Episode 4: Why Are So many Cities Victims of Ransomware Attacks?

Jeremy Boren: Hey everyone, it's Jeremy Boren with Gray Matter. It's the latest edition of the Empower Up podcast. We're excited to have you here today. And this week, we're focusing on cybersecurity.

It's been in the news a lot. And we're going to be talking with my colleague, Scott Christensen, Gray Matter's cybersecurity lead. And we're going to be talking a little bit about Baltimore, which recently fell victim to a ransomware attack. but not just Baltimore there's been a bunch of cities in fact we're estimating 20 or 21 just this year alone that have had to face the consequences of a ransomware attack so we're gonna dig into that with Scott next and after that we're gonna get you some details about transform 2019 our upcoming user conference in Put-In-Bay Ohio at the end of July so be looking for some more

details about that and how to sign up.

Just a quick programming note, Scott is super busy, so we caught him via Skype and the audio quality is a little bit different.

Welcome, Scott. Thanks for being on the podcast. Thank you, Jeremy. Appreciate you having me.

Yeah, absolutely. I just wanted to start off by kind of asking you about how you got into the world of cybersecurity and with gray matter. I know every boy grows up thinking that they'll They'll be the master of the cybersecurity universe. So I'm sure that's your case.

But could you just talk a little bit about how you got into this and how you got with Grey Matter?

Scott Christensen: Yeah, it's interestingly enough, it's kind of a, I fell into it in a lot of ways. I was always the kid that liked to break stuff. So figuring out how to get into things, how to break into it, and that kind of became a hobby of mine. And as I was working, you know, you know, in the technology field, I started noticing, you know, there's an opening and specifically an industrial world for, you know, looking at cybersecurity incidents and how, you know, root cause and looking for how you can get into systems and living in Houston kind of made it pretty easy to kind of get into industrial space, specifically oil and gas.

And then I got real excited about researching and finding out how things break. And just, you know, after 15, 20 years, you know, became my career. Then when I had the opportunity about a year and a half ago to come on board with the gray matter and actually build something, it was a very exciting moment for me. So I decided to come on board and we actually kind of help our customers solve that cyber problem.

Jeremy Boren: For sure. Did you start off as a technical person and somebody who wanted to go into a technical field or is it kind of evolved after college? college?

Scott Christensen: It very much evolved after college. You know, I got a degree in marketing, believe it or not. And I was always leaning towards the tech side. I always call myself a geek.

I always speak geek. I'm the kind of guy that, you know, has a couple of different pieces of computers and gadgets in my office. And I always was exploring that as a hobby. And then over time, it kind of developed into a career for me.

And, you know, like I said, 20 years later, all of a sudden, I found myself this. This is what I do day to day. And I'm kind of lucky in that way. It's always was something I had a passion for.

Jeremy Boren: So tell me when you were getting into it and even now, are there places online, newsletters, sites that you like to read up to just stay up to date on what's going on in the world of cybersecurity, some favorites that others might look to as well?

Scott Christensen: Yeah, there's a couple of the, you know, first, you know, I'm a big fan of the FBI's ISSA program program and their ISAC stuff, they share a lot of detailed information on past investigation and incidents and things that have happened, as well as kind of forward-thinking alerts of be aware of these are the things we're seeing.

Jeremy Boren: So that's the

Scott Christensen: first thing is really reaching out and looking at some of the stuff that the FBI puts out there and Department of Homeland Security as well with their ICS cert stuff. It's very interesting to hear what is being found from that perspective. And then there's quite a few different tech hubs that are pretty good that I really enjoy. Joy, you know, CNET's got a pretty good one and Wired's got a few good ones and Gizmodo.

All of them have kind of a section dedicated to hackers and cyber incidents.

Jeremy Boren: Very cool.

So when

you're not reading up on cybersecurity, what do you like to do in Houston?

Scott Christensen: I'm a baseball guy. So, you know, go Astros. Yeah. Yeah.

So, yeah. So if I'm going to if I've got free time, most most of it's watching us watching Astros play or watching sports in general. It's pretty much my only hobby other than, you know, one kid now and one on the way. Oh, congratulations.

Jeremy Boren: Thank you. Thank you. That's awesome. So when you're in Pittsburgh, have you had a chance to see PNC Park?

Have you seen the Pirates play?

Scott Christensen: I have not yet seen the Pirates play. I've stayed next to it. It's a beautiful park and I'm very anxious to see, but it's not aligned me yet to go see it. I'm hoping to take a customer out in the near future.

Jeremy Boren: You've got to check it out.

Scott Christensen: It's really beautiful.

Jeremy Boren: I don't know if we're playing the Astros anytime soon, but that would be the ultimate, I guess.

Scott Christensen: Yeah, absolutely. The stars align, right? Right, exactly. Yeah.

Jeremy Boren: And I think I can make this segue work, actually. So speaking of beautiful ballparks, Camden Yards, Baltimore, Baltimore is up against a ransomware attack right now that is making a ton of headlines. And some of these seem to make to get a lot of attention and other ones seem to fly under the radar. And I guess it just sort of depends on the nature of the attack and how the particular municipality decides to handle it.

But in Baltimore's case, they've had a ransomware attack about two weeks ago. It's slowed down a ton of city services down to real estate transactions grounding to a halt. And so it's pretty hard to keep that quiet, I guess. And they seem to be really in the middle of it right now.

And so I guess the first question I wanted to ask you is, what is it about cities that ends up making them a target for ransomware attacks? Because I've been doing some reading up on it, and it looks like there's maybe 20, two dozen that have been identified just this year. So what is it about municipalities like Baltimore that seems to either make them stick out or make them more vulnerable?

Scott Christensen: There's a kind of a multiple reasons. And if you really look back, it's, you know, I was kind of doing some research on this, you know, just really wanting to learn more about the history of ransomware. And if you really look back, you know, starting around 2013, they kind of identified the first city, which was a city out of Massachusetts, was attacked by the CryptoLocker ransomware. And what we've seen since then is there's been about 170 incidents since then.

And what we've seen is they take advantage of the fact that cities rely heavily on legacy operating systems and legacy applications and tend to not be very good at putting controls or putting patches on. So it gives a very easy entry into the systems. And secondly, the whole value from a ransomware standpoint is the more data I can encrypt, the more I can

Jeremy Boren: ask for when I want to decrypt it.

Scott Christensen: So cities tend to have tons of data sitting on these servers. So being able to get on them and encrypt them and then ask for Bitcoin makes them a very high value target.

Jeremy Boren: Absolutely. And I think the other thing that seems to be the case is that it's a hard thing maybe sometimes to sell cities on investing in. because it's just like it's one of those things that you know taxpayers never notice until something goes wrong it's like the sewer system or something it's just like you know it's it's a very expensive uh you know the sewer system can be very expensive to maintain um but for cyber you know is is that kind of your sense of it is just that it's something that's so in the background

Scott Christensen: it's yeah it's it's kind of twofold you've got the tendency to think about you know your water system is perfect. Most people don't really care until the faucet doesn't turn on and the toilet doesn't flush. So it's very hard to justify investment unless something like this happens.

Jeremy Boren: So it's, you know, cities

Scott Christensen: for a long time, you focus on other areas, you know, because you don't want things about the day-to-day operations in a city. And you don't think about the water and sewage system. You don't think about the lights until they don't come on. You don't think about a lot of the basic kind of services they provide.

And then you look at the way the systems are are designed to their design, very trusting their design. I see you, therefore I must know you, therefore I trust you. Well, it makes it very easy from an attack standpoint that if I can get one entry into that system with all the interconnectivity within a city, I can then spread out. I can then encrypt and control much more of the environment because I can see everything.

They're very flat and very simplistically designed network wise.

Jeremy Boren: So they They make

Scott Christensen: very attractive targets from a cyber standpoint.

Jeremy Boren: What are some of those points of entry for somebody with ill intent on the Internet?

Scott Christensen: Well, if you think about it from a perspective, there's a couple of things. One is find a user that's willing to open up an email he's not supposed to. Think about all the city government workers who have access to email who are probably on the network. They see a file.

They see something salacious, something interesting they want to open up. I can open it up. And then if you look at industrial environments, the other aspect of it is look at our reliance on USB keys. A lot of configuration, a lot of changes in the environment, a lot of just basic updating happens through USB sticks.

And with a USB stick, you're circumventing a lot of what would be normal controls, you know, the perimeter, the air gap, whatever might be there in place. You can circumvent a lot of that by simply getting something loaded onto a USB stick. So therefore, I'm circumventing around and it makes it very easy. And then you also look at kind of the cost to actually attack a city.

It doesn't require a high level sophistication. It doesn't require a team of attackers. It can take a couple people with the right scripts or people willing to go buy the scripts on the dark net and be able to download them and just find any entry into the environment and how open these environments are and how many different entries there could potentially be. I just had to find one and then you're exposed because I've now entered into everything else.

So there's so many different attack vectors that make it very difficult. And then you go back to, once again, we still rely in the industrial world on a lot of legacy technology because it's just not practical to update it. So, you know, the aspect that I don't have the updates means I'm leaving myself open to all kinds of exposure points and not just current ones, but ones that have been around for 10, 15 years. I mean, we still see in the industrial world conficker virus, which is a virus that was mitigated 10 years ago on IT side.

We still deal with it on a daily basis on the OT side. So those kind of things make it a struggle and really make it much more difficult from a city perspective to control and protect themselves.

Jeremy Boren: Yeah, absolutely. Absolutely. And some of the reporting that I've seen on Baltimore's case, you know, we don't actually know at this point. The FBI doesn't see or at least they're not saying who might be behind the attack.

But the theory at this point is that it's not like Baltimore was specifically targeted and they went out and said, well, we're going to go after that city. It was more of like a, you know, they were that the cyber criminals were doing a scan looking for, I don't know if I'm going to use the right terminology, but like an open port or a vulnerable port. And they came across it. And so it was opportunistic rather than targeted.

Scott Christensen: Almost all the city attacks seem to be opportunistic because from the attacker standpoint, they really are not looking to prove a point. this is a revenue generating model for them. So they're looking for low hanging fruit, easily to attack that makes their investment worthwhile. So when they go to do a scan and you can look at, you know, there's tons of things like Shodan where I can do a scan of the network and I can look for specific systems that are publicly addressable.

So I can say, I want to look for a specific manufacturer or vendors devices, and I want to look for a specific version of that. And then I'll just do a scan of the network and I'll look out and see, can I find this PLC with this version on it, knowing that it has a weakness to it, I can then take advantage of that weakness because of these tools that are out there. And because of the fact that we're putting more things connected than ever before, I can now scan the network just like I could scan a server, scan a PC, anything I want, but I can actually scan for a PLC or for a SCADA system or for multiple different things and look for a specific vulnerability. And I don't really care who owns it.

I just want to get access to it. So if it's publicly addressable and it's openly vulnerable, I now have access to it. I just have to get my payload delivered to it. So then I now have a system that I really don't care what it was.

I just want the owner to pay me money to get access back because it's all about the Bitcoin. It's all about driving those dollars back to how much data I encrypted. And if you look at the city of Baltimore, you're looking at it, they were basically, even their business model around it was charging per server they encrypted scripted a Bitcoin price. And I think it was 13 Bitcoins for everything.

So about $100,000. And the other aspect we see this is because it is revenue generating. I did some research and looked it up and saw that about 17% of cities pay the ransom. So if you look at it, 17 out of 100, I send it out, I spam out, I get everything I can.

I just need one or two and it becomes profitable for me to do this. So I continue to do this.

Jeremy Boren: Right. And I mean, that's a huge kind of almost ethical debate going on right now on how to contend with these attacks. Right now, Baltimore's mayor, I think it said that, you know, they're not paying, although that could change. I guess if nobody paid, these sort of attacks might not persist, right?

Scott Christensen: I mean, in theory, anyway. Yeah. Theoretically, if the market goes away, the business goes away. So So if you look at, and I was really thinking about, you know, what have we seen, who we've seen successfully as an industry get away from ransomware as a target.

And if you look at hospitals, so early on, hospitals were very easy targets. They were commonly targeted for ransomware. So hospitals started upgrading their systems. They started creating policies in place.

They created backups so that they would not have to pay the ransom. And if you look, the market has shifted away from hospitals as a common target for ransomware and move much more to municipalities and some other more public sector systems. So it's kind of interesting to watch that shift and you watch why did that shift happen? It's because the business model had to change.

It's not profitable to go after a hospital as it is to go after a city now. So you end up with a different kind of attack vector.

Jeremy Boren: Right. So we've talked about some of those attack vectors, you know, spear phishing attacks, a USB port, finding a, you know, an addressable port when kind of looking for an opportunity. So what are some of the ways that a city, at least in general, could protect itself to prevent those sorts of things? You know, is there a way to protect itself if an employee, you know, clicks on a link that they should not have clicked on?

Scott Christensen: Yeah, so I mean, there's multiple different things you can look at. So we started talking about, you know, legacy OSs. So the simple answer, you see it all the time in IT, you say, well, I patch or get rid of those legacy OSs, get modern OSs. Well, that's not always practical.

So what do we look at from a practical standpoint? Well, can I patch? Well, that's not always going to happen because I can't take the water offline so that I can patch my systems. So my next step is, do I have controls in place?

And by controls, I mean, do I segment my network to make sure that the person clicking on an email does not also have clear shot and view to my production environment? Do I have a segmentation in place? Do I encrypt my traffic? Do I have intrusion detection so that if something changes in my environment, I'm aware of it early in the cycle, not when everything is locked down.

So you start putting a lot of these things in place. You put controls. You put visibility. responsibility and if you look at like the NIST the DHS NIST framework you start moving through a maturity model you start with do I know where my risks are have I identified those if I've identified my risk do I have protections in place and then as you move through it do I get I go from a more reactive standpoint to a more proactive am I detecting threats as they happen is am I do I have an incident response and recovery plan so I think a lot of times what we see with municipalities is they just don't have a plan in place if we get attacked what do we do And even when they do, a lot of times the plan in place is revolving around mitigating the virus, not keeping operations up.

And you've got to think continuity is probably the key to a recovery model is how quickly can I keep operations up? Do I have to go to manual? Do I have the manpower to support manual? Do I have a backup, clean backup that I can restore to?

These are all the kind of things that you should have in place to help mitigate and minimize the impact of an incident when it happens. And I think we're seeing more commonly that it's not if it's going to happen, it's when it's going to happen. I mean, just since we started doing this conversation, you know, last night, city of Laredo was attacked with ransomware. So we're already seeing that, you know, we're on now on number 21 of the year.

So we're already seeing more attacks. So do they have a plan in place? Do you have systems shut off? Do you have that incident response plan?

I think those are kind of the key components to kind of putting together a plan when an incident happens. Sure.

Jeremy Boren: What kind of costs did cities incur when they have to deal with this and maybe they're caught a little flat footed?

Scott Christensen: Yeah. Interesting. If you look at kind of the case study that most people in the industry are looking towards, it's the city of Atlanta from last year. So similar incident, city of Atlanta got hit with ransomware.

They stepped up right away and said, we're not paying it. Brought in the FBI, brought in a secret service and started doing everything. As of right now, the cost has exceeded $17 million for the city of Atlanta to start remediating and getting back operational. And they still, over a year later, they still have systems impacted.

Jeremy Boren: Did they actually pay the ransomware?

Scott Christensen: No one's really sure. Sure. That's one of the other things that we struggle with in the industry is a lot of times there's a lot to be learned from the exposures, you know, the failures, the times we felt that fell down. But a lot of times the common feeling is I don't want to share.

I don't want to say, you know, it's embarrassing to me. I've been hit. Whereas those are lessons learned. You've been hit.

But why don't we help make sure that we find more information and share information with other cities so they can prevent the same fate as you had? If you look at Baltimore, they were hit 15 months before and they didn't do a lot of the best practices. They didn't share the information. And sure enough, 15 months later, now they have an even bigger exposure and attack.

So a lot of times we have to learn the lessons from previous attacks and sharing with your peers is really key. And I think that's that's one of the things in the municipality world we're not really good at. We don't share. Here's what happened to me.

We're more embarrassed. so we don't share that information.

Jeremy Boren: Right. And the other thing that seems to be the case is that it's not like there's a surefire way to beat this kind of attack once it's occurred. Like, it sounds like the key that's being used to encrypt all of this data is not something that you can really help to crack or unlock, right? Even with government resources.

Scott Christensen: Yeah, they're saying even the NSA with the highest technology cannot break the encryption. on this Robinhood ransomware. That's how harsh the encryption locks it down. You need the crypto key or you need to rebuild your system.

So that's your two choices or pay the ransom, right? So, I mean, if you look, so you look at it, you know, when you're given that as your choices, you start putting together the plan. I mean, I've worked with organizations that have been hit by ransomware and they were willing to pay. They didn't even have a process to get Bitcoin though.

So they were down for multiple days. They were willing to pay because they were so desperate, but they didn't have a process. They didn't have a supply chain for acquiring Bitcoin. So those are the kind of things that you start thinking through.

What do I do? How do I recover? How do I respond? If you're willing to pay or not, that's a self-judgment choice you make.

But if you decide that you'd be willing to do it, do you even have a mechanism for acquiring Bitcoin? So those are the kind of things you've got to really think through. And that's where you try to work with a partner who's seen these kind of things, someone who allows you to kind of communicate. It's kind of key to what we do.

Sure.

Jeremy Boren: And the really scary thing, and you kind of touched on this earlier, is that, you know, does it take an extremely high level of technical expertise to pull off this type of attack? I think you mentioned that a hacker could even purchase maybe a script or a methodology for doing this, which suggests to me that that's almost like an off-the-shelf dark web solution, you know, that they could use to launch this. Do you have to be a computer science major to pull something off like this?

Scott Christensen: No, absolutely not. There's a whole secondary business black market for selling scripting software. You buy an application license just like you buy a copy of Word. You go out there and say, I want a suite of tools that do A, B, and C.

And I put together a shopping cart and I pay for it. Real common, if you look about three years ago when the Ukrainian power incident happened, They were hit by a targeted attack called Black Energy. You could go online and you could find Black Energy for about $70. You could buy the suite of tools.

So I didn't have to be an expert. I don't have to be able to write code. I don't have to be able to script language. I could simply go out and say, hey, I want to do this, this, and this.

I want to look at these kind of targets. Let me put a shopping cart full of the type of suite of tools available to me and download. And then I can just then go to scanning networks, finding information, and then try to get my tools loaded on. So it's it's the level sophistication is extremely high on the application, but the hackers themselves don't necessarily have to be sophisticated coders anymore.

Jeremy Boren: And that's scary.

Scott Christensen: Absolutely. It's a whole secondary market out there for this kind of thing. If you look last year, a perfect example is you look last year at our transformer that we had a former hacker come on board. He told everybody, I'm not a I'm not a coder.

I don't do that. I get people to write it for me. I buy the tools that my job as a social engineer, how to get it delivered to the right place.

And if you look at the biggest hacks out there, most of them were toolkits.

Scott Christensen: They were bought, purchased or acquired from someone else and then deployed by a group of people. So it's really it's becoming the market. It's more sophisticated, but the individual attackers don't necessarily have to be.

Jeremy Boren: Right. Right. So when you've worked with municipalities or companies, do you typically are you hearing them from them at the prevention stage where they're like, yeah, we get it. We want to we want to stop this from from potentially happening to us.

Or is it more often? Yeah, we're in the middle of a problem and we need to figure it out.

Scott Christensen: If you ask me five years ago, it was almost always in the remediation. We got hit. Help us fix it. What I've seen the market do over the last two years, three years, is people are starting to realize the attacks are real and they don't want to wait to be a target.

They don't want to have that victim mentality, wait for it to hit them. I always think I use the analogy a lot of times of the security on your house and you put the sign in the front yard. It doesn't really matter if you have the alarm or not, if it's monitored or not. Just the sign in the yard makes you less of a target.

So a lot of companies are going through the process of putting the sign in the yard, going through and evaluating where the risk is and just not being the low hanging fruit, being the easy target.

Jeremy Boren: Sure. And that's just enough of a deterrent to to in a lot of cases help them out. Right.

Scott Christensen: Absolutely. Yeah. I mean, it's that's it doesn't have to be a massive cost exercise that, you know, if you look at remediation, it's going to be a massive cost exercise. But if you look at a prevention standpoint, it's much easier to prevent.

You go through, do some best practices, clean up a few things, don't allow your legacy OSs to be targeted publicly, prevent scanning of your environment, that kind of thing. Those are all low cost things. And it's things that you can do to really clean up and make yourself less of a target. And then you build maturity.

You don't boil the ocean, right? You try to do it one bucket at a time. You find little things that allow you to move up your maturity and become less and less of a target to some point where you feel you're a stable enough and mature enough organization to feel happy about it. I always talk about security as a trip, not a destination.

You're not going to ever get to a point where you plant the flag and say, I'm done, I'm secure, just because the attacks are always evolving and maturing. So you have to be doing that as well.

Jeremy Boren: Right. And they are. But like we just talked about, I mean, there's no there's no threats out there. There's you know, we we named a couple of them today.

Robin Hood and, you know, Convictor and others that have been around so long that, you know, at least take the easy wins away. from the cyber hackers out there, right? Exactly. Make them at least work to try to come up with some new method.

Scott Christensen: Exactly right. Exactly right. You know, the unforgivable sin is not learning from other people's mistakes, right? You know, if I can easily fix some things, remediate things, if it's just, hey, let's make sure our Windows XP systems are not publicly addressable, that's not a highly cost expensive expensive effort, but it prevents a lot of these attacks.

And it's amazing how often that's something that's overlooked. The other is you look at awareness programs. We talk about opening up the email. Having a policy and having an education and awareness that your employees know, don't click on a link.

Or know who the sender is, making sure it's not an alias. Those are very basic, cost-effective things. Making sure that your people are aware of why you don't do these things. We don't want to be the next Atlanta.

We don't want to be the next Baltimore. Let's make Make sure we validate where our emails are coming from. Let's make sure that we don't have access to every system, you know, auditing our logs. These are all very cost effective things that slowly, slowly raise the bar when it comes to best practices and security and makes you less and less of a target.

Jeremy Boren: And are those all things that you and your team can do for a client?

Scott Christensen: Absolutely. So if you look at the way we've been working with clients, a lot of times we start off with, let's identify the risks. Let's quantify where the costs are. Let's rank by criticality my potential vulnerabilities.

And then put together a plan for remediating. Oftentimes people think it's going to be this large, expensive effort to build an OT cyber practice. But a lot of times it's simply identifying some low-hanging fruit, some targeted things. Going and seeing if we can't remediate those.

Putting controls in place. A lot of times we look at water utilities because their low margins are very hard for them to put in things. So we put in plans around how do I protect that? So we have tools in our toolkit that let us do it at a very cost-effective way.

Jeremy Boren: Cool. So one other thing I wanted to get to before we close is our upcoming user conference, Transform, which is July 30th to August 1st. And people can go to graymattersystems.com and sign up. We still have early bird rates through the end of the month.

But I know you're going to be there, Scott, and you're going to be talking, of course, about cybersecurity track. What are some of the things that you think people who go will be able to take away from what you're talking about? I know anatomy of attack is one of your topics. Can you tell us about that and some of the others?

Scott Christensen: Yeah, absolutely. So anatomy of attack, walk through some of the basic ways an environment is exposed and things that you can do to fix it. And there's a lot of value. We also go around the technologies and the tools that we use and what are available to you.

But I think to me is kind of referring back to an earlier statement I made. It's not just what we do in the tracks. The fact that we also bring in success stories and other customers and talk to them. What are you doing?

What is working for you? What did you fail at? That way there's this sharing of information. You know, we will have a, you know, for example, we'll have a couple people from Penn State talking about what they did to secure the building operation systems.

Jeremy Boren: You know, it's very critical to learn, you know, what did they do?

Scott Christensen: They had a lot of success and they did it because they're an educational. They did it at a very low cost point. So they were very successful in protecting their environment in the same way that a municipality might. So, you know, getting a chance to talk to other customers, other partners, other your peers and finding out what they're doing is probably to me the highest value we can give you is that you can get into a room, talk to them and see what they're doing and what's working for them.

Jeremy Boren: Absolutely. All right. Well, Scott, I want to thank you for being on the Empower Up podcast today. And we'll make sure to share more information with folks about how they can get in touch with you and continue the conversation that we've had today.

and geez, it's amazing just, you know, that we set out to talk about Baltimore and, you know, in the 24, 48 hours, another city has been affected by it. So it's just scary to think about.

Scott Christensen: Absolutely. I mean, we're looking at two to three a month now. So, you know, it's not, like I said, it's no longer a matter of if, it's a matter of when.

Jeremy Boren: Thanks again, Scott. Appreciate it. Thank you, Jeremy.

All right. So not only are you going to have a chance to hear from Scott Christensen at Transform 2019. We have two keynote speakers that I just want to take a few minutes to introduce you to. The first one is Doug Bellin.

He is with Amazon and he's a key presenter about Amazon culture, the evolution of amazon.com and he talks about their fulfillment centers as well. And Doug kind of gets into a lot of the secrets behind Amazon, its success and its relentless focus on customer experience. The other major presenter that I want to let you know about right now is Cassandra Worthy. She's the founder and chief enthusiasm officer of We Are Change Enthusiasts, LLC.

She does a lot of corporate speaking and training for corporations, but she also has a fantastic background with Fortune 100 companies as an innovation leader. and she spent a good deal of her career so far in consumer packaged goods, particularly with Procter & Gamble. So we think that both keynote speakers are going to be a great addition to Transform, and check them out right now.

So the big goal right now is how industrial businesses are looking at new technology and implementing those in their businesses to start driving new change. It's not an easy thing and the reality is that most people are very reluctant to go all in to a new technology.

My very first major change challenge in my professional life came after I'd been working for about three years at Procter & Gamble and I transitioned into a recently acquired business. Day one, I walked into a completely different business culture. I was lost. I was frustrated and I felt like a fish out of water.

You can either get bitter or you can get better. I started to slowly embrace this idea that I had choice, that I had power and control over my own work experience. And the more that I leaned into that idea, I stepped into a major moment of opportunity.

Jeremy Boren: You just heard from Doug Bellin of Amazon and Cassandra Worthy of We Are Change Enthusiasts, LLC. Both of them are going to be keynote speakers this year at Transform. I encourage you to check out the whole lineup of events. We have a lot of other speakers to offer you and breakout sessions.

You can find out all the information you need at graymattersystems.com on our events page, or you can reach out to us directly on LinkedIn. Follow us on LinkedIn as well with any questions that you might have. And as always, please rate and review the Empower Up podcast. It really helps spread the word about what we're doing.

And it also helps gives us ideas for other topics that we should be covering. So if you have suggestions for the podcast, you can also reach us at empowerupatgraymattersystems.com. And if you're on Apple Podcasts in particular, please go ahead and rate and review us there. you