WEBVTT 00:03.050 --> 00:05.290 I'm your host for today. 00:05.470 --> 00:13.990 And we're welcome to DEF CON 30, AltspaceVR Virtual Reality Theater, where we're having DEF CON presentations. 00:14.130 --> 00:21.150 You're probably sick of hearing this from me, but new people are popping in and out all the time. 00:23.290 --> 00:25.950 Our next speaker is Guile. 00:26.770 --> 00:37.530 Guile has been volunteering with different online communities for the past two years by mentoring, moderating Discord servers, and presenting in different community-based InfoSec conferences. 00:37.530 --> 00:41.110 She's been in the tech industry since the early part of this century. 00:41.930 --> 00:52.050 Guile has a graduate certificate in response from SANS Institute and a master's in cybersecurity digital forensics from the NSW Canberra. 00:52.050 --> 00:57.310 Her day job is doing proactive and reactive work as an incident responder. 00:57.310 --> 01:03.450 And her talk is, How My High School Creative Writing Class Helped Me to Become a Better Incident Responder. 01:05.390 --> 01:08.070 So, Guile, please take it away. 01:08.730 --> 01:09.990 Thank you. 01:12.650 --> 01:14.030 Go there. 01:14.210 --> 01:15.450 Oh, wait a minute. 01:15.450 --> 01:17.690 Got to make sure you have access to the stage. 01:17.930 --> 01:19.510 That might help. 01:20.190 --> 01:21.310 Okay. 01:21.330 --> 01:25.250 Let's see if I could get there. 01:25.530 --> 01:26.130 There you go. 01:26.130 --> 01:27.510 You have access now. 01:27.510 --> 01:29.430 There we go. 01:32.000 --> 01:33.360 Okay. 01:39.680 --> 01:40.360 So... 01:40.360 --> 01:42.060 Okay. 01:42.060 --> 01:43.400 There we go. 01:43.400 --> 01:45.720 So, I do have megaphone access now. 01:45.720 --> 01:47.460 Can everybody hear me properly? 01:47.460 --> 01:48.480 Great. 01:48.480 --> 01:49.640 Sounds good. 01:49.640 --> 01:50.040 Okay. 01:50.900 --> 01:52.640 Thank you. 01:52.640 --> 01:54.980 So, good morning, everyone. 01:54.980 --> 01:56.380 I want to say good morning. 01:56.380 --> 01:58.540 It's 4 a.m. 01:58.540 --> 01:59.740 here. 01:59.960 --> 02:02.200 Two minutes after 4 a.m. 02:02.200 --> 02:06.600 So, I am calling... 02:06.600 --> 02:14.620 I'm dialing into this virtual reality space from NARM or Melbourne, Australia. 02:14.780 --> 02:20.000 So, first off, I'd like to start by doing an acknowledgement of country. 02:20.000 --> 02:27.580 I'm presenting from the lands of the Boon Wurrung people, and I wish to acknowledge them as traditional owners. 02:27.580 --> 02:37.260 I would also like to pay my respects to their elders, past and present, and aboriginal elders of other communities who may be here today. 02:37.280 --> 02:38.180 Thank you. 02:38.180 --> 02:39.820 Next slide, please. 02:43.540 --> 02:44.540 Next slide. 02:44.540 --> 02:44.880 Yes. 02:44.880 --> 02:45.120 Okay. 02:45.120 --> 02:46.200 So, I've been introduced. 02:46.200 --> 02:47.840 Thank you very much for that. 02:47.840 --> 02:55.720 So, I just wanted to add that I'm part of the first cohort of Project Freedman. 02:55.720 --> 03:14.980 This is an initiative here in Australia by the Women Speak Cyber and the AWSN, Australian Women in Security Network, to help make sure that we have diversity of thought and representation in our security, our infosec community here in Australia. 03:15.320 --> 03:20.480 I got training in terms of how to present in conferences. 03:20.800 --> 03:23.420 So, I do have a Twitter account. 03:23.420 --> 03:24.940 I have open DMs. 03:24.940 --> 03:32.320 So, please feel free to send me a DM if you have any questions afterwards about my presentation. 03:32.360 --> 03:34.040 Next slide, please. 03:36.320 --> 03:36.700 Okay. 03:36.700 --> 03:43.460 So, for this presentation, I'm going to be covering three areas here. 03:43.460 --> 03:48.980 So, first off, I'm going to talk about what's that creative nerd there. 03:48.980 --> 03:53.220 And then after that, I'm going to talk about incident response. 03:53.220 --> 03:57.360 And then I'm going to be, you know, giving some parting words. 03:57.360 --> 03:58.080 Okay. 03:58.140 --> 04:00.780 So, next slide, please. 04:02.040 --> 04:02.800 Okay. 04:02.800 --> 04:05.860 So, this is a photo, an old photo of mine. 04:05.860 --> 04:09.940 And this dates back from my high school time. 04:10.020 --> 04:20.420 And I was just, this particular day, I remember this vividly because I was just, you know, I brought the family camera. 04:20.420 --> 04:27.720 And this was before the time of, like, you know, digital cameras and all those things where you have to make sure you have a negative, you know. 04:27.720 --> 04:31.860 And then we have to take it to a store to have it processed. 04:32.020 --> 04:35.640 So, I was, like, you know, being all silly and just being goofy. 04:35.700 --> 04:42.460 And I borrowed one of my classmates, you know, beret and just, like, pretending I'm, you know, the artsy-fartsy person. 04:42.580 --> 04:53.120 And just for context, I actually went to a public school that is known for its strong science and math curriculum. 04:53.120 --> 04:55.160 It was called a Science High School. 04:55.160 --> 05:15.200 So, the concept was that there be high schools that are really focused on the STEM or to make sure that the students have this good background in science, technology, and mathematics in the hopes that we will go to the university and major in the STEM areas. 05:15.200 --> 05:22.040 So, if you cannot tell from my accent, I'm originally from the Philippines and I migrated to Australia. 05:22.480 --> 05:34.420 So, I was really lucky to get into that school because the entrance exam was really very competitive and we were, like, ranked. 05:34.420 --> 05:37.200 And then we had to make sure that we also passed the interviews. 05:37.200 --> 05:48.200 But the great thing about being in that Science High School was that there was also what we call electives, so we can take non-science and technology classes. 05:48.260 --> 05:52.660 And one of the first things that I signed up for was the creating writing class. 05:52.660 --> 05:56.500 And honestly, I was really glad that this was before social media. 05:56.500 --> 06:10.020 So, anything that I had in terms of photos and all those things were safe until my dad discovered Facebook and started scanning all my high school photos and started sharing it to everyone. 06:10.420 --> 06:16.380 Well, in a way, that was great because I asked him earlier this week, Hey, Dad, do you remember? 06:16.380 --> 06:18.320 Do you have one of my photos from high school? 06:18.320 --> 06:19.040 Ah, sure, sure. 06:19.040 --> 06:20.020 Which one? 06:20.020 --> 06:21.880 And then he sent me this one. 06:22.100 --> 06:23.380 So, that's the background. 06:23.380 --> 06:30.340 That's the context of why I called myself the creative nerd because I was a nerd first before I became a geekette. 06:30.340 --> 06:33.440 And so, next slide. 06:33.440 --> 06:35.720 So, next slide, please. 06:36.100 --> 06:50.180 So, one of the first things that I learned from my high school creative writing class was to really do research and, you know, document whatever that I come up with. 06:50.300 --> 07:09.800 And at the time, interviews, you know, contact people and interview them for your story or you read up... before we had internet back then. 07:09.820 --> 07:21.140 And the way to do research is actually go to a physical library, talk to a librarian, and then, you know, if you need, like, a book or something, there was a card catalog. 07:21.140 --> 07:25.300 Quick show of hands here or, like, show me your emojis. 07:25.300 --> 07:29.680 Anybody here has seen and used a card catalog in the library? 07:30.680 --> 07:32.200 Okay, any emojis? 07:32.600 --> 07:33.480 Okay. 07:33.760 --> 07:35.280 Okay, great. 07:36.620 --> 07:37.600 Okay, that's good. 07:37.600 --> 07:45.840 So, for those who haven't used a card catalog, so think of it like before we had the search engines, like , you know, Google. 07:45.840 --> 07:47.860 Before Google, there was, like, Yahoo. 07:47.960 --> 07:52.360 You know, that was the way how we did, like, research in the library. 07:52.360 --> 07:58.480 There's a series of, like, cards, and then they're alphabetically arranged. 07:58.620 --> 08:04.720 You know, you have topics, then you have, like, titles, and then it could be arranged by, you know, authors. 08:04.760 --> 08:07.260 Okay, so that's how we did the research. 08:07.320 --> 08:14.060 So, the first thing, the most important thing before you start, you know, like, writing anything, you have to think of an idea. 08:14.060 --> 08:18.420 Like, what do you want to, you know, tell? 08:18.420 --> 08:20.840 What's the story that you want to tell? 08:20.840 --> 08:23.100 You have to start with an idea. 08:23.180 --> 08:31.540 But the challenge is that sometimes if you're just, like, you know, stuck in a rut, you know, you can't really think of an idea. 08:31.540 --> 08:34.580 That's why there are things like story prompts. 08:34.580 --> 08:42.600 So, I remember, like, a week after, like, the first class, we were told, like, come up with an idea. 08:42.600 --> 08:47.220 So, the teacher, you know, said, like, okay, so what are your story ideas? 08:47.720 --> 08:52.120 And a lot of us were stumped, and that's why I should introduce, like, story prompts. 08:52.120 --> 08:53.100 So, what are story prompts? 08:53.100 --> 09:03.740 It's sort of like this, a sentence, you know, like, about something, and then you start, you know, building up, you know, from that particular story. 09:03.740 --> 09:05.320 So, you start with an idea. 09:05.320 --> 09:07.740 Then after that, you know, you think of a setting. 09:07.740 --> 09:12.620 So, you have to make sure that you do your research in terms of your setting. 09:12.620 --> 09:13.880 Where is it going to be? 09:13.880 --> 09:20.140 Is it going to be, like, local to our area, or is it in another city, another, you know, location? 09:20.140 --> 09:28.140 Or if you're thinking of something like writing, like, science fiction, is it set in this planet, or another planet, another galaxy? 09:28.480 --> 09:30.500 And then think of the period. 09:30.500 --> 09:33.020 When we say period, we're talking about the time, okay? 09:33.020 --> 09:38.020 Is it, like, is your story set in the present, or is it in the future? 09:38.020 --> 09:45.440 Or are you thinking about having a historical, you know, context? 09:45.440 --> 09:49.180 So, you've got to, like, do your research regarding that particular period. 09:49.560 --> 09:52.300 And then, of course, there's character building. 09:52.580 --> 10:07.140 So, for those of you who are, you know, into games, or let's just say Dungeons & Dragons, so you're probably familiar with, you know, that particular, you know, you have your... 10:07.600 --> 10:14.000 Think of it as, like, what's going to be, you know, the moral code of your, you know, character. 10:14.600 --> 10:22.500 You're going to be thinking about, okay, are they, you know, more on the good side, you know, like, evil side, or you're neutral. 10:22.500 --> 10:27.840 But mostly, when we start writing, we think of your hero, your protagonist, okay? 10:27.840 --> 10:35.020 So, and then you have to start thinking about their, you know, inner world, about their origin story, where did they come from? 10:35.020 --> 10:37.280 So, you have to start thinking about that. 10:37.380 --> 10:42.940 Okay, then lastly, of course, depending on the setting, you know, it's going to be about the genre. 10:43.000 --> 10:50.440 So, if you're thinking about, like, something in the future set in the other planets, or other galaxies, or something. 10:50.440 --> 10:52.160 So, that could be science fiction. 10:52.160 --> 10:56.200 But within science fiction, there's a lot of things that you can explore there. 10:56.200 --> 11:04.360 So, all in all, all these things that you've thought about, you need to make sure that you've done your research, and you've documented everything. 11:04.360 --> 11:08.140 You need to make sure that you, you know, write notes. 11:08.140 --> 11:17.080 And at that time, I just want to show, like, share this, my first attempt in using a computer. 11:17.080 --> 11:25.880 At that time, okay, there was a lot of, it was summer, and there were a lot of power outages. 11:26.000 --> 11:31.180 And I went to my mom's friend's house, who has a computer. 11:31.180 --> 11:34.420 And at the time, I really didn't know how to use a computer. 11:34.420 --> 11:38.680 And I just wanted to make sure that I'm able to type my story. 11:38.840 --> 11:41.600 And I was told, okay, this is how you do that. 11:41.600 --> 11:45.420 Okay, so that's your screen, black screen, you know, that was WordPerfect. 11:45.420 --> 11:54.480 And I have all these handwritten notes, and I have this story that I've written on paper. 11:54.480 --> 12:02.540 But as I was typing, I, you know, there are, like, other ideas that came in, and I just kept, like, you know, typing everything. 12:02.540 --> 12:07.180 And then suddenly, there was power outage. 12:07.440 --> 12:12.880 And then after, like, about 15 minutes, the power came back. 12:12.880 --> 12:19.600 And then I asked my, I call him uncle, although I'm not, you know, biologically related to him. 12:19.620 --> 12:23.640 I asked my uncle's kid, okay, so, okay, where's my work? 12:23.640 --> 12:26.940 I was, like, just typing, and then suddenly, the lights went out. 12:26.940 --> 12:30.600 And after that, it came back on, and I don't see my words there. 12:30.600 --> 12:34.480 And then he looked at me and asked, like, did you remember to save it? 12:34.480 --> 12:37.540 Like, what do you mean by saving? 12:39.860 --> 12:47.600 Okay, there was no way for me to recover, you know, those, like, I think I spent about three hours typing up my story. 12:47.600 --> 12:53.940 And then, like, okay, and that was my first experience in making sure that I always have, you know, redundancy. 12:53.940 --> 12:56.740 I have, like, backups and all those, you know, things. 12:56.740 --> 13:04.360 So, things that I learned from my creative writing class has really helped me when I shifted careers, like, you know, moving to tech. 13:04.360 --> 13:08.580 Okay, now, next slide, please. 13:10.520 --> 13:19.500 Okay, now, so, another important thing that I learned from my creative writing class was about the plot structure. 13:19.520 --> 13:24.200 Think of a plot structure, if you're a visual person, think of it like a mountain. 13:24.200 --> 13:30.660 So, sometimes it's called a story mountain, and sometimes you just see some examples like a plot diagram. 13:30.660 --> 13:39.780 So, you can see towards the left, you have there, left side of the mountain there, you have the exposition. 13:39.780 --> 13:45.940 So, think of it as the part of the plot when you start introducing your protagonists. 13:45.940 --> 13:50.060 Okay, and you also set the setting and the location there. 13:50.300 --> 13:56.040 And then, afterwards, you have what is called the pacing action. 13:56.040 --> 14:02.720 This is the part of the story that, this is basically after you've set your tone. 14:02.720 --> 14:06.420 Okay, and you've written something about your readers. 14:06.420 --> 14:13.900 I'm sorry, you've written something about your protagonists, and your readers are now invested in your protagonists. 14:13.900 --> 14:18.640 And think of the rising action as an event that interrupts this pattern. 14:18.640 --> 14:21.840 And this basically begins the story arc. 14:21.840 --> 14:32.540 Think of it as also, could be like there's a first conflict in your story, and then it ends with an event that changes everything for your protagonists. 14:32.700 --> 14:38.100 Okay, then towards the top of the story mountain, you have your climax. 14:38.100 --> 14:40.240 This follows the rising action. 14:40.240 --> 14:45.420 This is when everything comes together to create that single dramatic moment. 14:45.420 --> 14:47.880 So, that is the climax of the story. 14:47.880 --> 14:53.720 And then, after the climax of the story, you have to have the falling action. 14:53.720 --> 14:59.140 Sometimes some writers immediately move from climax to the resolution. 14:59.340 --> 15:09.940 But it is better to have a falling action, because you have to make sure that the tension and the conflict has started to resolve. 15:09.940 --> 15:15.220 And then your story starts winding down towards the resolution. 15:15.220 --> 15:20.360 And when we talk about the resolution, that is basically the conclusion of your story's plot. 15:20.360 --> 15:39.580 It could be just one scene, or it could be a series of scenes that will tie down your narrative arc to make sure that you show that something happened to the protagonist, and then what happened to that protagonist, and what changed in that protagonist's life. 15:39.580 --> 15:41.400 So, that is the resolution. 15:41.400 --> 15:44.640 So, this is basically your plot structure. 15:44.640 --> 15:48.860 And all stories should have this plot structure. 15:49.600 --> 15:52.340 Now, next slide, please. 15:54.080 --> 16:01.450 Sorry, I just have to have a sip of water here. 16:02.450 --> 16:20.830 So, in terms of the other important thing that I learned in my creative writing class is about knowing my reader and knowing myself. 16:21.170 --> 16:27.030 So, first of all, I have to make sure that I understand who is my target audience. 16:27.030 --> 16:39.970 I need to know, am I writing for, let's just say, my friends, family members, or am I writing for my classmates, or am I writing for the community? 16:40.330 --> 16:48.930 Because depending on your target audience, think of it in terms of the words that you use. 16:48.930 --> 16:55.970 So , of course, in terms of community, like in the Philippines when I was growing up, it was quite conservative. 16:55.970 --> 17:03.050 And the first story that I wrote was about a same-sex relationship. 17:03.050 --> 17:06.150 And at that time, that was considered quite controversial. 17:06.150 --> 17:09.610 And I was like, hey, you're too young to be writing about those stuff. 17:09.610 --> 17:15.690 And I was talking about it's about someone finding their identity and all those things. 17:15.690 --> 17:21.830 But I have to be very careful about the terminologies and all those things. 17:22.250 --> 17:24.710 So, in a way, I was self-censoring. 17:24.710 --> 17:35.070 But, you know, years later, I just realized that I shouldn't self-censor myself because I'm basically writing for myself. 17:35.210 --> 17:37.990 So , and then how will you tell your story? 17:38.350 --> 17:47.170 So , basically, there's the plot structure, you've done your research, and then how am I going to be telling my story? 17:47.170 --> 18:00.030 So, these are the important things that I've learned from my creative writing class that I still remember after so many decades later. 18:00.030 --> 18:04.650 So, what happened to this creative nerd? 18:04.650 --> 18:07.250 So, the creative nerd went to the university. 18:07.250 --> 18:15.430 Instead of majoring in science technology, I majored in psychology because I wanted to understand myself better. 18:15.430 --> 18:24.070 And at that time, it was, you know, difficult having like a career out of the university as, you know, a psychologist or as a psychology major. 18:24.070 --> 18:29.070 So, my family wanted me to either go to med school or law school. 18:29.250 --> 18:38.810 And I initially thought I want to go to med school, but I dropped by and thought like, nah, I don't want to do like, you know, all the dissection and all those things. 18:38.810 --> 18:41.550 And then I decided I'm just going to go to law school. 18:41.550 --> 18:47.610 So, after finishing my degree in psychology, I went to law school. 18:47.610 --> 18:59.310 And when I was there, I realized that, hey, I'm not like the very argumentative type because I'm turning into a very argumentative person. 18:59.310 --> 19:06.510 No matter what happens, we were being trained to win every single, you know, little argument. 19:06.510 --> 19:09.330 And I thought like, that's not what I want to do. 19:09.330 --> 19:13.070 And so, I got out of law school after two years. 19:13.070 --> 19:18.070 So, I joked that, hey, does that make me an outlaw because I dropped out? 19:18.410 --> 19:21.930 Anyway, then I got connected to the Internet. 19:21.930 --> 19:28.210 And when I got connected to the Internet, I realized, oh, there's a world out there and I want to be part of it. 19:28.210 --> 19:34.210 And that started my shift, career shift to tech. 19:34.210 --> 19:42.090 So, early part of this century, I moved into tech and I started my career doing networking stuff, Cisco stuff, and I love that. 19:42.090 --> 19:48.230 But I really wanted to focus on cybersecurity or at the time it was network security. 19:48.230 --> 19:55.230 It's largely because when I got connected to the Internet, I used IRC and I had an online stalker. 19:55.230 --> 19:58.110 So, that's why I was like really concerned about security. 19:58.110 --> 20:05.570 Anyway, eventually, so from doing networking, network security stuff, I moved into cybersecurity. 20:05.650 --> 20:16.310 And I really wanted to do forensic stuff because I've been reading mystery since I was a kid, mystery novels, all those things. 20:16.350 --> 20:23.730 So, now I'm at this point in my life and my career where I'm doing something that I really love. 20:23.730 --> 20:30.230 And it's digital forensics and focusing on digital forensics and incident response. 20:30.230 --> 20:32.330 So, now, next slide, please. 20:32.330 --> 20:34.910 Let's talk about incident response. 20:36.070 --> 20:39.490 Now, quick question for the listeners. 20:39.490 --> 20:50.110 What is the first thing that goes into your mind when you think about incident response? 20:51.050 --> 20:53.270 Next slide, please. 20:54.670 --> 21:03.550 Do you think of yourself like having a similar expression to this person in this photo? 21:07.650 --> 21:19.890 So, sometimes people consider incident response as one of the more stressful kind of work in the infosec area. 21:19.890 --> 21:26.710 Because basically, you're being called upon to respond to a particular incident. 21:26.930 --> 21:29.010 So, next slide, please. 21:30.070 --> 21:42.130 Now, before I start talking about incident response, I just want to clarify something about the terminology. 21:42.130 --> 21:52.170 So, when we talk about incidents, we need to always clarify that when we're talking about incidents. 21:52.170 --> 21:57.390 So, first off, there's the word event. 21:57.390 --> 22:07.490 When we say event in the context of incident response, an event is just basically something that is observable. 22:07.730 --> 22:10.270 An event is something that is observable. 22:10.270 --> 22:22.570 So, it could be, you know, there was a user connected to a particular website, visited a particular website, you know. 22:22.690 --> 22:24.210 So, that's an event. 22:24.210 --> 22:26.530 That is something that is observable. 22:26.530 --> 22:35.250 Now, when we talk about incident, incident basically means there was an event, an observable happening. 22:35.250 --> 22:36.690 How do you observe that? 22:36.690 --> 22:40.410 You have like logs, you have some evidence there. 22:40.610 --> 22:54.590 And the event itself, that's observable, is something that breaks, you know, the security triad, the CIA. 22:54.590 --> 22:57.990 Either confidentiality, integrity, availability. 22:57.990 --> 23:00.090 So, that becomes an incident. 23:00.090 --> 23:12.810 So, basically, an incident is an event that's observable, but it affects the CIA, or it breaks certain security policies in your organization. 23:12.890 --> 23:22.630 So, when we talk about incident response, it is a process to help protect the organization, and it has several stages. 23:22.630 --> 23:26.310 So, what's the difference between digital forensics and incident response? 23:26.310 --> 23:43.510 So, digital forensics by itself is both an art and a science in terms of understanding what has happened within a system or inside, let's just say, an organization or within your, you know, network infrastructure or your infrastructure. 23:43.590 --> 23:45.610 So, there are different artifacts. 23:45.610 --> 23:49.290 When we say artifacts, these are like the evidence, sources of evidence. 23:49.290 --> 24:00.310 And then incident response uses a lot of the techniques and knowledge from digital forensics in order to help protect your organization. 24:00.710 --> 24:10.470 So , incident response is, think of it like a practical organization, sorry, incident response is the practical application of your digital forensics. 24:10.470 --> 24:17.070 So, the incident response is like you're responding to an incident right now, the present moment. 24:17.070 --> 24:22.210 And then digital forensics, think of it, you're looking at what happened in the past. 24:22.210 --> 24:26.270 So , you're using your different tools and techniques to understand what happens. 24:26.270 --> 24:36.750 You're collecting all these artifacts, evidence, you're making sure that you preserve them just in case you need to present this, you know, case in court. 24:36.830 --> 24:41.470 So, that's the difference between digital forensics and incident response. 24:41.470 --> 24:43.870 Now, next slide, please. 24:45.630 --> 24:52.730 Now, when we talk about incident process, there are several frameworks that are available out there. 24:52.990 --> 24:59.270 So, the first one is the NIST, that's from the National Institute of Standards and Technology. 24:59.270 --> 25:12.350 And this particular incident response framework is actually in the special publication 800-61 Revision 2 or 800-61 R2. 25:12.350 --> 25:17.130 So, NIST is a government agency and works on technology. 25:17.130 --> 25:25.770 And their framework for incident response, or sometimes you can see it like incident handling, there are four steps. 25:25.770 --> 25:27.470 Now, there is SANS. 25:27.470 --> 25:34.490 So, SANS is known for providing security training. 25:34.490 --> 25:40.250 And initially, SANS used to call itself a Sys Admin Audit Network and Security. 25:40.250 --> 25:42.390 So, that's the meaning of SANS. 25:42.390 --> 25:49.510 And compared to the NIST, this is a private organization and they're very much focused on security. 25:49.510 --> 25:54.550 And for them, their incident response framework has six steps. 25:54.550 --> 25:57.430 Think of them, you have the PSIRL. 25:57.430 --> 26:03.670 This is the acronym for those steps for the SANS incident response framework. 26:03.910 --> 26:07.350 Now, can you please go to the next slide, please? 26:09.070 --> 26:15.650 So, for NIST, you have there the four steps in the incident response. 26:15.650 --> 26:20.350 So, you have preparation, and then you have detection and analysis. 26:20.450 --> 26:24.930 And then after the detection and analysis, you have containment, eradication, and recovery. 26:24.930 --> 26:29.190 And then after that, you have the post-incident activity. 26:29.530 --> 26:31.890 Now, let's look at the next slide, please. 26:31.890 --> 26:33.810 Can you please go to the next slide? 26:33.810 --> 26:40.110 So, for SANS, compared to the NIST framework, SANS has six steps. 26:40.110 --> 26:42.710 There are six phases. 26:42.710 --> 26:49.630 So, there's the preparation, identification, containment, eradication, recovery, and lessons learned. 26:49.630 --> 26:51.490 So, next slide, please. 26:52.510 --> 26:58.510 So, comparing this, you can see that both frameworks have the preparation phase. 26:58.510 --> 27:03.470 And then you have the identification phase as the second phase. 27:03.470 --> 27:09.670 And then you have the containment, eradication, and recovery, which are three separate phases from SANS. 27:09.670 --> 27:13.030 This is actually the third phase under NIST. 27:13.250 --> 27:22.590 And then the lessons learned phase from SANS is called the post-incident activity. 27:22.710 --> 27:30.350 So, at this point, I'm just going to go through the six steps of the SANS framework. 27:30.350 --> 27:39.550 So, when we talk about the preparation phase, this is where you should be making sure that you have your documentation in place. 27:40.490 --> 27:46.190 Ideally, you have your security policies. 27:46.190 --> 27:52.650 You do your reviews and you make sure that the security policies are well-known in the organization. 27:52.650 --> 27:56.810 This is the time where you're also doing a risk assessment. 27:56.850 --> 28:01.310 You're basically making sure that you know all your assets when we talk about assets. 28:01.310 --> 28:07.530 These are your endpoints in the context of incident response. 28:07.530 --> 28:10.250 It's your laptops, desktops. 28:10.270 --> 28:15.730 And then you also have to make sure that you identify what are the sensitive assets. 28:15.730 --> 28:22.670 And then you also make sure that you define which are the critical security incidents that the team should focus on. 28:22.670 --> 28:37.430 Because you don't want to call the incident responder when you're just dealing with what turns out to be a desktop issue. 28:37.450 --> 28:40.610 It could be like, oh, the printer didn't work or something. 28:40.610 --> 28:43.450 So, that's not a security incident. 28:43.450 --> 28:48.870 You have to make sure that you have a definition of severity levels, priority. 28:48.870 --> 28:59.430 During the preparation phase, if your organization hasn't built a computer security incident response team, this is the time that you should be doing that. 28:59.430 --> 29:01.490 During the preparation phase. 29:01.490 --> 29:07.750 And then you're also making sure that your team is prepared to respond to incidents at this point. 29:07.870 --> 29:11.110 Now, the second phase is called identification. 29:11.110 --> 29:15.610 This is when you have monitoring of your systems. 29:15.610 --> 29:21.370 And then you have to know what is normal operation, what is normal for your organization. 29:21.370 --> 29:28.550 And this is the phase where you are detecting any deviation from the normal operations. 29:28.550 --> 29:37.270 And you have to understand or check, make sure that these are representing actual security incidents. 29:37.270 --> 29:44.610 And during the identification phase, when an incident is discovered, you need to collect additional evidence. 29:44.610 --> 29:49.390 You need to establish the type, severity, and you need to document everything. 29:49.630 --> 29:55.790 And then from that second phase, you now go to the third step. 29:55.790 --> 29:58.150 This is where you do the containment. 29:58.150 --> 30:00.770 You perform short-term containment. 30:00.770 --> 30:08.350 For example, you may need to isolate a certain part of your network or a network segment that is under attack. 30:08.350 --> 30:26.450 And then you move to long-term containment, where you may need to implement some temporary fixes to make sure that your systems can still continue to be used in production, while at the same time, you are rebuilding the clean systems. 30:26.450 --> 30:31.290 And then from the containment phase, you move to the eradication phase. 30:31.290 --> 30:37.650 This is where if you are affected by a malware, you're removing malware from all your affected systems. 30:37.650 --> 30:40.990 And this is when you're trying to understand the root cause of the attack. 30:40.990 --> 30:47.730 And then you are making sure that you're trying to prevent similar attacks to happen in the future. 30:48.050 --> 30:56.150 And of course, that goes hand-in-hand with the recovery, wherein you will be bringing back your production systems online. 30:56.150 --> 31:00.970 You have to be careful before you bring back your production systems online. 31:00.970 --> 31:09.850 And typically, for a lot of the incidents I've worked in previously, there's always a check of the systems. 31:09.850 --> 31:20.690 For example, if there was a ransomware attack, before a system is fully put back to the production, we have to make sure that we have swept the entire system. 31:20.690 --> 31:23.690 Are there any indicators of compromise there? 31:23.690 --> 31:25.050 Is this a clean system? 31:25.050 --> 31:27.510 Can we put it back online? 31:27.510 --> 31:31.110 Or if it's like a backup, make sure that the backup is clean. 31:31.190 --> 31:37.290 And then part of the recovery phase is to test and verify. 31:37.290 --> 31:43.130 You monitor all the affected systems to make sure that they're back to their normal activity. 31:43.370 --> 31:46.310 Think of it like business as usual. 31:46.470 --> 31:49.710 And then lastly, you have the lessons learned phase. 31:49.710 --> 31:51.010 This is very important. 31:51.010 --> 31:58.170 Some organizations don't do this, but it's very important that you have a time frame. 31:58.290 --> 32:04.770 It's best that two or three weeks, not let's just say six months or one year after the incident. 32:04.770 --> 32:06.750 It has to be as soon as possible. 32:06.750 --> 32:08.230 Maybe it's like two weeks. 32:08.470 --> 32:13.510 You need to perform, let's just say, a review of the incident. 32:13.510 --> 32:18.310 You need to make sure that you have a complete documentation of the incident. 32:18.310 --> 32:27.610 If you need to further investigate the incident, you need to understand what was done to contain that incident. 32:27.610 --> 32:31.650 And then whether there's any improvement in the process. 32:31.650 --> 32:39.730 If you have issues in terms of processes, technology, or people, this is the time we're in. 32:39.730 --> 32:45.090 You're supposed to learn from this particular incident. 32:45.090 --> 32:50.210 But there should be no shaming, no victim blaming, and all those things. 32:51.690 --> 32:59.030 That's our basis in the incident response. 32:59.050 --> 33:09.070 Now, in terms of the preparation phase, you can see towards the right of this particular slide, I have an arrow called proactive. 33:09.070 --> 33:14.710 In incident response, we have what we call proactive and reactive side. 33:14.710 --> 33:17.630 When we say proactive, this is the part we're in. 33:17.630 --> 33:25.930 We are doing proactive projects or activities to help prepare us. 33:25.930 --> 33:33.130 And then towards the identification phase, towards the lessons learned, these are parts of the reactive. 33:33.130 --> 33:38.630 Wherein you're actually reacting to an ongoing incident in your organization. 33:38.630 --> 33:51.070 One of the activities that we do in terms of the proactive side of incident response is doing a tabletop exercise. 33:54.330 --> 34:01.050 Who among you here has participated in a tabletop exercise? 34:01.050 --> 34:03.170 Somebody could like, you know... 34:07.670 --> 34:17.210 Now, for the others who haven't participated in a tabletop exercise, I'm just going to be explaining what is involved there. 34:17.330 --> 34:20.950 Sometimes it's called TTX for short, tabletop exercise. 34:20.950 --> 34:24.330 So think of a tabletop exercise as a mock incident. 34:24.690 --> 34:27.650 So it's not a functional exercise. 34:27.650 --> 34:43.250 When we say functional exercise, you present the group with alerts and they're supposed to be trying to simulate how you're supposed to be responding. 34:43.250 --> 34:45.350 You're going to be checking the dashboards. 34:45.350 --> 34:46.750 It's a functional exercise. 34:46.750 --> 34:51.150 When we talk about tabletop exercise, it's a mock incident. 34:51.150 --> 34:57.630 There is a security incident and you are just giving them scenarios. 34:57.630 --> 35:01.850 And they're not going to be checking any dashboards. 35:01.850 --> 35:10.190 They're not going to be logging into the monitoring systems or the EDR, the endpoint detection response tools. 35:10.190 --> 35:11.850 They're not going to be looking at that. 35:11.850 --> 35:18.110 This is 35:22.170 --> 35:27.230 purely a tabletop exercise. 35:27.230 --> 35:34.250 Think of it, it's purely scenario-based. 35:34.250 --> 35:37.490 You are not responding to a real incident. 35:37.490 --> 35:47.470 Everybody's just there, sitting down, and everybody's just doing some discussions. 35:48.290 --> 35:58.870 And the goal here, there will probably be several goals, but mostly it's to test the IR plan. 35:58.870 --> 36:10.870 And then test the readiness of the organization in terms of if something similar to this scenario happened to your organization, what are you supposed to do? 36:10.870 --> 36:13.190 Who's supposed to be doing this? 36:13.190 --> 36:18.530 Who's supposed to be leading the incident? 36:18.530 --> 36:22.990 Who's supposed to be doing those other things that are in the IR plan? 36:22.990 --> 36:30.590 Before you actually have a tabletop exercise, make sure that you have at least a basic IR plan in place. 36:30.590 --> 36:37.090 And everybody who is involved in responding to the incident should be familiar with the IR plan. 36:37.090 --> 36:51.690 In terms of making sure that the discussion moves along, you need to make sure that when you create tabletop exercises, you have injects. 36:51.690 --> 36:58.930 Injects are additional information that you provide to the participants in your tabletop exercise. 36:58.930 --> 37:09.570 Ideally, the audience or the people who are participating in the tabletop exercise is composed of people who will be part of the incident. 37:09.570 --> 37:12.870 So you'll have a mix of technical people. 37:12.870 --> 37:28.850 And then also the best tabletop exercise will also have some people who are in the management area, because you will need to make sure that you involve certain managers so they're aware of what's happening. 37:28.850 --> 37:44.630 Sometimes if, let's just say, a particular incident would involve communicating with external agencies or external parties, you need to make sure that you have someone, let's just say, doing the comms for this. 37:44.630 --> 37:48.910 Because it could be, let's just say, the incident is like ransomware. 37:48.910 --> 37:51.590 You're preparing for a potential ransomware attack. 37:51.590 --> 38:00.070 You need to make sure that you have somebody who's in the legal team who may need to contact the insurance for your cybersecurity insurance. 38:00.070 --> 38:15.110 And then the other would be that you need to have an external facing statement from the corporate communications, providing a message out there that you have the situation under control and you're investigating it. 38:15.110 --> 38:22.110 So it would be good to have all these people who would potentially be involved in a major security incident. 38:22.110 --> 38:24.030 You can make sure that you have them there. 38:24.190 --> 38:41.810 Okay , so how are we, or like in my case, when I started, you know, creating scenarios for tabletop exercises for my previous clients, this is where the creative nerd came out. 38:41.810 --> 38:44.670 So I was a nerd first before I became a geekette. 38:44.670 --> 38:52.150 So the creative nerd in me started thinking about the things that I learned in my creative writing class. 38:52.290 --> 38:54.350 So next slide, please. 38:56.710 --> 39:06.250 So whenever I created scenarios, I made sure that I'm familiar with my client's incident response plans. 39:06.250 --> 39:15.230 And the incident response plan would actually have, you know, all these different IR bases, you know, identified there. 39:15.330 --> 39:28.430 So when I created, you know, a scenario, every time I need to create our scenario, of course, I need to make sure that first, okay, I set the scene. 39:28.430 --> 39:33.170 So think of it, it's like towards the left of that flat mountain. 39:33.170 --> 39:42.260 So I'm basically providing, think of it, I'm basically providing the exposition. 39:42.870 --> 39:52.290 So usually I put something there, like there's a day, okay, let's just say it's Wednesday morning. 39:52.950 --> 40:08.010 A user may, you know, a user contacts help this saying that they saw something unusual in their screen. 40:08.010 --> 40:11.350 And there was a strange message there. 40:11.350 --> 40:16.250 So think of it as, you know, preparing your, you know, scene there. 40:16.250 --> 40:19.390 So you're basically doing your exposition. 40:19.390 --> 40:33.030 And then afterwards, next inject, you know, for that tabletop exercise, other users started complaining that they can't do anything. 40:33.030 --> 40:36.430 So you're basically setting up the rising action. 40:36.430 --> 40:43.150 And then you start doing, if you're the incident responder, you start identifying who are the affected people. 40:43.150 --> 40:50.510 And then you ask them for, let's just say, any screenshots or read out, like if there's like any message that they see there. 40:50.750 --> 40:57.170 And then you have towards the top, the climax of where you're doing the containment eradication. 40:57.170 --> 41:00.190 Maybe it's because, you know, there's like another inject. 41:00.190 --> 41:04.870 You started like, you know, you saw the message and then you did some research. 41:05.680 --> 41:16.710 It's around some note and it's with a particular, let's just say, threat actor or a particular group, APT groups, that's like using this kind of, let's just say, malware. 41:16.710 --> 41:20.830 And then you start doing your containment eradication. 41:20.830 --> 41:28.870 And then you have your falling action or in your started doing your recovery as part of your incident response. 41:28.870 --> 41:30.470 What are you supposed to do? 41:30.470 --> 41:40.470 So it could be that you have other systems that were affected and you started like using, you know, your team backups, putting them back there. 41:40.470 --> 41:42.050 And then you have the resolution. 41:42.050 --> 41:49.510 Think of it, it's your lessons learned towards the end of that particular scenario in your tabletop exercise. 41:49.570 --> 41:58.450 So for those who may be tasked to do tabletop exercises, remember this plot structure. 41:58.450 --> 42:03.110 And then think of it, it's sort of like kind of mapped to the different phases there. 42:03.110 --> 42:08.670 And you can write appropriate injects for your particular scenario. 42:13.210 --> 42:15.530 Next slide, please. 42:17.250 --> 42:28.310 Now, after your tabletop exercise has been conducted, make sure that you have an after action report. 42:28.310 --> 42:30.490 Okay, this is important. 42:30.490 --> 42:39.730 This is basically documenting what was, you know, what happened during the tabletop exercise. 42:39.730 --> 42:46.610 Like for particular, you know, parts of these scenarios based on the injects. 42:46.610 --> 42:49.210 What was the decision? 42:49.210 --> 42:51.430 What did people, you know, decide? 42:51.430 --> 42:53.030 What did they do? 42:53.030 --> 43:10.490 If let's just say your goal was to improve the IR plan or the IR process, you have to make sure that someone during the tabletop exercise, someone was like taking down notes. 43:10.670 --> 43:14.670 And then these notes will form the basis of your after action report. 43:14.670 --> 43:20.470 You need to identify, let's just say, according to the incident response plan. 43:20.470 --> 43:41.710 Whenever, let's just say, major severity or, you know, let's just say major, you know, cybersecurity incident happens, there should be a message that goes out to the group chat over, let's just say, Slack. 43:41.710 --> 43:47.810 Okay, so if you're using Slack, so according to your IR plan, you're supposed to be using Slack. 43:47.810 --> 44:00.150 And then during the tabletop exercise, people started, you know, saying that, oh, we're just going to start sending messages via WhatsApp. 44:00.150 --> 44:06.010 So there's a deviation between the practice, actual practice and the plan. 44:06.010 --> 44:18.490 So you'll have to decide as an organization, like, are we going to change our incident response plan to indicate that whenever there's an incident, we're supposed to be using WhatsApp? 44:18.490 --> 44:24.410 So the question is, is WhatsApp one of your approved, you know, application when in fact you have Slack? 44:24.410 --> 44:33.470 So these things that you've learned during the tabletop exercise, you put it in the after action report, so that it will drive changes. 44:33.470 --> 44:48.930 Sometimes the incident response plan... you were using, let's just say, an old, you know, ticketing system, and then you move to a new ticketing system. 44:48.930 --> 44:55.290 And by the time that you did this tabletop exercise, everybody kept referring to the new ticketing system. 44:55.290 --> 44:58.830 So you need to, you know, update your IR plan. 44:58.830 --> 44:59.490 Okay. 44:59.490 --> 45:03.230 Now, next slide, please. 45:04.930 --> 45:21.270 Another application of the creative writing class, you know, learnings I had was whenever I actually sit down, and then I need to write a lessons learned report. 45:21.270 --> 45:26.150 So this is towards the reactive part of our IR process. 45:26.150 --> 45:32.590 So I make sure that I have documented what I've done. 45:32.590 --> 45:34.750 So this is like the how. 45:34.890 --> 45:37.050 And then sometimes there's the question like, why? 45:37.050 --> 45:44.790 Why was this particular, you know, let's just say, finding important. 45:44.790 --> 45:46.190 Why is it important? 45:46.190 --> 45:46.710 Okay. 45:46.710 --> 45:59.890 And then I have to make sure that I actually put there some recommendations so that, you know, in the future, what can we do in order to reduce the risk of similar incidents? 45:59.890 --> 46:10.390 And then sometimes when I write lessons learned report, it can be quite, you know, depressing because of what happened. 46:10.390 --> 46:35.770 And just, you know, between us in this particular space, there were times where in there were parts there that I knew with our team has already provided in a previous incident, but this particular client didn't learn from it, you know, they didn't like, 46:35.770 --> 46:40.290 you know, they didn't implement those changes. 46:40.290 --> 46:46.690 And then, you know, about a year or 18 months later, the same thing happened again. 46:46.690 --> 46:57.950 So sometimes it can be quite, you know, demoralizing, but I always try to, you know, remember, you know, like recognizing the positive. 46:57.950 --> 47:00.630 Okay, so I at least put something there. 47:00.630 --> 47:01.930 What was positive? 47:01.930 --> 47:03.310 Okay, I put something there. 47:03.310 --> 47:06.310 So it's not, you know, depressing. 47:06.310 --> 47:07.010 Okay. 47:07.010 --> 47:10.170 And then next slide, please. 47:10.970 --> 47:11.770 Okay. 47:15.090 --> 47:24.130 So when I write the lessons learned report, I also have to remember, what are my readers goals? 47:24.130 --> 47:26.430 Okay, so who's my audience? 47:26.430 --> 47:33.830 So the report that I'm writing is something that's hopefully going to be used as a guide by my clients. 47:33.830 --> 47:53.210 And then one of the things that I always make sure is that I write a good executive report, because depending on who your reader is, okay, there are some wherein they don't dwell into the technical aspect, like the indicators of compromise, they just want to know what happened. 47:53.210 --> 48:00.190 And the executive, you know, summary must have those, you know, think of it, the highlights, the important things. 48:00.190 --> 48:08.150 And especially for those higher ups, like executive level or something, they don't have time to dwell into the nitty gritty details. 48:08.150 --> 48:11.450 And they just want, you know, the executive summary. 48:11.450 --> 48:34.530 But I also make sure that the technical aspects is also documented, it's put in the lessons learned report, so that for the other teams that exist, it could be like engineering, it could be like, let's just say if the network was, you know, part, if there's like something like network related in the particular incidents of people in the network engineering, 48:34.530 --> 48:36.950 they look at it, they understand something there. 48:36.950 --> 48:43.330 So, it's very important to make sure that I have the reader's goals in mind when I'm writing. 48:43.810 --> 48:44.490 Okay. 48:44.490 --> 48:46.610 And then next slide, please. 48:47.410 --> 48:48.110 Okay. 48:48.110 --> 48:54.990 So, in conclusion, okay, I want everyone to remember the mounting. 48:54.990 --> 49:17.250 So, every time you look at the mounting, I hope you remember the plot structure, because the plot structure will help you in terms of framing the narrative when you're creating any tabletop exercise for any simulations, or if you are trying to write your lessons learned report, 49:17.250 --> 49:19.990 like how did the event unfold? 49:19.990 --> 49:21.810 Okay, remember the mounting. 49:21.930 --> 49:24.690 And then second point, think of your reader. 49:24.690 --> 49:27.350 Okay, who's your audience? 49:27.350 --> 49:29.030 Okay, what are their goals? 49:29.030 --> 49:37.410 What do they want out of your, let's just say, your lessons learned report and make sure that you present it in an orderly manner. 49:37.490 --> 49:42.130 And then this one is my call to action to everyone. 49:42.130 --> 49:49.110 So, everybody's saying like, oh, we have to be, you know, make sure that we have like, enough people going into STEM. 49:49.110 --> 50:14.450 Okay, please also support the arts and creative industries, because all the things that I'm doing in terms of the technical aspect, the background that I've had in high school in terms of creative writing, and other artistic classes that I took as elective has helped me in terms of communicating to the stakeholders, 50:14.450 --> 50:18.490 the management about, you know, issues or about incidents. 50:18.490 --> 50:24.310 So, please, let's make sure that we support the arts and creative industries. 50:24.310 --> 50:26.390 Okay, next slide, please. 50:26.390 --> 50:38.370 So, if you have any questions, okay, don't know whether we have that option here in this space, or I am in the Discord. 50:38.370 --> 50:41.130 Okay, you could ask me questions there. 50:41.130 --> 50:46.050 Or you can like send me a message, or like send me a DM in Twitter. 50:46.050 --> 50:46.670 Okay. 50:46.670 --> 50:55.630 Or it could be not even related to this, it could even be like questions about where's the best coffee in Australia? 50:55.630 --> 50:57.190 Not secret about it. 50:57.190 --> 50:58.290 It's in Melbourne. 50:59.330 --> 51:03.030 Okay, thank you very much for your time for having me here. 51:03.050 --> 51:05.230 And please take care, everyone. 51:05.230 --> 51:05.850 Okay. 51:19.270 --> 51:21.090 Is there a question? 51:21.090 --> 51:23.590 I think there's a raised hand icon there. 51:24.490 --> 51:27.730 I did have a question. 51:27.930 --> 51:34.250 So, this is related to but not exactly on your topic. 51:34.490 --> 51:42.790 So, how often would you suggest that a company does tabletop exercises? 51:45.610 --> 51:48.370 Let me just repeat his question. 51:48.370 --> 51:54.570 Ideally, how often should the company do a tabletop exercise? 51:54.570 --> 51:56.230 Did I get it correctly? 51:58.050 --> 51:59.250 Yes. 51:59.250 --> 52:00.030 Yes. 52:00.030 --> 52:00.690 Okay. 52:00.690 --> 52:04.790 So, ideally, it should be on an annual basis. 52:05.810 --> 52:06.650 Yes. 52:07.010 --> 52:10.790 So, and then why do I say on an annual basis? 52:10.790 --> 52:17.130 Because ideally, your IR plan should be reviewed on an annual basis. 52:18.010 --> 52:28.410 So, the ideal scenario is that or situation is that you make sure that everyone's familiar with their incident response plan. 52:28.410 --> 52:40.570 So, those who are involved in doing incident response should have, you know, a chance to go through it, to read through it, and then make sure that they're familiar with that. 52:40.570 --> 52:48.690 And then you make sure that you announce that you're going to have a tabletop exercise, make sure that everybody set aside time for that. 52:48.690 --> 52:54.930 It doesn't have to be long, it could just be three hours, okay, or four hours, depending on how long the scenario is. 52:54.930 --> 52:57.110 So, you can block, you know, like half day. 52:57.110 --> 53:05.330 And then you make sure that there is someone there who's taking down notes, because that's needed for the after action report. 53:05.330 --> 53:05.610 Okay. 53:05.610 --> 53:07.590 And then you run your scenario. 53:07.590 --> 53:22.170 And then based out of that, you know, scenario, then, you know, you go back if you need to, you know, review, change your IR plan, or if there are certain, you know, policies, you know, or processes or procedures that need to be updated. 53:22.170 --> 53:24.570 So, ideally, on an annual basis. 53:24.570 --> 53:36.230 And then you make sure that once you've updated your IR plan, you put there the date where you conducted your tabletop exercise. 53:36.230 --> 53:41.490 So, think of it as you tested your IR plan with that tabletop exercise. 53:41.830 --> 53:44.830 So, does that answer your question? 53:45.510 --> 53:46.890 Yes, thank you. 53:47.070 --> 53:48.550 Okay, no worries. 53:48.570 --> 53:50.070 Okay, anybody else? 53:54.050 --> 53:55.530 Okay, no questions. 53:55.530 --> 53:57.350 So, once again, thank you very much. 53:57.350 --> 53:59.130 Okay, how do I drop the mic? 54:00.350 --> 54:02.470 Press the letter R on your keyboard. 54:03.170 --> 54:04.830 Sorry, the letter what? 54:05.550 --> 54:06.890 Romeo, R. 54:06.930 --> 54:07.490 Ah, Romeo. 54:07.490 --> 54:08.710 Okay, thank you. 54:09.710 --> 54:12.870 Okay, and let me... Thank you very much. 54:13.450 --> 54:16.070 Well, thank you, Gael, for an excellent presentation. 54:16.070 --> 54:17.010 Thank you. 54:17.010 --> 54:23.970 We have about six minutes till the next speaker, so hang around, take a mile break, and we'll be right back. 54:24.350 --> 54:25.350 Okay.