EP02: How to secure your organisations assets against cyber threats

Rapid changes in cyber space and diverse developments globally are impacting organisations on an unprecedented scale. Organisations are consequently facing various challenges around safeguarding their assets against cyber threats. This is an issue which is becoming pivotal to sustaining enterprise in today’s climate. In this episode, we delve into the situation and explore actions you should consider as a leader to effectively combat cyber threats and achieve a successful, cost-effective cyber security strategy for your organisation.

Yemi Olutola, a Senior Cyber Security Consultant at Mazars, explores how organisations can safeguard their assets against current and emerging cyber threats. Yemi is part of the Cyber Advisory team which offers a range of cyber security services designed to assist with an organisation’s ability to protect its information assets and prepare against cyber threats.

Joining Yemi for the discussion is Chris Vaughan. Chris is the Area Vice President for Technical Account Management EMEA, at Tanium. Tanium, is a cyber security company that provides converged endpoint management via a single platform to give visibility and control of an IT environment and integrate IT, Security, Risk and Compliance.

Get in touch

If you would like to find out more about how we can help your business remain at the forefront with technology, please do not hesitate to get in touch by clicking the button below and a member of the team will contact you.

Contact us

Episode Links

Guest Links

Transcript

[Music]

Yemi Olutola: Hello and welcome to the next episode of the Tech for Leaders Podcast with Mazars. For those of you who are new to our podcast, welcome. And to our returning listeners, welcome also. I'm Yemi Olutola and I'm your guest host this week where we'll be exploring and providing guidance on how to protect your organisation's assets against cyber threats. The world seems to be moving at such a fast pace with technology and information technology abounding, and with it come the different changes. Organisations have also been forced into new terrain brought about by unexpected developments such as the pandemic, an increase in state sponsored attacks as just some examples. To discuss this topic, I'm happy to be joined today by the Area Vice President of the Technical Account Management for the EMEA Regions at Tanium, Chris Vaughan. So, Chris, welcome.

Chris Vaughan: Hi, Yemi. Thanks for having me today. I'm really excited to talk to you about cyber threats we're facing today.

Yemi Olutola: Thank you. For those of you who are not familiar with Tanium, they are a cybersecurity company with offices in North America, in Asia and Europe, and they are currently the only ones in the industry who offer converged endpoints management via a single platform to give full visibility and integrate I.T. Governance, risk, security and compliance. We have joined forces with Tanium to provide additional benefits to our clients by leveraging Tanium’s powerful discovery, remediation and reporting tools. So, Chris, once again, welcome. Thank you for joining us. If we could start with you explaining your experience with technology and your link to today's topic, please.

Chris Vaughan: Yeah, my experience with technology, it goes back to, back to my university days. I used to work in high performance computing, and I like telling this story because I think it's very relevant to the topic at hand today. When I was in university, we used to call our servers and I worked in a high performance computing lab after Lord of the Rings characters, Star Wars, movies, these types of things and reason you could, you could do that is because you didn't have that many and we had the directory server over there and that was called Gandalf because he was all knowing. We had a file server that was the death star and that always seemed to be blowing up. So that's kind of where I got my start in I.T, in high performance computing. And since then, you know, the worlds really changed. You know, things like mobile phones, mobile computing have really taken off in that time period. And it's, I feel really fortunate to be part of the ride. But in my role at Tanium today I work with some of the largest organisations on the planet. You know, we support I think it's over 50% of the fortune 100 customers out there-

Yemi Olutola: Okay.

Chris Vaughan: -we're deployed on eight of the ten top banks in the world, you know close to home we work with customers like Barclays Bank, AstraZeneca. In my role I'm talking to them about how they can secure and manage their end points at scale and at speed. And it's fascinating, and I really enjoy the topics that we're talking about today because, you know, that's why I got into I.T in the first place.

Yemi Olutola: Great. Thanks for sharing that with us. It's interesting to see or to hear how, you know, things have kind of developed or evolved from your university days to where we are. I mean, all these names that you would give these, these assets and then, you know, obviously things have developed since then. So, thanks for sharing that with us. Chris, could we start perhaps by exploring what we mean to our listeners, exploring what we mean by assets, at least in the context of today's conversation?

Chris Vaughan: Yeah. So, assets in the context of today's conversation it's you know, it’s, well let's talk about assets just broadly speaking for us to get into specifics. But, you know, when we talk about assets from an I.T. Standpoint and a cybersecurity standpoint, it's really anything that's connected over the Internet, you know, anything that has an IP address. So, that could be, you know, your smartphone, your smartwatch, you know, it could be an IP camera, you know, it could be your dog feeder in your house or your remote control robot that sweeps and vacuums the floor. But in the context today, really what we're talking about is computing devices such as laptops, servers, desktops, and then also whether it's either hosted on premise in your own data centres or hosted on the cloud. Because remember, cloud computing is just somebody else's computer that you're using somewhere else. So, you still have to manage it. You still have to secure it. And then we can also talk about, we also talk about other paradigms such as virtualisation and containers as well.

Yemi Olutola: OK, thank you, Chris. Right. So, thank you now we have a better understanding, at least of assets in the context of today's conversation. One of the things that I have found is that cybersecurity can sometimes seem quite complicated, and also for organisations or perhaps business leaders it can sometimes seem a daunting task to undertake in terms of what needs to be done to secure assets. And yet we have you know, we have cybersecurity becoming this, you know, topical area. It's, you know, one of the top, you know, key topics right now, and also, you have, you have it top in many board agendas, and rightly so. Yet you find that there's an increase, you have an increase in terms of cyber threats and cyber attacks at the moment. Why do you think it is that, it's difficult for organisations to secure their assets effectively against cyber threats?

Chris Vaughan: Yeah, I think you know it’s; it's ever evolving. And I talked about how computing has really changed in the last 20, 30 years I've been in the industry for. And you know, no time greater than now the pandemic has really forced us to transform our organisations. And there's great memes going around on LinkedIn and Facebook, and it was you know, who pushed forward the transition to cloud or digital transformation initiatives, and it was Covid-19 at the bottom, and you know, somebody saying there it wasn’t your I.T architects. It wasn't the CIO, ultimately, it was them that put in the plan. But, you know, a lot of these plans were over ten years, and they get condensed right down into, you know, two years. During that time, we saw that there was a big shift from on premise to off premise. And typically, most organisations had built their security infrastructure with the idea that at any one point in time they would only see about 15% of their staff working remotely. A lot of them had fixed desktops, fixed laptops, the devices didn't really leave the perimeter. And they invested heavily in things like intrusion protection systems and you can think about it as, you know, a big castle and we were talking to a gentleman on the way in about how he goes to Warwick Castle and you know Warwick Castle, I haven’t been there but described, you know, it's got a moat there, it’s got, you know, big walls there and, you know, well Warwick Castle used to be able to see everybody walking in and out. When you start moving people off premise that security, it disappears there. And that's what we've been seeing across organisations for now about ten years now is a perimeter starting to dissolve. When the, when Covid struck you know, I had one customer they moved something like 60/70% of their endpoints offline, sorry offline as in work from home overnight. And you know that creates new security problems there-

Yemi Olutola: Indeed.

Chris Vaughan: -and you know suddenly those devices they couldn’t scan for things like vulnerabilities, check to see if they're patched. They didn't know, you know, who was using what device for what. And a lot of times they were forced to use their own laptops at home because they, the company they worked for weren't able to keep their business continuity plan, because they'd never thought that, you know, suddenly, you know, we need thousands of laptops for people to work from home, and a lot of the traditional kind of security checks since things like that have been skipped. And, you know, I remember being on a zoom not long ago and one of the attendees on there came up as little princess, one, two, three. And I said to individuals like, who's little princess? Is that your nickname? He's like, no, no. It's like my daughter's been using my work laptop for school because they had to do that during the pandemic-

Yemi Olutola: Yes.

Chris Vaughan: -and, you know, so that's really changed things that shift there, and then it's also the different paradigms in computing. So, you know, cloud computing is still quite new for a lot of organisations. You know, people will quickly move into the cloud, but then they forget that they have to secure it and manage as well. And a lot of the tooling they have is built for that on premise world. It's not built for remote clouds, it's not built for remote employees. So, it's become a real difficult challenge and then also our adversaries, they're getting better. You know, if you, in the market, they've got marketplaces, so you can pay for credentials, you can pay for access, you pay for malware and kind of mix and match. So, there's really been a rapid boom there and it's gotten easier for the adversaries, but it's also gotten easier for us to work from home, so there's a lot of benefits there, too.

Yemi Olutola: So, Chris, one of the things that I’ve found with cybersecurity, we have so many things that are going on. So according to the NCSC, that's the National Cybersecurity Centre, for example, you have well, at least in 2021, there was a record level of online scams nearly four times higher than in the previous year apparently. Then you have, you know, this ever evolving cybersecurity, cyber, cyber threat landscape where you know, there's just different things going on. There's this propensity for the unexpected to happen with the NCSC again, they've mentioned they issued a heightened cyber threat alert earlier in the year, on account of the war between Russia and Ukraine. Then you then have these notable developments, which you've also alluded to, so, you have things like cloud services you've mentioned that you have the pandemic, you've spoken about the impacts that the pandemic has had. But in this context, you have the workforce who are now more than ever using their own devices, bringing those to work. Who would have thought that a few years back, and then you have supply chain related issues or you have third party related matters.  Looking at all of these notable developments, it seems as if, it doesn't seem as if, it is that technology and information technology are quite dynamic in nature. So, the question then is how can organisations maintain a handle on what is this clearly ever moving train?

Chris Vaughan: Yeah. Yeah, it's, it's tough, isn't it? There's a lot going on at once. And then, you know, not only work pressures, but home pressures, too. And-

Yemi Olutola: Yes.

Chris Vaughan: -working from home these things too. I think, you know, organisations there's lots of ways you can get a handle on this. You know, what we find with our customers and what I talk to them a lot about is just getting the basics right. So, things like understanding how many assets you have, understanding what state they're in, understanding what data it is you're trying to protect, and if you can do those things, you know, good patching, good asset management, then it makes a lot of problems just disappear overnight. And it's amazing how these simple things can do. I think also, two, is, you know, the best offence, sorry, the best defence is a great offence . You know, start getting prepared for these situations here. You know, practice your incident response plan, practice your data recovery plan, make sure that these processes are working and that you can execute on them. In terms of the adversary, you know, they're always going to be innovating and changing things. You know, you really, you know, organisations need to adopt a really secure, first type culture and be thinking about security all the time and every time. You know, a few months ago, I got hooked on one of those phishing tests from, from the company-

Yemi Olutola: Oh dear.

Chris Vaughan: -and, you know, I was wearing a badge of shame around the office for a couple of days. So they're really stealthy, I think I just booked my holiday for the summer and then it said, your holidays are being cancelled, click here to find out more. And I’m like what?  Clicked it. But, you know, luckily that was a simulation, and since then, I've been a lot more security minded. So, it's keeping that kind of security culture and keeping everybody thinking about security is a great way to, to just, you know, take a step up there. So, you know, to me that's kind of, you know, how you can keep up with the ever expanding trend there. And if, you know, you find yourself stuck, there's lots of resources available. You mentioned NCSC earlier on. I love their guides on the website because it's written for not only, you know, the big enterprises, you know, we talk to on a daily basis, but it's written for you know, mum and dad as well on how to shop online securely. So, it’s really easy to consume. Then, you know, for enterprises, if you need more help, you know, there's many managed service providers out there, you know, as organisations such as Mazars that  can help too. So, you know, reach out and get help there. You don't need to be developing your own security practice if you can't do it. You know, there's plenty of other companies that specialise in this.

Yemi Olutola: Indeed, indeed, indeed. So, you know, there's this saying that you are as strong as your weakest link. And what we have found, or what we do find is threat actors in their different guises trying to seek out an organisation, you know, the weakest links within organisations. To that extent what would you say are perhaps the emerging issues in cybersecurity or the cyber threat landscape, which perhaps leaders or business leaders ought to be mindful of in terms of weaknesses and vulnerabilities that are kind of emerging.

Chris Vaughan: Yeah. It's, you know, it always comes back to the human element in it, and you know, we are the weakest link. And, and sometimes it's not, not necessarily cyber it's you know, we've made a mistake, tried to make a code change or config change, you know, the middle of the night there and suddenly, you know, you've misspelt the server name and it's gone down. But, you know, in the context of the cybersecurity, you know, two of the biggest ways of compromising, well, the biggest way of compromising the organisation is still through phishing. So, you know, you need to protect that front line there. But you know, from there, it's, the biggest one is business email compromise. So, they get access to your email accounts, you know, they look at the billing organisation and then they impersonate either the customer or they change the digits on the bank account number or sort code and suddenly that money you thought you were paying to your, your vendor is actually going into the cyber crimes bank somewhere. So, you know, that's one of the big things and then when you look at, you know, endpoints in the further organisation, it comes down to ransomware. It's, you know, they get access to that initial endpoint by somebody clicking on a lure. And when I mentioned lures, lures is something that will get you to click on something. So, you know, for me when I failed that phishing thing, it was, you know, they timed it and said, your PTO had been denied. But the cyber criminals, they're starting to use a lot of themes that are in the news. So, during the pandemic, we saw a lot of vaccine type lures there. You know, we're apparently moving towards a recession. You know, money's going to get tight. You know, you might see a bit more Lures there, might be some get rich quick schemes there. So, you know, in terms of that, you know, the adversary will compromise through phishing, endpoint and then they'll move into the organisation and detonate ransomware and then they'll demand Bitcoin from you there. So, you know, weakest link is always the end user followed by that, it’s, it’s your perimeter. It's, you know, exposed servers on the, on the web and, you know, those remote log in devices that are exposed there reminds me of Colonial Pipeline-

Yemi Olutola: Yeah.

Chris Vaughan: -I think it was last year or the year before and for our listeners Colonial Pipeline, they were compromised through a remote access server. They'd been able to VPN into an organisation. That was password protected but they didn't have two-factor-authentication or multi-factor authentication and they ended up taking out the East Coast oil pipeline for a number of days there. It caused panic buying, it caused shortages on fuels, on fuel;- petrol, diesel, they call it gasoline over America, but it took them numerous days to recover. They did pay the ransom, $4.4 million, but they didn't get their assets back as quick as possible. So , you know, look at those exposed endpoints and just put in simple things like multi-factor-authentication, you know, most of VPN providers out there, remote desktop providers have this as a capability, you know, be investing in a lot of these simple things. And understanding where your perimeter is and comes back to knowing where your assets are.

Yemi Olutola: Yes, yes, yes. You know, another thing that, you know, comes to mind, you just mentioned the recession, this, you know, impending recession. And a lot of organisations, a lot of business leaders currently have so many other competing interests that sometimes I guess it might be a bit of an uphill task to decide or determine, you know, which ones should be priority and which ones shouldn't. Why do you think this topic is, you know, one that should be deemed priority by organisations in the present climate that, you know, the times, the present times that we were living in?

Chris Vaughan: Yeah. It certainly should be very, very top of the list. You know, if you go back five to ten years ago, it's quite amusing that, you know, the things that could take out a business, it wasn't a pandemic first of all, you know, that was very low on it. You know, cybercrime there, cyber was on the list, but really low down. Today that’s number one on the list or close to it. The reason why it's so high is that, you know, we had some devastating cyber attacks around 2015, 2017, yeah 2017-

Yemi Olutola: 2017.

Chris Vaughan: -got my dates wrong. WannaCry and NotPetya and they completely incapacitated some of the biggest organisations in the world. You know, one of the big ones was Maersk Shipping Company brought them down to a standstill for multiple days. In the UK TNT really suffered from it and most importantly, the NHS itself got hit by it. But you know cyber attacks can literally stop business in its tracks and halt it, and the knock-on effects of that are immense, immense. And it's even to the point where you know, it can cause physical injuries in the real world. I was looking online this past week and there was an Iranian steel mill. They had a cyber attack there and they were able to explode the steel mill. And then also devastating article I saw in The Wall Street Journal a few months ago, and they attributed the loss of life to a ransomware attack on the hospital and said, you know, if the ransomware hadn't hit the hospital, it wouldn’t have resulted in loss of life. So, it has real, real measurable consequences in the physical world, unfortunately. And it's all from the stroke of a keyboard.

Yemi Olutola: Yeah. So, the, the effects are far reaching, essentially-

Chris Vaughan: Yeah.

Yemi Olutola: -yeah if you're hit as an organisation. So, Chris, what would you say then in terms of or irrespective of an organisation's size, what would you say should be just some basic steps, perhaps, that organisations should be taking to you know improve their cyber hygiene?

Chris Vaughan: Yeah . So first off, it's understanding what you've got, how many endpoints you have out there, you know, physical, virtual, remote, connected, truly understand that, because if you don't understand what you've got, then how can you secure it? So, first asset management discovery, second step on that is understand what state they're in. So, you know, are they patched, are they compliant? Which means if their patched, if they're compliant, they're genuinely as secure as they can be out of the box.

Yemi Olutola: What does the patching do for?

Chris Vaughan: Patching it fixes common vulnerabilities on, on an endpoint there that hackers could take advantage of. So, a vulnerability you can think of, it's like a skeleton key, if a hacker knows that vulnerability exists, he can pull out his skeleton key unlock that and can gain access to that endpoint. Patching removes the skeleton key access on that endpoint and you know, only ways of getting onto that endpoint. So, you know, do that. Next off, once it’s nice and safe and secure and you know, there's no particular order in here. You know, I kind of, my understanding of where your data is can also help drive the priority of your patching but that would be second or third for me, you know, understanding where your critical data is in your environment. And, you know, then start cleaning that up. I mentioned lots of people were bringing devices home, people were using their own devices for work purposes. And a lot of that data is on devices where you wouldn't expect it, so, make sure you're cleaning that data up, getting it back into the places where it should be. And then once you've got that data in place it’s about understanding the controls and access to get to that data, we talked about more Warwick Castle there. You know, we've got the Tower of London not far from us there. The queen's jewels is always kind of right in the middle of, of the tower of London because they know that's most important thing and they make as many steps and as hard to get to that spot as possible. So, treat your I.T environment like that as well and your secrets also. And so, and then also make sure that you're doing things like putting in multi-factor-authentication. Okay, I would also recommend looking at a zero trust architecture so that if your device is on premise or off premise, it's as secure either, in either setting there, that way you know you've got, you know, latest antivirus install, latest patching-

Yemi Olutola: Okay.  

Chris Vaughan: -you're managing that endpoint offline when it's online as well.

Yemi Olutola: So, okay, so you've mentioned a few steps that organisations or business leaders should be taking to improve their cyber hygiene. Who would you say then are the key stakeholders in this respect? Who are the people that need to be able to move this forward? What role should they be playing to, to make their efforts count effectively?

Chris Vaughan: Yeah. And ultimately, you know, the first person, the CIO, Chief Information Security Officer, and that person's job is securing the organisation from cyber threats. But more importantly to get, you know, a good CIO in place, you need to have support from the CEO, the CFO. And then also I think legal needs to be considered as well because legal will be able to help measure the risk and liability if you don't have these safeguards in place. So, you know, what are the fines for say a data breach? Such as GDPR? British Airways got hit with that not long ago when they leaked some customer, well they didn't leak, they got compromised and there was a big fine there, multiple millions. GDPR by default, I think, is 4% of their gross annual profit, which is a large, large amount of money for an organisation. So, you know, need to invest in it. And then once you know, you've got a good security program in place, good structure that relationship between the CSO and head of I.T operations or CIO needs to be really strong as well because a lot of these controls that I talked about being able to patch endpoints, being able to check them for vulnerabilities, the tooling will typically reside in the I.T Operations Team and they need to be empowered to be able to patch things and make sure that we've got a clean bill of health. But when I talk to C-level individuals, the first thing I talk to them about really is making sure you've got a good security culture and then you know that you have security at the forefront of your mind, that you're doing regular tests there, you're investing in it, and then also making sure that you're adapting and being ready for the future.

Yemi Olutola: Okay, okay. So, we've spoken about the different approaches on measures should I say, which business leaders could take to safeguard their assets. In your, from your own experience, would you say that any organisations come to mind who have embraced some of these measures and, you know, as such or as a result of, you know, embracing those measures has seen favourable outcomes. Are there any organisations that perhaps you could share with us from your own experience, that is?

Chris Vaughan: Yeah, I can’t name specific organisations, but we work with a lot of the large financial institutes. And, you know, their job is securing our money. A lot of that moves digitally today, and, you know, I feel like they're doing a really good job there. They're investing in it, and, you know, my money is consistently, arrives in my bank account. And, you know, when it, I haven't been a victim of fraud, knock on wood there but the feedback and the like. But you know, they seem to be doing it well, you know, and they're probably the most crucial, you know. Well, there's many crucial organisations out there-

Yemi Olutola: Yes.

Chris Vaughan: - but you know, if your money disappeared, you would be up in arms. You wouldn't trust banks anymore to, to look after it. So, I think they do a good job. I mean, a lot of organisations do a good job. The theme that I typically see in organisations that do a good job is they really internalised this security first culture that I mentioned. They are investing in their organisation, and they are iterating and adapting their security programs to make sure that they're ready for future threats and that they're responding to current threats. But it's organisations that are thinking that, you know, they're going to get compromised and they're trying to do something about it constantly and trying to stop the adversary, the ones that are best suited. The ones that typically get compromises, they're not thinking they’ll get attacked, they think they're immune, and I don't think there's many organisations out there that are immune from attacks these days.

Yemi Olutola: Yeah, no, no unfortunately. In terms of where an organisation has embraced some of these things that you've, you know, you’ve suggested, if there were some, you know, like just fully embrace them, what realistically can they expect to see? Does that mean, you know, once they have embraced these, you know, measures, would you say that they can realistically then just, you know, rest on their ‘laurels’ and expect that things will, you know, continue to be secure, that their assets will continue to be secure.

Chris Vaughan: Great question. You know, no, no, no is a quick and easy answer. The adversaries, they're always innovating and adapting their business models, you know, for any changes. You know, if you look back, you know, five or ten years ago, a lot of where hackers spent their time was trying to get credit card numbers and personal identifiable information because they could use that to get access to money that's changed in the last few years to, to ransomware. And a lot of what's driving that is new ways to, to get paid and especially Bitcoin in this example, it's a lot harder to trace Bitcoin transactions than it is actual real world physical money transactions. So , we've seen a big switch to ransomware and with that, the targeting has switched. So, they used to target mostly financial institutions, to try and get these credit card numbers or any company that would take a credit card there because usually they had records of credit cards and with, with ransomware, it's, everybody's a target now. And, you know, they've gone after horrible places like schools, you know, who would want to, sorry, hospitals-

Yemi Olutola: Yes, indeed.

Chris Vaughan: -you know, who would want to ransomware a hospital, really, really sick individuals targeting that. And that's you know the most it needs people there. But, you know, they've adapted their model because those organisations will pay out to un-ransom. And, you know, insurance industry helps with that as well to recover. So, you know, they've adapted their model, and so should organisations adapt a model to fight it. There's a lot of innovation going on in the software market to help fix these problems. You know, there's a lot of good information out there, we mentioned the NCSC earlier. For those that might be listening from the US, CISA get some great actionable information as well.

 Yemi Olutola: Yes.

Chris Vaughan: So, but I feel like, you know, we know more about the threat today than we ever have and we know more on how we should be securing and managing endpoints.

Yemi Olutola: So, the key message really is we have to keep at it, it's not, it's not something that you just do and then, you know, you sit back. But I guess hopefully if you have, you know, the right measures in place, at least you can say that you, you can effectively safeguard your, your, your assets to a great extent and then just keep at it essentially.

Chris Vaughan: Yeah, and I don't know if you watch TV at all, there's this TV show on at the moment called The Undeclared War, which talks about, you know, cyber attack there. And, you know, part of the things you're seeing on the TV in this, this fake cyber attack, is deep fakes where they're impersonating people like the prime minister on TV and they're rebroadcasting that on the news, and people are thinking that's a prime minister that's actually saying these things. But, you know, the technology's really adapting you know, it's a bit easier to fool people, you can impersonate people's voices if you’ve got enough recordings. A.I. is really going to really feel that in the future as well. There's a lot of chatbots out there that people talk to, and they think they're real human. I saw a news article recently and it was a Google researcher saying that Google's A.I is sentient now and, you know, it's only a matter of time, trying to scare people. You know, the, the applications of these you know changes and you know, the way we use technology are really going to manifest itself in the cyber world as well.

Yemi Olutola: Right. So, we've covered quite a lot of ground today. We’ve talked about the fact that cyber threats are increasing, we’ve talked about measures that business leaders can take, we've also covered, you know, the evolving threat, cyber threat landscape, it, as it were.  As we draw this podcast to a close, I can't believe we're coming to the end of it, we just started, it seems. But anyway, as we draw, as we draw this podcast to a close, what would you say should be the key takeaway for business leaders?

Chris Vaughan: Yeah, multiple key takeaways I've got, to me you know, the main takeaway is, you know, adopt a security first culture and, you know, always be thinking about security there. It's not necessarily the shiny new widget there you've got in the software department that's going to protect you. It’s everybody doing their little bit to make the organisation secure. But, you know, once you've got that in place, then start with the basics. Make sure that you're managing your assets. Make sure that you've got real time visibility of all those assets, you understand what they're doing every day, every hour of the week, and make sure you're able to manage that and so, you know, being able to discover what you own, being able to patch, make sure they're compliant, make sure they’ve been inventoried. Make sure that they're doing the job they're meant to be doing. You know, computers are great things that make our life a lot easier. You know, if we secure and manage them correctly, then, you know, they won't work against us and make our life harder.

Yemi Olutola: Indeed, indeed. Chris, thank you so much, all sounds like great advice. Thank you so much for joining us today to help navigate this seemingly complicated course and doing it so effortlessly. So, thank you so much.

Chris Vaughan: Yemi it's been an absolute pleasure to join you and thank you very much for your time today.

Yemi Olutola: Thank you.

[music]

That brings this weeks episode of the "Tech for Business Leaders'' podcast with Mazars to a close. If you enjoyed today's show, please subscribe to the series and leave a review to help us extend our reach and keep technology at the heart of the business community. We look forward to sharing more with you in our next episode but for now, take care and thank you for listening.