Ulrich Seldeslachts with LSEC, The Digital Security Catalyst

SUMMARY KEYWORDS

Cybersecurity, CISO, Supply chain, Digital security, Industrial automation, IT/OT convergence, NIS2 regulation, Cyber resilience, Skills gap, Artificial intelligence, Gen AI, Pen testing, Vulnerability management, Data security, Risk mitigation

00:00

Yes, you need to get your cybersecurity house in order. You need to attend the Barcelona Cybersecurity Congress that is November 3 through the fifth, and meet the best cybersecurity leaders in the world to help you along on your cybersecurity journey and who are protecting our future. Enter promo code BCCpodcast26 and get your discount. I will be there. I would like to see you there. Talk soon.

00:34

Welcome to the Industrial Talk podcast with Scott Mackenzie. Scott is a passionate industry professional dedicated to transferring cutting-edge, industry-focused innovations and trends, while highlighting the men and women who keep the world moving. So put on your hard hat, grab your work boots, and let's.

00:51

All right, Rob. Once again, welcome to Industrial Talk. Thank you for your continued support of this platform. This platform that celebrates you, industry professionals all around the world, I say it once. I say it a million times. You're bold. You're brave. You dare greatly. You innovate. You collaborate. You're solving problems each and every day. And quite frankly, you're making the world a better place. Thank you for what you do. Thank you because you're the heroes in this story. All right, Barcelona Cybersecurity Congress. This is all about them. This is all about the podcast that will be featuring once again these cybersecurity professionals that, well, quite frankly, you need to you need to connect with in the hot seat. Ulrich. Ulrich is in the hot seat. I'm not even going to try to say his last name, but what we have here is we have a company called LSEC, the digital security catalyst. We're going to be talking about what keeps CISOs awake from losing sleep and all of that good stuff. Let's get cracking. Yeah, he was fun. That was a great conversation, and and he was hitting hitting on all cylinders. Definitely, he was nailing it, and yeah, you definitely. Here's the reality of this, and just just take this for what it's worth, right? It's always a human conversation. We have the technology. We want to connect our organization digitally. Connect our organization. We want to be able to be more efficient and leverage all of this wonderful stuff, so that we have a business that's resilient, business that has some sort of a way of just continuing on, but the reality is, is that with all of that, you have to have the conversation. You have to have people like Ulrich, and you're going to have to have these conversations to help protect your your organization. You just are. We want you to succeed. Industrial Talk wants you to succeed. To do that, it just depends on and and focuses on conversations. Ulrich, all his contact information is out there. It's a it's a great great great great insights into what keeps those CISOs losing sleep? You just the reality is that's what they there's stuff out there, but you know what's great? Here's the optimism: Ulrich and others, they have solutions. You don't have to struggle on your own. You don't have to. You just don't have to do this on your own. You you can have incredible professionals. Anyway, Barcelona Cybersecurity Congress. It's right around the corner. You heard it in the intro. Yeah, well, the the promo in the beginning. Still time. Still time. And and again, you need to have these conversations. All right, let's get on with this chat with Ulrich. Again, it is the company is LSEC, the digital security catalyst. We have his email. He's active out on LinkedIn. So let's get cracking with the conversation, welcome to the Barcelona Cybersecurity Podcast, aka Industrial Talk. How are you doing today? All the way from Belgium,

04:30

I'm doing very good. Thank you very much for asking, Scott. How are you today?

04:35

Thank you for asking. I'm doing well. I I can't complain because I get to talk to you, and I get. Here's the funny thing about podcasts. Just FYI, and I throw this out for anybody who's listening. Nobody complains. Now Ulrich is not going to complain because he's going to be talking about something that he's passionate about, and and that's always a good thing. So I, you know, it's funny. I go to these shows and nobody complains, and it's a nice thing. And I thank you, thank. For finding time, what time is it? It over there. It's now.

05:03

It's now quarter to six in the afternoon.

05:07

Yeah. So you're fine. Yeah. Yeah. You're okay. Anyway, again, Barcelona Cybersecurity Congress. Oh, it's just going to be there. He's going to be talking about stuff. But we before we have this, as I look at my form that he filled out, which is going to be a great topic. So, paper and pencils, anybody? We need to know a little bit about your background. Give us a little, just a smothering of your CV. Don't go into it. Yeah, not where you were born.

05:36

Wow, that's also interesting and exciting. But no, we won't go into that one. So I think I've been into cybersecurity for the last two decades, nearly three. So that's where the the grayness in in the hair is also coming from. But we've been around. We've seen how the business and the industry has been growing and and developing, and also how in this case the companies that need to deal with cybersecurity have been trying to cope with it and trying to deal with it, and at the same time, of course, you do see that cybercriminals are still there. They're still on the verge of just expanding their own business because that's mainly what it is. It's a business. There's of course the different calamities happening in the world, going from the east to the west, and and also there, of course, we do see quite a lot of havoc causing much of criminality still happening, and that also has its effect, of course, into business and into into Europe and into organizations and member states, so that is definitely what we see, and that's also, of course, in this case where I've been coming from over the last two decades. Before that, I was mainly involved into investment. I have been involved as an investor in many different startup companies throughout the world, still am today. I was doing investments as an investment director for both European and U.S.-based investment companies. I've been managing a couple of companies myself, and I have been before that also involved as a security director, both CISO as well as a security director for a couple of very large companies in Europe, mainly. Here, here's a here's a deal. Why I

07:30

can't understand this? Let's say we're all civilized individuals. I'm not going to go out and cause issue. Why? Why is why are there bad people doing really interest. Why? Why is that? What's the psychology about this whole cybersecurity? We'll go into this, but I just you pointed out it's just I just don't understand why it attracts bad people sometimes, and they just want to create harm. And and yeah, maybe there's a money. It's just it's just interesting.

08:00

Yeah, I think it's it's like anything else in the world. I mean, don't forget the cyber world is just a bit of a mirror of what's happening in the real world. It's it's the virtualized world, and like you have in the real world, I mean, there's thieves, there's crooks, there's murderers, there's all sorts of bad people, give and take a couple of world leaders in this case. So yeah, I mean those things do happen, and therefore we have we try to have a civilized world where these things shouldn't happen. The challenge is that in a virtual world, it's a bit more difficult to to catch the crooks because they can be on the other side of the world while you are trying to make your own business and do your own stuff here, and then it's pretty tough to catch them. I mean, when a thief enters your house, you will see that you will see there's physical damage. You will see maybe even the thief while he's running away. When you have that in in a virtual world, the only thing that you can see is that there's some numbers and IP addresses and some things that were passing along in a log file. If the if the criminals haven't done their best in in hiding that, that's the only thing that you can see. So the whys are exactly the same. I mean, it is really terminology is about okay. Try to to to raise some some funds to to gain some funds from somebody else by by just stealing or by extortion ransomwares. It can be just from skimming type of activity. So you just try to live off the land of somebody else, and trying to catch a little bit of small nibbles. But if you multiply that with a couple of millions, nobody notices, and so then it goes along as well. Or it can go totally the other side. It can be I want to put some other entity out of business, so it can be like. Industrial spear. There you go, or it can be putting basically a whole country or a whole civilization out of business, like we see today the both Russian attacks, North North Korean attacks, Chinese attacks, or even the U.S. attacks for that matter. So those things do happen on a daily basis.

10:20

Yeah. All right. I sort of knew that, but you you did a better job at what was rattling around in my cranium. All right, LSEC, LSEC, the digital security catalyst. That's what you have on the form. That's a that's an organization. It's a .org, quite frankly. Your email is leader. I'm looking at leader and security. Yeah, I was going leader sin security when I was I was messing up the name as I was looking. Anyway, explain to us just a little bit of why that's just just about the company, and then we'll get into what CISOs lose sleep over?

11:04

12:43

better

12:44

could also be on how to use open source types of technologies inside of corporates, and then we try to match those innovations with the end users and try to fill in some of the gaps that do exist,

12:59

and we

12:59

listen very carefully to what the industry is asking us, as in the end users, and we are also listening very carefully to what the industry of the supply side is telling us, where they see some challenges coming up and that they don't have a solution to fix something specific. So those are typically the types of activities that we are dealing with. So super highly interesting and very innovative.

13:22

Front line. I don't know how you keep up with that. It's it's just a dynamic market out there, just top to bottom. You know it, and that's amazing. I don't know how you do it. Thank you. But

13:35

it brings actually two things that that you just talked about. So the leaders in security is basically the org is the organization of all of those leaders that we work with. So therefore, is the association called Leaders in Security, because we do recognize that all of our members are very much leaders. They're at the edge of innovation and of new developments. And then the digital security catalyst is the the thing that you enter into when you look into us, and digital security catalyst. In this case, it means that we use digital security, but by bringing different things together, it becomes a catalyst. And so we we start to provide more energy and more speed into the developments of new ideas and new solutions. And so that's where the catalyst really comes out. So it's like the chemical process, but it's really by empowering different people, new ideas, and and bringing up some new innovations there as well.

14:31

15:37

Yeah, sure, Scott. So I think to start with, I think it's it's it's pretty important to to distinguish a small company, a micro enterprise, medium-sized company versus those large enterprises which are out there. I think if if you're one or the other, typically CISO will be part of a very large company or even some of the larger, smaller companies, but still, that's that's typically what it comes down to. So, I would point it more as as a role. So, CISO in the the acronym stands for Cybersecurity and Information Security Officer. So, in this case, the role is really how to keep up with today's cybersecurity challenges.

16:26

Yeah,

16:27

and the cybersecurity challenges are out there, but you have done a number of CISOs that are very much hands-on that are trying to to work with in this case everything in relation to the operational side, and then you have CSOs, which are slightly more working with paper and and trying to work with different policies, making sure that everything is outlined, and really being there as a driver, a manager in this case of an organization, so I refer to it as cybersecurity, information security. In principle, it's actually the chief information security officer. That's what the acronym really stands for. But we added cybersecurity to it because of the the really the core of the material today. Like is also was the case from in our side, we used to do information security, so now it's much more cyber. Of course, in this case, so second thing to consider is exactly what you were mentioning. I mean, manufacturing company, manufacturing company in this case can be large or small, whatever. But one of the challenges there is that it has both IT components as well as operational technologies. Yeah,

17:41

I T O T absolutely.

17:43

exactly, and so there. I think what what definitely is the case today. There's still this this backhaul when it comes to operational technology that needs to try to keep up. So many technologies out there in the field are what we call legacy, so they are technologies from 20, 30, 40 years ago. Sometimes machines that do very critical operations in type of manufacturing environment, which are running on an XP, so the Windows XP, and so that machine to master and to cyber secure is causing headaches by themselves. Now there are luckily some solutions out there, but those solutions are of course not, let's say, the easiest one, and you need to dig in a little bit deeper to figure out what you really need. So I would say definitely one of those challenges for those types of CSOs today is how do we keep those two things aligned? How do we keep them into control, and how do we make sure that on a continuous basis, those challenges that we see on those operational sides are keeping up and and can be managed at the same time as what we do within IT security? So that is definitely already a challenge.

19:01

Yeah, you're absolutely spot on, and I agree with you that the thing that that nugget that I sort of pull out of your statement is there are a couple. One, the the fact that you got to keep up with it. It's not just one and done. You think you're ready to go, but you got to have that those processes in place to say, hey, I'm still I'm secure. Yes, I have this this asset that is old, shall we say, but I need it, and it needs to be productive, and I can't have a vulnerability on that. the The other thing that I'd like for you to address. So many of these large companies, CISO got all the stuff, and they're all into it. They work with smaller companies, right? How does a CSO deal with these relationships with the smaller companies and that vulnerability that exists within that? Because I know if I'm a cyber guy, I'm going to go to that smaller and try to get into a backdoor or way of being able to compromise that. Bigger company, but I'm going to go through that smaller company. But and and and I still need that smaller company, even if I'm a big company. I still need them because they're providing whatever solution that I need to be successful. How do you? Yeah, yeah. So

20:13

absolutely right. So let me let me take a step back here, and that is, I mean, as a CISO, I wouldn't be too much awake at night because of this IT OT issue, but what would keep me awake at night and what does keep me awake at night, also being a CISO because I am a CISO in a number of companies, is is how to keep on making sure that the business keeps on running, and the business keeps on running thanks to in this case operational machines and IT for sure. It's also about, of course, people, and it's also about the different relations that we have as a business. So one of my major concerns in this case, as a manufacturer, would be: Is my supply chain still up to to the job? And my supply chain is, of course, maintained by different suppliers, so you're absolutely right. If one of my suppliers, in this case, is being hit by something like a ransomware, and they are basically stuck for a number of weeks, and they cannot they cannot deliver, and they are very critical in my supply chain, then is that is indeed also causing myself and my organization a serious challenge and issue. So what we have seen in the last couple of months and I would say year and a half is a number of large companies started to dig into this. On the one hand, because they had to. There's this thing. It's an acronym called NIS2, NIS2. You might have heard of it in in Spain. It's called NISDOS. So it's a European regulation in this case that is mandating large companies and specifically companies which are important or Essential to comply to a certain series of regulations. Several killings across the country, and it's raising the question. It has it has been specifically defined what those are, and then the member states, in this case, Spain is running a little bit behind in the transposition, as as it's called, of this regulation inside its its its its law, but still it's going to be there and it's going to be set out. And so, what it's demanding in this case is not only that, as an organization yourself, as a large company, as an essential or important operator, you do the necessary things. You also have to prove that you've done this when it comes to cybersecurity. Ah,

22:40

yeah. But then

22:41

23:53

is the nefarious component to that. You're absolutely right. What you just rattled off is vital. I get it. You small, you know, your supply chain has to be secure. Got it. I get all of that. It just seems cumbersome, and and it's and I as a company I need to keep rolling. I need to. I just and and it's just that the nefarious component to that is that it it might slow me down, and I don't like that. Is there a way of being able to approach this from a ease? I mean, and achieve that that level of of security.

24:34

Well, that's a bit of a challenging question, to be honest. I mean, like I said before, I mean, the the main thing that keeps us awake at night is making sure that the business keeps on moving. But the same is true there. I mean, it should not slow us down. To me and to us, like-minded in Caesar world as well, we see that cybersecurity needs to be an enabler for the business in in both the way that I described. But also, it should not stifle innovation. It should not stifle your actually doing your business. So what we've seen in a number of cases is that companies tend to go. I mean, is the old saying? As both of you have a bit of gray hair, so we can say that. You have hair. I have. Yeah, nobody's ever been fired for choosing IBM. I mean, the same applies, of course, these days. I mean, there's huge companies out there, the top cybersecurity companies. We won't name any names here, but what I'm hearing from many of my colleagues, and we see that too. Those solutions are very expensive, and those solutions are maybe not always fit for purpose. As in, we buy them because we think they are going to help us with cybersecurity, and they do. But they also give us quite a lot of additional work, and we need to have the expert people that will be able to implement them, that need to be able to configure them, that need to be able to maintain them. And sometimes we see that companies are not only using 10% of the capabilities of these types of major cybersecurity vendors, and I'm not going to call any names like CrowdStrike

26:12

or

26:12

Symantec, but I mean that's what it is. And so many companies are trying to take a couple of steps back and say, we don't need all of this. We need very specific things because our teams can manage these things, and that's the other thing that keeps us away at night. That keeps us awake at night. At night, that is, for instance, saying, can we find the right people to do this? Can we find the right resources?

26:39

Yeah, that's that's a whole nother conversation. I agree with you 100% Yeah, I I I get it. But

26:46

you know, there's this there's scarcity in in in the market today. It's not only in in Europe. It's not only in Spain. It's in the whole world about finding expert cybersecurity people. And I mean, there's there's there's a lag because we cannot train them all at the same time. We cannot educate them all at the same time. Even if we do so, they don't have the experience and and the the feeling in their hands to do the actual work. So there is this gap, and and then of course as the AI that you're probably going to ask me at some point in time,

27:17

I I will AI will help

27:18

for sure. But it's not going to do all of the necessary stuff for sure. No, the the the the

27:23

gap, the workforce gap is. I think it's vital. I think it's critical. I think it's a it's an issue that needs addressing yesterday. But I believe just the the silver lining in all this, you have individuals like you and your organization that are out there to be able to, for me as a manufacturer, keep on using that as an example that I can trust. I want to trust. This is this is important stuff. So I want to find individuals or organizations that I can trust, and I have to trust that your organization is going to sort of address that skills gap. And I think it's a good opportunity for that collaboration between a young, un-untested individual or whatever trying to get into the business and your organization, which you have, you know, a lot of experience. So I'm, I'm optimistic because I think there are a lot of good quality organizations out there that have your best interest at heart. That's I could be completely wrong, but i i have to I have to lean on that, or or I'll just curl up the ball and I'm not gonna I can't do anything. You know,

28:32

no, we see that too. And and honestly, Seth, I mean, it's one of the activities that we're working on today together with with Europe and and the 27 member states, because Europe recognizes the the skills gap, and it's actually being called capacity and capabilities. And so, what we try to do is work together with the member states, identifying within the member states where where the skills are, where the capacities, where the capabilities are, so we've been over the last two years, and I will continue for another two years, been identifying top experts when it came to pen testing. So red teaming, assessing applications, networks, systems, trying to find vulnerabilities, trying to help companies in mitigating those those vulnerabilities and potential risks, and there because of a challenge that we organized, we've basically received more than 350 applications for basically a contest where we've now selected 23 of those entities. It was under a program called Kisdi C Y S S D E, and so in Kisdi, basically we have selected those 23 top expert pentesters across Europe, and a couple of them from out of Spain in this case as well, and so the the entry. Result in this case really is that we see that the capabilities have increased in those companies. We have been able to assess them ourselves that they have the capacity and the capabilities of doing the stuff. We helped some of them out in even improving their stuff, and we also tried to create a sort of a level playfield when it came to trying to get also companies to do the assessments about which pen testers that they needed to invite on that basis, so we gave them this is the minimum level of reporting that we ask everybody of you guys to deliver to your customers. This is the minimum level of mitigation that we ask you guys to deliver to your customers. If you see these types of vulnerabilities and they're related to any sort of CVE, so basically the reporting mechanisms of vulnerabilities being discovered, then we want you also to share them amongst each other because that also increases the experience and the sharing and also the expertise amongst each other. So this is how we come up with a level of expertise which has been unprecedented before in Europe. I mean, we have to be able to identify them, and now the member states can pick them up, and they can publish them, and they can make sure that they become available in their own member states.

31:16

Yeah. See, I see this sense of urgency. I feel this, you know, tension that it just it has to happen faster. It's it's a it's a it's a big deal. Anyway, I'm so glad that you are on the front line. You're you and other organizations within Europe are on the front line. It's a big deal. Yeah. All right. I have to because you you you brought it up. AI tell us work with us. What what what pops into your head with AI and cybersecurity?

31:46

Scott, it's so fantastic, really. It is so fantastic. I mean, the the opportunities that it brings to us are just. I mean, we've been in into the use of of AI, artificial intelligence, for the last two decades. We started with just the basics on machine learning and how. I mean, we work with data. We work with real-time data on a day-to-day basis. I mean, if if things are coming in, those are bits and bytes, and those are numbers that appear, and those are IP addresses related to potentially a cybercriminal. So if that IP address pops up every once in a while, and it's we know it's related to the cybercriminal, that of course changes this IP address like 15 times a second. But still, we know that we can identify it with something which is more criminal. So if those things pop up inside of your look files, which are resilience of them on a daily basis. I mean, we talk about petabytes of data. So how can a human today understand what this is all about? And and it's it's finding the needle in the haystack, really, and and trying to get that out. So there is no human way today anymore possible to do that. And we we said that already 20 years ago. Now fast forwarding to where we are today, and seeing what the capabilities are of Gentic AI, LLMs, basically Gen AI all over the place is so fantastic. I mean, you can ask the the chatbots, you can ask your clothes, you can ask your systems to create for you basic cybersecurity policies. I mean, as a small micro enterprise, you have to pay otherwise an external consultant like at least a day or two to to draft your your policies. Now you can simply say, draft me a basic cybersecurity policy of 10 things that my people, which are not cybersecurity experts at all, need to focus on, and and you you review that and you present it to one or two experts and you ask them, okay, do you think this is really indeed sufficient? And then you present it to your teams, and off you go. I mean, it takes you like five or 10 minutes to do this. This is just incredible. At the same time, there's of course also a bit of warning. What we do see is that there's when people are starting to implement AI, both for cybersecurity as well as also for other types of of developments. That is this this discussion of warnings that we have to to relate to. I mean, we saw some news flashes happening over the last weeks and months, and those are real as well. We have to take those into account. Yes, the AI can go and wander around and try to invent new things because it doesn't have the information that it's looking for, or because it just picks up left and right, a couple of things, and then it starts to hallucinate for sure.

34:44

It does reach

34:45

out. I mean, if you don't border it, if you don't say, okay, yes, do search for stuff, but here's the limit. Don't go any further than this. And if people are starting to do this, and that's what we call guardrailing.

34:58

Yeah, if there's

34:59

no guardrail. There, then the AI wanders off and it starts doing something new. So, as a CISO, it would not keep me up at night. I mean, I'm pretty sure that the AI instrumentation that we have implemented, both for cybersecurity as well as for other tools, it's it's it's limited. I tell to my people and to my teams use it as much as possible because it helps you and because you know that it it needs to help you and you have to learn on how to use this.

35:33

Yeah, and that GDS model, you better learn how to use it.

35:37

Absolutely, absolutely, absolutely. But use it with common sense, and use it with whatever you get out of it. Review it and understand what it what it does, and check it and double check it and see if it can actually be maybe further improved. Yeah, so

35:52

I think we're at the tip of the iceberg with it. I think it's going to just definitely improve security over just globally. And I think to your point, if if I'm the old way, I had still a tsunami of data, and it's coming in. And as a human, I there was no way I was going to be able to sort of sift through that. But because of AI, yes, you can sit there and hammer on that data and really begin to see those nuggets of truth.

36:24

Yeah, and it goes also in other direction, Scott. So to give you another example, also in Europe we have another piece of legislation which is called the Cyber Resilience Act. So that mandates, in short, manufacturers of what's called products or digital elements (PDEs) which can be both appliances and pieces of software, so it mandates the manufacturers to deliver those things securely, and it is Europe saying

36:51

this. So,

36:52

38:35

See, the CRA. I have notes down here. The CRA, how far back are you? Let's say a Siemens. How far back do they have to go to ensure that their products, wherever they are, wherever they reside, because they're everywhere, comply with this particular act?

38:54

39:27

about.

39:28

So that that's a good thing. So if, however, in this case, any of those companies will bring out such a legacy product and they will bring it again into the market with some renewed types of materials, then it becomes a new product, and then that product needs to be also abiding by the CRA. But it's not only European products; it's also Chinese, US, anywhere in the world. So any product that enters into Europe, into the market, needs to follow those same guidelines and rules.

39:58

Yeah, well, that's. That's the right decision. I agree with that 100% There was this push that just because we could gather the data off of assets, okay, I can put a device. That device is going to be connected to some sort of cloud solution, but I'm going to stick it on a motor, and that motor is going to spit out data. Now we've sort of seen the convergence of both the the the device and the ability to assess the health of that, but it's all AI specific. But the reality is, is that it was it was like oh, what I would say, the wild west, where people were just buying devices and sticking them out on assets, and and each one of those, if they're not up to date, or just these little penetration points of of being able to sort of enter your network, just because, well, we got to get it. We got to get that information. I'm operating, and you know, and just goes on and on. I like that. I think that that's that's vital.

40:57

43:04

just typical, typical. You know, I I um I love what you're doing. I love the world of cybersecurity because it it it's it's one of those topics that people it it they lag. They just do. They don't want to have it because they just it is what it is. But the the conversations are really vital and important to just that global success. They are.

43:33

But but you know what I mean. Coming back to to to the the core of the the topic here. I mean, what keeps me up as a CISO at night as well is if I have to transpose this message that I know as a CISO into my management or my board, my colleagues in the board

43:51

people

43:51

of an of a manufacturing company that is still very much in the 80s, and where I'm trying to preach to the choir that this is what's needed, but then the choir is having earplugs in, in, and so they they're not they're not listening, they're not hearing what I'm saying. So then, as as a seesaw, what I'm going to do is I'm going to go for my next challenge because there's no point. I mean, you you can convince, try to convince the rest of the organization, going from the top and down to people, and and I mean no funds, but sometimes we do see people which are at the age of let's say next to retirements,

44:34

yeah, and they

44:34

have something from all of that cybersecurity. Yeah, just put it outside of the door, and that it for it's for my successor. He will he will take care of it, but it doesn't work that way. I mean that is also something that keeps me up at night because I'm I'm there and ready to present my my fancy dashboards with a bit of orange, lots of green, maybe a slight pinch of of red, just indicating. There are some things happening, and we have to do something about this. And here's my list of priorities. But my list of priorities is the same as the one that I presented to you a year ago. That keeps me away at night, awake at night, because then I'm also away in this case, because it it it basically it keeps me away from from my nights because I need to spend nights at the office in trying to make sure that there is no cyber incident happening in those specific environments. So that that is really what what sometimes concerns me, and where I need to put some consideration to the top level management to make sure that there's not only budget, not only financial, but there's also resources made available that these things can be implemented. It

45:46

always gets down to people. Every every conversation I have, it's the technology is great, and this is an exciting time for the technology to really help industry to succeed. Get it? It's all good, and yet people like you, old rich, that they're like all into it, and whatever your team and everybody else around is looking how that can help you gets down to that people, gets down to that individual that's sitting at that computer terminal, not understanding, you know, the implications of putting that thumb drive in because well, there's a picture, whatever. It it always gets down to that human side.

46:23

Well, you know what Scott? What we try to do is we we try to to help these these people as well, and and and also in this case our top management. We're working with with a number of of hospitals. In I I mean I I am so much looking up to those people because they they have to care for us as as humans. I mean, if something happens to you when you walk out, and and God forbid that that would happen, but that you walk on the street and and you're being hit by a car by something and you enter into a hospital and that hospital has had its next cybersecurity crash, it has an incident, and they cannot do anything because of this. I mean, imagine that you would be in that in that situation. So it's not going to happen, for sure, not. But I mean, we try to help these hospitals on a day-to-day basis by just going in there, by actually working together with them, understanding where they are today, trying to understand what that level of cybersecurity maturity is, it's it's an activity. It's called Medicis, and we work with with Spanish hospitals in this case, also hospitals in in Barcelona, in making this transition in becoming more cyber secure. And what needs to happen there is that we work with the cybersecurity teams, we work with the IT teams, we work with the management, and then we have to convince the board. So what we did is we try to set a specific date. Next board meeting is that moment in time. Okay, we're going to use one hour, and in one hour we're going to put you behind a screen, and we're going to give you an indication on how to use, in this case, cybersecurity at a very layman's level. But they will experience by themselves in this case on how this works. We use that for a range or a training activity or something of a kind, and so after this one hour of interaction, they really notice themselves what what's needed and and how it's needed and why they need to do things, and so this type of experience is so mind blowing and also eye opening that the next time that they think about it, they really invite somebody in to tell them, okay, these are the things that need to happen. So that's that's absolutely necessary that we try to train them on the floor.

48:35

Yeah, yeah, especially especially in the world of medical. Yes, of course. That's a complex IT world. Complex, changing all the time. Well, Ulrich, you were wonderful. You did not disappoint. You were fantastic. I can't wait to meet you in Barcelona. That's it's gonna be great. Couple of coffees. Look forward to meeting

48:58

you as well, Scott. For sure. Maybe,

48:59

maybe a beer. Maybe.

49:01

Oh, maybe even two.

49:02

Maybe a couple. Not two. Over

49:04

the weekend, I was in Barcelona Scott, and they have these these half liters, which is the standard level. So

49:11

if

49:12

if we ask two cervezos for favor, then we'll get two of those. So that goes for one liter of beer for each and every one of us.

49:20

I'm all in. I'm all in. Outstanding. Hey, if somebody wanted to get a hold of you, Ulrich, and they're saying I want to talk to him, is the best way to get a hold of you is LinkedIn?

49:30

Of course, yes. There you can find us. You can find the different activities that we're working on, and definitely also the links to our websites. So, as digital security capitalistic companies,

49:41

I love it, man. Yeah, you got. By the way, just FYI, you got to update your headshot here. Let's see what we got here. I'm looking at your thing, and I'm going, check out that nice flowing black hair.

49:57

Yeah, well, I mean, the the. The thing is, it has it has many different components. It has the the lightsaber. It has the castle in the background. So I mean, innovatively thinking about how to cyber secure my castle. That's what it

50:13

is. You're you're awesome. Well, thank you very much. All right, listeners, we're going to have all the contact information for Ulrich out on Industrial Talk. We're the Barcelona Cybersecurity Congress podcast, and if you're not attending this particular event, you will not meet Aldrich. And you need to meet Aldrich because he's a really good guy, and he looks like he's got a high beer factor. So let's just make sure you make it out there to the Barcelona Cybersecurity, and it's Barcelona. That doesn't stink either. All right, we're going to wrap it up on the other side. Stay tuned. We will be right back.

50:44

You're listening to the Industrial Talk Podcast Network.

50:49

All right, before we get into the conversation, I want you to be aware of a conference that you need to put on your calendar, and you have time. It is the Barcelona Cybersecurity Congress. It is necessary. You need to up your cybersecurity game. You're connected. You need to make sure that you're protected right here. This event, Barcelona Cybersecurity Congress. It is November 3 through the fifth. You have time November 3 through the fifth this year in Barcelona, and I'm telling you right now, the team at Farah who put this particular Congress on, the best. You will not be disappointed, and you know what else you get to do? You get to network with some of the best cybersecurity professionals from around the world. You need to do this. You need to put this one on your calendar. All of the contact, all of the information is out on Industrial Talk. I'm going to be there. I'm going to be broadcasting. I'm going to be talking cybersecurity with the best in the world. So be there. Put this one on your calendar. That is November 3 through the fifth. I'll see you there, Ulrich. Again, I can't say his last name. It's pretty lengthy. If I could, I would, but I can't, so I'm not. But if you went to the Barcelona Cybersecurity Congress and you're saying, "Hey, Scott, where's Oldridge? I would say he's over there, or he's here, or you need to find him, and then you you could try to say his name and put it on yourself. But one thing I can guarantee is that you'd have a great conversation, you'd have a journey forward into securing your operations because that's what they do at LSEC, the digital security catalyst. That's what they do. All his contact information is out on Industrial Talk. Yeah, you just need to get just do it. Here's the deal: everybody out on Industrial talk is connectable. You just you just find them. You you can even search it. So they're doing a great job with the world of cybersecurity. We're going to be broadcasting from this event, and and we, from our heart, want you to be there too. Barcelona's a great place. Thumbs up. But you know what's better? You get to be meet people like Ulrich and others who are just leading the way in this rapidly changing world that we live in, industrial world, and you just you just got to do it. Got to have that conversation. We want you to succeed, and a part of that success is making sure that your operations secure and you understand how to protect that, and that means finding those individuals. All right, I always say it: be bold, be brave, dare greatly, hang out with Ulrich, and you will be changing the world. We're gonna have another great Barcelona cybersecurity Congress conversation shortly, so stay tuned.