Now, CERT, as an agency, which is often the public face of cyber-security, publishes a list of 10 critical controls, and I would encourage members and people watching at home to go to cert.govt.nz to dig out this list. It highlights that some of the most simple things are the things that are the best at preventing this kind of attack: patches on software systems, multifactor authentication and verification—a large number of attacks where these simple things have not been done. Providing and using a password manager—giving people the tools to have a strong and unique password, and configuring logging and alerting so that you can see who's in the system and doing what, securing internet-exposed services where there are things that have drifted and are no longer used within a computer network so that those things are removed from the system if they present a vulnerability. Segmenting systems, testing back-ups, having back-ups ready to go immediately a problem is identified to replace a system, thus reducing costs on the enterprise and protecting the data that is within that system if the system can be switched over to a back-up version very quickly, and, of course, protecting from ransomware and the malicious effects of it, and so on. There is a list of 10 cyber-security critical controls that can be put into place very easily. 