[Autogenerated] great.
So typically eyes this a place where people fail on their assessments.
It is a place where we find areas of noncompliance.
It particularly amongst the rules.
Justifications.
Okay,
It tends to be the thing that they can turn around analysts a relatively easily,
but but without a whole lot of heartburn.
OK, right.
It tends to be the thing that they can say.
Okay, fine.
We need to do some justifications and go clean out all the garbage rules.
All right?
We know how to do that.
We can do it.
Okay.
So, findings, Yes, but really intractable ones,
not as much of some of the other requirements.
Okay.
And on the second assessment, you know where the people go wrong in b r u.
I think we've touched on change control, right?
Change control and not doing the semi annual rules.
Uh, and then just not accounting for, you know,
changes overall to the organization.
Know we bought this other entity, or we,
uh you know,
we decommission this whole thing and then migrated it over
just a new publication facility or whatever,
or we got a new third parts supplier right on.
No one told us about, and it's not my firewall rules,
but they have access to a network they do read to have
their own firewall that we can't manage.
Yeah, right.
So each so in terms of compromises that you would be
the scene or know about is firewalls.
This fire was an issue in terms off a common area of where compromise happens.
It is the thing that makes a bad situation worse, right?
Right in that it's not usually the sort of ingress points for the attack like,
Oh, this fire will rule was left open.
And now we can slither our way in, right.
There's usually some other point of attack.
But a lack of understanding of the rules leads to a lack
of effective network segmentation, right?
And a sort of inadequate level of egress.
Filtering then, means that the attack is more successful in X fill trading data.
Right.
So does it.
Does it burn the house down?
No, but is it the gas can that that makes the fire worse?
Often, I think if you look uh,
very the large box retailer that was taken in the US about five years ago.
That was a fun I mean the way in and the way out was the firewall rules when
we were right and the network segmentation was inadequate?
Absolutely.
And those air those are again for large,
complex organizations, not the easiest things to sort of suss out.
And that gave rise to some other requirements that I
think we'll talk about a little later.