Cybersecurity: Amplified And Intensified

3. What we can endure with current standards.

March 31, 2021 Shiva Maharaj/Eric Taylor
Cybersecurity: Amplified And Intensified
3. What we can endure with current standards.
Chapters
Cybersecurity: Amplified And Intensified
3. What we can endure with current standards.
Mar 31, 2021
Shiva Maharaj/Eric Taylor

On this episode, Eric and I discuss recent incidents (including Ubiquiti and you guessed it Solar Winds), how to vet your vendors, industrial control systems or at least what should be classified as ICS' and touched on our vision of what CMMC should look like. 

Eric Taylor
Twitter: barricadecyber
www.barricadecyber.com

Shiva Maharaj
Twitter: kontinuummsp
www.kontinuum.com 


BARRICADE CYBER
Barricade Cyber provides Ransomware Remediation Services, Incident Response and Penetration Testing.

KONTINUUM
Because you're entitled to support that's actually supportive.

Otter.ai
Otter.ai provides audio transcriptions services to help you get your message across.

FASTMAIL
Your data is for you, no one else. That includes your email, calendars, contacts, notes, and files!

Show Notes Transcript

On this episode, Eric and I discuss recent incidents (including Ubiquiti and you guessed it Solar Winds), how to vet your vendors, industrial control systems or at least what should be classified as ICS' and touched on our vision of what CMMC should look like. 

Eric Taylor
Twitter: barricadecyber
www.barricadecyber.com

Shiva Maharaj
Twitter: kontinuummsp
www.kontinuum.com 


BARRICADE CYBER
Barricade Cyber provides Ransomware Remediation Services, Incident Response and Penetration Testing.

KONTINUUM
Because you're entitled to support that's actually supportive.

Otter.ai
Otter.ai provides audio transcriptions services to help you get your message across.

FASTMAIL
Your data is for you, no one else. That includes your email, calendars, contacts, notes, and files!

Shiva Maharaj:

This is the cybersecurity amplified and intensified podcast. So what's on the docket for today?

Eric Taylor:

Not much, I think it's gonna be really easy. Like kind of news day there hasn't been a whole lot in there. But I have been going back through the ubiquity information that was leaked out last week from the whistleblower really started dive into a lot of that information and want to kind of touch on that, see if you're seeing the same thing as I am. And if this really is something to be concerned about, what do you got on your sizer?

Shiva Maharaj:

Not much, I'm just more concerned that this is the calm before the storm. This is the second week that we're going into without any major incidents. And I'm wondering if the bad actors are just laying in wait to start striking again.

Eric Taylor:

Yeah, we definitely start talking about that at least what I'm seeing on the incident response side of things is very, very interesting, very quiet. And the ones that we are getting, it's a little bit of a different conversation in the past couple of weeks, and I'm not really used to having a whole lot of so we'll definitely dive into that. So I guess let's kick it off with the ubiquity. Do you remember that ubiquity whistleblower article that came out toward the end of last week, I think or middle of last week? Yeah.

Shiva Maharaj:

The one from last week where it should have been all hands on deck because of how they deliberately avoided disclosure?

Eric Taylor:

Did you really dive into that whistleblower, and I'm gonna lead down this little rabbit hole here,

Shiva Maharaj:

I read the entire article, I think bleeping computer may have been the first one that I read. And there were few after the fact some confirmations of the breach. But ubiquity still has not come out and actually said what was exposed, what may have been exposed, and they keep toeing the line, that there's no evidence that user data was accessed, much less exfiltrated, which I can only believe that because of the article saying there was little to no logging,

Eric Taylor:

exactly this kind of stuff that we always read back to like, you're not going to see the weeds in your grass, if you don't open your eyes, right, if you're not logging these things, of course, there's no evidence of this stuff done, because there's nothing to show it. But the one thing that I did find very, very interesting is a couple of the spin off articles and stuff like that. And I think it may have actually been bleepingcomputer that I was reading this on, but ubiquity was blaming a third party vendor originally and said that it was no that was where the whole no information was coming out before the whistleblower actually came out. Now we're looking at the whistleblower. So ubiquity is pretty much blaming AWS, as all their stuff is in AWS as their third party vendor with a data breach. from what I gather,

Shiva Maharaj:

it was a reached LastPass account that got them privileged access to ubiquity back end, I could be mistaken. But that's Yeah,

Eric Taylor:

so what I was reading because they were actually showing login or a LastPass screen, so they breached somebody's computer, whether that's an AWS computer, whether that's a local VM or whatever, but there was you know, they were logged into Windows showing LastPass up inside of those LastPass credentials, were this SSH code for any and all ubiquity servers in AWS any and all critical system admins who all their containers whoever they got into was quote unquote godmode and had access to the entire kingdom this would be the equivalent of your AI getting compromised and having access to our identity it's really that same level of like here's here's the keys I'm just walking away type of thing. Here's my issue with what we know about this whole ubiquity yasko which let's be honest, we don't actually know much of anything other than hearsay coming from various points but the mere fact that there was no controlled access and one account can do this much damage that scares me Yes, we should always secure the identity as best we can. But no identity should be no single identity should be able to do this type of damage and that is really poor cybersecurity hygiene or just for it hygiene in general

Shiva Maharaj:

my point of view

Eric Taylor:

Oh, yeah, absolutely. And it goes back to what we've been talking about on the past couple episodes a little bit and privately where Who are you going to start aligning your vendors with you know, like I said on the call when we originally talked about this I got a ton of ubiquity stuff out there, I don't know short are starting to pull everything out and go with a different vendor I'm not really sure what to do.

Shiva Maharaj:

I don't know if you remember maybe a year ago just under a year ago, internally here my sock and Sam found out that the unify devices were passing their passwords in plain text

Eric Taylor:

we'll call that I do recall that conversation yesterday

Shiva Maharaj:

I reached out to ubiquity never got a response and I ended up ripping and replacing every bit of unify would at that point were only switches because I use other vendors for firewall and access point because I did not want those devices passing any type of password in plain text because that scared me to the point where I think now I'm the only unify I have is in my house so whoever's listening to trying to get in unifies your vector. I just oh scented myself, but hey, such as life.

Eric Taylor:

I don't use unify as a router firewall because I mean, they're not that right. Let's let's be honest,

Shiva Maharaj:

there's no such thing as unify router, or firewall, there's a paperweight that's called a USG but that's not really security. It's more the really nice cloud management console, which is what I think that thing should be. As opposed to being billed as a firewall,

Eric Taylor:

I mean their IDs and IPS is in been beta for over a year now,

Shiva Maharaj:

but how effective is it has anyone actually tested it relative to let's say Meraki go, which is their consumer based product,

Eric Taylor:

I don't know if anybody really has put it through its paces, to be honest with you. I know I keep talking about me wanting to put it through its paces to some degree, I just haven't had the time to actually, you know, really go through that. I guess, if you were approaching a new hardware vendor, who would you are? What kind of questions? Would you start asking these guys? Because like, I mean, we're starting to we use Fortinet primarily for all of our clients. But you know, I'm starting to ask them the questions, you know, I'm starting to ask them, you know, what's your policy or VDP, or vulnerability disclosure program? What is you know, how do you go back and look at your release notes? Are you actually disclosing your release notes? Hey, vulnerability, lemon law was patched here is a document on that kind of stuff. And for that is doing a really good job much like Microsoft, unfortunately, where we're all in a scramble is like, okay, here's the patch. By the way, we fixed seven zero days pre patch yet, so it's kind of like, Guys, can you wait a couple of days before disclosing zero days, we split the patch get out into the wild a little bit. So it's making me starting to question at least that but these are the kind of questions I'm starting to have, again, with my hardware vendors to figure out what's going on to the point where I'm even considering even dropping Lenovo because of their update policy, or their update software that enumerate or create a local administrator runs, commands, and then uninstalls that look or removes that local administrator account, and it sets off my EDR and all my sock four or five times a day, anytime

Shiva Maharaj:

that thing runs. I got a notification from CrowdStrike yesterday that Dells inventory manager was doing some similar things, and they had to put in place mitigate various mitigations to deal with it. But going back to your thoughts on how we approach vendors, and I say vendors, because it's not just the hardware guys, I think the software guys need to be held to a higher standard than we hold them to, if at all right now, I think we need to have in depth conversations with their cisos and understand what their security protocols are. And I know that's hard for them to do right now. They can shrouded in secrecy, saying, Well, this was to protect ourselves. But going forward, if I am not happy with the security posture of a vendor, I will either not use them, if they're not in the quiver, so to speak, or if they are a vendor of ours, I will drop them, you know better than most I dropped my major RMM provider back in the summer of last year because of a security issue. So yeah, need to hold on.

Eric Taylor:

Yeah, you, me and at least four. So other folks at close partners. You know, we all like Yep, this is enough, we're done. And we all completely disrupted our entire business for about a month replacing and ripping out and just redoing our entire our entire methodology of doing anything, man, to be honest with you, I'm still going through some of our stuff with our PSA, because I still haven't got it configured and set up the way we need to. And that's just crazy. But I feel that's a necessary evil.

Shiva Maharaj:

How can you put a product out there that represents you, your company and everything you stand for when it's insecure. So it's something we had to do, we had no choice. And the lack of response is a response. In my mind,

Eric Taylor:

even to this day, we are almost at a one year, our agreement with our new partner, the old one still hasn't responded.

Shiva Maharaj:

It's not on them to respond anymore, we're not their problem, they're not our problem. Fortunately, one of us had the incident, and we shared it with everyone else to show this is a vector, this is a problem and there was no response. And we need to apply that to every vendor in our arsenal, we can no longer just rely on their marketing to say they are the best

Eric Taylor:

part this you know, and I'm gonna play devil's advocate for a second here. But the part that I'm really worried about is we're going to keep hopping from vendor to vendor, because you know, while they are good today, they may not be good next week,

Shiva Maharaj:

my take on that is maybe not hop from vendor to vendor, but maybe thin out the herd. I know right now, there are about 15 or 16 key points that need to be secured at a minimum across all my clients. And that can probably be done with maybe seven or eight vendors, maybe less. But I think we need to start ripping back layers of the onion, because they're not actually providing any protection and perhaps double down on more of the identity protection. The MFA, the basic user protection is what we need, I would dare I say we probably need better protection of the user identity than we do a next gen AV at this point in time as far as the system not persistence and protection. But just as the entry

Eric Taylor:

point. I don't know. I mean, I'm really torn on that one. Because I was actually literally having a conversation the other day with somebody about this whole topic. You know, when you were talking about an on premise situation that Yeah, you're going to need or more of your firewall, you're gonna need more of your AV. But if you're going after cloud assets, you're going after s3, you want other AWS servers, you're going after all this stuff, then yeah, your identity is going to be critical, you know, protecting that. So I do think they need to be a 5050 if you will, just because you don't know where the attack vector is going to come from, but it really depends on where the business is. So still legacy in on premise, then maybe not so much focused on identity as much depending on you know what the what they're doing, you're a little bit case by case, but at least you got to start off at a 5050 kind of dress if needed. I

Shiva Maharaj:

think you got to do 100 100 100 across the board,

Eric Taylor:

I think you know, equal burnout,

Shiva Maharaj:

it does. But if you have the right vendors, you have the right processes and procedures, you can make a lot of headway. And that's one thing I've noticed in our industry, many providers think they can fix a solution by just buying a product when the real fix or the real solution is people, processes and procedures working together to work the problem.

Eric Taylor:

Oh, absolutely. Yeah, I had the same conversation, I think about you, or with you, or at least with some folks, because I used to do so posts for a long time. Well, I would say a long time, definitely about six months or so. And that was just after their they acquired or right around the time that they acquired Hitman Pro, and they were doing all these acquisitions. And while it was great, they're bringing more quote unquote security to the space of the products that I'm bringing to my client. But it was turning into just massive amounts of bloatware like I went from four services to 13 services in a week timeframe. I'm like, Oh, my gosh, is becoming a noisy sob. You don't,

Shiva Maharaj:

you don't like having 35 processes for one program that's not not required. And I can't it's not 35 processes, it's probably about 18 to 25, if that even higher. But that's the problem in our industry, too many of our peers rely on the marketing of the distributors, the marketing of the vendors, and then these these vendors get this fanboy status where if you speak out against a vendor, you have a large part of the channel coming after you. And it doesn't matter if you're right, or you're correct in what you're saying.

Eric Taylor:

Oh, exactly. I mean, I'll just be, you know, open and candid about it. I mean, it was a week or two, I went after and took over a subdomain four times after they were being featured on a podcast of somebody that we know and shout out to

Shiva Maharaj:

Steve Taylor rocket MSP

Eric Taylor:

there, we got to know if we want to plug his name or not. But there you go.

Shiva Maharaj:

He's a funnel, there we go.

Eric Taylor:

That he is that he is. But we went through or I went through and you know, found a sub domain very, very quickly and took it over and you know, put a public display or a public notice and a friendly dump subdomain takeover and quoted you there with peace and love and all

Shiva Maharaj:

that. That's actually I'm going to go star. I've been like labeling his he send love

Eric Taylor:

but I mean, those, those are always the first interesting conversations I get to have with new companies like, Hey, I did something but I love you guys. But yeah, and the MSP vertical was like, why'd you do this, you're hacking, you're doing this, I'm like, No, get chill out, calm down, relax, take a breather. It's not that bad, I promise.

Shiva Maharaj:

But you know, my thought is you have to break shit to improve. If you're not in pain, you're not growing, this is your space. This is the worst thing, in my opinion, staying still stagnant, not making any progress, not changing with the times and evolving with threats or just evolving with life. I want nothing to do with that, or anyone who enjoys that.

Eric Taylor:

Yeah. And that kind of goes into I guess some of the next topics that we'll have coming up here soon around the the new federal see compliances that we've kind of hinted around with cmmc three and stuff like that, I know, I got some calls coming up in the next week or so I know, you've got some calls coming up around the whole security space with some of your clients and whatnot. So I think the next couple of weeks are going to be really interesting as we bring some of the new information to be out and let everybody be aware of the whole situation that's going on, you know,

Shiva Maharaj:

touching on cmmc. without going too crazy about it, I am starting to see the ripple effects downstream. You know, we're not nearly big enough to be a prime, but we're a few layers down in the supply chain for certain clients of ours. And I am starting to see the reviews coming for the tool sets that are deployed, and I give it about a year before the entire supply chain has to be in line with some version of cmmc. What are your thoughts on that?

Eric Taylor:

Yeah, absolutely. I mean, it's going to really start people are going to have to start focusing in line whether they have to be compliant with a regulatory body or not, they are going to have to do something. We got to start taking security seriously. People will start, you know, we've talked about this before they got to be held to a new, higher standard and incredible standard. And what is that standard?

Shiva Maharaj:

In terms of security? If you think about it, my version of security of what I rolled out to my clients is likely slightly different to yours, because we are peers with our colleagues. We discuss things offline, but put us up against the average MSP out there who's putting out something like just an RMM some basic patching RMM what exactly are these guys doing?

Eric Taylor:

Oh, absolutely. You put any of our band of beautiful friends together. And I mean, the difference of security and complexity that these guys will actually roll out this

Shiva Maharaj:

staggering, and it's not that they're doing it wrong, or we're doing it right. I just think it's there's no actual standard that says every company should have a B, C, D, E fg in place at the bare minimum, and then anything else layered on top, what I would like to see with cmmc is you take the five levels and you have a singular compliancy set, get rid of HIPAA, get rid of Sarbanes Oxley, get rid of everything else and make it a tiered system like cmmc. This way, you have one set of auditors, you have one set of review boards, and now you rebuild each level to deal with the complexities needed. Because I don't care if you're a financial firm or hospital, an accounting firm, or even a plumber, I think there are certain things that need to be done security wise across the board for every client that has a computer attached to the internet.

Eric Taylor:

Oh, absolutely. I think that's where a lot of the countries are really starting to excel past us in the cyber security space, you know, they don't have the problems of these things that some of us do have. Now. You know, I will say that was a big Asterix on top of that, because I know for a fact that there are countries out there that are like, okay, you know, we're from Russia, we're not going to hack China, we're not going to do the work of these people, those people or whatever, you know, so they don't have some of the major problems that we face coming from ATP nation states, but it's definitely still a problem. Absolutely. I really think looking at the cmmc levels, level one, no offense is a joke level. So

Shiva Maharaj:

you're only logging and starting to do aggregation at level three, level one and two, I would not even call crawling.

Eric Taylor:

This is true. Is this true? I don't know. It's Yes, Grant, we got to start somewhere. I 100%. Agree. Where's that? I don't know. You know, I think I'm on board with you. I do think that we should be at a level three at a minimum for any and all businesses outside of you know, logging credit card information. Let's take your local Jiffy Lube or your local quick oil change outside of credit card information? Is there really anything that's really critical? Really important? I fair to say? No? Maybe?

Shiva Maharaj:

How about a half about one of the Joint Chiefs of Staff who brings their car in that could be a location where it's compromised, where things can be done?

Eric Taylor:

Maybe if there goes into the PCI information? Because

Shiva Maharaj:

I'm going deeper. I'm going into the car itself, let's say can we classify that OBD? Two port industrial control systems?

Eric Taylor:

Good point. I did not think of your correct. Okay,

Shiva Maharaj:

so with cars getting smarter, not necessarily the Tesla smart. But what's to stop anyone from uploading code to mess with the drive by wire or brake by wire system? Oh, there's not I mean, if that is done, how are we going to know who, what, when, where, why and how it was done? If there's no I guarantee you Jiffy Lube, the Jiffy lubes of the world aren't logging those, you know, what I termed the industrial control system.

Eric Taylor:

Absolutely. That's really gonna be interesting, because I mean, every year as you know, besides or hack five, or you know, whatever hacking facet you want to refer to, there's always guys and gals out there that are reaching into Tesla's or reaching into Honda, and GMC, and OnStar and all these other things. The one thing that surprised me, and I shouldn't have surprised me, but it really did. So I whipped out my old android phone last week to go out to look at a client's Wi Fi signal. And on there, I've seen things where I can start scanning for local Bluetooth Low Energy signal. Well, this is pretty cool. Again dawned on me at the time. I don't know why, but it just didn't I guess, you know what you know, or what do you think about his apartment, but my GMC car, SUV, whatever you want to call it? It emits a low frequency Bluetooth to receive a key fob information. I'm like, duh. But until I thought about it last week, I'm like, I never thought about it. I mean, there's so much Bluetooth hijacking going on. I can't tell you the last time my phone was ever on my car was ever updated for Bluetooth vulnerabilities about yours. And I have I'm sorry,

Shiva Maharaj:

I think nowadays there are updates going if you're getting serviced at the dealership, if you're not getting serviced at a dealership, I don't think you're getting some of those firmware updates. But while we're on this topic, I think last week around April 2 or April 3 bleeping computer put out a report on Aplus technologies, which does the vehicle inspections for Connecticut, Georgia, Massachusetts, Utah, Wisconsin and many other states and they suffered a cyber attack and again, these are the testing companies that plug in directly to your automobiles, say code could not have been dropped in just as what was done with solar winds to cause accidents

Eric Taylor:

shut off no job

Shiva Maharaj:

safety features for lane changing alerts with cars coming anti collision software and no one seems to care everyone just seems to think okay, what's next because we live in a not even a two week news cycle anymore. We live in a two day

Eric Taylor:

32nd depending on your Tick Tock or Twitter feed.

Shiva Maharaj:

fan of Tick Tock you leave Tick Tock alone You hear me but

Eric Taylor:

next week on the podcast.

Shiva Maharaj:

The only reason solar winds is still relevant today is not because of the national security implications. It's because solar when the solar winds breaches the breach that keeps on giving with new vectors, new attacks and new information being uncovered on a near weekly or bi weekly basis. I haven't had a chance to reach But you were talking about it the other day, where you were seeing report solar winter, Ryan was still in production and VOD, and local municipalities. Is that correct? Well, my understanding of Sisa guidance, it's still being used, there were certain mitigations put in place, which was to take it off to the internet, feasibly, it could only be used on the internet. And there were patches issued. I don't think the way our national security infrastructure is built in terms of civilian government organizations, they can just pivot and move to something else. There's a whole procurement process that needs to be done, and solar winds is already there, which would lead me to believe it's far easier to mitigate the threat and monitor the threat than to actually pull up stakes and switch software. On the other hand, what is the alternative? Where do they go? If they were to leave a Ryan?

Eric Taylor:

Good question. I

Shiva Maharaj:

don't know. I mean, to solar winds credit as much as it pains me to say this, but the Orion software really is a big monitor for these networks. That's why it really took off, the only things I think that were really come close to getting out of an RMM space really would be PRTG. That would give them a lot of the feasibility and insight that they're looking for on a network, you know, before the SolarWinds breach was made public to us. And I think it was early December, they were planning on spinning out there Managed Services Division, which is now called enable. And I think they were doing that because the managed services side of their business was a dead weight to the SolarWinds company, because their enterprise business is a solid business, they have solid product. And it's not the it's not built on the constant acquisitions that we see in the MSP space where it's just relabeled. And development stops. The sad part about solar winds is and you know, I have to give whoever the the hackers were credit for this. It was quite the elegant hack or breach the way they did it. They got deep into the code signing, it was impressive, in my opinion.

Eric Taylor:

Oh, yeah, absolutely. I mean, how much I hate to say it, but the guys and gals who did this attack are they've got to be a nation state. Because if any other person who's going after a profit they go when the actual trade day incorrect, they're done, right, these folks took the time to see who was falling back home worthy important, delete the ones that weren't important and do quietly move forward.

Shiva Maharaj:

Did you review how a hack or how the breach staged there were timers and logic where if it's a new installation, don't activate in case you're in a sandbox, wait two weeks or three weeks to do something that was planning, they even push test malware code to see if it would get caught. And when went through, they just went full bore on them. And I often wonder, did fireeye discover this breach because the bad actors wanted to be discovered. So focus would be put there so they can put their resources somewhere else a misdirection, if you will.

Eric Taylor:

It's an interesting thought. On the I have watched how they go in, you know, the sleep timers that they put in, like you said, the test codes that they put in to see they would never was so clever that they would use their payload to drop a different payload that was obfuscated from their existing just to see what EDR is and stuff like that out there may do when they start be getting all what about the

Shiva Maharaj:

fact that they hid their traffic, or they obfuscated their traffic to mimic that of legitimate Orion traffic?

Eric Taylor:

Oh, yeah. I mean, they do. As much as I hate to say it wasn't a piece of art, it really, really was definitely one that the analysts are still going through. And just simply amazed they are just in awe and things to be studied. There's a lot of lot of data to learn that still have been coming out that I'm sure God is still analyzing data to figure out how to just get pulled off again, how solar winds will just like, Oh, well, they got him because some interns set the password. So that was 123.

Shiva Maharaj:

No, that was their GitHub. They blame that on the intern, not around. But here's a question that I have for you. What government institution were you most surprised that uses Orion

Eric Taylor:

I was really surprised about Department of Homeland Security really think so

Shiva Maharaj:

homeland was put together after a crisis. So they probably used whatever they could have gotten then and made it better I'm sure with you know, they help with the development. But the one agency that has been publicly listed as a user of Orion blew my mind. And that is the NSA,

Eric Taylor:

wouldn't you forgot about?

Shiva Maharaj:

Wouldn't you think the NSA would have built their own product and not use something off the shelf?

Eric Taylor:

Or? I mean, I would imagine coding that out with a lot of work right. So I get the we're talking about the

Shiva Maharaj:

you know, if they

Eric Taylor:

can't do it, I would I think I would be more on the I think it'd be more on the side, honestly, of why are they not catching this situation before fireeye whether, you know, you build it out yourself or whatever, but they should have been the first ones to catch on. I was thinking, well, how

Shiva Maharaj:

did fire I catch it. I don't know that hasn't been public knowledge yet. fireeye detected access to subsystems related to government agencies, but they did investigation they saw what they saw. Now this goes back to you know, my thought of was that done for misdirection? Did they triple wire? So fireeye would discover it and the entire world would look at solar weapons while they have a whole nother vector into all the system.

Eric Taylor:

Good point. Good point. I mean, we can conjecture there's about about,

Shiva Maharaj:

yeah, I don't have clearance. I don't know who's doing what. So it is what it is. In that sense.

Eric Taylor:

Unfortunately, I know we got some stuff that we're going to be talking about next week's show coming up with cmmc and things of that nature. But is there any other topics you want to kind of cover before we wrap this one?

Shiva Maharaj:

No, just maybe a recap of our last show, which is please use MFA even if it's text message, but hopefully not protect yourself, protect your people.

Eric Taylor:

About you stop freaking being so blind, stop trusting everything, always question always be inquisitive and be asking your vendors if you're a business and your C level suite or you're in the IT department start asking your external vendors, your MSP is your external IP consultant, start asking them questions and drill down. We even had a buddy of ours who recently said as well that they have vendors that they're having conversations in the vetting process and don't ask him the same questions that we were asking them. It's alarming. I mean, we are less than 10. People ask me some of the most sophisticated questions to a lot of these vendors and they're surprised by it when there's I don't know at least 5 million quote unquote it MSP professionals out there. Well, there are at least

Shiva Maharaj:

5 million people that call themselves IT professionals. I may not agree with 99.9% of them. But hey, if they are the tip of the spear God help us

Eric Taylor:

they are the tip of the spear than I am tip of the spear and mushroom, sir. Alright guys, the GAO thank you so much for joining this week's podcast on cyber security amplified and intensifies If you liked this thing, if you like our show, please subscribe. Please join us next week on clubhouse word there twice a week and we'll see y'all in the next episode. Thank you so much. Thank you all

Shiva Maharaj:

take care. Thanks again for joining us for the cybersecurity amplified and intensified podcast.