1 00:00:00,445 --> 00:00:02,465 - Hey everyone, this is Erica Khal 2 00:00:02,465 --> 00:00:04,065 with Becker's Hospital Review, 3 00:00:04,485 --> 00:00:05,705 and thank you all so much 4 00:00:05,725 --> 00:00:08,545 to our listeners tuning into another episode 5 00:00:08,565 --> 00:00:10,865 of the Becker's Healthcare podcast series. 6 00:00:11,445 --> 00:00:15,185 In today's conversation, we're joined by Gary Salman, CEO 7 00:00:15,185 --> 00:00:16,385 of Black Talent Security, 8 00:00:16,845 --> 00:00:20,705 and Dan Presta Guard, CTO of Specialty Dental Brands. 9 00:00:21,445 --> 00:00:23,345 Dan and Gary, thank you both so much 10 00:00:23,405 --> 00:00:24,985 for taking the time to be here today. 11 00:00:25,695 --> 00:00:27,675 - Thanks for having, you're very welcome. Thanks. 12 00:00:28,785 --> 00:00:32,245 - So super hot topic right now, obviously with, with all 13 00:00:32,245 --> 00:00:34,285 of the events we're seeing around cybersecurity. 14 00:00:34,505 --> 00:00:39,365 So how should DSOs really be thinking about cybersecurity, 15 00:00:39,485 --> 00:00:40,925 particularly with the rise 16 00:00:40,985 --> 00:00:42,885 of all the attacks we've seen within the 17 00:00:43,165 --> 00:00:44,525 industry over the past year? 18 00:00:45,725 --> 00:00:47,775 - Yeah, I think the best way to look at it is 19 00:00:47,775 --> 00:00:49,015 through the lens of risk. 20 00:00:49,675 --> 00:00:51,935 Um, and I typically break it down into three 21 00:00:51,935 --> 00:00:53,175 primary categories. 22 00:00:53,275 --> 00:00:56,415 You have compliance, legal, and operational. 23 00:00:57,275 --> 00:00:58,895 And we know in the healthcare space, 24 00:00:59,345 --> 00:01:02,175 there is a tremendous amount of, uh, 25 00:01:02,205 --> 00:01:05,255 protected health information both on these networks 26 00:01:05,515 --> 00:01:06,695 as well as in the cloud. 27 00:01:07,475 --> 00:01:10,775 So in almost all ransomware cases that we deal with, 28 00:01:10,835 --> 00:01:15,575 and what the industry sees is a theft of patient data. 29 00:01:16,395 --> 00:01:19,735 So one of the modus operandi that the threat actors, 30 00:01:20,155 --> 00:01:24,935 you know, AKA the hackers do is they not only encrypt the 31 00:01:24,935 --> 00:01:27,495 network with ransomware, which causes a whole bunch 32 00:01:27,495 --> 00:01:29,295 of operational issues, which we'll talk about, 33 00:01:29,635 --> 00:01:34,335 but they have a goal of trying to steal as much data 34 00:01:34,435 --> 00:01:36,815 as possible, and that includes patient data. 35 00:01:37,315 --> 00:01:38,775 And when they steal the patient data, 36 00:01:39,005 --> 00:01:43,015 that then triggers compliance issues around hipaa. 37 00:01:43,395 --> 00:01:47,335 So the threat actors know that when they walk away with some 38 00:01:47,335 --> 00:01:48,535 or all of your patient data, 39 00:01:48,725 --> 00:01:51,735 there's an extremely high likelihood that you're going 40 00:01:51,735 --> 00:01:54,055 to in fact pay the ransom demand 41 00:01:54,285 --> 00:01:56,775 because you do not want that patient data, 42 00:01:57,035 --> 00:01:58,575 uh, released to the public. 43 00:01:59,075 --> 00:02:00,415 Um, and they also understand 44 00:02:00,415 --> 00:02:02,495 that you're gonna have some compliance issues to deal with. 45 00:02:02,555 --> 00:02:06,375 So you can have state regulatory issues, uh, related 46 00:02:06,435 --> 00:02:09,055 to laws within the states that these patients reside, 47 00:02:09,075 --> 00:02:11,695 or the practice or organization operates. 48 00:02:12,235 --> 00:02:14,215 And then obviously you have hipaa, uh, 49 00:02:14,235 --> 00:02:15,695 issues at the federal level. 50 00:02:16,435 --> 00:02:20,015 Um, from the legal perspective, there's always the risk 51 00:02:20,195 --> 00:02:24,375 of future class action lawsuits, uh, levied by the patients 52 00:02:24,375 --> 00:02:26,015 that were impacted by the breach. 53 00:02:26,235 --> 00:02:27,455 So that's something to consider, 54 00:02:27,515 --> 00:02:30,655 and a lot of DSOs don't realize that that is now a thing. 55 00:02:31,395 --> 00:02:34,255 And then one of the biggest impacts is really operational. 56 00:02:34,915 --> 00:02:39,495 Um, regardless of backups, cloud technology, 57 00:02:40,275 --> 00:02:43,495 you know, and some other things that DSOs have in place, 58 00:02:43,805 --> 00:02:47,695 what we typically see, you know, regardless of size 59 00:02:47,695 --> 00:02:51,295 of the DSO, uh, A DSO typically 60 00:02:51,805 --> 00:02:56,175 experiences a two to five week outage of their operations, 61 00:02:56,995 --> 00:03:00,405 mostly due to the fact that, uh, majority 62 00:03:00,405 --> 00:03:03,845 of ransomware strains actually damage the operating 63 00:03:03,845 --> 00:03:05,005 systems of the computers. 64 00:03:05,545 --> 00:03:08,565 Um, and the practice can't use the computers 65 00:03:08,565 --> 00:03:11,165 to either run their practice management software locally on 66 00:03:11,165 --> 00:03:13,805 their own server or connect to cloud technology. 67 00:03:14,345 --> 00:03:17,925 Um, and it causes a huge burden on the organization. 68 00:03:18,545 --> 00:03:20,805 And if you do, just some of, you know, some back 69 00:03:20,805 --> 00:03:23,965 of the napkin math and do a quick calculation 70 00:03:24,265 --> 00:03:25,805 and understand, you know, 71 00:03:25,805 --> 00:03:27,365 what you're producing on a daily basis 72 00:03:27,505 --> 00:03:32,205 and multi multiply that by 10 to 50 days, your operational 73 00:03:32,265 --> 00:03:34,845 and financial impact is going to be significant. 74 00:03:35,425 --> 00:03:38,405 Um, I've never really seen a situation where, uh, 75 00:03:38,605 --> 00:03:41,765 a practice has, has been down for less than a couple days. 76 00:03:41,765 --> 00:03:44,125 There have been some, you know, rare cases where 77 00:03:44,645 --> 00:03:46,005 a small practice can go out 78 00:03:46,005 --> 00:03:47,765 and grab some laptops, bring 'em in 79 00:03:47,765 --> 00:03:49,005 and connect to cloud technology 80 00:03:49,005 --> 00:03:50,125 if the cloud hasn't been impacted. 81 00:03:50,585 --> 00:03:52,925 But our experiences, most DSOs are down 82 00:03:52,925 --> 00:03:54,245 for an extended period of time. 83 00:03:54,625 --> 00:03:57,845 So, I mean, those are three primary categories that, 84 00:03:58,265 --> 00:04:01,525 you know, DSOs have to, you know, think about related to, 85 00:04:01,865 --> 00:04:05,885 uh, cybersecurity and the impact of a ransomware attack 86 00:04:05,985 --> 00:04:07,645 or, um, data theft. 87 00:04:08,645 --> 00:04:10,695 - Yeah, I, I agree, uh, completely with 88 00:04:10,695 --> 00:04:12,175 what Gary said there. 89 00:04:12,955 --> 00:04:14,655 Uh, thinking about cybersecurity in terms 90 00:04:14,655 --> 00:04:15,895 of risk is the right way to go. 91 00:04:16,355 --> 00:04:19,415 And in this case, if you think of it in those terms, 92 00:04:20,125 --> 00:04:21,175 what goes wrong? 93 00:04:21,245 --> 00:04:22,535 What happens if it goes wrong? 94 00:04:22,675 --> 00:04:25,855 And then for security, for compliance, for all 95 00:04:25,855 --> 00:04:28,575 of these things that can be existential, right? 96 00:04:28,575 --> 00:04:29,975 This is existential risk. 97 00:04:30,315 --> 00:04:33,815 We might not be around long if this happens to you. 98 00:04:34,315 --> 00:04:36,855 Um, and so it really does need to be taken seriously. 99 00:04:38,445 --> 00:04:39,705 - Oh, yeah. Thank you both 100 00:04:39,725 --> 00:04:42,185 for touching on those three key areas. 101 00:04:42,365 --> 00:04:44,505 So it really sounds like you can create 102 00:04:44,785 --> 00:04:45,985 challenges across the board. 103 00:04:45,985 --> 00:04:50,725 And Dan, as you mentioned, depending on, you know, what sort 104 00:04:50,725 --> 00:04:54,205 of attack happens can really be an existential challenge 105 00:04:54,265 --> 00:04:55,845 or turn into an existential problem. 106 00:04:56,265 --> 00:04:57,925 And Gary, I'm, I'm glad you mentioned the, 107 00:04:58,185 --> 00:05:00,165 the class actions lawsuit component. 108 00:05:00,325 --> 00:05:02,245 I think it's something that we sometimes, 109 00:05:02,295 --> 00:05:04,725 especially in the dental space, might not hear 110 00:05:04,945 --> 00:05:09,045 as much about in terms of thinking about the risks next. 111 00:05:09,225 --> 00:05:10,805 Can you also speak to the value 112 00:05:11,025 --> 00:05:12,885 of having a third party assessment 113 00:05:13,185 --> 00:05:16,565 and continuous monitoring within your digital environment? 114 00:05:17,725 --> 00:05:20,775 - This is Dan. I mean, I, I think that it's 115 00:05:21,335 --> 00:05:22,655 a requirement these days. 116 00:05:22,955 --> 00:05:25,135 You need to have it be constantly monitored, 117 00:05:25,135 --> 00:05:26,175 constantly updated. 118 00:05:26,835 --> 00:05:28,455 The, I can tell you that the hackers 119 00:05:28,515 --> 00:05:31,495 and the people that are trying to get into your data 120 00:05:31,515 --> 00:05:34,695 and get into your information, uh, are not taking time off. 121 00:05:34,835 --> 00:05:37,135 And so they're constantly trying to scan. 122 00:05:37,255 --> 00:05:39,215 I mean, we see in the, in the reports all the time 123 00:05:39,845 --> 00:05:42,055 that the environment's constantly being scanned 124 00:05:42,055 --> 00:05:43,295 and people are looking for holes. 125 00:05:43,395 --> 00:05:46,455 And with AI being what it is today, 126 00:05:46,455 --> 00:05:47,455 it's only gonna get worse. 127 00:05:47,585 --> 00:05:51,175 Where you start to get these vectors, these approaches 128 00:05:51,805 --> 00:05:54,015 into the system are just gonna keep getting smarter. 129 00:05:54,275 --> 00:05:56,175 Um, and they're gonna keep getting more targeted. 130 00:05:56,525 --> 00:05:58,885 They're gonna know more about you and, 131 00:05:59,145 --> 00:06:00,805 and what you're doing and how you behave. 132 00:06:01,385 --> 00:06:03,165 Um, so this is only gonna get worse. 133 00:06:03,265 --> 00:06:06,765 And so it really is a, uh, constant discipline 134 00:06:06,765 --> 00:06:07,805 that needs to be in place. 135 00:06:08,765 --> 00:06:11,645 Constant scanning, constant, uh, third party assessment 136 00:06:11,945 --> 00:06:13,605 and making sure that you're up to date 137 00:06:13,605 --> 00:06:16,925 and all things with the, the basics first, 138 00:06:17,025 --> 00:06:18,685 but then the advanced things as well, 139 00:06:18,785 --> 00:06:20,405 and make sure that you're doing things also, 140 00:06:20,405 --> 00:06:23,725 like educating your, your population, um, 141 00:06:24,255 --> 00:06:27,085 doing things like ethical hacking and, and phishing. 142 00:06:28,545 --> 00:06:29,555 - Yeah, absolutely. 143 00:06:29,575 --> 00:06:30,955 So really having the mindset 144 00:06:31,095 --> 00:06:34,155 for dsso is a really viewing this, having the position 145 00:06:34,155 --> 00:06:37,035 that this is a constant, a constant risk. 146 00:06:37,945 --> 00:06:41,435 Getting in a little bit deeper, can you speak to how a cyber 147 00:06:42,355 --> 00:06:44,155 security partner can actually work 148 00:06:44,185 --> 00:06:46,075 with current IT resources? 149 00:06:47,695 --> 00:06:51,915 - So one of the things that we see in many DSOs and, 150 00:06:51,915 --> 00:06:54,035 and almost regardless of size, you know, 151 00:06:54,035 --> 00:06:55,875 whether you're you're five locations 152 00:06:55,975 --> 00:06:59,675 or 500 is the IT 153 00:07:00,985 --> 00:07:04,335 department typically is responsible 154 00:07:04,355 --> 00:07:06,175 for keeping the network up and running, right? 155 00:07:06,175 --> 00:07:08,295 Making sure the servers are functioning properly, 156 00:07:08,295 --> 00:07:09,695 make sure they have access to the internet 157 00:07:09,755 --> 00:07:11,975 so they can access their cloud technology and, 158 00:07:12,275 --> 00:07:13,855 and communications, et cetera. 159 00:07:14,555 --> 00:07:18,695 And typically what we don't see is much of a 160 00:07:19,325 --> 00:07:23,175 proactive cybersecurity approach, meaning they're, 161 00:07:23,175 --> 00:07:25,695 they're typically running around putting out fires, 162 00:07:26,065 --> 00:07:29,495 onboarding new acquisitions, upgrading hardware, 163 00:07:29,495 --> 00:07:31,535 keeping software up to up-to-date, et cetera. 164 00:07:31,875 --> 00:07:34,095 And, and, and Dan kind of mentioned this previously, 165 00:07:34,875 --> 00:07:38,335 but the hackers are constantly attacking the network and, 166 00:07:38,395 --> 00:07:40,495 and looking for these holes and vulnerabilities. 167 00:07:40,835 --> 00:07:45,415 And typically what we see in DSOs of all sizes, 168 00:07:45,415 --> 00:07:47,935 they don't have the tools, the technology, the resources 169 00:07:48,355 --> 00:07:50,975 to be able to do those types of tests, right? 170 00:07:51,005 --> 00:07:54,135 Most DSOs have defensive measures in place, right? 171 00:07:54,135 --> 00:07:56,535 You're talking, you know, antivirus software, 172 00:07:57,045 --> 00:07:58,735 some basic patching, et cetera. 173 00:07:59,035 --> 00:08:01,135 But there's no technology in place that 174 00:08:01,695 --> 00:08:04,055 actively monitors the network for security holes, right? 175 00:08:04,055 --> 00:08:06,615 Vulnerabilities and vulnerabilities are kind 176 00:08:06,615 --> 00:08:07,895 of those unlock doors 177 00:08:07,895 --> 00:08:10,815 and windows that a hacker's gonna scan for find and, 178 00:08:10,815 --> 00:08:11,855 and break into the network. 179 00:08:12,715 --> 00:08:16,335 Um, and because they lack these tools, there's not a lot 180 00:08:16,335 --> 00:08:18,855 of visibility or clarity into 181 00:08:18,855 --> 00:08:20,815 where they actually have security risks. 182 00:08:20,995 --> 00:08:25,735 So I think a good partnership with a DSOs internal 183 00:08:25,835 --> 00:08:29,535 or external IT resources revolves 184 00:08:29,535 --> 00:08:31,095 around using tools 185 00:08:31,235 --> 00:08:35,175 and human intellect to identify risk, right? 186 00:08:35,175 --> 00:08:36,895 Through vulnerabilities in firewalls, 187 00:08:36,895 --> 00:08:39,015 vulnerabilities in in endpoints, 188 00:08:39,015 --> 00:08:41,815 meaning computers like laptops, servers, workstations, 189 00:08:42,565 --> 00:08:45,575 providing, as Dan alluded to training, right? 190 00:08:45,575 --> 00:08:47,615 Cybersecurity awareness training is a really, 191 00:08:47,615 --> 00:08:48,695 really key component. 192 00:08:49,435 --> 00:08:52,015 And, you know, leveraging all of this technology 193 00:08:52,115 --> 00:08:56,325 to help the DSO paint a clear picture of security risk. 194 00:08:57,185 --> 00:08:58,285 And, you know, 195 00:08:58,285 --> 00:09:01,165 cyber companies don't replace IT resources, that's a big thing. 196 00:09:01,225 --> 00:09:06,085 We have to have solid internal and or external IT resources. 197 00:09:06,145 --> 00:09:08,125 So when a cyber company comes in 198 00:09:08,125 --> 00:09:10,325 and identifies where there's risk, that data can be 199 00:09:10,685 --> 00:09:13,325 provided back to the IT resources 200 00:09:13,425 --> 00:09:15,805 so they can in fact address, you know, 201 00:09:15,805 --> 00:09:17,525 what we call remediate the risk. 202 00:09:18,185 --> 00:09:22,325 So it's a healthy relationship between what I like to say, 203 00:09:22,325 --> 00:09:23,485 all three parties, you know, 204 00:09:23,485 --> 00:09:26,965 the cyber company like black talent, the DSO, 205 00:09:27,265 --> 00:09:30,925 and the IT resources, whether they're internal or external, 206 00:09:31,025 --> 00:09:33,405 and everyone's basically fighting the same battle. 207 00:09:33,435 --> 00:09:36,445 Like, how do we make sure that our network is secure 208 00:09:37,185 --> 00:09:40,685 and we're gonna minimize the chances of an intrusion? 209 00:09:41,305 --> 00:09:44,285 You know, and a lot of, uh, a lot of folks talk about the, 210 00:09:44,285 --> 00:09:45,925 uh, the trust but verify concept 211 00:09:46,105 --> 00:09:47,725 or who's watching the watcher concept. 212 00:09:47,905 --> 00:09:50,925 And I, I think this is really what, you know, 213 00:09:51,005 --> 00:09:52,765 a third party cyber assessment is about. 214 00:09:54,135 --> 00:09:57,305 - Yeah, I, I, I agree with, um, what Gary's saying there. 215 00:09:57,365 --> 00:10:00,265 And, um, I, I will say that, um, I think of, 216 00:10:00,365 --> 00:10:04,065 so Jules RA is the guy on Gary's team that, that, um, 217 00:10:04,245 --> 00:10:06,585 we work with every single day, I mean, every single day. 218 00:10:07,245 --> 00:10:09,105 And we bring in him 219 00:10:09,285 --> 00:10:11,545 and, uh, he works with our, with our guy assigned, 220 00:10:11,545 --> 00:10:14,225 his name is Matt Harris and John Huss also. 221 00:10:14,485 --> 00:10:17,185 Um, and they work again every single day. They get together. 222 00:10:17,725 --> 00:10:21,545 Um, the big thing to me about our, a cybersecurity partner, 223 00:10:21,615 --> 00:10:23,185 like black talent is for us 224 00:10:23,765 --> 00:10:26,465 and my staff, the big thing for me is making sure 225 00:10:26,465 --> 00:10:27,625 that we're all on the same page 226 00:10:27,625 --> 00:10:28,945 and there's open communication. 227 00:10:29,705 --> 00:10:33,265 I expect, you know, Jules and Matt to be tied at the hip 228 00:10:33,285 --> 00:10:37,425 and them to be, um, you know, Jules has a very active voice. 229 00:10:37,935 --> 00:10:40,145 blacktown's got a very active voice of 230 00:10:40,145 --> 00:10:41,185 what the priorities are. 231 00:10:41,645 --> 00:10:44,505 Um, and helping us to say, you know, I'm, 232 00:10:44,565 --> 00:10:48,705 I'm very big on having an organized approach for, um, 233 00:10:48,935 --> 00:10:52,345 what it is that our risks are, where the big ones are, and, 234 00:10:52,765 --> 00:10:55,905 and, uh, the ones that need to get addressed right away and, 235 00:10:56,005 --> 00:10:58,585 and sort of where the ones are that we can, you know, 236 00:10:58,605 --> 00:11:01,105 put mitigating, uh, factors in place or, 237 00:11:01,525 --> 00:11:03,465 or ensure against the different issues 238 00:11:03,605 --> 00:11:06,345 or, you know, avoid, um, the different risks 239 00:11:06,375 --> 00:11:07,585 that are out there, um, 240 00:11:07,725 --> 00:11:09,585 and have different, you know, different ways 241 00:11:09,605 --> 00:11:10,745 of addressing the risks. 242 00:11:11,445 --> 00:11:15,585 Um, but I think that the main answer for me of, you know, 243 00:11:15,585 --> 00:11:17,745 how does a cybersecurity partner work with current IT 244 00:11:18,305 --> 00:11:19,945 resources is every single day 245 00:11:20,285 --> 00:11:24,065 and in an organized way with, uh, intentional results. 246 00:11:24,685 --> 00:11:27,025 Um, looking for things to, you know, I, 247 00:11:27,165 --> 00:11:31,225 we follow the CIS framework, um, for, you know, 248 00:11:31,225 --> 00:11:32,385 scoring our environment 249 00:11:32,445 --> 00:11:35,385 and making sure that we're, we're set up in a way that's, 250 00:11:35,385 --> 00:11:36,705 uh, can be benchmarked. 251 00:11:37,005 --> 00:11:38,865 Um, but then that way you can also measure 252 00:11:38,865 --> 00:11:41,185 that we're making progress against the standard. 253 00:11:41,325 --> 00:11:44,345 And so that to me is the way to do it with, uh, 254 00:11:44,855 --> 00:11:46,585 with a cybersecurity partner and, 255 00:11:46,605 --> 00:11:48,225 and the current IT resources. 256 00:11:48,255 --> 00:11:50,185 It's just making sure that they're in lockstep 257 00:11:50,565 --> 00:11:52,505 and that there's a plan, and that they're, 258 00:11:53,195 --> 00:11:56,245 that you're planning the work working plan and executing 259 00:11:56,245 --> 00:11:57,845 and making things better every single day. 260 00:11:58,825 --> 00:12:00,835 - Yeah, I think you both really underscored 261 00:12:01,015 --> 00:12:02,635 how really just at a point 262 00:12:02,635 --> 00:12:07,355 where the approach can no longer just be, uh, reactive or, 263 00:12:07,495 --> 00:12:09,635 or responding to something once you see it, 264 00:12:09,635 --> 00:12:11,075 but really getting to that place where 265 00:12:11,785 --> 00:12:13,475 it's much more proactive 266 00:12:13,495 --> 00:12:17,755 and having each player, you know, everyone's, as you said, 267 00:12:17,865 --> 00:12:19,955 Gary, fighting the same battle. 268 00:12:20,055 --> 00:12:24,035 So the cyber security, the DSO IT resources, how do we get 269 00:12:24,035 --> 00:12:26,995 to a place where, uh, they're all working cohesively to, 270 00:12:26,995 --> 00:12:29,115 to form that more proactive approach. 271 00:12:30,135 --> 00:12:32,475 Dan, you started to touch on the partnership already, 272 00:12:32,655 --> 00:12:33,675 but Gary 273 00:12:33,735 --> 00:12:35,955 or Dan, can you, can you speak a bit more to 274 00:12:36,135 --> 00:12:38,875 how the partnership between specialty dental brands 275 00:12:39,055 --> 00:12:41,595 and black talent has has really changed over time? 276 00:12:42,785 --> 00:12:43,925 - I'm gonna defer to Gary first, 277 00:12:44,205 --> 00:12:47,045 'cause uh, he's been here longer than I have 278 00:12:47,225 --> 00:12:48,365 and can probably see 279 00:12:48,365 --> 00:12:50,485 how it's changed even in the last six months, , 280 00:12:51,015 --> 00:12:52,015 - Right? 281 00:12:52,055 --> 00:12:53,685 Right. Like, I think it's all about 282 00:12:54,445 --> 00:12:55,685 building a foundation, right? 283 00:12:55,705 --> 00:12:58,325 We started with specialty dental brands 284 00:12:59,115 --> 00:13:01,445 four years ago when they actually only had 285 00:13:01,445 --> 00:13:02,565 about 10 locations. 286 00:13:02,785 --> 00:13:06,725 And Dan, you're, I think you're up to just shy of what, 300? 287 00:13:06,725 --> 00:13:10,165 Somewhere around there? 2 49? Yep. Two forty nine. Okay. 288 00:13:10,165 --> 00:13:13,405 So we'll call it two 50. Um, so I think one 289 00:13:13,405 --> 00:13:15,445 of the most important things is building this 290 00:13:15,665 --> 00:13:16,725 strong foundation. 291 00:13:17,075 --> 00:13:20,885 What I see in the DSO space is often 292 00:13:22,065 --> 00:13:26,445 due to the rapid growth of DSOs there, technology, 293 00:13:27,585 --> 00:13:32,165 um, their infrastructure is often playing catch up 294 00:13:32,825 --> 00:13:34,845 to the acquisition game, right? 295 00:13:34,905 --> 00:13:36,965 So all of a sudden, you know, they can kind 296 00:13:36,965 --> 00:13:38,645 of bandaid everything together when they're 10 297 00:13:38,645 --> 00:13:41,445 or 15 locations, then all of a sudden they get to 20 or 30 298 00:13:41,445 --> 00:13:43,765 and they're like, oh, the wheels are starting to fall off. 299 00:13:43,835 --> 00:13:45,725 This isn't working, and that's not working. 300 00:13:46,185 --> 00:13:48,325 And they're literally watching like their technology 301 00:13:48,435 --> 00:13:50,165 crumble, uh, in front of them 302 00:13:50,165 --> 00:13:51,925 because they didn't have a plan in place. 303 00:13:52,545 --> 00:13:56,245 The exact same thing applies, uh, not only to technology, 304 00:13:56,305 --> 00:13:57,485 but also to security. 305 00:13:57,675 --> 00:14:01,805 What we often see is, you know, DSOs, uh, 306 00:14:01,835 --> 00:14:05,325 have limited security in place, typically antivirus 307 00:14:05,945 --> 00:14:07,125 and some firewalls. 308 00:14:07,825 --> 00:14:10,685 And even for a single location, that's not great. 309 00:14:11,065 --> 00:14:15,245 But as they start growing, the risk magnifies, you know, 310 00:14:15,785 --> 00:14:17,685 if you have three or four locations 311 00:14:17,685 --> 00:14:19,645 and you get hit with ransomware, that's rough, right? 312 00:14:20,105 --> 00:14:23,805 But all of a sudden you're now at 75 or a hundred locations 313 00:14:23,805 --> 00:14:26,165 and a hundred locations get hit with ransomware. 314 00:14:26,785 --> 00:14:28,165 The, the, the financial 315 00:14:28,585 --> 00:14:32,325 and, um, compliance risk is extremely high. 316 00:14:33,695 --> 00:14:37,315 And if you don't have the proper security framework in place 317 00:14:37,415 --> 00:14:40,235 to able for you to be able to grow with your organization, 318 00:14:40,435 --> 00:14:43,115 you're ultimately going to struggle and or fail. 319 00:14:43,575 --> 00:14:46,635 Um, so I think the, the biggest thing that DSOs need 320 00:14:46,635 --> 00:14:49,995 to do is as they, you know, spin up 321 00:14:50,095 --> 00:14:53,285 and as they, as they grow, they really need to have a, 322 00:14:53,525 --> 00:14:57,205 a structured security program in place that is scalable 323 00:14:57,425 --> 00:14:59,445 for their organization and, and manageable. 324 00:14:59,745 --> 00:15:02,285 And unfortunately in the DSO space, I see 325 00:15:02,285 --> 00:15:04,045 that being a struggle for many of them. 326 00:15:04,785 --> 00:15:08,765 Um, and if they, you know, plan accordingly or had planned 327 00:15:08,845 --> 00:15:11,405 accordingly, the struggles would've been, you know, 328 00:15:11,405 --> 00:15:12,685 significantly reduced. 329 00:15:13,225 --> 00:15:15,245 So I think it's like anything else, if you're gonna, 330 00:15:15,265 --> 00:15:18,045 if you're gonna build a building, build a strong, you know, 331 00:15:18,045 --> 00:15:22,205 foundation with four walls, not a foundation with one wall, 332 00:15:22,265 --> 00:15:23,805 and hoping your building doesn't collapse, 333 00:15:24,305 --> 00:15:26,925 and, you know, I think specialties done a great job at, 334 00:15:27,185 --> 00:15:30,405 you know, being able to, to scale from a technology 335 00:15:30,505 --> 00:15:31,765 and a security perspective. 336 00:15:32,985 --> 00:15:36,155 - Just to layer in here for a second, I, I do think that 337 00:15:36,775 --> 00:15:40,675 too often places have a tools approach to security. 338 00:15:40,825 --> 00:15:42,995 Like it's, you know, antivirus tools 339 00:15:43,055 --> 00:15:47,195 or it's vulnerability scan tools, or it's patching tools. 340 00:15:47,305 --> 00:15:48,595 It's a tools based approach. 341 00:15:49,175 --> 00:15:51,595 And, um, the truth is policies 342 00:15:51,595 --> 00:15:53,395 and procedures are just as important. 343 00:15:53,855 --> 00:15:55,835 The human factor is hugely important. 344 00:15:56,335 --> 00:15:59,795 The training, the communication, there's so much 345 00:15:59,795 --> 00:16:01,435 that goes into security 346 00:16:01,455 --> 00:16:02,555 and compliance program 347 00:16:03,345 --> 00:16:05,835 that you really do need to be intentional. 348 00:16:06,535 --> 00:16:09,635 And, you know, again, I I emphasize the frameworks 349 00:16:09,635 --> 00:16:11,995 that are out there because you can benchmark yourself 350 00:16:12,015 --> 00:16:14,875 and you can start to see whether it's NIST framework 351 00:16:14,895 --> 00:16:17,755 or CIS, you can start to adopt those things. 352 00:16:18,215 --> 00:16:20,715 And once you do that, then you can look very much into 353 00:16:21,165 --> 00:16:23,995 where you are relative to the rest of the world, 354 00:16:24,535 --> 00:16:27,435 and you can look and see, you know, how far behind you are 355 00:16:27,435 --> 00:16:28,555 or how far ahead you are. 356 00:16:28,935 --> 00:16:31,755 And that can help you get investment from your board, 357 00:16:31,825 --> 00:16:33,835 that can get investment from, you know, 358 00:16:33,835 --> 00:16:35,555 from your leadership team to make sure 359 00:16:35,555 --> 00:16:36,555 that you're catching up 360 00:16:36,555 --> 00:16:38,715 and going in the right place to address what, again, 361 00:16:38,715 --> 00:16:40,715 could be an existential risk, right? 362 00:16:41,095 --> 00:16:43,315 So you really need to make sure that you got the right level 363 00:16:43,335 --> 00:16:44,635 of focus on this thing. 364 00:16:45,135 --> 00:16:46,635 Um, and so for me, it's, 365 00:16:46,635 --> 00:16:50,275 it's very much having there be an intentional approach to it 366 00:16:50,275 --> 00:16:53,395 with a framework in place where you can shake hands 367 00:16:53,415 --> 00:16:55,315 and say, look, these are the biggest areas we need 368 00:16:55,315 --> 00:16:56,955 to address and let's get after 'em. 369 00:16:57,295 --> 00:16:58,675 Um, and I think we're doing that now. 370 00:16:58,735 --> 00:17:01,235 And, you know, we're, we're partnering up very closely with, 371 00:17:01,465 --> 00:17:03,715 with Gary and the, uh, black talent team. 372 00:17:05,215 --> 00:17:08,665 - Gary, you started to mention a bit about really the value 373 00:17:08,965 --> 00:17:12,705 of cybersecurity partnerships, particularly 374 00:17:13,045 --> 00:17:17,105 as A DSO may start to grow, and why it becomes more 375 00:17:17,105 --> 00:17:21,185 and more important, um, as the risk, you know, magnifies 376 00:17:21,295 --> 00:17:22,705 with more and more locations. 377 00:17:23,205 --> 00:17:26,185 So Dan, can you expand on that and, 378 00:17:26,205 --> 00:17:29,225 and touch on some of the biggest wins you've seen 379 00:17:29,495 --> 00:17:31,425 with working with a cyber partner 380 00:17:31,495 --> 00:17:33,825 that really understands DSOs specifically? 381 00:17:35,405 --> 00:17:39,615 - Well, I mean, I think the, the experience with DSOs helps 382 00:17:39,755 --> 00:17:42,215 to pace the change. 383 00:17:42,555 --> 00:17:44,215 You know, 'cause, you know, Gary 384 00:17:44,215 --> 00:17:46,575 and his team understand that you can't, you know, 385 00:17:46,575 --> 00:17:48,335 you can't stop business, right? 386 00:17:48,355 --> 00:17:50,725 You need to make sure that we can still see patients, 387 00:17:50,725 --> 00:17:51,845 we're not interrupting things. 388 00:17:52,385 --> 00:17:54,925 Um, and, you know, there's, there's behaviors 389 00:17:54,925 --> 00:17:57,525 that a practice might have, whether it's like, you know, 390 00:17:57,525 --> 00:17:59,965 shared IDs that they've, they've done in the past 391 00:18:00,115 --> 00:18:01,765 that you have to get 'em out of that, right? 392 00:18:01,905 --> 00:18:05,805 Or they don't like multi-factor because it slows 'em down. 393 00:18:06,185 --> 00:18:09,125 And so you have to do a education along with it. 394 00:18:09,665 --> 00:18:12,565 Um, having a partner that understands the DSOs 395 00:18:12,565 --> 00:18:14,485 and what, what that productivity looks like 396 00:18:15,065 --> 00:18:17,165 and what sort of the bad behavior can be 397 00:18:17,165 --> 00:18:18,965 and the reasons behind it can help 398 00:18:19,025 --> 00:18:22,165 to then educate them into, you know, the right place 399 00:18:22,305 --> 00:18:24,765 and the right behaviors, uh, and the right patterns. 400 00:18:25,305 --> 00:18:28,365 Um, and so that, that's really the, the value 401 00:18:28,385 --> 00:18:31,725 of having a partner that understands DSOs is 402 00:18:31,725 --> 00:18:33,485 that they can help pace it appropriately. 403 00:18:34,025 --> 00:18:36,125 And they can also understand that like, so some 404 00:18:36,125 --> 00:18:38,205 of these practice management systems, you know, 405 00:18:38,205 --> 00:18:40,405 these practice management systems have, especially, 406 00:18:40,665 --> 00:18:43,285 you know, in dentistry there's large images. 407 00:18:43,625 --> 00:18:45,725 So a lot of 'em have to be local, right? 408 00:18:46,265 --> 00:18:50,285 Um, and that local dynamic is, is different than a lot 409 00:18:50,285 --> 00:18:52,045 of the, some of the different cloud provi 410 00:18:52,075 --> 00:18:53,845 providing provided solutions. 411 00:18:54,465 --> 00:18:57,365 Um, so you've got a different dynamic there too, 412 00:18:57,375 --> 00:18:59,685 where you have to make sure that your tools 413 00:19:00,425 --> 00:19:03,285 are operate appropriately in the environment that you're in. 414 00:19:03,345 --> 00:19:07,605 And so, um, security providers that understand, uh, 415 00:19:07,605 --> 00:19:10,885 the dental ecosystem can really bring value in that way. 416 00:19:11,025 --> 00:19:13,365 And so that's, that's some of what we're, 417 00:19:13,455 --> 00:19:14,565 we're, we're looking for. 418 00:19:14,705 --> 00:19:16,325 And, and some of the things that you need 419 00:19:16,325 --> 00:19:17,885 to know about in, in the DSO space, 420 00:19:19,225 --> 00:19:23,055 - Lemme touch on just the visibility component. 421 00:19:23,055 --> 00:19:26,175 So without clear visibility into cyber risks, 422 00:19:26,475 --> 00:19:29,695 as we've mentioned, how are executive teams making 423 00:19:29,695 --> 00:19:30,815 risk-based decisions? 424 00:19:33,055 --> 00:19:35,275 - So I think, I think one of the biggest challenges is I 425 00:19:35,275 --> 00:19:36,515 think they aren't, right? 426 00:19:36,585 --> 00:19:40,315 When, when I talk to executives, CEOs, 427 00:19:41,785 --> 00:19:45,715 COOs, sometimes even the CFOs of these organizations, 428 00:19:45,775 --> 00:19:49,555 and I ask a simple question, which is, do you understand 429 00:19:50,045 --> 00:19:52,315 where you have risk from a cyber perspective? 430 00:19:53,145 --> 00:19:55,075 Most of the time I can't get an answer, right? 431 00:19:55,075 --> 00:19:56,915 They're like, oh, I have, I have an IT team 432 00:19:57,185 --> 00:19:58,235 that addresses that. 433 00:19:59,335 --> 00:20:03,155 But we know, unfortunately, when these cyber events occur, 434 00:20:04,015 --> 00:20:05,915 it all rolls up to the top, right? 435 00:20:06,055 --> 00:20:09,675 The CEO, the c-suite, the board, they're gonna have 436 00:20:09,675 --> 00:20:12,275 to answer as to why they didn't address 437 00:20:13,045 --> 00:20:14,395 cyber risk accordingly. 438 00:20:14,735 --> 00:20:16,755 And I think the most simpl simplistic answer 439 00:20:16,775 --> 00:20:18,075 is they didn't know. 440 00:20:18,465 --> 00:20:20,955 They didn't know what questions to ask, right? 441 00:20:20,955 --> 00:20:23,715 They're relying on information that's, uh, fed to them. 442 00:20:23,855 --> 00:20:25,475 And I've been in the corporate world 443 00:20:25,475 --> 00:20:27,275 for a long time, Dan, you've been there too. 444 00:20:27,895 --> 00:20:30,395 And we know, um, that often 445 00:20:30,535 --> 00:20:34,595 as information has passed from managers to directors to VPs 446 00:20:34,595 --> 00:20:37,955 to the C-suite, that message is often diluted, right? 447 00:20:37,955 --> 00:20:41,355 Because no one wants to really, you know, hear it at the, 448 00:20:42,015 --> 00:20:43,195 at the top, um, 449 00:20:43,575 --> 00:20:44,915 or they don't want their, their bosses 450 00:20:45,015 --> 00:20:46,435 to hear it at the top, I should say. 451 00:20:47,025 --> 00:20:50,365 And, and sometimes the message is not communicated properly 452 00:20:50,605 --> 00:20:52,605 'cause people fear for their job, et cetera. 453 00:20:53,105 --> 00:20:54,285 Um, so one of the things 454 00:20:54,285 --> 00:20:57,645 that I think all executive teams need to do is 455 00:20:58,385 --> 00:20:59,885 ask hard questions, right? 456 00:20:59,985 --> 00:21:02,205 And, and get clear, uh, and, 457 00:21:02,205 --> 00:21:05,565 and transparent answers as to where they do have cyber risk. 458 00:21:06,145 --> 00:21:07,445 And I think, unfortunately, 459 00:21:07,705 --> 00:21:09,485 and Dan nailed this, is there are 460 00:21:09,545 --> 00:21:12,925 so many tool sets out there right now that often 461 00:21:14,025 --> 00:21:15,935 teams are just relying on tools. 462 00:21:16,515 --> 00:21:18,455 And because these data sets being 463 00:21:18,695 --> 00:21:22,615 provided by these tools are so large, it's very difficult 464 00:21:22,615 --> 00:21:24,975 to take all of that data consolidated 465 00:21:25,075 --> 00:21:27,975 and then, you know, use it to present risk back 466 00:21:27,975 --> 00:21:29,015 to an executive team. 467 00:21:29,675 --> 00:21:31,975 So typically the response that gets 468 00:21:32,035 --> 00:21:34,215 to the executive team is something like, oh, 469 00:21:34,235 --> 00:21:35,895 we have a covered, you know, 470 00:21:35,895 --> 00:21:38,255 we have AI based antivirus software, 471 00:21:38,345 --> 00:21:40,255 we've got great firewalls, you know, 472 00:21:40,255 --> 00:21:41,415 you guys don't need to worry about this. 473 00:21:42,475 --> 00:21:45,175 And, and if the executive team doesn't actually, you know, 474 00:21:45,225 --> 00:21:47,575 understand security at, at, you know, 475 00:21:47,675 --> 00:21:49,775 not in a tech from a technical perspective, 476 00:21:50,075 --> 00:21:51,295 but more 477 00:21:51,295 --> 00:21:53,575 of an operational perspective, they don't know what to ask. 478 00:21:53,875 --> 00:21:56,055 You know, they don't know how to dig into that type 479 00:21:56,055 --> 00:21:59,375 of answer, and they're just going to, you know, hope, right? 480 00:21:59,455 --> 00:22:01,655 I, I call it like a hope and a prayer that, you know, 481 00:22:01,655 --> 00:22:03,055 everything is being done properly. 482 00:22:03,635 --> 00:22:07,175 But I know we provide specialty, uh, specialty dental brands 483 00:22:07,285 --> 00:22:10,255 with clear transparency into their risk. 484 00:22:10,475 --> 00:22:13,215 You know, they, they leverage our platform called Eagle Eye, 485 00:22:13,275 --> 00:22:14,895 and then they can go into Eagle Eye 486 00:22:14,895 --> 00:22:17,575 and understand overall for their organization 487 00:22:18,125 --> 00:22:19,175 what their risk is. 488 00:22:19,365 --> 00:22:23,335 They can drill down into each individual physical office 489 00:22:23,775 --> 00:22:25,695 location and understand where the risk is there, 490 00:22:26,075 --> 00:22:28,575 and they can actually drill down into the actual machine 491 00:22:29,035 --> 00:22:31,215 and understand, is this computer presenting a 492 00:22:31,215 --> 00:22:32,375 risk to our organization? 493 00:22:32,835 --> 00:22:34,735 And then most importantly, you know, 494 00:22:34,735 --> 00:22:37,095 they can action on it from a budgetary perspective, 495 00:22:37,675 --> 00:22:39,775 you know, from a compliance regulatory. 496 00:22:40,395 --> 00:22:42,575 And, and then even, you know, Dan mentioned it 497 00:22:42,575 --> 00:22:44,135 before, is patching, right? 498 00:22:44,235 --> 00:22:47,735 How do we look at these vulnerabilities and then fix them? 499 00:22:47,885 --> 00:22:50,815 Well, usually it's through, through identity, uh, 500 00:22:51,055 --> 00:22:53,015 identifying the risk and then applying patches 501 00:22:53,015 --> 00:22:55,255 and other technology to eliminate that risk. 502 00:22:55,525 --> 00:22:57,615 It's kind of like knowing your front door 503 00:22:57,615 --> 00:22:58,735 to your office is wide open 504 00:22:59,115 --> 00:23:02,015 and then closing it versus finding out the hard way, 505 00:23:02,015 --> 00:23:03,815 which is, hey, your front door is open 506 00:23:03,815 --> 00:23:05,135 and your office is burglarized, 507 00:23:05,235 --> 00:23:06,615 but that's after the fact, right? 508 00:23:06,615 --> 00:23:09,535 You, you want to have proactive, uh, proactive approach 509 00:23:09,535 --> 00:23:11,015 and identify the risk and address it, 510 00:23:11,015 --> 00:23:12,255 you know, before it becomes a problem. 511 00:23:12,755 --> 00:23:15,135 But Dan, I know you, um, you 512 00:23:15,135 --> 00:23:17,935 and your team, you know, take a lot of time and, 513 00:23:17,995 --> 00:23:20,655 and analyze the, the data that we're provided to you. 514 00:23:20,655 --> 00:23:22,695 So I don't know if you wanna take a a shot at it 515 00:23:22,695 --> 00:23:24,295 from, from your perspective. Yeah, 516 00:23:24,485 --> 00:23:25,485 - Yeah. 517 00:23:25,485 --> 00:23:29,055 I, I really like so eagle eye, you're a hundred percent, I, 518 00:23:29,135 --> 00:23:30,975 I agree with what Gary just said there, right? 519 00:23:31,275 --> 00:23:33,655 Uh, from the fact that a lot 520 00:23:33,775 --> 00:23:36,295 of executives don't necessarily approach things from 521 00:23:37,015 --> 00:23:38,175 a risk perspective, 522 00:23:38,915 --> 00:23:40,655 nor do they know like what the strategies are 523 00:23:40,655 --> 00:23:42,095 for addressing risk, right? 524 00:23:42,635 --> 00:23:46,245 And so the very first thing is we have this tool, Eagle Eye, 525 00:23:46,245 --> 00:23:48,165 right, from, from black talent that, 526 00:23:48,595 --> 00:23:50,405 that shows you the risks that are out there 527 00:23:50,425 --> 00:23:52,565 and then puts a category around it or, 528 00:23:52,585 --> 00:23:55,645 or severity around it, um, which then sort of drives, 529 00:23:55,895 --> 00:23:59,005 draws your eye towards which ones do I address first, right? 530 00:23:59,065 --> 00:24:01,325 So order of precedence of what you wanna address, 531 00:24:01,465 --> 00:24:03,605 and then, you know, you could have it in groups too 532 00:24:03,665 --> 00:24:06,405 by practice and, and attack it in that way, 533 00:24:07,265 --> 00:24:10,005 but then there's the actual addressing of 534 00:24:10,005 --> 00:24:11,165 that articulated risk. 535 00:24:11,225 --> 00:24:13,405 So Eagle eye helps 'cause it articulates the risk 536 00:24:13,665 --> 00:24:15,365 and then it, and it categorizes it. 537 00:24:15,365 --> 00:24:18,245 So that's awesome. But then when you look at it, you know, 538 00:24:18,245 --> 00:24:20,725 you can either resolve it, mitigate it, ensure against it, 539 00:24:20,935 --> 00:24:22,445 avoid it, or accept it, 540 00:24:22,865 --> 00:24:25,085 and the accept it is something you can do on the tool 541 00:24:25,105 --> 00:24:27,805 so you don't have to repeat yourself again and again. 542 00:24:28,305 --> 00:24:30,325 Um, but then you've gotta look for other ways, 543 00:24:30,325 --> 00:24:31,925 like the really big ones you wanna resolve, 544 00:24:31,925 --> 00:24:34,525 you wanna patch 'em, or you want to, you know, get it, get 545 00:24:34,525 --> 00:24:36,165 that device outta your environment 546 00:24:36,185 --> 00:24:38,125 or you wanna do something so it's no longer there, 547 00:24:38,745 --> 00:24:41,485 as opposed to like a mitigate where you might put it into, 548 00:24:42,155 --> 00:24:43,605 into A VPN, right? 549 00:24:43,665 --> 00:24:45,805 So that it's still there and I have it, 550 00:24:45,865 --> 00:24:49,085 but you know, it's, it's, I've got controls in place 551 00:24:49,095 --> 00:24:52,365 where it's, it's not gonna hurt me, um, as opposed to, 552 00:24:52,365 --> 00:24:55,525 you know, uh, avoiding it or, or accepting a risk, right? 553 00:24:55,525 --> 00:24:57,205 So there's, there's a lot of strategies 554 00:24:57,205 --> 00:24:58,525 that are out there for these risks. 555 00:24:59,465 --> 00:25:02,725 And I think, ha the very first step though is identifying it 556 00:25:02,725 --> 00:25:03,725 and categorizing it. 557 00:25:03,725 --> 00:25:06,165 And that's, that's what Eagle Eye helps us to do, um, 558 00:25:06,265 --> 00:25:07,805 and the other tools help us to do. 559 00:25:07,865 --> 00:25:09,725 And then it's really big on having 560 00:25:09,725 --> 00:25:11,525 that relationship in place where you're, 561 00:25:11,625 --> 00:25:13,965 and a team in place that understands the things that need 562 00:25:13,965 --> 00:25:17,365 to be done based on the course of action that you've chosen. 563 00:25:17,985 --> 00:25:20,485 Um, and so that, that's the big thing for me on a, 564 00:25:20,545 --> 00:25:23,765 on a risk-based, uh, management system. 565 00:25:23,865 --> 00:25:25,005 And, and that's what we're, 566 00:25:25,055 --> 00:25:26,485 we're really trying to put in place here. 567 00:25:27,885 --> 00:25:30,735 - Yeah, it was interesting to hear just around the lack 568 00:25:30,735 --> 00:25:33,695 of awareness or knowledge at the executive level, uh, 569 00:25:33,755 --> 00:25:37,695 and on the challenges that that can create, as well as just 570 00:25:37,755 --> 00:25:41,055 how the platform really helps to not just show you 571 00:25:41,055 --> 00:25:42,055 where the risks are, 572 00:25:42,115 --> 00:25:45,695 but then sort of can give some action items in terms 573 00:25:45,695 --> 00:25:48,615 of prioritizing what to address first. 574 00:25:49,515 --> 00:25:52,575 Can you speak to now how actually having the data 575 00:25:52,635 --> 00:25:56,895 to back up specialties security posture trends can change 576 00:25:56,895 --> 00:25:58,495 the conversations within the broader 577 00:25:58,495 --> 00:26:00,055 leadership team and board? 578 00:26:00,355 --> 00:26:01,355 Dan? 579 00:26:02,205 --> 00:26:04,665 - The fir first thing that having the data 580 00:26:05,215 --> 00:26:06,425 that articulated risk 581 00:26:06,445 --> 00:26:09,105 and categorized, the very first thing it helps you do is 582 00:26:09,125 --> 00:26:11,585 say, look, I mean, here's, here's the funding I need, right? 583 00:26:12,165 --> 00:26:15,865 Um, so if you have, you know, if you have a, uh, 584 00:26:15,925 --> 00:26:17,145 an environment that didn't have, 585 00:26:17,495 --> 00:26:19,345 I'll just use a very simple example, right? 586 00:26:19,645 --> 00:26:21,225 It doesn't have a firewall, right? 587 00:26:21,805 --> 00:26:22,945 And you go in there 588 00:26:22,965 --> 00:26:24,025 and you say, all right, well, 589 00:26:24,025 --> 00:26:25,665 here's all the risks that are identified. 590 00:26:26,125 --> 00:26:30,305 Um, in order to, uh, in order to, uh, mitigate the fact 591 00:26:30,305 --> 00:26:34,505 that I've got, you know, unpatched PCs, I'm just, you know, 592 00:26:34,665 --> 00:26:36,425 throwing it out there as a, as something 593 00:26:36,425 --> 00:26:39,785 that's a possible example, unpatched PCs, in order for me 594 00:26:39,785 --> 00:26:42,865 to do that, I, I really wanna have 'em on a isolated VPN. 595 00:26:42,995 --> 00:26:44,645 Well, um, let me do that. 596 00:26:44,805 --> 00:26:47,805 I need a, I need a firewall to be put in place in order 597 00:26:47,805 --> 00:26:49,005 to do that and get the, you know, 598 00:26:49,005 --> 00:26:50,205 get the structure set up right? 599 00:26:50,745 --> 00:26:54,445 Um, and if I don't have that, I, I need to invest in it. 600 00:26:54,465 --> 00:26:56,405 So here's the, here are the dollars I need. 601 00:26:56,905 --> 00:26:59,165 And so having that organized approach 602 00:26:59,715 --> 00:27:02,405 with the risks articulated first 603 00:27:02,545 --> 00:27:05,405 and foremost, helps you articulate when you're, 604 00:27:05,955 --> 00:27:08,645 when you need funding to get the different things in place 605 00:27:09,105 --> 00:27:10,405 to address what's out there. 606 00:27:10,905 --> 00:27:14,085 Um, in the same way, if I need to replace PCs, if I need 607 00:27:14,085 --> 00:27:16,445 to replace servers, if I need to get some sort 608 00:27:16,445 --> 00:27:19,165 of software package in place, um, you know, all 609 00:27:19,165 --> 00:27:22,885 of those things, if you can talk about your 610 00:27:23,445 --> 00:27:27,605 security posture related to a, you know, a framework 611 00:27:27,745 --> 00:27:30,485 and also benchmark yourself against things, um, 612 00:27:30,635 --> 00:27:32,645 that can help you with your priorities 613 00:27:32,645 --> 00:27:34,325 and it can help you get funding, 614 00:27:34,625 --> 00:27:37,965 and it can help you spur action with your team too. 615 00:27:38,125 --> 00:27:41,045 I mean, if you see a series of things that are red 616 00:27:41,065 --> 00:27:43,365 and you're, you know, you're the head of infrastructure 617 00:27:43,905 --> 00:27:45,205 and you have these things kind 618 00:27:45,205 --> 00:27:47,245 of hitting you in the face every single day, um, 619 00:27:47,495 --> 00:27:48,605 those are the, those are the 620 00:27:48,605 --> 00:27:49,685 things you're gonna first address. 621 00:27:49,905 --> 00:27:52,525 And so that's, that's really how I like to approach it 622 00:27:52,865 --> 00:27:54,485 of seeing these things out here and, 623 00:27:54,485 --> 00:27:56,365 and get the right, the right pieces 624 00:27:56,425 --> 00:27:57,645 in place to get 'em addressed. 625 00:27:58,855 --> 00:28:02,515 - Dan and Gary, before we wrap up, can we share a piece 626 00:28:02,515 --> 00:28:03,755 of advice that you would share 627 00:28:03,815 --> 00:28:06,035 to other growth-minded DSOs today? 628 00:28:07,545 --> 00:28:09,125 - The very first thing I would say is security 629 00:28:09,145 --> 00:28:10,245 has to come first, right? 630 00:28:10,245 --> 00:28:12,805 It has to be the very, it's a primary thing that's part 631 00:28:12,805 --> 00:28:14,485 of the security and compliance 632 00:28:15,265 --> 00:28:17,565 is really the foundation on which everything else 633 00:28:17,665 --> 00:28:19,285 is, has to go on top. 634 00:28:19,485 --> 00:28:21,365 I mean, you can't, you know, 635 00:28:21,365 --> 00:28:23,925 you wanna get good processes in place, you wanna get, i, 636 00:28:24,045 --> 00:28:27,085 I use the serve scale, innovate structure where you, 637 00:28:27,145 --> 00:28:31,325 you wanna be able to your IT to serve, um, your business, 638 00:28:31,385 --> 00:28:33,725 and then you want it to be able to scale so you can grow, 639 00:28:33,865 --> 00:28:35,525 and then you want be able to innovate 640 00:28:35,585 --> 00:28:37,765 and, you know, whether that's using AI 641 00:28:37,765 --> 00:28:39,645 or using your data, you wanna do those things, 642 00:28:39,745 --> 00:28:42,965 but in order to do all of that, you need it on a foundation 643 00:28:43,065 --> 00:28:44,805 of good security and compliance. 644 00:28:45,505 --> 00:28:47,525 And so it really ought to be the very first thing, 645 00:28:47,525 --> 00:28:50,685 and it has to be part of the fabric of what, of 646 00:28:50,685 --> 00:28:52,325 what you're doing every single day. 647 00:28:52,465 --> 00:28:54,685 And so the piece of advice I would give 648 00:28:54,685 --> 00:28:57,525 to other growth-minded DSOs, is do that first 649 00:28:58,225 --> 00:29:00,085 and make sure it's part of everything you do 650 00:29:00,105 --> 00:29:01,245 and part of your fabric. 651 00:29:03,175 --> 00:29:04,265 - Yeah, well said, Dan. 652 00:29:04,975 --> 00:29:09,075 Look, I think one of, one of the best piece of advice 653 00:29:09,675 --> 00:29:11,155 I can give a DSO 654 00:29:11,415 --> 00:29:16,185 or any large group is they have 655 00:29:16,185 --> 00:29:17,745 to have a cybersecurity plan. 656 00:29:18,685 --> 00:29:22,585 And what I've seen over the years is the cybersecurity plan 657 00:29:22,655 --> 00:29:24,905 typically revolves around a firewall 658 00:29:24,965 --> 00:29:27,185 and antivirus, and guess what? 659 00:29:27,315 --> 00:29:29,665 Every DSO that gets hit right, and, 660 00:29:29,665 --> 00:29:32,345 and gets taken down for weeks, they have firewalls, 661 00:29:32,375 --> 00:29:33,985 they have antivirus software. 662 00:29:34,415 --> 00:29:38,385 It's just not a good overall strategy to protect yourselves 663 00:29:39,135 --> 00:29:41,025 from these more advanced threats. 664 00:29:41,945 --> 00:29:44,285 Are they required? Of course, you have to have a firewall, 665 00:29:44,345 --> 00:29:46,125 you have to have good antivirus software, 666 00:29:46,225 --> 00:29:50,445 but there's so many more elements to a cybersecurity program 667 00:29:51,195 --> 00:29:54,485 than just like Dan said at the beginning than just tools. 668 00:29:55,185 --> 00:29:58,165 And I feel like in the cyber world right now, 669 00:29:59,535 --> 00:30:04,245 we're relying so much on tools and it's failing, right? 670 00:30:04,265 --> 00:30:06,085 So organizations invest in, 671 00:30:06,305 --> 00:30:07,965 in some pretty good tools sometimes, 672 00:30:08,105 --> 00:30:11,525 and the hackers have absolutely f absolutely figured out 673 00:30:11,595 --> 00:30:13,645 ways to bypass these tools. 674 00:30:14,065 --> 00:30:16,925 And then all of a sudden the DSO turns around as like, whoa, 675 00:30:17,065 --> 00:30:19,285 how, how do we have 30 offices down 676 00:30:19,285 --> 00:30:20,325 with ransomware right now? 677 00:30:20,325 --> 00:30:21,805 We, we just bought this new tool. 678 00:30:22,425 --> 00:30:25,325 And often it starts at, you know, kind of the, 679 00:30:25,825 --> 00:30:27,005 the sales level, right? 680 00:30:27,145 --> 00:30:30,085 The a vendor getting in front of the DSO 681 00:30:30,085 --> 00:30:32,365 and saying, Hey, this is ai, it blocks everything. 682 00:30:32,415 --> 00:30:34,085 Don't worry about it. Put this on your network 683 00:30:34,185 --> 00:30:35,845 and you have nothing to fear. 684 00:30:36,225 --> 00:30:39,325 And that's, that's the failure point. So have a plan. 685 00:30:39,505 --> 00:30:41,165 It has to be multifaceted. 686 00:30:41,705 --> 00:30:44,045 Um, it has to incorporate defensive 687 00:30:44,045 --> 00:30:46,765 and offensive measures, vulnerability scanning, 688 00:30:46,995 --> 00:30:51,085 penetration testing, cyber training, AI based, 689 00:30:51,225 --> 00:30:53,205 what's called endpoint detection and response 690 00:30:53,265 --> 00:30:55,205 or extended detection and response. 691 00:30:55,825 --> 00:30:57,325 But it all has to be backed up 692 00:30:57,355 --> 00:30:59,965 with credentialed security engineers that, 693 00:30:59,965 --> 00:31:04,005 that understand the industry, understand cyber risk, deal 694 00:31:04,005 --> 00:31:05,085 with these, you know, 695 00:31:05,135 --> 00:31:08,405 cyber events on an ongoing basis like ransomware, 696 00:31:08,405 --> 00:31:09,925 data theft, email intrusions, 697 00:31:10,345 --> 00:31:14,685 and then make strong recommendations back to the DSO 698 00:31:15,345 --> 00:31:18,845 in terms of, you know, a strategy both based on humans 699 00:31:19,305 --> 00:31:23,085 and technology, so you can defend against these attacks, 700 00:31:23,785 --> 00:31:25,485 you know, these, these ransomware events 701 00:31:25,485 --> 00:31:26,565 that are occurring right now. 702 00:31:27,145 --> 00:31:29,325 You don't know how bad it actually is until you go 703 00:31:29,325 --> 00:31:33,405 through one yourself and it brings your organization 704 00:31:33,465 --> 00:31:35,005 to its knees, right? 705 00:31:35,025 --> 00:31:36,525 To, to the point where you, you know, 706 00:31:36,525 --> 00:31:38,685 especially if it's systemic, not localized, 707 00:31:38,785 --> 00:31:40,285 you can't function for weeks. 708 00:31:40,865 --> 00:31:44,045 And that's when the executive teams realized, wow, right, 709 00:31:44,095 --> 00:31:46,445 maybe we should have asked more detailed questions 710 00:31:46,465 --> 00:31:49,645 or had more knowledge on, on this stuff and, 711 00:31:49,665 --> 00:31:51,845 and implemented the trust bud verify concept. 712 00:31:52,545 --> 00:31:56,805 So have a plan, make sure it's comprehensive, you know, 713 00:31:56,905 --> 00:31:59,045 tap into organizations like ours 714 00:31:59,045 --> 00:32:02,565 that understand the cyber world and, and, and, 715 00:32:02,585 --> 00:32:04,485 and leverage us to help, you know, 716 00:32:04,485 --> 00:32:05,805 organizations like yourself. 717 00:32:05,875 --> 00:32:06,875 Stay secure. 718 00:32:07,745 --> 00:32:10,555 - Yeah, sounds like it's really critical moving forward 719 00:32:10,775 --> 00:32:11,955 for DSOs and leaders. 720 00:32:11,975 --> 00:32:16,155 Really do away with that tool, tool as cybersecurity mindset 721 00:32:16,375 --> 00:32:20,075 and really lean more into the cybersecurity strategy plan, 722 00:32:20,775 --> 00:32:23,195 the plan mindset to be successful in the future 723 00:32:23,255 --> 00:32:26,355 and fend off, uh, some of these types of attacks. 724 00:32:27,265 --> 00:32:29,315 Gary and Dan, thank you both so much 725 00:32:29,455 --> 00:32:31,515 for hopping on today to discuss this. 726 00:32:31,895 --> 00:32:33,875 We also wanna thank our podcast sponsor, 727 00:32:34,165 --> 00:32:36,675 black Talent Security and listeners. 728 00:32:36,775 --> 00:32:40,005 You can access more podcast episodes from Becker's 729 00:32:40,005 --> 00:32:42,845 by visiting the podcast page on our website, 730 00:32:43,245 --> 00:32:45,845 becker's podcasts.com. Thank you all so much. 731 00:32:46,345 --> 00:32:48,405 - Thanks ly. - Thank you for having us.