RON: That makes perfect sense. And you can even go in and say, “On our annual security audit, we found that we didn't have the disaster recovery backups that we're supposed to have.”. Lots of reasons. And that's a great point.
You touched on the passwords, I'd like you to mention and dive in, just for two or three minutes if you want, about [how this presents a] great opportunity to review security top to bottom. Are we on the right eAuction software? Do we have the right disaster recovery and backup? Are we painting ourselves into a corner where we don't have a backup and now we have to rely on the relationship with the previous vendor?
Do we want to add additional factor authentication? There's a lot of different things when we're talking about mobile and hacking and people stealing phones and replicating phones and things like that. So I wanted you to talk just briefly, because passwords are much more about security than just passwords, right? So this is a great opportunity when you're migrating, choose an opportunity to say, “Well, not only am I migrating to a new B2B auction platform form, I'm migrating to new technology and a new set of higher standards around this.”
CHRIS: Absolutely. There are a couple of facets there that you pointed out about a B2B auction website, and I'll dive into those and possibly mention a few more. First of all, multifactor authentication and being able to deal with the reality that, for a system of interest that has a lot of transactions, and could create a target of opportunity, and just like a really interesting system for hackers to go after, it becomes exponentially more and more important to focus on security.
This is just a reality in the context that we're in nowadays with operating a public-facing web property. Two-factor authentication in its classic form tends to be email or text-based verification. A lot of security analysis has gone into recognizing that even that isn't very secure and it's relatively easy to breach, but it's significantly better than only having a password.
And then, whenever you look at passwords, passwords themselves can be breached pretty easily with brute force approaches because we're dealing with human beings that tend to not use password tools. They're trying to remember everything. They're busy. “I'm just going to set this account up and then I'm going to make it better later.” But they never do.
So it's possible for us to use breach detection of passwords to discover if this password that they're using has been breached or used, or it's been found with their email in that password in a black-market list that's been sold. Well, our B2B auction site can subscribe to that list and include it as an auditing mechanism and let the user know, ”Hey, the password that you put in here is reported on this blacklist that we have access to as having been breached. So you need to update your password now to access the eAuction sites.”
Then we can do things like providing simple two-factor authentication whenever they're accessing basic things like using the site, but a more robust authentication that is more significant. They can include security questions or an authenticator application whenever they're trying to do something more substantial. Maybe they need to withdraw a large amount of funds, maybe it's over $100,000 or over $10,000, whatever that threshold might be. We can absolutely set these pieces of infrastructure up.
At the end of the day, there is a human factor to how to run an online auction where you're going to have a law of diminishing returns with too much security and too much diminishing impact on the user experience. And unfortunately, this is the reality. It's like a no-win situation if you go too extreme on the security and it's a no-win situation if you don't go extreme enough. It's a constant balancing act, and you're going to end up finding that you're going to be tweaking it towards more secure constantly over time.
You want to work with a custom online auction vendor who's looking at this, who's even considering it, and has executed it at the level of intensity that it will probably get to in your industry within two to three years. They should have already executed that when you're engaging them. We can tell you that we've absolutely done this.
We work a lot with government entities. We also work with a lot of HIPAA-compliant websites, medical portals, and apps, and of course being in the eCommerce space, PCI DSS compliance, among other things. We run into the fire, whereas a lot of vendors run away from the fire. We really enjoy these types of projects because we've invested the time to really get good at them.
It's a really key area in B2B auctions, Ron, and it's interesting how nowadays even two-factor authentication, which there was this perception three or four years ago that that was a very robust approach. It's constantly getting breached.