Speaker 1: Welcome to the deep dive where we extract the crucial
Speaker 1: insights you need. Today we're tackling something maybe a bit overlooked,
Speaker 1: third party risk. Did you know over half of businesses
Speaker 1: don't even do basic third party risk management seriously, and
Speaker 1: even fewer have like a really solid cybersecurity program for
Speaker 1: their vendors. That number, it's genuinely alarming when you think
Speaker 1: about it.
Speaker 2: Really is. It's what we call third party cybersecurity risk,
Speaker 2: or sometimes you hear supply chain security. You're not talking
Speaker 2: about direct hits on your own network necessarily. Often it's
Speaker 2: these silent threats kind of sneaking in through partners you
Speaker 2: actually trust. It's a fundamental shift really in how we
Speaker 2: need to approach digital defense.
Speaker 1: Absolutely, so our mission today give you a shortcut help
Speaker 1: you understand this pretty complex landscape. We'll cut through the jargon,
Speaker 1: shine a light on those hidden dangers, and show you
Speaker 1: exactly why looking at your vendors security isn't just nice
Speaker 1: to have, it's absolutely essential. Get ready for some insights
Speaker 1: that might really change how you think about security. Ok
Speaker 1: rte in why have these third parties become while the
Speaker 1: new front line? This risk isn't exactly new is it,
Speaker 1: But the scale of neglect seems huge. I saw this
Speaker 1: twenty eighteen Ponemon study said only forty percent do any
Speaker 1: cybersecurity checks on vendors, and sixty percent either nothing or
Speaker 1: just random ad hoc stuff. That's basically leaving the back
Speaker 1: door unlocked, isn't it.
Speaker 2: That's a perfect way to put it. Yeah, And the
Speaker 2: result we see them in some really big headline grabbing breaches.
Speaker 2: Think about the Solar Winds attack twenty twenty. There wasn't
Speaker 2: a direct hit on you know, the thousands of places affected,
Speaker 2: including US government agencies. No, it was a state actor
Speaker 2: inserting malware, the Sunburst trojan into routine software updates for
Speaker 2: Solo Winds Orion product.
Speaker 1: The update everyone trusted exactly. Microsoft's president Brad Smith called
Speaker 1: it an act of recklessness, classic supply chain attack, exploiting trust.
Speaker 1: It showed incredible patients sophistication.
Speaker 2: And it's not always these, you know, super sophisticated state
Speaker 2: actors either. Sometimes the way in is much simpler, right,
Speaker 2: but the damage is just as bad. Like the Target breach,
Speaker 2: remember that twenty thirteen, twenty fourteen. They didn't hack target
Speaker 2: directly first. Nope, they stole credentials from an HVAC vendor
Speaker 2: fazzio mechanical. Such a small thing, seemingly.
Speaker 1: But it led to massive financial damage, huge reputational hit
Speaker 1: for target. It just shows how a little crack and
Speaker 1: a partner security can become a giant problem for you.
Speaker 2: Yeah, it really does, and.
Speaker 1: It highlights that attackers often take the path of least resistance.
Speaker 1: That's frequently through a third party who might not be
Speaker 1: as buttoned up, which brings us to a key point.
Speaker 1: A lot of existing security programs they're just about checking
Speaker 1: a box, meeting some regulation.
Speaker 2: Ah, the checkbox trap, So just going through the motions
Speaker 2: not actually reducing risk pretty much, it becomes an obligation,
Speaker 2: not an active defense strategy. True security, real security has
Speaker 2: to be active, ongoing. It's got to go beyond just compliance,
Speaker 2: you mean genuine threat hunting, looking not just inside but
Speaker 2: outside at your suppliers too. If you're only doing what
Speaker 2: regulators mandate, well you're probably gonna get hit faster than
Speaker 2: someone who sees regulations as just the starting line.
Speaker 1: That's a really powerful point. The starting line, not the
Speaker 1: finish line. So if we want to move beyond that
Speaker 1: checkbox mentality, who are we actually up against. What do
Speaker 1: these adversary these bad actors actually do well.
Speaker 2: At its heart, cybercrime is just using tech computers the
Speaker 2: Internet for illegal stuff. The who can vary a lot,
Speaker 2: though most common cyber criminals think electronic thieves, usually after money,
Speaker 2: like in the home depot breach back in twenty fourteen
Speaker 2: grabbing payment guard data.
Speaker 1: Right, the financial motive, But then there are the others.
Speaker 1: The nation state hackers apt's advance persistent threats, those some
Speaker 1: more serious they often are.
Speaker 2: These are state sponsored groups or sometimes really large organized
Speaker 2: cybercrime syndicates. They have serious resources patients. They aim for scalthy,
Speaker 2: large scale attacks, often political or economic goals driving them
Speaker 2: Solar winds prime example of what they can do. The
Speaker 2: big difference is usually their motivation and just how deep
Speaker 2: their pockets are.
Speaker 1: Okay, so these actors, sophisticated or not, are out there.
Speaker 1: How do they typically get in? What are the common
Speaker 1: doors they knock on?
Speaker 2: Fishing is still massive, huge, those deceptive emails trying to
Speaker 2: trick you or your vendors employees into giving up info
Speaker 2: or clicking a bad link. And what's really dangerous is spearfishing,
Speaker 2: super targeted emails aimed its specific people, often ones with
Speaker 2: high level access like system admins exactly, or whale fishing,
Speaker 2: which goes after the big fish. The c Suite CEOs
Speaker 2: Verizon's twenty nineteen report said something like thirty two percent
Speaker 2: of all data breaches started with fishing.
Speaker 1: Wow, nearly a third, and once they're potentially in or
Speaker 1: even just to cause chaos. We hear so much about ransomware.
Speaker 2: Oh yeah, ransomware locks up your data, encrypts it, then
Speaker 2: demands money to get it back. Remember want to Cry
Speaker 2: hit over two hundred and fifty thousand systems one hundred
Speaker 2: and fifty countries. The cost is staggering, expected to hit
Speaker 2: twenty billion dollars globally in twenty twenty one. And guess
Speaker 2: how it often gets delivered?
Speaker 1: I mean guess fishing emails?
Speaker 2: Got it often through those very same fishing emails. As
Speaker 2: a common tactic is a man in the middle attack
Speaker 2: or mid M. That's where an attacker basically ease drops
Speaker 2: on communication between two parties, steals data wallets in transit.
Speaker 2: Often happens over insecure Wi Fi.
Speaker 1: Okay, it sounds like a minefield, but is there a
Speaker 1: typical playbook? A general sequence? These attacks tend to follow.
Speaker 2: There usually is yeah understanding it helps. Most breaches kind
Speaker 2: of follow five general steps. First, research, reconnaissance attacker scope
Speaker 2: out the target. This can take months. Then intrusion. They
Speaker 2: get that first foothold inside the network, maybe via phishing,
Speaker 2: maybe an unattached vulnerability, a foot in the door. Exactly
Speaker 2: once they're in, it's lateral movement. They start moving around
Speaker 2: exploring a network, looking for valuable stuff, more systems to compromise.
Speaker 2: Next comes privileged escalation. They try to get more access rights,
Speaker 2: go from a regular user account to something powerful like
Speaker 2: a domain admin.
Speaker 1: To get the keys to the kingdom right.
Speaker 2: And finally, exfiltration. They steal the data they came for
Speaker 2: and then try to cover their tracks so you don't
Speaker 2: notice immediately. It's methodical.
Speaker 1: Target breach fits that perfectly. Research finds the HVAC vendor,
Speaker 1: Intrusion uses their credentials. Lateral movement finds the payment systems.
Speaker 1: Expiltration steals the card data step by step.
Speaker 2: A painful but textbook example.
Speaker 1: Okay, so we've seen the dangers, the actors, their methods.
Speaker 1: Let's switch gears. How do we build a strong defense?
Speaker 1: What are the absolute fundamentals we need to think about?
Speaker 1: Especially when evaluating third parties.
Speaker 2: It's interesting the core ideas haven't really changed. It always
Speaker 2: comes back to the CIA triad. Confidentiality, integrity, availability, not
Speaker 2: just jargon. These are the pillars for every security decision.
Speaker 2: When you look at a vendor, you have to ask confidentiality,
Speaker 2: are they storing our data securely? Integrity? Will they ensure
Speaker 2: our data stays accurate unaltered? Availability? Can they guarantee we
Speaker 2: can get to our data when we need it? Your
Speaker 2: vendor assessment should really hinge on these questions.
Speaker 1: That makes sense, and with everyone working remotely. Now I
Speaker 1: keep hearing this phrase, identity is the new perimeter. What
Speaker 1: does that act mean? In practice?
Speaker 2: It's a huge shift. The old model was like a
Speaker 2: castle wall protect the network edge, but now people can
Speaker 2: act from everywhere use cloud services. That old castle and
Speaker 2: mote thing doesn't quite cut it right.
Speaker 1: The perimeters blurred.
Speaker 2: Totally blurred. So now managing who is accessing what becomes
Speaker 2: the main security control identity. This makes multi factor authentication
Speaker 2: MFA absolutely critical, that extra layer beyond just a password
Speaker 2: and privileged Access Management PM. For those really powerful accounts,
Speaker 2: think about it. A domain admin account might sell for
Speaker 2: over three thousand dollars on the dark web, a regular
Speaker 2: user maybe fifteen.
Speaker 1: Dollars, a big difference.
Speaker 2: Huge. So MFA and PAM they're your best defense against
Speaker 2: stolen credentials getting misused because who is logging in is
Speaker 2: often more important now than where they're logging in from.
Speaker 1: Okay, so identity and access are key. What other basic
Speaker 1: control should we be looking for from our vendors?
Speaker 2: Patch management is absolutely vital keeping software and systems updated.
Speaker 2: It fixes the holes, the vulnerabilities that attack are constantly
Speaker 2: trying to exploit. It's like fixing leaks in your roof.
Speaker 1: Regularly basic maintenance, but critical critical.
Speaker 2: And things like an intrusion detection system IDs that monitors
Speaker 2: network traffic looking for weird behavior or known attack patterns.
Speaker 2: Think of it like a security camera with an alarm.
Speaker 2: It won't stop the attack itself, maybe, but it gives
Speaker 2: you that crucial early warning. Hey, something's wrong, right.
Speaker 1: The alarm bell? Now I hear this a lot. Oh
Speaker 1: we're fine. We have a firewall. Is that really enough?
Speaker 2: Oh? Absolutely not. Firewall is like the moat and the
Speaker 2: guard at the castle gate. Essential. Yes, stops unwanted traffic
Speaker 2: getting in, but once someone is inside, or if a
Speaker 2: threat comes in through email, which a basic firewall won't
Speaker 2: inspect deeply. It's not enough. That's why you talk about
Speaker 2: defense and depth. Multiple layers, independent layers. If one fails,
Speaker 2: hopefully another one catches it.
Speaker 1: Multiple layers make sense. So with all this complexity, how
Speaker 1: do organizations actually structure their approach? This sounds like where
Speaker 1: cybersecurity frameworks come into play.
Speaker 2: Exactly. Framework give you a roadmap, a structured way to
Speaker 2: manage and reduce risk. The NIST Cybersecurity Framework NIST CSF
Speaker 2: is a big one, especially in the US. Came out
Speaker 2: of a presidential order. It focuses on five core functions.
Speaker 2: Identify your risks, protect your assets, detect incidents, respond when
Speaker 2: they happen, and recover afterwards. It's built around the idea
Speaker 2: that breaches will happen, so you need to be prepared
Speaker 2: to handle them and bounce back quickly. It's a proactive approach.
Speaker 3: And they are international ones too, right yes, Like ISO
Speaker 3: two seven seven zero one two seven zero zero two
Speaker 3: ISO two seven zero zero one sets the standard for
Speaker 3: an information security management system and two to seven seven
Speaker 3: zero two provides the specific.
Speaker 2: Controls if a vendor adheres to one of these frameworks.
Speaker 2: It's a good sign of their security maturity. Plus it
Speaker 2: gives you a common language to talk about security with them,
Speaker 2: which is really valuable.
Speaker 1: Okay, let's really unpack this whole vendor life cycle thing.
Speaker 1: It's definitely not just a one off check, is it.
Speaker 2: It's more like a journey, absolutely a continuous journey, and
Speaker 2: it starts right at the beginning in the intake phase.
Speaker 2: This is your first impression and maybe the most critical point.
Speaker 2: You've got to ask the key questions here. What kind
Speaker 2: of datas are we sharing, how sensitive is it, how much,
Speaker 2: where's it going to live, country, risk, cloud, location, and
Speaker 2: crucially who are their vendors the fourth parties because their
Speaker 2: security impacts you too.
Speaker 1: And this is where you lay down the law right
Speaker 1: your non negotiables exactly.
Speaker 2: Your organization needs clear must have security requirements, things like
Speaker 2: data must be encrypted at rest and in transit or
Speaker 2: MFA is mandatory for any privileged access to our systems,
Speaker 2: no exceptions. And those SoC two type two reports you
Speaker 2: hear about, they're common for IT vendors. What's really important
Speaker 2: isn't just the report existing. It's a Type two means
Speaker 2: an auditor has verified that the controls describe not only exist,
Speaker 2: but actually worked effectively over a period of time. That
Speaker 2: turns it from a claim into real evidence.
Speaker 1: Okay, so they're onboarded. The report looks good. How do
Speaker 1: you make sure things stay good? How do you keep vigilant.
Speaker 2: That's ongoing due diligence. It's about staying engaged. Need a
Speaker 2: risk based approach. You can't scrutinize every vendor down to
Speaker 2: the last detail. It's not practical. So focus your efforts
Speaker 2: where the risk is highest. High risk vendors, they get
Speaker 2: the deep dives, the more frequent reviews.
Speaker 1: Makes sense. But what about those giants, the too big
Speaker 1: to care vendors, the ones you absolutely rely on that
Speaker 1: they just won't meet all your specific requirements.
Speaker 2: Yeah, that's a tough one. Sometimes, frankly, your only real
Speaker 2: option is risk transfer. You require them to have solid
Speaker 2: cyberliability insurance. You document the risk, you accept it, and
Speaker 2: you have the insurance as of backstop. Not ideal, but
Speaker 2: sometimes it's the reality.
Speaker 1: And what about the people vendor employees? Their training must
Speaker 1: be super important, especially with phishing being so prevalent.
Speaker 2: Oh, absolutely critical. A vendor needs strong security awareness and
Speaker 2: training for their staff, especially around phishing. We keep coming
Speaker 2: back to it because it works. Look at the ge
Speaker 2: breach in twenty twenty. It happened because Canon, a ge
Speaker 2: vendor had a leak through an employee email account. Compromise
Speaker 2: just a simple email ish you at a third party
Speaker 2: cause problems for gg Wow.
Speaker 1: Okay, so annual reviews are standard, but like you said,
Speaker 1: a lot can change in three hundred and sixty four days.
Speaker 1: How do you bridge that gap?
Speaker 2: That's the role of continuous monitoring CM. There are automated
Speaker 2: vendors security rating tools out there now. They can scan
Speaker 2: vendor networks externally, look for things like open ports, check
Speaker 2: if they're patching pomply, even find exposed credentials online. It
Speaker 2: gives you a near real time pulse check between those deeper.
Speaker 1: Assessments filling the gaps, and for the really critical vendors,
Speaker 1: you can probably go even deeper with monitoring.
Speaker 2: Yes, that's enhanced CM. For your most vital partners, you
Speaker 2: might monitor more specific things, more often software vulnerabilities. They
Speaker 2: might have fourth party connections, data location changes how they're
Speaker 2: connected to you, and you need a plan for when
Speaker 2: things go wrong. A third Party Incident Management TPIM playbook.
Speaker 2: What do you do when a vendor tells you they've
Speaker 2: been breached discovery, investigation, reporting, closing the loop. Uber learned
Speaker 2: this the hard way. They delayed reporting at twenty sixteen
Speaker 2: breach and face serious consequences. Prompt notification is key right now.
Speaker 1: The end of the line offboarding, the vendor relationship ends.
Speaker 1: This feels like something that could easily get forgotten.
Speaker 2: It often does, but it's so important. When a vendor leaves,
Speaker 2: you need absolute certainty that any data you shared with
Speaker 2: them is gone, you reversibly destroyed. That means proper data sanitization,
Speaker 2: not just hitting delete. Depending on the media, hard drives,
Speaker 2: flash drives, even paper, it means clearing, purging, or physical destruction.
Speaker 2: And you need proof, not just a piece of paper
Speaker 2: saying they did it. Get digital certificates of destruction CODs, verifiable.
Speaker 1: Proof like what happened with Morgan Stanley.
Speaker 2: Exactly find sixty million dollars in twenty twenty. Why they
Speaker 2: mess up decomisioning old equipment customer data was still on
Speaker 2: there just shows them ass of failure and oversight during offboarding.
Speaker 1: Okay, let's pivot slightly. Cloud security. Everyone's moving to the cloud.
Speaker 1: Is it inherently riskier for third parties or just different.
Speaker 2: I'd say mostly different. Cloud offers huge benefits obviously, but
Speaker 2: it does change the calculus for your vendors. The key
Speaker 2: is understanding the NYST service models. SAUCE software is the service,
Speaker 2: pays platform is infrastructure. They define who's responsible for what.
Speaker 2: With SAUCE, for example, the vendor manages almost everything, so
Speaker 2: their security practices for the underlying infrastructure are paramount. With IAS,
Speaker 2: the customer, your vendor in this case has more control
Speaker 2: but also more responsibility.
Speaker 1: So it all comes down to that shared responsibility model again,
Speaker 1: knowing where their job ends and yours begins or where
Speaker 1: your vendor's job.
Speaker 2: Ends precisely, and it can get tricky. The Capital One
Speaker 2: breach in twenty nineteen was a big wake up call.
Speaker 2: AWS provides the secure infrastructure, but they basically said Capital
Speaker 2: One misconfigured their own Web application Firewall waf FOUCH. Yeah.
Speaker 2: It shows that even with a secure cloud provider, how
Speaker 2: your vendor configures and uses the services as critical. You
Speaker 2: can use tools like the AWS Trusted Advisor Report TART
Speaker 2: or as your Advisor to help assess how well they're
Speaker 2: managing their cloud environment.
Speaker 1: Okay, let's talk legal shields contracts. How do you actually
Speaker 1: bake security into the legal agreement? Sounds like the lawyers
Speaker 1: need specific constructions from the security folks.
Speaker 2: They absolutely do. Contracts are a crucial tool for managing
Speaker 2: vendor risk, but only if the security requirements are clear
Speaker 2: and strong. Cybersecurity teams need to tell legal what's essential.
Speaker 2: What are the non negotiables? Things like you must encrypt
Speaker 2: our data, you must use MFA for privileged accounts connecting
Speaker 2: to us. We must have the right to audit or
Speaker 2: assess your controls.
Speaker 1: Get it in writing upfront and incident notification too.
Speaker 2: That seems vital critical. The contract has to spell out
Speaker 2: what counts as a brooch that needs reporting and demand
Speaker 2: prompt notification. You should aim for twenty four to forty
Speaker 2: eight hours, you can't wait weeks. And for offshore vendors
Speaker 2: you often meet extra clauses, things like requiring work only
Speaker 2: from a specific secure designated workspace or Offshore Development Center ODC,
Speaker 2: maybe mandating encrypted connections virtual desktops that can't access the
Speaker 2: general Internet or allow copy paste, plus rigorous background checks
Speaker 2: on their personnel handling your data.
Speaker 1: What about really old contracts? Can they become a liability
Speaker 1: if the threat landscape has changed.
Speaker 2: A huge liability. Look at the Heritage Valley Held versus
Speaker 2: Nuance case from twenty twenty. The core issue was dismissed,
Speaker 2: but the court specifically pointed out they were operating under
Speaker 2: a contract over ten years old, made with a company
Speaker 2: Nuance had bought ages ago. It just screams review and
Speaker 2: update your contracts regularly. Security threats evolve constantly. Your contracts
Speaker 2: need to keep pace. Old language might not protect you anymore.
Speaker 1: Right, last big area the actual software and connections, the
Speaker 1: real attack surface. Seems like buyer beware is the mantra
Speaker 1: for third party software.
Speaker 2: It really has to be. Third party software is a
Speaker 2: massive attack vector. We saw it with heart bleed and
Speaker 2: open SSL. We saw it with Solar Winds. You need
Speaker 2: to push vendors to have a documented secure software development
Speaker 2: life cycle as SDLC. Security needs to be built in
Speaker 2: from the requirement stage through design, coding, testing, deployment and maintenance.
Speaker 1: On at the end, and testing is key.
Speaker 2: There absolutely different kinds static analysis looking at the code
Speaker 2: itself for flaws before it runs. Dynamic analysis running the
Speaker 2: software and watching how it behaves, looking for vulnerabilities in action,
Speaker 2: and fuzz testing basically throwing garbage invalid inputs at the
Speaker 2: software to see if it breaks in unexpected, potentially exploitable ways.
Speaker 2: Get to stress test it.
Speaker 1: Good to know and understanding common flaws helps definitely.
Speaker 2: The OASPA Top ten is a great resource. It lists
Speaker 2: the most critical web applications security risks, things like broken authentication,
Speaker 2: security misconfigurations. Your vendor should know it and test against it.
Speaker 2: And don't forget open source software OSS. So many products
Speaker 2: rely on it. It's great, but needs careful vetting, heart
Speaker 2: lead hit open SSL a library used everywhere. Tools called
Speaker 2: software composition Analysis or SCA can help find and manage
Speaker 2: risks in the open source component's vendors use.
Speaker 1: Okay, last piece, how these third parties actually connect to
Speaker 1: your network? That seems like a direct line in If
Speaker 1: not managed right.
Speaker 2: It is and this is where the zero trust ZT
Speaker 2: model is so important. The core idea never trust, always verify,
Speaker 2: assume nothing is safe by default. Every user, every device,
Speaker 2: every application, especially vendor connections needs to be verified before
Speaker 2: getting access, and even then only give the minimum access needed.
Speaker 2: It drastically limits an attacker's ability to move laterally if
Speaker 2: a vendor connection is compromised. Never trust, always verify. Got it?
Speaker 2: What about all those connected things IoT devices, smart cameras, sensors.
Speaker 2: They seem like a potential nightmare. They can be. IoT
Speaker 2: is a huge, growing risk area. Often manufacturers rush them
Speaker 2: to market and security is an afterthought. Hard coded passwords,
Speaker 2: no way to update them, Basic stuff gets missed, creating
Speaker 2: easy targets. Exactly, so, your organization needs minimum standards for
Speaker 2: any IoT devices connecting to your network, even through vendors,
Speaker 2: no hard coded passwords allowed. Access must be configurable. Ideally
Speaker 2: they have a hardware Trusted Platform Module TPM for security,
Speaker 2: and critically, they must be patchable. Can update it, you
Speaker 2: can't secure it.
Speaker 1: Wow. Okay, we have covered a lot of ground from
Speaker 1: that shocking statistic about how few companies are even doing
Speaker 1: the basics all the way to the nitty gritty of
Speaker 1: secure software development and zero trust from Solar Winds to
Speaker 1: making sure data gets destroyed properly during off boarding. It's
Speaker 1: crystal clear that security isn't just contained within your own
Speaker 1: walls anymore. It's a shared responsibility.
Speaker 2: It really is. It's a complex web, but understanding the
Speaker 2: pieces like we've discussed is absolutely essential. The sources we
Speaker 2: drew on really paint a picture of high stakes. This
Speaker 2: isn't just about dodging fines. It's about keeping the whole
Speaker 2: enterprise running and safe.
Speaker 1: So here's something to chew on. Think about solar winds again.
Speaker 1: Those attackers, likely in apt, spent months, maybe longer, doing
Speaker 1: research planning just to plant malware on one specific server,
Speaker 1: a build server at a well known tech company. What
Speaker 1: does that level of patients, that sophistication tell us about
Speaker 1: the adversaries out there today? And maybe more importantly, what
Speaker 1: does it imply about your organization's ability to find something
Speaker 1: malicious that might have been hiding dormant inside a trusted
Speaker 1: third party system for who knows how long yours may be.
Speaker 1: That's the chilling question, isn't it. How deep does your
Speaker 1: visibility actually go? Are you equipped to find something that's
Speaker 1: deliberately trying to stay hidden, possibly for a very long time,
Speaker 1: within your extended ecosystem? Right? This really isn't just about
Speaker 1: compliance checkboxes or avoiding bad headlines. It's fundamental to protecting
Speaker 1: your entire organization. So the question to ask yourself ask
Speaker 1: your team is are we really doing enough? Are we
Speaker 1: moving beyond just compliance and truly partnering with our vendors
Speaker 1: treating this as an active, ongoing practice of hunting for
Speaker 1: threats together, because in this interconnected world, you're only as
Speaker 1: strong as your weakest link, and quite often that link
Speaker 1: isn't inside your own company, it's with a third party.
Speaker 1: Keep learning, keep asking the tough questions, and definitely stay curious.