Industry sign banking montana presentation easy
go ahead and get started then um well welcome to montana mgma members and guests for those that don't know me i'm katie yakovich the executive director here at montana mgma and we are excited to offer this two-part webinar on cyber security sponsored by umia today we have connor smith from first call computer solutions with us connor is a fourth generation montana montanan he is a veteran of high-tech sectors in montana and beyond his team of over 30 it professionals help small and medium-sized organizations and implement practical yet informative i.t voice in web solutions first call is based in missoula with offices throughout montana just a couple reminders before we get started if you're not speaking please remember to meet yourself there will be a question and answer time at the end and also this webinar does count for live ceu credits if you are looking for those without further ado connor i will turn this over to you thank you katie i think i got some feedback there okay how's that there we go so katie thank you thanks you know to attendees and um i decided to interject uh a little bit of humor into today's uh presentation uh for a couple of reasons um as we all know 2020 has been an especially long year and that is absolutely true for folks within the medical field and we all know that cyber security is not exactly a light delightful topic you know it's fairly heavy and complex but i want people to walk away from this uh with a smile but also with a critical key takeaway and that is that security hardening isn't tough hopefully get the joke there uh katie um introduce me um and just a couple of more things um so i'm a 20-year i.t veteran i've got uh 35 very smart people around me that help me manage i.t for a wide variety of organizations in the medical field we work with community health centers rural access hospitals in some cases we are their i.t department in other cases we partner with their iit department at what's called a co-managed approach we've got private practices dental practices chiropractic practices orthopedic and again everything you know from there all the way up to you know full-blown 24 7 365 hospitals this graphic here is important to help you understand because when when people are talking professionals within the it world or the cyber security world it really matters what space that they play in in terms of overall risk management and so specifically the first call we work in the regulatory space and what i mean by that is we're not the organization that is setting standards you know those types of things policy we're also not in the verification world specifically or primarily we primarily are in your world in the operation doing the work uh implementing technology tools processes behaviors that help manage risk and in the event of an incident or an event helping organizations recover from that so that's really the role that first call plays as we kind of walk through cyber security and risk management i also want to frame up um this notion of managed it versus managed security services and it's very important that people begin to kind of reframe their thinking and please know when i say managed i t versus managed security that doesn't necessarily mean that you outsource it or you have in-house i.t it just means somebody is managing it so let's take a look and and make sure that we kind of create some distinctions here so managed it is what we have all you know primarily lived with for the last you know 20 30 years when we think about that we think about those are the folks that fix rit issues you know there's kind of a standard set of risks that all organizations face and they help us manage that they improve our infrastructure our tools you know they may be helping us boost our operations by using those tools better they're accountable for staying on budget so success for managed i.t again whether it's in-house outsourced or some combination thereof is usually tech tool-based it means fewer issues less fundamental risks and getting alignment technically operationally and fiscally managed security is different typically their focus on understanding regulatory compliance industry specific threats what the impact of those threats and risks might be they're implementing auditing alignment and other types of controls but this is the real thing that to help you know people understand success uh for managed security services is risk-based not tech tools based it's identifying closing and maintaining security gaps it's the ability to recover and if necessary to provide compliance reporting this is a an illustration you know to help re-emphasize the same point because it's a very important point so up here you've got the bathroom you've got managed i.t and again just think about that it's the tools for the job when they are needed where they are needed it's that captain obvious type of protections that need to exist when you think about managed security services you want to be thinking behind the scenes the plumbing the systems the connections you know the supply chain um you know you want to be thinking internet application vendors uh you know phone system phone carrier lots and lots of underlying technologies connections uh rights access etc so managed security services is identifying risk in those environments doing protections to address the risks responsibly enabling i.t to detect events and incidents respond to events and incidents and recover from events innocent incidents and again when you think and manage security don't just think up here in the bathroom be thinking about all of the underlying systems and connections and hopefully that's helpful to people in terms of breaking those things up within your mind all right um this question is there an issue um so uh cyber security uh there is an issue there's a large issue for organizations with 150 and fewer employees right now if a breach happens the costs are very significant and typically there's not a mature set of cyber security tools to detect uh respond and recover you know to that okay so i think most people now especially with the news headlines and and i don't want to get into fear-mongering and a lot of the statistics that that people throw around as they're trying to market services would agree that there is an issue with cyber security and protection right now so i don't think that's in question what is in question and part of what i hope this presentation helps people through is that many organizations many business leaders people in in your seats are defining the issue as too complex too technical and too expensive so reality is threat is real i think we can agree on that it's happening you know to montana organizations business schools academic medical etc the number of incidents that we hear about is much higher than what's reported um there are very sensible protections that organizations need there's also some advanced things that organizations need to be thinking about and that's true in the medical field and then you know also is people you know do make mistakes have careless behavior and those mistakes you know can uh you know certainly impact an organization so if we agree there is an issue we're certainly seeing across the american landscape that we're not dealing very well with the issue and typically you have to ask the question you know of what's um why um and one way of framing that is this question of what's holding our leaders back and i think the basic answer for that in 2020 is just a wonderful um a visceral you know uh uh response to that is there's been a lot of other pressing priorities um you know leaders have their hands full and especially you folks in the medical administration world trying to manage strategy finance operations health risks to your people to your patients it's just been an incredibly challenging year and even without the pandemic you know there's just a lot of different things that people are trying to manage and risk so i i really think part of it is or focused on other things but another really large part of the problem is that they haven't taken the time to adequately measure the risk and they're again kind of stuck in this i'm hoping i'm trusting nothing bad has happened in the past seems what we're doing is working um you know just steady as she goes so one of my um you know core parts of this presentation is to really encourage leaders to take a small amount of time to assess the risk many of you might be sitting there thinking okay you know do a risk assessment you know those could be very expensive so here's my first security hardening isn't tough tip do an executive level risk assessment gather your team get a qualified third party and run through one and when i say executive level risk assessment you know this is not going to meet you know the hipaa security compliance rule um you know what i'm talking about is an hour an hour and a half running through 50 questions through that exercise you will better understand the landscape as it sits today um you know what vision and action you can take around it 50 questions is plenty you start diving into full risk assessments with leadership teams it's much too much again the goal here is 50 questions an hour and a half to help people under better understand their risks and set a course you know to address them there's also this question about why do it with a third party someone like me or there's many other qualified companies as part of this association you know or do a google search the reason that i highly recommend that you do it live and do it with a third party is when you start to dive into those questions you really start to get confused the rules can be confusing it can be kind of very academic in nature a third party person can help make it more tangible realistic and actionable you know based off of what we're doing within other clients to address this okay another really important question to get answered is um all right what's holding the leaders back but what's holding traditional i.t back and um over there on the left i've got some more you know plumbing imagery and if everybody in this seat that deals with i.t people whether it's inside their organization or outside you know certainly has a perspective that it's got a lot on their plate too and usually doesn't have a tremendous amount of capacity because they're busy handling the day-to-day operations or making things flexible through this pandemic and all of that kind of stuff so definitely capacity is an issue cyber security is also a different focus you know as i mentioned before traditional i.t is tools operations making users happy security i t is managing risk identifying closing maintaining gaps they're two different focuses they're two different sets of skills so please do understand that cyber security is really a specialty focus capacity and is an issue another thing to keep in mind is oftentimes i.t people don't like asking for more money you know they want to feel like i'm doing the job i'm doing it cost effectively and asking for more money is a bad thing they're thinking dollars expense versus what could this really cost us if something happened soft skills many of the issues with cyber security aren't as much technical as they are behavioral and so many it people don't have some of those soft skills that are needed to help change behavior they may also not be empowered to help change that behavior the question last question i posed here is why are banks successful and this is a very important question because what you don't hear going on in cyber security world is a bunch of banks being breached you hear about the government you hear about medical institutions you hear about school systems you hear about municipalities but you don't hear a lot about banks being brought to their knees by ransomware or their customers data you know being financial data being infiltrated or those types of things and the answer to the question is that banks for a long long time decades have separated traditional i.t from cyber security they have a whole group that's decades mature of cyber security analysts cyber security assessment procedures cyber security standards uh actual auditing that happens multiple times a year they already have the maturity around this and so to answer this question of what's holding traditional i.t back it's they don't have that maturity from the leadership to operations to what's available in the market that say the banking industry does and if you're wondering where things are going to help deal with this problem look to a proven model you know and what banking has already been doing you know for a long time now so here's my next security hardening isn't tough tip organizations uh small medium and large are going to have to rely on outsourcing and you might think this is an overt sales pitch from a guy like me that does cyber security outsourcing as a service but it's really not i'm trying to help folks in your seat understand that you've really got to get more shoulders involved you're not large enough to hire these people internally build the systems build the processes build the tools and going back to what i was saying earlier your traditional it function isn't very well equipped to do these things or they would have done them the other thing i want to recommend is synergy not a la carte often times when we go into organizations and we start doing cyber security assessments you know they've got this firewall this antivirus this tool that tool and what has happened is they have as they've run into specific issues i need a better backup they've solved that without thinking about the broader picture i need a firewall or i need a vpn connection they've solved that without thinking about the broader issue it's as i've seen a problem i've gone to the counter i've picked up what i've needed i've put it in place that's the all a card approach that becomes very difficult to manage effectively and so you've really got to start looking at synergy across your tools and your vendors to be able to do this efficiently and affordably the other thing that i would recommend is from a cyber security perspective if you're looking for resources and partners especially like in the medical world banking has their experts there are also experts in the medical world and you're going to be better suited to work with somebody that works with the medical field versus seeking somebody you know that say does cpas and fintech and now you're asking them to do you know hipaa compliance and overall security so hopefully that's helpful okay human error hopefully this is not new news but the vast majority of breaches come from human error um and everything i've highlighted here is primarily things that users um you know can affect uh negatively so their behavior around working from home or working remotely care of their devices where they store files how they share data you know all of these types of things are behavioral things that lead you know to incidents and events you know there's a whole other set of behavior beyond your people but also along the lines with your vendors and their people and vendor management and behavior you know around those types of things as well main thing is is just to understand that people really are our number one security gap um and that that workforce isn't really a force at all it's kind of a giant ball of opportunity you know for cyber uh criminals so uh that said um here's uh our tech tip next is that if you implement the controls to limit what people do and you also train and test and train and test and train and test the statistics show that the overall risk of human behavior falls off you know we are people of routine people of habit and if things are consistently communicated to us over time we begin to absorb that internalize it and apply it when that starts to fade our attention goes elsewhere so having there are technical controls that are affordable cost effective you know to limit human behavior risk and then training testing training testing training testing you know being continuous and disciplined about that will improve and lower that human behavior risk okay so let's go back to the definition here you know that so many people running organizations run
ing medical practices etc are running with right now is that it's too complex it's too technical it's too expensive and so i want to dive uh deeper into this and kind of break it down and if there's any questions as we go through some of these you know please don't hesitate you know to reach out so let's go back to this diagram that we looked at earlier in the presentation so two complex too technical the bottom line answer to it is you've got to take a team-based approach so let's start up at the top with standards it's 2021. um you know hipaa security rules i think were last updated in in 2013. so not new news um these are free they're readily available to you here's what the hipaa security rules are and there's lots of resources again free readily available you know to help you understand those things the nist cyber security framework which i think came out in 2018 or something along those lines and has been updated once since uh but again um you know out there available free resource um so those two things for the medical world really provide the guiding standards okay um and yes you have to do a little bit of what they call crosswalking those standards um but not necessarily you know a big undertaking insurance insurance i think you guys have a presentation tomorrow from an insurance expert but the insurance world is fundamentally about managing risk that's how they make money and so ultimately they are rapidly working towards more and more standards to help their clients manage risk and again we'll make those readily available to you because the better you are at managing risk the better they are at making money uh policy lots and lots of policies are out there we provide these free you know to our clients to give you a good baseline of you know the policies around it and then you know if you've got policy what are the controls and typically if you're dealing with a vendor that deals with hipaa and cyber security and compliance they not only have a good set of policies but they also have some controls to help you manage those policies okay so bottom line there's lots of standards lots of resources and they are largely free but you've got to leverage you know these groups and services that are out there managed it and managed security um will help you implement and again whether that is in-house or outsourced or co-managed you know it really just depends on the size and the scope of your organization and the complexity and the risk that you're dealing with the main thing i want to help you understand is that you cannot just be thinking traditional managed i.t anymore and the reason why is because the risks have changed the problems have changed the work has changed you need people helping you also manage risk not just technology and tools and again there are lots of companies services you know people out there with expertise in this area to help you implement it verification internally honestly there's lots of different ways to do this and maybe during q a if there's questions i can help address some of that and then externally your insurance company is going to get more involved with this they're not just going to write policies anymore without verification that you're doing uh some of the things to help manage risk there's formal risk assessments and those come in lots of flavors there's pen tests there's vulnerability tests uh you know there's uh hipaa uh security rule compliance testing reporting will help you verify are we doing what we say we're doing and then recovery you know there's response recovery tools there's processes the main thing that i want to encourage people here and again if there's questions about this during q a is this has to be practical it has to be useful it can't be academic if you will and then insurance also is a tool to help organizations recover not just from a technical standpoint but you know across all stakeholders you know involved with an incident okay so bottom line you got to put together a team um and if your team currently is just you know your traditional i.t it's going to be a struggle just like it has been too expensive um you know important question here um you know the perception of it being too expensive is real especially for those of us you know with 150 100 or less employees and the fact is is like many technologies cyber security managed security has really been in more of the medium business set so the tools are priced for enterprise and for medium the people are priced for enterprise and medium so for many years honestly it has been too expensive but what's happening is this is becoming a universal problem and as the cyber criminals have moved more towards small and medium business because the enterprise has already shored a lot of their gaps up the tools have become more universal they've become more cost effective certifications universities and so the workforce um is certainly grown with cyber security whereas before it was a very small set of people it's a much larger set of resources now so expense is coming down let's talk through some of the expense factors so what drives expense and this is true whether you have internal i.t or external i.t or a combination the more endpoints and the more users you're going to have greater expense okay the more locations and not just physical locations obviously there's lots lots of work from home remote work flexible workers out there working virtually if you will we have to be thinking now these are locations they're part of the new perimeter that we have to protect the number of records and applications you know let's take a school district in montana that got breached so they have what's called a school management system and they had two school management systems the old one which they were keeping in production to access certain historical things and the new one that they were using day to day the more applications and really twice the records they should have had more cyber security controls and thus more cyber security expense what happened to them is they weren't protecting the legacy system and all the legacy records and that got breached and then off to the races they were standards alignment here's this is a really really important point um not all organizations are uh equal okay so let's just take a dental practice we have dental practices um you know that maybe have uh you know one patient room and we have community health centers with a dental practice that might have 30. okay you're going to handle risk management differently even though at the end of the day both organizations are providing dental work the one with more people more endpoints more users more records is going to have to align with more security standards than the very small dental practice in rural montana okay so part of having a good cyber security practice is being able to not only look at the standards but then also think practically what makes sense for us given our level of risk given our percentage of risk and manage accordingly and then regulatory overhead obviously you know medical folks do have regulatory overhead we'll talk a little bit you know more about that later but not everyone manages regulatory overhead the same um and so you know leaders have to make decisions on that front too but the more you're going to align with it the more expense associated so hopefully that helps people understand what drives expense and if there are areas where you can limit it so maybe you have computers in you know your practice that aren't in use anymore if you reduce those that's going to lower your cyber security risk and your cyber security expense simple example okay diving a little deeper into too expensive so over on the right hand side um you know there was um earlier in the presentation you know one of the attendees um betsy i think had said uh sorry betty had said what kind of are the the list of things you know that i um have in place just kind of my mental checklist okay so over here on the right you can see here's a checklist of stuff that is very common in the world of i.t and traditional i.t security you know as i mentioned earlier i.t traditional it is doing a fair amount of risk management you know at this point they really should be doing kind of the captain obvious types of things and and this is what i would say is a good captain obvious set of lists that most organizations should have in place the main thing that i want to emphasize is you know let's take backups as an example you might say i've got backups but you need to continue to revisit that and be like okay how cyber fit are those can those really protect us from ransomware or is it just the same backups we've been doing you know for the last decade because that has changed but bottom line is that these types of things as you look through them are probably most of you probably have an advanced firewall most of you probably have some advanced antivirus most of you have probably dealt with a vpn um so when you look at this stuff this getting this list of stuff will get you decent i.t administration infrastructure the captain obvious security stuff and a reasonable set of standards and compliance alignment and you're probably for a smaller organization you know say less than 20 employees dealing be able to do this from a budget standpoint for somewhere between 30 and 50 dollars uh per endpoint per month um with uh either internal i t or managed services okay um and that gets you pretty well in the ball game as well as meet you into your your operations okay when you get into larger organizations 50 75 100 employees or more you have to be more comprehensive about even these set of services to make sure that gaps aren't opening up and when you're doing that kind of ongoing texturing auditing reviews making sure things are up to snuff that takes that thirty to fifty dollar per endpoint per month and takes it up to eighty to a hundred dollars to stay on top of it and it's just the simple fact that more people more endpoints more data records all of that stuff drives more complexity and more expense when i say endpoint i'm typically talking about how many pcs do you have how many macs do you have how many servers do you have that's what i mean by endpoints okay so um i don't think um that's too expensive you know for most medical practices in 2021. um and certainly those prices have come down you know from what they have been to be able to get these types of technologies let's look at more some things that get you into advanced security and additional standards in compliance so this is things like dark web monitoring formalized security awareness training and testing fish testing and reporting true password management dns protection what's called manage detection and response you know which applies security policies uh lines those up with the controls advanced breach detection security event logging a much more scrutinized annual security gap audit you know these are the things that organizations should be doing above and beyond if they're trying to really manage you know more modern types of risk okay so when you think about this advanced cyber security stuff again you might be thinking too expensive but for a small organization 20 to 30 dollars per endpoint per month and it actually drops off as you get larger because the cost can be spread out and so you're down more into that ten to twenty dollars you know per user per month um but that again hopefully gives people a more up-to-date view on uh the expense associated you know uh to achieve these types of things regardless of your approach it's good to ask the question too of too expensive when incidents happen okay and so i got the little puppy dog you know um you know accidents do happen incidents will happen um and part of me you know does want to go back to simpler times um you know where um you know you could just go out in the forest that's not realistic in today's modern landscape we also can't afford uh you know these gold super cyber security types of things that enterprises you know invest in and embrace and so you really do have to have you know good quality facilities that allow your organization to adequately identify your risks protect against those risks be able to detect events and incidents respond to events and incidents and recover from events and incidents and again i want to bring this point home again of you can't just think about you know the bathroom level stuff you've got to be thinking cyber security at you know supply chain you know internet connectivity third-party vendors you know their tools their technology uh how that stuff you know all fits together and that will help you move beyond traditional i.t you know to to cyber security um maybe i'll stop here for a second does everybody understand what i mean when uh the difference between an event and an incident is there anybody that would want to take a stab at answering what the difference is it's an event something that's caught an incident is something that's not and so they actually made it all the way through and there was a breach um not quite danny but um think of an event like normal things that happen um you need a new user you hired a new employee you need that person added to your it system that's a security event because you need to be thinking about that event like i have to manage that risk i've got to get that employee with the right software with the right credentials with the right security tools i can't just willy-nilly add them so that's an event an incident is more look something has happened that's bad usually from a third party or an employee behavioral mistake or something that you have to respond to so events security events happen all the time they're just part of normal business you just have to have a security mindset is that helpful danny yeah absolutely i'm embarrassed i was wrong oh just that was that was the point danny of calling me out and see if i could embarrass you here okay um we're getting close to finishing up here and and open up the q a but um i really do want people as they attend this presentation to think about are you still acting like it's 2013 and the reason i chose 2013 is because that's the last time that the hipaa security rules were updated and that's a long time in the world of i.t and in the world of cyber security and so i'm asking you to heal to think about this and fill in the blank is your leadership still acting like it's 2013 your organization your user behavior your checkbook maybe your i.t department or your it function however that looks or your it service provider the point is is that if any of these things relative to cyber security are still acting like it's 2013. it's time to revisit it's time to take action it's not too complex it's not too technical it's not too expensive okay um so we've got um smart people uh myself meg ross who works in you know markets like uh the bitterroot missoula the flathead david brennan who works a lot within central montana we have clients across the state um so you know there's our emails there's our contact information people are always welcome to pick up the phone shoot an email uh have a conversation our website for solution.com has good resources um to help people better understand cyber security right now um we've got a big long explanation we've got case studies we've got blog posts um we've got e-guides you know that are helpful that you can download and also on there you can sign up for free executive level cyber security assessments these are those things you know again get the leadership team together let's spend an hour let's spend an hour and a half let's run through 50 questions um let's get our heads you know reframed around this thing better okay so i'll be quiet are there questions um at all from you know anybody with within the audience um and on on topic or or specific cyber security things that you've got i'm i'm happy to answer anything other than how i came up with the bathroom theme connor this is danny i i'll take a stab at a first question here sure you know i would have conflated before this webinar managed security and managed i.t and i think that our managed i.t does some manage security but what are the questions i go to them and ask to figure out do
hey do that are they already doing that and then if not obviously then you or other companies are available to take that on but how do i start to determine which is the services that they provide yeah um so one of the things is you know you can go through that checklist of things right and say okay what of these things are you doing for us what are of these things are you doing for us okay other good questions to ask is how do your how does your company protect itself what regulations are you following um how are you verifying that cyber security is being done for your company um you know they have the same problem that you have right i have the same problem that you have right i have to apply good standards to my company to avoid risk for my company as well as all the clients i serve you know there's things we have to implement so you can ask those questions to get an idea of what are you doing for yourself to help better understand well then what could you do for me above and beyond maybe what you're doing for us traditionally what standards do you follow what additional tools and services do you have in place how do you verify that stuff do you get a pen test you do a third party vulnerability test so having those types of discussions you know can help you can also ask you know did they do cyber security uh assessments um you know beyond the traditional things that that they're doing okay many companies honestly would appreciate um your understanding that hey we've worked together for a long time and the relationship is good but just even having your client understand i realize you're probably doing some captain obvious stuff for me and that you're not doing advanced security so could we have that discussion to see what's available a vendor would appreciate that discussion because oftentimes customers just assume well you're doing everything for me right and that's usually not the does case help danny yeah absolutely because i recognize a few of the things on the more advanced list but i don't know about all of them but also i only know enough about our system to know that i should be scared so it's helpful then you know i think to have them maybe walk through that list with me and say yes we are doing that you just aren't aware of it or yes what you call this is actually this thing that's on the list or you know no we're not doing these three or four things and you might want to add that or find somebody that can right and at a minimum revisit this quote question about backups um because if you uh sorry come back to this shot here right maybe you're not doing great with standards alignment and implementing managed security and managed i.t and verifying like not on my radar either if nothing else you've got to make sure that your backups are cyber fit and can deal with the most common threats like ransomware and that you've got that piece pegged so that that would be a minimal question that i would circle back to your vendors on um but again not the strategy i would take but at a minimum you've got to make sure that just for pure business continuity other questions at all all right well we'll close up um again here's that last slide um links to our website i know you guys have a a presentation tomorrow on cyber assurance insurance so just what's happening in that industry is that cyber insurance is becoming very unprofitable for that industry when they originally started selling policies not that many incidents were happening and so it was a good cash cow now lots and lots of incidents are happening across lots and lots of industries so what's happening is again they're losing money on it and when they start losing money they start having much much tighter tougher scrutiny on applications for new policies as well as claims on existing policies i would not be surprised if certain industries might be excluded in mass from the insurance industry for a while and honestly medical could be one of them because medical has been extremely hard hit if nothing else they will reduce coverages if they don't exclude all coverages certainly you will see higher premiums and deductibles the math just says that's going to be the case hopefully part of all of this is that companies will start to do more things so that they can get insurance and lower their premiums and deductibles which should drive less risk for everybody and you know another big impact is this whole solar winds thing which certainly the insurance industry is watching very very closely um because that is a category five if you think about like mass destruction to a community say like new orleans where one big storm hurt lots and lots of companies and obviously lots of claims against insurance solar winds is that kind of thing in the cyber security world where it literally could bankrupt certain insurance companies so that's kind of what's going on there um and then i'll close with this we all know if we're in your guys seat of hipaa risk analysis and compliance reports and here's something i just copy pasted from the internet there's more than 700 000 organizations that should be doing this okay in the past when we thought about compliance reporting we were thinking about i need to check that box i don't want to get audited i don't want to get fined and then you would decide do i want to hassle with it or not because your big risk then was i'd get audited i'd get fined and that risk was pretty low and that's how most people and your guys a seat have been thinking about it since 2013. i would really encourage everyone to be thinking about hipaa risk analysis and compliance reporting not on checking the box but on really figuring out your risks and the why to do that should be clear to us now it is the risks have gone up dramatically and if that helps you identify risks and close the gaps it's well worth the exercise you know change your why and you may change your view on doing these so anyway i really appreciate the time a few other resources out there you can click on and then i said this i wanted to close um you know by bringing some humor to this bringing some smiles it's been a long year thank you to the medical community and for all the people that support them um and uh let's uh smile uh on the way out of this presentation so thanks so much well thank you connor we really appreciate your presentation today on behalf of montana mgma to continue your theme cyber security scares the crap out of me uh i think it is that your last point is great in that when i first started was kind of a box checking thing and as i learned more i became more concerned about it and that's why we're really trying to take steps to educate ourselves and to educate our members so that we're making sure that we're proactive before we're at the next headline in the newspaper i know there have been a couple practices in montana and a few in wyoming that have been hit that i'm aware of and i'm sure steve tomorrow will share more because he insures most of a couple of the states here in the west so this isn't some big you know health system and you know some big city far away kind of a thing that this is in our backyard now so this was really great and i very much appreciate the information uh please do reach out to connor you have his contact information and we'll make sure we share it out with a link after the webinar today but reach out with questions they are a great resource and if you don't have the help you need certainly that they'd be a great place to start too to figure out how to start protecting your practices better i also want to put in a plug for tomorrow's part two today was kind of the front end how do we prevent things from happening uh tomorrow's is the back end what happens when you do have a breach and then what kind of insurance do you need because these are very expensive and so how do you protect your practice and make sure that you're able to recover not only your data but that you don't sync yourself financially so steve was on the presentation today and we'll be able to help see if some of connor's predictions as far as insurance actually are coming true but please do join us tomorrow for part two uh and then a special thanks overall to um ia for sponsoring this series they've been great partners and they are experts in this just as much as first call solutions is so thank you all for attending and we'll send out a link with contact information and a chance for you to look at the slides and pull some of those checklists from this after the session thanks everyone
