[00:00.000 --> 00:08.540]  Well, hello ICS Village. I'm coming to you live from sunny Amsterdam and today I'm going to be
[00:08.540 --> 00:15.140]  talking about critical infrastructure and a presentation that I gave recently at the United
[00:15.140 --> 00:21.900]  Nations after an invitation at the United Nations Institute for Disarmament Research.
[00:21.920 --> 00:29.100]  So, I hope you enjoy it. If you don't know who I am, that's fine. I'm certainly not a household
[00:29.100 --> 00:35.760]  name, but my name is Chris Kubecka and I am the CEO of two companies, one in the Netherlands,
[00:35.760 --> 00:43.600]  one in the UK, dealing with cyber warfare and ICS, IoT, and IT proactive security.
[00:43.600 --> 00:47.240]  I'm also a Distinguished Non-Resident Fellow at the Middle East Institute.
[00:47.520 --> 00:52.120]  And previous to all of this, I used to head the Information Protection Group
[00:52.120 --> 01:01.180]  for Aramco and I was a Aircrew member and was in Space Command dealing with many control systems.
[01:01.180 --> 01:08.840]  One might say I'm also a bit of a reformed hacker or at least now a reformed unethical hacker
[01:09.670 --> 01:16.100]  because I come from it from a slightly different point of view where I started as a kid being a
[01:16.100 --> 01:22.900]  black hat hacker and got busted at the age of 12 doing very, very naughty things.
[01:23.200 --> 01:31.520]  So, why is this particular talk and this topic important? Well, one of the reasons is we now live
[01:31.520 --> 01:37.080]  in this wonderful digital world. We're able to have DEF CON in the ICS village remotely
[01:37.780 --> 01:45.540]  and we depend absolutely on technology. And if we want our modern world to continue,
[01:45.540 --> 01:50.660]  we have to deal with the simple fact that hopefully our technology will not be used to
[01:50.660 --> 01:58.400]  kill us. So, the United Nations has been involved a little bit late in the game and they are very
[01:58.400 --> 02:03.840]  concerned about member states and their responsibilities securing the ICT assets
[02:03.840 --> 02:11.260]  within their own borders. So, in 2015, I did say they were a little late, a group of governmental
[02:11.260 --> 02:19.340]  experts published a report, Report H, that stated four main facts that every member state is
[02:19.340 --> 02:28.640]  supposed to secure its own country's cyberspace. That includes IT, IoT, and ICS security. In
[02:28.640 --> 02:34.180]  addition to that, every single member state should have a computer emergency response team.
[02:34.180 --> 02:42.440]  Fantastic. And also with that, if there is a country where an attack is coming from and
[02:42.440 --> 02:50.060]  then transiting through, that if you are a transit country, say like something coming
[02:50.060 --> 02:56.340]  through the Netherlands, aiming at Austria or the United States, then that transit country
[02:56.340 --> 03:01.900]  and their telecoms should be able to provide aid. And also, any member state that's under
[03:01.900 --> 03:10.800]  major attack should be able to exchange information on the incident and also technology,
[03:10.800 --> 03:18.700]  and if at all possible, additional subject matter experts like CERT teams to assist in a major
[03:18.700 --> 03:26.800]  attack. Now, this sounds all wonderful, lovely, jubbly, and at the UN, the majority of member
[03:26.800 --> 03:31.660]  states did agree to this particular report and thought that these things were very, very important
[03:31.660 --> 03:41.260]  to have. However, at the UN level, at this global scale, lots of government experts don't actually
[03:41.260 --> 03:50.080]  realize what's really going down on the ground. So, this is one of my favorite quotes. It is,
[03:50.080 --> 03:55.280]  never underestimate how dependent you are on your information technology and systems. It's become
[03:55.280 --> 04:00.440]  like oxygen. You think you can live without it, but you can't. And this was a quote from the CEO
[04:00.440 --> 04:08.900]  of Saudi Aramco after the 2012 Shamoon attacks. And what you're seeing here is a picture of one
[04:08.900 --> 04:16.140]  of the events that happened after the attack, where there were miles and miles of gasoline
[04:16.140 --> 04:22.480]  trucks that could no longer be loaded up, because the industrial IOT system in between
[04:23.240 --> 04:30.220]  was no longer functioning, nor were the payment systems. Now, Saudi Aramco experienced the world's
[04:30.220 --> 04:35.120]  worst cyber warfare attack. It isn't spoken about too much, because I'm currently the only person
[04:35.120 --> 04:43.940]  authorized to actually discuss it. In about two hours, 85% of their IT systems were lost.
[04:44.020 --> 04:51.280]  And when I say IT systems, this is a VoIP phone, this is the payment systems, this is the HR data,
[04:51.280 --> 04:56.280]  some of the backups were wiped, some of the firewalls were affected, and there were two
[04:56.280 --> 05:02.480]  production plants were actually affected. And unfortunately, Aramco was unprepared. They
[05:02.480 --> 05:07.940]  believed, you know what, barely anybody knows about us, unless you're in the oil and gas industry,
[05:07.940 --> 05:13.500]  so why would we ever be a target? Well, unfortunately for them, around the same time,
[05:13.500 --> 05:22.340]  Arab Spring was going on, and attacks that had recently occurred. And Saudi Arabia and Iran are
[05:22.340 --> 05:30.400]  not very good friends. And because of this lack of understanding, their systems, both on the IT
[05:30.400 --> 05:39.680]  side, IoT side, and ICS side, were not very prepared or secure at all. Now, in addition to this, the
[05:39.680 --> 05:45.060]  attack affected countrywide internet connectivity, taking out two of the three mobile providers,
[05:45.060 --> 05:51.500]  because they actually severed the internet connection. And Aramco provided internet
[05:51.500 --> 05:59.140]  connectivity for emergency services, hospitals, schools, police stations, universities, and you
[05:59.140 --> 06:06.100]  see where I'm going with this, it was not a very nice picture. 14 days after the initial attack,
[06:06.100 --> 06:11.740]  Qatar's national oil company, Rasgas, a joint venture between Qatar and ExxonMobil, was hit
[06:11.740 --> 06:18.060]  with a different variant. The Shamoon variant for Saudi Aramco had a burning American flag,
[06:18.060 --> 06:24.600]  the Qatar one did not. And what we estimated after the attack, if the two companies had actually
[06:24.600 --> 06:30.660]  fallen and could not restore themselves as quickly as possible, we estimated that a barrel of oil
[06:30.660 --> 06:39.940]  could hit as high as $450 per barrel. And if that had happened, it would have caused a domino chain
[06:39.940 --> 06:46.400]  of global economic and supply chain damage. We see COVID right now where it's causing a lot of issues,
[06:46.400 --> 06:53.440]  but imagine if nobody could purchase oil, no cargo ships could purchase oil because it would
[06:53.440 --> 06:59.060]  be too expensive. You see where I'm going with this. We teetered precariously on the edge of a modern
[06:59.060 --> 07:06.640]  age, bronze age collapse due to a cyber malicious attack. The reason why I know about this attack in
[07:06.640 --> 07:11.420]  depth was because I was the person requested to help recover international business operations
[07:11.420 --> 07:16.460]  and establish their mature digital security and cyber threat intelligence.
[07:17.480 --> 07:22.420]  So one of the things we have to understand is the vast majority of critical infrastructure
[07:22.420 --> 07:29.500]  is actually privately owned. And there are limitations to how much a state can regulate,
[07:29.500 --> 07:35.820]  legislate, and ultimately dictate to the private sector. There are major costs associated with
[07:35.820 --> 07:41.280]  going, hey, guess what? You got this legacy stuff. It's not really up to snuff. So you're
[07:41.280 --> 07:45.880]  just going to have to replace it. So then comes into the question, what should water actually
[07:45.880 --> 07:55.080]  cost versus a beautifully near risk-free ICS system? And now that we're in the middle of
[07:55.080 --> 08:01.000]  pandemic, unfortunately, are hospitals going to have to choose between securing their systems,
[08:01.000 --> 08:10.400]  which also includes a lot of medical IoT devices, or are they going to have to go ventilator to
[08:10.400 --> 08:17.940]  cure ICT? And I think all of us right now watching this, we would kind of like those ventilators.
[08:19.100 --> 08:26.200]  Now, when it comes to establishing a computer emergency response team, this is a fantastic
[08:26.200 --> 08:34.240]  step. However, we have to understand that a CERT team is a very reactive team. They are
[08:34.240 --> 08:42.580]  constantly putting out fires. And usually these teams are not very big. What happens as well is
[08:42.580 --> 08:49.460]  they have to do putting out fires, write advisements to constituents, advisements to governments. They're
[08:49.460 --> 08:54.820]  doing a whole bunch of stuff in investigations and give training, and especially give training
[08:54.820 --> 09:01.440]  to critical infrastructure. They don't have a lot of time to do a lot of anything, but yet they're
[09:01.440 --> 09:07.520]  expected to do basically everything. We also have to understand that a lot of computer emergency
[09:07.520 --> 09:13.420]  response teams are not actually capable of doing all of the services that are expected of them,
[09:13.420 --> 09:20.120]  or are not actually mature enough to provide the majority of services. There are still CERT teams
[09:20.120 --> 09:24.200]  in various countries that don't even use encryption on their website.
[09:24.660 --> 09:32.260]  And not all CERTs actually take vulnerability disclosure. I provided feedback for a person
[09:32.260 --> 09:36.700]  who works for a German think tank who's writing a paper right now for the German government.
[09:36.700 --> 09:41.480]  And one of the things she noted was the fact that here I live in the European Union, and we have
[09:41.480 --> 09:49.340]  something called CERT-EU. And she was very puzzled over the fact that nowhere on their website could
[09:49.340 --> 09:56.160]  you find a link or information on how to actually disclose vulnerability information. And this is
[09:56.520 --> 10:07.400]  a CERT that, in essence, would provide a response for 513 million people. So there are a lot of
[10:07.400 --> 10:13.600]  limitations with CERTs. Now, one of the things that I proposed to the United Nations was
[10:14.240 --> 10:21.960]  CERTs, fantastic. I think that is step one to really taking a look at how member states
[10:21.960 --> 10:29.100]  should really secure their cyberspace. But at the same time, I proposed to them a CEPT,
[10:29.100 --> 10:34.460]  if one might pronounce it that way, but a Computer Emergency Prevention Team.
[10:34.460 --> 10:42.160]  And I truly believe that member states should have these. So a team that actively looks for
[10:42.160 --> 10:49.400]  any sort of issue or high probability of compromise to systems, whether that's IT, IT and ICS,
[10:49.400 --> 10:56.360]  they're exposed to the internet, look at the supply chain issues, which may allow for exposure,
[10:56.900 --> 11:04.100]  and be that kind of like fire alarm and warning system before the fire actually
[11:04.100 --> 11:10.600]  bursts into flames and has to be put out. In addition to this, they can also take on the role
[11:10.600 --> 11:15.680]  of the advisement, especially in critical infrastructure, allowing the computer emergency
[11:15.680 --> 11:23.060]  response teams to actually put out the fires when they need to. So I'm a big believer in proactive
[11:23.060 --> 11:29.800]  security. And currently, I am the subject matter expert for part of the European Union, where we're
[11:29.800 --> 11:37.200]  building the world's first exclusively proactive security team, where we are looking for high
[11:37.200 --> 11:43.460]  probability of compromise systems and detecting compromise as quickly as possible, and starting
[11:43.460 --> 11:50.980]  the incident response portion of locking down a system and determining what the major risks are
[11:50.980 --> 11:56.300]  before the CERT team comes in for the incident, the rest of the incident portion.
[11:57.700 --> 12:03.380]  So we live in this wonderful connected world, and I'm going to give you a new term and a hashtag
[12:03.380 --> 12:12.940]  you're free to use. BYOH, bring your own house. I happen to be in my home. But when we connect up to
[12:13.590 --> 12:21.480]  power plants, or any sort of production, or industrial IoT, or even our workplace,
[12:21.480 --> 12:28.050]  which might just be regular IT systems, what has happened in this wonderful pandemic,
[12:28.050 --> 12:34.390]  wonderful at all, is the fact that the employees were sent home, and this also includes technicians
[12:34.390 --> 12:40.490]  and engineers, and they're like, hey, do your job from home. Okay, great. So I share this network
[12:40.490 --> 12:48.290]  with perhaps my kids, perhaps my partner, perhaps I'm stealing the neighbor's Wi-Fi, who knows?
[12:48.290 --> 12:58.030]  And their home network is now considered perimeter security in many ways. Now, I'm fortunate to have
[12:58.050 --> 13:04.910]  my own commercial-grade firewall that cost me about 2,500 euro, but most companies are not going
[13:04.910 --> 13:14.550]  to roll that out for their employees. So perimeter security is now your front door. And when we take
[13:14.670 --> 13:22.510]  a look at how engineers and operators are trying to stay connected, we are going into a very kind
[13:22.510 --> 13:29.970]  scary area right now. Because one of the things I did, also preparing for my Red Team Village talk,
[13:29.970 --> 13:38.990]  was to do a massive scan across the internet and try to find some easily found exposed control
[13:38.990 --> 13:49.010]  systems, looking at ICS, industrial IoT. And unfortunately, I found way too many systems.
[13:49.010 --> 13:55.490]  As you can see, I have this wonderful table that says, please hack me. The reason for that is a lot
[13:55.490 --> 14:03.390]  of these systems, either they don't have very much in the way of security, like the Modbus protocol,
[14:03.390 --> 14:10.070]  you have to be very careful with that one. Or even if they've got a more modern control system
[14:10.690 --> 14:17.790]  protocol, it doesn't necessarily mean they're on the newest and greatest firmware, or the fact that
[14:17.910 --> 14:23.430]  a lot of these things now are really industrial IoT products. And they've got these wonderful
[14:23.430 --> 14:31.050]  things called web servers. And I'd like to say, if it looks like a web server, hack it like a web server.
[14:31.690 --> 14:39.210]  And so just because the protocols might be wonderfully put together, or say Siemens S7,
[14:39.210 --> 14:46.470]  if it's got a web server login exposed to the internet, and it hasn't really been tested for
[14:46.470 --> 14:54.830]  security, then release the cross-site scripting and a bevy of other different types of attacks.
[14:56.470 --> 15:03.430]  So one of the problems we have is hacking. And when I say hacking, I don't just mean
[15:04.290 --> 15:11.770]  my 10-year-old self, or some of the people who deal with offensive security and find
[15:11.770 --> 15:19.610]  certain vulnerabilities. We also have to consider the fact that a lot of nation-states are involved.
[15:19.770 --> 15:28.190]  When I say a lot, one of my favorites is actually Ethiopia has a full-fledged offensive security
[15:28.190 --> 15:34.870]  team that is authorized to do various hacks, because they've been at war and are involved
[15:34.870 --> 15:42.610]  in various skirmishes with DANTREA. So if Ethiopia has something, lots of other countries
[15:42.610 --> 15:48.990]  have this particular capability. We also have to take a look at geopolitics and things that are
[15:48.990 --> 15:56.970]  going on. I was chit-chatting with Bryson Bort before we started, and I'm currently doing research
[15:56.970 --> 16:04.110]  into cyber guerrilla warfare between Azerbaijan and Armenia, where the Armenian nuclear powder
[16:04.110 --> 16:10.610]  plant is actually under threat because Azerbaijan has publicly stated that they want to blow it up.
[16:10.750 --> 16:15.790]  And I don't think that's good for anyone, especially since I live in Europe, and I don't
[16:15.790 --> 16:22.170]  want to like another trouble, and I don't want cancer. So we have to take the security devices,
[16:22.530 --> 16:28.410]  the way they're put together, the configuration, if they're exposed or not, think about geopolitics,
[16:28.410 --> 16:34.870]  but also think about the fact that not everybody is a friend. So if there's a major incident between
[16:34.870 --> 16:42.350]  several countries, even transit countries, some countries won't necessarily help others.
[16:42.450 --> 16:49.730]  And even if they do help others, they don't necessarily phrase what they need in a proper
[16:49.730 --> 16:57.490]  question so that another country can give proper aid. And one of the other things that we have to
[16:57.490 --> 17:03.690]  think about is before something major happens, groups actually need to start talking to each
[17:03.690 --> 17:09.370]  other because you don't just pick up the phone to a random country and go, hey, I need this stuff,
[17:09.370 --> 17:15.530]  and they're like, I don't even know you. I've never met you. And trust goes a long way, both with formal
[17:15.530 --> 17:22.510]  and informal networks. And one of the previous speakers had mentioned he was from academia,
[17:22.510 --> 17:30.370]  and academia is fantastic, and they can think out of the box in certain ways, but unfortunately,
[17:30.370 --> 17:38.040]  not every person who's in academia who's studying this topic necessarily has that hacker mentality.
[17:38.510 --> 17:43.240]  And currently, there is not enough involvement from the tech community.
[17:46.740 --> 17:53.750]  So we've got some things that are fantastic that we can use at the United Nations,
[17:53.750 --> 17:59.990]  and these are existing treaties. Now, whilst I was giving my presentation, one of the other
[17:59.990 --> 18:06.370]  presenters had brought up previous to me that perhaps we need to create this brand new treaty
[18:06.930 --> 18:14.550]  to tackle these issues. And my response was, guess what? We have stuff that we can use, we can expand
[18:14.550 --> 18:19.590]  on existing conventions, but if we're going to be doing a new treaty, it's going to take years
[18:19.590 --> 18:26.430]  and years and years, if it even gets a certain level of consensus from other member states
[18:26.430 --> 18:32.670]  inside the United Nations. And incidents don't wait years and years. Incidents want attention
[18:32.670 --> 18:39.130]  now, and they need it now. So we can use the Budapest Convention. There's also existing
[18:39.130 --> 18:45.710]  counterterrorism legislation and relationships between countries that also can be utilized
[18:45.710 --> 18:50.170]  if there's a major attack that is happening, going through countries,
[18:50.170 --> 18:53.150]  or hitting a particular country's critical infrastructure.
[18:55.330 --> 19:01.010]  So when it comes to preparation, one of the things that we have to remember is
[19:01.010 --> 19:07.290]  practice, practice, practice, right? And I think we've heard this at many different discussions,
[19:07.290 --> 19:14.890]  whether it's critical infrastructure or other areas. And the way that you get very good at
[19:14.890 --> 19:20.750]  something is to practice it. And obviously not every incident is going to be exactly the same
[19:20.750 --> 19:27.110]  because everyone is unique, everyone is unique and different. But when we talk about exercises,
[19:27.110 --> 19:31.930]  they're still kind of lacking, especially at the UN level for different things like this.
[19:32.170 --> 19:38.290]  Now, a few years ago, I had the opportunity to work with the European Center for Foreign Relations
[19:38.290 --> 19:46.410]  on building NATO and EU member exercises for diplomats and ministers. And I was the only
[19:47.090 --> 19:55.350]  tech person who was a subject matter expert who was not an academic. And I noticed that this was
[19:55.350 --> 20:03.210]  really, really lacking because we need to get certain people involved in this to do a good
[20:03.210 --> 20:10.710]  exercise, accept team members, as well as ministerial advisors, because a minister
[20:10.710 --> 20:16.670]  and an ambassador do not make decisions all by themselves, they have advisors.
[20:16.810 --> 20:23.710]  We also have to involve the public and private sector, obviously grab some academics as well,
[20:23.710 --> 20:30.810]  because they can share a lot of different research. But also consider us, a lot of the people who are
[20:30.810 --> 20:35.550]  watching this talk right now, in the tech community and subject matter experts who have
[20:35.550 --> 20:43.830]  actually dealt with some of these things. Reformed, nice hackers, so to speak, who can think in a way
[20:44.590 --> 20:52.490]  that they can misuse systems and even information that nobody else can really think about within the
[20:52.490 --> 20:59.990]  other groups. So one of the major things that I proposed to the United Nations was
[20:59.990 --> 21:07.250]  we need to get security researchers involved. One of the biggest reasons is when you get the
[21:07.250 --> 21:12.150]  tech community involved, I'll give you a good for instance, there's a CTI league, which was set up
[21:12.150 --> 21:20.050]  of subject matter expert tech community folks, and they volunteer to protect hospitals and medical
[21:20.050 --> 21:26.850]  personnel and medical devices. And they work extremely quickly. They also interface with
[21:26.850 --> 21:33.830]  computer emergency response teams, Europol, and other law enforcement, so that hospitals have some
[21:33.830 --> 21:42.510]  sort of advantage in this game. A few months ago, I was contacted by a particular EU government,
[21:42.510 --> 21:48.650]  because 15 of their hospitals went down on a Friday night, because it was a cyber attack.
[21:48.650 --> 21:55.130]  And that particular country came out publicly saying, this country who did these attacks,
[21:55.130 --> 22:03.930]  stop attacking our hospitals. But defending and realizing that there are some exploitable systems
[22:03.930 --> 22:09.750]  out there, if you've got the tech community involved, they can go ahead and interface
[22:10.630 --> 22:16.070]  like that, like the snap of your fingers. Unfortunately, when you're dealing with
[22:16.070 --> 22:22.670]  diplomats and countries on that much higher level, those formal networks are kind of slow.
[22:23.390 --> 22:28.990]  Now, another thing that I brought up to the United Nations is the fact that the majority of ICT
[22:28.990 --> 22:37.210]  vulnerabilities, both IT, ITICS areas, they're still discovered by good hackers like us, attending
[22:37.210 --> 22:45.910]  DEF CON, SIGMO. And this is fantastic, because a lot of us do this, maybe for a t-shirt, some stickers,
[22:45.910 --> 22:51.890]  sometimes a bug bounty, but really because we want these systems protected, so we can use them when
[22:51.890 --> 23:00.110]  we say, go to a hospital. And unfortunately, we still face a lot of legal barriers. As I mentioned
[23:00.110 --> 23:05.610]  before, not all certs actually will take vulnerability disclosures. And sometimes if
[23:05.610 --> 23:13.590]  you contact a company or a power plant or a hospital or whatever, they might have the reaction of,
[23:13.590 --> 23:19.350]  who the heck are you? Are you trying to extort us for money? Are you some sort of criminal?
[23:19.350 --> 23:25.210]  So there's some legal barriers. And sometimes you have to deal with very strange laws, like in the
[23:25.210 --> 23:29.870]  Netherlands, you're not allowed to ping a computer system. That's written in our cyber law. Even
[23:29.870 --> 23:38.470]  computer systems you own, which is still kind of odd, but depending on the country or the laws,
[23:38.470 --> 23:42.510]  you could actually be arrested for reporting some of these things.
[23:43.310 --> 23:49.990]  Now, another issue is who to contact. Here you've got this major thing,
[23:49.990 --> 23:55.630]  and you want to be able to contact people as quickly as possible in a secure manner,
[23:55.630 --> 24:02.170]  but who do you contact? Using the CertEU example, I have no idea. And neither does the person
[24:02.170 --> 24:12.490]  writing the paper for Germany. So what we have to realize is, as we all plainly know right now,
[24:12.510 --> 24:19.310]  we live in this digital world. And we are absolutely as dependent on ICT systems as we are
[24:19.310 --> 24:26.450]  to oxygen in this modern world. So my closing recommendation to the United Nations was that the
[24:26.450 --> 24:33.530]  UN and member states should lead the effort in establishing computer emergency prevention teams,
[24:33.530 --> 24:40.410]  because it is much easier, cheaper, quicker to prevent a major attack against critical
[24:40.410 --> 24:49.030]  infrastructure than it is to try to put out a fire. So I have some references, which I can
[24:49.030 --> 24:56.510]  copy and paste somehow and put into Discord, or folks can take screenshots. The first one is
[24:56.510 --> 25:05.030]  the UN Group of Governmental Experts Report H from July 2015. There will be a new report coming out
[25:05.030 --> 25:10.950]  from my presentation and other people's presentations that we gave at the United
[25:10.950 --> 25:17.830]  Nations last month. And also, if you want to take a look at a very, very good
[25:17.830 --> 25:24.830]  convention that actually deals with cybercrime that can be utilized for information sharing,
[25:24.830 --> 25:30.090]  technology sharing, subject matter expert sharing, etc. when a major incident occurs,
[25:30.090 --> 25:38.170]  Budapest Convention on Cybercrime is excellent. And last but not least, thank you very much ICS
[25:38.170 --> 25:45.230]  Village and doing this safe mode. I know it took a lot of work. And Mr. Bryson Bort for inviting me
[25:45.230 --> 25:51.190]  to do this talk. And if you want to know more about me, I'm available on Twitter. If you take
[25:51.190 --> 26:00.070]  DMs, just no weird pictures, please. And also, we're doing a lot of work. We have just started
[26:00.090 --> 26:06.390]  the cyber portion of the Middle East Institute. I'm the first distinguished non-resident fellow
[26:06.890 --> 26:13.070]  and person coming in as a non-resident coming into the Middle East Institute specifically for
[26:13.070 --> 26:19.610]  cyber to look at these particular issues. So, that ends my presentation. And what I'll do is
[26:19.610 --> 26:25.290]  I will look on this Discord. And hopefully, there are some questions.
[26:26.730 --> 26:35.650]  And there doesn't seem to be that many questions, but that's okay. Does the ICS Village have any
[26:35.650 --> 26:52.150]  questions? Or I'll just dance. I'm up and it's after midnight and I'm still here, somehow.
[26:54.710 --> 27:01.170]  Well, since no one has any more questions, thank you very much, everyone. And hopefully,
[27:01.170 --> 27:08.110]  the United Nations will take some of my recommendations on how to secure their
[27:08.110 --> 27:15.750]  individual member state cyberspace, specifically critical infrastructure, a lot better in the near
[27:15.750 --> 27:17.870]  future. Thank you.