New Penalties is a Push to Mitigate Cybersecurity Threats in Telecommunications and Healthcare

Yeah. And our attackers pivot very quickly too. You know, I'd say from my perspective and I worked for telco for close to twenty years, which is now critical infrastructure provider. Right? And then they become the interconnect to all other verticals like health care or utilities. Right? So if you can attack the communications, then you can now bring down anything. So then you start rabbit holing into that whole topic of resiliency. But, you know, my career at that telco, very difficult. Right? A lot of the things that Davey's hitting on. Right? You're you're always fighting for that budget. You're fighting for the headcount. You you know the things that you have to do for your security program, but, you just don't have the teeth. So one of the things that I like that has been a more recent trend is kind of the wave of cybersecurity regulations that are hitting, things like EU's, NIST two directive, the US national cybersecurity strategy, SEC cybersecurity disclosure rules. And there you know, there's a lot of regs. Right? And I could probably spend the next ten minutes just listing all of them. Right? Every nation state's gonna have their own and then verticals are gonna have their own, implementations of them. But they're saying a lot of the things that security practitioners have been saying for decades at this point. Right? Like, we have to be better at access control. We have to, monitor for intrusions. Like, what does our threat detection and response capability look like? Can we detect things timely, and then is that disclosed? How do we coordinate vulnerability response? So the regulations are finally starting to catch up with that. But then in tandem with that is also penalties. Right? And that that's the reality. Right? We are talking about businesses, and we're kind of in weird macroeconomic times. Although, hopefully, coming out of that, Right? But globally, things were very suppressed. So most organizations were scaling back all all of their spend. Right, whether it was IT or security. And and, usually, security is first to go. Right? Like, well, let's be honest. They're not revenue generating. The risk is just accepted by organizations. So now regulation kind of has more of that teeth. So if you're making sacrifices on your risk management approach, whichever aspect that might be, maybe it's access control, maybe it's threat detection, there's multiple pieces. Right? Patching, how are you managing supplier risk? All these are components of that. If you're making sacrifices there, it has to be disclosed, to the regulatory body or maybe the public. And then if you have a failure, like in the case of an incident or breach, there might be financial repercussions to that. Right? Your leadership might be at fault. Potentially, you can't practice. Right? Maybe there's criminal criminal penalties on the table. So that looks much different than it did twenty years ago. So as a practitioner and a a leader, right, I was managing or leading the application security efforts a component of it at, Verizon, and that was a large team. Right? Many organizations don't even have adequate staff. Right? Their security are are juggling all of the security roles. But I never had enough, people, and I never had enough money. And I was constantly fighting those battles, and it's exhausting. So, yeah, as a practitioner and leader and advisor, it's like, this is great. Right? This is music in my ears. We need to ride that wave because that's gonna improve all industries, certainly certainly health care. But, yeah, the tech hasn't really changed. We're talking about a lot of the same problems that just kind of got swept under the rug, unfortunately.