Speaker 1: Welcome to Chopping It Up. I'm your host, Mike Haleon,
Speaker 1: the senior restaurant and food Service analyst at Bloomberg Intelligence.
Speaker 1: I've got a great guest today. I'd like to introduce
Speaker 1: Deborah Nika, Senior manager of Cybersecurity and Privacy. She's also
Speaker 1: the privacy services leader at Cone Resnik and she's also
Speaker 1: been named Top twenty five women in Food Service and Hospitality.
Speaker 1: Thanks for doing this.
Speaker 2: Deborah, Thank you so much for having me on. Excited.
Speaker 1: Yeah, this is this is cool because this is a
Speaker 1: topic that's, you know, become increasingly important. You know, I'm
Speaker 1: old enough to remember when investors didn't really care so much.
Speaker 1: You know, I remember trading stocks in the early two
Speaker 1: thousands and Target or Walmart and somebody would have a
Speaker 1: security breach and you know, the stock would trade down
Speaker 1: for about five minutes and then I would go back
Speaker 1: higher than when it was traded prior to the news,
Speaker 1: and it was just kind of people thought it was
Speaker 1: a cost of doing business. But things have changed a
Speaker 1: lot over the last two decades.
Speaker 2: Yeah, I mean, you know, it's we're not living in
Speaker 2: that world anymore. Unfortunately, we live in in a economy
Speaker 2: where a breach is no longer blip on the radar.
Speaker 2: A cybersecurity or privacy incident is you know, tip of
Speaker 2: the iceberg, and everything that comes, you know, under the
Speaker 2: water that you don't see is you know, loss of
Speaker 2: investor confidence, loss of consumer confidence. And it really is
Speaker 2: not a fun place to be having to crawl back
Speaker 2: up and refresh your brand image and capability.
Speaker 1: Yeah that's great, and so can you I guess before
Speaker 1: we really dig in here, can you please tell the
Speaker 1: listeners a little bit about your background and the cybersecurity
Speaker 1: practice at Cohen Resnik.
Speaker 2: Yeah, so I am. I am a self you know,
Speaker 2: I am a data geek. I am so excited about information,
Speaker 2: and you know, spend the very early years of my
Speaker 2: career decades ago, wanting to be an academic librarian. I was,
Speaker 2: I was really going down the path of like I
Speaker 2: want to sit in a crusty old library and just
Speaker 2: like go through archives and books all day every day.
Speaker 2: And living in New York City, you really quickly learn
Speaker 2: like that's not sustainable. Like I could be a librarian
Speaker 2: and eat beans, or I could like take this knowledge
Speaker 2: that I've built up and figure out how to you know, pivot.
Speaker 2: We love that word pivot right, pivot into the corporate space,
Speaker 2: and it was the earlier days of what today we
Speaker 2: known as big data and really the early start of
Speaker 2: companies figuring out, hey, we have all this information and
Speaker 2: how do we use that information to make data informed decisions? Right?
Speaker 2: Gone are the days where an executive licked their finger
Speaker 2: and like put it up in the air and to
Speaker 2: figure out which way the wind was blowing on a deal. Right.
Speaker 2: So my career has really followed that data life cycle, Right,
Speaker 2: how do we collect information, how do we curate information,
Speaker 2: how do we use information and flow it through our
Speaker 2: technology systems? How do we use that information to make
Speaker 2: data informed data informed decisions? And then, you know, ultimately,
Speaker 2: after a what I'll call a big Brother moment mid career,
Speaker 2: I was like, hey, we've got to really do more
Speaker 2: about protecting the data, right and protecting the people that
Speaker 2: are ultimately the ones that are impacted in that you know,
Speaker 2: by that data. So four years ago, I mean it
Speaker 2: started way earlier, but four years ago had the great
Speaker 2: privilege of coming over to Cohen Resnik part of their cybersecurity, tech,
Speaker 2: risk and privacy practice and our you know, our mission
Speaker 2: in market if you will is to help companies understand
Speaker 2: that cyber and privacy don't need to be scary, if
Speaker 2: they don't need to be these unattainable only technology driven capabilities.
Speaker 2: But how do you use cybersecurity programs? How do you
Speaker 2: use competency around privacy, compliance and management to actually drive
Speaker 2: value in your business? Right? So if it's a transaction, right,
Speaker 2: how are you preparing your company to make sure you're
Speaker 2: getting great valuation? How do you make sure that you're
Speaker 2: prepared to answer the hard questions of the underwriters of
Speaker 2: how are your systems and how are your data secure?
Speaker 2: How are you running your business? How are you growing
Speaker 2: your business? How are you sustaining that growth? Cyber and
Speaker 2: privacy are front and center to that equation. But before
Speaker 2: we go any further, I think it's one of the
Speaker 2: places I really like to start and chatting about this
Speaker 2: is what is cybersecurity? What is privacy? Because when we
Speaker 2: say cybersecurity, I can guarantee you half more audience is
Speaker 2: going to think of a hacker sitting in a room
Speaker 2: somewhere at night, tugging red bulls in a dark hoodie, right,
Speaker 2: trying to crack code. And it's not that cybersecurity. There
Speaker 2: are three main tenants of cybersecurity that we call the
Speaker 2: CIA triad. Confidentiality, so information in your ecosystem is being
Speaker 2: maintained in a confidential manner. Integrity that the information in
Speaker 2: your systems can be relied upon. This is extremely important
Speaker 2: for public retreated companies, especially when you get into things
Speaker 2: like Starbine z Oxley, compliance and availability that your systems
Speaker 2: are available when you need them to be right. And
Speaker 2: then we layer on this wrapper of privacy, which historically
Speaker 2: legally has been defined as the right to be left alone. Right,
Speaker 2: But for companies that means you know, when, how and
Speaker 2: to what extent can you use the information that you've
Speaker 2: collected about your customer, about your population, about your consumers.
Speaker 2: So you know, love, I always love to lay that
Speaker 2: out because it really helps contextualize when it means, when
Speaker 2: it means bringing this into your business, How does this
Speaker 2: actually impact the decisions that you might be making about
Speaker 2: a new business line, a growth of business line, an
Speaker 2: investment in the technology, an investment in a membership rewards program, right,
Speaker 2: putting an app out there to let folks, you know,
Speaker 2: order ahead, So it makes an impact.
Speaker 1: Cool, and so you know, there's there's a few different
Speaker 1: types of cyber attacks. You know, I guess if you
Speaker 1: could talk about them a little bit and maybe what
Speaker 1: what customers should be particularly worried about right now. You know,
Speaker 1: I think I've read something recently about ransomware attacks being
Speaker 1: up over one hundred percent year over year, uh, and
Speaker 1: things of that nature. So I guess maybe the the
Speaker 1: you know, biggest issues are may depend on the size
Speaker 1: of the company, But if you can kind of give
Speaker 1: us some color on that would be.
Speaker 2: So. So ransom I would definitely say ransomware is what
Speaker 2: we're seeing get the most, the most news coverage, if
Speaker 2: you will. Right, So, ransomware in simplest terms, is your
Speaker 2: systems have become unavailable a threat actor. Right. It can
Speaker 2: be somebody who is out there for monetary you know,
Speaker 2: monetary gains. They just want to access your system to
Speaker 2: be able to get paid. That that that that ransom, Right.
Speaker 2: It could be political, right, It could be a activist
Speaker 2: that is not in agreement with something that you've said
Speaker 2: or put out there in the marketplace, which we see
Speaker 2: impacting right our our industry today. So somebody comes in
Speaker 2: takes over all of your systems, a system, a critical
Speaker 2: financial system. The point of access into your environment and
Speaker 2: doesn't let you doesn't let you back in until you've
Speaker 2: agreed to pay a fine, right, or a fee or
Speaker 2: some sort of cost value. The other thing we're seeing
Speaker 2: a lot, interestingly enough, is the theft of intellectual property. Right.
Speaker 2: So we live in a very fluid marketplace. Intellectual property
Speaker 2: theft doesn't really get that much airtime, but it is.
Speaker 2: It is especially especially important. I I worked with a
Speaker 2: company a few years back, and this was a transaction.
Speaker 2: So you know, we said, okay, what's your what's your
Speaker 2: crown jewel? Right, what are you the most afraid of
Speaker 2: would get exposed? And they're like, there's only one there's
Speaker 2: only one thing that we're worried about. I said, okay,
Speaker 2: what is it? And they go our recipes? Like, if
Speaker 2: our recipes walked out the door, we're out of business.
Speaker 2: There's absolutely no reason for us to continue getting up
Speaker 2: in the morning. Right. So, where we normally think of hey,
Speaker 2: hackers coming in, our threat threat actors coming in, they're
Speaker 2: taking over our financial systems, they're taking over our employee data,
Speaker 2: they're changing numbers in our finance system. So we're actually
Speaker 2: paying them when we think we're paying a vendor or
Speaker 2: our employee, right, this company was like, hey, if this
Speaker 2: recipe gets out the door, we're done.
Speaker 3: Yeah.
Speaker 1: It's literally their secret sauce.
Speaker 2: Literally, and you know, like I'm a native New Yorker,
Speaker 2: we're very, very you know, proud of our pizza industry. Right,
Speaker 2: generally speaking, can you imagine if your favorite pizza place
Speaker 2: all of a sudden had like a new dough recipe,
Speaker 2: new sauce recipe, like the whole nine yards, Like, I'm
Speaker 2: not going back there, yeah, right, And you can say
Speaker 2: the same thing up uphill right for larger industries, right,
Speaker 2: if you're gonna change something and all of a sudden
Speaker 2: you're like, hey, that's what we made money off of.
Speaker 1: First thing that came to my mind was the Kernel
Speaker 1: secret recipe. It's worth a lot, man, it's worth a lot.
Speaker 1: Oh yeah. So, in addition to restaurant companies, what other
Speaker 1: types of clients are seeking your help? Other industries, other
Speaker 1: verticals who seeking your help?
Speaker 2: Yep. So so where our team very proudly is industry agnostic.
Speaker 2: What I focus on day and day out is what
Speaker 2: I'll call the hospitality adjacent companies. Right, are manufacturing firms
Speaker 2: that are coming in and maybe you know producing producing
Speaker 2: items our consumer retail company. Real estate. Everybody always forgets
Speaker 2: that that real estate is a bigger market than just
Speaker 2: the you know, the industrial real estate side of things.
Speaker 2: A lot of noise being made, especially in states like
Speaker 2: Illinois on biometrics, Right, what does that mean for the
Speaker 2: smart building space? What does that mean for real estate
Speaker 2: companies that are putting technology in to help them manage
Speaker 2: from afar technology companies a lot of noise today.
Speaker 3: Right.
Speaker 2: We saw Apple and the Google play Store start putting
Speaker 2: controls in place around what kind of applications security posture, hygiene,
Speaker 2: privacy posture and hygiene could be put out there. And
Speaker 2: then of course, you know, we can't ever forget that
Speaker 2: the financial services industry spend a good amount of time
Speaker 2: they're doing cyber privacy diligence in support of transactions. Right,
Speaker 2: So what is a potential company's potential acquisition look like
Speaker 2: from a cyber security lens? Right? What kind of risk
Speaker 2: is present in their environment? What does that look like
Speaker 2: for uh, the the you know, let's call it private
Speaker 2: equity company that that's that's going out and buying them, right,
Speaker 2: that the risk comes with it? How does that impact
Speaker 2: the reps and warranties insurance. How does that impact money
Speaker 2: that that may be set aside an escrow uh to
Speaker 2: cover potential potential liability obligations. Uh. You know, especially in
Speaker 2: consumer and hospitality, they're very they're very people centric industries. Right.
Speaker 2: Nobody wants to be the company that bought the other
Speaker 2: company and all sudden to find out that, hey, there
Speaker 2: was a breach of a million records of personal information
Speaker 2: and we're doing business in California and all of a sudden,
Speaker 2: you're you're running a foul of the AG's office in
Speaker 2: California with CCPA and cpr A. Right, there's a lot,
Speaker 2: there's a lot of contentious conversations that are happening of
Speaker 2: what is the obligation of covering that risk in the transaction?
Speaker 1: Okay?
Speaker 2: Cool?
Speaker 1: And so you know, are you seeing you know in
Speaker 1: the research that consumers are significantly changing their behavior following
Speaker 1: cyber attacks And I guess, hows how's that changed over
Speaker 1: the last decade or so?
Speaker 2: Yeah? Really, really good question. So the greatest shift that
Speaker 2: we've seen is in upfront conscientiousness by the consumer. Who
Speaker 2: am I getting into business with? You know? What are
Speaker 2: they doing with my information? Is this brand doing right
Speaker 2: by me as a consumer. A lot of we all
Speaker 2: remember the days of the Target breach, right, and most
Speaker 2: forget that Target was breached because of their HVAC system. Right.
Speaker 2: It wasn't that Target went out and willingly did something
Speaker 2: that was running a foul of their of their customers.
Speaker 2: A big Target fan here, This is not this is
Speaker 2: not a knock on Target, right, this is the reality
Speaker 2: of the world that we live in. And you know
Speaker 2: the response was okay, well, Target was required right to
Speaker 2: go out and get credit monitoring service for their customers.
Speaker 2: Most people still think that it was Target's goodwill. But
Speaker 2: they went out, I got credit service monitoring for their customers.
Speaker 2: That's not the case. They were required to do it, right.
Speaker 2: But today we very much still see this conscientiousness by
Speaker 2: consumers to say, you know what, I'm not going to
Speaker 2: opt in. I'm not going to download an app that
Speaker 2: is knowingly using my information. We're seeing a lot of
Speaker 2: it now, right with the way that there's this conscientiousness
Speaker 2: of how is big tech using our information? How are
Speaker 2: they monetizing my information for their own their own purposes.
Speaker 2: In a post ro v wead world, right, there was
Speaker 2: a lot of a lot of light that was suddenly
Speaker 2: shown on well, there are all these these apps that
Speaker 2: help women, and what are their practices around cybersecurity? How
Speaker 2: might my information be compromised there? So there's certainly this upfront,
Speaker 2: you know, conscientiousness, and on the flip side, right, there's
Speaker 2: a lot of brain reputation that that is impacted when
Speaker 2: the own no moment happens, not if the owned no
Speaker 2: moment happens, but truly when, right, what did the brand
Speaker 2: do to protect my information? What was their social contract
Speaker 2: that they had with me? What information did they give
Speaker 2: me in their privacy policy, their terms and conditions upfront
Speaker 2: about how that information they were collecting about me it
Speaker 2: was going to be protected. So we are seeing a
Speaker 2: little bit of a shift. We're seeing a lot more
Speaker 2: noise come out when a brand is impacted. And the
Speaker 2: reality is in the marketplace is that we're no longer
Speaker 2: living in a marketplace where there's only one makeup store,
Speaker 2: or there's only one retail shop, or there's only one
Speaker 2: shoe store that you that you can shop in. Right,
Speaker 2: so brands have to take that proactive stance of saying
Speaker 2: we are in custodians of this information. We have built
Speaker 2: this reputation in the market with our customers. We have
Speaker 2: to do right by protecting this information, using it with fairness,
Speaker 2: using it with transparency, because the reality is that if
Speaker 2: our clients want it to walk away, it's going to
Speaker 2: be that much harder for us to reacquire that client.
Speaker 1: Yeah, more costly as well. Yeah for sure. Yeah, it's
Speaker 1: really really interesting. You know, I think there's definitely been
Speaker 1: more attention paid to it.
Speaker 2: Right.
Speaker 1: You have have people in the media, you know, looking
Speaker 1: at you know, TikTok terms of service and things of
Speaker 1: that nature, right, And so I think I don't know
Speaker 1: if it's hurt their user base at all, but you know,
Speaker 1: you have people definitely more cognizant of what's being cappedured, right,
Speaker 1: and what's being used and how it's being used. So
Speaker 1: I think that's a good thing. And when anytime, consumers
Speaker 1: are willing to educate themselves, right, So, what are the
Speaker 1: main vulnerability points both at the restaurant level and at
Speaker 1: the corporate level.
Speaker 2: Tough question, and I hate to sound like a consultant here,
Speaker 2: but I'm going to give the first consultant answer, which
Speaker 2: is it depends. It depends what the ecosystem looks like.
Speaker 2: I'll say that, you know, even up to like four
Speaker 2: or five, six years ago, when we had these types
Speaker 2: of conversations with brands, it was like, oh, well, I'm
Speaker 2: PCI compliant, my credit card data is safe, and you're like, okay,
Speaker 2: that's fine, and I am so happy that you got
Speaker 2: through the PCI questionnaire, which is like totally counterintuitive. Let's say,
Speaker 2: but now we're beyond credit card information, right, and I
Speaker 2: think that what the what the questions are now that
Speaker 2: these companies should be asking themselves, especially in a post
Speaker 2: COVID world, is what does your technology landscape look like? Right?
Speaker 2: Are you using cloud based platforms to support your orders
Speaker 2: your fulfillment? What does that look like? How are you
Speaker 2: how are your restaurant locations or how you know, how
Speaker 2: are your store locations interconnect one another? What does that
Speaker 2: that mesh of network look like? How are you granting
Speaker 2: access to your systems? How is your customer interacting? Right?
Speaker 2: Are they coming in making a purchase and that purchase
Speaker 2: is being shipped? Are they coming in making a purchase,
Speaker 2: the purchase is going out the door with them? Are
Speaker 2: they ordering ahead for pickup? Right? So this this you know,
Speaker 2: night what we'll call ninety percent reliance on technology has
Speaker 2: really changed the game of where you need to look
Speaker 2: for the technology related risks. Your apps? Right, who's developing them?
Speaker 2: Are they developing them in a secure manner? Are they
Speaker 2: are they being updated? How is information that you're collecting
Speaker 2: about your consumer being protected and used right through that app?
Speaker 2: Again above and beyond just credit card information? Right? How
Speaker 2: are you granting maintaining access to your point of sale systems?
Speaker 2: What kind of point of sale systems are you using?
Speaker 2: Are you are you pushing the you know, are you
Speaker 2: pushing onus onto your vendors to make sure that they're
Speaker 2: behaving and coding and developing their own software in a
Speaker 2: secure manner? Right? How is it information going from store
Speaker 2: location back to HQ? Right? What is your what is
Speaker 2: your cyber hygiene, privacy hygiene and posture look like at headquarters? Right?
Speaker 2: And that is logically right? How are folks get how
Speaker 2: are folks interacting with your systems? How are they getting
Speaker 2: into your buildings technologically? Right? What controls do you have
Speaker 2: in place around your technology systems? Again? How are you
Speaker 2: working in partnership with your vendors to make sure that
Speaker 2: that if you're if you're using a cloud based system
Speaker 2: and you're like, oh, yeah, you know so and so
Speaker 2: companies responsible for security because they're providing me this platform.
Speaker 2: Guess what, buddy, read the fine print because that risk
Speaker 2: transfer that you think that you're making is not really there. Right.
Speaker 2: There are obligations that you've got on your side to
Speaker 2: make sure that you've got appropriate controls in place. How
Speaker 2: are those systems interacting with one another? Right? What does
Speaker 2: that interface look like between your systems? How are you
Speaker 2: educating your people and your users to maintain a sense
Speaker 2: of cybersecurity hygiene? Right? You know one of the latest
Speaker 2: statistics out there is sixty five percent of cybersecurity incidents
Speaker 2: start with your people. Somebody click the link that they
Speaker 2: shouldn't have, right, and we're we're a click happy bunch humans. Right,
Speaker 2: So are you educating your people on hey, don't click
Speaker 2: the link. If your finance team is getting requests for wires,
Speaker 2: are they calling the person to confirm that it's a
Speaker 2: legitimate request? The account number has not been has not
Speaker 2: been compromised in an email transit? Are you? Are you
Speaker 2: doing technical testing of your boundaries? Right? Are you having
Speaker 2: an objective third party come in and look at at
Speaker 2: all of this And I think the other piece that
Speaker 2: really really gets lost in all of this is are
Speaker 2: you empowering your information security and your privacy teams to
Speaker 2: do what they need to do? Are you giving them,
Speaker 2: you know, the monetary support. Are you giving them the
Speaker 2: right human capital to be able to do this? Are
Speaker 2: you giving them a seat in the conversation to say, hey,
Speaker 2: here's where we are today, Here's where we need to
Speaker 2: be in the future to meet all the obligations that
Speaker 2: we're putting out there. Right. Are you educating your board again?
Speaker 2: You know, the SEC has proposed proposed rules out there
Speaker 2: for publicly traded companies that you know, in the future,
Speaker 2: should these rules pass, you're going to have to have
Speaker 2: board educated members, right, really be aware of what what
Speaker 2: does cybersecurity mean? Right? And and you've got to be
Speaker 2: able to train your board on what cybersecurity risk look
Speaker 2: like for the company. So I think where we talk about,
Speaker 2: you know, what is the vulnerability to a brand? What
Speaker 2: you know, you've also got to really weigh what the
Speaker 2: impact is going to be. Right. You could have let's
Speaker 2: say a single location Wi Fi go down, it sticks, right,
Speaker 2: It could be malicious intent behind that, it could just
Speaker 2: be the fact that it's Wi Fi and it's not
Speaker 2: always going to be friendly, right, But what if your
Speaker 2: critical application goes down? What if your CRM goes down?
Speaker 2: What if your order payment system goes down? Right? And
Speaker 2: it is a threat actor? You know, what does it
Speaker 2: mean for your business to be out of you know,
Speaker 2: out of technology service for four hours, for eight hours,
Speaker 2: for three weeks? How many dollars are not coming in
Speaker 2: the door because of that? Right? So you've really got
Speaker 2: to understand what are your crown jewel systems, What technology
Speaker 2: do you need to keep safe? And what what investment
Speaker 2: are you willing to make as a company to make
Speaker 2: sure they stay safe.
Speaker 1: Yeah, that's great. And you know what I found when
Speaker 1: I was doing a little bit of legwork before we
Speaker 1: spoke that was interesting was like how much they spoke
Speaker 1: about employees and protecting employee data, right, because I've just
Speaker 1: been thinking about you thinking about it at the consumer level, right,
Speaker 1: and the credit card data and the loyalty data and
Speaker 1: all that kind of stuff, But obviously securing employee data
Speaker 1: is important too.
Speaker 2: Right. So without naming names of brands, because I feel
Speaker 2: for the brands, irrelevant of size of these companies, I
Speaker 2: feel for the brands that are dealing with this. The
Speaker 2: state of Illinois gifted us some new laws around bio
Speaker 2: biometric information. Right, So I think you're spot on. When
Speaker 2: companies think about data, we're always thinking about consumer We
Speaker 2: really also need to include employees in that. And the
Speaker 2: reason I bring it up is because it is not unmanageable.
Speaker 2: Again speaking in broad strokes here, I don't want to
Speaker 2: throw any any companies under the US on this. Right.
Speaker 2: When we think about employees, I'll give you this scenario.
Speaker 2: An employee walks in the door. You're using, you know,
Speaker 2: upper right quadrant technology for your employee timekeeping systems, and
Speaker 2: your employee comes in, they scan their thumbprint, they've clocked in,
Speaker 2: they work the shift, scan back out, end of day. Right,
Speaker 2: How are you protecting that information? Are you? Did you
Speaker 2: give disclosure to your employees that you're going to be
Speaker 2: using your biometric information to do this? How are you
Speaker 2: maintaining the security of that information that you're collecting. How
Speaker 2: are you maintaining information that your employee and their health
Speaker 2: care status? Right, especially if in the restaurant industry world, right,
Speaker 2: if there's a health matter that's being investigated related to
Speaker 2: an employee. So there are all these laws that are
Speaker 2: very specific to employee data. I am not into I
Speaker 2: don't want to ever be a labor attorney. I give that,
Speaker 2: I give that that group of specialists great great respect. Right,
Speaker 2: but what are you doing? And do you understand the
Speaker 2: complex environment that you that you're operating in about that information? Right?
Speaker 2: You know, Illinois, California. You know there are states that
Speaker 2: are really making it easy for businesses to operate, and
Speaker 2: there are states that make it a little bit tougher.
Speaker 2: And you've got to really do the work to understand
Speaker 2: what are our obligations And a lot of it really
Speaker 2: comes down to how are you informing your employees about this? Right?
Speaker 2: What does that look like to inform you employees? Here's
Speaker 2: the information we've re collected about you. Here's how that
Speaker 2: information is being used, Here's where that information is stored,
Speaker 2: Here's how it might be shared. Because it's not just
Speaker 2: you know, the yester year of Oh, we're collecting employee
Speaker 2: information so we can send it to our our you know,
Speaker 2: the company that does our health insurance. Right now, all
Speaker 2: of a sudden, you're saying, Okay, we're collecting really sensitive
Speaker 2: information about an employee, and maybe we're using AI to decide, Hey,
Speaker 2: this person works this shift and that person works that
Speaker 2: shift because of X y Z capability. But there are
Speaker 2: inherent biases to a lot of this that I think
Speaker 2: that our industry, well the technology industry least, is still
Speaker 2: fleshing out. But I will say we're seeing a lot
Speaker 2: creeping up, especially in Illinois. What does it mean to
Speaker 2: use employee information appropriately even if it's for legitimate business practice?
Speaker 2: And you know where can companies start getting in trouble?
Speaker 1: And you mentioned the employee data being upper right quadrant data.
Speaker 1: I'm not familiar with the quadrants. I can kind of
Speaker 1: maybe back into a guest there, but if you can
Speaker 1: kind of talk about the quadrants a little bit, talk
Speaker 1: about what the upper right quadrant means for you know,
Speaker 1: you know us layman.
Speaker 2: So oftentimes when I talk with businesses and we start
Speaker 2: having conversations of hey, we're finally out of COVID, right,
Speaker 2: We're finally back to a world where we can make
Speaker 2: technology investment. We're like, we're gonna go look at Gartner,
Speaker 2: We're gonna go look at Forrester, and we're gonna pick
Speaker 2: like the top leader, right. The leader of this is
Speaker 2: like the best tool or application that we can get
Speaker 2: in the space. And this is this you know, Gartner
Speaker 2: leading or Forrester wave leading technology is going to solve
Speaker 2: all of our problems. You know, I'll context I'll contextualize
Speaker 2: them saying Gartner and Forrester are great resources for information. Right,
Speaker 2: They're fantastic. I use them quite a bit. But you've
Speaker 2: got to then say, Okay, we're making this investment technology
Speaker 2: we're going with you know this this this hr information system, right,
Speaker 2: but what does that mean for your business? You're making
Speaker 2: this gigantic investment. These these tools, technologies, applications are not cheap, right,
Speaker 2: How are you then deploying that in your environment? A?
Speaker 2: What technology risk are you introducing to your environment by
Speaker 2: doing this? B? How are you setting appropriate controls of
Speaker 2: who's got access to what information is it? Is it?
Speaker 2: Com measure it with the job that they were doing? Right? See?
Speaker 2: How are you giving people appropriate disclosure about what information
Speaker 2: you're storing about them? Right? How are you integrating these
Speaker 2: systems with other technologies that are that are in your environment?
Speaker 2: And I think the big one, which is which is
Speaker 2: let's call it one of the largest emerging issues in
Speaker 2: cyber and privacy is what kind of onus are you
Speaker 2: taking on because of this third party? Right? You got
Speaker 2: you went out, you spent half a million bucks on
Speaker 2: a system that is, Oh, but it's great. It's SaaS
Speaker 2: solution and we don't need to have a server form
Speaker 2: anywhere supporting it. And this vendor is going to do
Speaker 2: all this maintenance and they're going to support it for
Speaker 2: us and we don't need to worry about like backing
Speaker 2: it up or disaster recovery or you know, UX and
Speaker 2: U I updates. It's fantastic. Right, But somewhere there's a
Speaker 2: paragraph in your contract that could say, hey, we reserve
Speaker 2: the right to use this data that you're uploading as
Speaker 2: we see fit. Right, what kind of exposure did you
Speaker 2: just introduce to your business because of this third party? Right? Alternatively,
Speaker 2: right on the extreme opposite side of the example, we'll
Speaker 2: get cases where the company is like, look, we just
Speaker 2: need something. I googled first to ad that came up.
Speaker 2: We went with them, and oh, by the way, we
Speaker 2: got like the first year free for I guess right,
Speaker 2: and it's great. Right, And then very similarly, like you know,
Speaker 2: you're like, okay, we'll review the contract for you from
Speaker 2: a cyber or privacy perspective, and the contracts two pages
Speaker 2: right and a full page of it says, by the way,
Speaker 2: you got this free year because you're giving us access
Speaker 2: to use your information turn around and sell it to
Speaker 2: another customer. And that's why you're not paying the ninety
Speaker 2: nine ninety nine a month in twelve equal installments, right.
Speaker 2: And what happens with those with those smaller mom and
Speaker 2: pop companies that are that are out there is they're
Speaker 2: not doing the due diligence to make sure that that tool,
Speaker 2: application technology right and naven what you will is secure.
Speaker 2: They're not helping you to shore up and mature your
Speaker 2: own cybersecurity hygiene because they're introducing right a mode into
Speaker 2: your environment where this is living. They are they may
Speaker 2: or may not be acting above board in terms of
Speaker 2: what the data sharing. The data sharing is behind, you know,
Speaker 2: behind the scenes, and all of a sudden, right this
Speaker 2: thing that you were like, oh this is great, we
Speaker 2: got out of paying ninety nine ninety nine a month, Well, hey,
Speaker 2: guess guess what you just took on from a risk perspective, right,
Speaker 2: So there's there's a lot of the lot of you know,
Speaker 2: obligation that companies have that doesn't always get seen of
Speaker 2: What does there look like to manage proactively manage their
Speaker 2: their third party risk? Right, and especially in hospitality and
Speaker 2: especially in in in the food industry. Food companies should
Speaker 2: be doing food, They're not. They're not technology companies, right,
Speaker 2: So the likely, the high likelihood is there's a lot
Speaker 2: of these tools in their ecosystem, right and likely not
Speaker 2: getting looked at.
Speaker 1: Is there a way for them to negotiate, to negotiate
Speaker 1: out some of that that third party risk?
Speaker 3: When when yeah, absolutely absolutely, Again, I'm not not attorney,
Speaker 3: not legal advice, but consult your friendly neighborhood attorney in
Speaker 3: a space.
Speaker 2: The other thing that companies really should be considering is
Speaker 2: what does their data sharing agreement look like with these
Speaker 2: with these vendors, are they are you know, are companies
Speaker 2: setting out the appropriate rules of the road based on
Speaker 2: their business there, the jurisdictions where they're, where they're conducting business,
Speaker 2: their type of end consumer. Are they setting out the
Speaker 2: right rules of the road with these vendors saying here's
Speaker 2: how you may or may not use information, right, here's
Speaker 2: how you here's how you are obligated to help us
Speaker 2: in the case we have a need around this information,
Speaker 2: especially for the companies that are required to be GDPR compliant,
Speaker 2: especially for the companies that are required to comply with
Speaker 2: CCPA CPR, companies that are operating states with emerging or
Speaker 2: newly enacted privacy laws. This is going to become critically important.
Speaker 2: Understand what your data sharing landscape looks like, and the
Speaker 2: risk around third party is front and center and that conversation.
Speaker 2: Understand Yes, you as a company, you're collecting information, you're
Speaker 2: using it right for again fully legitimate business purpose, but
Speaker 2: then you're sharing it right and you may not think
Speaker 2: of sharing it in that way, but ultimately that that
Speaker 2: is what it looks like. Right, you are sharing information
Speaker 2: with your technology platform. What are the appropriate rules of
Speaker 2: the road for that platform to be able to use
Speaker 2: your data?
Speaker 1: Okay? Cool? And you know, can companies also ensure some
Speaker 1: of their risk against cyber attacks and third priority risk?
Speaker 2: I love that question. I spend a lot of my
Speaker 2: time talking about that question. So cyber insurance is incredibly expensive,
Speaker 2: it is harder and harder to get. There are more
Speaker 2: and more exclusions being put into policies. So yes, you
Speaker 2: can go out and you can get it. It is
Speaker 2: not a set it and forget it. Most cybersecurity insurance
Speaker 2: pols today are very descriptive of what capabilities a company
Speaker 2: has to have in place in order for the cyber
Speaker 2: insurance policy to be effective and cover a potential breach loss,
Speaker 2: whatever it is. So most of the time you speak
Speaker 2: to folks and they're like, no, I don't need to
Speaker 2: do anything. I have cyber insurance and it'll be great.
Speaker 2: And then the oh no moment happens because again nobody
Speaker 2: is immune from an oh no moment, and they go
Speaker 2: to their cyber and share and they're like, hey, I
Speaker 2: have to pay like two million dollars if ransom right
Speaker 2: to get my finances the back. The cybernture is like, no,
Speaker 2: I'm not covering that. It's like, what what do you mean? Like,
Speaker 2: we've been paying you a hundred thousand dollars right for this,
Speaker 2: and cybernture is like, well, you didn't have any proactive
Speaker 2: controls in place. You weren't doing your job in making
Speaker 2: sure that you're authenticating traffic that's crossing network. You weren't
Speaker 2: doing annual risk assessments to understand where you might have
Speaker 2: cybersecurity risk exposures. You weren't doing a good job at
Speaker 2: managing your third party risk. And even though you had
Speaker 2: a great CRM platform that you paid half a million
Speaker 2: dollars for right two years ago and you finally got
Speaker 2: the implementation, and that's where the vulnerability came from. You
Speaker 2: didn't do enough to proactively understand what your cyber risk
Speaker 2: landscape looks like internally and to mature your capabilities to
Speaker 2: mitigate those risks. So, yeah, cyber insurance is available out there,
Speaker 2: but there is a large obligation that's still put on
Speaker 2: companies to have that oh no, right file ready if
Speaker 2: you will. Hey, we've been doing every year, we've been doing,
Speaker 2: you know, an objective you know, cybersecurity risk assessment. We
Speaker 2: understand that we have areas that we can mature, but
Speaker 2: we've got these baseline competencies in place. We're making sure
Speaker 2: that folks are accessing our network in a secure manner.
Speaker 2: We're using multi doctor authentication for people coming in. We're
Speaker 2: doing proactive scanning of our network to detect any any
Speaker 2: potentially malicious activity. You know, We're doing annual penetration testing
Speaker 2: to make sure that that the walls around our castle
Speaker 2: are intact. We're educating our users with security awareness training.
Speaker 2: We're training our leadership to be able to identify spearfishing
Speaker 2: and you know, whale fishing. And if you have those
Speaker 2: in place, you're in a much better position to go
Speaker 2: to your insure and say, look, the own no woman happens.
Speaker 2: We need help, you know, we need hey, we ensure,
Speaker 2: we need your help being able to engage a an
Speaker 2: incident response team or a ransom you know, uh recovery
Speaker 2: team and somebody's got to go figure out how to
Speaker 2: buy bitcoin for me to pay this ransom. Right, But
Speaker 2: we did everything that we were supposed to do, and
Speaker 2: the own no, theman still happened. And in those cases,
Speaker 2: the insurers are looking. You know, it's a more favorable
Speaker 2: outcome for the most part. Now that's not written in stone.
Speaker 2: There are some insurers that are better than others. I
Speaker 2: will not name names here, right, but but that's really
Speaker 2: where we try to help folks understand. You could have
Speaker 2: a great cyber insurance policy. That doesn't mean that you're
Speaker 2: fully protected.
Speaker 1: Okay, cool, cool? Yeah, And I guess in terms of
Speaker 1: the insurers you you recommend, I guess we have to
Speaker 1: pay for that.
Speaker 2: You can we could we could have a one on
Speaker 2: one a lovely one on one chat on you know
Speaker 2: what that space looks like. But I'll refrain from publicizing
Speaker 2: too widely my my fearing.
Speaker 1: So what should a restaurant chain do if they suffer
Speaker 1: a cyber attack?
Speaker 2: Engage a good attorney. I say that tongue in cheek,
Speaker 2: but you know this is really where your service providers
Speaker 2: that you have relationships with come into play. So most
Speaker 2: of you know, very very you know openly your attorney
Speaker 2: is going to be critical in a lot of this.
Speaker 2: There's going to be a lot of conversations that happen
Speaker 2: of what do we know, what don't we know? And frankly,
Speaker 2: attorney client privilege is going to be very helpful right
Speaker 2: until you get your feet under you. Obviously, there are
Speaker 2: obligations in certain jurisdictions to let h you know, an
Speaker 2: Attorney General's office know if you're if the cyber event
Speaker 2: that happens is a data breach and there's a disclosure
Speaker 2: of uh personally that the fiable information right, there are
Speaker 2: obligations there. You know that is again, we're a really
Speaker 2: good attorney in the space in the room is going
Speaker 2: to help you through that process. Your cyber insure if
Speaker 2: you've got cyber insurance in place will be dramatically and
Speaker 2: drastically helpful in terms of getting boots on the ground
Speaker 2: to help you get you know, systems back to help
Speaker 2: you understand how how you know what is the breadth
Speaker 2: and depth of this cybersecurity incident to your environment? You know,
Speaker 2: if it's if it's an internal you know, insider threat,
Speaker 2: it's a you know, totally different game. You're getting departments
Speaker 2: like HR involved. But leading up to this, you know,
Speaker 2: the cyber incident, the point of cyber incident is not
Speaker 2: the time where you want to be figuring this out.
Speaker 2: You want to do a lot of this planning for
Speaker 2: the own no moment before it actually happens. So we
Speaker 2: always make the recommendations that on a regular basis, you
Speaker 2: should be simulating, right, even if it's a table top event,
Speaker 2: you should be simulating these discussions. Sit folks in a
Speaker 2: room and that includes your CEO, that includes your investor relations,
Speaker 2: that includes your your legal team, that includes you know it,
Speaker 2: if your insurer is proactive, your you know, your cyber
Speaker 2: and ensure and talk through, Hey, here's a scenario, how
Speaker 2: are we going to respond to this? How are we
Speaker 2: going to get to the other side of this moment,
Speaker 2: because there is light at the end of the tunnel.
Speaker 2: At the end of the tunnel, a cyber event is
Speaker 2: not the end of your company. Right, So you know,
Speaker 2: if you feel that there's capabilities in house to lead
Speaker 2: that in house, do it partner with a third party. Right,
Speaker 2: and shameless plug for our team here, Right, We do
Speaker 2: these regularly. Right, We're sitting down with with with the board,
Speaker 2: We're sitting down with the incident response teams to say,
Speaker 2: how are you actually going to respond to this? What
Speaker 2: does this mean to be able to go out to
Speaker 2: the market and say, yes, we brand ABC that is
Speaker 2: a publicly traded company in this many states. Here's what
Speaker 2: happened to us, Here's what we're doing to respond to it.
Speaker 2: Here's how to you as a consumer. This may impact
Speaker 2: you if there is a data breach. Here's how your
Speaker 2: information what types into and how your information might have
Speaker 2: been exposed. But look at your partner landscape to help
Speaker 2: support that that response. It should not happen in a silo,
Speaker 2: and it certainly should not be you know, that cyber
Speaker 2: event or you know, the privacy beach event should not
Speaker 2: be the point where you're figuring it out.
Speaker 1: Yeah, by then it's too late.
Speaker 3: Right.
Speaker 1: Oh yeah, all right, So how is cybersecurity impacting loyalty programs?
Speaker 1: And do you think privacy and data concerns are going
Speaker 1: to slow down the shift to one to one marketing?
Speaker 2: Yes? So here's here's kind of the you know what
Speaker 2: we talk about when it comes to loyalty programs. Loyalty
Speaker 2: programs are great. I and myself will say that I
Speaker 2: love my loyalty programs. I love getting to know that
Speaker 2: my tenth pizza is free. And I'm not going to
Speaker 2: name the brand, but we all know, right, I love
Speaker 2: my tenth pizzas free. Right. But the reality is, to
Speaker 2: sign up for a loyalty program, you're giving them a
Speaker 2: lot of information about yourself. So let's first talk about
Speaker 2: from a consumer perspective, right way, whether or not the
Speaker 2: loyalty programs really worth it. Right if this is an
Speaker 2: ongoing brand that you have an ongoing relationship with, Yeah,
Speaker 2: maybe you want to say, okay, look if I you know,
Speaker 2: if I give my information, I get my tenth pizza free,
Speaker 2: I get twenty percent off my my my purchase of
Speaker 2: you know, linens and whatever. All right, totally at it.
Speaker 2: Let's say this is a brand that it's a one
Speaker 2: and done. You're on the road, you're grabbing a soda,
Speaker 2: you're grabbing a coffee somewhere to rest stop. Right, what
Speaker 2: does it look like for you to actually give that information? Right?
Speaker 2: Is there an ROI for you for doing that? So
Speaker 2: I don't wanna I don't want to ignore the fact
Speaker 2: that a consumer plays a really big role in this
Speaker 2: relationship right on the marketing front. Now, let's go to
Speaker 2: the company side of this. Right, So companies are looking
Speaker 2: to say, Okay, we want to understand better who our
Speaker 2: consumer is. We want to figure out you know, we're
Speaker 2: we're piloting products, let's see who buys my membership perspective,
Speaker 2: We're using this to maintain customer loyalty, right, to increase
Speaker 2: customer lifetime value for us. You know, gone other days
Speaker 2: where we can just put cookies and pixels on our websites,
Speaker 2: right and have at it. Because again, thanks thanks right
Speaker 2: to the powers that be for disallowing us to do that. Right.
Speaker 2: But you're collecting as a company, massive amounts of information
Speaker 2: about people that they may or may not understand the
Speaker 2: impact of. Right, So how are you going to collect
Speaker 2: information about your user base? How are you going to
Speaker 2: aggregate that information? How are you then going and buying
Speaker 2: let's say consumer sentiment information to layer on top of this, right?
Speaker 2: How are you potentially using deal location data as an
Speaker 2: additional layer here? Right? And what does that mean now
Speaker 2: to that massive data set and aggregate instead of just hey,
Speaker 2: you know Debra Nica who lives in xity and meets
Speaker 2: the demographic measurement, right now you're like, hey, Debra is
Speaker 2: more likely to buy you know, shoes A versus shoes B,
Speaker 2: and she's going to she's more likely to go to
Speaker 2: store one versus store two. Right, So, now that data
Speaker 2: set has become a lot larger and a lot more
Speaker 2: risky for your company if a cyber event topic. Right, So,
Speaker 2: I think a lot of what the what the loyalty
Speaker 2: program you know, is showing us is yes you can
Speaker 2: do it, Yes you can do it in a smart way.
Speaker 2: But you've got to be really really measured of what
Speaker 2: is it that you're trying to push out there to
Speaker 2: your customer and how much risk and you know, are
Speaker 2: you taking on and is that ROI is still going
Speaker 2: to be worth it at the end? I still am
Speaker 2: I'm going to age myself for a second, But I
Speaker 2: remember the really really early days of like the shop
Speaker 2: right card and key card beef. Anybody they'll put on
Speaker 2: the little key card right, and it was like, well,
Speaker 2: like you want to the point you have to like
Speaker 2: go into the store right to swipe your card, and
Speaker 2: that is not the shopping experience reality. Right, I'm biased.
Speaker 2: I'm in New York, right, and I'm not. There's there's
Speaker 2: no shop right where I live. I missed my little
Speaker 2: membership card, right. But now, what does it look like
Speaker 2: for me to have a loyalty program for a supermarket
Speaker 2: that I am going to right, or an online grocery
Speaker 2: service that is kind of my way? So I think
Speaker 2: that there's a great from business perspective, there's a great
Speaker 2: utility for the loyalty program. It's also going to impact
Speaker 2: the breadth of your security, right. So so we look
Speaker 2: at this from the lens of you as a company,
Speaker 2: have certain information assets that you're going to use to
Speaker 2: drive value for your company. You're gonna support revenue, You're
Speaker 2: gonna put the loyalty program out there the own no
Speaker 2: moment happens or the own no moment is about to happen. Right,
Speaker 2: you have one hundred million pieces of data in your ecosystem, right,
Speaker 2: every every one of those, every piece of that of information,
Speaker 2: there is an exposure point for you. So let's say
Speaker 2: the own moment happens. We have fifty states in our
Speaker 2: in our country, every single state has its own data
Speaker 2: breach law, right, none of which are the state you're crazy, right,
Speaker 2: we have great precedent here for why privacy laws are
Speaker 2: day by state, right, because we couldn't get it right
Speaker 2: with data breach, so why should we get it right
Speaker 2: with privacy right. So there are thresholds of in each state,
Speaker 2: because a threshold that says, you know, all it takes
Speaker 2: is one person's record to be breached and that is
Speaker 2: going to trigger you to have to inform your attorney
Speaker 2: general's office, and it's going to trigger some sort of
Speaker 2: requirement for you to respond to this bridge. Other states
Speaker 2: are like, nope, it's got to be over you know,
Speaker 2: five ten thousand whatever it is records for it to
Speaker 2: actually trigger a response for you to need to do something. Now,
Speaker 2: let's say you have a loyalty program and you've got
Speaker 2: you know, you've got this hundred million data points, right,
Speaker 2: and you've got all these records about people. What does
Speaker 2: it mean in that Oh no, woman, how much of
Speaker 2: that information is actually a value additive information that you
Speaker 2: are utilizing to support business? And how much of that
Speaker 2: is information that you were collecting because you could, because
Speaker 2: you could take on that information? And what does that
Speaker 2: mean in protecting it? Right? Are there appropriate controls around it?
Speaker 2: Is there a locks on the treasure box of this
Speaker 2: treasure trove of information? Right? Or it's information that ultimately
Speaker 2: exposed you to requirements and to cost of responding to
Speaker 2: a breach and you know, cost of responding to the
Speaker 2: impact of you know, brand erosion in that own a moment.
Speaker 1: That's great, thanks and you have time for one more.
Speaker 2: I have time for one more?
Speaker 1: All right, good stuff. So last question, are ESG investors
Speaker 1: placing a focus on cybersecurity? Are they focusing enough on cybersecurity?
Speaker 1: I'd imagine this is probably a big part of the
Speaker 1: governance piece of ESG.
Speaker 2: Oh yeah, So we're seeing a lot a lot of
Speaker 2: conversations happening from an ESG lens on this. So cybersecurity
Speaker 2: is certainly from a governance lens, and then privacy from
Speaker 2: a social lens. Right. So I'll say that that for
Speaker 2: the most part art right, unless a fund is purely
Speaker 2: an es G play. Right. There are still i would say,
Speaker 2: conversations that are emerging in this space, right, But there's
Speaker 2: a lens that says we have to report out, we
Speaker 2: are required to report at out on our ESG activities,
Speaker 2: and we're going to use cybersecurity or privacy as a
Speaker 2: means to quantify ESG for us. So what we see
Speaker 2: a lot of the time is there's this focus on
Speaker 2: what does cybersecurity mean and how can cybersecurity hygiene be
Speaker 2: used to inform that governance metric? And from a privacy perspective,
Speaker 2: how are companies you know, how are are let's say
Speaker 2: called up a port code right in this example? How
Speaker 2: is a portfolio company maintaining the privacy standards of you know,
Speaker 2: of their their consumer base, of their of their data
Speaker 2: in order to really understand this social social contract aspect
Speaker 2: with their customers. So I think that there's a there's
Speaker 2: a really I this is personal opinion, right, I think
Speaker 2: that that we're going to see an increase in a
Speaker 2: in a lot of these types of conversations. I think
Speaker 2: that as we see more perforation of you know, e
Speaker 2: s G based funds, we're going to see a lot
Speaker 2: more traction in the conversation of you know, the seat
Speaker 2: at the table that that cyber and privacy you know
Speaker 2: have in that value edit creation.
Speaker 1: Very cool. Uh, that was awesome. I learned a lot.
Speaker 1: Is there is there a best way you know, in
Speaker 1: an email you'd like to share something like that, best
Speaker 1: way for our listeners to get in touch with you
Speaker 1: if if they have any questions.
Speaker 2: Yeah, absolutely so. Always happy to chat and geek out
Speaker 2: about this, Debra cofres dot com. Happy to to chat
Speaker 2: with you. Uh, I am going to say, feel free
Speaker 2: to Google because Google is still very much one of
Speaker 2: our best friends. Cohen Resnick Cybersecurity, tech risk and Privacy team,
Speaker 2: and we're always happy to have a chat, have a thought,
Speaker 2: you know, a moment of thinking and sharing and looking forward.
Speaker 1: Awesome. Well, thanks for doing us, Thanks to our listeners
Speaker 1: for listening it, and have a good day everybody,