1
00:00:00,000 --> 00:00:12,640
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,640 --> 00:00:15,360
with the top experts in their field.
3
00:00:15,360 --> 00:00:19,520
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,520 --> 00:00:21,520
ready for whatever comes next.
5
00:00:21,520 --> 00:00:23,680
This is Logically Speaking.
6
00:00:23,680 --> 00:00:26,160
Today we have the pleasure of speaking with Aaron Zepper.
7
00:00:26,160 --> 00:00:33,560
He's the CEO of DMD Security Systems Recovery, which is an IT asset disposition company.
8
00:00:33,560 --> 00:00:39,400
They provide solutions that adhere to some of the industry's most rigorous environmental
9
00:00:39,400 --> 00:00:41,560
and security standards.
10
00:00:41,560 --> 00:00:49,320
Aaron was recently recognized as Momentum's 100 CEO in 2023, which honors CEOs who often
11
00:00:49,320 --> 00:00:54,120
champion new visions of capitalism and is measured by a force of good ranking.
12
00:00:54,120 --> 00:00:57,040
So congratulations for that, Aaron.
13
00:00:57,040 --> 00:01:03,640
And prior to his position at DMD, he was an executive leader in IT industries for over
14
00:01:03,640 --> 00:01:10,800
20 years with companies such as IBM, Insight, Tech Data, where he led sales, marketing,
15
00:01:10,800 --> 00:01:11,800
operations.
16
00:01:11,800 --> 00:01:15,520
Aaron, thank you very much for taking some time to join us.
17
00:01:15,520 --> 00:01:20,240
I was hoping that you'd be able to share with our listeners about your experience and how
18
00:01:20,240 --> 00:01:27,440
you got into this IT space, because I think most of our listeners find it very interesting
19
00:01:27,440 --> 00:01:32,360
to find people's journeys into this world of IT.
20
00:01:32,360 --> 00:01:34,800
So if you wouldn't mind starting there, that'd be great.
21
00:01:34,800 --> 00:01:35,800
Absolutely.
22
00:01:35,800 --> 00:01:40,240
So it started over 20 years ago, which seems like a hard thing to say sometimes, but before
23
00:01:40,240 --> 00:01:45,920
that I was waiting tables, bartending, and I actually took an inside sales job at a large
24
00:01:45,920 --> 00:01:48,040
bar, basically.
25
00:01:48,040 --> 00:01:51,520
And found that I like sales, found that it was interesting.
26
00:01:51,520 --> 00:01:58,120
I was learning something new around IT sales, technology, learning about PCs, servers, laptops,
27
00:01:58,120 --> 00:02:03,920
and that just spawned a career that led me to be, I was pretty successful at sales, and
28
00:02:03,920 --> 00:02:09,560
then it led to sales management, and it led to leading sales groups, got into product
29
00:02:09,560 --> 00:02:15,920
management, got into operations, and switched out a few times from product into software
30
00:02:15,920 --> 00:02:20,200
then into services and things that I kind of learned along the way, and then it moved
31
00:02:20,200 --> 00:02:21,400
into a SaaS company.
32
00:02:21,400 --> 00:02:25,320
But one of the things a lot of my mentors always said was, keep going to where the margin
33
00:02:25,320 --> 00:02:26,320
is.
34
00:02:26,320 --> 00:02:30,520
And so you look at the margin in product, and it was small, then it was like, well, you
35
00:02:30,520 --> 00:02:33,360
want to be in software, a better margin, so you resold software.
36
00:02:33,360 --> 00:02:36,200
And it's like, no, no, you want to be in services.
37
00:02:36,200 --> 00:02:41,360
And then funny anecdote was, as I was looking to leave and go to a small data center services
38
00:02:41,360 --> 00:02:45,400
company, one of my mentors took me aside and he goes, now what you really want to do is
39
00:02:45,400 --> 00:02:46,400
open a bar.
40
00:02:46,400 --> 00:02:50,160
He goes, once you, because he's like, the problem with our industry is everything you
41
00:02:50,160 --> 00:02:52,320
learn within five years, it's completely outdated.
42
00:02:52,320 --> 00:02:54,480
So you have to replace the entire body of knowledge.
43
00:02:54,480 --> 00:02:58,160
Once you know how to make a martini, you know how to make a martini forever.
44
00:02:58,160 --> 00:03:03,960
I was like, wait a second, I got out of that just to go do something more interesting.
45
00:03:03,960 --> 00:03:05,240
That's really great advice.
46
00:03:05,240 --> 00:03:09,640
I never thought of it that way, but that's really great advice.
47
00:03:09,640 --> 00:03:15,280
It's funny when you said bar, I thought you said bar, and then I heard martini and I thought,
48
00:03:15,280 --> 00:03:18,320
he's got it right.
49
00:03:18,320 --> 00:03:22,440
You could always perfect a martini.
50
00:03:22,440 --> 00:03:30,200
So I'd also like to get your perspective on how the tech landscape has been evolving.
51
00:03:30,200 --> 00:03:33,240
You've been in it for 20 years.
52
00:03:33,240 --> 00:03:37,440
Maybe share a little bit about how you've seen that evolution and how you might see
53
00:03:37,440 --> 00:03:40,120
the evolution of it coming.
54
00:03:40,120 --> 00:03:44,160
If you had a crystal ball, what that would look like in the years to come.
55
00:03:44,160 --> 00:03:45,800
Yeah, that's an interesting question.
56
00:03:45,800 --> 00:03:46,800
There's so many perspectives.
57
00:03:46,800 --> 00:03:48,760
I think you can take that from.
58
00:03:48,760 --> 00:03:53,600
One of the ones that I rely on a lot is, I think of it really a lot as a pendulum.
59
00:03:53,600 --> 00:03:58,360
So as I think of how I look at the industry and the pendulum being from centralized to
60
00:03:58,360 --> 00:04:02,440
decentralized, and then you can apply that same pendulum into different aspects of the
61
00:04:02,440 --> 00:04:03,920
IT landscape.
62
00:04:03,920 --> 00:04:08,840
So when I was first getting into the industry, it was the PC on every desktop.
63
00:04:08,840 --> 00:04:13,560
So before that, there was a lot of centralized mainframes, thin clients, and so everything
64
00:04:13,560 --> 00:04:14,560
was locked down.
65
00:04:14,560 --> 00:04:16,840
Then they put PCs everywhere and it's great.
66
00:04:16,840 --> 00:04:21,120
You can have a CD-ROM, you can download music, you can download your MP3s, you can burn
67
00:04:21,120 --> 00:04:22,120
them.
68
00:04:22,120 --> 00:04:24,360
Then all of a sudden the corporate America was like, we got to shut that down.
69
00:04:24,360 --> 00:04:28,120
There's all these security risks, there's problems with what our employees are doing.
70
00:04:28,120 --> 00:04:32,080
So basically they took a PC that had all this functionality, locked it back down to make
71
00:04:32,080 --> 00:04:33,880
it more like a thin client.
72
00:04:33,880 --> 00:04:38,040
And then it's like, well, wait a second, we got to distribute what people work on.
73
00:04:38,040 --> 00:04:43,400
And so as the things that we've gone into, sorry, out of the data center services group,
74
00:04:43,400 --> 00:04:46,600
we were worried, oh, the cloud's going to destroy this business.
75
00:04:46,600 --> 00:04:47,920
Everything's going to move to the cloud.
76
00:04:47,920 --> 00:04:53,440
And I mean, I've been, the cloud conversations are going on since probably 2007 and in a large
77
00:04:53,440 --> 00:04:55,080
way that I've been dealing with.
78
00:04:55,080 --> 00:04:58,640
And every year it's like, oh, we're going to move all the applications.
79
00:04:58,640 --> 00:05:02,160
And every time I look at the things that are on it, we still hardly have any applications
80
00:05:02,160 --> 00:05:04,360
in the cloud as a thing.
81
00:05:04,360 --> 00:05:09,600
And so, and then we see, even like exchange moves all into the cloud or your outlook,
82
00:05:09,600 --> 00:05:12,040
whatever you want to call it, your mail client.
83
00:05:12,040 --> 00:05:17,360
And then, well, for backup recovery purposes and continuity purposes, it's really cheap
84
00:05:17,360 --> 00:05:19,240
to put an on-premise backup online.
85
00:05:19,240 --> 00:05:22,400
So in case you're ever down and sorry, I see a lot of companies adopt that.
86
00:05:22,400 --> 00:05:27,320
It's like, wait a second, I thought we offloaded all this to be centralized and now we're decentralizing
87
00:05:27,320 --> 00:05:28,320
it.
88
00:05:28,320 --> 00:05:33,280
And so, you know, at the end of the day, to me, it's, there's always change.
89
00:05:33,280 --> 00:05:36,840
And no matter what in technology, there's going to be a new or better way.
90
00:05:36,840 --> 00:05:42,280
And that new change brings new sets of services, new offerings, new challenges, and we just
91
00:05:42,280 --> 00:05:44,600
keep going back and forth along those pendulums.
92
00:05:44,600 --> 00:05:46,880
Yeah, that's a great way to look at it.
93
00:05:46,880 --> 00:05:49,600
Yeah, you mentioned cloud migrations.
94
00:05:49,600 --> 00:05:57,320
I'm interested to, have you seen certain industries be faster to adopt cloud migrations?
95
00:05:57,320 --> 00:06:03,120
So I mean, I think it's like anything, and just in my course of the last five to 10 years,
96
00:06:03,120 --> 00:06:07,320
probably what I've seen is, you know, the older the company is, the larger the company
97
00:06:07,320 --> 00:06:11,240
is, the less likely they are to be able to move everything to the cloud.
98
00:06:11,240 --> 00:06:14,160
So you end up with companies that are, quote unquote, we're bored in the cloud.
99
00:06:14,160 --> 00:06:20,160
So if you're a startup, people aren't dying or clamoring to create their own infrastructure.
100
00:06:20,160 --> 00:06:23,200
And then when they get to scale, they might look at moving off that.
101
00:06:23,200 --> 00:06:28,640
And then the flip side of it, large companies, they've had this infrastructure, they have
102
00:06:28,640 --> 00:06:32,760
applications, custom built, home grown, whatever you want to say, that are critical to their
103
00:06:32,760 --> 00:06:33,760
business.
104
00:06:33,760 --> 00:06:37,360
And it's so difficult to move them into the cloud that, you know, you're going to end
105
00:06:37,360 --> 00:06:42,120
up with a hybrid, I think you're going to end up with a hybrid mode in almost both cases
106
00:06:42,120 --> 00:06:44,040
as companies get to mass.
107
00:06:44,040 --> 00:06:50,600
So, yeah, but, you know, I wanted to talk a little bit about, because a lot of a big
108
00:06:50,600 --> 00:06:55,240
portion of your business is disposition of, of IT assets.
109
00:06:55,240 --> 00:07:04,560
And I read a study recently that stated that 69% of organizations report falling victim
110
00:07:04,560 --> 00:07:10,520
to at least an exploit that originated from an asset that either was disposed and the
111
00:07:10,520 --> 00:07:17,960
data was exfiltrated or, or didn't dispose of it properly.
112
00:07:17,960 --> 00:07:23,880
Can you talk a little bit about how, just for our listeners, how to dispose of assets
113
00:07:23,880 --> 00:07:29,000
in an appropriate manner and, and, and the steps to take?
114
00:07:29,000 --> 00:07:33,720
Because I don't think that that's something that most people consider in the entire life
115
00:07:33,720 --> 00:07:36,760
cycle of, you know, a hardware asset.
116
00:07:36,760 --> 00:07:42,360
We could probably spend the next two hours on this topic because appropriate means a lot
117
00:07:42,360 --> 00:07:43,360
of things.
118
00:07:43,360 --> 00:07:47,120
And I think you hit it on the head is this isn't the sexiest part of IT.
119
00:07:47,120 --> 00:07:51,720
You know, as we work with customers and we work with primarily Fortune 5000 or we call
120
00:07:51,720 --> 00:07:59,480
cloud 500 customers, nobody is dying to talk about how to get rid of the assets.
121
00:07:59,480 --> 00:08:00,880
And let's spend all of our time on that.
122
00:08:00,880 --> 00:08:02,280
It's about, Hey, here's what's coming in.
123
00:08:02,280 --> 00:08:04,280
Here's the new thing we're going to go work on.
124
00:08:04,280 --> 00:08:10,200
Here's how we're transforming or, you know, changing things.
125
00:08:10,200 --> 00:08:14,960
And so this is really often less talked about for sure.
126
00:08:14,960 --> 00:08:17,360
And it's not given a lot of thought.
127
00:08:17,360 --> 00:08:23,120
And we think about appropriate, appropriate means a lot of things to a lot of companies
128
00:08:23,120 --> 00:08:27,520
and, and we can dissect this in the three ways we talk about it.
129
00:08:27,520 --> 00:08:30,760
So we think about it in three sort of areas.
130
00:08:30,760 --> 00:08:32,640
One you have the physical asset.
131
00:08:32,640 --> 00:08:36,920
So no matter what there is a physical asset that needs to be this, this position, whether
132
00:08:36,920 --> 00:08:41,960
that's a laptop, it's a server, whatever it is, it's physical, tangible, it touches.
133
00:08:41,960 --> 00:08:43,360
So we can talk about that.
134
00:08:43,360 --> 00:08:49,640
And we usually talk about environmental appropriateness on that, because really it's the physical
135
00:08:49,640 --> 00:08:51,280
components that make that up.
136
00:08:51,280 --> 00:08:56,600
The second aspect would be the data on the asset and the data on the asset isn't the
137
00:08:56,600 --> 00:08:58,000
same as the physical asset.
138
00:08:58,000 --> 00:09:02,320
It can be in some cases, but in other cases, you have to think about it because it's abstracted
139
00:09:02,320 --> 00:09:03,320
as ones and zeros.
140
00:09:03,320 --> 00:09:07,280
It's not the physical, Hey, I've disposed of this mobile phone.
141
00:09:07,280 --> 00:09:08,280
It's gone.
142
00:09:08,280 --> 00:09:09,280
It's not in my environment.
143
00:09:09,280 --> 00:09:11,040
Well, your data is still there.
144
00:09:11,040 --> 00:09:15,720
And so if you're not segmenting that as a corporate customer, then you're probably making
145
00:09:15,720 --> 00:09:19,160
some mistakes in the way you set up your disposition program.
146
00:09:19,160 --> 00:09:23,400
And then the third level is what we call the virtual asset, which is the embodiment of
147
00:09:23,400 --> 00:09:28,760
that asset, but really as the theory of the asset, which is what corporations typically
148
00:09:28,760 --> 00:09:29,960
keep track of.
149
00:09:29,960 --> 00:09:35,440
So they have this asset, its number, whether it's a serialized asset tag, whether it's
150
00:09:35,440 --> 00:09:39,000
to make model number on it, who it's assigned to, et cetera.
151
00:09:39,000 --> 00:09:42,400
It sits in either an ITSM or some similar system.
152
00:09:42,400 --> 00:09:46,440
And it's a lot of companies say, well, we've dispositioned it out of there.
153
00:09:46,440 --> 00:09:47,440
We're good.
154
00:09:47,440 --> 00:09:50,240
And so you've got to think about it at all three levels.
155
00:09:50,240 --> 00:09:55,040
And then we think about, so again, each of those three levels has its own aspect of it.
156
00:09:55,040 --> 00:09:57,760
So the virtual asset is really just the accounting of it.
157
00:09:57,760 --> 00:10:00,600
And so one is a corporate entity.
158
00:10:00,600 --> 00:10:04,840
You should keep track of where that asset is, where you think it is, the embodiment of
159
00:10:04,840 --> 00:10:06,840
it, because that's how you keep track of it.
160
00:10:06,840 --> 00:10:10,520
It doesn't mean that it's not sitting in a closet, but it's either in your environment,
161
00:10:10,520 --> 00:10:12,080
it's not in your environment.
162
00:10:12,080 --> 00:10:17,680
And in reality, you want that virtual asset to match what the physical asset and the data
163
00:10:17,680 --> 00:10:18,920
of the asset is.
164
00:10:18,920 --> 00:10:23,000
So all three of those should be in congruence.
165
00:10:23,000 --> 00:10:26,920
And so to us, that's where you put in the later of governance.
166
00:10:26,920 --> 00:10:30,800
And so ultimately you have this set of governance, that's all three aspects.
167
00:10:30,800 --> 00:10:35,840
So when we talk about appropriateness of it, so you must have a process for dispositioning
168
00:10:35,840 --> 00:10:39,440
the asset in your own ITSM, the virtual asset.
169
00:10:39,440 --> 00:10:42,920
And then a lot of times that's accounted for financially.
170
00:10:42,920 --> 00:10:44,520
The next piece is the physical asset.
171
00:10:44,520 --> 00:10:45,520
Where did it go?
172
00:10:45,520 --> 00:10:46,520
Do you know where it is?
173
00:10:46,520 --> 00:10:51,400
Do you have a physical record that you can then import back into that virtual asset that
174
00:10:51,400 --> 00:10:55,880
demonstrates who's taking it, where it's gone, when it was gone, et cetera.
175
00:10:55,880 --> 00:10:58,120
So we think of that a lot as chain of custody.
176
00:10:58,120 --> 00:11:05,320
So when somebody is to come pick up that asset or you are to take it to its next place, how
177
00:11:05,320 --> 00:11:06,800
do you have a record of that?
178
00:11:06,800 --> 00:11:11,840
Did you match and marry that record back up then to the virtual asset?
179
00:11:11,840 --> 00:11:16,520
And in theory, as a company, you're going to want to make sure that what you did with
180
00:11:16,520 --> 00:11:22,040
the physical aspect, as we're talking about appropriateness, matches whatever environmental
181
00:11:22,040 --> 00:11:24,080
compliance you're subject to.
182
00:11:24,080 --> 00:11:30,200
So fortunately or unfortunately, like in my view for the world and even for our businesses,
183
00:11:30,200 --> 00:11:35,440
there is not a federal law around disposition of electronic assets.
184
00:11:35,440 --> 00:11:38,920
So in my home state of Arizona, you want to throw it in the dump, you can throw it in
185
00:11:38,920 --> 00:11:39,920
the dump.
186
00:11:39,920 --> 00:11:40,920
It's not against the law.
187
00:11:40,920 --> 00:11:42,080
Is it the right thing for the environment?
188
00:11:42,080 --> 00:11:43,080
Probably not.
189
00:11:43,080 --> 00:11:44,760
Is it against the law in California?
190
00:11:44,760 --> 00:11:45,760
Absolutely.
191
00:11:45,760 --> 00:11:48,040
So you can, then there's no federal law.
192
00:11:48,040 --> 00:11:49,920
About half the states have laws.
193
00:11:49,920 --> 00:11:53,240
So as a company, you know, do you have governance?
194
00:11:53,240 --> 00:11:57,800
Knowing where that asset was, what state law you're bound to, and then marrying that back
195
00:11:57,800 --> 00:12:02,560
up now to your virtual asset for a record of it, should anything happen in the future?
196
00:12:02,560 --> 00:12:07,800
And then the third part and the part that we see the most risk and the most issues with
197
00:12:07,800 --> 00:12:10,360
is the data on the asset.
198
00:12:10,360 --> 00:12:14,240
Because people think, okay, I don't, it's not in my system anymore, or it's not in my
199
00:12:14,240 --> 00:12:15,480
building anymore.
200
00:12:15,480 --> 00:12:16,800
I'm done with it.
201
00:12:16,800 --> 00:12:21,960
Well, you can't see the data, but that data sits on the asset and just like you should
202
00:12:21,960 --> 00:12:27,760
have a record of the physical custody of the asset, you should have a record of the data
203
00:12:27,760 --> 00:12:29,000
on the asset.
204
00:12:29,000 --> 00:12:32,800
And so we talk about certificates of destruction and we provide those for our customers, which
205
00:12:32,800 --> 00:12:40,480
show when the data was eradicated, and that could be via software or it could be physical
206
00:12:40,480 --> 00:12:46,000
destruction, where that was, when it was, if there's a white blog to it, you can upload
207
00:12:46,000 --> 00:12:51,160
the white blog file, you can see what software was used, wasn't used, when it was, what technician
208
00:12:51,160 --> 00:12:53,400
did that, when they did it, all those kind of things.
209
00:12:53,400 --> 00:12:57,280
And again, that should be married back up to your virtual asset.
210
00:12:57,280 --> 00:13:03,760
One of the things that we see that's probably the most concerning to me is that many companies
211
00:13:03,760 --> 00:13:07,480
think they can indemnify themselves of the data on the asset.
212
00:13:07,480 --> 00:13:11,880
And this is probably like the, one of the strangest things are, you know, by the area
213
00:13:11,880 --> 00:13:17,120
that I see that we talk about appropriateness that companies miss.
214
00:13:17,120 --> 00:13:23,080
And company, if you create the data, you're, and again, you're bound by certain legislation,
215
00:13:23,080 --> 00:13:24,360
so I'll throw a few of them out there.
216
00:13:24,360 --> 00:13:27,760
Because Sarbanes, actually, so if you're a publicly traded company, you're going to be
217
00:13:27,760 --> 00:13:31,720
bound by a HIPAA, Fair Credit Reporting Act.
218
00:13:31,720 --> 00:13:34,560
People are like, okay, well, that doesn't, we're not a financial institution.
219
00:13:34,560 --> 00:13:37,840
Do you pull a credit report on your employees as part of their onboard, you know, prior
220
00:13:37,840 --> 00:13:38,840
to hire?
221
00:13:38,840 --> 00:13:39,840
Yes.
222
00:13:39,840 --> 00:13:41,520
Okay, that data is subject to that law.
223
00:13:41,520 --> 00:13:45,360
And if you can't segment where that data is stored, then it's probably better for you
224
00:13:45,360 --> 00:13:49,400
to assume that your entire company, all your data, all your servers, etc., are bound by
225
00:13:49,400 --> 00:13:50,400
that same aspect.
226
00:13:50,400 --> 00:13:51,400
Right.
227
00:13:51,400 --> 00:13:59,280
So what I'll say is that you as the data creator and the owner of it are basically responsible
228
00:13:59,280 --> 00:14:01,280
until the destruction of that data.
229
00:14:01,280 --> 00:14:05,840
So even if the asset's been sold, people are like, oh, I sold the asset, I got rid of it.
230
00:14:05,840 --> 00:14:07,320
I'm not on the hook anymore.
231
00:14:07,320 --> 00:14:08,320
Someone else is.
232
00:14:08,320 --> 00:14:12,920
That's not, you can't indemnify yourself for a legal liability.
233
00:14:12,920 --> 00:14:20,520
Yeah, I mean, I was just thinking about the last comment you made about data.
234
00:14:20,520 --> 00:14:26,960
I think from my experience, oftentimes the challenge is no, it's like the hot potato.
235
00:14:26,960 --> 00:14:30,960
No one wants to actually be the owner of the data.
236
00:14:30,960 --> 00:14:35,200
Even within business units, they're going, well, that, you know, IT doesn't own the data.
237
00:14:35,200 --> 00:14:37,080
The business line owns the data.
238
00:14:37,080 --> 00:14:38,520
And I didn't create that data.
239
00:14:38,520 --> 00:14:41,440
I'm just responsible for the systems that it resides on.
240
00:14:41,440 --> 00:14:44,120
And it's kind of like this hot potato.
241
00:14:44,120 --> 00:14:49,160
And I appreciate the way you, you laid it out because that's so important, especially
242
00:14:49,160 --> 00:14:55,840
with, and that's kind of like my next question about ensuring compliance, because more and
243
00:14:55,840 --> 00:15:01,720
more regulatory is focused on patient privacy, focused on, you know, breach notifications
244
00:15:01,720 --> 00:15:03,280
and things of that nature.
245
00:15:03,280 --> 00:15:10,880
So in this kind of asset life cycle, how can some of our listeners kind of understand how
246
00:15:10,880 --> 00:15:12,640
to ensure compliance?
247
00:15:12,640 --> 00:15:16,280
It seems like compliance is all over the place.
248
00:15:16,280 --> 00:15:20,800
You know, could you, could you, could you offer some guidance on how to ensure compliance?
249
00:15:20,800 --> 00:15:21,800
Yeah.
250
00:15:21,800 --> 00:15:24,560
So there's lots of ways to think about it.
251
00:15:24,560 --> 00:15:26,160
And it's a tough one.
252
00:15:26,160 --> 00:15:30,600
What I would advocate for most companies is if they even remotely think there's some
253
00:15:30,600 --> 00:15:36,480
sort of legislation that they need to adhere to for data compliance, my recommendation
254
00:15:36,480 --> 00:15:37,680
would be a handful of things.
255
00:15:37,680 --> 00:15:42,760
But first off, no matter what, just assume all of your data is bound to that and take
256
00:15:42,760 --> 00:15:45,200
steps to be compliant to that across all your data.
257
00:15:45,200 --> 00:15:49,480
If you do nothing else, assume that across your whole enterprise, whether that's your
258
00:15:49,480 --> 00:15:54,560
mobility, your data center, your end user compute, everything, and have a governed solution
259
00:15:54,560 --> 00:15:56,920
of here's how we're going to eliminate our data.
260
00:15:56,920 --> 00:15:58,200
And this is our process.
261
00:15:58,200 --> 00:16:02,080
So that doesn't matter who's debating whether they own the infrastructure or not, who owns
262
00:16:02,080 --> 00:16:06,680
the data as a, as a oversight, whether it's your CISO, whether it's your infrastructure
263
00:16:06,680 --> 00:16:12,240
team, however you have it, however you have a design, make that mandatory.
264
00:16:12,240 --> 00:16:16,000
And then, you know, if you looked at most of a lot of it, even boils down to if you
265
00:16:16,000 --> 00:16:20,640
want to look at federal legislation, you could just make the assumption that as long as you're
266
00:16:20,640 --> 00:16:26,320
using a vetted third party, they're adhering to best practices that you've done reference
267
00:16:26,320 --> 00:16:32,560
checks that you've, you know, investigated and done due diligence to some sort of vetting
268
00:16:32,560 --> 00:16:33,560
process.
269
00:16:33,560 --> 00:16:36,440
And again, you could probably download RFP templates online.
270
00:16:36,440 --> 00:16:40,480
I'm happy to talk to anybody if they wanted to go through some of the ways that we even
271
00:16:40,480 --> 00:16:44,480
have like a one page worksheet that we take customers through and like, hey, no matter
272
00:16:44,480 --> 00:16:46,640
what, like just do these things and you're covered.
273
00:16:46,640 --> 00:16:49,280
Like you have at least, if you're not doing this, you shouldn't sleep at night.
274
00:16:49,280 --> 00:16:51,600
Because as you're doing this, you can at least fall asleep.
275
00:16:51,600 --> 00:16:55,880
And then there's like various levels you can take it to.
276
00:16:55,880 --> 00:16:57,920
But you should make sure they're certified.
277
00:16:57,920 --> 00:17:01,200
So look at things like, so there's different certifications in Europe.
278
00:17:01,200 --> 00:17:07,640
A DISA is a big one from a security perspective in the domestically made, the National Association
279
00:17:07,640 --> 00:17:09,280
of Information Destruction.
280
00:17:09,280 --> 00:17:13,560
So making sure they're not a member, making sure that they're AAA certified.
281
00:17:13,560 --> 00:17:17,600
And then there's different certifications for what we call onsite or offsite.
282
00:17:17,600 --> 00:17:20,560
So again, it's like you're looking to ramp up your program.
283
00:17:20,560 --> 00:17:24,280
Like if you're saying, you know, what's the best way that's different than what's, you
284
00:17:24,280 --> 00:17:25,280
know, the minimum.
285
00:17:25,280 --> 00:17:29,400
And, you know, as an example, I think Morgan Stanley, and this one was pretty publicly
286
00:17:29,400 --> 00:17:35,240
available was find millions and millions and tens of millions of dollars for not taking
287
00:17:35,240 --> 00:17:40,720
these steps and they made the assumption that they hired somebody who's an IT asset disposition.
288
00:17:40,720 --> 00:17:45,240
They didn't do any reference checks, anybody, they subcontracted it out, we subcontracted
289
00:17:45,240 --> 00:17:47,840
it out to a moving company.
290
00:17:47,840 --> 00:17:53,320
The data shows up three years later that none of these devices were actually rat.
291
00:17:53,320 --> 00:17:56,600
The data was eradicated and Morgan Stanley is on the hook for it.
292
00:17:56,600 --> 00:18:00,160
And they're like, well, wait a second, this company bought these assets off me.
293
00:18:00,160 --> 00:18:01,640
Here's the bill of sale.
294
00:18:01,640 --> 00:18:04,240
They're like, well, your data doesn't matter.
295
00:18:04,240 --> 00:18:10,280
And so, I mean, you can go through example after example, and people, I think, think
296
00:18:10,280 --> 00:18:13,040
that because somebody else took it, it's not my problem.
297
00:18:13,040 --> 00:18:14,040
And we see it a lot in HIPAA.
298
00:18:14,040 --> 00:18:19,160
One of the ones I saw was most intriguing to me was companies had leased assets.
299
00:18:19,160 --> 00:18:20,160
They were photocopiers.
300
00:18:20,160 --> 00:18:24,640
A lot of people don't know that photocopiers have hard drives in them and store data.
301
00:18:24,640 --> 00:18:27,920
They were scanning patient data in there.
302
00:18:27,920 --> 00:18:29,240
The leasing company took them back.
303
00:18:29,240 --> 00:18:32,040
And we're like, well, we made the assumption that the leasing company takes care of that
304
00:18:32,040 --> 00:18:33,960
because we didn't own the asset.
305
00:18:33,960 --> 00:18:36,400
We've never owned the asset.
306
00:18:36,400 --> 00:18:40,080
The leasing company just gets rid of them however they, you know, hey, we have a mechanism
307
00:18:40,080 --> 00:18:41,680
to get rid of these things.
308
00:18:41,680 --> 00:18:46,760
That data comes back out and they went and hit everybody along the chain.
309
00:18:46,760 --> 00:18:48,080
So that's intense.
310
00:18:48,080 --> 00:19:01,000
Well, hey, I know that you were recently awarded, you know, Momentum 100 CEO this past year.
311
00:19:01,000 --> 00:19:05,120
Sort of just being a CEO that is a force of good.
312
00:19:05,120 --> 00:19:16,120
So my question revolves around if our listeners are interested in the environmental aspects
313
00:19:16,120 --> 00:19:24,800
of disposition, ensuring that they look at the recycling and the reuse of these devices
314
00:19:24,800 --> 00:19:27,560
so that they don't have an environmental impact.
315
00:19:27,560 --> 00:19:28,880
Can you comment on that?
316
00:19:28,880 --> 00:19:30,120
How you handle that?
317
00:19:30,120 --> 00:19:31,120
How you look at that?
318
00:19:31,120 --> 00:19:32,120
Yeah, absolutely.
319
00:19:32,120 --> 00:19:37,080
And so again, most of the things we talk about are really on those three levels of, you know,
320
00:19:37,080 --> 00:19:40,400
the physical, the virtual and the data of the asset.
321
00:19:40,400 --> 00:19:44,480
So on the physical side, you don't want to make sure that any company you deal with from
322
00:19:44,480 --> 00:19:50,120
an environmental standpoint is certified either R2B3, which is responsible recycling
323
00:19:50,120 --> 00:19:53,760
and it adheres to everything they do.
324
00:19:53,760 --> 00:19:56,360
They can't just kind of pick and choose.
325
00:19:56,360 --> 00:19:59,400
This part was certified and this part wasn't.
326
00:19:59,400 --> 00:20:01,600
So that's one certification.
327
00:20:01,600 --> 00:20:07,600
The other one is E-Stewards and both of them have very well vetted out processes that take
328
00:20:07,600 --> 00:20:16,720
everything from the original asset all the way to and it applies all the way to the components
329
00:20:16,720 --> 00:20:18,440
are into the ROS form.
330
00:20:18,440 --> 00:20:22,240
So as an example, if you wanted to, you can go back and take any of those certified companies
331
00:20:22,240 --> 00:20:27,880
and see where the circuit board ends up and who's smelting the metal out of it.
332
00:20:27,880 --> 00:20:31,440
So it's to ensure that nowhere that there's not these leaks out of the side.
333
00:20:31,440 --> 00:20:34,880
Well, I dealt with the certified company, but yeah, these things ended up in a landfill
334
00:20:34,880 --> 00:20:36,560
in Africa.
335
00:20:36,560 --> 00:20:38,800
So those would be the starting point.
336
00:20:38,800 --> 00:20:43,480
And then the most important thing I think that's different that I would advocate and
337
00:20:43,480 --> 00:20:49,040
a lot of companies don't adhere to this or don't believe in it, but they get really wrapped
338
00:20:49,040 --> 00:20:53,520
around this recycle aspect and saying, okay, well, we're going to ensure everything's recycled.
339
00:20:53,520 --> 00:20:54,520
And that's great.
340
00:20:54,520 --> 00:21:00,160
So what we really want to focus on and what we really need to drive as a country, as individuals,
341
00:21:00,160 --> 00:21:03,520
as organizations, and as a world is around reuse.
342
00:21:03,520 --> 00:21:07,320
And so what is the next best use of that device?
343
00:21:07,320 --> 00:21:13,920
What's its next most useful life cycle and driving the asset towards that?
344
00:21:13,920 --> 00:21:20,160
So what good is it to take a and some of the OEMs is where I have a lot of angst with them
345
00:21:20,160 --> 00:21:21,960
is, you know, they'll mandate shred.
346
00:21:21,960 --> 00:21:26,800
So they'll take out a network device and if it's on smart, if it's not on smart net,
347
00:21:26,800 --> 00:21:28,840
it's not supported, then I'm going to go take it.
348
00:21:28,840 --> 00:21:31,160
I'm going to force it and we put it back in.
349
00:21:31,160 --> 00:21:32,160
We're going to lease it to you.
350
00:21:32,160 --> 00:21:34,760
We're going to take it and we're going to shred them off and we're going to recycle all the
351
00:21:34,760 --> 00:21:35,760
metal.
352
00:21:35,760 --> 00:21:37,480
But what is the embedded energy cost?
353
00:21:37,480 --> 00:21:39,800
What, you know, could that thing be better used for that?
354
00:21:39,800 --> 00:21:41,720
Could it still work for another three years?
355
00:21:41,720 --> 00:21:45,840
Could it be, you know, and again, it doesn't help with product sales and I understand that
356
00:21:45,840 --> 00:21:49,840
and it doesn't help with some of the other aspects, but more and more, we need to make
357
00:21:49,840 --> 00:21:57,560
things that available to move into their next most useful life, not lock out the firmware,
358
00:21:57,560 --> 00:22:00,160
make things more replaceable.
359
00:22:00,160 --> 00:22:03,440
You know, so again, we're really supportive of a lot of the things out there, right to
360
00:22:03,440 --> 00:22:10,800
repair some of the other legislation that makes it easier for IT assets to be reused
361
00:22:10,800 --> 00:22:12,600
in another life cycle.
362
00:22:12,600 --> 00:22:13,600
Yeah, yeah.
363
00:22:13,600 --> 00:22:16,400
No, thank you.
364
00:22:16,400 --> 00:22:18,800
That's really, that's great comment.
365
00:22:18,800 --> 00:22:23,880
I wanted to shift gears a little bit and talk a little bit about any experiences you might
366
00:22:23,880 --> 00:22:30,120
have with medical devices and or kind of the Internet of things because the IoT seems to
367
00:22:30,120 --> 00:22:38,160
be, you know, something that is beginning to push out large and larger numbers of devices
368
00:22:38,160 --> 00:22:45,520
that in my humble estimation seem to have shorter life cycles.
369
00:22:45,520 --> 00:22:51,280
You know, when it comes to Wi-Fi access points or when it comes to, you know, these devices
370
00:22:51,280 --> 00:22:54,480
that are in these healthcare organizations.
371
00:22:54,480 --> 00:23:01,760
So can you talk a little bit about that, whether it's the Internet of Medical Things or IoT
372
00:23:01,760 --> 00:23:06,920
specific, is this something that you're seeing and any comments that you can make around
373
00:23:06,920 --> 00:23:07,920
those?
374
00:23:07,920 --> 00:23:10,000
Yeah, so it's that's a tough one.
375
00:23:10,000 --> 00:23:11,960
We are seeing more Internet of Things.
376
00:23:11,960 --> 00:23:16,880
We're seeing that proliferation of devices and, you know, again, the tough part with
377
00:23:16,880 --> 00:23:22,360
those is one is there's not usually, and it's hard to find a useful life for those afterwards.
378
00:23:22,360 --> 00:23:26,480
Two is that they're all have little batteries in them, which make them very difficult to
379
00:23:26,480 --> 00:23:28,040
recycle.
380
00:23:28,040 --> 00:23:29,840
And so it's like a burgeoning problem.
381
00:23:29,840 --> 00:23:35,480
It hasn't quite reared its ugly head yet, but that I think is going to be, and we talk
382
00:23:35,480 --> 00:23:38,360
about it, we see some of those devices.
383
00:23:38,360 --> 00:23:43,040
It's really hard to decide what to do, how to do, and then really get back to the other
384
00:23:43,040 --> 00:23:45,320
question of what data is on those things.
385
00:23:45,320 --> 00:23:50,000
So we also see, and I use, I won't use an Internet of Things, but a lot of router switches,
386
00:23:50,000 --> 00:23:54,480
things that don't have even moving parts, really, you know, people, their network passwords
387
00:23:54,480 --> 00:23:57,200
are loaded in there and there's levels.
388
00:23:57,200 --> 00:24:02,320
There's like three different levels of data on network switches, an example, and getting
389
00:24:02,320 --> 00:24:06,800
rid of all of those is complicated and expensive.
390
00:24:06,800 --> 00:24:10,240
And I think that you're going to see more problems with like the Internet of Things,
391
00:24:10,240 --> 00:24:13,440
because those passwords are embedded on there.
392
00:24:13,440 --> 00:24:16,680
There's, it's a very low cost item.
393
00:24:16,680 --> 00:24:20,320
And so they're probably, again, this is, I'm not, it's out of my wheelhouse a little bit,
394
00:24:20,320 --> 00:24:24,520
but the security level of what people are paying attention to and how they're managing those,
395
00:24:24,520 --> 00:24:30,000
I think is much less than what they consider their quote unquote critical infrastructure
396
00:24:30,000 --> 00:24:33,880
that has to pass different, you know, kind of security protocols in most companies.
397
00:24:33,880 --> 00:24:39,280
You know, you mentioned earlier, just as you were talking, I thought about it, you know,
398
00:24:39,280 --> 00:24:40,280
asset management.
399
00:24:40,280 --> 00:24:46,920
And, and I think one of your points was, know where all of your assets are.
400
00:24:46,920 --> 00:24:55,720
Do you come across ever in scenarios where customers struggle with that?
401
00:24:55,720 --> 00:24:57,160
And why would that be the case?
402
00:24:57,160 --> 00:25:02,480
I mean, you know, you think about it in the sense, I think about it in the sense of my
403
00:25:02,480 --> 00:25:04,720
home and protecting my home.
404
00:25:04,720 --> 00:25:10,160
And there's certain things in my home that I find to be irreplaceable, right?
405
00:25:10,160 --> 00:25:13,320
My critical assets.
406
00:25:13,320 --> 00:25:18,640
And most of those are a little intangible, like pictures of lost loved ones and things
407
00:25:18,640 --> 00:25:19,640
like that.
408
00:25:19,640 --> 00:25:23,760
Organizations themselves have that same kind of criticality of asset.
409
00:25:23,760 --> 00:25:25,120
It can be intellectual property.
410
00:25:25,120 --> 00:25:30,080
It can be, it always is in some form of data.
411
00:25:30,080 --> 00:25:36,880
But do you find that from a physical asset organization struggle with that?
412
00:25:36,880 --> 00:25:42,280
And why would you, you know, if you could share your opinion on why you think folks have that
413
00:25:42,280 --> 00:25:44,680
difficulty with asset management?
414
00:25:44,680 --> 00:25:45,680
It's almost impossible.
415
00:25:45,680 --> 00:25:46,680
Every company has that problem.
416
00:25:46,680 --> 00:25:49,440
I mean, it is, I mean, I'll speak for myself.
417
00:25:49,440 --> 00:25:52,480
I just, even this is my business.
418
00:25:52,480 --> 00:25:54,080
And usually people come and visit me.
419
00:25:54,080 --> 00:25:58,320
They usually bring me a couple of hard drives and old cell phone and old mobile phone and
420
00:25:58,320 --> 00:25:59,960
they usually drop them off, right?
421
00:25:59,960 --> 00:26:03,880
And so I know that, like I just came across our own drawer the other day, like, where
422
00:26:03,880 --> 00:26:05,520
did this Nokia phone come from?
423
00:26:05,520 --> 00:26:10,160
And I'm sure it has pictures on it of my daughter when she was born, you know, 12 years ago.
424
00:26:10,160 --> 00:26:11,160
All right.
425
00:26:11,160 --> 00:26:15,960
Since you mentioned it, Aaron, I'm going to bring this and this one when I come to visit
426
00:26:15,960 --> 00:26:16,960
you.
427
00:26:16,960 --> 00:26:17,960
Okay.
428
00:26:17,960 --> 00:26:18,960
Perfect.
429
00:26:18,960 --> 00:26:20,600
We all have one, right?
430
00:26:20,600 --> 00:26:23,200
And, you know, like, did you keep track of it?
431
00:26:23,200 --> 00:26:25,480
It was, you know, it was probably expensive when you bought it.
432
00:26:25,480 --> 00:26:28,720
And it never, it's probably the hardest thing.
433
00:26:28,720 --> 00:26:32,960
I mean, you have employees that bought stuff on a credit card and they put it in the drawer
434
00:26:32,960 --> 00:26:35,440
and then, or something wasn't accounted for.
435
00:26:35,440 --> 00:26:39,560
I mean, we do, we run a box program for a large software development company.
436
00:26:39,560 --> 00:26:43,120
And when their employees are terminated or quit for any work from home employees, we
437
00:26:43,120 --> 00:26:46,280
send a box to collect their assets.
438
00:26:46,280 --> 00:26:49,480
And they're also supposed to throw in their badge or credit card, a couple of other things.
439
00:26:49,480 --> 00:26:55,800
I would tell you probably, I don't know, it's, it happens every week, but we get personal
440
00:26:55,800 --> 00:26:57,040
assets in there as well.
441
00:26:57,040 --> 00:26:58,040
People just throw in other things.
442
00:26:58,040 --> 00:27:00,320
And I even know like, is this the company's asset or not?
443
00:27:00,320 --> 00:27:04,080
I mean, we end up with a laptop, a MacBook, and we'd be like, Hey, this one's not on the
444
00:27:04,080 --> 00:27:05,080
list.
445
00:27:05,080 --> 00:27:07,800
And then the company goes back and forth and we try to figure it out.
446
00:27:07,800 --> 00:27:13,800
I mean, it is, it's all those things that people buy, take out, or they don't account
447
00:27:13,800 --> 00:27:14,800
for it.
448
00:27:14,800 --> 00:27:17,080
I mean, it's hard.
449
00:27:17,080 --> 00:27:24,360
And we attend the IT asset management, ITAM, there's a certification and an association
450
00:27:24,360 --> 00:27:27,840
around it, the International Association of IT Asset Management.
451
00:27:27,840 --> 00:27:30,800
We have a number of individuals on our team that are certified in it.
452
00:27:30,800 --> 00:27:33,040
We help companies go through that.
453
00:27:33,040 --> 00:27:36,680
And like anytime you think it should be easier, there should be a process, there's always
454
00:27:36,680 --> 00:27:38,040
an exception to it.
455
00:27:38,040 --> 00:27:41,680
And when you get into companies with 10,000 employees, you start multiplying the exceptions.
456
00:27:41,680 --> 00:27:44,080
And it's, you know, they acquire companies.
457
00:27:44,080 --> 00:27:47,480
They don't know what the, you know, we have one company we work with every time they acquire
458
00:27:47,480 --> 00:27:50,920
a company, we go to a physical asset count on site.
459
00:27:50,920 --> 00:27:54,600
So they start with like, Hey, we have no idea what they, we have an idea of what they have.
460
00:27:54,600 --> 00:27:56,040
Here's what they told us.
461
00:27:56,040 --> 00:28:00,680
We need somebody to go on site, count them all and match all the serial numbers.
462
00:28:00,680 --> 00:28:04,560
And then you run, I mean, you run into things like if you were to replace the motherboard,
463
00:28:04,560 --> 00:28:07,120
it's going to read as a separate serial number.
464
00:28:07,120 --> 00:28:08,760
So all of a sudden you've lost this matchup.
465
00:28:08,760 --> 00:28:11,560
I mean, I mean, we've seen so many things.
466
00:28:11,560 --> 00:28:13,560
It is the, it'll never be perfect.
467
00:28:13,560 --> 00:28:15,400
It'll never be reconciled.
468
00:28:15,400 --> 00:28:20,360
I think there is a better chance is, get a little out there, but like the blockchain
469
00:28:20,360 --> 00:28:21,680
could probably help.
470
00:28:21,680 --> 00:28:27,200
So you have, you know, the processes to register it and you can keep track of it.
471
00:28:27,200 --> 00:28:31,200
And so I've seen some interesting ideas and thoughts around it, but I don't see it going
472
00:28:31,200 --> 00:28:32,200
away anytime soon.
473
00:28:32,200 --> 00:28:40,880
And all you can do as a company is hope to do your best and create processes and inspection
474
00:28:40,880 --> 00:28:46,800
points to ensure that the quality is as high as possible, but you know, it's massively impossible.
475
00:28:46,800 --> 00:28:53,400
Well, so, you know, you brought up the three aspects, physical data, and then the virtual
476
00:28:53,400 --> 00:29:00,440
aspect of that, that asset theory of that asset.
477
00:29:00,440 --> 00:29:06,840
If you were to share like one or two things that are most critical for our listeners,
478
00:29:06,840 --> 00:29:13,680
kind of as we wrap all of this up, what would you suggest that they do with respect to their
479
00:29:13,680 --> 00:29:15,480
current asset inventory?
480
00:29:15,480 --> 00:29:18,200
So I'm going to make two suggestions.
481
00:29:18,200 --> 00:29:20,480
One is like, kind of, hey, this is what you should do no matter what.
482
00:29:20,480 --> 00:29:27,400
And here is if you're, if you want to be best in class, there's a simple thing you can do.
483
00:29:27,400 --> 00:29:31,080
So the first one is no matter what, you should get your different groups together.
484
00:29:31,080 --> 00:29:35,680
However you think about that in your organization, whether you have an infrastructure group and
485
00:29:35,680 --> 00:29:43,480
a, you know, an end user compute group, or if you have, you know, security over here
486
00:29:43,480 --> 00:29:44,880
and physical assets over here.
487
00:29:44,880 --> 00:29:49,000
Whatever you do, get the different groups together and come up with governance to handle
488
00:29:49,000 --> 00:29:50,000
those three aspects.
489
00:29:50,000 --> 00:29:52,560
Here's how we're going to count for our virtual asset.
490
00:29:52,560 --> 00:29:57,280
Here's what we're going to mandate across all locations, all assets for a data destruction
491
00:29:57,280 --> 00:29:58,280
policy.
492
00:29:58,280 --> 00:30:02,400
And here's what we're going to do from an environmental or physical disposition.
493
00:30:02,400 --> 00:30:06,760
So get those groups together, get them talking, get them conversing and come up with something
494
00:30:06,760 --> 00:30:10,320
that you're going to apply universally across the company.
495
00:30:10,320 --> 00:30:12,680
And if there needs to be exceptions, figure that out as it goes.
496
00:30:12,680 --> 00:30:18,720
But you know, like a lot of times we see mobility handled by, you know, HR or it's in this onboarding
497
00:30:18,720 --> 00:30:22,600
process and it's just completely outside of IT because we have corporate liable phones
498
00:30:22,600 --> 00:30:27,040
and certain titles get them and then it's like those are totally on their own.
499
00:30:27,040 --> 00:30:31,760
So again, bring all your IT assets, have some sort of governance.
500
00:30:31,760 --> 00:30:36,120
And as long as you do that, you're going to be better than 90% of the companies out there,
501
00:30:36,120 --> 00:30:39,840
even Fortune 5000 companies, I tell you.
502
00:30:39,840 --> 00:30:45,320
If you want, if your data, and the next one kind of moves to the data side and you want
503
00:30:45,320 --> 00:30:52,200
best in class, the easiest solution is to work with a provider that does, and it's not
504
00:30:52,200 --> 00:31:02,240
a huge incremental cost, it does cost more, but erase, destroy all your data on site before
505
00:31:02,240 --> 00:31:05,480
it leaves your four walls of your buildings.
506
00:31:05,480 --> 00:31:12,160
Like that's probably, like if you did that, you know, you're just dramatically reduced
507
00:31:12,160 --> 00:31:16,600
down, could the re-arrows, could things slip out maybe, but you've dramatically reduced
508
00:31:16,600 --> 00:31:18,240
what your exposure is.
509
00:31:18,240 --> 00:31:23,800
And so best practice would be, you know, if you have a help desk that swaps PCs in and
510
00:31:23,800 --> 00:31:28,600
out, laptops in and out before those leave, quarantine them all together and then have
511
00:31:28,600 --> 00:31:30,240
some come on site and wipe them off.
512
00:31:30,240 --> 00:31:35,800
For your data center, same thing, you know, either get a locker, and we do this a lot
513
00:31:35,800 --> 00:31:40,040
of customers, even in their third party, like Kogo facilities, is we provide a storage bin
514
00:31:40,040 --> 00:31:45,000
of some sort of lockable thing, or we do ones that like some of the large Kogos in Vegas,
515
00:31:45,000 --> 00:31:50,320
where I don't care who you are, you drop it in there with a tag and it all stays in this
516
00:31:50,320 --> 00:31:54,920
box and we come on once a month and we erase all of them or we destroy them all for all
517
00:31:54,920 --> 00:31:55,920
a fail.
518
00:31:55,920 --> 00:31:58,320
And like you don't want any data leaving that facility.
519
00:31:58,320 --> 00:32:04,160
You know, those are great recommendations.
520
00:32:04,160 --> 00:32:05,360
I really appreciate it.
521
00:32:05,360 --> 00:32:09,080
Aaron, thank you for your insights.
522
00:32:09,080 --> 00:32:10,640
That's all for this episode.
523
00:32:10,640 --> 00:32:30,160
Make sure you tune in the next time, logically speaking, and stay cyber first and future ready.
00:00:00,000 --> 00:00:12,640
Welcome to Logically Speaking, where we discuss the latest trends and challenges in cybersecurity
2
00:00:12,640 --> 00:00:15,360
with the top experts in their field.
3
00:00:15,360 --> 00:00:19,520
You're going to learn how to keep your data safe, your operations sound, and your business
4
00:00:19,520 --> 00:00:21,520
ready for whatever comes next.
5
00:00:21,520 --> 00:00:23,680
This is Logically Speaking.
6
00:00:23,680 --> 00:00:26,160
Today we have the pleasure of speaking with Aaron Zepper.
7
00:00:26,160 --> 00:00:33,560
He's the CEO of DMD Security Systems Recovery, which is an IT asset disposition company.
8
00:00:33,560 --> 00:00:39,400
They provide solutions that adhere to some of the industry's most rigorous environmental
9
00:00:39,400 --> 00:00:41,560
and security standards.
10
00:00:41,560 --> 00:00:49,320
Aaron was recently recognized as Momentum's 100 CEO in 2023, which honors CEOs who often
11
00:00:49,320 --> 00:00:54,120
champion new visions of capitalism and is measured by a force of good ranking.
12
00:00:54,120 --> 00:00:57,040
So congratulations for that, Aaron.
13
00:00:57,040 --> 00:01:03,640
And prior to his position at DMD, he was an executive leader in IT industries for over
14
00:01:03,640 --> 00:01:10,800
20 years with companies such as IBM, Insight, Tech Data, where he led sales, marketing,
15
00:01:10,800 --> 00:01:11,800
operations.
16
00:01:11,800 --> 00:01:15,520
Aaron, thank you very much for taking some time to join us.
17
00:01:15,520 --> 00:01:20,240
I was hoping that you'd be able to share with our listeners about your experience and how
18
00:01:20,240 --> 00:01:27,440
you got into this IT space, because I think most of our listeners find it very interesting
19
00:01:27,440 --> 00:01:32,360
to find people's journeys into this world of IT.
20
00:01:32,360 --> 00:01:34,800
So if you wouldn't mind starting there, that'd be great.
21
00:01:34,800 --> 00:01:35,800
Absolutely.
22
00:01:35,800 --> 00:01:40,240
So it started over 20 years ago, which seems like a hard thing to say sometimes, but before
23
00:01:40,240 --> 00:01:45,920
that I was waiting tables, bartending, and I actually took an inside sales job at a large
24
00:01:45,920 --> 00:01:48,040
bar, basically.
25
00:01:48,040 --> 00:01:51,520
And found that I like sales, found that it was interesting.
26
00:01:51,520 --> 00:01:58,120
I was learning something new around IT sales, technology, learning about PCs, servers, laptops,
27
00:01:58,120 --> 00:02:03,920
and that just spawned a career that led me to be, I was pretty successful at sales, and
28
00:02:03,920 --> 00:02:09,560
then it led to sales management, and it led to leading sales groups, got into product
29
00:02:09,560 --> 00:02:15,920
management, got into operations, and switched out a few times from product into software
30
00:02:15,920 --> 00:02:20,200
then into services and things that I kind of learned along the way, and then it moved
31
00:02:20,200 --> 00:02:21,400
into a SaaS company.
32
00:02:21,400 --> 00:02:25,320
But one of the things a lot of my mentors always said was, keep going to where the margin
33
00:02:25,320 --> 00:02:26,320
is.
34
00:02:26,320 --> 00:02:30,520
And so you look at the margin in product, and it was small, then it was like, well, you
35
00:02:30,520 --> 00:02:33,360
want to be in software, a better margin, so you resold software.
36
00:02:33,360 --> 00:02:36,200
And it's like, no, no, you want to be in services.
37
00:02:36,200 --> 00:02:41,360
And then funny anecdote was, as I was looking to leave and go to a small data center services
38
00:02:41,360 --> 00:02:45,400
company, one of my mentors took me aside and he goes, now what you really want to do is
39
00:02:45,400 --> 00:02:46,400
open a bar.
40
00:02:46,400 --> 00:02:50,160
He goes, once you, because he's like, the problem with our industry is everything you
41
00:02:50,160 --> 00:02:52,320
learn within five years, it's completely outdated.
42
00:02:52,320 --> 00:02:54,480
So you have to replace the entire body of knowledge.
43
00:02:54,480 --> 00:02:58,160
Once you know how to make a martini, you know how to make a martini forever.
44
00:02:58,160 --> 00:03:03,960
I was like, wait a second, I got out of that just to go do something more interesting.
45
00:03:03,960 --> 00:03:05,240
That's really great advice.
46
00:03:05,240 --> 00:03:09,640
I never thought of it that way, but that's really great advice.
47
00:03:09,640 --> 00:03:15,280
It's funny when you said bar, I thought you said bar, and then I heard martini and I thought,
48
00:03:15,280 --> 00:03:18,320
he's got it right.
49
00:03:18,320 --> 00:03:22,440
You could always perfect a martini.
50
00:03:22,440 --> 00:03:30,200
So I'd also like to get your perspective on how the tech landscape has been evolving.
51
00:03:30,200 --> 00:03:33,240
You've been in it for 20 years.
52
00:03:33,240 --> 00:03:37,440
Maybe share a little bit about how you've seen that evolution and how you might see
53
00:03:37,440 --> 00:03:40,120
the evolution of it coming.
54
00:03:40,120 --> 00:03:44,160
If you had a crystal ball, what that would look like in the years to come.
55
00:03:44,160 --> 00:03:45,800
Yeah, that's an interesting question.
56
00:03:45,800 --> 00:03:46,800
There's so many perspectives.
57
00:03:46,800 --> 00:03:48,760
I think you can take that from.
58
00:03:48,760 --> 00:03:53,600
One of the ones that I rely on a lot is, I think of it really a lot as a pendulum.
59
00:03:53,600 --> 00:03:58,360
So as I think of how I look at the industry and the pendulum being from centralized to
60
00:03:58,360 --> 00:04:02,440
decentralized, and then you can apply that same pendulum into different aspects of the
61
00:04:02,440 --> 00:04:03,920
IT landscape.
62
00:04:03,920 --> 00:04:08,840
So when I was first getting into the industry, it was the PC on every desktop.
63
00:04:08,840 --> 00:04:13,560
So before that, there was a lot of centralized mainframes, thin clients, and so everything
64
00:04:13,560 --> 00:04:14,560
was locked down.
65
00:04:14,560 --> 00:04:16,840
Then they put PCs everywhere and it's great.
66
00:04:16,840 --> 00:04:21,120
You can have a CD-ROM, you can download music, you can download your MP3s, you can burn
67
00:04:21,120 --> 00:04:22,120
them.
68
00:04:22,120 --> 00:04:24,360
Then all of a sudden the corporate America was like, we got to shut that down.
69
00:04:24,360 --> 00:04:28,120
There's all these security risks, there's problems with what our employees are doing.
70
00:04:28,120 --> 00:04:32,080
So basically they took a PC that had all this functionality, locked it back down to make
71
00:04:32,080 --> 00:04:33,880
it more like a thin client.
72
00:04:33,880 --> 00:04:38,040
And then it's like, well, wait a second, we got to distribute what people work on.
73
00:04:38,040 --> 00:04:43,400
And so as the things that we've gone into, sorry, out of the data center services group,
74
00:04:43,400 --> 00:04:46,600
we were worried, oh, the cloud's going to destroy this business.
75
00:04:46,600 --> 00:04:47,920
Everything's going to move to the cloud.
76
00:04:47,920 --> 00:04:53,440
And I mean, I've been, the cloud conversations are going on since probably 2007 and in a large
77
00:04:53,440 --> 00:04:55,080
way that I've been dealing with.
78
00:04:55,080 --> 00:04:58,640
And every year it's like, oh, we're going to move all the applications.
79
00:04:58,640 --> 00:05:02,160
And every time I look at the things that are on it, we still hardly have any applications
80
00:05:02,160 --> 00:05:04,360
in the cloud as a thing.
81
00:05:04,360 --> 00:05:09,600
And so, and then we see, even like exchange moves all into the cloud or your outlook,
82
00:05:09,600 --> 00:05:12,040
whatever you want to call it, your mail client.
83
00:05:12,040 --> 00:05:17,360
And then, well, for backup recovery purposes and continuity purposes, it's really cheap
84
00:05:17,360 --> 00:05:19,240
to put an on-premise backup online.
85
00:05:19,240 --> 00:05:22,400
So in case you're ever down and sorry, I see a lot of companies adopt that.
86
00:05:22,400 --> 00:05:27,320
It's like, wait a second, I thought we offloaded all this to be centralized and now we're decentralizing
87
00:05:27,320 --> 00:05:28,320
it.
88
00:05:28,320 --> 00:05:33,280
And so, you know, at the end of the day, to me, it's, there's always change.
89
00:05:33,280 --> 00:05:36,840
And no matter what in technology, there's going to be a new or better way.
90
00:05:36,840 --> 00:05:42,280
And that new change brings new sets of services, new offerings, new challenges, and we just
91
00:05:42,280 --> 00:05:44,600
keep going back and forth along those pendulums.
92
00:05:44,600 --> 00:05:46,880
Yeah, that's a great way to look at it.
93
00:05:46,880 --> 00:05:49,600
Yeah, you mentioned cloud migrations.
94
00:05:49,600 --> 00:05:57,320
I'm interested to, have you seen certain industries be faster to adopt cloud migrations?
95
00:05:57,320 --> 00:06:03,120
So I mean, I think it's like anything, and just in my course of the last five to 10 years,
96
00:06:03,120 --> 00:06:07,320
probably what I've seen is, you know, the older the company is, the larger the company
97
00:06:07,320 --> 00:06:11,240
is, the less likely they are to be able to move everything to the cloud.
98
00:06:11,240 --> 00:06:14,160
So you end up with companies that are, quote unquote, we're bored in the cloud.
99
00:06:14,160 --> 00:06:20,160
So if you're a startup, people aren't dying or clamoring to create their own infrastructure.
100
00:06:20,160 --> 00:06:23,200
And then when they get to scale, they might look at moving off that.
101
00:06:23,200 --> 00:06:28,640
And then the flip side of it, large companies, they've had this infrastructure, they have
102
00:06:28,640 --> 00:06:32,760
applications, custom built, home grown, whatever you want to say, that are critical to their
103
00:06:32,760 --> 00:06:33,760
business.
104
00:06:33,760 --> 00:06:37,360
And it's so difficult to move them into the cloud that, you know, you're going to end
105
00:06:37,360 --> 00:06:42,120
up with a hybrid, I think you're going to end up with a hybrid mode in almost both cases
106
00:06:42,120 --> 00:06:44,040
as companies get to mass.
107
00:06:44,040 --> 00:06:50,600
So, yeah, but, you know, I wanted to talk a little bit about, because a lot of a big
108
00:06:50,600 --> 00:06:55,240
portion of your business is disposition of, of IT assets.
109
00:06:55,240 --> 00:07:04,560
And I read a study recently that stated that 69% of organizations report falling victim
110
00:07:04,560 --> 00:07:10,520
to at least an exploit that originated from an asset that either was disposed and the
111
00:07:10,520 --> 00:07:17,960
data was exfiltrated or, or didn't dispose of it properly.
112
00:07:17,960 --> 00:07:23,880
Can you talk a little bit about how, just for our listeners, how to dispose of assets
113
00:07:23,880 --> 00:07:29,000
in an appropriate manner and, and, and the steps to take?
114
00:07:29,000 --> 00:07:33,720
Because I don't think that that's something that most people consider in the entire life
115
00:07:33,720 --> 00:07:36,760
cycle of, you know, a hardware asset.
116
00:07:36,760 --> 00:07:42,360
We could probably spend the next two hours on this topic because appropriate means a lot
117
00:07:42,360 --> 00:07:43,360
of things.
118
00:07:43,360 --> 00:07:47,120
And I think you hit it on the head is this isn't the sexiest part of IT.
119
00:07:47,120 --> 00:07:51,720
You know, as we work with customers and we work with primarily Fortune 5000 or we call
120
00:07:51,720 --> 00:07:59,480
cloud 500 customers, nobody is dying to talk about how to get rid of the assets.
121
00:07:59,480 --> 00:08:00,880
And let's spend all of our time on that.
122
00:08:00,880 --> 00:08:02,280
It's about, Hey, here's what's coming in.
123
00:08:02,280 --> 00:08:04,280
Here's the new thing we're going to go work on.
124
00:08:04,280 --> 00:08:10,200
Here's how we're transforming or, you know, changing things.
125
00:08:10,200 --> 00:08:14,960
And so this is really often less talked about for sure.
126
00:08:14,960 --> 00:08:17,360
And it's not given a lot of thought.
127
00:08:17,360 --> 00:08:23,120
And we think about appropriate, appropriate means a lot of things to a lot of companies
128
00:08:23,120 --> 00:08:27,520
and, and we can dissect this in the three ways we talk about it.
129
00:08:27,520 --> 00:08:30,760
So we think about it in three sort of areas.
130
00:08:30,760 --> 00:08:32,640
One you have the physical asset.
131
00:08:32,640 --> 00:08:36,920
So no matter what there is a physical asset that needs to be this, this position, whether
132
00:08:36,920 --> 00:08:41,960
that's a laptop, it's a server, whatever it is, it's physical, tangible, it touches.
133
00:08:41,960 --> 00:08:43,360
So we can talk about that.
134
00:08:43,360 --> 00:08:49,640
And we usually talk about environmental appropriateness on that, because really it's the physical
135
00:08:49,640 --> 00:08:51,280
components that make that up.
136
00:08:51,280 --> 00:08:56,600
The second aspect would be the data on the asset and the data on the asset isn't the
137
00:08:56,600 --> 00:08:58,000
same as the physical asset.
138
00:08:58,000 --> 00:09:02,320
It can be in some cases, but in other cases, you have to think about it because it's abstracted
139
00:09:02,320 --> 00:09:03,320
as ones and zeros.
140
00:09:03,320 --> 00:09:07,280
It's not the physical, Hey, I've disposed of this mobile phone.
141
00:09:07,280 --> 00:09:08,280
It's gone.
142
00:09:08,280 --> 00:09:09,280
It's not in my environment.
143
00:09:09,280 --> 00:09:11,040
Well, your data is still there.
144
00:09:11,040 --> 00:09:15,720
And so if you're not segmenting that as a corporate customer, then you're probably making
145
00:09:15,720 --> 00:09:19,160
some mistakes in the way you set up your disposition program.
146
00:09:19,160 --> 00:09:23,400
And then the third level is what we call the virtual asset, which is the embodiment of
147
00:09:23,400 --> 00:09:28,760
that asset, but really as the theory of the asset, which is what corporations typically
148
00:09:28,760 --> 00:09:29,960
keep track of.
149
00:09:29,960 --> 00:09:35,440
So they have this asset, its number, whether it's a serialized asset tag, whether it's
150
00:09:35,440 --> 00:09:39,000
to make model number on it, who it's assigned to, et cetera.
151
00:09:39,000 --> 00:09:42,400
It sits in either an ITSM or some similar system.
152
00:09:42,400 --> 00:09:46,440
And it's a lot of companies say, well, we've dispositioned it out of there.
153
00:09:46,440 --> 00:09:47,440
We're good.
154
00:09:47,440 --> 00:09:50,240
And so you've got to think about it at all three levels.
155
00:09:50,240 --> 00:09:55,040
And then we think about, so again, each of those three levels has its own aspect of it.
156
00:09:55,040 --> 00:09:57,760
So the virtual asset is really just the accounting of it.
157
00:09:57,760 --> 00:10:00,600
And so one is a corporate entity.
158
00:10:00,600 --> 00:10:04,840
You should keep track of where that asset is, where you think it is, the embodiment of
159
00:10:04,840 --> 00:10:06,840
it, because that's how you keep track of it.
160
00:10:06,840 --> 00:10:10,520
It doesn't mean that it's not sitting in a closet, but it's either in your environment,
161
00:10:10,520 --> 00:10:12,080
it's not in your environment.
162
00:10:12,080 --> 00:10:17,680
And in reality, you want that virtual asset to match what the physical asset and the data
163
00:10:17,680 --> 00:10:18,920
of the asset is.
164
00:10:18,920 --> 00:10:23,000
So all three of those should be in congruence.
165
00:10:23,000 --> 00:10:26,920
And so to us, that's where you put in the later of governance.
166
00:10:26,920 --> 00:10:30,800
And so ultimately you have this set of governance, that's all three aspects.
167
00:10:30,800 --> 00:10:35,840
So when we talk about appropriateness of it, so you must have a process for dispositioning
168
00:10:35,840 --> 00:10:39,440
the asset in your own ITSM, the virtual asset.
169
00:10:39,440 --> 00:10:42,920
And then a lot of times that's accounted for financially.
170
00:10:42,920 --> 00:10:44,520
The next piece is the physical asset.
171
00:10:44,520 --> 00:10:45,520
Where did it go?
172
00:10:45,520 --> 00:10:46,520
Do you know where it is?
173
00:10:46,520 --> 00:10:51,400
Do you have a physical record that you can then import back into that virtual asset that
174
00:10:51,400 --> 00:10:55,880
demonstrates who's taking it, where it's gone, when it was gone, et cetera.
175
00:10:55,880 --> 00:10:58,120
So we think of that a lot as chain of custody.
176
00:10:58,120 --> 00:11:05,320
So when somebody is to come pick up that asset or you are to take it to its next place, how
177
00:11:05,320 --> 00:11:06,800
do you have a record of that?
178
00:11:06,800 --> 00:11:11,840
Did you match and marry that record back up then to the virtual asset?
179
00:11:11,840 --> 00:11:16,520
And in theory, as a company, you're going to want to make sure that what you did with
180
00:11:16,520 --> 00:11:22,040
the physical aspect, as we're talking about appropriateness, matches whatever environmental
181
00:11:22,040 --> 00:11:24,080
compliance you're subject to.
182
00:11:24,080 --> 00:11:30,200
So fortunately or unfortunately, like in my view for the world and even for our businesses,
183
00:11:30,200 --> 00:11:35,440
there is not a federal law around disposition of electronic assets.
184
00:11:35,440 --> 00:11:38,920
So in my home state of Arizona, you want to throw it in the dump, you can throw it in
185
00:11:38,920 --> 00:11:39,920
the dump.
186
00:11:39,920 --> 00:11:40,920
It's not against the law.
187
00:11:40,920 --> 00:11:42,080
Is it the right thing for the environment?
188
00:11:42,080 --> 00:11:43,080
Probably not.
189
00:11:43,080 --> 00:11:44,760
Is it against the law in California?
190
00:11:44,760 --> 00:11:45,760
Absolutely.
191
00:11:45,760 --> 00:11:48,040
So you can, then there's no federal law.
192
00:11:48,040 --> 00:11:49,920
About half the states have laws.
193
00:11:49,920 --> 00:11:53,240
So as a company, you know, do you have governance?
194
00:11:53,240 --> 00:11:57,800
Knowing where that asset was, what state law you're bound to, and then marrying that back
195
00:11:57,800 --> 00:12:02,560
up now to your virtual asset for a record of it, should anything happen in the future?
196
00:12:02,560 --> 00:12:07,800
And then the third part and the part that we see the most risk and the most issues with
197
00:12:07,800 --> 00:12:10,360
is the data on the asset.
198
00:12:10,360 --> 00:12:14,240
Because people think, okay, I don't, it's not in my system anymore, or it's not in my
199
00:12:14,240 --> 00:12:15,480
building anymore.
200
00:12:15,480 --> 00:12:16,800
I'm done with it.
201
00:12:16,800 --> 00:12:21,960
Well, you can't see the data, but that data sits on the asset and just like you should
202
00:12:21,960 --> 00:12:27,760
have a record of the physical custody of the asset, you should have a record of the data
203
00:12:27,760 --> 00:12:29,000
on the asset.
204
00:12:29,000 --> 00:12:32,800
And so we talk about certificates of destruction and we provide those for our customers, which
205
00:12:32,800 --> 00:12:40,480
show when the data was eradicated, and that could be via software or it could be physical
206
00:12:40,480 --> 00:12:46,000
destruction, where that was, when it was, if there's a white blog to it, you can upload
207
00:12:46,000 --> 00:12:51,160
the white blog file, you can see what software was used, wasn't used, when it was, what technician
208
00:12:51,160 --> 00:12:53,400
did that, when they did it, all those kind of things.
209
00:12:53,400 --> 00:12:57,280
And again, that should be married back up to your virtual asset.
210
00:12:57,280 --> 00:13:03,760
One of the things that we see that's probably the most concerning to me is that many companies
211
00:13:03,760 --> 00:13:07,480
think they can indemnify themselves of the data on the asset.
212
00:13:07,480 --> 00:13:11,880
And this is probably like the, one of the strangest things are, you know, by the area
213
00:13:11,880 --> 00:13:17,120
that I see that we talk about appropriateness that companies miss.
214
00:13:17,120 --> 00:13:23,080
And company, if you create the data, you're, and again, you're bound by certain legislation,
215
00:13:23,080 --> 00:13:24,360
so I'll throw a few of them out there.
216
00:13:24,360 --> 00:13:27,760
Because Sarbanes, actually, so if you're a publicly traded company, you're going to be
217
00:13:27,760 --> 00:13:31,720
bound by a HIPAA, Fair Credit Reporting Act.
218
00:13:31,720 --> 00:13:34,560
People are like, okay, well, that doesn't, we're not a financial institution.
219
00:13:34,560 --> 00:13:37,840
Do you pull a credit report on your employees as part of their onboard, you know, prior
220
00:13:37,840 --> 00:13:38,840
to hire?
221
00:13:38,840 --> 00:13:39,840
Yes.
222
00:13:39,840 --> 00:13:41,520
Okay, that data is subject to that law.
223
00:13:41,520 --> 00:13:45,360
And if you can't segment where that data is stored, then it's probably better for you
224
00:13:45,360 --> 00:13:49,400
to assume that your entire company, all your data, all your servers, etc., are bound by
225
00:13:49,400 --> 00:13:50,400
that same aspect.
226
00:13:50,400 --> 00:13:51,400
Right.
227
00:13:51,400 --> 00:13:59,280
So what I'll say is that you as the data creator and the owner of it are basically responsible
228
00:13:59,280 --> 00:14:01,280
until the destruction of that data.
229
00:14:01,280 --> 00:14:05,840
So even if the asset's been sold, people are like, oh, I sold the asset, I got rid of it.
230
00:14:05,840 --> 00:14:07,320
I'm not on the hook anymore.
231
00:14:07,320 --> 00:14:08,320
Someone else is.
232
00:14:08,320 --> 00:14:12,920
That's not, you can't indemnify yourself for a legal liability.
233
00:14:12,920 --> 00:14:20,520
Yeah, I mean, I was just thinking about the last comment you made about data.
234
00:14:20,520 --> 00:14:26,960
I think from my experience, oftentimes the challenge is no, it's like the hot potato.
235
00:14:26,960 --> 00:14:30,960
No one wants to actually be the owner of the data.
236
00:14:30,960 --> 00:14:35,200
Even within business units, they're going, well, that, you know, IT doesn't own the data.
237
00:14:35,200 --> 00:14:37,080
The business line owns the data.
238
00:14:37,080 --> 00:14:38,520
And I didn't create that data.
239
00:14:38,520 --> 00:14:41,440
I'm just responsible for the systems that it resides on.
240
00:14:41,440 --> 00:14:44,120
And it's kind of like this hot potato.
241
00:14:44,120 --> 00:14:49,160
And I appreciate the way you, you laid it out because that's so important, especially
242
00:14:49,160 --> 00:14:55,840
with, and that's kind of like my next question about ensuring compliance, because more and
243
00:14:55,840 --> 00:15:01,720
more regulatory is focused on patient privacy, focused on, you know, breach notifications
244
00:15:01,720 --> 00:15:03,280
and things of that nature.
245
00:15:03,280 --> 00:15:10,880
So in this kind of asset life cycle, how can some of our listeners kind of understand how
246
00:15:10,880 --> 00:15:12,640
to ensure compliance?
247
00:15:12,640 --> 00:15:16,280
It seems like compliance is all over the place.
248
00:15:16,280 --> 00:15:20,800
You know, could you, could you, could you offer some guidance on how to ensure compliance?
249
00:15:20,800 --> 00:15:21,800
Yeah.
250
00:15:21,800 --> 00:15:24,560
So there's lots of ways to think about it.
251
00:15:24,560 --> 00:15:26,160
And it's a tough one.
252
00:15:26,160 --> 00:15:30,600
What I would advocate for most companies is if they even remotely think there's some
253
00:15:30,600 --> 00:15:36,480
sort of legislation that they need to adhere to for data compliance, my recommendation
254
00:15:36,480 --> 00:15:37,680
would be a handful of things.
255
00:15:37,680 --> 00:15:42,760
But first off, no matter what, just assume all of your data is bound to that and take
256
00:15:42,760 --> 00:15:45,200
steps to be compliant to that across all your data.
257
00:15:45,200 --> 00:15:49,480
If you do nothing else, assume that across your whole enterprise, whether that's your
258
00:15:49,480 --> 00:15:54,560
mobility, your data center, your end user compute, everything, and have a governed solution
259
00:15:54,560 --> 00:15:56,920
of here's how we're going to eliminate our data.
260
00:15:56,920 --> 00:15:58,200
And this is our process.
261
00:15:58,200 --> 00:16:02,080
So that doesn't matter who's debating whether they own the infrastructure or not, who owns
262
00:16:02,080 --> 00:16:06,680
the data as a, as a oversight, whether it's your CISO, whether it's your infrastructure
263
00:16:06,680 --> 00:16:12,240
team, however you have it, however you have a design, make that mandatory.
264
00:16:12,240 --> 00:16:16,000
And then, you know, if you looked at most of a lot of it, even boils down to if you
265
00:16:16,000 --> 00:16:20,640
want to look at federal legislation, you could just make the assumption that as long as you're
266
00:16:20,640 --> 00:16:26,320
using a vetted third party, they're adhering to best practices that you've done reference
267
00:16:26,320 --> 00:16:32,560
checks that you've, you know, investigated and done due diligence to some sort of vetting
268
00:16:32,560 --> 00:16:33,560
process.
269
00:16:33,560 --> 00:16:36,440
And again, you could probably download RFP templates online.
270
00:16:36,440 --> 00:16:40,480
I'm happy to talk to anybody if they wanted to go through some of the ways that we even
271
00:16:40,480 --> 00:16:44,480
have like a one page worksheet that we take customers through and like, hey, no matter
272
00:16:44,480 --> 00:16:46,640
what, like just do these things and you're covered.
273
00:16:46,640 --> 00:16:49,280
Like you have at least, if you're not doing this, you shouldn't sleep at night.
274
00:16:49,280 --> 00:16:51,600
Because as you're doing this, you can at least fall asleep.
275
00:16:51,600 --> 00:16:55,880
And then there's like various levels you can take it to.
276
00:16:55,880 --> 00:16:57,920
But you should make sure they're certified.
277
00:16:57,920 --> 00:17:01,200
So look at things like, so there's different certifications in Europe.
278
00:17:01,200 --> 00:17:07,640
A DISA is a big one from a security perspective in the domestically made, the National Association
279
00:17:07,640 --> 00:17:09,280
of Information Destruction.
280
00:17:09,280 --> 00:17:13,560
So making sure they're not a member, making sure that they're AAA certified.
281
00:17:13,560 --> 00:17:17,600
And then there's different certifications for what we call onsite or offsite.
282
00:17:17,600 --> 00:17:20,560
So again, it's like you're looking to ramp up your program.
283
00:17:20,560 --> 00:17:24,280
Like if you're saying, you know, what's the best way that's different than what's, you
284
00:17:24,280 --> 00:17:25,280
know, the minimum.
285
00:17:25,280 --> 00:17:29,400
And, you know, as an example, I think Morgan Stanley, and this one was pretty publicly
286
00:17:29,400 --> 00:17:35,240
available was find millions and millions and tens of millions of dollars for not taking
287
00:17:35,240 --> 00:17:40,720
these steps and they made the assumption that they hired somebody who's an IT asset disposition.
288
00:17:40,720 --> 00:17:45,240
They didn't do any reference checks, anybody, they subcontracted it out, we subcontracted
289
00:17:45,240 --> 00:17:47,840
it out to a moving company.
290
00:17:47,840 --> 00:17:53,320
The data shows up three years later that none of these devices were actually rat.
291
00:17:53,320 --> 00:17:56,600
The data was eradicated and Morgan Stanley is on the hook for it.
292
00:17:56,600 --> 00:18:00,160
And they're like, well, wait a second, this company bought these assets off me.
293
00:18:00,160 --> 00:18:01,640
Here's the bill of sale.
294
00:18:01,640 --> 00:18:04,240
They're like, well, your data doesn't matter.
295
00:18:04,240 --> 00:18:10,280
And so, I mean, you can go through example after example, and people, I think, think
296
00:18:10,280 --> 00:18:13,040
that because somebody else took it, it's not my problem.
297
00:18:13,040 --> 00:18:14,040
And we see it a lot in HIPAA.
298
00:18:14,040 --> 00:18:19,160
One of the ones I saw was most intriguing to me was companies had leased assets.
299
00:18:19,160 --> 00:18:20,160
They were photocopiers.
300
00:18:20,160 --> 00:18:24,640
A lot of people don't know that photocopiers have hard drives in them and store data.
301
00:18:24,640 --> 00:18:27,920
They were scanning patient data in there.
302
00:18:27,920 --> 00:18:29,240
The leasing company took them back.
303
00:18:29,240 --> 00:18:32,040
And we're like, well, we made the assumption that the leasing company takes care of that
304
00:18:32,040 --> 00:18:33,960
because we didn't own the asset.
305
00:18:33,960 --> 00:18:36,400
We've never owned the asset.
306
00:18:36,400 --> 00:18:40,080
The leasing company just gets rid of them however they, you know, hey, we have a mechanism
307
00:18:40,080 --> 00:18:41,680
to get rid of these things.
308
00:18:41,680 --> 00:18:46,760
That data comes back out and they went and hit everybody along the chain.
309
00:18:46,760 --> 00:18:48,080
So that's intense.
310
00:18:48,080 --> 00:19:01,000
Well, hey, I know that you were recently awarded, you know, Momentum 100 CEO this past year.
311
00:19:01,000 --> 00:19:05,120
Sort of just being a CEO that is a force of good.
312
00:19:05,120 --> 00:19:16,120
So my question revolves around if our listeners are interested in the environmental aspects
313
00:19:16,120 --> 00:19:24,800
of disposition, ensuring that they look at the recycling and the reuse of these devices
314
00:19:24,800 --> 00:19:27,560
so that they don't have an environmental impact.
315
00:19:27,560 --> 00:19:28,880
Can you comment on that?
316
00:19:28,880 --> 00:19:30,120
How you handle that?
317
00:19:30,120 --> 00:19:31,120
How you look at that?
318
00:19:31,120 --> 00:19:32,120
Yeah, absolutely.
319
00:19:32,120 --> 00:19:37,080
And so again, most of the things we talk about are really on those three levels of, you know,
320
00:19:37,080 --> 00:19:40,400
the physical, the virtual and the data of the asset.
321
00:19:40,400 --> 00:19:44,480
So on the physical side, you don't want to make sure that any company you deal with from
322
00:19:44,480 --> 00:19:50,120
an environmental standpoint is certified either R2B3, which is responsible recycling
323
00:19:50,120 --> 00:19:53,760
and it adheres to everything they do.
324
00:19:53,760 --> 00:19:56,360
They can't just kind of pick and choose.
325
00:19:56,360 --> 00:19:59,400
This part was certified and this part wasn't.
326
00:19:59,400 --> 00:20:01,600
So that's one certification.
327
00:20:01,600 --> 00:20:07,600
The other one is E-Stewards and both of them have very well vetted out processes that take
328
00:20:07,600 --> 00:20:16,720
everything from the original asset all the way to and it applies all the way to the components
329
00:20:16,720 --> 00:20:18,440
are into the ROS form.
330
00:20:18,440 --> 00:20:22,240
So as an example, if you wanted to, you can go back and take any of those certified companies
331
00:20:22,240 --> 00:20:27,880
and see where the circuit board ends up and who's smelting the metal out of it.
332
00:20:27,880 --> 00:20:31,440
So it's to ensure that nowhere that there's not these leaks out of the side.
333
00:20:31,440 --> 00:20:34,880
Well, I dealt with the certified company, but yeah, these things ended up in a landfill
334
00:20:34,880 --> 00:20:36,560
in Africa.
335
00:20:36,560 --> 00:20:38,800
So those would be the starting point.
336
00:20:38,800 --> 00:20:43,480
And then the most important thing I think that's different that I would advocate and
337
00:20:43,480 --> 00:20:49,040
a lot of companies don't adhere to this or don't believe in it, but they get really wrapped
338
00:20:49,040 --> 00:20:53,520
around this recycle aspect and saying, okay, well, we're going to ensure everything's recycled.
339
00:20:53,520 --> 00:20:54,520
And that's great.
340
00:20:54,520 --> 00:21:00,160
So what we really want to focus on and what we really need to drive as a country, as individuals,
341
00:21:00,160 --> 00:21:03,520
as organizations, and as a world is around reuse.
342
00:21:03,520 --> 00:21:07,320
And so what is the next best use of that device?
343
00:21:07,320 --> 00:21:13,920
What's its next most useful life cycle and driving the asset towards that?
344
00:21:13,920 --> 00:21:20,160
So what good is it to take a and some of the OEMs is where I have a lot of angst with them
345
00:21:20,160 --> 00:21:21,960
is, you know, they'll mandate shred.
346
00:21:21,960 --> 00:21:26,800
So they'll take out a network device and if it's on smart, if it's not on smart net,
347
00:21:26,800 --> 00:21:28,840
it's not supported, then I'm going to go take it.
348
00:21:28,840 --> 00:21:31,160
I'm going to force it and we put it back in.
349
00:21:31,160 --> 00:21:32,160
We're going to lease it to you.
350
00:21:32,160 --> 00:21:34,760
We're going to take it and we're going to shred them off and we're going to recycle all the
351
00:21:34,760 --> 00:21:35,760
metal.
352
00:21:35,760 --> 00:21:37,480
But what is the embedded energy cost?
353
00:21:37,480 --> 00:21:39,800
What, you know, could that thing be better used for that?
354
00:21:39,800 --> 00:21:41,720
Could it still work for another three years?
355
00:21:41,720 --> 00:21:45,840
Could it be, you know, and again, it doesn't help with product sales and I understand that
356
00:21:45,840 --> 00:21:49,840
and it doesn't help with some of the other aspects, but more and more, we need to make
357
00:21:49,840 --> 00:21:57,560
things that available to move into their next most useful life, not lock out the firmware,
358
00:21:57,560 --> 00:22:00,160
make things more replaceable.
359
00:22:00,160 --> 00:22:03,440
You know, so again, we're really supportive of a lot of the things out there, right to
360
00:22:03,440 --> 00:22:10,800
repair some of the other legislation that makes it easier for IT assets to be reused
361
00:22:10,800 --> 00:22:12,600
in another life cycle.
362
00:22:12,600 --> 00:22:13,600
Yeah, yeah.
363
00:22:13,600 --> 00:22:16,400
No, thank you.
364
00:22:16,400 --> 00:22:18,800
That's really, that's great comment.
365
00:22:18,800 --> 00:22:23,880
I wanted to shift gears a little bit and talk a little bit about any experiences you might
366
00:22:23,880 --> 00:22:30,120
have with medical devices and or kind of the Internet of things because the IoT seems to
367
00:22:30,120 --> 00:22:38,160
be, you know, something that is beginning to push out large and larger numbers of devices
368
00:22:38,160 --> 00:22:45,520
that in my humble estimation seem to have shorter life cycles.
369
00:22:45,520 --> 00:22:51,280
You know, when it comes to Wi-Fi access points or when it comes to, you know, these devices
370
00:22:51,280 --> 00:22:54,480
that are in these healthcare organizations.
371
00:22:54,480 --> 00:23:01,760
So can you talk a little bit about that, whether it's the Internet of Medical Things or IoT
372
00:23:01,760 --> 00:23:06,920
specific, is this something that you're seeing and any comments that you can make around
373
00:23:06,920 --> 00:23:07,920
those?
374
00:23:07,920 --> 00:23:10,000
Yeah, so it's that's a tough one.
375
00:23:10,000 --> 00:23:11,960
We are seeing more Internet of Things.
376
00:23:11,960 --> 00:23:16,880
We're seeing that proliferation of devices and, you know, again, the tough part with
377
00:23:16,880 --> 00:23:22,360
those is one is there's not usually, and it's hard to find a useful life for those afterwards.
378
00:23:22,360 --> 00:23:26,480
Two is that they're all have little batteries in them, which make them very difficult to
379
00:23:26,480 --> 00:23:28,040
recycle.
380
00:23:28,040 --> 00:23:29,840
And so it's like a burgeoning problem.
381
00:23:29,840 --> 00:23:35,480
It hasn't quite reared its ugly head yet, but that I think is going to be, and we talk
382
00:23:35,480 --> 00:23:38,360
about it, we see some of those devices.
383
00:23:38,360 --> 00:23:43,040
It's really hard to decide what to do, how to do, and then really get back to the other
384
00:23:43,040 --> 00:23:45,320
question of what data is on those things.
385
00:23:45,320 --> 00:23:50,000
So we also see, and I use, I won't use an Internet of Things, but a lot of router switches,
386
00:23:50,000 --> 00:23:54,480
things that don't have even moving parts, really, you know, people, their network passwords
387
00:23:54,480 --> 00:23:57,200
are loaded in there and there's levels.
388
00:23:57,200 --> 00:24:02,320
There's like three different levels of data on network switches, an example, and getting
389
00:24:02,320 --> 00:24:06,800
rid of all of those is complicated and expensive.
390
00:24:06,800 --> 00:24:10,240
And I think that you're going to see more problems with like the Internet of Things,
391
00:24:10,240 --> 00:24:13,440
because those passwords are embedded on there.
392
00:24:13,440 --> 00:24:16,680
There's, it's a very low cost item.
393
00:24:16,680 --> 00:24:20,320
And so they're probably, again, this is, I'm not, it's out of my wheelhouse a little bit,
394
00:24:20,320 --> 00:24:24,520
but the security level of what people are paying attention to and how they're managing those,
395
00:24:24,520 --> 00:24:30,000
I think is much less than what they consider their quote unquote critical infrastructure
396
00:24:30,000 --> 00:24:33,880
that has to pass different, you know, kind of security protocols in most companies.
397
00:24:33,880 --> 00:24:39,280
You know, you mentioned earlier, just as you were talking, I thought about it, you know,
398
00:24:39,280 --> 00:24:40,280
asset management.
399
00:24:40,280 --> 00:24:46,920
And, and I think one of your points was, know where all of your assets are.
400
00:24:46,920 --> 00:24:55,720
Do you come across ever in scenarios where customers struggle with that?
401
00:24:55,720 --> 00:24:57,160
And why would that be the case?
402
00:24:57,160 --> 00:25:02,480
I mean, you know, you think about it in the sense, I think about it in the sense of my
403
00:25:02,480 --> 00:25:04,720
home and protecting my home.
404
00:25:04,720 --> 00:25:10,160
And there's certain things in my home that I find to be irreplaceable, right?
405
00:25:10,160 --> 00:25:13,320
My critical assets.
406
00:25:13,320 --> 00:25:18,640
And most of those are a little intangible, like pictures of lost loved ones and things
407
00:25:18,640 --> 00:25:19,640
like that.
408
00:25:19,640 --> 00:25:23,760
Organizations themselves have that same kind of criticality of asset.
409
00:25:23,760 --> 00:25:25,120
It can be intellectual property.
410
00:25:25,120 --> 00:25:30,080
It can be, it always is in some form of data.
411
00:25:30,080 --> 00:25:36,880
But do you find that from a physical asset organization struggle with that?
412
00:25:36,880 --> 00:25:42,280
And why would you, you know, if you could share your opinion on why you think folks have that
413
00:25:42,280 --> 00:25:44,680
difficulty with asset management?
414
00:25:44,680 --> 00:25:45,680
It's almost impossible.
415
00:25:45,680 --> 00:25:46,680
Every company has that problem.
416
00:25:46,680 --> 00:25:49,440
I mean, it is, I mean, I'll speak for myself.
417
00:25:49,440 --> 00:25:52,480
I just, even this is my business.
418
00:25:52,480 --> 00:25:54,080
And usually people come and visit me.
419
00:25:54,080 --> 00:25:58,320
They usually bring me a couple of hard drives and old cell phone and old mobile phone and
420
00:25:58,320 --> 00:25:59,960
they usually drop them off, right?
421
00:25:59,960 --> 00:26:03,880
And so I know that, like I just came across our own drawer the other day, like, where
422
00:26:03,880 --> 00:26:05,520
did this Nokia phone come from?
423
00:26:05,520 --> 00:26:10,160
And I'm sure it has pictures on it of my daughter when she was born, you know, 12 years ago.
424
00:26:10,160 --> 00:26:11,160
All right.
425
00:26:11,160 --> 00:26:15,960
Since you mentioned it, Aaron, I'm going to bring this and this one when I come to visit
426
00:26:15,960 --> 00:26:16,960
you.
427
00:26:16,960 --> 00:26:17,960
Okay.
428
00:26:17,960 --> 00:26:18,960
Perfect.
429
00:26:18,960 --> 00:26:20,600
We all have one, right?
430
00:26:20,600 --> 00:26:23,200
And, you know, like, did you keep track of it?
431
00:26:23,200 --> 00:26:25,480
It was, you know, it was probably expensive when you bought it.
432
00:26:25,480 --> 00:26:28,720
And it never, it's probably the hardest thing.
433
00:26:28,720 --> 00:26:32,960
I mean, you have employees that bought stuff on a credit card and they put it in the drawer
434
00:26:32,960 --> 00:26:35,440
and then, or something wasn't accounted for.
435
00:26:35,440 --> 00:26:39,560
I mean, we do, we run a box program for a large software development company.
436
00:26:39,560 --> 00:26:43,120
And when their employees are terminated or quit for any work from home employees, we
437
00:26:43,120 --> 00:26:46,280
send a box to collect their assets.
438
00:26:46,280 --> 00:26:49,480
And they're also supposed to throw in their badge or credit card, a couple of other things.
439
00:26:49,480 --> 00:26:55,800
I would tell you probably, I don't know, it's, it happens every week, but we get personal
440
00:26:55,800 --> 00:26:57,040
assets in there as well.
441
00:26:57,040 --> 00:26:58,040
People just throw in other things.
442
00:26:58,040 --> 00:27:00,320
And I even know like, is this the company's asset or not?
443
00:27:00,320 --> 00:27:04,080
I mean, we end up with a laptop, a MacBook, and we'd be like, Hey, this one's not on the
444
00:27:04,080 --> 00:27:05,080
list.
445
00:27:05,080 --> 00:27:07,800
And then the company goes back and forth and we try to figure it out.
446
00:27:07,800 --> 00:27:13,800
I mean, it is, it's all those things that people buy, take out, or they don't account
447
00:27:13,800 --> 00:27:14,800
for it.
448
00:27:14,800 --> 00:27:17,080
I mean, it's hard.
449
00:27:17,080 --> 00:27:24,360
And we attend the IT asset management, ITAM, there's a certification and an association
450
00:27:24,360 --> 00:27:27,840
around it, the International Association of IT Asset Management.
451
00:27:27,840 --> 00:27:30,800
We have a number of individuals on our team that are certified in it.
452
00:27:30,800 --> 00:27:33,040
We help companies go through that.
453
00:27:33,040 --> 00:27:36,680
And like anytime you think it should be easier, there should be a process, there's always
454
00:27:36,680 --> 00:27:38,040
an exception to it.
455
00:27:38,040 --> 00:27:41,680
And when you get into companies with 10,000 employees, you start multiplying the exceptions.
456
00:27:41,680 --> 00:27:44,080
And it's, you know, they acquire companies.
457
00:27:44,080 --> 00:27:47,480
They don't know what the, you know, we have one company we work with every time they acquire
458
00:27:47,480 --> 00:27:50,920
a company, we go to a physical asset count on site.
459
00:27:50,920 --> 00:27:54,600
So they start with like, Hey, we have no idea what they, we have an idea of what they have.
460
00:27:54,600 --> 00:27:56,040
Here's what they told us.
461
00:27:56,040 --> 00:28:00,680
We need somebody to go on site, count them all and match all the serial numbers.
462
00:28:00,680 --> 00:28:04,560
And then you run, I mean, you run into things like if you were to replace the motherboard,
463
00:28:04,560 --> 00:28:07,120
it's going to read as a separate serial number.
464
00:28:07,120 --> 00:28:08,760
So all of a sudden you've lost this matchup.
465
00:28:08,760 --> 00:28:11,560
I mean, I mean, we've seen so many things.
466
00:28:11,560 --> 00:28:13,560
It is the, it'll never be perfect.
467
00:28:13,560 --> 00:28:15,400
It'll never be reconciled.
468
00:28:15,400 --> 00:28:20,360
I think there is a better chance is, get a little out there, but like the blockchain
469
00:28:20,360 --> 00:28:21,680
could probably help.
470
00:28:21,680 --> 00:28:27,200
So you have, you know, the processes to register it and you can keep track of it.
471
00:28:27,200 --> 00:28:31,200
And so I've seen some interesting ideas and thoughts around it, but I don't see it going
472
00:28:31,200 --> 00:28:32,200
away anytime soon.
473
00:28:32,200 --> 00:28:40,880
And all you can do as a company is hope to do your best and create processes and inspection
474
00:28:40,880 --> 00:28:46,800
points to ensure that the quality is as high as possible, but you know, it's massively impossible.
475
00:28:46,800 --> 00:28:53,400
Well, so, you know, you brought up the three aspects, physical data, and then the virtual
476
00:28:53,400 --> 00:29:00,440
aspect of that, that asset theory of that asset.
477
00:29:00,440 --> 00:29:06,840
If you were to share like one or two things that are most critical for our listeners,
478
00:29:06,840 --> 00:29:13,680
kind of as we wrap all of this up, what would you suggest that they do with respect to their
479
00:29:13,680 --> 00:29:15,480
current asset inventory?
480
00:29:15,480 --> 00:29:18,200
So I'm going to make two suggestions.
481
00:29:18,200 --> 00:29:20,480
One is like, kind of, hey, this is what you should do no matter what.
482
00:29:20,480 --> 00:29:27,400
And here is if you're, if you want to be best in class, there's a simple thing you can do.
483
00:29:27,400 --> 00:29:31,080
So the first one is no matter what, you should get your different groups together.
484
00:29:31,080 --> 00:29:35,680
However you think about that in your organization, whether you have an infrastructure group and
485
00:29:35,680 --> 00:29:43,480
a, you know, an end user compute group, or if you have, you know, security over here
486
00:29:43,480 --> 00:29:44,880
and physical assets over here.
487
00:29:44,880 --> 00:29:49,000
Whatever you do, get the different groups together and come up with governance to handle
488
00:29:49,000 --> 00:29:50,000
those three aspects.
489
00:29:50,000 --> 00:29:52,560
Here's how we're going to count for our virtual asset.
490
00:29:52,560 --> 00:29:57,280
Here's what we're going to mandate across all locations, all assets for a data destruction
491
00:29:57,280 --> 00:29:58,280
policy.
492
00:29:58,280 --> 00:30:02,400
And here's what we're going to do from an environmental or physical disposition.
493
00:30:02,400 --> 00:30:06,760
So get those groups together, get them talking, get them conversing and come up with something
494
00:30:06,760 --> 00:30:10,320
that you're going to apply universally across the company.
495
00:30:10,320 --> 00:30:12,680
And if there needs to be exceptions, figure that out as it goes.
496
00:30:12,680 --> 00:30:18,720
But you know, like a lot of times we see mobility handled by, you know, HR or it's in this onboarding
497
00:30:18,720 --> 00:30:22,600
process and it's just completely outside of IT because we have corporate liable phones
498
00:30:22,600 --> 00:30:27,040
and certain titles get them and then it's like those are totally on their own.
499
00:30:27,040 --> 00:30:31,760
So again, bring all your IT assets, have some sort of governance.
500
00:30:31,760 --> 00:30:36,120
And as long as you do that, you're going to be better than 90% of the companies out there,
501
00:30:36,120 --> 00:30:39,840
even Fortune 5000 companies, I tell you.
502
00:30:39,840 --> 00:30:45,320
If you want, if your data, and the next one kind of moves to the data side and you want
503
00:30:45,320 --> 00:30:52,200
best in class, the easiest solution is to work with a provider that does, and it's not
504
00:30:52,200 --> 00:31:02,240
a huge incremental cost, it does cost more, but erase, destroy all your data on site before
505
00:31:02,240 --> 00:31:05,480
it leaves your four walls of your buildings.
506
00:31:05,480 --> 00:31:12,160
Like that's probably, like if you did that, you know, you're just dramatically reduced
507
00:31:12,160 --> 00:31:16,600
down, could the re-arrows, could things slip out maybe, but you've dramatically reduced
508
00:31:16,600 --> 00:31:18,240
what your exposure is.
509
00:31:18,240 --> 00:31:23,800
And so best practice would be, you know, if you have a help desk that swaps PCs in and
510
00:31:23,800 --> 00:31:28,600
out, laptops in and out before those leave, quarantine them all together and then have
511
00:31:28,600 --> 00:31:30,240
some come on site and wipe them off.
512
00:31:30,240 --> 00:31:35,800
For your data center, same thing, you know, either get a locker, and we do this a lot
513
00:31:35,800 --> 00:31:40,040
of customers, even in their third party, like Kogo facilities, is we provide a storage bin
514
00:31:40,040 --> 00:31:45,000
of some sort of lockable thing, or we do ones that like some of the large Kogos in Vegas,
515
00:31:45,000 --> 00:31:50,320
where I don't care who you are, you drop it in there with a tag and it all stays in this
516
00:31:50,320 --> 00:31:54,920
box and we come on once a month and we erase all of them or we destroy them all for all
517
00:31:54,920 --> 00:31:55,920
a fail.
518
00:31:55,920 --> 00:31:58,320
And like you don't want any data leaving that facility.
519
00:31:58,320 --> 00:32:04,160
You know, those are great recommendations.
520
00:32:04,160 --> 00:32:05,360
I really appreciate it.
521
00:32:05,360 --> 00:32:09,080
Aaron, thank you for your insights.
522
00:32:09,080 --> 00:32:10,640
That's all for this episode.
523
00:32:10,640 --> 00:32:30,160
Make sure you tune in the next time, logically speaking, and stay cyber first and future ready.
