1
00:00:00,000 --> 00:00:02,900
Well, hello ICS Village.

2
00:00:02,900 --> 00:00:21,900
I'm coming to you live from sunny Amsterdam and today I'm going to be talking about critical infrastructure and a presentation that I gave recently at the United Nations after an invitation at the United Nations Institute for Disarmament Research.

3
00:00:21,920 --> 00:00:23,920
So, I hope you enjoy it.

4
00:00:24,460 --> 00:00:28,000
If you don't know who I am, that's fine.

5
00:00:28,080 --> 00:00:43,600
I'm certainly not a household name, but my name is Chris Kubecka and I am the CEO of two companies, one in the Netherlands, one in the UK, dealing with cyber warfare and ICS, IoT, and IT proactive security.

6
00:00:43,600 --> 00:00:47,240
I'm also a Distinguished Non-Resident Fellow at the Middle East Institute.

7
00:00:47,520 --> 00:01:01,180
And previous to all of this, I used to head the Information Protection Group for Aramco and I was a Aircrew member and was in Space Command dealing with many control systems.

8
00:01:01,180 --> 00:01:22,900
One might say I'm also a bit of a reformed hacker or at least now a reformed unethical hacker because I come from it from a slightly different point of view where I started as a kid being a black hat hacker and got busted at the age of 12 doing very, very naughty things.

9
00:01:23,200 --> 00:01:28,480
So, why is this particular talk and this topic important?

10
00:01:28,480 --> 00:01:33,840
Well, one of the reasons is we now live in this wonderful digital world.

11
00:01:33,840 --> 00:01:42,120
We're able to have DEF CON in the ICS village remotely and we depend absolutely on technology.

12
00:01:42,120 --> 00:01:51,720
And if we want our modern world to continue, we have to deal with the simple fact that hopefully our technology will not be used to kill us.

13
00:01:51,840 --> 00:02:05,600
So, the United Nations has been involved a little bit late in the game and they are very concerned about member states and their responsibilities securing the ICT assets within their own borders.

14
00:02:06,720 --> 00:02:23,900
So, in 2015, I did say they were a little late, a group of governmental experts published a report, Report H, that stated four main facts that every member state is supposed to secure its own country's cyberspace.

15
00:02:23,900 --> 00:02:28,460
That includes IT, IoT, and ICS security.

16
00:02:28,460 --> 00:02:34,180
In addition to that, every single member state should have a computer emergency response team.

17
00:02:34,180 --> 00:02:35,260
Fantastic.

18
00:02:36,000 --> 00:02:59,640
And also with that, if there is a country where an attack is coming from and then transiting through, that if you are a transit country, say like something coming through the Netherlands, aiming at Austria or the United States, then that transit country and their telecoms should be able to provide aid.

19
00:02:59,640 --> 00:03:19,900
And also, any member state that's under major attack should be able to exchange information on the incident and also technology, and if at all possible, additional subject matter experts like CERT teams to assist in a major attack.

20
00:03:19,900 --> 00:03:32,780
Now, this sounds all wonderful, lovely, jubbly, and at the UN, the majority of member states did agree to this particular report and thought that these things were very, very important to have.

21
00:03:32,900 --> 00:03:45,560
However, at the UN level, at this global scale, lots of government experts don't actually realize what's really going down on the ground.

22
00:03:45,820 --> 00:03:49,580
So, this is one of my favorite quotes.

23
00:03:49,680 --> 00:03:54,820
It is, never underestimate how dependent you are on your information technology and systems.

24
00:03:54,820 --> 00:03:56,540
It's become like oxygen.

25
00:03:56,580 --> 00:03:58,840
You think you can live without it, but you can't.

26
00:03:58,840 --> 00:04:05,240
And this was a quote from the CEO of Saudi Aramco after the 2012 Shamoon attacks.

27
00:04:05,260 --> 00:04:25,140
And what you're seeing here is a picture of one of the events that happened after the attack, where there were miles and miles of gasoline trucks that could no longer be loaded up, because the industrial IOT system in between was no longer functioning,

28
00:04:25,140 --> 00:04:27,100
nor were the payment systems.

29
00:04:27,320 --> 00:04:32,160
Now, Saudi Aramco experienced the world's worst cyber warfare attack.

30
00:04:32,160 --> 00:04:38,180
It isn't spoken about too much, because I'm currently the only person authorized to actually discuss it.

31
00:04:38,380 --> 00:04:43,940
In about two hours, 85% of their IT systems were lost.

32
00:04:44,020 --> 00:04:58,640
And when I say IT systems, this is a VoIP phone, this is the payment systems, this is the HR data, some of the backups were wiped, some of the firewalls were affected, and there were two production plants were actually affected.

33
00:04:59,060 --> 00:05:02,180
And unfortunately, Aramco was unprepared.

34
00:05:02,180 --> 00:05:10,840
They believed, you know what, barely anybody knows about us, unless you're in the oil and gas industry, so why would we ever be a target?

35
00:05:11,020 --> 00:05:19,260
Well, unfortunately for them, around the same time, Arab Spring was going on, and attacks that had recently occurred.

36
00:05:19,260 --> 00:05:24,280
And Saudi Arabia and Iran are not very good friends.

37
00:05:24,720 --> 00:05:37,180
And because of this lack of understanding, their systems, both on the IT side, IoT side, and ICS side, were not very prepared or secure at all.

38
00:05:37,700 --> 00:05:48,660
Now, in addition to this, the attack affected countrywide internet connectivity, taking out two of the three mobile providers, because they actually severed the internet connection.

39
00:05:48,760 --> 00:06:03,060
And Aramco provided internet connectivity for emergency services, hospitals, schools, police stations, universities, and you see where I'm going with this, it was not a very nice picture.

40
00:06:03,340 --> 00:06:13,600
14 days after the initial attack, Qatar's national oil company, Rasgas, a joint venture between Qatar and ExxonMobil, was hit with a different variant.

41
00:06:13,740 --> 00:06:20,000
The Shamoon variant for Saudi Aramco had a burning American flag, the Qatar one did not.

42
00:06:20,400 --> 00:06:35,300
And what we estimated after the attack, if the two companies had actually fallen and could not restore themselves as quickly as possible, we estimated that a barrel of oil could hit as high as $450 per barrel.

43
00:06:35,700 --> 00:06:42,980
And if that had happened, it would have caused a domino chain of global economic and supply chain damage.

44
00:06:42,980 --> 00:06:54,780
We see COVID right now where it's causing a lot of issues, but imagine if nobody could purchase oil, no cargo ships could purchase oil because it would be too expensive.

45
00:06:54,780 --> 00:06:56,760
You see where I'm going with this.

46
00:06:56,760 --> 00:07:03,780
We teetered precariously on the edge of a modern age, bronze age collapse due to a cyber malicious attack.

47
00:07:04,280 --> 00:07:16,460
The reason why I know about this attack in depth was because I was the person requested to help recover international business operations and establish their mature digital security and cyber threat intelligence.

48
00:07:17,480 --> 00:07:24,900
So one of the things we have to understand is the vast majority of critical infrastructure is actually privately owned.

49
00:07:24,900 --> 00:07:32,860
And there are limitations to how much a state can regulate, legislate, and ultimately dictate to the private sector.

50
00:07:32,860 --> 00:07:37,280
There are major costs associated with going, hey, guess what?

51
00:07:37,280 --> 00:07:38,900
You got this legacy stuff.

52
00:07:38,900 --> 00:07:40,820
It's not really up to snuff.

53
00:07:40,820 --> 00:07:42,800
So you're just going to have to replace it.

54
00:07:42,800 --> 00:07:52,980
So then comes into the question, what should water actually cost versus a beautifully near risk-free ICS system?

55
00:07:53,060 --> 00:08:11,900
And now that we're in the middle of pandemic, unfortunately, are hospitals going to have to choose between securing their systems, which also includes a lot of medical IoT devices, or are they going to have to go ventilator to cure ICT?

56
00:08:12,000 --> 00:08:17,940
And I think all of us right now watching this, we would kind of like those ventilators.

57
00:08:19,100 --> 00:08:27,200
Now, when it comes to establishing a computer emergency response team, this is a fantastic step.

58
00:08:27,200 --> 00:08:34,040
However, we have to understand that a CERT team is a very reactive team.

59
00:08:34,040 --> 00:08:36,380
They are constantly putting out fires.

60
00:08:36,380 --> 00:08:39,520
And usually these teams are not very big.

61
00:08:40,440 --> 00:08:48,980
What happens as well is they have to do putting out fires, write advisements to constituents, advisements to governments.

62
00:08:48,980 --> 00:08:56,500
They're doing a whole bunch of stuff in investigations and give training, and especially give training to critical infrastructure.

63
00:08:56,640 --> 00:09:04,160
They don't have a lot of time to do a lot of anything, but yet they're expected to do basically everything.

64
00:09:04,320 --> 00:09:18,200
We also have to understand that a lot of computer emergency response teams are not actually capable of doing all of the services that are expected of them, or are not actually mature enough to provide the majority of services.

65
00:09:18,300 --> 00:09:24,200
There are still CERT teams in various countries that don't even use encryption on their website.

66
00:09:24,660 --> 00:09:29,280
And not all CERTs actually take vulnerability disclosure.

67
00:09:29,760 --> 00:09:36,700
I provided feedback for a person who works for a German think tank who's writing a paper right now for the German government.

68
00:09:36,700 --> 00:09:43,780
And one of the things she noted was the fact that here I live in the European Union, and we have something called CERT-EU.

69
00:09:43,960 --> 00:09:55,460
And she was very puzzled over the fact that nowhere on their website could you find a link or information on how to actually disclose vulnerability information.

70
00:09:55,460 --> 00:10:06,000
And this is a CERT that, in essence, would provide a response for 513 million people.

71
00:10:06,000 --> 00:10:09,600
So there are a lot of limitations with CERTs.

72
00:10:09,880 --> 00:10:16,640
Now, one of the things that I proposed to the United Nations was CERTs, fantastic.

73
00:10:16,660 --> 00:10:25,420
I think that is step one to really taking a look at how member states should really secure their cyberspace.

74
00:10:25,420 --> 00:10:34,460
But at the same time, I proposed to them a CEPT, if one might pronounce it that way, but a Computer Emergency Prevention Team.

75
00:10:34,460 --> 00:10:38,540
And I truly believe that member states should have these.

76
00:10:38,540 --> 00:11:07,440
So a team that actively looks for any sort of issue or high probability of compromise to systems, whether that's IT, IT and ICS, they're exposed to the internet, look at the supply chain issues, which may allow for exposure, and be that kind of like fire alarm and warning system before the fire actually bursts into flames and has to be put out.

77
00:11:07,440 --> 00:11:19,740
In addition to this, they can also take on the role of the advisement, especially in critical infrastructure, allowing the computer emergency response teams to actually put out the fires when they need to.

78
00:11:19,740 --> 00:11:24,440
So I'm a big believer in proactive security.

79
00:11:24,660 --> 00:11:43,040
And currently, I am the subject matter expert for part of the European Union, where we're building the world's first exclusively proactive security team, where we are looking for high probability of compromise systems and detecting compromise as quickly as possible,

80
00:11:43,040 --> 00:11:56,300
and starting the incident response portion of locking down a system and determining what the major risks are before the CERT team comes in for the incident, the rest of the incident portion.

81
00:11:57,700 --> 00:12:05,240
So we live in this wonderful connected world, and I'm going to give you a new term and a hashtag you're free to use.

82
00:12:05,640 --> 00:12:08,420
BYOH, bring your own house.

83
00:12:08,420 --> 00:12:10,400
I happen to be in my home.

84
00:12:10,640 --> 00:12:32,950
But when we connect up to power plants, or any sort of production, or industrial IoT, or even our workplace, which might just be regular IT systems, what has happened in this wonderful pandemic, wonderful at all, is the fact that the employees were sent home,

85
00:12:32,950 --> 00:12:38,110
and this also includes technicians and engineers, and they're like, hey, do your job from home.

86
00:12:38,110 --> 00:12:39,370
Okay, great.

87
00:12:39,370 --> 00:12:48,290
So I share this network with perhaps my kids, perhaps my partner, perhaps I'm stealing the neighbor's Wi-Fi, who knows?

88
00:12:48,290 --> 00:12:56,450
And their home network is now considered perimeter security in many ways.

89
00:12:56,450 --> 00:13:08,550
Now, I'm fortunate to have my own commercial-grade firewall that cost me about 2,500 euro, but most companies are not going to roll that out for their employees.

90
00:13:08,910 --> 00:13:12,770
So perimeter security is now your front door.

91
00:13:12,770 --> 00:13:25,250
And when we take a look at how engineers and operators are trying to stay connected, we are going into a very kind scary area right now.

92
00:13:25,250 --> 00:13:44,470
Because one of the things I did, also preparing for my Red Team Village talk, was to do a massive scan across the internet and try to find some easily found exposed control systems, looking at ICS, industrial IoT.

93
00:13:44,630 --> 00:13:49,010
And unfortunately, I found way too many systems.

94
00:13:49,010 --> 00:13:53,590
As you can see, I have this wonderful table that says, please hack me.

95
00:13:53,650 --> 00:14:05,490
The reason for that is a lot of these systems, either they don't have very much in the way of security, like the Modbus protocol, you have to be very careful with that one.

96
00:14:05,490 --> 00:14:22,190
Or even if they've got a more modern control system protocol, it doesn't necessarily mean they're on the newest and greatest firmware, or the fact that a lot of these things now are really industrial IoT products.

97
00:14:22,190 --> 00:14:25,430
And they've got these wonderful things called web servers.

98
00:14:25,430 --> 00:14:31,050
And I'd like to say, if it looks like a web server, hack it like a web server.

99
00:14:31,690 --> 00:14:54,830
And so just because the protocols might be wonderfully put together, or say Siemens S7, if it's got a web server login exposed to the internet, and it hasn't really been tested for security, then release the cross-site scripting and a bevy of other different types of attacks.

100
00:14:56,470 --> 00:15:01,410
So one of the problems we have is hacking.

101
00:15:01,410 --> 00:15:13,590
And when I say hacking, I don't just mean my 10-year-old self, or some of the people who deal with offensive security and find certain vulnerabilities.

102
00:15:13,590 --> 00:15:19,610
We also have to consider the fact that a lot of nation-states are involved.

103
00:15:19,770 --> 00:15:37,530
When I say a lot, one of my favorites is actually Ethiopia has a full-fledged offensive security team that is authorized to do various hacks, because they've been at war and are involved in various skirmishes with DANTREA.

104
00:15:37,530 --> 00:15:45,210
So if Ethiopia has something, lots of other countries have this particular capability.

105
00:15:45,370 --> 00:15:50,290
We also have to take a look at geopolitics and things that are going on.

106
00:15:50,290 --> 00:16:10,610
I was chit-chatting with Bryson Bort before we started, and I'm currently doing research into cyber guerrilla warfare between Azerbaijan and Armenia, where the Armenian nuclear powder plant is actually under threat because Azerbaijan has publicly stated that they want to blow it up.

107
00:16:10,750 --> 00:16:18,750
And I don't think that's good for anyone, especially since I live in Europe, and I don't want to like another trouble, and I don't want cancer.

108
00:16:18,770 --> 00:16:33,010
So we have to take the security devices, the way they're put together, the configuration, if they're exposed or not, think about geopolitics, but also think about the fact that not everybody is a friend.

109
00:16:33,010 --> 00:16:42,350
So if there's a major incident between several countries, even transit countries, some countries won't necessarily help others.

110
00:16:42,450 --> 00:16:54,290
And even if they do help others, they don't necessarily phrase what they need in a proper question so that another country can give proper aid.

111
00:16:54,310 --> 00:17:10,070
And one of the other things that we have to think about is before something major happens, groups actually need to start talking to each other because you don't just pick up the phone to a random country and go, hey, I need this stuff, and they're like,

112
00:17:10,070 --> 00:17:11,330
I don't even know you.

113
00:17:11,330 --> 00:17:12,850
I've never met you.

114
00:17:13,170 --> 00:17:17,650
And trust goes a long way, both with formal and informal networks.

115
00:17:17,910 --> 00:17:38,040
And one of the previous speakers had mentioned he was from academia, and academia is fantastic, and they can think out of the box in certain ways, but unfortunately, not every person who's in academia who's studying this topic necessarily has that hacker mentality.

116
00:17:38,510 --> 00:17:43,240
And currently, there is not enough involvement from the tech community.

117
00:17:46,740 --> 00:17:56,490
So we've got some things that are fantastic that we can use at the United Nations, and these are existing treaties.

118
00:17:56,670 --> 00:18:08,830
Now, whilst I was giving my presentation, one of the other presenters had brought up previous to me that perhaps we need to create this brand new treaty to tackle these issues.

119
00:18:08,830 --> 00:18:12,210
And my response was, guess what?

120
00:18:12,210 --> 00:18:28,450
We have stuff that we can use, we can expand on existing conventions, but if we're going to be doing a new treaty, it's going to take years and years and years, if it even gets a certain level of consensus from other member states inside the United Nations.

121
00:18:28,450 --> 00:18:31,510
And incidents don't wait years and years.

122
00:18:31,510 --> 00:18:35,610
Incidents want attention now, and they need it now.

123
00:18:35,930 --> 00:18:38,130
So we can use the Budapest Convention.

124
00:18:38,130 --> 00:18:53,150
There's also existing counterterrorism legislation and relationships between countries that also can be utilized if there's a major attack that is happening, going through countries, or hitting a particular country's critical infrastructure.

125
00:18:55,330 --> 00:19:03,370
So when it comes to preparation, one of the things that we have to remember is practice, practice, practice, right?

126
00:19:03,370 --> 00:19:12,390
And I think we've heard this at many different discussions, whether it's critical infrastructure or other areas.

127
00:19:12,390 --> 00:19:16,870
And the way that you get very good at something is to practice it.

128
00:19:16,870 --> 00:19:25,030
And obviously not every incident is going to be exactly the same because everyone is unique, everyone is unique and different.

129
00:19:25,090 --> 00:19:31,930
But when we talk about exercises, they're still kind of lacking, especially at the UN level for different things like this.

130
00:19:32,170 --> 00:19:44,950
Now, a few years ago, I had the opportunity to work with the European Center for Foreign Relations on building NATO and EU member exercises for diplomats and ministers.

131
00:19:45,050 --> 00:19:51,890
And I was the only tech person who was a subject matter expert who was not an academic.

132
00:19:52,170 --> 00:20:14,930
And I noticed that this was really, really lacking because we need to get certain people involved in this to do a good exercise, accept team members, as well as ministerial advisors, because a minister and an ambassador do not make decisions all by themselves,

133
00:20:14,930 --> 00:20:16,670
they have advisors.

134
00:20:16,810 --> 00:20:26,990
We also have to involve the public and private sector, obviously grab some academics as well, because they can share a lot of different research.

135
00:20:27,110 --> 00:20:37,950
But also consider us, a lot of the people who are watching this talk right now, in the tech community and subject matter experts who have actually dealt with some of these things.

136
00:20:38,490 --> 00:20:54,230
Reformed, nice hackers, so to speak, who can think in a way that they can misuse systems and even information that nobody else can really think about within the other groups.

137
00:20:55,030 --> 00:21:03,550
So one of the major things that I proposed to the United Nations was we need to get security researchers involved.

138
00:21:03,570 --> 00:21:22,370
One of the biggest reasons is when you get the tech community involved, I'll give you a good for instance, there's a CTI league, which was set up of subject matter expert tech community folks, and they volunteer to protect hospitals and medical personnel and medical devices.

139
00:21:22,370 --> 00:21:25,210
And they work extremely quickly.

140
00:21:25,210 --> 00:21:38,190
They also interface with computer emergency response teams, Europol, and other law enforcement, so that hospitals have some sort of advantage in this game.

141
00:21:38,190 --> 00:21:48,650
A few months ago, I was contacted by a particular EU government, because 15 of their hospitals went down on a Friday night, because it was a cyber attack.

142
00:21:48,650 --> 00:21:57,910
And that particular country came out publicly saying, this country who did these attacks, stop attacking our hospitals.

143
00:21:58,050 --> 00:22:14,050
But defending and realizing that there are some exploitable systems out there, if you've got the tech community involved, they can go ahead and interface like that, like the snap of your fingers.

144
00:22:14,610 --> 00:22:22,670
Unfortunately, when you're dealing with diplomats and countries on that much higher level, those formal networks are kind of slow.

145
00:22:23,390 --> 00:22:38,850
Now, another thing that I brought up to the United Nations is the fact that the majority of ICT vulnerabilities, both IT, ITICS areas, they're still discovered by good hackers like us, attending DEF CON, SIGMO.

146
00:22:39,110 --> 00:22:53,970
And this is fantastic, because a lot of us do this, maybe for a t-shirt, some stickers, sometimes a bug bounty, but really because we want these systems protected, so we can use them when we say, go to a hospital.

147
00:22:54,330 --> 00:22:58,990
And unfortunately, we still face a lot of legal barriers.

148
00:22:59,110 --> 00:23:04,350
As I mentioned before, not all certs actually will take vulnerability disclosures.

149
00:23:04,350 --> 00:23:15,030
And sometimes if you contact a company or a power plant or a hospital or whatever, they might have the reaction of, who the heck are you?

150
00:23:15,030 --> 00:23:17,150
Are you trying to extort us for money?

151
00:23:17,430 --> 00:23:19,350
Are you some sort of criminal?

152
00:23:19,350 --> 00:23:21,730
So there's some legal barriers.

153
00:23:21,930 --> 00:23:28,050
And sometimes you have to deal with very strange laws, like in the Netherlands, you're not allowed to ping a computer system.

154
00:23:28,050 --> 00:23:29,610
That's written in our cyber law.

155
00:23:29,610 --> 00:23:42,510
Even computer systems you own, which is still kind of odd, but depending on the country or the laws, you could actually be arrested for reporting some of these things.

156
00:23:43,310 --> 00:23:47,430
Now, another issue is who to contact.

157
00:23:47,710 --> 00:23:56,990
Here you've got this major thing, and you want to be able to contact people as quickly as possible in a secure manner, but who do you contact?

158
00:23:56,990 --> 00:24:01,110
Using the CertEU example, I have no idea.

159
00:24:01,130 --> 00:24:03,970
And neither does the person writing the paper for Germany.

160
00:24:05,670 --> 00:24:15,210
So what we have to realize is, as we all plainly know right now, we live in this digital world.

161
00:24:15,230 --> 00:24:22,030
And we are absolutely as dependent on ICT systems as we are to oxygen in this modern world.

162
00:24:22,030 --> 00:24:43,610
So my closing recommendation to the United Nations was that the UN and member states should lead the effort in establishing computer emergency prevention teams, because it is much easier, cheaper, quicker to prevent a major attack against critical infrastructure than it is to try to put out a fire.

163
00:24:45,770 --> 00:24:55,430
So I have some references, which I can copy and paste somehow and put into Discord, or folks can take screenshots.

164
00:24:55,430 --> 00:25:03,110
The first one is the UN Group of Governmental Experts Report H from July 2015.

165
00:25:03,110 --> 00:25:13,750
There will be a new report coming out from my presentation and other people's presentations that we gave at the United Nations last month.

166
00:25:13,750 --> 00:25:28,070
And also, if you want to take a look at a very, very good convention that actually deals with cybercrime that can be utilized for information sharing, technology sharing, subject matter expert sharing, etc.

167
00:25:28,070 --> 00:25:33,910
when a major incident occurs, Budapest Convention on Cybercrime is excellent.

168
00:25:34,930 --> 00:25:40,710
And last but not least, thank you very much ICS Village and doing this safe mode.

169
00:25:40,710 --> 00:25:42,350
I know it took a lot of work.

170
00:25:42,410 --> 00:25:43,070
And Mr.

171
00:25:43,070 --> 00:25:46,690
Bryson Bort for inviting me to do this talk.

172
00:25:46,770 --> 00:25:50,650
And if you want to know more about me, I'm available on Twitter.

173
00:25:50,650 --> 00:25:54,570
If you take DMs, just no weird pictures, please.

174
00:25:54,990 --> 00:25:58,350
And also, we're doing a lot of work.

175
00:25:58,350 --> 00:26:03,130
We have just started the cyber portion of the Middle East Institute.

176
00:26:03,350 --> 00:26:15,890
I'm the first distinguished non-resident fellow and person coming in as a non-resident coming into the Middle East Institute specifically for cyber to look at these particular issues.

177
00:26:15,950 --> 00:26:18,630
So, that ends my presentation.

178
00:26:18,630 --> 00:26:22,270
And what I'll do is I will look on this Discord.

179
00:26:22,330 --> 00:26:25,290
And hopefully, there are some questions.

180
00:26:26,730 --> 00:26:32,130
And there doesn't seem to be that many questions, but that's okay.

181
00:26:32,810 --> 00:26:36,710
Does the ICS Village have any questions?

182
00:26:38,790 --> 00:26:40,810
Or I'll just dance.

183
00:26:47,150 --> 00:26:52,150
I'm up and it's after midnight and I'm still here, somehow.

184
00:26:54,710 --> 00:27:00,170
Well, since no one has any more questions, thank you very much, everyone.

185
00:27:00,170 --> 00:27:16,710
And hopefully, the United Nations will take some of my recommendations on how to secure their individual member state cyberspace, specifically critical infrastructure, a lot better in the near future.

186
00:27:16,710 --> 00:27:17,870
Thank you.