Coming up on DTNS, gaming sales sort of kind of went haywire last month. Wi-Fi 6 is finally upon us. And is Jeff Bezos running Amazon again? This is the Daily Tech News for Thursday, April 23rd, 2020 from Studio Redwood. I'm Sarah Lane. From the shores of Lake Erie, I'm Rich Drafalino. From Oakland, California, I'm Justin Robert Young. And I'm the show's producer, Roger Chang. Tom Merritt is off today. Don't worry, he's alive and well. And we'll be back on the show tomorrow. But we've got a lot of stuff to talk about. In fact, speaking of talking, on GDI Rep, before the show started, we were talking about great lakes, how to rank them. And if lakes are kind of like oceans or something else entirely. If you're interested in that and all the stuff we talk about, good day internet. Become a member at patreon.com slash DTNS. Let's start with a few tech things you should know. According to a conversation between Apple CEO Tim Cook and European Commission for Internal Markets Theory, Breton, the first phase of Apple and Google's cross-platform contact tracing API should be available to developers using it on behalf of public health agencies starting on April 28th. Breton shared a photo of him having a video conversation with Cook and told Las Echoes that Cook confirmed the April 28th date has been moved up from the original mid-May release. Phase two, which would be a system update to build in opt-in contact tracing at the OS level for both Android and iOS, is expected later this year. Apple and Samsung announced that an Apple Music app is now available on Samsung's most recent TV models for its 2018, 2019, and 2020 lineups, which already support the Apple TV app. The app has access to Apple Music content, including playlists, videos, and radio stations. Apple and Samsung have an interesting relationship. Social network Nextdoor and Walmart, speaking of relationships, are co-launching a neighbors helping neighbors program to help the elderly or high-risk or otherwise vulnerable Nextdoor members get help from neighbors who are already planning a trip to go to Walmart. Nextdoor users can post to groups associated with their Walmart store to request assistance within the app. The shopping details can either be worked out in the group thread or through direct messages. Got to tell somebody your address or something like that. Nextdoor says since Group exited Beta a few weeks ago, it's seen a 7x increase in people joining groups to help each other out. And Instagram spokesperson told BuzzFeed News that the company is accelerating plans for an account memorialization feature, which would add the banner remembering under the username of a deceased person. Instagram currently allows family members to submit forms to memorialize accounts already, which preserves the account, prevents logins from using any password, even the one, the correct one for that account, and removes it from the Explorer page. Instagram did not announce when the new banner would launch. CEO Eric Yon announced on Wednesday that more than 300 million people joined Zoom meetings on Tuesday, April 21st, up 50% from the beginning of the month. In response to security concerns about its platform, Zoom said in a blog post that it's rolling out a software update this week that will include letting users report Zoom bombers giving users more security settings and will no longer send analytics data to Facebook without alerting users. Amazon Web Services launched Amazon AppFlow, which aims to help developers streamline data transfers between AWS and system as a service apps like Google Analytics, Marketo, Salesforce, ServiceNow, Slack, Snowflake, and Zendesk. Although Dataflow can be bidirectional, AWS's announcement plays up how AppFlow can move data from those applications to other AWS services for further analysis and then transform the data as it moves through the service. AWS defines each flow as a call to source application to transfer data to a destination, and each flow costs $0.001 per run with data processing start at starting at $0.02 per gigabyte. All right, let's talk a little bit more about people buying video games. Yeah, that's right. Nielsen's super data report that digital video game spending hit a record high in March with revenue topping $10 billion. The highest ever total for a single month and 11% year over year increase. In the number one spot, I think unsurprising to everyone is Nintendo's Animal Crossing New Horizons, which launched just on March 20th and sold 5 million digital copies at the end of the month, beating a record set in 2018 by Call of Duty Black Ops for kind of crazy. Call of Duty Warzone, meanwhile, which launched on March 10th, increased monthly active users by more than 150%, peaking at nearly 63 million active members. Bethesda and id Software's Doom Eternal sold 3 million digital copies last month. All these things are so dramatic I have to punch them up. More than three times what the 2016's Doom sold. Overall console spending was up 64% month to month from $883 million to $1.5 billion, and PC game spending was up 56% to $567 million. In mobile, meanwhile, revenue jumped 15% year over year, which doesn't sound like a lot until you realize it's $5.7 billion for March, with Timmy and Tencent's Honor of Kings in the number one spot. So yeah, kind of just, I mean, we talked about this on DTNS before, kind of on the competition side of this, but yeah, kind of the numbers bearing out that for a lot of reasons, people are isolating at home. A lot of people are out of jobs right now and spending that time either playing mobile games or buying Animal Crossing, it seems like. Yeah, I mean, Animal Crossing, not a huge, I mean, it's a huge smash hit in 10 days previous record from Call of Duty for the entire month. These numbers, if they were sort of like incremental bumps, you might say, looks like the trend, I mean, maybe games are getting better or the consumer spending is on the rise in general. I mean, this has a lot to do with, people got time on their hands, people are home, people are looking for an escape, all of the above. I still kind of have to be like, okay, how much more time do you have exactly? I mean, certainly if you're out of work, you. Sarah, that's the answer. For 22 million Americans, it's all the time because that's the amount that we now know have filed for unemployment at the very least. There's likely far more that haven't and it appears that they have now found a new pursuit under the tutelage of Tom Nook. Google announced that it will start requiring advertisers to verify their identity in an effort to prevent misrepresentation and allow users to see who is running ads. Google previously collected basic information about an advertiser but didn't require documentation such as government IDs from individuals representing the organizations to verify. The change will roll out in the U.S. first and Google expects it to take several years to implement the change globally. Advertisers will have 30 days once notified of the requirement by Google with accounts suspended from running ads if not verified in that window. Consumers will start seeing identity info in the why this ad button in search starting this summer. Google began requiring political advertisers to verify identities in 2018 so they could run election ads. Man, every time I see a why this ad link now, I'm like, it's because I'm looking at an ad for a bunch of sweatshirts because I was looking at sweatshirts over the last week because all I do is live in pajamas in my home. But yeah, I mean, kidding aside, there are times where I'm kind of like, well, it's not about, you know, and I've been trained to largely ignore ads because they're ads. But yeah, the more people who have more information like this and to hold, you know, folks feet to the fire who are representing these organizations who have kind of been able to slide through in the past Google saying, yeah, we asked them for information, but none of it is really verifiable. It's nobody really on the hook was saying, yes, I am the person who's running this company. Here's who I am. Here's my full name and where I live and that kind of thing. I don't know. I mean, it's a step in the right direction as far as information being public knowledge. It shows that Google thinks this is a real, real, real problem because they don't want to do anything to mess with the goose that lays the golden eggs. Ad words is that goose and the golden eggs are what make everything else at alphabet go. None of the other stuff that they are able to try that they are able to pour resources and money into happens unless they are able to make the gigantic industry shaping amount of money that they get through AdWords. So for them to do anything that would require action and if you do not provide that data, you will now be suspended from giving Google money. That is a major issue. And to me, it is a sign that they are either girding for something that will be coming down the road in terms of government interaction with them or they are just trying to head off a PR problem before it happens and they know that maybe some people are running ads that they don't want them. Yeah, I think two things stand out to me from this story. The first is that beginning to verify identity for political ads in 2018. I think at the time, that was seen as like, we're in this very contentious political environment in the US and this is a way to add some transparency to that. Really though, also a field test for the impact that this potentially would have in terms of verifying information for something that is by percentage a very small amount of the ads that they actually run. And then the other thing is that this will take several years. So this isn't Google flipping the switch and potentially seeing a significant impact on ad revenue overnight. Yes, this will be a long-term project.  They're going to get a little bit of a PR bump for doing this even if we don't see this worldwide into the mid-2020s or something like that. Bloomberg sources tell Mark Gurman that Apple will ship at least one Mac using an ARM processor in 2021 next year. The company is reportedly working on three processors based off the A14 design that will be used in the next iPhone model. TSMC will reportedly make the chips on a five-nanometer process featuring eight high-performance cores codenamed Firestorm with at least four energy-efficient cores called iStorm. Sources, Google doesn't say, but sources do say that Apple is exploring Macs with more than 12 ARM cores for future models. Yeah, so seeing this... Yeah, this stuff is... I mean, it's been in the works. We've heard rumors. Mingxi Quo noted Apple analyst who's always got the good stuff said that, some of the stuff could be happening as soon as this year. There may be supply chain issues that have drawn that into question or it might have just been pushed back by the company. But, Rich, you had some theories about why we've seen some of the products as of late that we have. Yeah, I think this has a lot... Seeing this really made the recent iPad Pro refresh make a lot of sense to me because when that first came out, it kind of seemed not like a... If you're in the market for an iPad Pro, they up the storage. There was a marginal increase in graphical power. But if you look at the benchmarks for that device, it really is... They literally just took the exact same CPU. They added a little extra graphics score. They doubled the memory. And that was about the extent of the refresh. They put a new camera in the back as well. But seeing now that they're going to be moving to that A14 for that first generation, whatever that MacBook is going to be, I'm assuming it's going to be a laptop device, with that A14, that means there's going to be a two-generation bump. And whatever processor they do, at least if they'd go from the iPad model, that's a very souped up processor compared to what's going to be available on that iPhone. So then you're going to be looking... The next comparable thing that everyone's going to be looking for from that device is going to be those iPad Pro numbers that's going to be the only comparable thing in the ARM ecosystem. And there's just going to be this huge increase between those two chips. And I think it really is designed so that there are going to be a lot of bumps along the road. I feel like it's... I mean, it's Apple. They're going to try and make it as smooth the transition to ARM for macOS as possible. But having that huge performance bump that they can boast, you know, this is 4x or whatever, you can render 8k video in three seconds or something like that, I think is a reason they held off instead of using an A13-based chip for the iPad Pro this year that they are holding off on that, virtually because they have no competition in that high-end tablet space anyway. They can afford to do it. It's still a high-performing chip. And then to have that Mac with that A14-based and really put out some stellar numbers for some very specific applications. I'm sure they're going to have their Mac apps optimized for that. And they'll really be singing on that A14-based chip. So it really made that iPad Pro, that approach to that make a lot more sense if these rumors do pan out. I mean, I will say this is something that everyone's kind of been predicting for the past, what, seven, eight years. There's still questions remaining. What are they going to do with their existing... I mean, they just released the new Mac Pro with the cheese grater look design case. Are they going to keep two lines? Are they going to keep the standard everyone uses an arm? If you're a pro, then we still have our Intel line, which is compatible with your existing suite of software that you don't need to go to either buy a new license for or upgrade. I mean, this is very exciting. And part of it is that Intel really hasn't kept its eye on the ball and respects. This is just kind of a story of Intel just letting, getting a little too comfortable where they were at in terms of competition. I think AMD really lit a fire under their butts. And I'm wondering if this will really just crank it up to 11 for Intel and really kind of get them back to the drawing board of trying to innovate once again, because Apple has been a pretty big partner for the company for the past 15 years. Yeah, I mean, they're a top three OEM for PCs worldwide. So theoretically losing that over the course of two, three years could have obviously major impacts on Intel and they're kind of getting hit, yeah, right now, buy on all sides for sure. Oh, that's me. So we have a little bit of an explainer here. There was the US FCC voted to open up the 1,200 megahertz of the spectrum in the six gigahertz band for unlicensed use. Now that's a lot of spectrum talk, but what that means is that this band can be used for broadcasting Wi-Fi and marks the biggest spectrum addition for Wi-Fi since the FCC voted to really open up the initial spectrum in 1989. And that currently uses only about 400 megahertz of spectrum across both the 2.4 gigahertz and 5 gigahertz band. So, you know, that 1,200 addition, just on that face alone is quite an addition. So what is that all gonna mean, I guess, the six gigahertz band gonna mean for your home Wi-Fi? To kind of break it down, it doesn't necessarily mean it's going to be faster. This is still gonna be going over the Wi-Fi 6 protocol. So there's still a theoretical max of around 9.6 gigabits per second that that's gonna top out at, of course, never going to see that speed regardless of what spectrum you're going to be using, but that six gigahertz spectrum can provide for up to 7,160 megahertz maximum capacity channels at once without signals overlapping, like we often have currently whether, you know, you have routers, you have multiple devices kind of communicating all in one space, not very uncommon for a lot of situations. And what that's going to allow routers to do is broadcast at their maximum allowable channel size. And we have Kevin Robertson at the Wi-Fi Alliance estimating that realistically, because the speeds of up from one to two gigabits per second are provided your connection is fast enough on the back end there. The Wi-Fi Alliance has already approved the Wi-Fi 6E designation in place for devices that support six gigahertz. And we'll begin certifying devices in early 2021 so we can expect to see those coming in about a year. Broadcom, Qualcomm, Intel, Linksys, Netgear, and Apple have all signaled that they have chips and devices that will support Wi-Fi 6E or that six gigahertz band and IDC estimates 316 million devices will ship with Wi-Fi 6E support in 2021, mostly smartphones, and then moving into smart TVs maybe in 2022 according to their estimates. But, you know, we've seen a lot of attempt set coming up with like a faster or provide more spectrum. You know, we have things like Y gig and stuff in the past. Haven't really seen any industry adoption. It seems like all of the major partners that need to be on board from chip makers to device makers, router makers, that kind of stuff are all kind of lining up for 6E. The FCC has been on board kind of for a while and this vote was mostly a formality. And it looks like we're going to be living in a six gigahertz future before too long. So when do you think that we'd see consumer products that adopt this? There's smart, yeah, smartphones in 2021 and it may, I don't 100% know this. It's all going to come down to when Broadcom, whenever Broadcom puts out that first six gigahertz chip. But we've seen announcements from on the enterprise side of a lot of companies like Aruba and stuff like that already kind of having six gigahertz access points and stuff like that on their roadmap and that, you know, consumer devices can't be too far behind that. Yeah, I mean, I sort of was like, all right, how do we poke holes in what the FCC might be thinking here? And it's like, nah, it sounds like this is really a win for, again, if everything works as advertised and the manufacturers and companies who make these products that we would end up using follow through, they all seem pretty excited about this too.  This seems like a win for all. And, you know, the FCC historically, sometimes these things take a while. So unanimous vote here is moving in the right direction. Yeah, the one thing to watch out for is, like anything as devices proliferate that use the six gigahertz spectrum inevitably, it will become crowded. I mean, I don't think we're coming to a situation where we're going to have less devices with IoT smart home stuff. But it's still, it's a huge expansion of the available spectrum.  So it'll be a wild buy thing before we hit that saturation point. The New York Times reports that Jeff Bezos is back in the day to day saddle of his company, Amazon. After years of focusing on long-term projects and pushing day-to-day management to his executive team. People familiar with the company's working tell the Times that due to the coronavirus pandemics, extreme pressure on how Amazon does business, Bezos is holding daily calls to make sure decisions about inventory and testing are correct and how Amazon responds to public criticism. He's reportedly talked to government officials in an April made a publicized visit to one of Amazon's warehouses for the first time in years. Due to skyrocketing customer demand for product delivery, Amazon shares are up and the world's richest man is also $25 billion richer on paper since early March. However, coronavirus cases continue to appear among workers at Amazon warehouses and Amazon has had to rethink logistics operations such as stopping accepting low priority items into warehouses and to delaying customer shipments of other items that Amazon considers low demand which I now realize is also my case of Topo Chico mineral water the next week. Oh Bezos. You know, it's Jeff Bezos having stepped away from day-to-day operations company of Amazon size not the least bit surprising. You know, Amazon's also doing sort of long-term projects. Blue Origin, for example, Bezos apparently very interested in that before Amazon launched its cash shear list go stores. The project that seems successful enough that it is expanding Bezos very hands-on with that sort of thing. So it's not as if he's just sort of like and the figurehead, I don't care but you've got executives that you put into place to make sure that the whole operation runs smoothly. In a normal world anyway we're not there anymore. So, you know, someone being at the helm who needs to better understand how are we changing course all over the place. And yeah, it's like you're in, Amazon's not in a bad position in the sense that orders are up. They've got to figure out how to make a bunch more people happy that want to give Amazon their money. So it's not, you know, Amazon is at least enjoying a surge in a sense of, you know, a lot of money is coming into the company's hands but it's a mess right now. There's definitely a PR mess that has been brewing and may get a lot worse before it gets better. So I don't think business really has a choice. Amazon is a logistics company. It started as a logistics company. They were not the first website that wanted to sell books. They were the first website that realized that if they put warehouses next to other book reseller and publisher warehouses they were able to ship out books faster and cheaper. This is a moment for Jeff Bezos to step back into the spotlight because I do believe this is an inflection point for Amazon and whether or not this is a PR article that they want to make sure that everybody knows that Jeff Bezos is out there or this is a sea change in terms of a major company. There is no doubt that Amazon effectively right now is the most viable, effective and efficient part of our federal government. They are providing so much and there is no doubt that we're going to look at the history of this company and say there was what Amazon was before coronavirus and there's what Amazon was after. They are rapidly shifting their logistics enterprises so they can optimize for a virus world and a post-virus world. This is going to be a big, big, big moment of inflection for them. Justin, I think it's a really great point but I think it's there a logistics company again. I think one of the underreported things is the importance of AWS is kind of having its moment of everybody using SaaS work from home apps or people using Netflix, people using Zoom or Zoom-like services that basically all of those services depend on AWS on the back and what we see reports of outages of Microsoft Teams or something like that. We haven't seen any like, oh my God, the services down for days and days and days and I do think that's where their profit center is, essentially at this point, is things like AWS. They're definitely inflicting back wisely, obviously due to the insane demand that they've been seeing justifiably because of the COVID-19 crisis but I also think that that is something that, not that necessarily this article was talking about that but that is an equally important role that Amazon is also playing at this moment right now. In other Amazon news, the Wall Street Journal reports that more than 20 former Amazon employees said that they accessed data from third-party sellers to help structure Amazon's own private labels. The data reportedly allowed the company to single out which products had the best earning potential, how to price its own private label products, what product features Amazon might want to copy. Amazon is an ongoing antitrust probes from the Department of Justice, the Federal Trade Commission, and the European Union's Competition Commissioner. In fact, in a July 2019 congressional hearing an Amazon executive said, the company didn't use seller data to help favor its own products. That is definitely not in line with what employees are telling the journal. In response to the journal's story, Amazon tells Business Insider it's going to launch an internal investigation. So it didn't say, this is crazy, we're not doing this, never have. We should look into this because it's two very different stories now I'm not going to pretend to know exactly again talking about Amazon here, there's a lot going on behind the scenes, so I don't know. But I find it very, very hard to believe that Amazon would willfully not look at data that's extremely helpful to the company in launching its own branded products, private label products of which it has put a lot of R&D into over the last few years and only wants more of. Well, but here's the big thing. Number one, did they look at things that are proprietary to them that only they could look at because they control the back end or do they look at public data? Obviously, if you're going to launch something, if you're going to launch a phone, you're going to know what other phones are sold for and you can go ahead and look on Amazon the same way that anybody else can. Secondarily, if you can't look at their sales data, that doesn't mean that you can't look at other things that show, you know, basically what that sales data could be based on the larger trends that are looked at through your back end. I think what Amazon is going to prove or attempt to prove is that they're, yes, there's a lot of data out there, but they didn't look at anything proprietary when they launched it. However, this has and always will be a sticky subject for them because they are a seller inside the mall that they own. They're always a scant. Yeah, and there, you know, Amazon has a number, I mean, obviously as the owner of the platform has a number of other lovers that I think are kind of wrapped all in this, whether it's the FTC or the European Commission looking at them, in terms of the label of that Amazon choice. Obviously, they have knowledge, they know exactly how the algorithm works, so it would not take much of that inside, much of that proprietary or insider information that other competitors wouldn't have access to for them to get a very distinct business advantage. One thing that the article did kind of point out is that Amazon's private labels, I think they said accounts for about 1% of their overall sales, so it's like not this huge thing, but the issue is how many other competitors could they theoretically use that to kind of edge out of the market long-term, and they said the trend is that that is increasing and looking like it's going to be a little bit more of a significant percentage in terms of sales and revenue going forward, and it's definitely in their plan, certainly. Hey, y'all, if you want to get the tech headlines each day in around five minutes, you should subscribe if you haven't already to dailytechheadlines.com. All right, and thanks to all those participating in our subreddit, remember you can submit stories and vote on them at dailytechnewshow.reddit.com. Hey, Rich. Yes, Sarah. I'd like to know what's in the mailbag, please. Well, I would love to tell you because there is an amazing message in there from Amos, our producer Amos. Hi, Amos. As of this writing, I am excited to say that the GDI folding team has 41 contributors. We're running 1,568 simulations and contributed over 17 million points to the project. This has us in just two weeks, placed just outside the top 4,000 teams worldwide. This is truly a resounding effort from everyone. Thank you for making the project a success. Let's continue to make the world a little better. I agree, Amos. Anyone that wants to join can reach out to Amos on Twitter at Ethan Kane or just join the team with the ID 261-830. Awesome. In fact, a couple folks have been like, this sounds really great. What's your team ID? 261-830. Join us if you can. And thanks to everybody who's participating. Very cool. Yeah, it's really awesome. And a special shout out to our patrons at our master and grandmaster levels, including Chris Bettenau, Ragnahild, Vermidel, and Reed Fishler. Thank you so much. And of course, last but not least, thank you, Justin, Robert, Young. Where can people find more of your great stuff if they want to check it out? Well, if you go to the podcast store of your choice, you can search for Politics, Politics, Politics. We are obviously covering all the things that are happening in real time in our crazy plague world that we are all trying to survive. Yeah. Well, there's that. You know what we've been doing at the end of each show is shouting out a creator. Somebody who's who's doing some cool stuff you might not know about. Maybe you want to check out.   He's referring to the fact that I have an Oculus Quest, which I'm in the review period for for the next Live With It segment. Comey, you are correct. Comey says, I have the Insta360 ONE X 360 camera. I'd like to share with you some videos from Norway, Vietnam and Iceland. These are all YouTube videos and we've added the link in our show notes. Comey is a VR AR enthusiast. He says he has a Quest and a Rift also into into photography and imaging technologies in general. I have a Lightro first gen and Illum Lightco's L16 various stereoscopic cameras. Wow, really do have a lot and Ricoh Theta series cameras. But the Insta360 ONE X is the one I use most often besides my main Sony. If you want to shoot your own 360 degree photos and videos and view them on Oculus Quest, the ONE X is the model I recommend. Thank you so much, Comey. You know, it's, I've been, I am a, well, I don't know if it's really passive experience at this point. It's not really very passive, but I am a consumer of the VR experience. I hadn't really thought about being a creator of the VR experience, but that gives me a lot of really cool ideas. So everybody go and check out Comey's stuff and thanks for letting us know. Please, please support our show. If you can, I know times are weird. Times are tough right now for all, but we've, we've banded together and we appreciate your support. So, so, so much. DailyTechNewsShow.com slash Patreon. Our email address is feedback at DailyTechNewsShow.com. We're live Monday through Friday at 4.30 p.m. Eastern, 2030 UTC. Find out more at DailyTechNewsShow.com. Shannon Morris and Len Peralta will join Tom Meredith back on the show. I'll talk to you then. This show is part of the Frog Pants Network. Frog Pants Network. Get more shows like this at frogpants.com. Time and Club hopes you have enjoyed this program.


So, the Navy's Keep What You've Earned campaign, the flagship program for responsible drinking.   The Keep What You've Earned campaign is out there for us to grab on to something, to some language, to some campaign environment that we can share with each other and educate each other on as a reach back and a reach forward and a reach to the side. When we get into a situation with alcohol and we need some resources, let's face it, most of us do like to imbibe in an alcoholic beverage now and then and that's okay as long as you're of age and you're within the legal limits and the law and just like everything else, you know, I'm not here to tout drink a moderation or don't drink at all, I'm here to tout drink responsibly, you know, drink responsibly. What I'm excited about with the Keep What You've Earned campaign is that it talks about what you've earned and what you can lose if you are irresponsible in your decision-making processes when it not only involves alcohol but other things. So what do you lose?  Say for example, as an E-5 and earning in base pay $2,440 a month and that doesn't include your COLA, your special duty assignment pay, your your BAH or OHI, your comrades, your all of that stuff, which can raise it up even higher. But let's just take base pay. Okay, so now you're an E-5, you've done all that, you've made a poor decision, you've gone to Captain's Mass or court marshal and you lose rank and you're reduced in rank to E-4. So now basically for at least three years before you can look at an exam again, right? Three years in pay, in pay grade, right? Time and rate. So for three years, because you were reduced in rank as an E-5 to an E-4, you have lost over a three-year period just in your base pay over $10,600. Now you can double that amount because of the loss of the increase of or the decrease of your COLA, of your OHI, your BAH, your comrades, your special duty assignment pay, which you will lose, and other associated pays. So you will lose almost $20,000 over a three-year period because you chose consciously one night for whatever those reasons to drink irresponsibly and then drive. Only one-third of Americans between the age of 17 and 24 are even eligible to join the United States military. And an even smaller percentage makes it through boot camp. And an even smaller percentage makes it through their first tour. That has the stamina, that has the capabilities, that has the strength. So we are a very elite group of decision makers of Americans that join the United States military. There's not a lot of us that are eligible. So you've already said to the world, you've already said to yourself, to your family, to your shipmate, I'm one of the few that has made this decision, that has made this commitment. Regardless of what your age is or where you're from, you made a commitment and part of that commitment is keeping what you've earned. Don't wait for things to happen to you. Make them happen for you.


Hi there, my name is Ken Mayer. I'm going to be your instructor for this course on Security Plus. Now I've been back working in this industry and business in some way or another since 1983. Of course, technologies have certainly changed from times when we had very closed systems, mainframes, to getting into the world of actually having a little more open network operating system to everybody discovering the worldwide web, to being able to have to worry about routing and switching, about different applications that are running web applications, identity theft, the works. And so I've been obviously staying with these topics, working with a lot of different areas of security through those 30-some years that I've been in this business. I'm hoping that I'll be able to give you some of that extra knowledge that will help you make you a better security professional throughout this course. In this lesson, we're going to talk about security fundamentals. And so what we'll do is we'll, kind of like it says, fundamentals, give you that foundation. We'll hit that information security cycle. Then we'll talk about the information security controls. And when we talk about controls, remember, we're going to be kind of, we'll feel like all over the place when it comes to security because there are a lot of different things to think about. We'll take a look at least from the 30,000-foot view, the authentication methods, some of the fundamentals of crypto systems or cryptography. And we'll also talk about some of the security policy fundamentals, which by the way is where I say that's about the paperwork, where we actually write out and make those policies that we use as a guideline for setting up our secure systems. So let's take a look at the information security lifecycle. What we're going to do is we'll talk about what information security is, some ideas of what you should be protecting, the goals of security. We'll throw in some of the words like risk, threats, vulnerabilities, intrusions. We'll also talk about some of the types of attacks, some of the controls that we can use, types of controls that we have to use. Again, all trying to mitigate risk really when it comes down to it. And then we'll look at the security and management process. So when you ask the question, what is information security? Well, you can probably give it just on these basic definitions, the protection of available information or information resources. Now, when we talk about information, I guess you could say we're talking about, for some people anyway, data. It could be data in a database of customers, maybe their credit cards that you, like so many stores these days don't want to lose. It could be other types of resources of information. Literally, it could be information that's on a paper form that needs to be securely locked or stored, files, think about medical records and those types of things. So it's important that you understand what really is important for your company or your organization. And our goal is to provide that protection. Now, it is necessary for the responsible individuals or the organization to have a way of securing confidential information. Just in the United States, we have a number of regulatory laws for a variety of different types of organizations, such as HIPAA for medical records, medical patient information, what we call Sarbanes Oxley or SOX for financial institutions, banks and those types of things. That those laws actually say that in order for you to do business without getting a huge fine or possibly even going to prison that you must need to meet those requirements and be able to document that you've at least met the minimum requirements, especially, let's go back to the bank. If SOX tells us what we need to do minimum and that bank loses your money, do you think maybe somebody might sue that organization or that organization says, oh, we weren't in compliance? It really doesn't look good for those organizations. So anyway, it is necessary, as I said before. And when I say responsible individuals, well, that starts right at the top, whether it's a CEO, sole proprietor, who's the owner of the business, who whatever the type of setup is, director of a different agency, they're the ones ultimately responsible. Anyway, when you think about this, our goal is by looking at some of those documentations plus following best practices, our goal is to minimize the risks and other consequences of losing any type of your critical data. So here's where I was talking a little bit about the ideas of what we're trying to protect, the data, the resources, whatever's important. In fact, one of the things I'm gonna have to put up here is when we ask the question, what to protect, I'm gonna say whatever's important to that organization or company. We go back to what's called business needs. Now business needs means that we need to protect whatever's gonna keep that company, assuming it's a for-profit company in business. If they make widgets, their resources may be for supply line information, or if they're, let's say, a credit card processing, then they're gonna have to have a resource that lets them connect out to a variety of different bank buildings. And so we have to be able to protect those connections. And then, of course, internally, like I said, we could have paper files, we could have digital media, or digital storage of our files that protect information crucial to how we do business, like it says bank account numbers, or in the U.S. social security numbers, or any other personal information. So how do you answer the question? I'm asking it like a question, what to protect? Again, what to protect is what's important for the business, what makes that business run? And when we are talking about protection, and you're gonna be seeing some ideas of what security is, but I'm gonna draw just a little bit different idea here about one way to look at security. And that is this idea of CIA, which is not the spy organization, but stands for Confidentiality, Integrity, and Availability. And somewhere in here we have some data, some assets that you want to protect. Now, I just wrote it in the middle of this little triangle, and one of the things that you're gonna see is that, you know, when it comes to how to protect, and I'm way ahead of where we're gonna be coming up to in just a bit, one of the things to remember is that we can protect information through confidentiality by encrypting our data. In fact, we'll often tell you that you should encrypt your data whenever it is in motion, or it's at rest. At rest means it's stored on your hard drive, it's stored on your laptop, encrypt the files. In motion means you're connecting to your bank and doing online banking. Don't do that in clear text, right? We always look for those HTTPS connections. We also want to know that the data has not been changed either while at rest or in motion, that's the integrity or the I. But at the same time, if you were to imagine that, you know, where I placed this little dot where my data is, if I start moving my dot a little closer to confidentiality, I may move it away from the ability to do integrity checks, and certainly move it away from the A, which is availability. Availability means, can I get to my information? I mean, we could secure information so much that hardly anybody can access it. Well, if they're customer records, and that's your business needs to access customer records, you're gonna have a tough time here. So there's a balance in between all of these that it'll be appropriate to, again, to what did I say, the regs, regulations. There'll be a balance that you want to meet there. And the other one I said it would be best practices. And then from there, you can determine based on your own risk assessments, we'll say, of how you want to set up the policies coming up with this balance of security choices. But anyway, take this to the resource. Now, under resources, I made little connections like these are servers connecting out to other banks from a credit card processing center. You know, the resource is the equipment itself. I mean, if that equipment is not locked in a secure facility, then anybody can walk in there and potentially walk away with your servers. Let me just say this about servers. You might go through all of this work here, confidentiality to encrypt your information, which is very important to you. But, and you may say, well, I've got the best of, let's say, Windows security set up on this thing.  So what's stored there?  I'll take the time to decrypt it back at my evil hacker shack or wherever it is I'm doing the work from. So resources are more than just thinking of data. It's also the equipment, the hardware, everything else that's important. And so again, going back to what to protect, there's kind of a small list that I've just given you and plus a little idea about how to decide what way to protect that information. Now there are some goals of security and I already mentioned my CIA triangle as kind of the idea of really dealing with actual data. That was more for just data. But when we said what do you protect and what we're doing with security, well, we were talking about data, we were talking about paper files, we were talking about actual server hardware, you know, even protecting your personnel. I know of a company that does a lot of financial work for some of the bigger credit card companies around the world and they tell me that they often have to have security in the parking lot at the quitting time because they'll actually have employees who as they're walking out to their car get hit up by people trying to bribe them to get them special access or to get them information about other people's, you know, financial situations. So I mean, when you think about the goals of security, one of them is prevention. How do you prevent these different types of breaches and security? I mean, again, we've probably all heard, I'm assuming, at least for most of you watching me, that you've all heard of antivirus software, maybe intrusion detection, firewalls and things that we do to prevent, but you know, security goes beyond the transmission of those little ones and zeros. It does go to the personnel, it does go to the equipment, to the resources, supply chains, you know, another part of your security is power supply. I mean, what happens if the power grid goes down to where you're at? Do you have backup generators? I mean, all of these things, we could say, well, we can put them in to try to prevent a security flaw. And yes, the loss of power is a security issue because if you can't get the business to run, you're losing money. Of course, detection. Now, detection is where I'd be talking a little bit more about your use of scanning software, like I said, antivirus and intrusion detection, obviously just in the name of that IDS, right, intrusion detection. But it goes beyond that again, physical stuff, right, motion sensors, sensors on windows, you know, having a way of auditing who accesses the server room. And of course we have to have a recovery system. Recovery is important because the loss of downtime for some organizations could be so monumentally hard on that company that they may never recover. In fact, I remember reading, I just wish I could quote it to you, so don't take this as pure 100% fact. But I've heard that for small businesses, if they were down for a week because they couldn't recover their information, by then their customer base will have found a new supplier of whatever widgets they're selling and they might not recover. So, you know, we wanna be able to say in our recovery parts of our goals that we can bring data back right away, that we can recover if we have power outages, that we can recover, right, all of those things go together as goals of our security. Now, the actual idea or definition of risk is, I guess you could say one, the likelihood that something could happen. And if it did happen, what kind of damage would it do and on a way of doing a rating? There are very simplistic methods of analyzing risk. If you think about it, you could simply draw a little box and you could put the, what I would call the threat here first and I'll make my box pretty big. And let's say the threat was a virus to your operating systems. Then of course, what do we say? The likelihood, so I'm just gonna use an L because I don't wanna respell that word. And maybe you might say, you know, let's have different people do their own ratings of say from one to five or one to 10.  And then of course, the next thing we said is the damage. And the damage could be in time, could be in money, could be both. And so you just come up and say, let's take a look at this. I mean, what about burglary, right? Somebody coming in, what's that likelihood of that occurring? Like I said, I always wanna think more than just electronic or technical terms when it comes to these threats. How about flood or fire, right? Again, likelihoods and what kind of damage would it do? And that's important. I mean, you know, if you ask me about a virus, I might say, hey, there's a good chance that my end users might download some garbage. So I'd give it a four out of five. I might consider that we have, you know, maybe armed security and outside TVs. And so the chance of a burglar coming in might be very low, unless I'm worried about an internal employee. Flood and fire, well, you know, you can look up what flood zone you're in to know if that's a high likelihood. You know, maybe I'll say it's a three, maybe a four. Really? Four? Do I wanna work in a building that has that high likelihood to catch on fire? All right, so anyway, you're getting the idea, right? Viruses could be pretty minimal. You might get a little bit of disruption. You might have to rebuild or re-image some machines. This could be medium, depending on how much a burglar could pull out.  Right? See if I can spell catastrophic. Can't use words or can't spell, right? All right, there you go. So anyway, you know what I mean? Cause, you know, once you have a flood or a fire, we're talking about a building that usually can't be occupied for a while and that's a lot of downtime. So as I said, you come up with a way. There are plenty of documented methods that you can use to do different types of risk. And the idea here is you then have to make some decisions with your risk. You have to say, okay, you know, something catastrophic with a high likelihood that I've put in here, seems like that'd be the first thing I'd wanna address out of my risk, more than buying antivirus software. I might be saying, hey, we need to put sprinklers in here, we need to update the fire extinguishers, you know, all that sort of stuff. You know, and then maybe I'd say, okay, well, the virus looks like it could happen a lot, which is something we wanna deal with. You know, so it's helping you also kind of focus your energies. Now, like I said, when you look at threats, I wrote some down here. We've got one here that can be very common, unfortunately, disgruntled former employees. Now, you know, I'm gonna take out the word former because you also have a risk from disgruntled employees who are working for your company and your corporation that might not have the best interest of what your company does, as I said. And, but either way, the idea was that they may, because they've worked there or are working there, that they might try to get improper access to information. You know, I've got a person I'm working with in the small town that I live in who just had their sales manager hired by the competition. And, of course, what happened when that sales manager left for, I guess, greener pastures, they try to take all of their customers with them as well, right, could be a major idea of a disgruntled employee. And by the way, that had nothing to do with technology, other than maybe the database of who the customers are. But we look at that as risk. Now, the idea of threats is the fact that something could happen, right? The risk is, you know, for us to identify the threats and how likely the threat will happen. But we have to identify what those threats are because we don't know what the problem is. We're not gonna have a good chance of trying to prevent it or even know that we should detect it. So, let's talk about just changes to information. The first one here, changes to information. Okay, so changes happen, right? We update our customer records. You know, I move or get a new phone number, whatever. So, some changes we expect. But there could be the time that somebody made a change to a record, like maybe deleted a customer, not wanting to do it on purpose, but that would make it unintentional. And then we have to ask, what have you done in security to be able to bring that customer's information back? That would be part of your recovery options that we just mentioned before. It could also be something intentional. I did read a story about a lady who was an architect, right, who would draw out plans for a million-dollar jobs and saw that her company was advertising for somebody with the exact same job requirements that she had, so she thought she was getting fired.  And that's when the employer said, well, you know, two things, we were actually hiring somebody to help you and now we're gonna prosecute you for destroying our stuff. You know, that's again, changes to information. Interruption of services. Sometimes we call that a denial of service on the binary side. When I say binary, by the way, I'm talking about the data transmitted from one place to the other across, you know, radio frequency or physical copper cables or fiber channel. It was sending a bunch of ones and zeros and sometimes our goal is to try to stop that. Again, interruption of services could also have been, as I said, somebody damaging the power grid. You know, there's so many things that we can do to interrupt services. Interruption of access, that's also, I would put as a part of this, what we call a denial of service, where sometimes we'll purposely have a hacker try to take your server offline. How? Maybe send it a virus, maybe send it some pre-known types of data or information that would cause it to crash. Again, if they don't physically lock these things up, could be damaged to hardware. By the way, could also just be that you don't have the right type of heating and ventilation and air conditioning that can also cause damage to your different hardware out there. So all of these, right, damage to facilities. Again, fire and flood, the rest of it. All of these are threats. As I was just saying before, when I talked about risk, we would look at the different threats that could interrupt our ability to work and what is the likelihood that that threat could happen. A vulnerability is often something we would say could be a bug in a system, whether known or unknown. And that happens. I've never met a company, and you can name any of the big ones that have ever put out perfect, perfect software. It could be a bug that's in the hardware, just the way the hardware chips were encoded with their instruction codes. There's a lot of different things that could be a vulnerability. A vulnerability could be an open window, or a window that doesn't lock, or a door that doesn't lock. You know, all of these, again, trying to get away from just the technical aspect could be considered a vulnerability, a known weakness. And that's what's important, is that often we know what the weaknesses are, and that's where people are gonna try to take advantage of the weakness. I mean, if I knew that some employee was sneaking a smoke inside the office and left their window open when they went out at night, hoping they didn't get caught, so they could blow the cigarette smoke out the window or something. And I was paying attention to that while I was watching your company. That to me would be a vulnerability, a way I could come in. And so we want to try to patch a lot of these vulnerabilities. We want to fix them. Bugs, when they're detected, usually will have a fix or a patch or an upgrade to fix those things. Hardware, sometimes we can rewrite the firmware and some of these chips. Open windows, again, you can have security guards walking around the outside. I mean, so our goal is to look for these types of vulnerabilities. Now, some of the tough ones, when it comes to the world of your operating systems, and how we exchange information, are these ones we call zero days. A zero-day vulnerability is one that the manufacturer does not know exist, one that nobody except for certain groups of hackers would know that exist. And even if the existence of this vulnerability is known, it also means that it's one that doesn't have a patch. And this is your big thing that is affecting us today. Because if we don't know those of vulnerability and we don't know to patch it, then we have people that are going to be able to take over your networks no matter how good you try. And that's just a true statement about security. So again, in this little example here, a attacker hitting what looks like an unsecured router. So I'm gonna mention a vendor that makes these wireless routers, not because they make poor ones, or I mean, you'll understand, I'm not saying anything bad about it. But I was with a friend at a Thai restaurant. I'm not even gonna tell you what state it was, that advertised free Wi-Fi. So he opened up his laptop, because he was gonna check his email, and he found that this router's SSID was Linksys. All right, nothing wrong with this company, by the way, makes good products. But the problem is, is because the SSID was Linksys, which is the default setting of that router, then he took the guess to say, well, let's see if I can go to its management page of <IP_ADDRESS> on its IP address, and the management page opened. And so then he said, well, I know that their defaults are username admin, password of admin. So he tried those out, and lo and behold, he had full control of that unsecured router. Now, like I said, not an issue with Linksys, because I can mention a number of different routing companies who every single one of their products out of the box without you doing any configuration are gonna be just as unsecure. And we all know that, and unfortunately, so did my friend. Now, he was not a hacker, he was really just curious, and actually brought it up to management and said, you know, I ought to do something about it. Maybe he was looking for an extra consulting gig, I don't know. But you know, once I'm into a device like that, you know, I can change the way in which your traffic goes out.  Because if I can change that, I could, basically I could have made this a firewall, and I could have stopped all your traffic from leaving. That would be a denial of service. I could have redirected your traffic to me as a web server instead of, you know, to your regular Facebook or social media. I mean, so many things that could have been done to really just take care of things. So that's just, again, an example of a vulnerability. And so one of the vulnerabilities, I guess I didn't write it down here, is default settings, right? We, they all are there. And I could probably just keep going on and on with this, but I'm hoping that by now you understand what I'm referring to. It's a weakness in a system. Intrusions are, again, gaining access into an area that you shouldn't be able to get to. Well, notice this one right here, talking about a door. What's in that door? Could it be files, file storage, that are paper? Could it be a server room? You know, how is it secured? Is it left unlocked? Is it easy to get into? Right, that's a type of intrusion. You know, in some of my advanced hacking classes, we actually taught students, and it only took 30 minutes, by the way, how to pick any standard Tumblr lock or to use a shim to get past any regular padlock, which, you know, I'm just gonna tell you, those things aren't secure anyway. That's where we start seeing the magnetic key cards or at least a password encoder device, something a little more than just a Tumblr lock for people to get into. But we have to consider that that could be a destination as a place of intrusion. Of course, it could also be what I'll call electronic, which is just the way in which we speak to different devices. And again, that could be my trying to break in or hack into a system. That's what a lot of us keep thinking about when we think of the word hacker. If somebody's breaking into a server to steal your files or your other data. And you know, if they're successful and able, let's say, to take over one of these systems, then they're what I would say golden. Because once they're inside, I mean, even if I had to go through a firewall, once I can take over any system on the inside, there's an idea of trust, that once you're in the network, we trust everything else in the network. And so I can then just, from there, start what I call a pivot point. Where I take this machine, then I pivot to the next machine or pivot to the next machine and try to own them and then just continue to have my way inside of your network. So again, another example of an intrusion. Now an attack to me sounds like somebody is trying to basically follow through on this threat or vulnerability. And again, we kind of want to give you this, sometimes people call it a little bit like it's a mile wide of information and maybe not quite as in depth of information. In other words, we want to make sure you are aware of different types of security issues and problems and have a good, at least if you're aware of it, you know that it's something that should be looked at. For example, you might work solely on firewalls, yet here we are talking about physical security attacks. Again, is there a weakness, a vulnerability? Is there a likelihood, a risk that it could happen? And so it could be theft, as I've mentioned before. It could be sabotage. It could be somebody just destroying your facilities. There's a lot of things that can go on. Especially when we see a lot of that kind of news reported more and more often. Social engineering, probably easily. At one point I used to say to people that this was almost 50% of what hackers did. Social engineering attacks are where people are trying to get information out of other people. Now there's a number of ways that can be done. It could be that somebody is just watching with their eyes while you're typing in a password. They call that shoulder surfing. Or maybe you're just being nosy, who knows. They could be calling you on the phone and asking you for your password, trying to impersonate somebody from IT and they're trying to fix a system. It could be somebody eavesdropping and just listening to a conversation. I mean, I have learned passwords for at least one airline by just listening to somebody that works at the airline said, hey, I need the password for the computer and baggage claim. And I heard on a walkie-talkie no less and I heard it back and so I'm hoping they changed the password. I was at a cell phone store and I heard one person say, hey, what's the manager's password? And the other person who wasn't the manager knew. So again, lots of weaknesses there but eavesdropping is another great way of doing that. And it just goes on and on. It couldn't even be dumpster diving, looking in the trash to see what you've thrown away. That might help me better fool you. Now, a lot of us, at least me, seems that I'm spending a lot of time on network-based attacks. I say that because I've worked for so many companies who have their variety of routers or switches or that was a pretty bad-looking switch there or firewall or something that does all in one. It could also be some of what they call this next generation firewalls that might do AV and IDS. And so a lot of people are spending a lot of time in trying to secure those types of networks. And that is, like I said, probably one of the big ones. Of course, I do like to do a lot of social engineering as well. I'm not so much into breaking into things. I just showed people how to pick locks. But anyway, so network-based attacks, they seem like that's the one we hear a lot about, right? You hear about the big warehouses and retail stores losing all those accounts. Well, they all kind of came based on somehow across the network. Another great way to break in, though, of course, here is through webpages. You'll see people trying to take care of a poorly designed page by doing sometimes what they call SQL injection, which is taking advantage of somebody forgetting to encode security, either at the web page or to the database server that sits behind the web page that delivers the information back and forth. So it could be certainly a web-based application or to me, software-based attack is still pretty much trying to say the same thing as a web application, except for we could probably throw in all the operating systems in here and say, what are their weaknesses?  Windows is a great operating system. It's got its flaws like every vendor. I mean, you can't tell me that you're gonna use Linux so it's more secure because it's really not.  There's no perfect operating system or program. And sometimes the operating system might be the strongest operating system you have out there, but there's an application running like the one you use to check your email. And so that person will attack the application because the application is trusted by the operating system and therefore there's a weakness. So anyway, I'm trying to just give you a number of ideas of the types of attacks and what we mean. And I hope that you see again a little bit mile wide because we went from physical security to eavesdropping, listening, calling on the phone to hitting you through the network or if the network's good, going through an application or you're going through a webpage, you know, lots of different types of attacks. And none of those are actually even on people, on your personnel. Again, that could be a very dangerous world out there for people who might be in a place of authority for a company worrying about getting kidnapped or those types of things. All right, so controls, I mostly want to talk about kind of the way in which we could classify them. But a control is what we call a countermeasure. The idea of a countermeasure is to basically mitigate or lessen the amount of risk that you have to worry about. And it's something we would do or put in place, as I said, to make that risk less. Obviously, we could say that a bunch of them are preventive. All right, so, you know, in this case, a preventive control would be locking things, locking doors, but I've already told you again, you have to be worried about the types of locks and where, you know, you can access that lock from, you know, so that's prevention. And even by the way, the best control systems can be easily thwarted by the people that are working there. Maybe I have too many stories and you all don't want to hear my stories because you don't get a chance to tell me yours. But you're my captive audience, so you're gonna listen to mine. I was at this, basically, worldwide multinational company, I won't say which one it was, doing some consulting work on a network management system that they had. And, but I didn't have access to the network operations center, the knock. So one day I was bored and I was walking the hallways down in the basement area and I saw one door that had no label. You know, like how doors would normally have a label and tell you what's in there. Well, this door didn't have any, so right away I knew it had to be the knock because somebody once said, you know, in security you shouldn't put that information on the outside of the door. And it had a little window right here, a little window that I could look into. And when I looked into that window, it showed me there was another door. There was also a podium, which looked like a fingerprint or palm scanner. And I could see that it was a keypad for that door. So they basically were being forced to have a magnetic key card to get to the front door. You know, palm print, I mean, perfect, right? And so here's Ken. All right, I'm not the skinny, but anyway, here I am looking in that window, trying to see what was in there. And some guy walked up behind me and said, hey, can I help you? Scared me, made me jump. And I just told him, you know, I said here's who I am, I could have lied because my tag only said visitor. Anyway, so he takes me in, shows me the network operating system, best security in the world. He just let me ride in, which is nice, but I didn't do anything bad. But I just want to throw that out there. Detection controls, all right, detection. Well, all right, so what do we have here? Close circuit TV as an example. You know, again, it could be an alarm on a door, an alarm on the window. So if somebody opens it or breaks it, that there's some sort of detection. And of course, hopefully some of the controls can correct things. You know, like firewalls can drop packets or intrusion detection can drop those packets. They can send out emails. The alarm company could be calling the police when they detect something. Right, so that's part of the correction. That after we, well, we try to prevent it, we have a way to detect it. And from there, have a way to correct it. Hopefully our control can help us with all of those things. So as a review, when we're talking about these controls, and I hopefully gave you a big enough breakdown there, that we do classify them as prevention, detection, and correction. And if we're lucky, our controls can help with each of these aspects. But remember, they usually have a primary function. Like I said, a lock on a door is generally there to prevent you from getting in there. Detection would be an alarm strip on the door so we know when it's open. And that device, hopefully relaying it to a machine or to a person, would be the correction. And again, that's just one example on a physical security side. When we take a look at the idea of the management process for security, as a process, it means it's something that kind of, I almost want to look at it instead of just a circle, as kind of a spiral staircase. I mean, we're still going around. One thing leads to another, but we're always getting better or higher up the staircase as we're approaching it. And then, of course, for those of you who think the glass is half empty, you'll say, oh, it could be going down. Well, all right, you could be, but take my analogy. Anyway, one of the things, of course, that we want to look at when it comes to security is knowing that we have to have a way to identify what those issues are. And from that identification, right, to be able to report this and to monitor it. And depending on what we see, having to go back through this entire lifecycle of being able to know what it is, how to implement a security control, monitor the control for success, which is a part of auditing. And from that, maybe have to make new recommendations so we keep going through this process.