Hacking the Future Navigating the Cyber Threat Landscape with Glenn Maiden [Part 2]

WEBVTT
00:00:00.281 --> 00:00:05.972
Today we're bringing you part two of my discussion with Glenn Maiden, Director of Threat Intelligence at Fortiguard Labs, ANZ.
00:00:05.972 --> 00:00:09.308
If you haven't listened to part one yet, I suggest you do first.
00:00:09.308 --> 00:00:13.929
If I think about AI machine learning we have to talk about AI.
00:00:14.490 --> 00:00:15.272
It's KPI here.
00:00:15.272 --> 00:00:17.280
It's a new blockchain.
00:00:17.541 --> 00:00:18.003
That's true.
00:00:18.003 --> 00:00:19.307
That's true.
00:00:19.307 --> 00:00:28.766
And think about the AI machine learning from a transforming of different areas of cybersecurity, both defence and attack.
00:00:28.766 --> 00:00:35.469
You know how are these technologies being used by the defenders and attackers and what are the implications on threat intelligence.
00:00:36.219 --> 00:00:36.883
Yeah, so we mentioned.
00:00:36.883 --> 00:00:41.551
We touched on this before when I mentioned about the 500 human Russians before.
00:00:42.159 --> 00:00:45.450
And you think of some of the early social engineering attacks.
00:00:45.450 --> 00:00:50.892
You know, get your free iPhone here or here's your DHL and it'd have spelling mistakes.
00:00:50.892 --> 00:00:55.128
You know, in a lot of cases you know it was absolutely obvious that it wasn't right.
00:00:55.128 --> 00:00:58.203
So now with AI, we could have an attack.
00:00:58.203 --> 00:01:09.569
So even using things like voice or video, but definitely written, where it could be as close enough to me attacking you, or a message coming from me that even I wouldn't even be able to tell the difference.
00:01:09.569 --> 00:01:20.811
So I think that there's going to be a real explosion of certainly on the attack side and I can tell you from our perspective on the defender side there's some quite innovative capabilities coming in.
00:01:20.811 --> 00:01:21.762
So I mentioned before that.
00:01:21.762 --> 00:01:23.105
So there's sort of AI on AI.
00:01:23.105 --> 00:01:31.352
So we've trained our AI as a very sort of standalone system to detect threats both against computers and within the network.
00:01:31.352 --> 00:01:32.061
So that's one thing.
00:01:32.061 --> 00:01:37.644
But we're also putting Gen AI on the front of many of our systems and we did a demonstration recently.
00:01:38.447 --> 00:01:44.146
If you imagine you're the SOC analyst, you've got more alerts than you can ever process as a human.
00:01:44.146 --> 00:01:49.106
You're looking across five different systems in a lot of cases, maybe 10, maybe 20 different systems.
00:01:49.106 --> 00:01:52.120
I've got to go out, pull logs off one system.
00:01:52.120 --> 00:02:02.811
I've got to transform, maybe run a Python script over to make it be able to be fed into the next system and I've got to do all these different things to be able to sort of work out what's an alert and what's not.
00:02:02.811 --> 00:02:08.033
Also, I've got to be trained in all these different systems so I know how to interact with them.
00:02:08.033 --> 00:02:16.887
So we did a test by putting an AI agent sort of on the front of some of our security operations tools and you can just go in like you would with ChatGPT.
00:02:17.741 --> 00:02:25.109
Tell me more about this threat, tell me where I've seen this anomalous IP address elsewhere in my network.
00:02:25.109 --> 00:02:28.389
Oh, can I please just contain those?
00:02:28.389 --> 00:02:30.307
Can I make sure that they can't get anywhere else?
00:02:30.307 --> 00:02:39.562
So there's some really nice innovation happening in the defender side, under the very, very true assumption that the security analyst is the unicorn that's going to be.
00:02:39.562 --> 00:02:46.012
The one constraint we're always going to have is smart analysts, smart security engineers, smart responders.
00:02:46.012 --> 00:02:48.651
There's just not enough of them and there never will be.
00:02:48.651 --> 00:03:09.298
But if we can make their lives a little bit easier and they're not having to go through and do data mining and data transformation and learning five different systems, we can make a lot more their time a lot more effective in defending us If I then pivot a little bit onto a supply chain, because that's, you know, people always tacking specifically an entity or a targeted attack.
00:03:09.358 --> 00:03:12.450
But supply chain is definitely gaining, and I'll kind of tie the two together here.
00:03:12.450 --> 00:03:20.604
Supply chain is definitely gaining attention over the years or more recently, and also critical infrastructure is becoming, you know, a real national security priority.
00:03:20.604 --> 00:03:28.393
I know we touched on it a little bit earlier, but what's some of the unique challenges that are facing both the supply chain and the critical infrastructure sectors?
00:03:28.580 --> 00:03:32.068
Yeah, so there's a lot to unpack there From a supply chain perspective.
00:03:32.068 --> 00:03:39.923
I mean, we've seen and I know I'm going back a few years but SolarWinds, I think, was a really, really good example for us to learn from.
00:03:39.923 --> 00:03:58.533
So in that particular attack Russian threat actor, so in that particular attack Russian threat actor, their target, their victim was US government and US defense industry, right, so, and if you think of that, well, they didn't actually attack the US government or the defense industry, at least for not six or 12 or even more months.
00:03:58.533 --> 00:04:00.163
Before they went through.
00:04:00.163 --> 00:04:05.981
They were able to compromise the SolarWinds organization and they do a lot of system management tools.
00:04:05.981 --> 00:04:12.500
They went through and wrote bespoke custom malware that looked like a SolarWinds agent.
00:04:12.500 --> 00:04:16.329
They wrote custom malware to crazy, yeah, also.
00:04:16.329 --> 00:04:24.810
But even even in terms of the, the command and control traffic, so that actually was encapsulated into some of those proprietary SolarWinds protocols.
00:04:24.829 --> 00:04:27.535
So again, I think of myself as a SOC analyst.
00:04:27.535 --> 00:04:32.324
If I'm looking at this Russian attack, I'm going to see SolarWindsexe running on a server.
00:04:32.324 --> 00:04:35.572
I'm going to see SolarWinds go back to SolarWinds HQ.
00:04:35.572 --> 00:04:36.459
I look at that.
00:04:36.459 --> 00:04:38.422
It's the right port, it's the right traffic.
00:04:38.422 --> 00:04:41.846
That would be so, so difficult to detect.
00:04:41.846 --> 00:05:00.543
And so once, obviously, once all all SolarWinds customers went and updated, as we tell everyone to do well, we've got a patch, we've got a patch, we've got a patch they went through and then downloaded the malware onto their machines and then, from there, that's where the threat actor went mad.
00:05:00.543 --> 00:05:10.514
So supply chain is so, so important, because all these different organizations and these different vendors that we're using are all all these different organizations and these different vendors that we're using are all definitely areas where an attacker could get in, if they can't get into you in the first place.
00:05:10.720 --> 00:05:20.586
And then that leads on to critical infrastructure, right, which is, you know, skills gap, a lot more connectivity now into these, you know, processing facilities, critical infrastructure being so important.
00:05:20.586 --> 00:05:25.125
And same thing, right, you're not actually trying to target specifically, maybe, the output of the critical infrastructure.
00:05:25.125 --> 00:05:27.071
But how do we get into those five different mechanisms?
00:05:27.071 --> 00:05:32.105
Right, could be through third parties, might not be the blast rate of sprinter, but it might be from an external source, right?
00:05:32.266 --> 00:05:37.245
Yeah, and I think this is where I mentioned before we probably need to have more of a sense of urgency.
00:05:37.245 --> 00:05:43.867
So in Australia and I guess it's probably the same everywhere so much of our critical infrastructure is operated by the private sector.
00:05:43.867 --> 00:05:49.896
And I know here in Brisbane and there's organisations like ORO we talk cyber every single day of the week.
00:05:49.896 --> 00:05:51.744
I come from Canberra.
00:05:51.744 --> 00:05:55.992
The population in Canberra and FedGov is quite well informed about cyber.
00:05:55.992 --> 00:05:57.745
They know the rules and regulations.
00:05:57.745 --> 00:06:01.220
They've got relatively decent maturity around their networks.
00:06:02.343 --> 00:06:11.523
Like everyone, it's always an ongoing process, but I think the further away you get from Sydney, melbourne, canberra, brisbane, north and West, that's where a lot of our critical infrastructure is.
00:06:11.523 --> 00:06:19.767
So, whether it's a mine or a gas plant, that's where some of these critical processes have been operating probably for 50 years.
00:06:19.767 --> 00:06:29.819
And now all of a sudden we're putting a Starlink or something on the top of them and an opening up to those attackers that we mentioned before that are sitting up there in Romania or in North Korea.
00:06:29.819 --> 00:06:37.033
And again, the legislation that Home Affairs has just come up with is great the security of critical infrastructure.
00:06:37.033 --> 00:06:40.468
It gives them a baseline, all these critical infrastructure entities and operators.
00:06:40.468 --> 00:06:46.180
It gives them a baseline level of cyber maturity, but certainly there's a lot more to do there.
00:06:46.261 --> 00:06:50.500
So where I always think about back in defence, we would say effects-based operations.
00:06:50.500 --> 00:06:58.685
If I press a button here, it might actually go through a chain of processes maybe five, 10, or maybe two but the outcome's still the same.
00:06:58.685 --> 00:07:07.521
So maybe I want to hit some sort of a processing facility and that might mean that we can't have fresh bread for two or three days.
00:07:07.603 --> 00:07:14.846
So, very, very very frightening stuff, which probably leads on to a little bit of the weakest link in the chain, which is a people issue.
00:07:14.846 --> 00:07:26.310
Right, and people are generally always kind of some of the root cause of some of the problems, as in the tax, but could be not educated properly around malware or ransomware, all those sorts of things.
00:07:26.310 --> 00:07:30.831
So we know that cyber is just not a technology issue but it's also a people issue.
00:07:30.831 --> 00:07:38.473
How can organizations kind of build a strong cyber culture amongst their employees and stakeholders to help mitigate that?
00:07:38.473 --> 00:07:40.324
I know, is it hygiene, is it training?
00:07:40.324 --> 00:07:41.769
Is it more investment?
00:07:41.769 --> 00:07:42.550
What are your thoughts?
00:07:43.300 --> 00:07:52.788
I think again and this is a challenge and I'm probably a little bit different I mean, obviously, for organisations like Fortinet and like mine, we've got free cyber training for anyone that's interested in it.
00:07:52.788 --> 00:07:56.088
But I think, as an industry where we have failed is you know?
00:07:56.088 --> 00:08:02.968
Again, I think of my mum, or I think maybe of a tax agent that is wearing a cardigan and all they know how to do is you know, do your accounts.
00:08:02.968 --> 00:08:03.488
And they know that.
00:08:03.488 --> 00:08:05.271
Well, I don't know about.
00:08:05.271 --> 00:08:12.721
You know I pay someone to do my taxes because I just cannot, I cannot comprehend.
00:08:12.740 --> 00:08:16.752
But at the same token, we say well, you know, tax agent, you also have to understand cyber and it's such a complicated global threat.
00:08:16.752 --> 00:08:26.980
I don't know, I don't know exactly where it's going, but I think certainly things like primary school, you know, we give people, we give all our kids sort of basic information around.
00:08:26.980 --> 00:08:28.723
You know how the economy works and basic mathematics.
00:08:28.723 --> 00:08:53.726
I think we'll have to eventually get to the point where every school leaver, whether they're becoming a hairdresser or a chef or an accountant or even a cyber security systems engineer, will have to get to the point where they've at least got basic cyber how to spot a phishing attack, how to have good password hygiene, how to have good backups of your personal data, all that basic stuff which, unfortunately, a lot of people are learning the hard way still.
00:08:53.907 --> 00:09:00.474
And you're absolutely right, and it's something that will take a little while to get there, and it's very important that education starts early.
00:09:00.474 --> 00:09:02.552
It's not going anywhere right.
00:09:02.552 --> 00:09:14.347
As we come near the end of our discussion today, I kind of wanted to touch on a couple other points, which is considering your roles you've had over the years and leading teams and working with customers, et cetera.
00:09:14.347 --> 00:09:23.690
What advice would you give security leaders on staying proactive and continuously adapting to the evolving threat landscape or staying ahead of cyber, if that's their passion?
00:09:23.910 --> 00:09:33.589
I think the best thing that we can potentially do is have cyber people that can probably just relax a little bit and learn to become more part of the organization.
00:09:33.589 --> 00:09:54.231
I remember I spoke to the CISO for one of the big four banks this was a long time ago, maybe 10 years ago and he said I'm not, and he was the chief security officer, I'm not the size of this particular bank, I'm a banker and all I have is a whole bunch of levers that I need to sort of push up or push down to make sure that that risk stays in the acceptable level.
00:09:54.231 --> 00:10:03.471
So you know, if I was that guy and I was, you know, a Nazi SISO no, you can't do that and you would get to the point where you know that bank would not be able to do its business.
00:10:03.471 --> 00:10:07.086
So you know, every single thing we do carries an element of risk.
00:10:07.086 --> 00:10:16.359
That's just how we can do that as an organization with the lowest amount of risk and the most amount of risk that we're able to tolerate.
00:10:16.458 --> 00:10:20.490
So you can't do that alone as a CISO or a security leader.
00:10:20.490 --> 00:10:28.808
You have to be working with the business, you have to be working with the people, otherwise they'll just find work around and again, this is where it's going actually, michael, which is good.
00:10:28.808 --> 00:10:36.091
Having cyber as a key part of the business is the important thing, because it's not a business impediment like it used to be.
00:10:36.091 --> 00:10:42.019
Having a good cyber culture now and having good cyber hygiene is now a competitive advantage.
00:10:42.019 --> 00:10:48.212
I would rather do business with someone like Oro, because I know that you care about cyber and I know that you're going to protect my POI.
00:10:48.212 --> 00:11:02.004
I know you're going to protect my sensitive IP If I thought of your competitor down the road where they're trying to do things for the best price, lowest price, least.
00:11:02.025 --> 00:11:04.596
I'm not going to go and work with those guys because I know that the risk is going to be too high.
00:11:04.596 --> 00:11:06.703
Yeah, fair enough too, and part of that is continuous learning right.
00:11:06.703 --> 00:11:12.096
It's all around being as a leader, staying at the forefront of it, understanding it.
00:11:12.096 --> 00:11:22.936
You've got teams, obviously, and lots of ingestion places and lots of sources of data, but it's really about that continuous learning right and staying updated with that, to be ahead of these things right, and not getting caught out with it.
00:11:23.284 --> 00:11:25.711
Well, I think so, but also working with smart people.
00:11:25.711 --> 00:11:33.394
So, from my perspective, as I said before, if I was the CEO of that bank, I would not expect that CEO to be a cyber expert.
00:11:33.394 --> 00:11:46.927
I would expect him to understand cyber risk and I would expect him to, or she I should say I'm being a bit presumptuous there, a bit old-fashioned he or she should then go and talk to the head of security and be able to have intelligent conversations.
00:11:46.927 --> 00:11:54.876
What is the best, most relevant controls and systems and devices and people and process for me to protect my organisation?
00:11:55.158 --> 00:12:06.351
Considering your career and what you're doing today and reflecting on your career so far, what would have been some of the most memorable or challenging experiences in the field you've worked in, and maybe even threat intelligence.
00:12:06.351 --> 00:12:08.071
But you get to see some pretty cool stuff, no doubt.
00:12:08.071 --> 00:12:09.215
And what have you learned from it?
00:12:09.215 --> 00:12:11.972
Any key learnings from your time in your career?
00:12:11.972 --> 00:12:12.936
I was lucky.
00:12:13.264 --> 00:12:14.330
I was very, very lucky.
00:12:14.330 --> 00:12:25.230
So, as I said, I started out in the 90s just as a bit of a computer nerd, playing around in a lot of cases with hardware you know plugging in Cat5 cables, crawling under floors, cabling.
00:12:25.230 --> 00:12:26.654
You know building servers.
00:12:26.654 --> 00:12:33.097
I was one of the first guys to sort of put a server farm together with all those blade servers in Australia in the late 90s.
00:12:33.097 --> 00:12:41.793
But I got really fascinated by cyber in the early 00s, and not because it was popular then, it was something that not I mean.
00:12:41.793 --> 00:12:52.914
You know, if you're lucky, you had a firewall, you know at all, maybe some antivirus on the endpoint, but I was absolutely fascinated about how you could compromise a system or break into a system.
00:12:52.914 --> 00:12:57.355
So that's only been in the last few years where that's become something that's so important.
00:12:57.355 --> 00:13:00.533
And now all of a sudden, you know, I get to come and talk to you on a podcast.
00:13:01.105 --> 00:13:02.110
I've got something worth saying.
00:13:03.128 --> 00:13:06.471
But that's been the key for me and I think you know it's all around.
00:13:06.471 --> 00:13:10.684
You know when people talk digital transformation and then the invention of the iPhone, you know.
00:13:10.684 --> 00:13:20.192
So we're now able to pretty much run our lives with a little pocket, powerful computer in our hand, and the bad guys know that they can make some money out of it.
00:13:20.192 --> 00:13:27.498
So now, unfortunately and I remember I was so impressed I saw Anthony Albanese sort of sitting up addressing parliament talking about cyber risks.
00:13:27.498 --> 00:13:34.630
Can you imagine that would have happened, maybe not even that long ago, with Not at all, yeah, not at all, right Even in Kevin Rudd's time.
00:13:35.147 --> 00:13:36.270
Did he ever say cyber?
00:13:36.270 --> 00:13:36.673
Probably not.
00:13:37.366 --> 00:13:42.855
No, it would have been an unusual term, right, and now it seems like we've just had it around for forever, right?
00:13:42.855 --> 00:13:46.985
I mean, that's how quickly things evolve and it's not going anywhere On that.
00:13:46.985 --> 00:13:52.889
Do you have any predictions of any significant shifts you see in cyber over the next few years?
00:13:53.730 --> 00:13:56.493
Yeah, I think so, so I won't go back into AI.
00:13:56.493 --> 00:13:58.014
We can probably touch on quantum.
00:13:58.014 --> 00:14:04.099
So one of my concerns about quantum is about this idea of data harvesting.
00:14:04.099 --> 00:14:17.190
We know that eventually someone's going to move enough qubits I think what are they doing now, like 80 or 100 at a time so someone's going to be able to move enough qubits to make the first quantum computer and we're not going to read about it on.
00:14:18.312 --> 00:14:18.793
X CRN.
00:14:18.793 --> 00:14:19.856
Yeah, we're not going to.
00:14:19.856 --> 00:14:20.057
No, no.
00:14:20.446 --> 00:14:21.147
So what will happen?
00:14:21.147 --> 00:14:24.777
It will be, hopefully, one of the good guys, will be one of our Five Eyes partners.
00:14:24.777 --> 00:14:31.207
Yes, if we're unlucky, it'll be one of hostile nation state and again, it's not going to be on the news.
00:14:31.207 --> 00:14:43.851
But what they will be doing right now is they'll be finding where there's data being transferred, either by over a satellite link or a cable that they might be able to get hold of, and they'll just be sucking all that into a massive big database somewhere.
00:14:43.851 --> 00:14:51.869
And once they do have that quantum capability running through a decryption system, bust the encryption, they'll have access to all this sensitive data.
00:14:51.869 --> 00:14:59.351
And while it won't be the most recent, you can imagine just how powerful any of this historic data is, so it could absolutely bring someone unstuck.
00:14:59.351 --> 00:15:03.636
So I think definitely quantum is going to be a game changer.
00:15:03.784 --> 00:15:05.552
Quantum is a fascinating one, because you're absolutely right.
00:15:05.552 --> 00:15:12.918
I watched a documentary recently when they talked about the amount of dollars being spent in the US and China to lead the quantum charge.
00:15:12.918 --> 00:15:16.767
And you're absolutely right, the quantum charge.
00:15:16.767 --> 00:15:17.349
And you're absolutely right.
00:15:17.349 --> 00:15:25.557
Even one of the recent Gartner symposiums I went to, they were talking about the same challenges, not only around the harvesting of the data, but also that this stuff's going to be powerful enough to break encryption that we've got today.
00:15:25.557 --> 00:15:36.953
So we have to think about a problem potentially bigger than Y2K, which is how do we re-engineer, how do we re-secure, how do we things like VPN know it could be broken quite easily if they get that right.
00:15:36.953 --> 00:15:41.730
So it's a pretty scary prospect to think about and I do believe that it's closer than people think.
00:15:41.730 --> 00:15:43.378
Right, you're right, someone's going to crack it soon.
00:15:43.378 --> 00:15:48.909
No one can hold me to the timeline, but I think it's going to and it's a quick, and you're right, no one will hear about it.
00:15:48.909 --> 00:15:52.674
It'll be done in some skunk work somewhere that might've already potentially.
00:15:52.695 --> 00:15:56.500
Yeah, yeah, yeah, I mean this is stuff we know about as as they say.
00:15:56.500 --> 00:16:02.207
Right, so as we, as we wrap up, glenn any key messages or takeaways you want to share with the listeners before.
00:16:02.268 --> 00:16:11.767
Before we finish up yeah, I think, don't panic is probably a good one so as, as, as I mentioned before, like the threat, actors are getting more sophisticated, the attacks are getting more sophisticated.
00:16:11.767 --> 00:16:25.591
The time for and I didn't mention this before the time for an attacker to turn a vulnerability that a vendor might disclose into an attack and attack real victims in the wild, that's all the way down to about four days now.
00:16:25.591 --> 00:16:30.789
So they're really, really rapid in deploying a vulnerability or deploying an attack based on a vulnerability.
00:16:30.789 --> 00:16:35.727
So the time for us, as defenders, to go out and patch these devices is getting hard.
00:16:35.727 --> 00:16:41.120
So there's absolutely a lot of challenges around keeping ourselves secure.
00:16:41.181 --> 00:17:06.355
But I think, from a don't panic perspective, as long as you're proactive and you build that resiliency into your systems beforehand, you think about what your assets are, you think about how they're connected, get your network into a defendable place, and then you go back to the really really old school type of things, like you know role-based access, defence in depth, and it doesn't matter if you might lose one battle, but you won't lose the campaign.
00:17:06.355 --> 00:17:14.545
So I think, as long as we're thinking about this now, we've got a sense of urgency, we're building that resilience into our people, process and technology.
00:17:14.545 --> 00:17:16.680
I think we have got a fighting chance.
00:17:16.961 --> 00:17:24.201
And the last question for you today is tell me about the most significant technology change or shift you've been involved with or you've seen in your time.
00:17:24.201 --> 00:17:24.663
It can be anything.
00:17:24.663 --> 00:17:25.807
It doesn't have to be cyber related.
00:17:25.807 --> 00:17:29.078
It could just be what's changed the world or what you've seen that's important here.
00:17:29.921 --> 00:17:34.438
I'll be showing my age now, but I do think it was probably the iPhone.
00:17:34.438 --> 00:18:00.507
So I remember, as you do, having your PC with the old dial up internet, and I remember talking to one of my mates that first got DSL and he's saying I just leave my computer on all the time you don't turn it off so, and not very, very long after that, we started to put the something more more powerful than that old computer into into our pockets and so all of a sudden, now we're not only accessing the internet from our homes, but from anywhere.
00:18:00.567 --> 00:18:05.943
so I think that's when, you know, obviously the internet had been sort of growing and growing and growing since then.
00:18:05.943 --> 00:18:14.236
But after that point in 2007, that first iPhone and I don't know how long it took before the adoption was, you know, pretty much everyone that's when I think it changed.
00:18:14.236 --> 00:18:26.116
That basically turned us from people that would go through and occasionally, or you know, use technology in discrete sort of blocks, to having it sitting in our staring into our phones every single day.
00:18:26.116 --> 00:18:28.084
So I'm saying probably 2007,.
00:18:28.084 --> 00:18:29.609
2008 was the game changer.
00:18:29.770 --> 00:18:34.471
Look I agree, it's a fundamental shift, right, and I see people just living and doing everything on their phone.
00:18:34.471 --> 00:18:36.076
It's so powerful and so incredible, right.
00:18:36.076 --> 00:18:48.604
In fact, I saw a cartoon the other day where it was a park bench with two robots effectively AI robots, the ones that they're trying to invent with the Teslas of the world, et cetera sitting on this park bench.
00:18:48.604 --> 00:18:57.906
One was reading the newspaper, one was drawing a painting, and all the people were walking past just looking at their phones, completely oblivious, and I thought that just really summed it up the way we're living, right.
00:18:58.055 --> 00:18:58.757
Oh, and isn't it crazy?
00:18:58.757 --> 00:19:05.653
So we could be sitting here today like now, with our phones sitting right next to us, and have our bank accounts drained while we're sitting?
00:19:05.693 --> 00:19:06.095
here, it's true.
00:19:06.698 --> 00:19:09.028
So that's it is amazing to think of.
00:19:09.269 --> 00:19:10.355
Yeah, it's absolutely incredible.
00:19:10.756 --> 00:19:13.605
We don't have to like walk into a bank and get robbed by a guy in a mask.
00:19:13.605 --> 00:19:17.684
Someone can be draining our bank accounts right now if we haven't got good cyber hygiene.
00:19:17.684 --> 00:19:18.426
It is terrifying.
00:19:19.737 --> 00:19:21.143
I tried to end on a positive note.
00:19:21.143 --> 00:19:21.344
You did.
00:19:21.344 --> 00:19:23.540
Now I've ruined it.
00:19:23.540 --> 00:19:24.041
No, no, no.
00:19:24.041 --> 00:19:25.507
But look, that's some considerations.
00:19:25.507 --> 00:19:27.661
Look, glenn, I really appreciate your time.
00:19:27.661 --> 00:19:28.765
Catch up in Brisbane.
00:19:28.765 --> 00:19:30.440
Really insightful conversation today.
00:19:30.440 --> 00:19:32.605
Thank you very much for having me, no problem at all.