Thanks for coming out for a nice and cool DEFCON, right? It's so nice outside. But to kick things off right away, who am I? So I'm Joe Sloick. What do I do? Currently, I work for Intelligence for Dregos, an industrial control system focused cybersecurity company in case you haven't heard of it. Prior to that though, I was running Incident Response at Los Alamos National Laboratory, was in the Navy, did some things there. Some were interesting, some were not. And I was actually a philosophy graduate student dropout at the University of Chicago before I got involved in anything relating to computers, like the most I did before maybe the Navy was game. So yeah, kind of took an interesting, well we've all taken interesting paths to this field. But enough about me. Main thing we want to talk about today are, you know, what are some major ICS attacks? What could we learn from those? But also look at those in the context of a surge and sort of minor IT based events and look for the overlap and behaviors between these two and how do we can start designing defense in light of what we've observed from the sort of smaller things that are bubbling up. So looking at ICS events, there's really not all that many that are publicly disclosed or identified. So we've certainly have seen some rather headline grabbing events in the last few years, but you know in terms of ICS focused malware, you have Stuxnet, Drink, Havex, Black Energy 2 and 3, although Black Energy 3 really is an ICS based. It was just used for an ICS attack. We can talk about that after this if you'd like. The crash override framework, which I had the pleasure of being here last year to talk about that with the guys from ESET and then Trisys, which was fairly recent August of last year 2017. But then looking at this, we have a few other disruptive attacks. You know, the malware maps to certain things like we know what happened, what has happened in Ukraine. There was the still mysterious German steel mill event of 2014. If anyone has more info on that, please talk to me. And you know, then moving into again the events I just talked about with Trisys and Crash Override and only a couple of things that have genuinely been disruptive. Stuxnet, Crash Override and Trisys. So we're not talking about a very large sample size.  But there's just not that many events to start designing detections around and take lessons from. So you know, if we're looking to design defense in ICS environments, what's our corpus of data? What is our ability in order to start reading into this so that we can start building out a defensive framework? Well, we just don't have enough items within the ICS space to really use those as at least our exclusive set of building blocks for how to arrange defense. Furthermore, if you're taking a very traditional IOC approach to defense, you're just going to find yourself in a bad spot quite quickly because we don't have a very large set of IOCs. We have you know, maybe a couple dozen hashes, you know, IP addresses and stuff like that might be somewhat relevant depending on the environment, but we're talking about you know, presumably a controlled network that's not hooked up to the internet, I hope. So instead of focusing on these IOCs, why don't we look at methodologies instead to look at how adversaries fundamentally have to behave and start building out defense in that respect. You know, furthermore, looking at the attacks in question, you know, especially when we're talking about the disruptive things, they're very specific to what they were designed to disrupt.  It might have spread to your system, but the way it was designed, it was really only looking for a very specific environment to trigger its payload. Crash Override was kind of modular, but at the same time, you really needed to build up the capabilities in question in order to deliver the effect on target. And then Trices was very specific. Like if you're not running the exact piece of equipment with the exact processor set and the exact firmware set that it was built to, you really don't need to worry about it. Very much designed for the target in question. So again, if you're trying to build defense off of these, using the IOCs from Trices is useless, because unless you're running that very specific piece of equipment, which some people may, it's not germane to your interests. It's not relevant to defending your network.  What's that disruptive, destructive event? But we leave out all of these other things. So what we really want to do is because past events aren't all that sufficient to start designing a more robust defensive framework because we want to, you know, look for other ways of going about this to see what it is that we're missing and how we can move forward to build something more robust, especially for a control system environment. So while we've talked about, you know, the scope and scale of ICS events, where do we get this larger corpus of data than to start building stuff up? Well, really, we can just look at general IT infections because, you know, buzzword here, IT OT convergence means that a lot of your classic IT vulnerabilities and threat surface has been migrated into the operational environment. You know, aside from marketing buzz talk around that, you know, from a security perspective, that's pretty damn important because it means that a lot of the lessons and a lot of the things that we're seeing in IT environments get moved into the ICS environment and are just as effective there and perhaps even more so because we're dealing with environments that don't have or are not amenable to the fancy EDR solutions or, you know, complete visibility and host-based logging and whatnot. So that's what are the trends that we're seeing in terms of IT-based attacks? Well, we're seeing the rise again of the worms, you know, for those who are maybe a little, this looks like a good audience, everyone knows what Conficker is, etc., but, you know, really a return to that warmable sort of malware over the last year or so. Really seeing a re-emphasis on credential capture and reuse, use of living off the LAN techniques and running scripts in memory, leveraging native windows and operating system technologies in order to execute attacks. And then the unfortunate continued use of wiper malware either as the end destructive event in question or as a means of cleaning up one's tracks at the end of an infection event. So in terms of worms, you know, want to cry. I don't, Marcus isn't in here because we're not that important, but so want to cry about a year ago, you know, everyone was familiar with that. It was exploit fueled, which meant that, you know, if you're running SMB v1, it wasn't patched, you had a bad day if anything that you had was touching the internet back in June-ish of last year. But what was interesting is that while that is still a problem, you can ask TSMC, the Taiwanese chip manufacturer, who had an issue that they are attributing to want to cry just this past weekend. It's still an issue, but we've seen an evolution in how these worms work when we went to not pet you bad rabbit Olympic destroyer and migrating away from just exploits and instead building in things like mini cats to harvest credentials on the fly and then use those to propagate. So it's relatively low skill in a way. I mean, you have to design the software, but once you've done that and deployed it, it's pretty much fire and forget and let things take their course.  So not that big of a deal when it comes to ICS environments. Then we moved to want to cry. We had, you know, the SMB exploit that was pretty nasty and it's still going to be nasty in industrial environments for probably the next 10 years as equipment ages off and gets replaced and whatnot. But then when we started getting into not pet you in bad rabbit, we saw exploits paired with credential capture in order to spread until finally we got to Olympic destroyer, which started out with an initial seed of credentials that were harvested through some preliminary operations and then used on the fly capture and reuse to spread quite effectively through the target network. Now, none of these are industrial focused, which is good, but almost all of them have had impacts in industrial environments because their very nature has allowed them to take advantage of certain network connections and levels of connectivity to spread into areas where we really don't want these things to be. So, you know, we're seeing a movement towards that's exploitless migration by harvesting credentials as mail removes throughout the network, dumping things from LSAS and whatnot and taking advantage of the fact that people still stupidly run as a local administrator all the time and avoiding the use of exploits and such in this facilitating living off the land either in an automated fashion by continuing to build up the capacity and capability of these worms or pending that access over that's gained through a wormable exploit to a human operator so that they can take advantage of what this has been able to, you know, warm its way into the network and spread. That leads us to our next topic, living off the land. So that's a buzzword.  But if you don't, you know, it's really we're talking about the use of native Windows system commands, some legitimate system administration tools like PS exec, as well as administrator-centric scripting languages, PowerShell WMI. No news to this audience, you know, we know that these things are going on, but that's been a really big shift across, you know, especially our more advanced threat actors of really eschewing malware and going more and more towards trying to blend in with native system activity. Finally, wiper malware.   What else did I list there? Yeah. And Olympic destroyer was also a wiper as well. So I'm having a screen resolution issue, so no worries there. But what we've gotten from looking at this is that, okay, these are certainly not ICS focused sort of attack methodologies, but if we take a step back and instead of focusing on that very last stage of how these attack ICS-centric attacks are executed, what I've just talked about facilitates everything that goes on prior, whether that's your initial intrusion into the IT network to get into the ICS environment, as well as the ability to start moving within ICS to identify your final targets and then deliver that bespoke, whatever, destructive payload. So what we really want to do, you know, the specifics of some of these commodity things aren't relevant. I mean, I'm not a very big IOC fan. I blog about that and then people yell at me on Twitter or whatever. But, you know, I'm very much more focused on, you know, how are these things fundamentally operating? And so looking at those sort of general underlying trends gives us an idea of how the attack landscape is shifting and how adversaries that are operating within the industrial environments that this audience cares about will execute attacks and what defenders need to do to evolve to meet them. So expanding the kill chain not only lets us get a view of, you know, things that we can get a better grasp on, it also gives defenders the opportunity to step in and catch these attacks at an earlier stage. So yes, even if you were able to have a good signature to catch Trisys or Crash Override or Stuxnet, yeah, I mean, but you're catching perhaps the very last stage of a complex attack, so you might just have averted boom or you might have been notified and got an email alert about boom 30 minutes before it actually happens and no one's responded to it yet. That's not terribly useful. Really, what we want to do is try and, you know, move left of boom, sorry, former military, so I can actually say that, I guess, too, but, you know, move further left of boom as much as you can so that you can capture and identify these attacks earlier in that kill chain process, which makes them to facilitate cleaning these things up and mitigating any damage. So really what we're trying to do is, you know, Venn diagrams are awesome, aren't they, but overlapping IT attack trends on what the ICS, you know, threat environment looks like and really try and focus on that juicy center right there for the threat surface. Like, that's really where an adversary is going to be operating, where there's an opportunity to go forth and stop those things, especially, again, at an earlier potential stage, but also catch entire categories of attack instead of worrying about very specific intrusion events. Again, going back to the fact that many of these events in question, then when we look at concrete examples are bespoke in the sense that they're very much tuned to the target environment in question.  I don't think enough attention has been paid to us despite the fact that Renault, FedEx, Maersk, TSMC, etc., like lots of companies have had a bad day just from an IT focused worm. Imagine if you take the same capabilities that were leveraged in, you know, not even leveraged, but unintentionally use in ICS environments, pair that with something that's ICS specific in terms of propagation and spread, and do something stucks to it, like in terms of awareness for the environment that the malware is running into at a payload, that's a scary day. I'm glad no one's done that yet. Please don't take this idea and run with it and execute that because that would not be cool. But, you know, really it could be quite effective means of getting into a network, burying in quite quickly before defenders might even know that something's going on, and then detonating something further on. Credential capture is very important as well because, well, one of the biggest reasons, you don't have to use malware. If I can log in as, you know, admin-admin, engineer-engineer, etc., I don't need to exploit anything and that, one, lowers my signature threshold. So even if you're running antivirus in the environment, if I don't have to bring, you know, a piece of malware in to do something, but you can just pivot around through RDP and VPN tunnels, like, okay, that's one less thing to look for. But also allows you to start modeling legitimate activity. You don't have to bring tools into the environment, which is another touch point for defenders. It really makes detection very hard. So again, it's, you know, it's something we need to deal with, but it's very much the reality of the now as far as how these attacks are shaping up, at least in their preliminary stages. Living off the land, again, continues this theme. Don't need to bring tools into the environment. I've got all my toolkit right there with me. Maybe I bring PS exec into the environment so I can do some remote process execution, but otherwise, I've got PowerShell. What else do I need? I can run crap in memory and just copy paste the page 64 script and good to go. You know, really allows adversaries to just get in, stay in, and not really have to do a lot of moving back and forth from adversary controlled infrastructure to the target network. So what I'm trying to get at here is we're really looking to build out what I call behavior based defense, targeting the underlying adversary behaviors, targeting what are necessary adversary touch points. You know, you might say that yes, there are potentially infinite different ways of compiling and, you know, creating malware or whatnot to evade signatures, but at the end of the day, an operator needs to get control over implants or they need to design implants with some sort of logic. They typically want to have some means of staying within a network, some means of persistence, but looking at those requirements then as means of targeting what behaviors are necessary to achieve these things, start avoiding these specific one-off implementations reflected in an indicator and build a more robust detection and monitoring framework. So when we're looking about these things, we want to articulate tactics, techniques and procedures, PTPs, again, I'm a former military, I can say that, and, you know, start identifying those underlying attack trends, map those to the necessary adversary behaviors to execute successfully an attack, and then start building out defensive, you know, responses, detection frameworks and playbooks for response based upon what an adversary just simply has to do in order to be successful moving away from the final stages of that ICS attack kill chain. So things that we could look for, you know, pursue those adversary goals, what is it that the attacker needs to do to achieve things, target those and move on, you know, looking for attackers trying to abuse legitimate commands, etc. These are not easy problems to answer and I'm not up here to sell a blinky box that's going to sit in the rack that tells us and people who do typically are selling a little bit of snake oil, you know, these are difficult things to sort of answer and requires both a commitment on the part of defenders to start building up a profile of what attackers are doing and then building up the visibility to actually be able to track these sorts of things.   So like that fundamental idea of C2 is necessary. Well, how are different ways of implementing that possible? You know, what does DNS tunneling look like?  Look at those ways, those broad base ways of implementing it and what sort of detections can I build around there? And as far as possible, try to avoid that last stage because you can have near infinite instantiations of each of these more general items in terms of concrete observables. Those will change quite trivially, not as trivially in some cases as possible because people are lazy humans, but, you know, it's really trying to stay at this middle ground here to capture both the fundamental requirements in terms of an attack execution while avoiding the sort of limitations afforded by, you know, focusing at that observable stage. So in implementing a behavior-based approach to ICS defense, we really want to identify those behaviors of interest, try and get an idea of the different means of achieving those behavioral objectives, you know, determine, not a notification, I'm sorry, and then build out means of detecting these things as they move along the line. So for an example with credential theft, credential theft or reuse happens. Well, how does it happen? So there's both the, you know, mini-cats, dumping LSAS memory in order to achieve it. What does that look like? Well, yeah. Host and network visibility are important items in terms of answering this, so like in order to see when these events happen, what sort of visibility, what information telemetry do I need to track it, and then how do I then build out an appropriate security response in order to defeat it? So the thing is, is that do not alert on mini-cats. I mean, maybe, like, you know, if someone wants to compile the source code off of GitHub and they're stupid enough to do that, all right, we're going to learn on that hash to catch the lazy, bottom feeding adversaries, although interesting enough, some advanced ones have done this in environments that I'm familiar with, but really the main idea is to focus on, well, what does mini-cats allow you to do? How do I start looking at that idea, not just of seeing the initial credential dump, but then how that's actually implemented by looking for logon activity that may be of interest, you know, anomalous, suspicious, or definitely malicious, and start designing my defensive framework around that? So to talk about a concrete example of this, let's talk about crash override. Why talk about crash override? Well, because I worked on that a lot, and so I can talk about it to a certain level of detail. It's also a pretty important attack in the ICS space. In this case, the attack took place, you know, they had to penetrate the ICS network, establish some sense of some sort of foothold, survey the environment, get a feel what's going on there, and then deliver the attack. What's that sound like? It sounds like that kill chain thing that we were talking about before, meaning that getting from here to there requires a lot of time, effort, and other work in order to really execute it.  So building up stuff around here lets you start catching this sort of activity. The crash override event required a lot of prepositioning to execute. And looking at how that prepositioning took place, you know, at least from what we've observed so far and reported mostly privately to this point, what we observed was a lot of credential captured reuse. We observed beamy cats in the environment, not just beamy cats, but like beamy cats dumped off the GitHub repo, packed with UPX and then deployed. That's a pretty easy damn signature actually. And then a lot of use of native system commands and tools in order to then facilitate movement of malware throughout the network. So really mapping on right to those same trends that we identified in terms of more general ICS attacks. So yeah, we saw a packed copy of beamy cats, PS exec 2.11 in terms of what was used in the environment for remote process execution. And then a bunch of scripts that could have been pulled from a TechNet help page or from, you know, Stack Overflow in order to facilitate things like system survey, monitoring, verifying that file is removed and then doing some also remote execution stuff. So we're not talking about anything that's really advanced here and really mapping right on to what we've talked about so far.  On its face, it looks very much like something you'd expect using WMI and W script in order to just do some system profiling if you're trying to get a feel for what's in your environment. You know, what's the so what there, among other things, you know, there's no obfuscation whatsoever going on in here. So from a visibility standpoint, are you actually monitoring for these things as they pop up within your network to the extent possible? The example I like to give it, I've given a talk on this previously a few times is pairing bro for file carving with things like Yara in order to do a deep dive into them. Well, you can search for script files and then look for these sort of administrator commands identifying system profiling to at least identify when these things are moving around, which could be a good touchpoint that something a little shady might be going on in the environment. So we've seen an overlap with some of these same general TTPs we talked about. And believe it or not, I didn't just like sort of shoehorn this in like, you know, it's kind of like came to me in a dream, feel mostly likely about alcohol or something similar that, you know, hey, like, you know, what we're seeing with these general attacks actually kind of maps right on what we observed in the crash override event from soup to nuts. So really looking for, you know, how do we start tracking and identifying these sorts of things to build out some robust defense because at the end of the day, these adversaries are following the same sort of script and playbook that we're seeing the more lower level attacks use. So defense against this, you know, really need to build defenses around what we talked about earlier in terms of it attack trends, you know, credential replay and reuse, how do you identify when that's taking place, how do you identify that living off the land's tech taking place. But once you do that, and I'm sorry, we have a short timeframe here, so we're not going to get too much into the weeds on that. But the result of doing that sort of defensive playbook is that you've now not just built up a defense against how the electron adversary responsible for crash override operates, you've also covered a lot of other attack pathways as well for other adversaries that are going to try and do roughly the same damn thing. So we've actually seen this within the ICS environment looking at some of the events that have taken place over the last yearish give or take. Alanite, which is in the news yet again when DHS decided to rerelease after they rereleased news about the Russians in the US electric grid, a lot of their operations, credential capture and reuse and using a lot of scripts and system commands. Same thing looking at the xenotide adversary responsible for trices or Triton. I don't know who said in a black hat talk on that, if you had access to that talk, but you know, unfortunately, they didn't go into the actual preliminary for the attack. But if you look at how the attack was executed in the environment, again, seeing a lot of the same things, Amy cats using native system tools, maybe a few custom scripts and custom binaries, but overall really mapping on to how we're observing these attacks play out in the IT landscape. So the impact is that once you start covering something like credential theft, not only are you defending against a specific adversary, but you're defending against entire classes of behavior, which means that you get a better opportunity in order to try and identify and defeat multiple different things as a result of that sort of commonality and very fundamental overlap in TTP. Worms are another example.  But you know, that ability to move and burrow within a network with no oversight is truly scary because it allows for that unsupervised migration into the network and potential to deploy capability with very little human intervention. And as we've seen with certain ICS impacting but IT focused malware sets, they were quite effective even though they weren't didn't intend to be so. So so far again, the only ICS targeting worm is Stuxnet, but others have had ICS impacts. And so focusing on how those impacts came about and how those might be changed and weaponized in the future gives us a good warning for what we need to start doing now, I would say like six months ago, and we're a shore up against these things. And as any ICS professional can tell you just saying, well, apply the patch for MS 1710, like, well, I can't necessarily do that everywhere unless I want to avoid my warranty or, you know, maybe the vendor doesn't support it yet or I need SMBV one because my historian product acquires it in order to move data around the network, etc. So there's a lot of dependencies here and just saying apply the patch is not a good answer. And yes, and the result of not a good answer is that you get this happening in this environment, which is not a good day. I imagine that the poor process engineer in that facility had, I hope he got a beer after that, if nothing else, because it's a pain to deal with. So we avoided, and far as trends within worms is that we've seen first off the avoidance of exploits as time has moved on. So we started out like Stuxnet is still the crown jewel or whatever, couple of Windows zero days and some other fancy shit, not everyone can do that.  But then adversaries start getting a little savvier and start doing that integrated credential capture and replay to facilitate propagation. So using native means within the system, like net use commands and doing mapping shares to try and copy itself over and avoiding the use of what looks like obvious malicious code. And finally a shift to wipers at the end.   That's a very bad day unless you are backing up all your project files offline, etc. That's going to ruin you very fast and make your network quite untenable to operate. So the risk to ICS is that you get some self propagating malware introduced to the environment, it finds and traverses an IT ICS link that might not sound reasonable. But then like in look at want to cry, take advantage of some SMB links from historians to business process systems in the IT network and boom, you got want to cry in the OT environment. And then if you can just weaponize that by tacking on some sort of ICS specific payload, the step that has not been taken yet, thank goodness, you get a really big problem that crops up. So really what you can do is like stuck stuff for dummies, you know, to think that we kind of like move back to what was the most advanced attack yet no one really seemed to like build off of that a little bit is kind of surprising. Yet that's kind of where we are, if you can start taking these sorts of attack pathways and weaponize them in such a fashion that you're not relying on the exploits and add that ICS component, you get a very robust attack that can result in disruption or even potentially destructive destruction if you have a good enough ICS attack developer. So in building defense, you know, how do we want to do this? Well, what's one of the fundamentals behind how this attack executes? Well, it has to spread. So looking at how things can spread within your network, do you have network choke points? Does your network look like the top of this podium in terms of how flat it is? If it does, then you have a problem because if you get a warmable infection on just that one central node or one of them, it's going to propagate everywhere quite quickly. But if you establish choke points and use those as a means of hard need defense by, you know, building them up as bastion hosts or something along those lines, then you get the ability to stop these sorts of things in their tracks or at least sort of limit the damage by allowing you to filter to a certain specific endpoint and being able to take action there. And then reducing that attack surface so identifying what those ITICS traversing links are, locking those down as much as possible and maybe making sure that they host on the other end of those, you know, whether that's putting in something like a, you know, VPN gateway or some other sort of bastion host and making sure that guy's patched, probably a good idea. Finally, you want to increase visibility within the network with worms might not help too much because it's just going to tell you what happened after the fact, which is actually not trivial, because just being able to say that, hey, we know why this happened is still an important question to answer, but can inform detection, mitigation, and also recovery by being able to track how an attack was actually executed within the environment. So the impact is, is that, well, hopefully you get better architecture.  So by focusing in how these things self-propagate, you've now taken care of or at least started to address problems like, you know, RDP use by using captured credentials by a human in the loop, taking advantage of single points of failure in the network in order to start spreading malware willy-nilly within the control system network. So really again, taking advantage of what ideas are afforded by these general IT attack trends to improve ICS-based defense. So in developing defense, you know, really we want to, you know, identify those sort of common commodity sorts of attacks and start building up an idea of how these things look within the environment and then close at the sort of pinnacle with how we were going to start building detections and response around them. And again, the idea being is that once you start getting up here in developing ways of responding and identifying these that you're covering a very broad base of potential attacks based upon the identification of fundamental behaviors that adversaries are taking. So ultimately, and I just got the five minute warning, so we're going to have time for questions, is if you look at how attacks play out, and I know this is a sort of an offensive conference, I'm sorry, I'm like, blue team are all the way that defense really has the advantage when it comes to ICS defense if you're doing this sort of work. Because when you look at how an adversary has to operate, they've got a lot of steps that they have to succeed in order to actually execute with the, there we go, in order to actually execute an IT, an ICS-based attack. They got to get into the IT network, they have to figure out how to move from the IT network to get into the control system network, figure out where the hell they are and what's in that control system network, if they haven't harvested that from a spreadsheet sitting on the IT network, which hopefully they didn't. But even if that step's been accomplished and they already know what they're getting into, you still have to get onto those devices, tunnel into where you can actually start delivering a destructive or destructive payload and deploy it. That's a lot of touch points that as defenders you can use in order to trigger off of what's going on, and thus build out a more robust multi-stage defense. And if you're lucky, you get them here. If nothing else, you just want to make sure that your response isn't when you see smoke coming up from one of the machines on the plant floor. But really by following these steps, I would say that defense legitimately has the advantage in having done maybe things that are more on the attacker side. It's harder than it looks and it's harder than we often make it seem and adopting that approach, again, sorry, defender here, really drives home the point that defense is doable within these environments. So that's all I've got. And now we got a fast question. I don't know. I wish I did. There's still a lot of details around that attack that either are not public or simply unknown for various reasons. So we're still poking at that one and hoping to answer that question some day, but unfortunately I don't have an answer for you right now. Yes, that's a good question. And that's again goes to my scary scenario. So, you know, I've seen some other talks or whatever about like, oh, building an ICS attack is easy or whatever.  And boom, you build an exploit. It's not that easy, thank goodness, because again, a lot of the benefit to that is depending on how you're building out an attack and what equipment you're targeting, the unfortunate diversity in vendors, standards and protocols builds in a unintentional layer of security in that something that's going to say attack the DMP three protocol for North American electric operations. It's going to be inapplicable for targeting say IEC 61 850, which well, no, that's a bad example. IEC 104 crash override example, more prevalent in Europe in the Middle East. So it's really depends on like what sort of targets you're looking at, what you're actually identifying and then weaponizing it in that fashion. So it is possible though, like we may well, we didn't really see it. And this will be a talk tomorrow, the Modbus capture capability for VPN filter, like people have kind of implemented something along these lines already. But that's only one example. And that is a allegedly, we'll talk to Mr. DeSantis tomorrow, a, you know, state sponsored sort of activity. So not talking about just any Johnny off the street, executing that attack. So in terms of the possibility of developing that, I mean, again, it's going to take time, effort and resources to build that out, but it's not impossible. And we've already seen someone getting part of the way there with Olympic destroyer, because even just the capability that it offered, which was very window system focused in terms of, oh, what's funny, Olympic destroyer, the wiper function operated very similar to the wiper function and crash override. And that on top of wiping some files that also remap systems in a way to render the system unbootable. So really using the same sort of behavior, again, behavior based defense. But if you ran that in an ICS network and it spreads to Windows machines there, and you can do that by, you know, deploy an implant that sniffs for Modbus traffic on the wire. If it's in a situation where it detects Modbus, I might be in the ICS network. Let me fire the wiper there because I'm going to do more damage. Please don't take that idea. But anyway, and at that point you're wiping HMI's and engineering workstations, which yeah, maybe you haven't caused physical destruction, but you've disabled your plant environment and your engineers can't do their job. So yeah, it's eminently possible. It's just not necessarily the easiest thing to do. I do.  The engineers don't want to patch their crop or whatever. Like, no, I think everyone's taking this serious. The problem is, is that you're not like this for the same reason why I want to cry is going to be a problem for the next five, 10 years. Probably is that you just don't like, oh, replace that piece of equipment like that cost a million dollars. Right. Exactly. Which is the issue. So as a result, we get a really long tail, you know, that we're dragging behind us of legacy equipment with its own sort of problems, which is why again, building that, you know, layer defensive model is important because like, yeah, I might have some PLCs or whatever that those are going to be vulnerable to, you know, MS-867 or whatever for the next 20 years.  But I've got these HMI's and EW's that are sitting a little further upstream. I can harden those though to make sure that, you know, that lessens the likelihood that someone will be able to take advantage of the weaker equipment at a lower layer of the Purdue model. No. Yes. No. Unless you're nuclear power, there is no air gap. Sorry. That ship sailed a long time ago. Yeah. I mean, just that's a fact of life. Look at vendor documentation. You want updates? Well, you have to have network connectivity. Sorry. And you know what? We get a lot of efficiencies out of having no air gap in terms of, you know, even something as fundamental, which allowed for one to cry. You know, SM, you know, the way it was implemented was wrong, but the fact that it's there is sort of good. You know, links from data historians to business process servers or systems within the IT network.  So yeah, these things are here and here to stay. So the best thing is instead of bemoaning, like, oh my God, if only we could air gap these things, like, eh, pump your brakes, we can't do that. You know, identify that that is no longer the case and how do we actually go about defending it then? All right. It's hot in here. So, yeah. Thanks everyone for showing up.


Everybody, welcome to another episode of Esoteric at Nanna. Today I had the incredible opportunity to sit down with former Olympiad and gold medalist Jamie Saleh and Stanley Cup winner Theo Flurry. The full episode, the full interview is over on my rumble page. You can find that full episode by following the link below.


Is he? Were any of your human friends ever afraid of the dark? Oh, sure. Every imaginary friend's faced that problem. Hmm. Let me just get my fishing rod. Huh? Is he? Oh! Wow!  A bucket of starlight for your friend Nathaniel. So he'll never have to be an ookey-spookey darkness again.


Hey, good afternoon everybody. Tom Stewart here, I'm with Let's Trotter. This is Smart Business Moves, and we're with Derek Christian today, sitting in the basement. Yep. Derek's been relegated to the basement. Well, that's no shocker. You like to be there as long as they got comic books or something down there for you, huh, Derek? It's quiet, it's dark, it's cold. This sounds about perfect. Good place for a mushroom. Yep. Basements are cool, though. I like basements. We don't have basements where we are.  Yeah, yeah. So your house in my world, you would like your mother-in-law apartment, that would be called a basement here, even though it's not under the ground. It's not buried, yeah. Yeah, it's not buried. But we have basements here. Not a lot of them, but we do have them. Hey, Denise. Good to see you. I talked to her just for a second earlier today. All right, good to see you. Did you see where Molly had a birthday party Friday? Yes. I saw it, yeah. Did you post on Facebook? He did. What happened? I think 2-2, it was nice.  Wait, can I talk? Do you have help? Liz, do you have a special, do you have a special one? Come say hi, real quick. Oh my. Yeah, this is Elsa.  Oh yeah. Yeah, but it's not Anna, it's Elsa, but she's like, yeah, no. So yeah, we're working. Hey Dawn, hey Linda, hi guys. All right, I gotta get back to work. Tell Molly. I might need to tell you something. Tell me what? Can I, can I have a special day, can I have a treat, treat? Yes, it is a special day, yes, you can have a treat. Okay, it's a special day, can I have a treat, treat? Yeah, sure, go ahead, go. That's, my daughter is being lazy right now. She's probably in there reading a book, thinking, Mom, I'll take care, it'll be fine. Yeah, that's all good. That's kind of what these trips are supposed to be about, right? I mean, she does the heavy lifting every day, you're supposed to, yeah. Yeah, yeah, and I like it. So, but I'm like, hey y'all, it's one hour, come on now. All right, so any news? I heard a little bit, I was talking to somebody about Earned Income Tax Credit, Tom, and I heard that there were a few things to, that you had to know that. The Employee Retention Tax Credit? Yeah, what did I say? Earned Income, which is probably what your employees are using. Right. Like hopefully none of us are qualifying for that one. No, that wouldn't be good. Yeah, for the. Employee Retention Tax Credits. Thank you. All right, is there any kind of new news about that? I might have just been talking to somebody who's hiring a company. And so they were talking about the criteria that they have to meet. I don't know. I haven't heard anything recently. Yeah, I haven't heard anything recently. I mean, the last big change is they made it. So if you got your PPP loan, you could still get the tax credit. You just can't use the money for the same things, which is a bummer to me because I'd already applied for forgiveness. And if I would have known that at the time, my forgiveness would have been utilities and rent. But it was easier just to send in my payroll. But we didn't know it at the time. But for a lot of us, we're still able to get some. In fact, I was talking to someone today who just got $30,000 with their accountant. They got done with their taxes and discovered they'd be getting $30,000 back. She was like, it's like another PPP loan. Nice. There's no paperwork other than what her accountant did. Yeah. And I'm looking here in the news and I don't see anything within the last couple of weeks on that. But I know a lot of companies are working them. And there's a lot of details in terms of not overlapping. You can't, whatever your PPP forgiveness period is, you can't use those expenses to, those payroll expenses to qualify for ERTC. But there's a lot of fine print to the rules of how do you qualify for ERTC? I mean, the easiest way is 25% the decrease in revenue quarter over quarter. But there's also a lot of fine print about some type of government intervention, shutting stuff down, schools, things like that. It's very broadly worded. And I know there's a lot of companies out there who help companies fund tax credit. So they're kind of getting into the game and are finding all types of ERTC tax credits for companies. Yeah. So I guess I really wanted to bring it up to, let's, we'll see what Denny has to say in a second, but I wanted to bring it up to remind everybody that this is a significant amount of money, that you're not hearing a lot about this in the way that we heard about the PPP. So don't just blow it off. Don't just be thinking, oh, okay. Well, yeah, I've heard about that, but yeah, it sounds like a hassle, you know, you just- It's like 70% of payroll up to $7,000 an employee, I believe, for quarter. Right. So it is a lot of money. A lot of money. And that is one thing that changed. It was 5,000 and they raised it to seven. So yeah, we might want to see if we maybe can find someone who wants to come talk to us about it. That might not be a bad idea. Yeah. It'd be a good topic for next week if we can find one of those guys who chases down credits. I do know a couple of people. Tom, you have connection with somebody? I do. How did I know that? So that'd be great. That's a good idea. I'm pretty sure we use our service at Castle Keepers. We do. Yeah. You know, you give them power of attorney that way. If there's any, I mean, at the end of the day, I don't know how all this is going to shake down, but just having a third party intermediary use the subject matter expert saying that you qualify and whom I would argue with them. They're the experts, right? Yeah. Okay, what is, what is, didn't he talk about here? Applications. Come on, has ERC going? We're in the room and got stuff. So it's kind of tied to accountants. Well, your CPA is another way of doing it. A lot of CPAs don't get into the payroll processing part of it. You really, it gets into somebody who, a lot of your, your, your payroll processing companies, partner up, tax credit companies for, you know, WCT credits, which is another program that's been out there forever, but this employer retention tax credit has potentially been bought. And if your revenue is still down, it goes, this program goes all the way through 2021. So, you know, like first quarter 21 compared to first quarter 19, they don't even look at 20 because COVID was messing those numbers up.  It could be a ton of money. And to the point, to the point where, you know, if you're within a few points of being below 25 or above 25, you'll have a lot more money in the bank by not working so hard these last couple of days. Yeah. So, yes, absolutely, Denit. There's no, that's what most people are working on right now. Yeah. And I think what you're running into, Denit, is the problem that to qualify your revenue has to be down, which is why, your gusto says, talk to your accountant. Make sure you meet the revenue requirements, but your accountant's like, we'll talk to your payroll provider for your report. So honestly, either a third party company or getting the two of them to talk to each other might help.  Well, why would they do it if they're not making money anyway? I mean, that makes no sense to me. Well, I'd like to know. Yeah, you pay them per hour, but they're not going to be making any more money if they find you tax credits or not. I mean, credit companies get a percentage. Tom made some predictions on this thing way back when, which I thought was crazy at the time, but at the rate they keep passing laws might not be. And I remember he said, I wouldn't be surprised if they don't eventually waive the idle loans until you don't have to pay those back either. And I wouldn't be surprised if that's not one of the future bills at this point. Yeah, I wouldn't be surprised. Yeah, I wouldn't be surprised by anything at this point. Yeah. Everything is shocking. So, Denny, I think Derek's probably right. You probably just have to get those two people to talk to each other, find out what information your accountant wants from your payroll company to find out what your, probably your accountant needs information from your payroll company, like Derek said, and your payroll company needs to give you, give your account the information so that they have the numbers to be able to work with. Probably, it makes sense. All right, well, anything else around our financial stuff that we might want to talk about? Not right now. Not a whole lot going on there. Found an article today that maybe I'll share later this week. I haven't had a chance to dig into it. It's in the Atlantic, just so you know, it's a little political, but starting to talk about COVID-21 and how this whole thing is going to be evolving and it has some pretty interesting implications for people on work such as us, I mean, short story is COVID's not gonna be going away anytime soon and safety issues and, you know, some risks and some opportunities for us in the house cleaning world. Hey, Leslie. All right, yeah, I definitely want to hear about that, Tom. Absolutely. The more information, the better in my mind. We'll stop talking about COVID-19 and start talking about COVID-21. Yeah. So Derek, we want to talk about sales tonight. Yeah, we're gonna talk about sales, but before we do, what are you guys talking about on the next couple of days? Give people a quick preview and then I'll jump in. One point. But tomorrow we're gonna be talking about recurring revenue and have stock recurring revenue, why it's important, the math behind it and all the techniques that we can do with our business to set the expectation to both prospects as well as throughout the sales funnel. It's like, you know, any rational person would want their home cleaned on at least an every other week basis.  Well, we're gonna talk about how we can implement techniques to increase the probability of getting a lot more lifetime revenue out of those customers. Where'd you go, Liz? I went to shut the door so that my grandbaby couldn't keep coming in here. Okay. What are we gonna be doing next, parents? What are we gonna be doing Wednesday? I do not remember. It's gonna be awesome, Liz is gonna be doing it. Well, I can tell you in just a second. See, I went and put you on the spot, sorry. That's okay, I have it right here. And Wednesday is a pretty big day, pretty important day. A lot of things are gonna be going on Wednesday. Yeah, it's like one of the most important days of the year, I think. Wouldn't you, Tom, wouldn't you say that? It's right up, it's close, it's with them. Really close. All right, so yeah, my birthday, that's why. But Tom's only thinking it's close to the important day because it's his day, his next day. All right, so controlling your quality standards, that's what we're going to be talking about. And the reason why I wanted to talk about controlling quality standards, I mean, outside of the foundation thing, and of course, everybody knows that we're talking about foundations and trying to give you guys a sneak preview is because I have had so many contact communications with people over the past couple months about quality dropping. And it seems like, why is quality dropping? It doesn't seem like it should be. We've all had all of this time to invest in training and be able to pay people better and do all of these things. So why is quality dropping? So I'm going to be talking about, you know, when quality drops and it drops even in the best of times what you can do and how to manage that and how best, what are the best strategies for raising quality? So that's it. Cool. Well, today I'm talking about how sales is actually teachable skill and something I'm pretty passionate about because I see a lot of familiar names on the feed but a couple of people I don't know. I'm not exactly known for being Mr. Warm Fuzzy. I'm not real biggie to being hugged and you put me in a room full of strange people and I don't like to talk to them but my career was always in sales which for a lot of people doesn't seem to make a lot of sense because I'm not the outgoing, I'm kind of an introverted person. Yet I was in sales for many, many years at P&G and then ran sales at my own company till I got so big that it just didn't make sense to do it because despite what people think, sales isn't really about personality. Everyone seems to think that sales is that gregarious outgoing loud person. They meet one of those people and go, wow, that should be a sales person and believe it or not, those are actually normally your worst salespeople. There's kind of a stereotype of that kind of pushy loud salesperson and that's actually not what you're looking for. Sales is a skill that you can be taught. Real sales, I always tell people if you're a real sales person, you should love your job because your job is to give people solutions to their problems and you should be able to listen to what their problems are and let them know whether or not your company can help and if so explain it and that's really what sales comes down to is making sure you understand what their needs are and understanding your company to know enough to know whether or not you're a good match and then explain why you're a good match so that you're the logical choice. So sales is all about having a process in a system for people to follow and to make sure that they know a ton about your company and that you give them a process to follow. So for example, one of the things that I like to do with new salespeople is I actually make them talk about our company for 15 minutes without talking, without stopping which is painful. I've done it with Tom's people. It's entertaining to watch but the idea behind it is you really wanna force them to think about all the great things about your company because there are a lot of great things about your company. You've got great management, you've got your training program, you've got the product you use, you've got your quality assurance program, you've got the tenure of your employees.  Okay, what about attendance? What happens if somebody's sick? How do we make sure quality stays on? So I would prompt them with the questions to make sure they come up with all this because your salesperson really should have an almost encyclopedic knowledge of the company because if they're gonna try to offer solutions they have to know what they're selling and they have to know it well which is what I find a lot of people make a mistake on is they think that sales isn't that important and there's this real trend toward using like virtual assistants and stuff where, hey, I'm gonna have somebody else sell for us, all they need to do is get a name, address, phone number and get people on the schedule but at that point, the only thing you're explaining about your company is your price. So don't be surprised if people pick off of price if the only thing you're talking about is price. What you wanna do is talk to the customer, find out what they need, pull it out of them and then at that point, I'll explain why your company is good. So that's why we always recommend you have a pretty detailed script and that's one of the things we do share at our foundations program is the script that we used and it varies, different people care about different things but I ask lots of questions that honestly aren't gonna affect the price of your house, do you have any kids or not? At the end of the day, that's not really part of my pricing formula, some people it is but it's not for me but I wanna know because that's starting to help me figure out what your problem areas are. If they have kids, I'll normally ask questions like, oh, that's so great, what ages are they? Cause A, I'm trying to make a little bit of a connection with them but as I learn about the ages of the kids, I can talk more about our service. If they've got young babies, I might wanna highlight things like our floor cleaning program and things like that. If they've got older children, I might wanna talk about things like clutter pickup. There's different services maybe make sense for different age groups and you just wanna kind of find out what those needs are and I've always been a big user of the rank your home on a scale of one to 10 question where I ask people on a scale of one to 10 with one being the most beautiful home in the world in a magazine and 10 being an episode of hoarders, how would you rank your own home? And that is how I phrase it, I try to make them laugh a little bit and then once they give me the rating, I ask them why they rate it that way because that really helps me get into the psychology of the person a little bit. There are people that'll say, you know, my house is a three, four, it's pretty clean. I cleaned the kitchen after we do meals and, you know, the maid service comes every other week and the next customer would say, yeah, it's a six, seven, you know, I can barely wipe down the counters and every now and again, I sweep the floors but I just can't stay on top of it like I used to. And that kind of lets you know what type of customer are you dealing with? That first person's definition of clean and standard of clean is not that high. That second person's definition of clean is much higher. They think wiping down the counters isn't cleaning, it's minimum necessary level. And so with that first person, I'm probably gonna talk about our convenience, how easy it is to pay with us, how friendly our people are, how easy we are to work with because at the end of the day, they're not your white glove person. They're just not. Where when that second person describes what I think is a pretty clean home but ranks at five or six, meaning me kind of dirty. I know this is somebody where I've got to be talking about our quality control systems or training programs because that's the type of stuff they're gonna care about. So a lot of those questions that you wanna build in there, not only do you wanna have the question that you wanna explain to your sales person, why is it in there? And what are we trying to learn from it? Like I said, on that dirt code question, it's not really just about how dirty is the house. Although it is, that helps us price the first cleaning but it's also how do they define clean? Because honestly, that's probably one of the toughest things about our business I've always thought is there's no single definition of clean. And when you're trying to sell something, it can be difficult if you don't know what clean is. So trying to define what clean is is important and understanding what the customer's definition of clean is and then also making sure they understand our definition of clean, which is also part of the selling process. Your sales person needs to be setting an appropriate expectation. It's easy to be a good sales person if you basically lie and to constantly tell everyone, oh yeah, we do that. No, we can do everything. You'll be so blown away by our cleaning service. It takes a real good sales person to explain why you don't do certain things. Yes, we don't vacuum under beds. Here are the reasons why that's good for both us and you. Here's what's included in the service. Here's what's excluded in the service. And here's why that may or may not be a good match. Sometimes a sales person should be talking people out of your service. There are times where a customer's just not a good match. And I always like to say it's like walking into McDonald's and trying to order a quarter pounder. You know, could they make both for you? They could, but it's never gonna be right. It's not what they do every single day. So if you're trying to design both a quarter pounder Okay, excuse me. What, which one's burger king? Burger king. Look, I get my burger spectrum. I was looking at Liz, Liz was looking. It's like McDonald's was doing it. So you go to Burger King and if you order a quarter pounder, they can probably make it, but they don't make them very often. They're not gonna make it. That's not what Burger King does. They make their burgers, they're different. Okay, the waffers. See, I don't need enough burgers. So the waffers is there. I should have said Burger King in order a Big Mac because I know Big Macs McDonald's. But the point is they could probably fake it. They could come up with something close, but it's never gonna be quite right. And you don't want your salesperson selling to people who just have the wrong expectation. And so I always use the burger analogy. And sometimes I'll also say you can get a burger at McDonald's, you can get a burger at Chili's, you can get a burger at a fine dining restaurant. They're all burgers, but you've got to understand what you're ordering and what you're getting. So making sure that those two things line up is always super important. And it's also why different companies have different prices. We don't all clean the same stuff. So it's really important that your salesperson explains what that scope of work is. There's a certain franchise who I always had to sell against in Cincinnati because they started in Cincinnati, which uses a rotational cleaning system where they don't clean everything every single time, where we cleaned everything every single time. So we wanted to make sure people understood the difference. Hey, when you call another company, they're gonna be a little bit cheaper. But the reason why is they're only gonna do your baseboards every third visit.  And making sure that your customers understand those differences of scope of work and what is gonna be delivered so that the price makes sense. So we were just talking on a call today on one of the MMA calls and somebody was, you know, we're going back and forth about how you should price. Should you price for hourly or price by the job and how there are benefits to both. But either one, whichever one you're going to do, back to what you're saying, you've got to be able to sell what it is that you do in a way that it sounds better than whenever the other guy is doing. Yeah, I mean- And they're doing the same thing, yours has to sound better in some way. Like you said, I can sell both of those. I can sit here on hourly and say, hey, the great thing about hourly is the team is not motivated to rush. They're gonna take their time. They're gonna do a good job when your house is cleaner. You're not gonna pay as much.  The advantage of flat rate, you're never gonna get surprised. Don't you hate it sometimes when someone comes in and you get sticker shock at the end? That never happens with us. You will always have a set price. We'll make sure that you never get surprised. So for like every, you know, model, I guess, you could come up with a list of like pros and cons. So you speak to the pros of your model and you speak to the cons of your competition model. Right. I don't even think so. I think you just identify their cons and then speak to your pros, the pros of your company that address those cons. I think that's a more successful strategy than speaking directly to their cons. Because a lot of people think speaking directly to other people's cons is... Yeah, I mean, that makes you look bad too. I mean, I wouldn't recommend saying XYZ company does all these bad things, but you say in general, you might find some other companies that are doing certain stuff. If you keep it just very generic, these are some things that you wanna be aware of. Right. Like on the hourly, I wouldn't get into details. I'd say some companies charge hourly.  We always charge a flat rate for that reason. You know, and if people start saying, well, why would it vary? Then you can start saying, well, what if they've got a new cleaner? Who's kinda slow? You know, you're getting penalized for that. And you get the idea. Not every company cleans everything every visit. Sometimes they'll clean your base. Or is that an example? You're not calling out XYZ franchise, but... Right, and I'm not even saying that's a bad model. It's just different. Honestly, I'd probably be better on a rotational model because I'm not a guy who inspects my baseboards. But my company cleans them every single time. So it's important the customers understand that. And that's the other point that we were talking about today, is when customers leave your company, it's almost always for one of two reasons. Everybody thinks it's because of price. And the customers will tell you price because it's easy. It's easy to say, right? But it's almost always, and we've done so many tests on this, almost always unmet expectations. They were expecting something that they didn't get. Or they didn't know how to get what they wanted. They didn't know how to say it, how to get it. Sorry about the screaming in the background, y'all. Yeah, I've always said, even when people cancel for financial reasons, to me, it's not really financial. They're saying there were other things I'd rather spend my money on. Even when people have financial trouble, they're still getting their Starbucks potentially. They're still spending money on some services. When it came time to cut something, you were on the list of services they could live without. Yeah. They could get somewhere else cheaper. Yeah. But they wanted they could get it cheaper. So unmet expectations, I think that's pretty clear. Not being able to explain what your expectations are, I guess there's a little bit of differentiation there, but they're still kind of the same thing. In their mind, they're looking, they want something that they're not getting. Yeah.  Go ahead there. No, and I think that's part of your sales person's job is to do the initial expectation setting. Here's what's normally included in our cleaning and try to pull out if there's anything that the customer's looking for. Cause we will specifically ask, is there anything else you're looking for in your cleaning service? And we used to have a rule that we would do what I call two deviations, which is if you wanted two tweaks to our service, we would do, we would do a couple changes. But once you hit three deviations, that's when we said, you know what you're looking for is a little too different than what we do. And we knew enough about our competition that a lot of time we can say, what you're talking about is more like what so-and-so does. Why don't you call them? We took that from you, Derek and it worked out amazingly well for us. Yeah, that was, I thought that's a great, and it's really good for your salespeople to know that it's okay to use these two tweaks. But when you get to the third one, they're not going to be happy with our service and we're not gonna be happy with them as a customer. It's just too different. We're gonna drop the ball too many times. Yeah, we're getting too far away. Yeah, and over the course of time, they're not going to end up being happy. Because when you make an exception to your processes, it's a manual intervention. You're training your people to do something very specific and then you're including on a work order. For this one customer, do something manual interventions are when errors happen. And you've got to try to eliminate as many of those as you can. So when you get to the third deviation, do you just automatically go to, you know, that's the answer to stuff that we don't do, or do you? If it's something we don't offer, I mean, it could be, well, it sounds like what you really want is our deep cleaning. Let me talk to you about that package. So sometimes it is another service that we offer, but sometimes they just, they're getting too far away from what we do. They start asking for different cleaners. They start asking that we use their vacuum instead of ours. We just start moving too far away from what we do. And basically I'm telling my people, forget your training, do something special for this person. And that's when everything goes to pieces. Yeah. And a couple can hold in their heads and they can do, which makes sense. But once, and for us, it was three. So, you know, we do a lot around the magic of the number three, right? So you can do up to three for us, but once you get past that, nope, things are going back. And I guess kind of in the same discussion would be trying to get the prospect to try to drill down in terms of what is the outcome they're looking for?  And you know, presumably we're the experts, we would know better than the prospect. But you know what? I love that you brought that point up, Tom, because I think that right there is one of the key things that sucks people in and messes up the business. Because the business owner just all of a sudden starts becoming the follower. Even if they were doing really well, leading the conversation, leading the sales process, as soon as the customer says, well, you know, I wanna make sure that they're gonna be doing my kitchen floor on their hands and knees. It's really easy for the business owner to go down that path of hands and knees. But that's really not what the customer's asking for, but it's easy to think they are. That what they want is they want to, they wanna look down on that person and like, I got a whip and shh, shh, shh. You're not on your hands and knees. That's not what they want, right? When people are asking for hands and knees, they're asking for a certain level of cleaning. And so that's what you gotta address. But I think business owners get stuck a lot of times that customer says, well, I really want you to use pine salt. All right, so why do they want you to use pine salt? Do they like the pine scent? Do they think it cleans better? Or do they think it's the only thing that works as a disinfectant? You know, what's their reasoning? And so finding that out is really critical on the sales process, which goes back to finding out instead of telling people what you do and all of that stuff, finding out what they need and then address that. And typically we'd recommend you ask a lot of questions like on Tom's example, where somebody brings up hands and knees, we'd say. So what I'm hearing is that floor, kitchen floor is really important to you. And then when they say, yes, okay. So what types of issues have you had with the kitchen floor in the past? And a lot of times at that point, we can talk about what our solution to it is. Whether it's our steam or our mops or our technique or the way we inspect it or, yeah. And that's how we address that problem. Yeah. And I do like to do a little bit of what you're gonna find at other companies and what we do that's a little bit different. So not what they do, it's bad, but what we do that's just a little bit different than that. And a lot of times also in the language, sorry, Derek, go ahead. Now I was gonna say what you just described is a variation of what's called feel felt found. Yeah. I understand why you feel that way. Others have felt that way too. What they found is when they used our service, here's why they didn't have that problem. So that's another really good example of how you can train for sales. So if y'all are taking notes here, that would be a really great note to write yourself, feel felt found. Mm-hmm, yeah. And you just did a variation of it, which when other people use other services, this has happened. Here's how that doesn't happen here. Yep, yep. This is what we do here to combat that. Yep. And so anything that you do that other companies don't do, you just wanna have a really good reason why. What is it that you're doing that, well, why do you do that thing and how is it better for me, the customer? That's what all the customers looking for is, oh, that does sound better. Oh, okay. Back in the day, this before COVID of course, but back in the day when customer would call and ask, you know, well, what do you guys do? How do you clean? We would say, well, one of the things that we do that's a little bit different is when you call around other cleaning companies, they'll tell you that they dust, they do all of the dusting and the high cobwebs in the bathroom. We don't do any dusting in the bathroom. We do only disinfecting in the bathroom. So all the surfaces that we touch, we disinfect. So you're not going to be seeing a lot of dusting in the bathroom. Now, of course, everybody says that everywhere, right? But back in the day, a lot of times that would send the deal right there. They're like, oh, yeah, I would rather have my bathroom disinfected. Of course, the other companies disinfecting the bathroom too. They're just calling it dusting. But that little tiny. Ain't the bathroom just got to be dusting? No, it's going to be disinfected. So of course not. Because the only way to disinfect it is if it doesn't get dusted away will disinfect. Yeah. And we don't say that we are not going to dust it. We say that instead of just dusting the bathroom, which is what they said they were doing, we're going to be disinfecting. Everything will be disinfected. And usually that would, right there would be, oh, yeah, I'd much rather have my stuff disinfected. Okay, yeah, I'll sign up. But I mean, I mentioned it kind of passing and now you've mentioned it. I'm surprised when I audit company's calls, because one of the things I do a lot of is audit company's calls. How many people don't tell people what's included in their cleaning service? I mean, part of your sales, at some point, your sales person, you say, great, now let me explain what's in our cleaning package. And it's funny, once you've done enough, you can have it memorized and be pasting the room while you say it, but, you know, and you can normally get it down to 30 seconds and you know both rooms so that people know what you're going to get. And I would say anything more than 30 seconds is working against doing a lot, unless you're dealing with certain behavioral style, right? If you're dealing with somebody who wants all the data from all the companies, all the time, then you might have to give more information. But most people that are calling, they just want a general idea of what you're doing and how you're different and what's gonna help. They want help making the decision. That's what they're looking for. I wanna find out why I should hire your company over that other one or why I should hire them over you. I just don't wanna have to call anybody else. I don't wanna have to look any longer. I just wanna be done. Give me a reason to stop trying to figure out who to go with. Because assuming you give them that reason, why are they gonna move on? That's why the, you know, carry strategy is so, so great. That's why it's such a no-brainer.  The irresistible deal. Yeah, the irresistible offer. Conn, how does fragrance fit into the discussion? And when we're talking about expectations, and I know that that might not be the thing that's gonna make a client fall in love with you and say I'm not calling anybody else, but, you know, expecting expectations. I mean, certainly, I guess as a salesperson, you need to be prepared to speak about that, because Liz mentioned earlier, you know, I want to use a pine saw. And what they really are saying is they want their bathroom to smell like a pine tray. Mm-hmm. No, I mean, fragrance is part of it. There are companies, I know, that specialize in fragrance marketing. When they're talking to the customers, they're like, we use this amazing mint basil product that when you come home, it's gonna smell fresh and wonderful. And other people really sell that we use products with very low scent, so that when you come home, you're not getting that nasty chemical scent. I've seen people sell both sides of that. Equally, but once again, it's part of setting the expectations.  Right? Smell anything? You gotta explain that. Right, they've been trained by the previous company for vice versa, if they've been using the scent neutral company and they come home and smell what they think is chemicals. If you didn't explain that you're using this wonderful natural basil extract product, they're thinking you're trying to kill them. Yeah, or you're trying to cover up dirt, right? Yeah. Because the company that is cleaning without any scent at all, usually their pitch is that clean has no smell. So if you're smelling something, that is not a good sign. That's a sign of some cover-up maybe going on there, right? So there's, you gotta know what you have and how to combat what the other people are saying. So you do have to know well, what is it that you offer and how does it combat what the other guy is offering? Well, and it's tough to sell clean without a scent. When I worked at Proctor Gamble, there was a famous case study where when Febreze first came out, it was a failure because people would use it and they didn't smell anything and they would say the product didn't work.  You don't smell the bad scent anymore. It wasn't until they started putting good scent into Febreze that people actually started buying the product. People used to buy Febreze and go, this is a terrible product. I sprayed it and I don't smell anything. And they're like, that's the point. It's an odor eliminator. It's not an odor adder, but they had to put an odor in so that people would realize it became clean. Yeah, that makes sense. And people, you know, I think that a lot of this is shifting also, you know, it's always shifting, but I think COVID is changing a lot of this and there are no right answers right now. You know, it was easier. I still think scent is definitely a thing though because I hear people complain all the time about the hand sanitizers that are stinky and things like that. Man, that brewery hand sanitizer is terrible. And you're like, actually, that's actually pure sanitizer. It sounds like they were drinking on the job at my house. Wow, that's a little vodka we use for cleaning. That's fine. But yeah, so one of the things is making sure you understand the scope work. And like we said, you got to explain why you're different. So with us, what we do is we get through our quoting questions and then we give the customer an opportunity to ask questions. I go, great, before we move on, do you have any questions? That often gives you a chance to brag. A lot of times customers will ask you questions like, well, how are you different? I've looked at three other cleaning services. What do you do about this? What do you do about that? And then you don't seem salesy. You're just answering the question. So I normally say, so great, before we move on, do you have any questions? And about half the time, they give you a reason to brag. And that's like I said, where I like having myself, people have nearly encyclopedic knowledge of the company. So when people start bringing up stuff, they go, well, let me tell you about our training program and our training program. Here's what we do. Because they know and they sound authentic and they know the truth behind it. If for some reason, somebody says, no, I don't have any questions to lie. And I normally use this, well, great, while I'm figuring out your price, I'm going to give you a little background on the company. Now I use software that I press a button and I've got the price already. I probably have the price before I ask if you have any questions. But it gives me an opportunity to talk to the customer. And normally what I try to do is take that stuff we talked about earlier when I was having the conversation with the customer. Do they have dogs? Do they have kids? What special needs did they express? And make sure that what I'm explaining matches that. So that's where having that in-depth knowledge of the company helps. So you can do great. Well, you mentioned that you had kids and here's what we do to make sure that we don't wake up the kids when we come over. We can adjust around nap time or here's the product that we use on the floor so that your kids won't get those products in their mouth. Whatever those kind of touch pranks are for your company and it's going to vary for each customer. Yeah, absolutely. How long would you think this process should last? Ring, ring, hi. I'm interested in having my home cleaned. You know, I think there's a lot of different thoughts out there of, you know, you can't stay on the phone all day. But in order to do this, this is going to take some time, isn't it? Well, I always say in sales there's a battle for control. People are fighting for control over the discussion. And so I want to control the flow of the call, but I let the customer control the speed. There are people who convenience is the number one thing for them and you don't want to force them into a 10 minute spiel, you're going to tick them off. So if you can get what you need and tell them what they want and get them on the schedule quickly and efficiently, it's great. But then there's other customers that need to ask questions, need to spend time, feel like they trust you. And if you force those people off the phone, they're going to feel like you're corporate. So you control the process so that you don't want somebody who when you answer the phone goes, great, let me tell you about my house. You want to be able to go, all right, well, actually, I've got a series of questions that really helped me and I do this all day. So let me ask you some questions. It'll help me narrow it down a little bit. Where they let you control the questions and their order they're in, but if they want to delve in and talk more, let them. You know, if they want to ask more questions about products, if they want to tell you about their baby, you asked, you know, how many kids you have? Well, I've got a baby and if they want to go down that rabbit hole, they're that type of customer.  Conversely, if they call up to say, hey, I'm really busy.  You would try to be a little faster about it, right? Yeah, I mean, I still got to tell them what's in the scope of work to make sure I'm selling what they want. I still want to tell them why we're different, but we can do that in under a minute and then get them on the schedule. I've booked customers in two, three minutes sometimes, but they're not all like that. Yeah, they're not. So I'm curious what you guys have as your, like sort of your magic questions, your questions that you asked that sort of like Derek, you gave an example of your dirt code question. That's a question that you like to ask to get a little bit different information than it sounds like you're asking.  Who's Facebook users? Is that you, Sarah, Robin or whoever? I'm curious what y'all's questions are. Do you have any kind of questions that get you some stuff to talk about? I have two questions that I really love. One is, so what is the one thing that you can't wait for us to do so that you never have to do it again? I love that question. They're like, floors. I can't wait to never do another floor. Awesome.  So to be able to set up that expectation there. I ask, what is the main issue? All right, so why are you looking for a professional cleaner? Getting the question that is getting you that answer that is like, oh, yeah, all right. I just always ask if they've used a cleaning service before. Yeah. Yeah. I've never used a cleaning service before. Can you tell me about your experience? I wanna know what's going on with it. And they're gonna tell you the good and the bad. And if you get the answer to that question up front, that'll shape a lot of the discussion from that point forward. And that's also where I always felt like it helped knowing competitors too, because sometimes they'd mentioned certain companies and say they did a terrible job. And I'm like, actually, she runs a really good company. So if she didn't make you happy, that is not a good time. Yeah. And then there are other companies that I will not mention that if people would mention, I'd be thinking, yeah, yeah, they suck. That makes sense. Yeah. In certain areas, I ask about pets and explain we offer pets sitting. Ooh, awesome, Linda. That's great. It gives you a little chance to plug that other little service in there. They're a storm blowing in and we only had time to do one thing. What would that be? Ooh, that's good, Kelly. So you find out that thing that really matters to them that you can't ever miss, right? If they're like, my kitchen. My kitchen has to be done, especially if there's a storm. The storm might take your whole house away, but the kitchen will be clean. You don't care. Kitchen's gotta be clean. Yeah. Do you have, ask how much you paid the current cleaners? So I usually ask a version of that. I usually say, instead of asking if they've ever hired anybody else or used professional cleaning service, I ask, when was the last time you paid somebody else to clean your house? And so that, because sometimes I wanna know if they like paid the neighbor girl or, you know. And so I wanna find out that answer cause then I can find out how much they used to paying what they, ah, well, I lived in California. Soon as they say they lived in California, I'm ready for them to tell me they paid 10 bucks an hour and I paid, you know, $40 and she cleaned my 12,000 square foot house every week and it was awesome. Okay, good to know. Thank you. So I have no problem asking how much people have paid in the past. I'd like to know how much they paid. We normally didn't ask just because it feels like our price is negotiable if we ask. Now, I wanted to know if they've used one before because most cleaning services in our area do the same basic thing where there's a deep clean and then a maintenance clean. And I feel like if they understand that I don't have to get into the whole spiel of it. I don't need to bore them with that. Stealing seems to be the main answer to why they are looking for a new company. Oh, wow. That is so- Not our area, they didn't show up or they, the quality decreased over time. Yeah. That's usually what I ask is, when was the last time you paid somebody to do the cleaning for you? And if they give me anything that's like in the last year and what made you stop, right? Usually if it's anything longer ago than that they'll tell us like, well, when my kids were still at home, we did or whatever. But I like to know why they stopped using that cleaning service. And usually they'll give pretty good answers about what bothers them. Which what you just said, Derek is like one of the number, one of the top. If I get an answer like, you know, stealing I'm going to ask a couple of follow up questions. Did you have a bad experience? What was missing and how was it resolved? And kind of like if somebody says, well, they broke stuff every time they were here. Really? Well, let's talk about that a little bit. I mean, sometimes they can disqualify with themselves and after that, it's like, you know, we're probably not an awesome fit either because we break stuff all the time. Yeah, that's true.  So if I'm asking them, you know, why they can't, why they stopped service. If they say, well, you know, they would say that they were going to be there between eight and 10, but they always got it up to our house closer to 10. Well, you know, you might not like our cleaning company either because we might say eight to 10. We might show closer to 10. We might even call you and tell you it's going to be closer to 11. I don't know how's that going to fly for you. So, but I am concerned like Shannon, if you're hearing a lot of people saying that they're looking for a new company because of stealing, like a lot of customers are saying that, that is the weirdest thing I've heard in a long time. You might want to find out who they were using, but what happened? And if former employees of that company want to work for you, take a second. Yeah, that's a scary one right there. Yeah, what didn't you like about your last cleaning service? Absolutely, that's a great one. One of the things that I do think you have to be careful of that I don't know gets enough conversation is people want to, they want to know what they're paying for, but only to a certain point. They don't want to know every tiniest detail of everything that they're paying for. And an example of that is if you say, well, our basic cleaning is whatever, $100. And then they ask, well, does that include, and then they ask questions after that. Like, well, how many pets do you have? Oh, okay, well, we charge $5 per pet. So that's going to be $110. And when you have two floors, we charge $3 for stairs, extra for stairs. Or, oh, you have grout, is it white grout or gray grout? Oh, well, we charge more for, you've got to be really careful when you start telling people all of the little things that you're paying for, because it can start to sound like you're penny-pinching them. Nickel and diming them, I think, is the term that is used. Especially as part of the sales process. Yes, that's what I was talking about for the sales process, yeah. Yeah, so you do have to be a little bit careful there, which is why I really love the strategy that we talked about last week, with just dropping that big number on them, all right? And how amazing this is. And if that's not good, backing off. Nick-picking, okay. That's actually also why I have always had three levels of service. Because three levels of service allow you to have flexibility, you can move. If you are cleaning somebody's house and they say the price is too much, you can always back them off the level of service. You tell them maybe they're looking for a different level of service. If they're saying they need a higher level of quality, oh, well, looks like we probably need you our higher level of service. Instead of three stars, put you on four or four or five. So I have always loved giving myself a way to move and maneuver in the sales process. I think it's interesting, like I said, you don't always want to get into the details. For example, I'm also involved in a window washing company. And on the window washing, we don't clean the screens, we don't clean the sales and we don't clean the tracks. Now, we've learned not to tell people that because when you tell them and your window cleaning $6 a plane, by the way, we aren't doing these three things, they get mad. But when we just go and clean the glass, they're happy. Oh, it's interesting. They never even thought about the sales, the tracks and the screens. Until we told them, we weren't going to do that. Yeah. Yeah, people don't want to hear what you don't do. Right. Somewhere in the hotels processes, they're in agreement that explains that, you know, this is what we do. And this is probably we do those other things for an additional fee, right? We do do it for an additional fee. But like I said, we used to make sure that, hey, just so you know, this isn't part of the window cleaning service. And we learned instead, we just talk about, hey, we're going to clean the glass. He goes, we're going to do to clean the glass. We talk about the glass and we leave the other things off. And if they care and they say, are you guys going to get the tracks? We go, oh, well, we can do that too. You know, how many sets of cracks do you want to get cleaned? Yeah, that's right. Because that's saying, yes, we do do that. Here's how much I got. But it's not the glass. We are a glass cleaning company. We're not going to clean the toilet either, but in your glass. Right, and what happened is we would get one to 2% of the customers who would complain. So we changed everything about our sales pitch because we didn't want to get that 1% complaint anymore. So we started because we got that once a month complaint about you didn't clean the tracks that we need to tell people on every call, by the way, we're not going to be cleaning your tracks. And it didn't work very well. So we've learned to just go back to it and just try to pick up warning signs or people are asking about. That is such golden advice. Never tell people what you don't do. Even if they ask you straight up, do you do blah, blah, blah, absolutely, we would love to do that. You haven't given them a bid yet. So just include it in the price. Absolutely, we love to include baseboards in our cleaning price. If they're asking you for something that you don't normally do, vacuum the furniture. Why can't you say yes? Yes, I'd love. Is there a reason why you are never going to vacuum the furniture? My guess is you will. They just have to pay for it. So yes, absolutely, I'd love to include furniture, vacuuming in your cleaning. Because people just want to hear what you are going to do. Every time you tell people what you're not going to do, you go, I love that you said this, Derek. You're reducing your value in the customer's mind, even if they never wanted those things done. Even if you are talking about things that they don't care about. Yeah, but you don't do as much as the other company because they do all of that stuff and you don't. And similarly, another thing is my salespeople are forbidden. In fact, every one of my companies forbidden from ever mentioning company policy. Nobody ever wants to hear about our policy. I say, if we have a policy and you don't know the reason why, ask me so I can teach you so that when people call in, you can say, here's why we do things this way. It's not, well, I'm sorry, ma'am. Our company policy doesn't let us do that. Now we sound like everyone's favorite institution, the bank in our insurance company. So the reason why we don't vacuum under beds is we've had a real problem in the past of sucking up iPad cords and things like that. We did it. Yeah. We've got just a few more minutes before we make it to the top of the hour. So what we're doing here really is covering some of the highlights of what we do in foundations. And that is an event that we're doing here the first week of October 3 through 10. 3rd through 10, yeah, 3rd through 10. It's so funny you said that, Tom, because my brain was automatically going to March. I'm ready for March. Yeah, October 3rd through 10. And the thing about foundations is, yeah, we're giving you just a real quick overview of some of the topics that we talk about. But how foundations works is you get a class and then you have an implementation period. So everybody takes the class together and then we all split apart and we implement big need in your company because everybody needs different things. So that's how we split apart. Throughout the week, you also have, this is something we don't talk a lot about you guys. Throughout the week, you also have one-on-one coaching with where you are and your big problems, where you're getting some conflicts or don't know how to implement something. So that happens all week long. Tom, you do, I know throughout the week, I'm coaching a lot around all of the financials, people's individual financials. And you do a lot of one-on-one coaching around people's individual sales processes and their marketing plans. And I do a lot of one-on-one coaching around building some of the problems and how to get some of those problems fixed in their individual companies. So I don't think we have spent enough time talking about that because when Tricia was talking about her experience at Foundations or Heather, they almost always talk about, yeah, I spent two hours on the beach just walking with Liz, talking about blah, blah, blah. Or I had a two-hour one-on-one with Tom talking about how messed up my P&L was. And I think it's a big deal for a lot of people. You know, we don't have any beach pictures of us either. Why does this look so big? It's so cute. We don't have pictures? There's no pictures of the beach. And I mean, this is kind of the back. And if you go that way, I don't know, just a short walk here. I mean, you can kind of see the ocean right there. That makes it look far away to me. Yeah. So yeah, the beach is how far, Tom? 100 yards? No, maybe 100 feet. Now I was gonna say it's out the back door. Yeah. Beach, meet you. Well, you're not the only one. You probably don't love the beach as much as Sarah, Sarah Mitchell. When Sarah Mitchell was not in class, she was at the beach. Every minute she was not in either classroom, Asian class. And I think she came to every single version because she was like, yeah, I need the beach. I need the beach. Well, we'll get some pictures of the beach. Time is up. Tomorrow, we're talking about what, Tom? We're gonna be talking about high frequency recurring revenue and how to make it happen. There's the beach. So here's like, you're standing on the back deck and here's the pool and there's the ocean. So I don't know. You can probably throw a rock from the back porch and get it out to the beach. Just don't fall off the boardwalk on the way to the beach. It's very painful. Only you can throw that, Derek. Only you. Laura fell off too. Oh, didn't she really? Well, she did not have a mark like you did. Yeah. Well, that was from walking into a bridge, another high hazard on the beach. Oh my gosh, y'all. Yeah, going to the- It really isn't that bad. I mean- I seem to have a problem walking and paying attention what I'm walking into or on. I don't think any of the rest of us got hurt. I was even in the water and I didn't get hurt as much as you did with surfboards and stuff. All right. Probably be sure it's in shorts in October. Yeah, yeah. Yeah. It's huge. It's awesome. Okay, guys. We got a balance. Back here tomorrow, five o'clock Eastern. Have a good day. Bye-bye. Bye-bye.