Hello everyone, are you ready for the next talk? Awesome, this is Dumby, he is enamored with defense and predictive things. His career is focused on security operation, but he loves understanding the way systems operate. He is passionate about investigating root cause incident, of incident, sorry, or the things that came to be the way they are. Security is a full stack cross-discipline field and he loves learning about and digging into all. So what are for the review? Dumby. Well that's a little overwhelming. All right, so yeah, anatomy of a mega breach. This is a talk that I built out of the Equifax report that was a result of lots of work. I'd like to start with an interesting quote that they included that I really love. So failure to maintain an accurate inventory undermines all attempts at securing OPM's information systems. That came directly from the Office of Personal Management's Inspector General. So to get started, who am I? As mentioned I'm Dumby, I'm a blue teamer and just a general security nerd. I love everything about all sources of security. The mass majority of the information for this talk as I mentioned is pulled from the U.S. House of Representatives Committee on Oversight and Government Reform report on the Equifax data breach. It was released in December 2018 and it contains references and official sources for almost all the information that I'm going to have in this talk. The report itself is amazing and I strongly encourage everybody to go check it out yourself because it is just full of details and very relatable information. So the report itself is laid out in this format. It has seven sections, consumer reporting agency business model. Two, regulations for consumer reporting agencies. Three, anatomy of the Equifax data breach. Four, Equifax notifies the public. Five, specific points of failure. Six, Equifax remedian efforts. And seven, recommendations. The sources for the report were internal emails, Congress testimony, the Mandiant report, Equifax disclosures and situational updates, investor releases, public speaking appearances and a government consent order. One of my favorites. So why this talk? I was giving, I was reviewing the Equifax report. We're pretty lucky in the security industry to have awesome reports pretty consistently. The Verizon DBIR is amazing. This just came out another one and I'm always reading them and finding nuggets of wisdom in them. So what do I want you to take away from this? An understanding of the timelines of a major breach. The simplicity of attacks, the scale and why previous research of breach metrics are so important.  Or at least understand why it's important and you can support the people that actually get along with your executives. It's a great example of why forced action really sucks and why everyone should do work to avoid it. Basic hygiene and IT security matters. As we just heard in the panel before, you can get started with security no matter the scale or scope and even large companies don't do this stuff. It's not common that you find people doing all the basics. The sans top controls, the sys top 20, all of those go to the wayside. So starting from a small business up is very, very important. And also an appreciation and an understanding of just how much action there is in an enterprise as a result of a breach. Lots and lots of stuff changes, hopefully at least. So let's go over a brief timeline of the Equifax breach. March 7th, there is a struts vulnerability publicly disclosed as CVE 2017-5638. On March 8th, the next day, the US CERT notifies Equifax directly of the struts vulnerability. On March 9th, Equifax's global threat vulnerability management team, their GTVM, inform systems administrators of the vulnerability. On March 10th, forensics completed show, Mendient later completed forensics that show that on March 10th, some hackers at actually compromised boxes with struts vulnerability and just ran who am I and left them there. Nothing more than that. On March 14th, Equifax is emerging threats team. They have a dedicated emerging threats team, released a snorts signature specifically for the struts exploits that were public. Equifax's countermeasures teams deployed those rules to their IDS and IPS systems. On March 16th, the struts vulnerability was discussed at a monthly meetings of the GTVM, their vulnerability management team. The team is made aware of in the wild exploitation. They know this stuff is happening in the wild. Admins responsible for the struts are simply reminded to update immediately. So let's do a quick rewind. Within days of the struts vulnerability being disclosed, they had specifically updated their IDS with signatures for struts, but it didn't find any struts exploitation. The admins are reminded to check for vulnerable versions and update. All of this failed. Witness testimony collected indicates that the difficulties of scanning a complex legacy environment was the reason that the scans failed to detect the vulnerability. So let's talk some patching. Unlike Equifax, at least these guys really saw there was a problem and tried to fix something. And you're going to see that the common theme throughout this talk is that patching is core. It's critical. And also mentioned in the panel, sometimes you can't patch when you got to be aware of that.  So let's review the ACIS, the automated consumer interview system. It is a public facing system that is used to dispute incorrect information on your credit file. So anytime you get a delinquent bill that's wrong, you submit your files to the system. It was built in the late 1970s to address the Fair Credit Reporting Act. The VP responsible for the environment at the time of the breach was hired in 2014. It was built on sun servers, running struts. The inventory was reduced to less than 200 servers, but they were running a variety of versions of OS. The Apache Struts. So let's go over that real quick. So it's an application for deploying Java web applications. Struts 1 was released in 2000 and it's been maintained since then. Struts 2 was released in 2006 and maintained 27 vulnerabilities of a CVSS of 7.5 or higher since 2006. This is a big risk program and you should be very aware that it's in your environment. Also there have been additional 12 vulnerabilities since 2016, including six that were higher than a CVSS of nine. This is very serious stuff. There is no comprehensive software inventory of the ACIS. Patch management policy relied on administrators knowing their system software inversions and tribal knowledge. They relied on manually initiating patching process. There was no automation. The VP wasn't aware at the time of breach that struts was used in the environment. He gained this awareness July 30th when he was notified that they needed to shut down the system. When probed about how widely Equifax used struts, the CSO was not able to answer. They just didn't know. Conflicting reports on software inventory thoroughness. The CSO was not confident that a single comprehensive inventory was available to employees. This is critical. If you're running a big corporation like this, you've got to have an idea of what your inventory is. So there's a possibility that individual lists were maintained by IT and security, but they never had cooperation to synchronize and make sure that they were up to date. Equifax had a lot of people engaged in specifically inventory management, but at the end of the day it didn't matter because they just didn't bring it together. Legacy systems were noted as especially difficult to inventory. Scanners and automated systems for its information gathering weren't prepared to completely function with Sun servers. So on May 13th, attackers exploit struts too in the ASIS environment. On July 29th, Equifax detects the data breach. At 9 o'clock p.m., the counters measure team is doing standard maintenance and they upload 67 new SSL certificates to their IDS and SSL visibility platform. Four is specifically for the ASIS environment. SSL inspection resumes and almost immediately a review of packet captures detect suspicious requests to a Chinese IP. The server response contained more than 10 megabytes of data. That's just always weird. They also thought it might be image files related to credit investigations. While inspection of SSL traffic wasn't functioning, Equifax had been collecting PCAP and had historical data. The IT team implemented MOLOC and reviewed that historical information and detected that since at least July 25th there's been this activity going. So they were pretty lucky that they caught it within four days just by chance. The counters there's also an additional Chinese, German IP that was being leased to a Chinese provider that they discovered as well. And the counter measures team blocked the ISP in an attempt to try to prevent the attack from furthering. So on July 30th, the incident investigation continues. They conduct vulnerability tests of the ACIS environment. They discover rendering system vulnerable to SQLI and insecure direct object reference attacks. These were not discovered in a previous vulnerability scan that was run in April of 2017. So just a couple months and for some reason the results are changing. It is unclear why the scans produce different results. The forensics team discovered that there's exfiltrated data likely contained personal information, PII. The continued observation of suspicious traffic originated from a secondary IP to belong into a German ISP but was leased to a Chinese provider. At 1241 p.m. the ACIS web portal is shut down for emergency maintenance and that ends the direct cyber attack against Equifax. The CSO was informed of the incident at 1.30 p.m. and joins a conference call with the IT and security groups. An email is sent to the chief legal officer who was on vacation as well as his covering employee but neither responded that same day. At 6.30 p.m. the CSO, the chief security officer calls the senior manager for the ACIS application. She informs him of the situation and requests information about what is being run in the environment. Resources from his development team are requested to assist in the investigation and research of the potential breach. The senior manager informs the CIO of the incident at 7.16 p.m. On July 31st Equifax initiates an incident response so it took them up until this point to be confident that there was an issue that they needed to handle. They assigned a codame of Project Sierra to the IR efforts. At 7 o'clock a.m. they have a call to review the vulnerability assessment findings from the scan on the day before on July 30th. The CIO and the ACIS manager meet in the morning to discuss what is known but neither are familiar with how severe the incident may be yet. It's suspected that struts vulnerability was exploited. The ACIS developers provide a web archive file for forensics and security team verifies that indeed the ACIS environment has struts that is vulnerable to the recently disclosed vulnerability. CSO reviews information from forensic analysts and informs the CIO that PII is likely involved. So now the chief legal officer has been engaged and he's aware of the issue. The CSO does not inform the CIO of a concern that PII was breached. So again you have information being shared but it's not cohesive and it's not understood why some information is going to some places and not others. On August 1st the CIO has provided a brief update on the investigation. While it was progressing there was no new information known. The CIO leaves on vacation August 2nd and doesn't return for two weeks on August 16th. July 31st the CIO informs the CEO about the security incident and that limited information is available. On August 2nd Equifax contacts outside council and informs FBI of the breach. Outside council contacts Mandiant and they're hired to buy Equifax to complete a forensic investigation and determine the scope of intrusion. On August 3rd Mandiant begins forensic review that concludes on October 2nd so that's a very long investigation. Mandiant preserves databases searches for relevant queries used by attackers and they identify potential access points based on forensic markers. They recreate the attackers actions discovered the extent of information access at least preliminarily. On August 11th Mandiant identifies potential access consumer PII by the attackers. On August 15th IT employees informed the CEO that PII was likely stolen. On August 17th it's determined that large volumes of PII had been compromised. There is a meeting to review the status of the forensic investigation that includes the alphabet soup of executive CEO CIO, CLO, CFO and an ACES representative. The CIO returns from his vacation the previous day and gets up to speed. On September 1st Equifax convenes a board meeting to discuss the investigation scale of the PII compromise and notification plans. Senior leadership team meets again. The CIO discusses status of forensic investigation, number of affected records, possible causes and further investigative actions. Let me highlight that's a pretty big gap of about 15 days that they just kind of have to sit around and wait for the giant engine of corporatism to move around them. On September 4th Equifax with forensics information from Mandiant completes a complete a list of approximately 143 million affected consumers. They initiate Project Sparta and I consider this Equifax getting ready to go to war. They know that there's something big happening. They're trying to get prepared for it. So they have a response related effort initiated to prepare a consumer facing website. This website was meant for people to use in the public to identify if they were part of the breach and also to be able to register for the wonderful credit monitoring and identity stuff services that so many of us have now. There were 50 to 60 IT employees directed towards Sparta so taken from their normal duties and instantly thrown into this random development project to say, Hey, we're going to have a bunch of people hitting a website. Can you build this thing for us? They aren't informed exactly what has happened, but to hold prepare a web portal for a mass amount of consumers to hit systems. So Equifax runs on a business to business model. They provide information to other businesses that they can use to justify if you are worthy of their services or not. They are not prepared for 143 million people to access their services. They engage contracts to ramp up to 1500 call center agents when they normally have 500. So you can see they didn't really do a whole lot. Just because they they they had a poor perspective of how many people would be interested. So they prepare for the September 7th notification to the public. That's three days of development for an entire team of 50 to 60 IT employees. How many people have developed a simple web project with that many people in a day? It doesn't happen. It's impossible. So they they initially had the 500 call center employees. They ramp up to 1500 and then it takes them a few weeks to get to about 3000. On September 7th they announced the data breach. A cybersecurity incident affecting approximately 143 million U.S. consumers is announced. Type of information includes social security numbers, birth dates, addresses, and driver's licenses. So again 143 million people need to be informed and that's just the directly affected. You have everybody in the U.S. and Canada wondering if they're part of that. So the attackers also access 209,000 credit card numbers, 182,000 credit dispute documents that included PII. Those were just any random images you uploaded to support your case as to why you needed to get something off of your credit record. So consumers are directed to the infamous EquifaxSecurity2017.com domain. How many people remember the joy that that was? It was really fun that day. The stock drops 35% in the first week. It's nice to know that people actually took this seriously. It was a big deal. Federal regulators announced or confirm investigations and the U.S. cert team warns consumers of phishing scams leveraging the data breach. So issues with the Equifax Security2017.com domain. Website and call centers are immediately overwhelmed with requests and consumers are left without answers as to whether they are affected or not despite being designed for an intake of at least 143 million people over three weeks. Again, why they had a timeline that people were going to be like, I got like a couple weeks to check if I'm part of this. That's not realistic. So Equifax representatives on Twitter aren't clear which domain to use and some end up using the wrong domain. Security Equifax2017.com instead of EquifaxSecurity2017.com. There's a wonderful security researcher that set up a phishing page on the wrong domain. Luckily they used it as an awareness opportunity and didn't do anything malicious with it but it was super hilarious. Website provided consumers with incorrect or incomplete information. Some individuals who was sent to sign up for protection services were just told, ah, sorry we don't know how to do that right now. People received completing answers about whether they were affected by the breach. You could check on your phone or you could check on your computer or other computers and you would get different results checking the exact same website with the exact same information. It was hosted in a large cloud provider but the bottleneck was in the application developed by again 60 plus IT people in the span of one to three days. The internal systems couldn't keep up with them the demand because again they went to a cloud provider but they have all these back end systems to do their own validations and checks that couldn't keep up. A coding issue affected the capability to accurately identify whether a consumer was a victim of the breach or not. A rush on development likely led to the quality issue. And again this is all documented in the report. It's wonderful. September 15th the CIO and the CSO retire. The CEO retires on September 26th. On October 2nd of 2017 more victims are announced. Throughout the investigation Mandian reported had found some failed database queries but upon re-examination they actually discovered that they were successful so that came with an additional 2.5 million records. The senior manager of the ASIS environment is terminated. He was informed that the reason was a failure to forward an email. So I don't know how many people have ever been a CIO of an environment and been fired because they forgot to forward an email but that's pretty hilarious to me. The GTI so and also it was a GTVM email that was sent broadly to over 400 people. This wasn't targeted towards a specific group. It was just that vulnerability management team saying hey everybody that owns systems struts is vulnerable. Go deal with it. Because he didn't forward that he was fired. October 3rd 2017 the former CEO testifies before Congress. He repeatedly mentions the manager failed to act on security warning as a key failure. These ASIS manager a guy named Payne later testifies on the allegation he failed to forward the patch email on March 9th. He claims and very validly that there was no established process in the patch management policy that required him to take any specific action. The committee informs confirms that he was never directed by anyone to forward such emails. On March 1st of 2018 Equifax updates announcements from September 7th and October 2nd. It confirms the identities of an additional 2.4 million U.S. consumers that had names and partial driver's license information stolen. They were not previously identified in the affected population so the total number of individuals is brought up to over 148 million. So there are 12 standard data elements that were taken from databases and I'll cover those in the next slide here. As well as those images that were uploaded to the dispute portal. On September 6th of 2018 with the investigation starting in August it took Mandiant approximately 30 days to arrive at a firm number of impacted consumers. With the data and many tables and databases they had to do all sorts of assessment analysis to avoid double counting. They had to meet with individual database owners to track backwards and identify what these random disparate bits of information actually were because they were tokenized and all sorts of things which some of it was tokenized some of it was just randomly generated type stuff. But they had to do full investigation Mandiant had to go sit with database owners and walk through their schemas and all of that. Mandiant um on top of that Mandiant had to actually identify who the even who the owners of the databases were because this wasn't publicly or privately known information to Equifax themselves. So let's cover real quick the actual data that was taken. Alright so we have the name, date of birth and social security number of at least 145.5 million people. The full address of additional 100 million people. The gender and phone number of an additional 27.3 million people. The driver's license number of full number for 17.6 million. The email address is for 1.8 million people. Payment card information about at least 209,000 records. The full ID for an additional 97,500 people. Driver's license info for 27,000 and again 182,000 random images that could be anything uploaded to that dispute portal. So that kind of covers a timeline of everything and let's go over the really interesting bit of organizational structure and the dynamics and issues that resulted from that. So this is going to sound like a really long-winded corporate tirade but I think it's really important to understand that they did have policy in place. They had reasonable people doing reasonable work constantly. It just wasn't enough. So let's go over a brief history of the corporate ladder and I like this one because it's also kind of like a crappy Dr. Seuss rhyme for corporate. So prior to 2005 the CSO reported to the CIO Robert Webb. An internal restructure resulted in the CSO reporting to the chief legal officer instead. Richard Smith was hired as a CEO. Tony Spinelli is hired in 2005 as a CSO. Spinelli presents a three-year $15 million plan to reorganize IT security across the entire enterprise. There's fundamental disagreements and there's a devolving relationship. Security functions were removed from IT to legal. The CIO was removed from controlling security and it was placed under the CIO. The CIO was referred to as the head of security. That's chief legal officer if I didn't make that clear. 2010 David Webb is hired as the CIO, the chief information officer to replace Robert Webb. In 2013 Spinelli leaves Equifax. Susan Maldin takes over as the CSO. Despite the CIO Webb discussing the organizational structures reverting, it just never does. Maldin testified that she saw no issues with the structure of the CSO reporting directly to the CIO. The CIO were for uh the web testifies the previous CIO testified that this arrangement was atypical to him. In 2017 the CIO Webb retires in mid-September. Webb testified that two weeks prior to this he had discussed with the CEO and CIO about moving security group back under the CIO. On September 15th Equifax announces that Webb, the CIO and Maldin the CSO had retired and interim officials would temporarily fill the positions. The interim CSO reported to the interim CIO. This structure continued until February 2018 when a permanent CSO was hired and the CSO now directly reports to the CEO. That's a good move. Testimony proves the disconnect between the CIO and the CSO which created an accountability gap.  Uh C. So Webb attempted to separate IT from security and often referred the committee to the CSO. Uh I'm IT. Security is not my gig. Go talk to this other person. The CSO saw the responsibility as global and whose function was to set forth the rules and policies for the enterprise. It would then work with the IT team to implement the rules and security had established. There was no clear responsibility of enforcement for all of this stuff. Uh according to the organizational structure. There was no high degree of coordination and communication between security and IT groups. Collaboration between IT and security only happened when required. This separation also led to issues such as the lack of IT security coordination regarding asset inventory. Super important. Security group was responsible for the what and provided security engineering. Security could not affect changes to infrastructure. Uh in the case of a new controller appliance, security would make the request. IT would review and approve. Installing any necessary hardware software and then allowing security to get back in and configure it. They could operate software but not install it or change infrastructure. Security was responsible for ensuring the work was completed properly. IT implemented at the direction of the CSO. In April 2016, IT had a risk and compliance group and it was removed under pain. Who is also the ASIS manager that we talked about earlier. This added the responsibility for access management, IT audit coordination and IT security coordination. Pain initiated a process of monthly meetings between IT and security, CLO, CSO, CIO and he himself participated. Uh they identified 10 to 20 initiatives and started tracking them. The testimony from pain indicates the much uh the patch management and certificate deployment were included in those initiatives. A lack of both directly contributed to the breach. The CEO did not prioritize cyber security. Quarterly senior leadership meetings discussed IT security but only as one of many topics. The CSO was not considered a part of senior uh leadership. They were executive but you know just kind of down a couple tiers from the CEO. Uh information was generally presented by the CLO who had no background in IT or security. Again that's their lawyer. Uh the CSO was the company's IT expert but they didn't have a place in the the executive meetings to have their say. So a quick review of standard organizations. The Aponomon Institute survey found 50% of CSO report directly to a CIO. A 2018 Pricewaterhouse Cooper study concluded is more common for the CSO to report directly to the CEO. Or a board rather than the CIO. 24% of CSO report to CIO while 40% report to a CIO. Just kind of interesting stats there. September 2017 there was a revamp. So following all these announcements in the retirement of the CIO and the CSO, the CSO was retitled to the chief information security officer and they report directly to the CEO. The CIO was retitled the chief technology officer and he also directly reports or they also report directly to the CEO. This reorganization recognizes that cyber security is a core business function and it needs a place at the table. It is a drastically different from the previous organization and it does encourage collaboration between the CTO and the CSO which is super good. So structure of patch management. Again this stuff was in place during the time of the breach. So the patch management policy defined roles and responsibilities and established guidelines for the patching process. It designated two employees to lead implementation, a policy manager and a senior leadership team owner. The policy manager was to ensure that all the work was tracked and the leadership team owner was to ensure the organization conformed to the policy. 2016 they had an official patch management policy for the enterprise. It was in place on March 8th when the struts vulnerability was announced. The CIO was senior leadership team owner and the CSO was the policy manager. The business owner is informed of need to patch and responsible for approving downtime to apply it. The system owner responsible for applying the patch and application owner is responsible for ensuring it was applied properly. Many roles and responsibilities were defined in the policy but no employees were officially designated for the roles. Patches received a critical LED classification by vendors. While Ikefax could alter this they usually just adopted the vendor's classification. Struts was identified as a critical, hands down, no questions about it. And policy dictated it should be resolved within 48 hours of the patch dissemination on March 9th of 2017. This patch was not properly applied until the discovery of the breach in July of 2017. It is confirmed to exploitation of this vulnerability was the source of the initial intrusion. In testimony, Payne the ASIS manager was asked to identify employees by the roles listed within the patch management policy. Specifically, business owner, systems owner and application owner. There were no employees designated for those roles. Payne testified and this is one of my favorite things of the entire thing. So he testified that he had no specific role or responsibility to patch the ASIS system stating that he was a manager of managers who managed teams that would fulfill the roles laid out in the policy. So you can see here I have this nice red box. Responsibility? There is none. Everybody can point fingers and say, well these people were supposed to do this but they were supposed to get information from these people and nobody has responsibility at the end of the day. Payne just slides by and gets fired because he didn't forward an email. So the patch management policy required system and application owners to subscribe to the vulnerability distribution bulletins. There were no official designation of who was supposed to be subscribing to those bulletins and receiving information. There was no mechanism for ensuring anyone followed the subscription requirement. The CIO testified that the patch management policy did not work in the case of this vulnerability. Process was in place but no people to conform to it and there was a failure in the technology to ensure the policy was enforced. So executive leaders noticed many issues in the patching process as far back as 2015 when they did a full patch management policy audit. A number of significant deficiencies were identified within the patching process and I ate detailed findings and recommended actions were provided. Not many of these identified issues were ever remediated over a very long time scale. You're talking years. No automated patching tools were implemented to establish redundancies in the patching process. Asset management controls were a need of improvement. As of July 2017 the company did not have a comprehensive software or IT asset inventory. They did not. Employees had previously identified the presence of struts in the ASUS environment because they remediated another struts vulnerability in January of 2017. Can you see like it's crazy that they're doing things but there's all this stomping over from January to March. They somehow forgot that struts was there. Information wasn't reliably tracked and they failed to identify the presence of struts in July of 2017. So just a review real quick. I really do appreciate the patch management audit that they went through. I'm just going to breeze through these eight findings real quick. So the finding and the manage the suggested recommendation the complete buy date. So one vulnerability is not remediated in a timely manner. The recommendation implement automated patching tools and retire legacy systems as quickly as possible. That was supposed to be done by end of year 2016. Equifax lacked adequate asset management procedures. Recommendation improve IT asset management controls completed by mid-year 2017. Three systems were not patched in a timely manner. Recommendation implement and enforce a proactive patching process that was supposed to be completed by end of year 2016. Four vulnerabilities were not adequately tracked prioritized and monitored to ensure timely remediation. An honor system was used to ensure patches were installed. No controls in place such as a patching exception tracker to escalate vulnerabilities not remediated in a timely manner. So recommendation create a controlled patch and exception process to assess prioritized blah, blah, blah. Long term solution target 2017. Five new system and changes to existing systems were not required to be scanned so you should probably scan stuff. They wanted to start doing that. That was supposed to be completed end of year 2015. They never started scanning new systems as they were set up. Six server hardening standards have not been developed for window systems. Recommendation document and publish windows server hardening standards completed by March 31st of 2016. Seven patches were inadequately and inconsistently tested prior to deployment. Recommendation test your patches completed by mid year 2016. Eight patch management policy did not consider the criticality of an it asset when determining the time frame for patch installation. Recommendation review all it assets and classify risk enhance the patch management policy to include more things or more stringent patching requirements for high risk systems completed by end of year 2015. So how many of those did they get done again? This is their stuff. This is an executive that went through and did got a whole team together in 2015 and found all this great information. They just couldn't act on it. So the certificate management process as we discussed earlier, Equifax was aware of a disconnect between policy development and implementation of certificate management. It had no process for updating SSL certs. Security employees uploading the strut signature rule into their IPS noted issues. They had two recommendations of what to fix. And this was coming directly from the IT employees themselves. Number one, define who owns SSL certificates. Number two, create and validate an SSL certification or an SSL certification update process. So this reconfirms that process really matters. I don't understand how they had all this overhead and all this prompt planning and preparation. They just refuse to get process in place and responsibility in line. So an internal vulnerability assessment tracker entry from January 20th of 2017 stated SSL visibility devices are missing certificates limiting visibility. At the time of breach, 324 SSL certificates had expired, 79 of which were for monitoring critical domains. This failure directly led to a loss of visibility into the intrusion on May 13th. So more on ASIS? Yes. So Equifax was fully aware a legacy system from the 80s was being used by millions of customers in a public facing manner. It still failed to prioritize security and modernization. The CSR requested an assessment of the ASIS security concerns and preparation for the August 17th meeting of the Databreach investigation. Six concerns were cataloged. Number one, no segmentation between sun servers and the rest of the Equifax environment. Access to the ASIS network grants access to any other database device or server within the Equifax network globally. A 2015 audit indicated the lack segmentation. Again, we reviewed that. They knew they only needed access to three databases for the application, but far more available. Mandy confirms the segmentation would have restricted the severity of the breach. The CSO and the CSO and the CIO testified that before the breach, they were unaware that ASIS lacked segmentation. Surprise. Two, file integrity monitoring or FIM is not in place for application or web servers. There were no alarms generated when over 30 web shells were up placed within the Equifax network. The CIO testified that before the breach, she was unaware that file integrity monitoring was not implemented in the ASIS environment. Three, sun systems use an NFS. Access to one machine grants access to the entire NFS, including administrator and configuration files. An Equifax vulnerability tracker found as sun server accepts NFS requests from any source. The NFS contains stored application credentials that granted access to sensitive systems outside of the ASIS environment. Four, logs are only retained for 14 days on system and 30 days at a collector. NIST recommends that high impact systems retain logs for between three and 12 months. Studies continue to show that the average time to dwell or time to detect of a security breach is 98 days. The CIO dismissed log retention periods for internet-facing systems. Five, a complete inventory of resources within the application was not maintained. A 2015 audit found that IT inventory did not exist nor did accurate network documentation. A global view of IT infrastructure did not exist. The CIO dismissed the importance of an inventory for the security team. Six, consistent and timely patching of sun systems is a general observation is a concern. Equifax admitted patch management was ineffective. The 2015 patch management audit corroborated this. They recognized that the patching process was not being properly implemented and failed to take timely corrective action. So here's some of my favorite things. Again, these are all pulled directly from the report and this is what I'd like to call my haul of what? So I'm going to review the quote in the beginning. It is critical for organization to know what assets are present within its IT environment and to make accurate and informed risk determination such as when and how to patch a vulnerable system. As the Office of Personal Management's Inspector General warned part of the 2015 OPM data breach failure to maintain an accurate inventory undermines all attempts to securing OPM's information systems. So let's go over some of these quotes. Well, it's not necessarily too short. I think that logs in the retention of them is always and it depends kind of answer. It depends on what they're used for, how much space they take and those kinds of things. So there are various strategies with logs and it's really in my opinion dependent on that environment. Question. Well, depending on this ASUS environment external facing is 14 days on disk and 30 days collected sufficient in terms of and they get cut off. I think it certainly could be sufficient. So are you question? Are you surprised that there's not a complete inventory in this type of environment? Answer. I wouldn't say that I'm surprised. No, not necessarily, but that that would not from a security perspective keep us from doing our job properly. Question. Wouldn't you have to know though that the Apache Struts software was operating in this environment and if you didn't have an inventory you wouldn't know. Answer. Well, we might not know. But again, I don't think that not knowing that would prevent us from doing the right things from a security point of view. It's all in the report. It's amazing. It's it's it's glorious. So the CIO indicated that Equifax was in the process of making ASUS compliant to guess what we heard in the last panel two PCI DSS. This is pretty hard. This isn't something that you just like suddenly go and do, but it's pretty good because it has five main things that you want to worry about. Number one, use of file integrity monitoring to strong access control measures. Three, retaining logs of at least a year with immediate availability of three months. Four, installing and updating patches. Five, maintenance of an updated inventory system. They started the compliance process in August of 2016, but it was not completed in a year by August of 2017. There was a modernization process underway at the time of the breach. This was essentially a rebuild of everything instead of attempts to maintain that legacy ASUS environment built on Sun servers. Their next generation environment was a private cloud. They were going to implement best practices, orchestration, all this good stuff. The project was started in 2015, but by 2017 the ASUS application had not yet been integrated into the replacement environment. The biggest delay was a lack of domain expertise in the legacy environment. Additionally, they were building a consumer care management system to replace the ACS. Development started in 2014 but fell behind as a priority. While risk was a major motivator for the new system, they were primarily concerned with the difficulty and cost of maintaining a legacy environment as well. So let's see. So again, time to dwell for the attackers was May 13th of 2017 to July 30th of 2017. The recommendation of Mandiant and there's a lot on these slides coming up so I'm just going to kind of run through them. Number one, enhanced vulnerability scanning and patch management processes. Two, reduce the scope of sensitive data. Three, increase restrictions and controls for accessing data housed within critical databases. Four, enhance network segmentation. Five, deploy additional web application firewalls. Six, accelerate the deployment of file integrity monitoring. Seven, enforce additional network application and database level logging. Eight, accelerate deployment of a privileged account management solution. Nine, enhance visibility for encrypted traffic by deploying additional inline network traffic decryption capabilities. Ten, deploy additional endpoint detection to response agent technologies. Eleven, deploy additional email protection and monitoring technologies. So how much of that was directly related to the breach that just happened? All that stuff is really good but it's useless in the context of just stopping this specific breach. So the former CEO testified in the progress of recommendation implementation on October 3rd to 2017. The process the progress was vulnerability scanning and patch management processes and procedures were enhanced. Scope with sensitive data retained had been minimized. Restrictions and controls of sensitive data strengthened. Network segmentation increased for internet facing systems. The WAF was deployed, signatures tuned, deployment of file integrity monitoring, implementation of a more thorough application database and systems logging. A 30, 60 and 90 day implementation plan for additional improvements. A firm independent commandee will conduct a top to bottom assessment. Of Equifax's information security stature. Mendiant and Equifax confirmed that all 11 remedial recommendations have been implemented in August of 2018. So September 19th of 2017 to August of 2018 is the time from recommended by Mendiant to implemented by Equifax. So here's another bit of testimony. So answer. So yeah, several of those were underway and were things that we were already working on with the security program. Some of these got accelerated and were able to it looks like get a boost as a result of having Mendiant and additional resources to get those implemented. When you say accelerated, is that as of July 2017 or prior to that? Answer. What I was referring to is after Mendiant came in to assist with the investigation, they were able to add resources to help us get some of these things finished more quickly than we would have done in our own natural timeline. So forced action, there is a consent order from the government placed on Equifax as a result of their investigation into them. So there's so much about to blow through and I'm just going to blow through it real quick because it is you do not want this. It overall addresses the information that is necessary for Equifax but it has something to do like who reviews what, how often in what detail. You want to avoid this. Do not get the government into your business and telling you what to do with your IT because government in cloud definitions that's pretty much my nightmare. A government well maybe except for a governmental order to get an IT asset inventory. You probably don't want that either. So they had 90 days for the following a risk and risk assessment that addresses foreseeable threats to the PII of the company potential damage to the company's business operations. Safeguard for mitigating controls to address each threat and vulnerability. Yeah. So board and management oversight approve a consolidated written information security program and policy that can be updated annually review annual report from management on adequacy of information security program and hence level of detail within board minutes review and approve standard IS policies and ensure they are up to date. Ensure IR procedure guys are up to date and clarify roles and responsibilities of groups involved in incident response. Vendor management monitor management's documentation of efforts to comply with PCI DSS review and approve policy procedure for outsourcing management oversee management's development of a definition of cloud service. Development of policies that provide guidance for the use of cloud-based services for when the use of cloud-based services is permissible. Patch management identify comprehensive IT asset inventory that includes the hardware software and location of assets. Formalize an identification process for patches that need to be installed. Develop an action plan for decommissioning legacy system including compensating controls systems until systems are removed. Formalize patch management policy IT operations ensure the key processes continuity plans are independently reviewed at least annually. Formalize emergency change standards 30 days to improve the oversight of auditing a formal risk analysis process used to set scope and frequency of IT audits an audit schedule prepared on a multi-year basis audit of critical and high-risk areas at least annually. Issues tracking report and issue aging reports submit quarterly to an audit committee. Validation via internal audit the severe issues are resolved in a timely basis. Guidelines for ensuring the internal audit is not involved in daily operations. By July 31 approximately one month from the consent order being issued submit to multi-state regulatory agencies a list of all remediation efforts planned and processed implemented in response to the breach. Written report outlining progress toward complying with each provision of the consent order. These then must be submit every quarter. There's still more. Six months to do formalize a process we're to only identify what patches need to be updated. Popular current metrics prioritizing address outstanding critical high-medium risk patch management audit findings provide programmers job-specific training covering secure coding conclude process of removing systems access of development staff for production environments. Equifacts board will require management to have an independent party test controls relating to all remediation efforts and related multi-state agencies blah, blah, blah. It's you don't want that. It's the worst. It is the most heartbreaking thing to read through that entire government consent order. That's I don't recommend you do. So tally up the damage. Credit card numbers for 209,000 US and Canadian consumers PII of 146.6 million consumers. 225.15 221.5 million dollars in cost in 2018 alone expected to reach 350 million dollars by the end of the year. The incremental cost to transform IT infrastructure to these professional services and costs provide to the consumers. 61.4 million dollars in legal and investigative fees. A total of 74 million dollars was spent on the incident response and breached stuff alone close to two times the yearly budget of security. The CSO claimed the budget for IT security prior to the breach was 38 million dollars. They maintain 125 million dollars in cybersecurity insurance coverage. 7.5 million deductible they recovered about 95 million dollars of that. So overall since September of 2017 to December of 2018 a total of 430.5 million dollars related to the security cost and response to the breach. We also just recently heard about all the class action lawsuits and the settlement money so you can get your pennies because of the 225 dollars. Who would take 125 dollars when you could have credit monitoring?  So what can we learn? Don't ignore the past while you're focused on the future. Equifax had invested in a replacement infrastructure for the automated consumer interview system but hadn't properly prioritized it moving to it. This is despite an acknowledgement of the difficulty maintaining legacy environments. Sophisticated attackers do utilize technologies such as encrypted C2. Now again, it's hard to say that's encrypted but this was a very specific group doing this and they were able to use the information in very malicious ways. So I think that knowing that they do use encrypted C2 is important.  The mandiant recommendations in the consent order. So invest proactively so you aren't operating reactively.  It's expensive and painful to work on their time and dime. Mandiant is a very expensive IT company to hire. Effective facts have properly maintained policy procedure and organizational structure. It's likely that the government wouldn't have gotten involved in verifying the remediation was consistent and thorough. Also, control fails cascade and result in extreme severity from a very simple breach. So properly notifying stakeholders of vulnerabilities and maintaining your security investments. Verify they are working correctly. Patch things on time. Keep an asset inventory list. Organizational structure matters. Cooperation interoptability between business groups is critical to healthy security. Anything to provide redundancy and security monitoring or patching notification would have likely restricted the breach severity as well. Cyber security executives do matter and organizations are really adapting to that. A breach is inevitable so be prepared. If you handle information of millions of people probably also be prepared to notify them in the case of a breach. Don't be stuck training thousands of call center employees and building random web apps last minute. Have a plan to quickly triage scope of breach and methods for communicating that information. Probably use a page on your real domain for notification not a real one or not a not a new one like Equifax2017.com or was that EquifaxSecurity2017.com? They relied on capabilities such as SSL decryption and seemingly did no backup accessory monitoring or net flow of any other IDS functionality. Again, they had all the data. They just never implemented MOLOC or any other external system to review the information they had. They relied on one technology alone. So that's it. As you can see here this is one of the best things that come from the entire breach. Equifax was trying to play some crowd control and you can see here Tim never got the memo. Hi, for more information about the product enrollment please visit securityequifax2017.com. Tim, that was the wrong domain. That was a phishing page. They did that for weeks even after the page was identified. So, lots of fun stuff. And that's really it. So, thank you.


Several of the pedagogies outlined in our report promote awareness of the role of emotions in teaching and learning. This seems highly relevant in times of adversity and may go some way towards counteracting the emotional anxiety and the cognitive stress brought on by uncertainty and insecurity in the current pandemic. In our report we discuss the use of enriched realities such as augmented reality and virtual reality which can help build confidence and lower the risk involved in difficult procedures or learning activities which might also reduce anxiety. Enriched realities can support collaboration at a distance which is also very relevant to today's educational challenges. At the present time we also should look to innovations that support people who would otherwise miss out on education. Several pedagogies in our report focus on inclusivity, widening participation and listening to students to discover more about their needs. They also highlight that we need to consider whether students have the necessary skills and competencies needed for full participation and how these may be developed. Some pedagogical approaches require collaboration skills or creation skills as well as specific strategies needed for handling tensions between participants or even conflict resolution. In cases where teachers are not available, peer learning in telecollaboration projects may be applicable. By working on such joint projects, pairs or groups of learners can proceed at their preferred pace and in good alignment with their common interests and needs. Our report gives more information about these approaches if you are interested. Thank you.


Hey everybody, welcome back to another haul video here at a Week in Geekdom, Gio here, and today we're going to be going over all the stuff I acquired, all the geeky items I got in the month of August 2020. Let's go. Welcome back to the channel everybody. And yeah, as always, there are only two rules for this. One, if you want me to review a specific product that I'm going to highlight, leave those comments down below and I will happily do so. And two, let's just have some fun. Here are some manga that I got. Let's start things off with Dr. Stone, Volume 12, one of my favorite series. I love how inventive and fun and just lighthearted it can get, but also very dramatic and really pulls at your heartstrings on the whole human condition and how it, I don't know, it's a, it's a real treat. I really liked those scenes in this manga where they examine human nature and our tenacity and our valuable spirit and all we've accomplished and all that stuff. So it really does get to you if you're into that kind of thing. Also the art is really fantastic. I love it. I can't praise Boichi enough. I think he's fantastic at what he does. The other manga that I've got here, I got a double whammy of a demon slayer. Here is a volume 14 with a really cool cover. This is one of my favorite covers. I'd love the contrast of colors right there with the pink and the green. And of course here is volume 15. I love this series, man. And the art Koyoharu is a wonderful mangaka.  I love that. It's it's such a great series. I'm a huge fan. Here's something I haven't gotten in a while. It is that time I got reincarnated as a slime volume 13. If I remember correctly, the following volumes 14 and 15 were both postponed to later dates, I think like November or December, something like that. And this was delayed as well. So I finally got it as always. This is such a delight. Sometimes the backgrounds are missing, like you'll read scenes like this and there's no backgrounds, but that's OK. I love the captivating art and I seriously think, in my honest opinion, that Fuse and Mitsuba and all the guys involved in the creation of this manga, this is some of the most underrated drawings. I love how cartoony yet anatomically right the series can be at times. Yes, I'm saying that while talking about a character that turns into a ball of slime or is a ball of slime and ogre characters and all that stuff. But still, there's something very alluring. This is one of my favorite panels from this book. I love the attention to detail to the characters and the clothing and all that stuff. And I think this continues to be an underrated manga. Yes, it got super famous because of the anime, but not a lot of people like to talk about the manga for some reason. But I really like it. And finally, on the manga section of this hall, we got Beastars Volume 7. So I'm officially up to date with Vizz and their releases. And yeah, this is really awesome. I can't wait to continue reading Beastars. Got to be careful with what I show here. I don't want to spoil anything for new readers for the series. But you can you can see some of the stuff that's happening here. I can't wait for more volumes. I can't wait to have the full set, but it sucks because we got to wait a really long time for Vizz to put these out. OK, so we talked about manga. Let's switch on over to anime, which is one of my favorite things. And I got a bunch of series, which is really cool. First, I got the full season of the rising of the shield hero. So here is season one part one. And I got, of course, season one part two of a really awesome series. I love me some good isekai. When it's done right, you're going to have a blast. And with rising of the shield hero, I didn't like all of it, but the overall presentation, the art, the story elements and all that stuff. I really enjoyed and most of the characters I do like. So I was really excited to pick this up. I know it came out a while ago, but I waited for a bit and got it at a really good price online. So yeah, rising of the shield hero. Here we have another series that came out a while ago. Mob Psycho 100 season two or the Blu-ray, I should say. It came out a while ago, not the series. Mob Psycho is one of my favorite shows as well. The animation on this thing is just off the chain. Fantastic. And it's on another level. I always recommend this series because even though it's good, it has a lot of fans, it goes under the radar for a lot of people. I just think it's wonderful. And this season just blew my mind. And if you want a master class in doing amazing opening animations for a show, watch Mob Psycho's openings. Regardless of the catchy songs, the style and the animation techniques at display here are just masterful in my opinion. Part of my childhood growing up was being exposed to anime for the first time with series like Sailor Moon, the Pokemon series, of course, Dragon Ball Z, Yu-yu Hakusho, all that stuff. But there was one series in particular that I was hooked from day one and I watched everything and loved it. And that is, of course, Inuyasha. I was really excited that it finally got a Blu-ray release. And I am more than happy to collect the series. I've always watched it whenever it was on TV. Here is Inuyasha set one right here with the first 27 episodes. And Inuyasha season two or set two Blu-rays. So, yeah, right off the bat, 55 episodes. I think the total will be six Blu-rays plus the final act series, which I still need to get. So I'm excited. I'm really pumped up to get this. Love the spines, love revisiting this series so much. These characters are so great and part they're ingrained in my mind as part of my childhood that I cannot wait to revisit this and see it in HD. This was a guilty pleasure of mine from summer 2019. It is how heavy are the dumbbells you lift? The series is extremely wholesome under the disguise of working out and cute girls doing workout sessions.  I know when I started watching it, I took it upon myself to start changing the way I did things and get healthier and all that stuff. So none of the other shows have done that ever. And this was the first one. So I got it commended for that. Plus, the opening is one of my favorite openings ever. And the animation is just fantastic. It's from the same guys that did New Game and what was the other one? Oh, helpful Fox Senkosan, which is also a wholesome show. So yeah, really excited that I own how heavy are the dumbbells you lift? It's a shame that we're not getting a season two. Hopefully with enough sales, there is incentive enough for them to go back and animate more stuff or, I don't know, I would like to see more. And finally, I mentioned earlier, Sailor Moon. I am continuing the collecting. You can sort of see it back there. The Sailor Moon sets on Blu-ray. I'm a little bit late to the game, but I want to have not every single anime on Blu-ray. That's not my goal, but at least the essentials and the stuff I like. And this is something that I'm really excited about because I only saw just a handful of episodes growing up. I've always wanted to see the full series. So here is Sailor Moon S, which is basically the third season. Here are the two volumes inside. And the guidebook, limited edition booklet, which gives you, I can show you the covers, at least. So here's the first part and here's the second one right there. And the booklet. It's pretty, it's a pretty hard box. And the booklet you get with the booklet, you get episode descriptions as well as art from the series, which is really cool and character designs right there. Yeah. So really excited about this and hopefully I can get seasons four and five because I think one of them might be out of print or a little bit harder to find. I'm not too sure, but I'm pretty sure this series will always be evergreen. So I'm not too worried about it. OK, moving on, let's go to the comic book section because even though I'm not collecting so many comic books or graphic novels as I once was, I'm still getting a few titles. There are a couple of series that I do want to own, mostly older stuff or something that's cool and easy to get. I'm not exactly going after new titles or omnis or whatever. I'm mostly focusing on famous runs. For example, Alan Moore Swamp Thing, which I've always wanted to own. And I had the first trade paperback. I didn't want to buy the absolutes because they're a little bit pricey. So instead, I opted to get the trade paperbacks, like I just said. So here is book two and the rest of the volumes will eventually arrive. So here is a taste of Swamp Thing right there. The next series is another one that I really like. I made a review on the first volume here on this channel. If you want to check it out, there's Brian Itzarello's and Eduardo Rizzo's Moonshine. If you don't know what Moonshine is, this is a graphic novel about a werewolf story in prohibition America. So it's really fantastic. And you might have seen my previous haul where I talked about the Street Fighter books and how I sold the previous books and then rebought them because I actually did want to collect them. So I got the Street Fighter classics one, two and three. And here I have Street Fighter four, even though it says volume one, it's just this volume. So fortunately, it doesn't say volume one on the spine. But yeah, I'm really excited to continue my journey through the Street Fighter universe in comic book form. Just really awesome stuff. There, I do want to get everything and eventually make my way towards the Dark Stalkers, because that's another game I used to play and I love. And of course, the Street Fighter versus Dark Stalkers, crossovers, all that stuff. I forgot to show some of the art because I did so for Demon Slayer and Dr. Stone and all that stuff. So, yeah, although you've probably already seen this stuff before. This isn't exactly new stuff. And this book is actually a month old now in my collection. I totally forgot to highlight it on the previous haul for summer. It is, of course, from Phantographics, the complete life in times of Scrooge McDuck from Don Rosa. This is the hardcover box set that you see right here. This thing is massive and beautiful and awesome. I remember reading this a very long time ago when I was super tiny. I used to love reading all the duck tales and duck books and all that stuff. But it's been so long. I barely remember anything and a nice thing to collect and a good place to start would be here. So, yeah, this claimed 12 issue run, if I remember correctly. And these boxes are awesome. Phantographics always does amazing work. Here's volume two right here. Let me show you volume one, of course. So, yeah. Oh, and the sweet kicker about this is that I got this for hefty discount on Amazon. It was going for the retail price on this is $60. I got it for twenty four or twenty three bucks because there was a summer discount code or something, plus it was already on sale, applied to two things. And I got it for twenty four dollars, which is insane for such a beautiful collection. All right, let's close out this hall with video games and regular Blu-rays. Now, this is video game related, but not necessarily a game or a Blu-ray movie. This is something really cool that I did not know existed. And I was kicking myself for not knowing. I got an art folio for Metroid Other M right there. See if you can. There it is. There you go. And what this contains are sort of oversized postcards, basically, about Metroid Other M. If I remember correctly, this was a pre-order bonus from GameStop when you got the Wii game for Metroid Other M, Metroid being my favorite Nintendo franchise and video games. One of my goals is collecting as much Metroid things that I can get. Unfortunately, there's not a whole lot because Nintendo just doesn't care about the franchise, apparently, and likes to ignore it whenever there's an anniversary or just overall just not pay too much attention to it. But yeah, as you can see here, sorry. It's renderings and art from the video game with some descriptions. You can see some of the spaceships is a scene from the game. Really cool stuff and you can get creative and display it properly and do like a little art piece right there or something. Here's Samus and leave. This was the first at the time, the first illustration for the Zero Suit Samus right here. Samus is one of my favorite video game characters of all time. She's just an utter badass. Other M wasn't the best game at all. A lot of people hate this with good reason, but I want to get a full set of Metroid, memorabilia and all the video games and all that stuff. Speaking of Nintendo, this is the highest selling Switch game of all time. As of August 2020 and I can't believe I still didn't have it. So I picked up a copy of Mario Kart 8 Deluxe and I know it had a lukewarm reception or a mixed one at that. It is Paper Mario and the Origami King. If you remember the last home video, I had ordered it and it got lost in the mail or something and it took forever, almost two months for me to get this, which is insane. But I finally got it. I remember typing an email to GameStop like, hey. But what the heck happened to this? Because it's not media mail, because media mail is being held up because of obvious reasons. So I was wondering, like, do you have any status updates on this? I don't mind waiting. I just want to know where this thing is, because when you typed in the shipping, the tracking number, it showed nothing. And when I finally do get a response, the person typing was like, oh, it says it arrived. I'm like, wait, why? And I checked and just as I had written the email, it decided to arrive at my address. So yay. Finally, to finish off this very long and weird haul, I've got some Godzilla movies.  You know what I'm missing? I'm missing my Godzilla Blu-ray collection. I don't have the criterion set, but I decided to get everything else. And later get that criterion because it's a little pricey, at least for me. So I got the Sony licensed Toho films, the Toho Godzilla collection. So I'm just going to show you guys real quick.  This one I got above retail price, which sucks, but I didn't pay too much over the suggested retail price, so I didn't mind. But the rest, you can get them for cheap still, even though I think all of them are probably out of stock everywhere, but you can still find them. So there's that one. Here's another one. These are all just fantastic movies. Godzilla 2000s, one of my favorites. Tokyo SOS and Final Wars. The one I'm missing is Godzilla versus Byelante, which is stupidly out of print.   I had the opportunity to get it for at least $20 at one point. But I didn't know I wasn't committed to owning these movies. I didn't want to complete the set or anything. And I'd let it go. I remember seeing eBay offers for cheap.  The thing is, Miramax was the one that had the license. They lost it. So Toho got the rights back and Sony has it for this type of releases for the Toho Godzilla collection. So maybe we'll see it one day released in this format with the green banner or something. I don't know. I mean, I'm not dying to get that movie, even though it's one of the favorites and one of the best ones, actually. But it is what it is. I just find it ridiculous that a movie like that can just suddenly skyrocket in price and rarity online. You see it all the time because I do have saved searches for it. And everybody's like one hundred and seventy four. I want a hundred bucks for it.  So, guys, with that mini rent out of the way, that's my haul for August. Not a bad haul. Some very interesting things. I am missing. What am I missing? I'm missing one switch game, which you will see eventually. But I did order it a few days before recording this. So I knew it wasn't going to arrive in time and a really cool item that I hinted at in previous streams. So when that gets here, I'll probably do something with it. I'll do a video on it. Before I go, I got a cool little surprise, I guess. I don't know, I got some digital codes that I wanted to give out to you guys. OK, so here's a digital code for how heavy are the dumbbells you lift. If you're able to get it, leave a comment down below so I know who you are. And here's a code for Bob Psycho season two. Hopefully, if you are able to snag that one as well, leave a comment down below so I know who it was. Thank you, everybody. So other than that, I'm pretty excited that I got everything. And I can't wait to rewatch Godzilla films and play through Mario and like Paper Mario, I mean, and yeah, read some manga, watch some anime and enjoy life. So hopefully you guys enjoyed this haul video. It was a little bit all over the place. But thank you so much for tuning in. Thank you for supporting this channel, liking, commenting, subscribing and just being a part of the a week and get them experience. Thank you so very much. I've got to go. As always, links down below to social media, links down below to the merch store, et cetera, et cetera. I've got to go. I will catch all of you on our next episode.


Thank you very much. I would like just to highlight the fact that today we've seen that the links between climate change and migration are clear. And so it's more than a matter of merely migration or climate. It is a matter of human security because migration, which is induced through catastrophes and due to climate change, affects the stability of states and of entire regions as has been said as well. It affects economic growth, it impacts human development, and it affects poverty reduction strategies, which we are trying so hard to put into place. As the various speakers have said, climate change and migration brought about through it forced migration, disorganized and chaotic migration, amplify fragility. So it's a global problem and it is one of human security. And so we need to make this a cross-cutting issue in places and organizations where we look at conflict, human rights and go beyond the area of migration. I'm very grateful that IOM has used its session this year to use to cover the subject of migration and climate change. Man is at the center of this, man is part of the cause, but also suffers the negative effects of climate change. As the speakers asked questions, are we aware of resilience when we develop the Nansen initiative? We're not just looking at creating standards or a legal framework, I'll come back to the question from Ethiopia, but what we want to do is to provide states, whilst we're still looking for details and data, we're trying to provide states with the means of being able to carry out practical action. Because in the Nansen initiative, resilience is part of it. If we can prepare populations to adapt, to withstand, that is a first step in controlling migration and making it less chaotic. If we can help during the migration process, that limits the negative impact of the migration. And if, when they arrive, either elsewhere within their own country or in another country, there are solutions in place to offer new perspectives that also mitigate the negative potential of this migration, and we can make it more predictable and manageable. That's something we need to work on. In addition to the standardization work that needs to be done, and I'd like to reply to the Honourable Delegate from Ethiopia, yes, the legal framework is still incomplete. And that's why in a specific niche we have decided to act not in a binding and compulsory manner through a convention, but to look at how we can address solutions for a certain category of migrants. But the major challenge isn't so much the regulations, but the application of them. And there I'm also replying partially to a question from the Honourable Delegate of Venezuela, when they said, what are we doing about multinationals? Yes, you're right, multinationals can be a vector with many negative impacts. But if they are well placed, they can also aid development. And I repeat that the multinationals work within the sovereign legal framework of a country. Countries need to channel multinationals that they grant concessions to. So it's a critical call on ourselves to make the first efforts to ensure that those who are in contact or could have negative consequences either through, in some places, if we think about mining activity where there is excessive use. That's also responsibility of the state to ensure that that works, and it should be on the agenda. So those are really the comments I wanted to make now. Thank you. Thank you very much, Ambassador.