget around it and say knowing that
it costs that much, how can I put in tools that start to mitigate that risk without coming back?
So if I came back with something that ended up being $200,000 to mitigate the risk and I'm saving
$50,000, I'll probably just skip it and go, I can accept that risk for now. Then the last piece
that I would put on there and I'll let Nate take over is once you start building your budget and
it's in there, people start to go, okay, he's serious. He isn't letting this go. If you have a
physical budget and it's in there month after month and you're talking about it and you're saying
this is why and here's what I'm fixing on a risk perspective, things will move forward.
There's a couple low hanging fruit items that just simply makes sense. When Todd's talking about
these big numbers for critical security events or even things like you go take a look at business
emo compromises, account takeovers. When you do those, take a look at some of the statistics of
what is it actually or what's the likelihood that they actually happen? It's all over the place.
These are the number one threats is system intrusion, their human interaction. So you have
statistics to back you up on then and they often are the initial attack vector to these critical
security incenses. The tools are actually pretty dang cheap to be able to protect against those.
So yes, let's say you're talking about some type of endpoint detection response, it may be a couple
thousand dollars a year, right, depending on the size of your organization, obviously. But
how many years of protection can that give you if we know that this is the number one,
number two, number three threat across the organization, you may be able to afford 10 years
of protection simply for the cost of one security incident. And we already know that these are the
critical things. Therefore, it's an easy business justification to try and put those in place.
Multi-factor, yes, there are three solutions. We see this with Microsoft just saying,
it's not required because it's so critical that you have it. There are other paid solutions that
have more bells and whistles. We spend a significant amount of money on our identity and access
management solution. However, we see the value because the criticality of an account compromise
or access into these systems far outweighs the risk of not putting into the play. So again,
the budget and everything is completely subjective to your industry and everything like that,
especially if you're non-regulated versus regulated. But I guess the last thing I would say is there
are actually frameworks to help calculate some of this stuff. So if you're not familiar with things
like the fair risk matrix or reporting structure, there are ones out there such as fair that can
help you out and make those a quantitative justifications. Yeah, I think it was that the
FTC had generated some guidelines on what people should expect as they were rolling out some of
their stuff and they built, they helped build budgets too. So those things do exist and you can
go search for those and kind of get an idea what ballpark numbers look like. But that'll help.
And then last but not least, there are partners out there that will help you build the budget and
go, okay, well, let's look at the overall budget of who you are, where you are in your maturity
level and where you're going and we can help build that out and then help. If you need it,
not everybody does, but sometimes people help need somebody to come in and just be that buffer
between the person that's asking for the money and the people that are saying yes or no to spending
it. So partners can help you with that piece as well. I think sorry, the one last thing I'm
going to add on to this just to Ariel, just to help tie your last question together is
how do you break down for your C levels or justify them? Or that initiative, how does it drive the
business forward? Right? Even today, I was talking to Todd about some type of security initiative
and going, how do I benefit from that? Right? And what's the cost? What's the labor associated?
Taking those into consideration, are there alternatives that we have considered to maybe save
those expenses, right? Having those conversations of saying we've considered and exhausted all
efforts to mitigate this risk or transfer this risk or something along those lines,
the only viable way that I see this moving forward and mitigating is to implement this.
And if you have those numbers backed up, again, the business wants to keep moving,
they want to keep making money, but they also want to mitigate risk because that costs money
on the back end as well. I think like camera for us, Todd or Nate, who said it's important to
know your audience and kind of know where they're coming from when you have these conversations.
I totally take credit for that because I was talking.
So my very last question is how often are you having these conversations? How often should
you revisit these cyber policies? It depends. I have to work it in. You knew it was coming. It
was just a matter of time. It really does depend if you have it written down in one of your other
policies. And so for example, in HIPAA, in the finance world, etc., they say what they do and
then you go through the audit process, improving you do what you say. And in most of those,
they typically say they review them at quote unquote, at least annually. So if you document
somewhere that it's at least annually, then you better do it at least annually. I generally recommend
at least annually as kind of a baseline. You should be doing most things at least that frequently.
Things do change enough that you should be doing it. We talked about MFA. We've been screaming it
from the top of the mountain for seven years and it's changed. So we got into that fish
resistant conversation because it's changing. You need to revisit your policies and say
has what's happened in the world, our new adoption technology, our different change of our risk
appetite has changed. Do I need to make adjustments to my policy? And then of course,
did I miss anything the previous time? Like every day policy. So I guess whenever something comes
up, right, is if you have a policy here at CIT, we've had these in the past where,
yes, let's say the quarterly or sorry, not the quarterly, the annual cadence is we add a minimum
needs to do this annually. If there's an issue that comes up and it's something that you didn't
encounter in one of your policies, communicate it, right, make sure that it's associated into
the business moving forward. So we have issues every single day. I'm going to say daily on your
lunch break, just look at them and update them. Right. But annually is a good start. It is.
And I mean, there are certain things that businesses do just by nature that causes it to
happen. So for example, we do like an incident response plan and we review that at least yearly.
And what typically ends up happening is we just had a conversation earlier today where
someone was talking about, well, what happens if I implement an EDR and I get an alert,
what does that look like? Well, if that's not an incident response plan, it should be.
So those kinds of things that change pretty regularly and you just need to be on top of it
and continue to revisit and make sure you're doing all your due diligence.
Perfect. Well, we're definitely revisiting this topic. We got some more questions. We couldn't
fit it all in. So we'll be back. And I see there were more questions. Thank you, Todd and Nate for
joining us today. If you enjoyed this podcast, please like and subscribe. It's how we know
that you are interested in these topics. If you have a question or a topic, you'd like us to
discuss, reach out to us at info at cit-net.com or head out to our website cit-net.com slash
podcast and we'll be back next week with an all new episode.