Be the Champ, Not the Chump: Crisis Management that Actually Works

Alright. I can see that everybody's being quite shy and staying in the back of the room. You might be right because we have OLED monitors and my whole presentation is in black so the contrast is actually really good where you're standing. So maybe you should just stay there. So quickly about me, so I'm a VP at CAP, I'm the head of cyber for our division in France and I manage over 700 people. For the rest as you can see I've been doing consulting sort of forever since 2004. So this is my twenty second year I guess, yeah, going on twenty three years. Today, as we said, we're going to talk about a few things and I think I just skipped a slide so we might no, we're good. Alright. So we're going to talk about a few things and I thought the title, you'd appreciate the title, be the champ not the chump and there is only a one letter difference in the two words. But to be a little more serious, we're going to talk about a few things. So MVCs, I'm trying to look and get a feel for the crowd. Do you guys know anything about MVCs? Does this ring a bell or not? Yeah, I can see some some fingers. Alright, cool. How to create of course your crisis teams, that's something that's really important. And of course building the governance and the chain of command is something that's really crucial but we're going we're going go over that in the next few slides. And of course potentially the tools that you want to use because, you know, tools save you time and today it's all about speed. Okay? By the way, I like to interact. So if you have questions, raise your hand and we can make this interactive. I don't want you to wait till the end for the questions. Okay? So this was a little flashback because I've been doing HIP for quite some time now. So '21, twenty two, three, four, five. Yeah. And if you look at the different steps as a consultant, I'm trying to bring a story together. And what we're bringing for the past few years so the first one was more about hardening. It's more about, you know, the protection, how you can do things, who's in charge. So I was already talking about governance in 2021. 2022, we're talking about, you know, building the wall. So this little joke, of course, but building the wall, things that work, things that don't work, but also basically preparedness. I was talking about if you want to, you know, be able to think well, to act without thinking, you have to sort of prepare before that. So that was 2022. 2023 was also coming to back to basics. This is something that we keep pushing all the time because as you know everybody, the vendors, everybody's going to come out with brand new logos, brand new AI this, AI that, whatever. But sometimes it's really good to come back to the fundamentals. 2024 was business first. So I was talking about CTEM, how that was important. So the next steps of transforming Voc into CTEM. And then 2025 was operational resilience because at the end even though we're doing IT, mostly it's for business. IT is only here to serve business in the end and maybe part of your IT is working, but if you're losing money every day, then that's not going to work out. Okay? So the story, as you can see, there is a story behind all this and today I would say we're mostly going to be talking about speed also. Okay? So a quick flashback, you don't have to read these, the slides, you can read them afterwards. It's more about what we used to see in 2024. It's the cost of a ransomware attack, the cost of, you know, whatever would happen. And this is what got me thinking into, you know, operational resilience. When we're starting to share these amounts, it's it's not about just protecting your IT, it's protecting your business. Okay? And we see the amounts and you know that potentially your IT is going to be down for a couple of weeks, that actually translates to a lot of money and a lot of businesses are going to close behind that. So that's the storyline. I'm not a huge fan of scaring people into buying stuff, it's more about explaining to them what the company is going to be hit for, how much production they're going to lose, and how we can circumvent that by creating operational resilience. So this is a type of, you know, stuff that I talk to with our clients. Alright, so now any Conor McGregor fans here? No? Sort of? He tried to make a comeback this year. Come on guys, he got hurt. Alright? But he was still good, okay? So this one is really very important. Of course, everybody knows about the zero day clock? No? Yeah? Sort of? Alright. So as you can see in ten years, we've seen it's it's the time so the mean time to exploit. Okay? So between the fact that we discover vulnerability and the time for exploitation. So ten years ago or roughly ten years ago, between the time we'd find an exploit and then, you know, a Vault and then exploit it, it was two years. And right now we're sort of down to so this one says six hours but it's refreshed all the time. So we're now down to two hours actually. And potentially we're gonna be down to zero. Okay? At one moment. And now the real question is with everything that's happening, how on earth can you protect your information system and keep it operational and ensure that you know you're gonna get resilience. So I don't know if anybody has an answer here. We're trying to think about these answers and we're trying to bring them to our clients. Okay? So the joke is of course all I see here are easy targets, that's Connor. And then the second one was you know Fast and Furious saying, You owe me a ten second car, I almost had you. So I was just saying down to six hours, now two hours and probably down to zero and very soon. Alright. So does anybody know the huge difference between 1997 and 2026? No? Well, in 1997 we had Skynet. Okay? And this was AI of course if you think come to think about it and I'm a huge fan of movies. I'm just gonna skip the bottom part of course, we're talking about self awareness, the attack of the result, billions were killed, right? Now this one might be it might be a little challenging but 2026, we got Mythos. Of course Mythos is not there on its own. It's also the AI and all the different models that we have. But you do realize that from the previous slide to what we've disclosed this summer with Mythos and you know the frontier models and everything that we have, that the time to exploit and all the vulnerabilities that we were able to find have not been found for years and now it's a real risk. So this was a little joke that I had right here about the awakening, you know, the intervention and of course the outcome. The outcome right now is the most important part. So this was just a joke what I was writing, but the outcome is very important. I work in France. I've been contacted by all the major banking FS, you know, industry and they're all very very worried about mythos. Well, mythos or any attacks on AI. Is that the case here? Does anybody fear it? Does anybody feel fear for the speed or what's gonna happen after that or I can see ***** is saying yes, but I'm trying to see looking around me. Yeah. A little bit? Okay. So I'm gonna share a little bit. So this one is sort of the future and how we see it at Capgemini. So this is of course my good friend AI that helped me design this because I'm very bad at drawing even though I always wanted to be, you know, a designer when I was a kid. But it's to see a little bit about, alright, now we got this these exploits and we're gonna see potentially attacks that are boosted with AI. How can we answer in a speedy manner? And it's all about speed. So we talked about identity in the past, we're talking about resilience maybe a year or two years ago, and now we're talking about speed. So the different pillars that I listed here to go to the autonomous cyber operations, they're basically four. So CTEM, automated automated patching, automated remediation, and zero trust. So why zero trust? You're probably gonna ask me. It has nothing to do with the rest about automation, about AI. This the the path the the part with zero trust that's really important is the back to basics. Okay? When we're talking about mythos and, you know, how it can spread, how it can use very low severity vulnerabilities in span, The the important thing is if you segregate, if you do a lot of basic basic things, you can really slow down the attack. Okay? Remember that it's not about fixing everything, preventing everything, it's about to being able to make it sufficiently slow so that we can detect it and try to react. For the rest, does anybody here know I'm talking about CTIM, automated patching, automated remediation, and AI pen testing? What do those have to do? Has anybody been messing with that? I'm looking around, have no answer. Okay. So this is actually really interesting. This is not just a design. This is something that we're actually doing for two clients, an insurance company and a bank. So we're basically using CTEM to gather all the information and, you know, potential exploitability, I guess, we could well, possibility to exploit, CMDB and tons of different things to try to see, of course, if a CV comes out, if it's relevant, and if it's existing, you know, in your information system. And then we use AI pen testing to ensure that, you know, is it really relevant or not. So this is an automated process. We're not asking any pen testing team to do that. We're doing that automatically. CVE is published. Behind that, we evaluate it. Behind that, we physically evaluate it with a pen testing part. Based on the results, we get the automated patching or automated remediation. So for the patching, same thing. We're just not just gonna patch in production, we're gonna, you know, have different states of production like low level production or something that's related to your MVC. And based on those we can keep a human over the loop or we can do automatic stuff. It seems a little far fetched but just believe me when I'm saying that we're actually delivering this for some clients. So you can do attacks leveraging AI but you can also defend and speed up your your, you know, your defense with AI. And I believe that that is sort of the future. And the idea is to go all the way down to autonomous cyber operations. So the idea is not to say that we're getting rid of all the people, it's we're boosting people, we're boosting speed, and then those people who are actually doing those tasks can actually help you for the rest. And the rest is the next step. So what is your MVC? So another great design that I have right here. Does anybody know? So MVC minimum viable company. So you guys are working in different industries. Does anybody has anybody here tried to define what an MVC is within your industry or within your company? Anybody want to raise a hand? Okay. I'm not talking to *****. So I saw two two gentlemen right there, one right there. What are the different steps? And I don't know if somebody can pass a mic over or if we are out of mics or just have a very loud voice and try to try to speak. Yep. Right now in the question they ask is what is my minimum viable company which, know, if it's a new customer I don't know. So that's that's one of the parts that's hard right now as a as a consultant is that they're just asking you for the answer which, know, you don't know. Okay. So if you look at the different different steps and the number the third one is what must survive, that's the most important part. You have a company, don't know, for example, you're in retail. Okay? You need to be able to produce, So your factory has to be able to run your workshops. You have to be able to bring, you know, deliver to your shops and your shops have to have POS's that sell, okay? I'm just giving you a very very high level overview. Does your CRM need to work? If you're able to sell every day and you're able to deliver, I'm not sure that CRM is critical. Do I have to read my email? Would be good, not necessarily critical. The idea around an MVC is really understanding, you know, how your business operates, what are the applications that are really business critical. And usually you're gonna give me five to 10. If you start to give me fifteen, twenty, thirty, forty, they're not critical. Trust me. Business never relies on more than five or 10 applications. When you get those applications, so what what is your your main business operations? What applications do you need? What is the relying infrastructure to support those applications. Once you get that, you already have an idea of what your minimum viable company is. And once you have that, the whole idea is to build a construct where you're going to scale everything down. So that's the part that's, you know, it's completely on the right. Of course, it's not a 100% of the operations running. But if during a crisis, I'm able I'm able to sustain 8080%, 7080% of my production, my sales, and whatever, I'm good to go. And I can survive the crisis long enough. Okay? If you look at the bottom what it says, 90% of complexity is removed, you're going for simplification and the essential outcomes are the ones that are protected. I'm not trying to protect everything. In the past everybody has been trying to tell us you have to back up everything, you have to do this, you have to have, you know, whatever working. We know it doesn't work. We know that the clients we work with, they don't test the backups. There are a lot of things that they don't do. But there are a few things that they must do, and those are the crown jewels that we need to protect. Any question on the MVC part or is that pretty clear for you guys? You go for it if you have any questions, really. No? Okay. So the next slide is not popping up. Coming back one alright. Maybe I'm too far away with the clicker. That was the alright. So we're good on the MVC part. Sorry about that. So now if you're thinking about, I have a crisis. Alright? You've defined your MVC. Potentially, you have your crisis, okay? And how are you supposed to manage a crisis today? So do you guys have a plan? Is there anything that you've prepared or not? Because as I was saying, we're talking about preparedness, right? Trying to look, I'm trying to get a feel for it. No? Okay. So you've defined a plan and can you try to explain to me a little bit how you've defined this plan and how you're gonna help, you know, rebuild or maintain your activity because of you as you guys have probably understood, it's all about maintaining this MVC, right, until you can fully recover. So do you want to share a little bit of your plan and see if it's up to par with what were with the expectations or not? Is it working? Okay. And and then from there, they engage we have a what we call a care pod, which is like that minimal viable that we spin up through automation, and then we can get those key components. But it really depends on what the how big the impact is and where we go from there. Anything you want to add to that? It depends. Alright. So so you've defined your bubbles, you've defined a few things, you probably have your backup. I hear that's a lot of technical stuff. But I mean, do you have any training with your execs? Do you go over scenarios that you could be playing? So you just do tabletop exercises, but is it in a real life condition or is it just basically Okay. And you define the scenarios yourself or you work with a consulting firm that comes and brings in, you know, a 100 scenarios or whatever and how do you run them? Because usually when we do them is we try to understand your business. So when we come and we go for an audit, we'll come and understand, you know, of course what your business is and that's where we try to define a little bit what your MVC should be. And then we're going to start bringing in scenarios that are going to pinpoint and attack specifically on, you know, your business and your operations. And then while you're answering, you know, those questions and trying to scale, we continue digging and digging and digging and trying to see where the issue is. Yeah. We've from let's say, like, the past year, our business continuity team has really been challenged to do is almost monthly to enhance some of that paperwork, if you will, or game plan. However, we've also partnered with people like Mandiant and so forth to come in and really drill into those scenarios. And that's not think it only happens like twice a year. Okay. Fair enough. Has anybody here had an incident in their company where they had to go through IR? No one? Hands up? Somebody has a hand up in the back? Okay. So just for you to understand, so today you have your IT teams of course, you got your security teams and they're probably scaled down because the budget is not unlimited, right? Unless someone here tells me that they have 50 people handling Active Directory, a 100 people handling Azure, but I don't believe so. So the teams have really scaled down. And the issue that we have when you go into crisis mode is that, of course, you're gonna have to call your insurance company or you may have to call your insurance company. You're gonna have people coming in for forensics, but what you have to understand is that these people, they don't touch your information system. They're actually gonna ask you to perform the operations. So your teams are very small today, okay? And you're handling daily day to day operations. You're hit with a crisis tomorrow. Everything is sort of hectic. You're trying to keep, you know, the business afloat and doing what you can, but at the same time, know, same teams have to go through forensics and you know help the CERT teams do a lot of things and that is very very time consuming right now and that's not something that you necessarily have. And of course there are different phases. So if you guys have been going to well you know what we're talking about right now, so crisis management with Marty or with Courtney, basically, so in forensics you have the forensics part, you have the containment part, you have the eradication part, and then you have the remediate remediation part. And just think of it as one thing, is those insurance companies that are gonna come, they're not gonna help you with those. They're going to ask you a lot of things to try to understand what's happening, but they're not necessarily going to build the plan for you to recover. So, you should work on the plan to recover on your own, that's part of it, but you should always challenge it with a third party. And I'm not saying that because I'm consulting firm but I'm saying that because it's nice to have a, you know, an outside opinion. And then the second thing was really interesting is I was in another session where they said the first thing is you have to call someone to help you. You're you're already not powered enough for your day to day operations. Anything goes wrong, you should call a partner to come help you out, someone who's used to doing this. And this is where you get your training. So it's not just calling your partner when things go wrong, it's preparing for things so that when things actually go wrong, they're pretty fluid. So doesn't anyone you know why I have three different teams right here, right? Why I have the the crisis team, the crisis management team, and the exec team. Is this is this just total nonsense to you or do you sort of grasp the concept because I know it's a pretty loaded slide but do you understand the meaning behind it or not? And I've tried to to really simplify it because there's a lot of text. On the right side, when you look at the tech team, okay, and I'm a big fan of movies, so you have Tom Cruise right there and it's Maverick and Maverick says one thing, he says, don't think just do. Okay? This is the important part of having separate teams. You have to have separate teams and these teams they operate very differently. So the tech guys when we ask them to do something, I don't want them to start challenging what I've asked for. I'm in the I'm in the crisis management cell, okay? I'm dictating the way we're doing things and the decisions are based upon, well, my knowledge, patterns, I'll come back to that with a crisis team, and the fact that you know we know what we're doing and we're the link between the exec team and the tech team. So when I ask someone on the tech team to do something, I'm not asking them to think about whatever, I'm just asking them to perform the action and to do them. And this is something that's very important in your teams. When you have architects, there's very two very different things. When you're working with an architect team to build, I don't know, a new version of a migration to Windows 11 or doing whatever. You start of thinking about a blueprint, you're doing your design and you're you have the time to think about all these scenarios and the people who think about these are usually, you know, not stressed working behind a desk. Okay? Crisis management is very different and when you're operating under a huge amount of stress, you don't necessarily want those same teams that usually have all the time in the world to do something to be the ones operating under the stress and duress and doing the crisis management. Okay? So when you're evaluating the teams internally, and this is something that you guys should do, this this is what we recommend our clients is architects and whatever is one thing, but you should also know if they're prone to stress, if they can still work under stress, tiredness, or whatever, and those are the people that you're gonna list and sort of put in your safe. And if anything happens, well, maybe ***** is my usually my usual boss on a day to day thing, but maybe he's really bad when it when there's stress management involved or whatever and he can't handle it. Well, if there's a crisis tomorrow when we break open this little capsule that's in the safe, it actually says that Ben is the guy who will be handling Active Directory because he just does thing and I can does things. I don't need to sleep and I'm not stressed out. So it's very important to understand the knowledge between build, analyze, design, build and crisis. Crisis is completely different and your teams should already be separated. Don't try to build your teams when you have a crisis. You have to define this way before. This is this I I don't think anybody realizes this because you guys are all pretty passive which is cool. Oh oh or maybe it means that everybody has everything figured out. But this is months of practice. This is literally months of practice, months of designing things with the people and then rehearsing it several times per year. And I'm only talking about the technical crisis. And once again, if you look at the different parts of technical crisis, you have to have someone for the cloud part, the infra part, the network part, AD part, backup part. That's a lot of people right there and you probably don't have those all available. So you have to plan, as I said, that part. Then you get the the crisis management team. So that's the blue team right there. Simplify it on the right, does anybody know who that is? That's Matt Damon, but you guys know the movie? Alright. Will Hunting. And you remember what good Will Hunting says? He's doing the math thing with his, you know, his master and he says, you know how simple this **** is for me? He says, I don't have to think about it. It's the big difference with the crisis management cell right there. You have to be able to see patterns. If all the data is coming through and you have to crunch down the numbers and you have to come up with a solution, you're basically doing what I just said you shouldn't be doing. We're not doing analysis, we're not doing design. I see something. I've seen this many many times in other companies so I'm actually gonna speed up. I'm gonna take a decision based on my knowledge, based on the patterns that I see and because I can see through them, I know what's gonna come next. And then I can advise and of course move it up to the execs. Do you see the difference between the two types of profiles in the teams? I'm just trying to get a feel for it. So the crisis management normally, you can have defined whoever in your company can be part of that team but I would strongly recommend that that's an external party because external parties just like me and ***** and other people here have done many, many incident responses and that's the fact that we're trained to them. We can see them in different industries and we have an idea of how things go and how to manage things. Okay? So you should always have someone on your teams, and as I said, not just a doer, someone who this time can see patterns but is quick for it. And then the exec team, that's margin call right there. So I don't know if you guys saw the movie. Of course, the execs need to be there, but you really need to segregate those three different rooms. So if you're thinking about the bottom room, technical team is completely apart, nobody talks to the tech team. The only people talking to the tech team is the crisis management cell. Nobody talks to the execs except the middle part. Okay? You're you're sort of like an intermediary and it's really important. We don't want the c levels to start making technical decisions. That goes nowhere. And we don't want them coming down and bugging our tech guys who haven't slept in the past two weeks asking when is this coming back? When are you doing this? Can you unlock this? Can you unlock that? That's why we really have to have this buffer zone in the middle which is the crisis management. Okay? Do we have any questions regarding this? Yes. Partly. So, you also mentioned that, you know, you're looking for patterns, but somebody who's external is not going to understand the baseline of the way the environment may have been operating before to understand this now looks different. So agreed. This is why it's a hybrid since Mickey was talking about hybrid this morning. I would say it's a hybrid team. I do need so the patterns it was more about the patterns of attack, not the pattern of how the company usually works. Patterns of attack, things that are happening that I see that I've seen elsewhere. This was my my crisis team. But it's important to have someone on board also from, you know, the client who can share the knowledge, share, you know, how things usually work And that's why I said one or two people from the team who could actually help, but they're not usually the ones who are gonna handle everything because there's a hierarchy. So let's say that you've been appointed to this, but you're gonna give, you know, orders around to your tech team, you're gonna talk to the execs. It might be something that you're not trained at or for. And this is why internally, if you look in the crisis management cell, we have different so you have the crisis director. Alright. He's the overall lead. He's usually the one that will do the interface up and down. But you also have the situation manager. So this is something that you were talking about. You know, he might know how things run-in in the company. He might know a lot of things and this could be an open position, you know, on the team in case of an issue to help us out. As we said, we're not trying to have several people within the same role. We're trying to have a very lean way of operating. What that means is usually what what I used to say in my previous company and what I say now is only one head to cut off. When I'm defining basically my my org chart, I don't want two people to make any decisions. Two people means I say yes, you say no, and then it's gonna be very complicated. We're working in a crisis. We have to be able to act fast, to be smart enough to make the right decisions and sometimes maybe you'll be wrong, sure. But I don't want to have somebody who's always going to be on the counter side and telling me that I'm not doing the things right or doing something different and we're going to waste weeks. ***** can actually talk about this and we were talking about this earlier is we had one of our clients that was, so one of my previous clients in my previous company, that was under attack. It was an insurance company in The US and part of the company, it's a it's a global company and it's a French holding. But then The US part was attacked and as we try to barge in, of course, everybody starts thinking about, wait, it's only The US that's being attacked. So should France be driving, you know, the remediation? Should France be planning? Is it even legally, you know, something that they should be doing? Our legal structure is this is the holding is in France, different, you know, companies throughout the world. Who's gonna do what? And we lost two to three weeks in the beginning just to get a sign off to be able to start working there. And this is precisely what we don't want. So this has to be predefined in the beginning with different scenarios. When you're trying to think about you've defined your MVC. That's one thing. So you know what has to run. Then you have to define how the org is gonna work and what's your chain of command. The chain of command is the most important part. And if I come back in number two right here, you see the people in governance enable decisions. So as you're building your MVC, have to define who are the main actors too. And for crisis management, it's pretty much the same thing. You have to define chain of command, who makes the decisions, and in what scenarios. If it's only a sub that's attacked, maybe it's only a country, maybe it's global, but all those decision makes I mean, make it that you have to have a different chain of command for different scenarios. Is that about clear for anyone or not? Okay. Now, we can talk so as I said, have many, there's a lot of information on these slides and you can read them and this was not the point is not reading them right now, but there's something that you probably will understand is if you guys have never been hit, I don't know what industries do you run. I don't want the name of your company but at least which industry do you work in? Anybody in for this? Manufacturing. Alright. How big is the company? How many users? A thousand? What's the revenue? Public. I'm talking about public public figures. I'm not asking for anything, you know, secret. $500,000.5500000000? Okay. 500,000,000. Alright. So 500,000,000 for the year and so you you don't sell people, you sell things. Right? Okay. So what if there was an attack tomorrow and you can't operate anymore, you can't deliver, can't sell. That definitely has an impact, right? So you said if it's a little more complicated than this, but if we said 500,000,000, you divide it by the number of days in the year. It is more complicated than that, but if you divide it by three sixty five, let's say you're close to 1,500,000 per day. Sound about right? If you don't have any plan for it for it to start with with backupping your MVC, you don't know what it is. You don't know about your backups. You don't know about your plan. So you're gonna start going through your backups. You're gonna try to restore everything. You don't have your crisis teams there already. You're gonna try to do everything at the same time. It's probably not gonna work. What we usually see in this scenario is big companies. So you said a thousand people. Right? So I would consider that as a SMB on my end but I'm just saying it's because the clients my usual clients are about a 100,000, 200,000, 300,000 people. But for a thousand people that still has a huge impact. It would probably take two to three weeks at minimum for you to start getting something that resembles a little resilience. We said 1,500,000 per day, three weeks is twenty one days, that's gonna cost you 30,000,000 right there. And I'm not sure that most of the companies can spend can wait 30,000,000. Oh, it's okay. I'm not gonna disclose anything. I'm just gonna lose 30,000,000 and we're gonna keep surviving. A lot of companies, you know, they they don't go through it. One of our clients, so same thing, know, knows knows this client, a pharmaceutical company, when AD is down, well they have a lot of different Active Directories but they have more than 50 directories, when the directories are hit they lose 70,000,000 per year, per day sorry, 70,000,000 per day. So just imagine waiting for three weeks, how much that's gonna cost and if the company is gonna survive. Another retail client that I have, it's 15,000,000 per day. You don't have the time, once again we're talking about speed. All this has to be prepared in advance. So I'm being hit. Okay. There's the legal part, there's the insurance part, that's one part of it. The second part is it has to be automatic. My backups are there. I know how to recreate my MVC. It's probably in a completely isolated environment, and there's only 60 to 80% of my business that's gonna be operational. But who cares? 60 or 80% of my business is operational. I can survive. If you look at the previous slide, it's should be written somewhere. Yes. Strong in purpose built to survive. I'm not asking for it to be a 100%. I just want enough for me to be able to continue and then recover the a 100% maybe in three months. I don't care, but we survived during that period of time. Okay? Does that make it any clearer to you guys or or not? A little bit. Okay. To finish, so all the slides will be available. And actually, so this has not all been fully created by AIO, by the way. It's by prompt that's pretty big. Ten minutes, yes. The prompt is pretty heavy and everything that's in it, there's no hallucination or anything. This is stuff that I, you know, push for. So please read it, pay a little attention, and it will give you like the top things to do. We were talking about speed, right? We're talking about the crisis management cell, we're talking about the execs, technical crisis team. Now, most of my clients as I said are worldwide. They're spanned everywhere. We people work remotely, people are traveling, the execs are everywhere throughout the world. You go in a crisis the way we used to do it at the time is everybody would come to the company, we'd have two different rooms. So we'd have an exec room, on the other side we'd have the tech room, the crisis management cell is basically going back and forth in those rooms. That time is pretty much over. If I have to fly everybody back to the office, that's gonna take two days. Just remember, I just said some some of my clients lose 15,000,000 per day. So just bringing people back to the office for two days, that's 30 mil or a 140 mil if you're a pharmaceutical client. I have to be able to start ASAP. And how can I communicate? So if my systems are down, if I can't use Teams, what's the next step? How do I so how do I get everyone back? And if I do so, I'm wasting two days and I'm losing a lot of time. How can I communicate because my systems are down? I don't have Teams. I can't use my email. Do any of you guys do you have a backup plan for your email? If Office three 65 if I go into Entra, I switch all the passwords on all of the users. I've actually gained, you know, access to your tenants, and you're locked out of your tenant, and you can't access your email, you can't do anything. How do you guys communicate? You have a backup plan on GCP? Do you use Hotmail? Do you use WhatsApp? Did you ever think about this? Yeah. It's a disaster. So this hits, you're not ready, you don't have the tools, you don't know how to communicate, and this is when mistakes are made. And so this is a little joke with Lilo and Stitch. I'm the man they call when things have gone wrong and things have indeed gone wrong. This is pretty much it. You're you're in a **** show. You're not prepared for it. You're gonna start using your phones. So unencrypted, you're gonna be sending text messages or messages to a whole bunch of people who should definitely not be aware of what's happening, and this is how a rumor gets spread or potentially, you know, it's public. But you haven't even called your lawyers or anything and the thing is breaking out. So, there is a solution to this. Does anybody have an idea? Got six minutes and fifty seconds left. I'm not supposed to talk about products and I'm not Semperis, as you know. But in the next slide, I did mention Ready1. It could be any other solution. Okay? There are different solutions there and it's true that I should not have put it as vendor specific. But the next slide is if it decides to pop up. Alright. Basically you have two different worlds. The world on the left which is my world and was my world for quite some time. As I said, very complicated. The exec team, the crisis cell, the technical teams, different locations, different countries, very complicated for them, you know, to to be able to talk. You have on the left part multiple sources of truth, delayed escalation because of course things have to go back and forth but I can't communicate correctly. This is something that is really critical. As I said, everything is about speed. Okay? And right now we're just wasting a lot of time and time that was my little my little joke right there with the interstellar when he's locked in the fifth dimension and there's so many things to do and then he's wasting time. This is basically what's happening on the left side. You're going back and forth with your bridges, nothing is followed through, your calls are not even recorded. Everything, you know, the proofs, anything that you're getting, all the data that you're getting is being stored somewhere but probably on different laptops or whatever or in the cloud. Nobody's following through with a single source of truth. This is something that's very, very important. You have to get organized. So we're talking about speed and organization. That's the only thing that we've been talking about. The MVC, the org structure, the the crisis different the the teams that you have to define, and the chain of command. Okay? Now, once we have all this, how do we communicate? What is the simple tool? So we're talking about Ready1, I could have done anything, let's call it the the unified crisis command platform. Okay? That'll be better. Where you can start communicating from day one. You have to find, so I've actually been working with some clients to define these types of platforms before they were available through Semperis or other partners. And it's a third party, you know, email system where we can exchange email in a way where we're not blocked out. Same thing with instant messaging, so an equivalent of Teams or whatever where we can start talking and we have to make sure of course that the IDP is not whatever you're using within your company because if you get attacked, then you're not gonna be able to sign in on this other solution. So this allows you to start communication from day one or in couple of hours to you know maintain very low level of execs inside. So not talking, not sending anything, not making anything public. Ensuring that everything is stored in one single place. This is also something that's very important. So, you probably have all your procedures that are stored in there, the people to contact, what to do, and everything that you start working on is basically shared in a single point where everybody can see and access it. I'm just trying to give you a feeling that it has to be about preparedness. You don't just spend a tool like Ready1 or any other tools that we use f 24 or anything. The tool is empty. So I can install it tomorrow if I don't prepare, if I don't start doing things inside, it's not gonna help you. It's not just buying a tool, installing it, and ticking a you know ticking the box and thinking that you're all good, you're you're not gonna be good. This actually takes time. Five minutes, yes. Thank you. Do you guys see the story that's behind this or is it still pretty obscure? Well of course I have someone saying yes but aside from that in the back, have you thought about all this or is does this look like Star Wars to you? Sort of really. But but do you get what's behind it? Because trust me, mean, the worst thing that comes is basically when you're hit with an attack, ransomware or whatever. Okay? You're not prepared for it. People are gonna start, first of all, protecting themselves. Your c levels, your exec I mean, your CISO is supposed to have defined a strategy, protected whatever, and now he has an issue and it potentially is a legal issue. So a lot of decision making is gonna be made out of fear if you're not if if you're not prepared for this. And you know as we said before, stress, fear, lack of sleep brings to the bad decisions. So this is the moment where it's already too late. If you start doing things when you're attacked, it's too late. You have to prepare, you have to define your plans, and then you just have to execute them. Okay? And this is where tools help you out, but the tools I would say are sort of the last thing that you need in everything that I presented and this is why they're on the last slide. The tools are only an accelerator. As I said, the tool on its own is not going to help you out. If you haven't defined all the rest, it's not going to work out. And I would say so, I only work in France, so I'm not even pushing Capgemini for you guys, but I would go with a consulting firm and I would definitely ask them to have a two hour workshop. They'll come, they'll do it for free. I do it for free for my clients. You come and you try to understand the thing these things and have a chat, you know, with the execs and whatever and this is when we usually get budget. This is when we usually get things where we can prepare them. It's to finish so I have a minute thirty. It's a little bit like an inception. You guys all are you familiar with the movie? Alright. The thing is training your mind, you know, to be protected. It's exactly the same thing. You have to train the people to be ready in case there is a crisis. And trust me, I've done this many many times and even when we're rehearsing, even when we're doing the scenarios and we're talking about you know CIO CEOs of fortune 100 companies, trust me a lot of them are not ready for it. You're not used to this amount of stress and the impacts that you have behind it. And the only way that you can go through it is through automated way of thinking, you know. Don't think just do once again. So I'm used to it, I do it, this is the pattern, this is how I work, I only work on this part, I don't have to work on the tech part and people are gonna help me get through this. Okay? I got thirty seconds left if there are any questions. So a little joke, I usually have more jokes in more movies. We can extend as long as we want. Oh, that's true. Technically. Yeah. Yeah. Technically. It's it's between you and the party. So if there's questions, don't hesitate to ask them. But we also don't want to extend without the need to extend. But if there is a question and there we go. Can I get a copy of that? So for me, right, I think you asked a lot of good questions. Right? And it's more I think the questions were more organizational based A 100%. Less Active Directory based. Yes. Right? So I can appreciate all those questions, but I don't have any of the answers for my organization. And for me, we're relatively new. Right? We're a new company four and a half years ago or something. So we don't really have a lot of this yet, and I'm crying a lot, you know, trying to get the attention. So something like this, just as simple as that, would be helpful for me to maybe tailor that a little bit to to my organization and help sell it. So And get the right people to meeting, and then invite the people to come in and have a conversation. First of all, the slides are available and nothing's copyrighted. So you can you can use them. That's not an issue. I would say a very important part and as you can see, so I've been doing this for more than twenty years. I've never worked for a company, but what I've seen as a pattern since we're talking about patterns, I'm not a genius. I mean, I used to do, you know, talking about Active Directory with experts and you guys know as much as I do or probably even more. But once you're within a company and you're talking to your manager who's then bringing to his manager who's bringing it above, nobody listens to you. Make it very clear. They only listen to people like me because I dress smart. That doesn't mean that I am smart but they they will listen to me and they're paying for it. And when I come in and I will explain pretty much the same thing that you've been explaining, maybe in a different way, maybe a little more business oriented, that makes a huge difference. That's why I was emphasizing the impacts on the money And that's why last year's talk that I had was around operational resilience. It's all all business is all about the money. That's ODB. But it's really, really important is that how much is it gonna cost? You know AD is down. I don't I don't even know what Active Directory does. Okay? I have no idea what it does in my company. So what's the why are you talking about AD and all this purpose about it? Oh but wait, if AD doesn't work then my POS don't work. If my POS don't work, I can't bill a client. I have 500 stores in The US and none of them can actually bill anyone. Oh I'm gonna lose a lot of money right there. Maybe Active Directory is critical. That's a way of you know, it's it's a very different way to bring that perspective. Pretty close to just shutting down all the domain controllers just for ten minutes. Just Yeah. Have a point. It. Thank you. But but do you see the way of thinking for for c level? If you're talking technical, they're not gonna understand. If you're talking about business, AD is not running. Potentially, my IDP my sync is not warning. My my IDP is not working, and my SaaS solution that drives 90% of my business, we're not gonna be able to log on to it, and we're not gonna be able to work on it. So if I'm not able to do that for x number of days, that actually relates to x number of millions. How can we make it relevant? Any other questions? Don't feel shy. I'm I'm I'm I asked them to lock the door and you're staying one extra hour with it. He he deliberately waited until I was at the front. Thanks for helping me. So looking at this, are are we have looked at a lot of these these things? Yeah. We we've looked at a lot of these things, but one of the one of the issues I see is, you know, most security organizations really want all your passwords in one place, which sounds great until you actually have an event. For break glass passwords So you can go in, you know, get in some pairs, restore this stuff and everything. I see a lot of that I have to keep reex explaining why we need to have something other than one place to manage all our passwords or rotate our passwords. Does a product like this actually have, like, the capacity to keep break glass passwords to to help with that? Or how how do you see organizations actually dealing dealing with that? So I'm I'm not gonna answer for Ready1. As I said, I I did put them in the slide and I should have done something else. But you can store a lot of things as I said. Just think about when you're developing alright. Let me come back. Come on. Alright. You're defining your MVC. So let's go a little a little deeper in it. So the critical outcomes, what I have to protect. Okay? The people in the governance, as we said, is the org and the command chain. My trusted digital core is basically all the underlying infrastructure that I have to protect, the minimum viable stuff that I need. My priority processes and, of course, the ecosystem essentials, meaning the factories, the delivery, the whatever, that builds my MVC. Now once you've defined all this, you're of course not gonna put all those documents in the share that's on your Active Directory, you're not completely dumb. So you would technically print them out at in the time, we'd print stuff out like this, these plans, and put them in safes on-site because you have to access them on-site, but if the site burns you also have to have them out of sight. Okay? Now there is a waste of time and we've I've had this issue. So do I have a few more minutes to answer? Alright. Technically, think about hunt for the red October. Okay? Always two people to verify something. So ***** is on-site, but because I'm lazy, I'm in so I'm French, so I'm Paris. He's in Germany. So he's on-site in Germany and I'm at hip in The US and having a great time. He has a crisis. He has one key just like in the submarine. I have the other one. How do you access your information now even though it's in a safe on-site? You can't. So that's an issue and we've had those types of issues for real with clients. Or somebody forgot the code or somebody forgot the key so they had to go home, they had to do this, they had to do that. Once you have it, let's say in the cloud on a solution with immutable storage that's secured well enough, of course not using any of your credentials that are the same as the company credentials, that is a smart way of accessing things. But it's also very interesting to say, if you're defending your ecosystem on prem, you definitely have to defend also whatever solution you're going to be using to store and to get access to all this. If I'm an attacker today and I know that you've defined your response team, your partners, I have access to everything and everything's stored in a single location, that's probably what I'm gonna be aiming for if I go for something. So once again, whether it's Ready1, any other solution, don't have 50 admins, Keep it very simple. Rotating passwords, 2FA, and anything that is not based on anything within your company. So no IDP with your company, not the same MFA for your phone, back to basics. It's, you know, logical stuff. That's where you host everything because all the procedures, all the numbers, all your tech people, your org chart, everything has to be there. How to bring anything back up online has to be there. I like that as a lovely last statement, Ben. That was great. Thanks, everyone, for staying this long. It's definitely shows the discussion shows this is a topic that needs preparation. You've given us some great tips. People will come back to that. Now for today, 06:30, not that far anymore, and it's just ten minutes walk from here to the Jelly Rolls Goodnight Nashville bar, place, whatever. We'll find out. Yeah. Not not been there myself. Definitely something that you don't want to miss to get some of the real natural feeling. I hope you all have picked up your little purple thing here wristband, because that's what gets you in. You don't need to take your badges along because that'll replace it. Yeah? Apparently, still an ID of some sort doesn't hurt. I take my phone, got a picture of me on there, so that's good enough. Yeah, hope to see you all there. Ben, thanks again, this has been great. Thanks.