Today on our Tech for Business podcast, we're joined by Todd, our COO and CISO, Nate, our
Director of Cybersecurity and V-CISO, and Matthew, our GRC Analyst and V-CISO.
Today we're talking cybersecurity trends of 2024, but I'm actually going to start about
a year ago.
We had this same group on, same conversation for 2023.
So I'm going to throw this first question to Todd and maybe we'll just kind of do a
little round robin.
Was there anything from 2023 that surprised you or maybe something that you thought was
going to come up, but didn't?
I would say probably not.
We were chatting amongst ourselves a little bit earlier today and I know it seems like
you get to put on your prognite, never mind, I won't even try and say it.
Had the ability to look into the future and go, this is what's coming.
But really what we tend to see is more often than not, we see so much stuff and I've said
that on a million podcasts, but because we see so much, we tend to see that starting
to kind of ramp up at the end of a year.
So when we get to this point looking into the future going, this is what we think is
going to happen.
We usually have a fairly good idea of what's coming.
So there wasn't anything in particular that really took me by surprise.
Some of the things that I think I would call more disappointed that they haven't had more
legs and I think this will probably be one of the trends we're hoping for in 2024 is
there's been this longstanding conversation that E-Rate is going to have more coverage
of cybersecurity funding and it really hasn't come to fruition.
And I want to say I don't know why, but it's government-ridden and therefore it's got to
take forever.
They can get on things occasionally, but man, it just usually just tends to be so slow.
And for me, it's a little frustrating because schools in particular really need that kind
of help and they just really can't afford it unless they go out and get special funding
from the public, which is really unfortunate.
Yeah, we're taking a look at the list of things that came through there and I was like, yep,
all of these came to fruition.
I think one of the things that maybe surprised me a little bit is how much of a push there
was to get some of the cybersecurity talent continuing to be fulfilled.
So if you're not familiar with some of the major vendors, there's one called ISC squared.
They are the ones that provide the CISP certification, which is kind of one of the de facto, just
new standards for most security professionals.
And they introduced a initiative to certify one million individuals on that.
So that was really exciting to see last year.
I first saw a little more of a natural attempt to grow that, but they said, come on, get
the certs.
You don't get the full certificate until you get the experience, but they kind of opened
the doors to say, just start taking tests, which is really cool to see.
And then the government did a ton of initiatives as well to continue increasing the cybersecurity
talent.
So yeah, a lot of really cool things on the training front.
What about you, Matthew?
Anything thinking back at 2023 that surprised you because it did or didn't come up?
Well, right at the end of last year, we finally got the new CMMC guidelines out, which was
fun to have that as a nice little Christmas gift for those of us who appreciate it.
There was a lot of...
What a weird gift.
Yeah, that's fine.
That's valid.
Very valid.
At Christmas, just being like, ooh, let me read this policy document.
I always wanted this.
Yeah, I should have wrapped it under the tree and just waited till Christmas day.
So a lot of regulation, a lot of compliance requirements came through like we expected
them to.
Some of them really kicked in.
I think we saw a bigger change, like Nate was saying, not just in terms of the training
that was available, but in people, I want to say coming to the awareness of how critical
it was to be prepared for some of this stuff.
I think we were pretty spot on with the industries that we talked about as being under attack
from our experience.
I know we'll have a bit more on that when the IEEC releases their next round of reports
for what happened in the past year, we'll probably get some deeper insight into that.
But just all around, I feel like everyone's increasing their awareness and trying to find
new ways to do things and better ways to do things than what they were doing before.
Very excited about the past keys becoming more common across systems, as well as one
thing that we saw was insurance companies requiring more and more things that we used
to think of as add-ons or organizations thought of as add-ons that we would always try and
require as being required just to even renew your cybersecurity insurance, which is great.
I love seeing that there's that push from elsewhere rather than just us being like,
hey, here's all the cool things.
Here's the things that will help.
And then I feel like the insurance companies getting on board helps with that as well.
Sure, so I was talking in 2024.
So when we talk about cybersecurity, sometimes it can be really scary, but it can also be
really exciting.
So maybe Matthew will stick with you.
What is the good, bad, and the ugly coming for 2024 trends?
Wow.
Which one to pick first?
Well, I'll go with one of the things that I'm thinking about the most at the moment,
which is how attacks are coming in.
Generally, we've always talked about the types of attacks that are occurring, phishing attacks,
attacks for people, and we've got very specific terms for the type of phishing attack that's
coming in.
Wailing means that they're going for director levels.
There's comments like that where we break down deeper what these are.
And I think we're going to see a lot more of those.
There's been a lot of reports recently of people using AI to craft these emails.
And suddenly, you don't need to really know as much about maybe the person you were looking
into because there's a chance AI has already got some of their information.
So you can just say, hey, write this type of email for this type of person.
And on some of the less regulated AI systems may actually do that for you.
So, obviously, being more aware is going to come from that.
I think additional training is going to come from that.
On top of that, there seems to be a real twist to put Internet of Things in literally everything
they can get their hands on.
So more network security requirements and just being aware of how much of the stuff
that you have in your office or at home is connecting to the Internet directly and maybe
getting information it doesn't need or shouldn't use.
I know you want to jump in, Nate.
You got your list.
We were just joking yesterday about there's smart wrenches that are being discovered with
vulnerabilities.
There you go.
You could have jumped in.
I was being patient here.
But as Matthew was saying, is that everything is becoming so interconnected.
And IoT is one of those things that we always knew.
You have the smart speaker.
You have whatever it is, smart TVs.
But now getting down to the wrenches that you're using can be exploited to overtorque
or undertorque, miscellaneous stuff like that.
There's a lot of business value that could be used for tools like that.
I won't get into the big internal discussion that we had about that, but they are heavily
continuing to move down that smart path, which means there's software, which means there's
potentially vulnerabilities.
Yeah, just kind of expanding on that briefly.
One of the larger threats on there is, Nate highlighted it extremely well, but one of
the other ones that's on there is if you don't do network segmentation, that could be a launching
point into a network, which is very concerning.
So, just kind of wanted to highlight that.
I think the IoT of the world is getting extremely proliferating.
People aren't even paying attention to it.
They're just like, it needs to be connected.
Let's go.
Giddy up.
There is business reasons for it, which is fantastic, but it still needs to be secured.
So, jumping back to the comment that got us here is the good, bad, and the ugly.
And I think Matthew started it out with a bang.
I was going to go on AI, right?
I mean, it was the big topic of 23 in general, but if you look at it, it does all three of
those things in a nutshell.
It's fantastic of what it's going to mean for defenders.
It's terrifying for what it's going to be for 10 defenders at the same point.
So, there's a lot there that's fantastic.
Matthew kind of got into the comment as well about generative AI that's regulated versus
what's not.
You may have already noticed this if you're in the SMB market, which is small, medium-sized
business, but Microsoft's co-pilot has been released to Enterprise, and they keep saying
it's coming for the SMB market, but it hasn't been released.
So, just to kind of say what it's coming is, you can get it.
You just need to buy 300 licenses, which is pretty much outside the realm for most people
at $9,000 per month.
So, the biggest hang-up on it has been the compliance, right?
The Enterprise is getting their hands on it, they're going, this thing has got its hooks
in damn near everything, and that is very concerning.
And so, the fact that you're not seeing it heavily rolled out, we're at the beginning
of 24, I probably should put a minor time stamp on it.
So, the reason why you haven't seen it generally released is because of this, is there's all
this compliance and concern behind it of, what exactly am I doing?
How do I keep my data safe?
Is this more than I want to?
Do I have the ability to stop portions of it, so on and so forth?
Really, the big thing that I'd see coming up in 24 is AI, and we will see a significant
impact on how that has a role to play in the phishing simulations, as Matthew already said.
And really, what that means on the defensive side is there will be a lot of stuff that's
going to have to come in place of what are the mitigating controls that we put in place
to make sure that we are protecting ourselves, our customers, and so forth.
Yeah, and this is one of the things that I just wanted to touch on as well a little
bit is with the introduction of some of this generative AI.
So for example, Microsoft Co-Pilot, right?
Most organizations are using Office 365.
The way that Microsoft is going to handle those permissions is the content that that
user has access to, it's going to be able to interact or retrieve that data to generate
new stuff.
So, for ASISO or other security executives at these organizations, let's say about two
or three years ago, you were focused heavily on infrastructure and hardening that.
Then you moved into more of that identity and access management as your core focus,
as everything started moving to the cloud and the application sprawl started to continue.
And now what we're going to see is security executives focusing heavily on data classification
and data segmentation and access control of the internal data.
Because these tools, let's say you have board reports and your share point is too open,
are you wanting to allow your intern to use AI, have it automatically query your meeting
minutes and generate a report of everything that the business is doing, right?
Is that data classification is going to become exponentially more important as AI is introduced
into the businesses?
So, I think across the board with that, we've seen a lot of changes.
At the start of last year, there was executive orders that came through these requirements
for greater awareness, like I mentioned, but also more thorough ownership from organizations
of what's occurred.
One of the things that took me by surprise, but in a good way, was the reaction most recently
to the SolarWinds hack and what's happening with their team.
There seems to be a lot of real consequences if people are being intentionally negligent
or potentially not acting in the best interest of the organization.
There are some consequences coming from that.
And it's great to see that it's been kind of a shift from that.
We see it in the compliance side within CMMC, where right now within NIST 800, the person
who needs to attest to everything that was done can not be anyone in the organization,
but it doesn't have to be leadership.
CMMC, it has to be someone from the leadership team.
And that change alone requires that that sign-off is happening with the awareness of the leadership
team or the board of directors or whoever it is.
So seeing that that ownership and responsibility really be put where I think it should be put,
it has been nice to see across the board.
Yeah, as a senior security leader, the way Matthew just covered mildly terrifies me.
I was in the same thing.
My name is now going to have to be written on there somewhere.
Yeah, unfortunately, for what it's worth, I think the individual thought he was being
probably clever on how he phrased things, but it was not done in the best light for
everybody, right?
He may have been trying to protect the company, but he wasn't doing what was really, really
right, if you will.
But that being aside, it is interesting.
One of the big takeaways that I kind of feel like is coming down the pipe here, and it
has a lot to do with what we were just talking about, whether it gets into segmentation with
your IoT devices and so forth, is I think this is going to be a big trend, and it has
to start somewhere.
It has to start sometime.
What better place than never mind.
Maybe some people will get that one.
Anyways, we're almost to the point where, to me, I'm looking at, and I say that I'm thinking
the world has to change, and I'll attribute this very similar to the transition to endpoint
detection and response.
Nationwide globally, I think the adoption of EDR is still quite low.
For us and our customers, it's extremely high because we believe so strongly in it, but
the next trend for me is it's very complicated.
It's zero trust.
We're at a point now where enough stuff has moved to the cloud for various reasons, and
a lot of them are very strong business reasons, right?
I get to reduce the amount of equipment I have on place, I can apply updates on the fly.
Cloud is fantastic.
However, as you continue to go down that path, you have to find new interesting ways to start
to protect that and your individuals.
In addition to that cloud migration, we still have the remote world, and again, how do I
protect everything?
It's to the point, in my opinion, that the potential re-wrenching of the architecture
infrastructure of IT needs to be reconsidered, and that is going to be, if you're doing it,
zero trust is the way forward.
I think you're really going to start to see that get real legs this year.
I know in a lot of instances, some of that is starting to happen.
I read an article a couple of weeks ago that said 80 plus percent of organizations have
started the zero trust journey, and I was like, there's no way that number is correct.
When I looked in it, basically, the big thing in it was people have been implementing MFA,
which is fantastic.
It's a great first start.
But it's not really, we're adopting zero trust.
It's more like I have to protect myself, and I've got this tool in place.
It is part of the journey.
It's just not a massive chunk of the process.
I thought you were going to say that they had had a demo with a zero trust company, which,
I mean, that's beginning the journey, right?
That is the beginning.
That's fair.
I know what you're talking about, and no surprise, they sell zero trust solutions.
Just from the infrastructure side of things, just to continue on to what Todd was talking
about.
So CIT, we have an internal incident response team that helps customers with critical security
incidents.
With the implementation of things like EDR, application, whitelisting, privilege access,
management, we have seen a massive, massive decrease of security incidents.
However, we still get called quite frequently from other companies saying, we need assistance,
we've got ransomware or whatever it is, right?
And in the past, it used to be someone clicking on an email, it originates from there, and
then it kind of moves across the rest of the network.
One of the biggest things that we saw in 2023, because so many companies are implementing
those security tools, is coming in through the VPN, because unfortunately, it's either
companies that don't have a multi-factor on the VPN, or the user is still susceptible
to that, but then there's no protections across the network for monitoring and segmenting
that traffic if it is malicious.
And so we've seen VPN after VPN, after VPN initiated compromises on the network.
And so one of the big things for CIT is, and this is getting more than zero trust mentality,
is get rid of the VPNs.
It's one of those things that have been around for 25 years, so you would think, what is
the alternative to that?
There's ways that you can still allow that remote access, but close up the hole on the
firewall.
So it cannot be scanned.
And so this is kind of the introduction of something called SASE.
But it's one of the things that CIT does place a lot of importance on, is getting rid of
those VPNs, because it's just a hole in the network that just is open for just brute force
activity or someone to prod around and try and find their way in.
I think we...
Well, what it's worth, I'm sorry, Matthew, I was real briefly.
I think it's kind of ironic that a couple years ago, we're like, get VPN and get VPN,
get VPN, and now we're saying get rid of it.
But it was, right?
The world changes, unfortunately, especially in the world of cybersecurity is at least
your data was encrypted.
At least you had a secure connection.
At least you had, well, unfortunately, at least really isn't all that much anymore.
Not surprising, there's also something out there called zero trust network access, which
is ZTNA.
I'm sure you'll start seeing that in 24 significantly as well.
But if you're using VPN, you already know that it stinks, right?
Your employees struggle with it constantly.
We do a lot of work with our customers, and it's one of the things that we find that they
need the most amount of support on is the VPNs.
And I thought, let's go ahead, Matthew.
I was going to say, I believe we've done a podcast on zero trust, right?
Yeah.
We've gone through a lot.
We've talked about it a lot, and I just wanted to make sure.
Because there is a lot of things that it does that basically it covers a lot of these bases.
It does work.
It does cover by working similarly to a VPN at a workstation level.
It does bypass, therefore, any of the security flaws that come from VPNs from being on the
same network.
I was having conversation with a customer just the other day about the fact that I have a
segmented network at home for all of my Internet of Things stuff.
And I know that may seem like a little bit of overkill for a lot of people, but I just
don't need any of that stuff running on the same network as the one I use for everything
else I do.
I mean, the streaming stuff I do doesn't need to be on the same subnet as my cameras do.
That doesn't make any sense to me.
So this segmentation, ZeroTrust covers a lot of these things that we talk about as
changes that are upcoming.
We're covering a lot of those specific ones by talking about ZeroTrust because it is
designed to include things like the software access secure edge and things like that, which
make it helpful for us to just use this single term to define it all.
We aren't saying it's a catchall in the same way that when we said VPNs a couple of years
ago and they were a fantastic solution at the time, that's changed.
And ZeroTrust right now is the solution that is a pivot because if we're pivoting, the
bad guys have to pivot too.
And that's part of it.
If we're always moving, they also have to be always moving.
I don't have to be, but they sure want to.
They should be.
I mean, yeah.
I mean, look, as part of my certifications that I've got, they gave me a copy of Windows
Server 2003 and said, use this for all your testing because everything that you've been
taught can be done on this server.
And I just remember thinking back when this happened, I was like, I know people who still
use this server in their day-to-day business, and it is the one that I'm being taught how
to do everything on because it all works.
The quicker you pivot, upgrade, change, move to new things, get stuff that is different.
The people who've been doing the same thing the whole time can't anymore.
They have to find new ways to get around it as well.
And that's just, as a change, a thing that I'm hoping comes through here is that, is
people realizing that it's not about trying to force them off a thing they love or trying
to make them move to a thing that maybe someone else likes more.
There is specific benefits to making a change that are far beyond just its new and cool.
Its new and cool is a benefit.
Just to continue on about threat actors having to change tactics as the industry changes,
we have actually seen this quite a bit.
Again, I'm just going to focus on ransomware.
There's plenty of other threat types out there or attack types out there.
But in the past, you used to just encrypt the data and say, give me money to be able
to decrypt that data.
Then it changed to once everyone had solid backups, well, then they would pull the data,
then encrypt it and extort you for the data itself.
Then we saw a transition to, I'm going to pull the data, encrypt it, and then I'm going
to go bug your customer saying, I know that this company is compromised.
Go tell them to take care of this.
Otherwise, we're going to release your data.
And so there's additional extortion that's happening there.
Just last year, we saw a threat group actually file a SEC complaint against the company after
they compromised on this and they said, hey, by the way, they didn't do the reporting requirements.
And so that's how that all came out.
Now what we're actually seeing, there's just an article I saw, I believe last week, about
a threat actor that compromised a hospital and then they actually were swatting their
patients.
And so if you're not familiar with swatting, you essentially call the police, say, there's
bomb threat, gun threat, whatever it is, and they send the police and the SWAT team to
your house with guns.
And so as companies are further increasing the security controls that they have and better
protecting the environments, threat actors are also getting a little bit desperate and
purely just malicious of these high pressure tactics to still receive that money.
So the more you can do to prevent those, obviously, is the better.
But I thought that was really interesting that now they're resorting over to swatting
as well.
There is a lot of high pressure tactics that are being used.
And we've seen this not just at a business level, but at a personal level, the horror
stories about the things they're doing to try and get what seems like minimal sums from
some people.
When it comes to the business side, we've always known that that fear is a tactic, creating
a sense of urgency is a tactic.
But the way they're doing it now in a lot of these cases is beyond the pale for the
types of things that you would expect.
Swatting anyone is a crazy thing to do.
Putting in the SEC complaint, on the other hand, that seems like they're using capitalism
in a very interesting way.
So we've seen this in other ways, though, right?
To support portals for a lot of ransomware look incredibly professional.
You'd think they came from a Fortune 500 company.
There are things that you can't be prepared for that make them look more and more like
official businesses because they work very similarly to them.
Looking for these high pressure tactics and remembering that someone's saying, hey, I
need you to do this now is oftentimes a tactic, not just for ransomware, but in general.
It's something to be aware of.
I think it's helped me personally remain a lot calmer to have to fight that in response
to a lot of things that come my way of, I'm sure this can wait.
Maybe the 15 minutes it takes for me to take a step back is very helpful in dealing with
that type of tactic.
And I think we'll see more of that in the training that's coming out.
We'll be more of a take a breath if is this really that critical style language?
We're also seeing a lot of...
We talked about it briefly with the IoT stuff, but it's being smart devices now everything,
right?
We're seeing everything be added that way.
It doesn't ransomware and malicious code is not just added on the fly.
Sometimes if anyone's read up on the Stuxnet attack, it can happen slowly over time.
Things with this type of tech in them are vulnerable, not just in every moment they're
connected to the internet, but sometimes there's things that are hibernating.
They have timeframes on them.
They have weight X amount of time before you run this code so that you're not connected
to the network.
I think there's going to be a bigger push not just for data classification, but for within
reason airgapping data, keeping some data disconnected from your regular data in a way
that it wasn't before.
Just because the amount of times if someone gets into one section, even if your data is
tagged, the potential that they'll grab really important data with the less important data
because you haven't segmented them fully is much higher.
One thing I know this is naturally going to do is you're going to go, wow, you're steering
the crap out of me.
What do we do about that?
That'll have to be a follow up meeting on some of the other stuff.
It's fine.
But it's naturally where my mind goes, right?
We start getting into swatting and it's boys out of an escalation.
I will say currently it's not something where I say 80% of all attacks have escalated to
swatting at least currently and I'll knock on wood wherever that may be.
But it is something that is out there and it is worthy of being aware of.
But just in general, I mean a lot of the other things, Matthew, I wanted to circle back about
this before we ran out of time too because I do think that this will be a big topic for
this year.
As Matthew mentioned, CMMC is Christmas present at the beginning.
It is, I think it's finally getting ready to go live so they've had a couple of false
starts on it and we see little jumps up where people are like, okay, I have to be compliant.
I need to do that immediately.
Most organizations tend to wait till the last minute and it seems like they've been somewhat
justified but my point here is it's actually coming.
So in 25, it will be in place.
It will be out there and so you will see a lot of organizations.
In case anybody doesn't know what CMMC is, I don't know what the acronym stands for
anymore but it is heavily impacting a lot of manufacturers and anybody that's working
with the Department of Defense and so forth but it will be in place and it is coming and
there have been revisions so we'll have to follow up later this year with what you can
expect in the latest version with another podcast around it.
So if you are under that particular type of regulations, you'll need to be aware of it
and you will need to be compliant and I would guess my rough estimate is going to be at
the beginning of 25 so they'll probably put a drop dead date somewhere at the end of 24.
Cyber security maturity model certification.
Thank you.
It's not, honestly, I do wonder if it's worth memorizing.
I do think CMMC is much better.
I wouldn't bother trying to memorize it anywhere.
I don't want to go into it too deeply.
I will say if you haven't read it, if you are interested in these changes, bring it in
my opinion more in line with where it was originally which is a very good thing in my
opinion and maybe there'll be a podcast of me on my soapbox.
Yeah, quick little tangent but I just wanted to introduce one last prediction.
This is my own personal prediction.
I didn't see it listed on many articles when I was looking for what others have predicted
for 24.
Although we all have to get to work somehow and I know this is called the tech for business
podcast but this is a little more of a personal thing but again we have to get to work in
some way was auto manufacturers are making a massive push right now to introduce electric
cars to everyone and so I foresee a lot of reports coming about vulnerabilities in these
systems.
We've seen it in the past when Tesla first got introduced but unfortunately there's a
mad rush to market right now for all these automotive manufacturers and so my concern
would be that they're prioritizing that push a little more than some of the security and
so just drive safe to work right and just again the nice thing is that there's a lot
of these cars are becoming being deployed with interconnected systems so they can receive
software updates but again if you have an electric car just make sure you're doing your
updates to help mitigate a lot of those vulnerabilities that will likely be discovered.
Hit the tangent alert button has anybody watched or read leave the world behind?
I watched it this last weekend and my cybersecurity mind is just racing through the whole thing
like how would I protect myself but in the movie there is a portion where the Teslas
get attacked and they are being launched self driven so it's not a great movie but I still
liked it so.
I love it.
Tech for business.
Yes.
I'm going to real quick just to kind of wrap it up I'm going to bring it back to businesses
because that's what we're focusing on and you know it's quarter one everyone's in these
meetings they're figuring out what this year with three years with five years looks like
if you had one thing maybe we mentioned it maybe we didn't that you think is missing
from that meeting from that agenda that people that businesses are not thinking about that's
a blind spot for them.
What would that be?
I first want to ask are we sure this isn't the tech for business movie review podcast
because it could be.
I like it we can do an icebreaker next time.
I'll say in my opinion one of the biggest things that's happening is I know a lot of
people are having the conversation and I'm pulled into a lot of conversations where people
are saying we want to do the next thing we want to do we want to make sure we're thinking
about this at the right level and that's a great conversation to have but it's important
to have someone guiding that who can actually guide it and knows where it's coming from
in my opinion the best way to start with that is with a picking a framework and just basing
it on something because they're designed to help you as an organization create a create
a system that works within that framework they give you guidance on everything.
A CISO is definitely a good step making sure you have someone who is taking ownership and
then really the authority on that for the organization if you want to take that next
step be aware that it does have an output to it there is something that you'll need
to get that guidance and I know there are a lot of organizations doing this already
but I've just been a part of three to five conversations in the past two weeks already
of people just saying what do I do next and the answer is you you find something to follow
whether that's a person whether that's a framework you find someone who you trust in this topic
to help guide you in what they know and what they see on a regular basis.
Yeah I know you said one thing but I'm going to do two one is just kind of telling enough
of what Matthew just said there and I can't help myself I'm sorry this is who I am.
This is getting extremely complicated when it comes to cybersecurity insurance where
we've actually worked with some organizations where it's been treated almost like a full
IT audit and the reason why I bring it up is most organizations are not prepared to handle
that type of conversation so if it's not on your agenda you're going to have to find somebody
in my opinion that that can help navigate that and it's very similar to what Matthew
was saying is find a partner that you can work with that'll help you get through those
most companies that we work it's a fairly significant piece they come to us and say can
you help us through this so we're already seeing a massive uptick in it but the one
thing that I wanted to highlight as I mentioned it as Zero Trust is it's time in my opinion
it's time to start to build a plan it seems unwieldy it seems like a massive lift and
it's a lot but it's time to go what am I going to do if I do nothing there is going to be
significant and risk that's going to be increasing for organizations that don't have it on their
plan to move forward you will be replacing portions of your infrastructure it's time
to start planning on if I do that what do I replace it with zero trust is going to be
the answer and again you're going to have to find a partner to help you through that
find was actually very similar to Todd's was I believe it's on the podcast that I was on
with Kyle where we talked about a lot of the zero trust coming off of our tech for business
or tech fair conversations however one of the big things that I think I mentioned on
that one if I remember correctly was small businesses often are operating on a budget
for just an annual basis right how do we get through this next year but kind of what Todd
was saying and kind of coming into with Matthew as well about the VC so is you need a long
term strategy to actually implement those those are often three to five year initiatives
and so if you're only ever budgeting for an annual cycle you're never going to catch up
or put in the proper building blocks to get where you need to go you have to have that
longer term strategy and so my advice for business owners is going to say look a little
bit further out and you know whether or not it's just listening to something like this
of saying how do we get there do we need to work with a partner or not but at a minimum
look at a three year budget cycle for your security initiatives that's what's going to
drive you forward you're just going to get caught in a cyclical pattern if you're only
focusing on annual yeah and those costs should increase because you want to get more secure
over time don't just think this is the amount I'm spending on security and that's it remember
that a the cost change but be the tools change we find things that are more secure and we
find things that are better to keep the organization safe you don't want to have to get to that
point three years from now when this tool that does a lot of this comes out and you
haven't budgeted or prepared for what a shift would be like this is a moving it's a moving
target because it's a moving and changing industry and that's like I said speak to someone
who can help with this because that's almost impossible to plan for if you aren't living
in it every day it's hard to see what these are like or why things become more important
than other things over time.
Somebody who wants policies as a Christmas present yes.
Those are the right people to talk to yes.
Oh my gosh thank you Todd, Nate and Matthew for joining us today if you enjoyed this podcast
please like and subscribe if you have a question a topic a trend you want us to discuss reach
out to us at info at cit-net.com or head out to our website cit-net.com slash adcast and
we'll be back next week with an all new episode.