Okay, so I will give a short overview of the genesis of where Faber is coming from and what the global consortium is doing. And then later on, my colleagues will talk about the UK specifically. So the basic motivation and ambition of Faber is to find pathways, future pathways to feed currently 7.6 billion people but then in the future it goes up in our scenarios to nine and even more billion. The other issue to mention is that the agricultural sector globally is actually providing the livelihood of about 2.5 billion people. So there's also a job market issue to the problem. And then if you take kind of the nature-based economy definition, there were calculations that it's still 50% of global GDP. So here it's not only about the food system GDP but also forest sector mining tourism and so forth. So what we are talking about is a very large chunk of the global economy. And at the same time, we actually need to make sure that we stay within planetary boundaries. And planetary boundaries doesn't only mean climate policy but it's also the integration and coordination with policies that ensure biosphere integrity with respect to biodiversity but also biogeochemical flows, land use systems, fresh water and so forth. So this is really the large ambition. And when we now look into what jointly countries deliver for the respective global politically processes, you actually get a little bit into frustration and you start to understand the challenges. And here I just plot some work we did two years ago where we looked at on the aggregate where countries together in terms of the business as usual, the projectorium, their pledges and what countries should actually do to be compliant with the 1.5 or two degree world by 2100. And what you see is that there are huge, huge ambition gaps and when you look into the details in this case of the national determined action plans of countries, many times the Lulu CF sector, the land sector is actually not even properly represented at all or very poorly. And at the same time, we see that global models that provides kind of the long-term term traectoria for the 1.5 degree scenario, they actually disconnected from the realities in countries. And this gives us the basic ressent de être for favor to exist. And just specifically when you look at the pledges that were done for Paris and now they're wretched up a little bit but by far also not meeting the targets. What you see is that the national reports actually suggest in the baseline a business as usual that's going even up. The INDCs in that case could be interpreted as a kind of continuation of business as usually if you take the recent trends into account. And this is where we actually should be. So there's a lot to be done.  And now we are 20 country teams and as you see on the map, we are covering really the very large countries, both developed and developing countries. We still have gaps in Africa, which we're trying to fill, but overall we have probably enough critically mass to actually push off a larger evidence of ambitions or to say. So what do we do specifically? What we are after are globally consistent long-term national pathways. And the national pathways, they should reflect the realities, the preferences of individual countries, which in the end together play out to meet global targets. In order to do so, one means in order to get consistency international pathways is actually to harmonize trade assumptions across countries such that at least trade balances are closed. And then what we have seen as I showed in the previous slides, countries are typically far away from what's actually required in terms of their current ambitions. So a ratcheting up process needs to be installed. And this is what we do. And I will talk about the mechanisms a little later. We go through iterations with all countries in order to get more ambition into country plans. How do we do this technically? So first we look into, we actually take a starting point, we take FAO national data, we put it into the database and we communicate with the specific countries whether or not we can improve from the very basic input data sets. So these are land use balances, but also food balances, biodiversity information and so forth. Then we prepare the joint models. Typically currently we use an Excel based calculator. Then what we also engage in the scenario building, we have developed a verification tool where we just look at plain errors, but also we spot unreasonable assumptions. So let's say on excessive assumptions of agricultural productivity, for example. And we strive for consultation with stakeholder engagement that we get vetting off the scenarios of the pathways from national stakeholders. This is then aggregated up to the global level and we try to meet several global targets. So more specifically with respect to the Excel FABL calculator, we have quite a lot of detail in terms of products. Currently we have included about 76 products of crop, livestock, oils, but also for a sector commodities. We do these scenarios in five year time steps and how we construct the scenarios, it's in such a fashion that we first determine demands and demands that you will see later will be kind of modeled in terms of any continuation of current diets, but also we are quite engaged in defining diet shifts. And we also take care of the very nature of land use that land is a limited resource and so there is competition for land induced in the scenarios. Just finally to give you an illustration how what we call Senaton, which is kind of a scenario marathon like a hackathon where we construct these national and joined it up global scenarios. So what we basically do is we have these calculators on the national level. We do allow for bilateral coordination which sometimes happens, but many times it doesn't. And we look through kind of a linker platform, we look out for trades consistency. Once trade consistency is achieved, we display the outcomes of the individual of the sum of individual contributions by countries in a global dashboard. And if we see that we don't meet the global goals, be it biodiversity, greenhouse gases, food security and so forth, we go into a new iteration and we iterate basically pledging even more as long as we meet all of the global targets and then we finished the Senaton. So with this, I will now hand over the presentation to my colleagues. Thank you. Thank you very much indeed, Mikhail, for that overview of the Fable process. And now let's hand over to Paula who's going to go into the details of the results from the latest UK assessment. Thanks, Jim. So this is actually a double act with Alison and myself. So Alison's gonna start by providing some background to the pathways and then she'll hand over to me and I'll describe some of the results. So Alison, do you want to go ahead and have a minute to move? Yes, so first slide please, Paula. Okay, so as Mikhail described, each of the 20 Fable countries has defined during the Senaton process with stakeholders has defined two or three pathways, a current trends pathway and then either one or two sustainable pathways. And most of the countries use the Fable calculator to do their modeling, but a small number of countries use the Magpie global partial equilibrium land use systems model and the pathways run until 2050 in each case. Next slide please. So we're aiming to meet globally by the menu and all the different country pathways together, we're aiming to meet these four different global targets. So for food security, it's based around the average minimum daily calorie requirement in all countries for land and biodiversity, we're trying to meet no net loss of land where natural processes predominate. And that's a kind of amalgamated data set which includes intact forest land, key biodiversity areas, and also low impact areas with low human impact. And then by 2050, we want to increase the area of that land by at least 20% and also have zero net deforestation by 2030. For greenhouse gas emissions, we want to have global emissions from agriculture less than four gigatons by 2050. And we want to have a net sink of global emissions from all land use and land use change activities. And then we also have a target for water use which is a quantitative target. Next slide please. As you can see here, there are very different assumptions across the 20 different countries. In general, the sustainable pathways are characterized by lower population in some cases. In many countries, they reduce their total calorie consumption that's in the more developed countries. But in some of the less developed countries, they aim to increase their calorie consumption. Higher crop and livestock productivity is a key feature of most of the sustainable pathways. Very mixed assumptions on imports and exports. Most countries have higher forestation in their sustainable pathways and also reduced food loss and reduced food waste. But I want to point out that, although it's a very complicated model, there are still some limitations. So for example, we don't currently represent organic farming or agroecology or agroforestry in our models. So it's based around a kind of land sparing approach, but we don't model any specific land sharing in terms of having more sustainable agriculture in the areas where farming does take place. Next slide please. And next slide again. So for the UK pathways, we went through a state-configured input process and some of the people here today helped us during that process. So we invited key policy makers from the UK government and devolved regions. We couldn't at that stage contact anyone from Northern Ireland and I'm really glad that we've now got a couple of Northern Ireland representatives here today. But we had representatives from Scotland and Wales and also expert researchers from, for example, the UKCH and Royal Society and Royal Academy of Engineering. And we produced a flyer and then we held some structured discussions in two parts, first in October, 2019 and then later with a workshop in February, 2020 and subsequent emails and phone discussions. So the state-configured had a lot of impact and a lot of inputs to our pathways, helping us to choose the best parameters with the UK version of the Fable calculator. And then we also had Mike Bourne from DEFRA seconded to us for one month to help us look at future options for developing the model into a more spatial model in future. Next slide, please. So this is a very brief summary of our pathways and then I've got a few more slides that will go through them in a bit more detail. So broadly speaking, the current trends pathway is based on current policy. And then the sustainable high ambition pathway is a very ambitious pathway based on adopting the E12 diet, very significant increase in tree planting, slight increase in protected areas, ambitious increases in crop yields and livestock productivity and pasture stocking density and also decreases in food waste. So I'm going to go through these in a bit more detail now. So next slide, please, Paula. So for land use and biodiversity, we have a sort of medium projection for population change and then for urban expansion, that's based on current projections to housing needs, which is an increase of 26,000 hectares per year between now and 2050 for the current trends and the medium ambition scenario. But for the high ambition, we assume that that could be only half that rate if we have, for example, more compact housing growth. For tree planting, the current trends is a continuation of the current levels, which is 9,000 hectares per year. And then the medium and high ambition matches the CCC scenarios. So that's 30,000 hectares a year, which is the current target. Or in the high ambition, a very, very ambitious 50,000 hectares per year. And I know that a number of people have actually said that this is really not achievable, but we thought it'd explore it anyway, since it's the purpose of the models to test the very most extreme scenarios, which are possible. And then for protected areas, the current trends remains at the current 27.6%. And I should point out that they did not all kind of high biodiversity protected areas. They include national parks and AOMDs, which clearly have a very large amount of farmland, which is not high biodiversity value. In the medium ambition scenario, based on the 25 year environment plan ambition for an extra half a million hectares of land for nature recovery, we assume that all that area would become protected. And then for the high ambition, we have an additional target to protect all the peatland, which is currently not protected. And that brings the total area up to 29.6% of total land. So it's still a relatively small increase. Next slide, please. For crops, we've got quite ambitious targets for crop productivity increases in the high ambition. So the medium ambition is all crop yields increased by 39%. And that's based on the revised CCC medium ambition scenario. And the high ambition, they increase by 65%. So for example, for wheat, that would go from the current average of 7.7 tons per hectare, up to 12.7 tons per hectare average yield in the high ambition. So this is still pretty ambitious. We're doing two climate change impacts. And we assume that in the current trends, we're looking at RTP 6.0, but in the high ambition scenarios, we're looking at RTP 2.6, so a lower impact on climate change. And then for post-harvest losses, we're currently losing 1% for crop products. And then we're assuming that's going to go down to 0.5% in the medium ambition scenario. And in the high ambition scenario, we're also going down to 0.5%, but earlier by 2030. Next slide, please. For livestock, I'm just going to look at the bottom line first here, which is stocking density. So we're assuming that the livestocking productivity improvements for ruminants occur through increasing the stocking density from 1.2 livestock units per hectare at the moment, up to 1.2 in the medium ambition or 1.7 in the high ambition. And that's in line with the CCC high ambition scenario for that high ambition scenario. We have had this querage, some people have pointed out that actually because of animal welfare and water quality impacts and so on, the current ambition is actually to reduce stocking densities rather than increase them. So again, this is a very ambitious assumption. And then looking at the upper rows there for livestock productivity, in the current trends, we're assuming a continued increase in milk yield by 18%, that's half the current rate of increase because we assume there will be some kind of flattening off eventually and no increase in yields for the other categories. But for the medium ambition, we've also got an increase in poultry productivity. I should point out that these are not carcass weights. So we're not talking about 15 kilogram chickens here. This is actually the total yield in kilograms of meat per head of herd at any one time during the year. And then for the high ambition scenario, milk yield increases by a higher amount, 27% of the current rate, which is 75% as the current rate of increase. Next slide please Paula. This is the last slide before I hand over to Paula. So for food, we're assuming that the current trends is the same as the current diet. The medium ambition is in line with the CCC medium ambition scenario. That's a 20% reduction in meat and dairy consumption by 2050. And then the high ambition is the eat well diet, which has a much stronger increase, a decrease in dairy in particular and also a slightly higher decrease in red meat consumption and a much higher food and vegetable consumption. And then for food waste, we're assuming a decrease from current levels of 14% to 12.5% in the medium ambition or 7% in the high ambition. And I could hand over to Paula now to talk through the results. Okay, thank you Alison. So yeah, I'm going to present results for a few indicators, both at the global level and for the UK based on the assumptions that Alison has just presented. And I'm going to start by looking at the bigger picture of actually what happens to land use change at the global level first and then we'll zone in on the UK. So here in the stacked bars on the right-hand side of the plot, you've got the current trends pathway that all of the country teams submitted and were linked together in the upper stacked bar and a sustainable pathway because some country teams only did two pathways, one current trends and one sustainable and other country teams did two and were able to bring in a medium ambition as well as a high ambition sustainable scenario. So what we can see in the current trends for land use change is we see over time an increase in both pasture area and crop land. So the yellow and the lime green blocks in this upper graph. And we see simultaneously, we see slight increases in forest land here at the bottom despite some new forest areas through a forest station. We're still seeing deforestation and we also see some decreases in other natural land. And that's primarily driven at least half of, almost half of that total agricultural expansion is driven by the assumptions over diets which continue to have higher consumption of livestock products. And that has implications again for expansion of productive areas of certain crops and we see expansions in planted area of wheat, corn and sorghum, and this has implications again then for the overall land use change in the current trends pathway. If we look at the lowest graphic of the stacked bars and the sustainable pathway, here you can see that we see decreases in pasture land right from 2020 and in crop land from 2030. And this provides sufficient space to begin to have net gains in forest area and increases in other natural areas. And this is largely driven again by shifts towards more healthy and sustainable diets that involve a lower meat consumption. And this changes the composition of global crop land areas. And we see 70 million hectares less of corn planted area and significantly more planted area being dedicated to nuts and pulses. If we look at what does that mean for the UK? And here we've got the three pathways that Alison described the underlying assumptions behind. And again, if we look again at the upper stacked bar for the current trends scenario initially, here you can see that you get increases in urban area, in red, in crop land, and in pasture land over time, but also some increase in forest area as our forestation targets are gradually being met. But the increases in all of these areas mean that there's a great squeeze on other natural lands such as Heathlands and Wetlands and Box. And that is just such extent of the assumptions in the current trend scenarios that all unprotected other natural land is lost by 2025. And this means that ultimately we're not able to meet our forestation targets because there's no land left available to meet them with even though those targets are relatively low. And again, this is driven by the assumption of our continuing current diet and continuing high levels consumption of beef, lamb, and milk. And also the crop land area we see expansion in the area of wheat, barley, and rapeseed. Again, reacting to internal increases in demand for livestock feed for non-food products and also for biofuels. And then if we look at the sustainable pathways in the lower two bar charts, mainly particularly focusing on the high ambition sustainable pathway which shows the greatest difference. And here you can see quite large decreases in both crop land and particularly in pasture land over time. And we also have a lower rate of urban expansion as explained by Alison as this is assumed to be half the rate as under the current trends. And of course this then frees up land to allow forestation targets to be met and also leads to substantial increases in other natural land as farmland that is no longer needed is abandoned and naturally regenerates to either woodlands or short vegetation. And here again, these changes in the sustainable pathway are driven largely by dietary changes through decreased demand for meat and increased demand for vegetables and other products but also through the assumptions around increased agricultural productivity that means that more yields are possible on a smaller area of land. Then if we look in more detail at one aspect of that land use change, particularly looking at what's happening to global forest cover change. And here we have the global target of meeting zero net deforestation by 2030. Again, if you look at the graphic, the red dots illustrate the current trends pathway. So you can see that under this scenario we still have net forest loss by quite significant amount. So that by 2030, the timescale of the target we're still seeing net forest losses of around 20 million hectares per year. This does decrease gradually up to 2050 but we're still seeing net forest loss globally of around 15 million hectares per year. Now we can compare that with our global aggregate sustainable pathways which are shown as the average in the black dots with the balance of net forest gain and net forest loss in the bars beneath those black dots. And here we can see that it is possible to move to zero net deforestation by 2030 and the target is achieved. And we see that by 2030 we're ending up with about a net gain of around 15 million hectares per year in forests. And that is principally due to significant actions in a number of countries to stop deforestation but also to have ambitious forestation targets, particularly in Brazil and Indonesia and the US, India, Australia and Ethiopia. So if we, sorry, look at one other aspect of that land use change where Alison introduced the target that we have that is related to biodiversity. And again, this is always a difficult one to relate in a way to each individual country because it has to be applicable across all of the countries in the consortium. So we're using this aggregate indicator of land where natural processes dominate and we have the two targets of no net loss by 2030 and an increase of at least 20% by 2050. And at the global scale, we are able to achieve that first target of no net loss under both the current trends and the sustainable pathway with the current trends pathways leading to a 1% increase in land where natural processes dominate by 2050 and the sustainable pathway leading to an 8% increase. Again, largely driven by changes in a few countries, particularly those countries that are driving down deforestation and increasing deforestation such as Brazil, the US and China. If we look at the UK and the graph on the right shows the results for the UK. Here again, we see under the current trends a very slight decrease in land where natural processes dominate and that is related to the land use changes that we simulate under this scenario where we see large increases in urban area and in a whole range of farmland and a complete squeeze on forest areas in part and particularly on other natural land. Whereas under the two sustainable pathways we see the area of land where natural processes dominate significantly increase. And again, this is due to the reductions that we see in farmland and the increases that we see in deforestation and other natural land. If I move on to look, sorry, at greenhouse gas emissions, first again, looking globally. And here we have two targets, as Alison explained, greenhouse gas emissions from agriculture, so from crops and livestock and that threshold of less than four gigatons of CO2 equivalent per year is based on scientific evidence from the literature to be consistent with the Paris Agreement targets of two degrees of 1.5 degrees. And the second target is that greenhouse gas emissions from Lulu CF should be below net zero. And if we look at the current trend scenario, here we see certainly that emissions from agriculture miss by a very wide margin the target. In fact, they're 80% greater than the target, showing that countries really need to substantially increase their current efforts to get anywhere near the Paris Agreement target. But if we look at the sustainable pathway and what that looks like globally, we see that actually target can be met and actually both targets are met from agriculture and from Lulu CF. And particularly the graph on the right shows the main contributors to achieving the greenhouse gas reductions from agriculture. And that's particularly dominated by reductions due to changes in deforestation and livestock emissions with India particularly being key to this, but also Brazil, the US, China and Indonesia. And if we look at the role that the UK plays in reducing greenhouse gas emissions, again, here in this slide, we can see in the black solid line here, the projection of changes in greenhouse gas emissions under the current trend scenario. And here we see a slight reductions to 2050. Again, this is reflecting the fact that some farmland is being converted to urban areas or being a forested. But by contrast, if we look under the two sustainable scenario under the medium ambition, we see a 36% reduction in comparison to current trends. And under the high ambition, we see a 123% reduction in comparison to the current trends. So in this high ambition scenario, we're turning what was a net emission into a net sink. And again, if we look at sort of the sources in this, the right hand side, we can see the general sources under the current trends. And we can see that most sources of those emissions are still coming from livestock and also from cropland. Again, if you look at the graph on the right hand side, again, if you look at the scale, which is looking at, which has negative values, you can see that most of the contribution to reducing greenhouse gas emissions comes from reductions in livestock and also increases in sequestration through increasing forested lands through the forestation targets, but also through land abandonment from farmland, meaning that those greenhouse gas emissions are lost through land use change. Whoops, sorry. So my last indicator I was going to look was focusing on food security and dietary change. I guess here's, as Alison mentioned here, the global target is related to calorie consumption being greater than a minimum daily energy requirement. And for some countries here, the requirement was to reduce calorific consumption, so particularly for those countries that have more dietary risks due to obesity or overweight issues, such as in developing nations, such as the UK and the US. And in other countries, such as in Rwanda and Ethiopia, it was to increase calorific values, calorific consumption to address food security issues. So each country addressed this in different ways, but overall, what we saw was that we see under the current trends pathway, a overall slight increase in the average calorie consumption per capita per day at the global level by 8%, but in the sustainable pathway, we see a decrease in overall calorific consumption of 3%. And this puts less pressure on the land use system, and particularly we see in the sustainable pathway a strong reduction in the consumption of red meat and sugar. So if we look at what does that mean in terms of UK diets, here again, I'm just showing two scenarios, the current trends, which assumes the current UK diet and the sustainable high-ambition scenario, which assumes the eat well diet. Here we look at the consumption of different food groups relative to the recommendations from the Eat Lancet report. So the minimum calorific consumption is the inner ring, the maximum is the outer ring. So looking at this under our current diets in the current trend scenarios, we are over-consuming red meat, sugar and roots, and also eggs and milk. So under the Eat Well diet, if we look at how that changes, we can see that we are able to move the consumption of all groups within the recommended levels, some still at the maximum and edge of those recommended levels, but we are still over-consuming in roots, and particularly this is a relation to over-consumption and over-production of potatoes. And again, if we look at what does that mean overall, under the current pathways, we basically see that we are 32% higher than the minimum daily dietary energy requirement at the national level, and this corresponds with approximately 30% of adults still being classified as obese and about 60% being overweight, but in moving to the Eat Well diet means that our computed average calorific intakes decreases to only being 4% above the minimum daily energy requirement. So just to finish with some conclusions. Yeah, so at the global scale, we have shown that current trends pathways lead most countries towards unsustainable land and food systems, both within those countries and at the global level, and that sustainable pathways are able to both meet targets related to food security, greenhouse gas emissions, water use and biodiversity. And out of the seven global targets that each country team was aiming to achieve, we were able to meet six of those concurrently. Looking at the UK again, we saw a very extreme case in the current trend scenario where basically through the expansion of urban area and farmland, all unprotected land was lost and tree planting targets could not be met. And again, as Alison said, this is looking at those lands in the more of a land sparing look, it's rather in the land sharing and we're looking to improve the calculator to bring those issues into it in the future. But it still shows that the standard pathways do illustrate the importance of things like dietary change and productivity improvements for freeing up land for biodiversity and carbon storage and enabling that transition to both a healthy and sustainable food and land use system. So overall, I think that what we're trying to show in Fable is that through integrated and deciphered decisive action, there is things that governments and other stakeholders can do to try and meet the relevant targets and objectives of international agreements such as the Paris Agreement, CBD and the SDGs. But the results do highlight different trade offs and synergies and strong dependence between climate, food and biodiversity targets that are important to consider in the different countries when they're developing existing and emerging policies. And I'll come back to next steps after because I want to open it up for a discussion but the tools are openly available from the Fable website. People can download both the global calculator, the Fable calculator and the global dashboard and we're aware that there are ways we want to improve our pathways and the modeling tools. For example, including Peatlands in a better way, improving the representation of grasslands and forest types, being able to represent land sharing management practices in a better way and also then moving down to look at subnational versions of the Fable calculator for UK nations and eventually to spatial explicit modeling. And then just finally just to finish with that we do have funding from the SCDO over three years for the Fable secretariat to develop a food environment, land and development policy action tracker, which is a synergist to the climate action tracker that is used to track progress of different countries towards Paris agreements. The idea of the failed policy action tracker is really to focus on policies in different countries that are related to food and land use systems. And the UK will be a pilot country in this so we will work closely with the Fable secretariat in pushing this forwards. And I will leave it there, thank you. Thank you very much.


So, this is our panel discussion on security strategy for small and medium business.  First to my right, this is Jim Nitterauer, he has Twitter handles up there for you. So Jim, Jim ran his own company for a while and then he got some experience with a company that grew from about 280 to 500 employees, which was acquired and is now a publicly traded company. So I wanted to tell you a little bit about all of the panelists experience, I think it's important for our discussion here. Next is Amanda Berlin, Info sister. Amanda has experience with organizations of all sizes, including eight years at a small hospital and she currently works at a startup. She's also wrote a book I heard. She's the co-author of the defensive security handbook, if you weren't aware. It's an O'Reilly published book. We have two copies up here that we're going to give away to the first two people who ask us questions when we start the Q&A. Not now. Once we start the Q&A. Next, we have Klaus Hauman. So Klaus has experience as the CISO for a small bank and he's now trying to implement all of his lessons learned with a much larger organization in Europe. But certainly not least is Lit Moose. And she got her start in InfoSec at a university and has experience in the weeds at everything from small companies all the way to Fortune 5 companies doing DFIR. So all of my experience, I'm sorry, my name is Russell, the Twitter handle is Smokum and all of my experience has been a small company. I've been 20 years at a small company, which I know is pretty unheard of and it's not because I'm bored. It's because I'm fortunate to work for a very good small company that invests in security and invests in their staff and we've built a great security program. And you know, I hear a lot in the InfoSec community about how small companies, you know, can't do security.  And that kind of bothers me and I'm trying to make a difference by doing talks, publishing things about how you can build a security program at a small company and do it well. It is possible. So that was sort of our idea for the panel today. We wanted to talk a little bit about our various experience and our different roles and what security strategies are best for small to medium businesses. Is there anything I've forgotten before we get started? So once upon a time there was, I know I'm really short, there's a reason I'm here today. There was a practitioner that was once among us here at DEF CON who's no longer with us. His name was King Tuna. Some of you know him, some of you didn't.  So I think that's enough. In remembrance of King Tuna, I just wanted to take a second to light this can of Tuna on fire and you know, if he were here today, hopefully he'd be proud. And I'm going to try not to drop this otherwise it's going to go much like his did which was I believe at SkyTalks and he just laughed and laughed, which I would too, but I don't want to get kicked out. So thank you guys for coming and hopefully you have another story to tell now in remembrance of him. Alright and that concludes our panel. Thank you Moose. So really briefly before we get started, I wanted to define small to medium business. I know that there are some official definitions from governments about what is a small business. But thinking in terms of companies today that should have a security program in place. We talked a little bit about this yesterday and sort of landed on a company with one to a hundred people should at least have some IT person with some infosec knowledge, right? Should I think is the key word there. From a hundred to a thousand, you should have a small IT team, at least one dedicated security engineer today. And then anything over a thousand employees, you should have an executive who's responsible for security and a dedicated security team. And I put on the slide here, this is a recent report. I was looking for what do people think is a small to medium business. Did anyone go to Black Hat this week? Okay. Did anyone learn anything at Black Hat this week? What I learned is that from all the vendors I stopped by, I heard the same things, right? Same problems from the last 10, 15 or years or so, I've really been paying attention infosec. Everybody has new solutions with the blockchain and AI. But I think we also have the same problems that we have to fix. And I think that it's not really different between small businesses, medium businesses and large businesses. So we're going to touch on all of that. But this report, anyway, they were trying to define what's a small to medium business. And you can see it says they surveyed a bunch of folks ranging from 250 to 3,000 employees and they're thinking that's small to medium business. And again, this goes to my point, nobody thinks small companies can actually do anything with infosec. They just excluded below 250 staff. So we're going to talk about that. So there's a perception in the industry that small to medium sized businesses will do the minimum that they have to until they have a breach. So panelists, I'm putting this to you. In your experience, is this generalization accurate? Well, I can go first. From a bank perspective, you are under compliance regimes. And as long as you can take off the compliance report items, you will be hard pressed to get any funding beyond that. So what you need to do if you want to do more in security, you need to do free, cheap, fast wins. So what we found growing from a company of 100 people, 200 people up to 500 people and now merging with a publicly traded company is that security really depends on the mindset of the people that are leading that company first. You can work your butt off in the trenches, try to secure a business and when your C level people come back and say it's not priority, we're not going to fund that, we have other options. That's a hard thing. And we're going to talk about that a little bit later. But one of the things that we really saw was now that we're paying the price for is building up what I call technical debt. You overlook all of these things that you know you should be doing, but as your company grows that debt gets deeper and deeper and deeper and bigger and bigger and bigger and sooner or later you have to pay that debt. So it's going to be better for you to pay that debt up front. And from a small business perspective, people don't see that. They're so busy trying to make money, they forget about the things that they have to secure. And one of the couple of things that we talked about yesterday was asset management and then assessing what your risks are. So Klaus, do you want to talk about that or let Amanda talk about that since she's gotten more experience with that? Well, I'd like to add a quick comment here. Where should SNB start? And this is something we talked about. Jim mentioned risk assessment. There are frameworks out there that you can follow to build your information security program. And there's books. And there are books. I've read the book and it is excellent, it's worth reading. Has anyone heard of the Sands Top 20? Yeah, so I think a lot of small businesses fall under this, I think. But every now and then you'll see not the bare minimum, but you'll see like that one super passionate, they might not even be an infosec person doing way better than a fortune 500 because they do have a smaller amount of assets to secure. But yeah, I kind of agree for the most part. It's really difficult to get the information out to all the small businesses. There's not a whole lot of like, hey, can I just, how do I contact all the small businesses in my area? There's not really a unique, I mean, a standard way to be able to do that. So I think getting a lot of the information out there so they even know that that's something they're supposed to do before they get breached is a big problem too. I kind of have a unique case in that doing DFIR as a consultant usually when I get the call, it's already happened. So, you know, that's kind of a catch 22 for me. But I will say that, you know, usually we all come from different spaces. None of us started, well, most of us didn't start in security. We all took an interest in it. So I think that finding kind of the niches in the communities that are outside of Infosec and kind of spreading out that way, sometimes you'll just inherently find people who are at small to mid-sized businesses and I, if you're at a larger corporation at some point, you're hiring people as vendors. You're touching in some way, shape or form a small to mid-sized business. So even if it's not you, you're affected by them or you're incorporated with them somehow, all of us interact with, you know, smaller businesses and I think that just being an advocate and growing that way and finding the people who are interested is, you know, being more involved is kind of a strategy for it. And you asked how to get started and you mentioned the CIS top 20 and it is a good way to get started and especially for SMBs, you can actually move through that list and take them off and not come back to them heavily just for maintenance and you can get through the whole list whereas some of you are probably from larger corporations and you're stuck in item number three forever, right? For SMB you can do the top 20 and you can move on to other things and it's quite fantastic and to get started you need that but before that you need some kind of a business champion who is willing to get the process started that can come in the form of someone contacting a VC show and you need the advocate or as coined by Amanda, a security masochist, someone to take the beatings, the early beatings for years to start improving security. So that is what you need to get started, the masochist, a champion or a VC show, someone to get it done and get it started. So this tweet that I just put up on the slide from Leslie Carhart, you know, this goes to that point, right? It's a call to action for executives that they are directly responsible for the caliber of cyber security at the organization. Larger companies today, many of them today have a CISO, right? Or VP of security, somebody at an executive level responsible. Many organizations still don't. So if you are a security practitioner and you're pushing hard to help your organization improve its security posture, how can you get a security champion to help lead innovation? And Amanda has a good story that I hope will share with us and it could perhaps be to your benefit if you're looking for that champion. Sorry. All right, yeah. So when I worked at the, it was like a medium-sized hospital, we had 400 beds. We didn't have a security department at all. And coming into the hospital, it was as bad as you can even imagine. There's terrible horror stories. That's where I got a lot of the experience that I ended up putting in the book. The way we got our security champion to be able to get an actual budget for security items, because we had already done a lot of free stuff, was we already had advocates on our board of directors for the hospital. It seemed to turn up. And we took them because a lot of them were already advocates for EMR to kind of teach like, you know, the older nurses and people that weren't so tech savvy why it was a good thing to have more technology. So those champions that were already kind of doing that thing already were in that role. So we took them and all of their colleagues and ran a live fishing demo for them and like their little training thing. And we just phished people's emails that we found with the harvester. So we just scanned like the internet for our domain and let them just live in this training meeting, watch all the creds come in just because right away, you know, when you send fishing to a company that's never had any training and right away like they were on board because they didn't realize the free stuff wasn't everything, right? They thought that we were already pretty much covered because we had fairly good uptime and, you know, we put all this money into this new EMR software but didn't really understand there was all of the stuff that goes with all of that in the infrastructure. And the result was that you found a security champion who was a member of the board, right? And also a doctor in the hospital who helped help improve everything. So going back to the security masochist, right? I think I've been in that position and now leading teams to train them so they're not in that position, right? Everybody's been there. First everybody thinks security is absolute. It's not absolute and it's different for every company, right? So your security risk versus the company that's down the street or other people in here is going to be different. You have to figure out what that risk is and what's secure enough for you. The question is what is enough security and the answer is always just enough, right? You never want to spend more time, effort or money on security than you need to spend. Unfortunately, if you go to Black Hat and RSA and all of these places, all the vendors want you to spend all the money on one thing and they're going to provide you security which they don't even know what that is, right? So the bottom line is you have to figure out what that is first before you can do it. The other problem is you feel overwhelmed, right? You get into a situation where the CIS stuff, that's a great resource that's available through several vulnerability scanning platforms you can actually use to scan your infrastructure for CIS compliance and that's a really good tool if you do that and use it on a regular basis and there's people in the room that can help you with that. So if you do that, that will take the load off your mind. So what I'm getting at is you can't do it all. You have to find that champion in your company that's going to help you hire the expertise to do it right and do it right the first time. So I think to kind of piggyback on both of those and especially Amanda's point and Jim was talking about scanning, I think debt are the days where we're a blue team only and I know that's a very controversial thing to say in this room. So I think that kind of the merge between and I don't want to get too much into the colors but red, blue, purple teaming, what have you, a lot of these small and mid-sized businesses you'll come across people who have just been there forever or you have one person you're working with that has the security skill set or no people that you're working with that have security skill sets and when we're trying to educate them on how to better their posture, a lot of that has to do with show and tell and how do we show and tell? Well, we could show them artifacts but that's after the fact that it's happened. So if we want to make their businesses better and if we want to advocate for a better security posture, I think that coming at it from like phishing or like, you know, showing them where their vulnerabilities lie and giving them a real scenario where it's not an APT, it's us and showing them where the hole is with an actual attack is an actual strategy. So I think being more hybridized in the future is really going to lead to some successes for all of us. On that note, as for an SMB, the VC role actually makes a lot of sense and then if you can get someone with the technical job to be a purple VC so who will come in maybe once a month, point out a few things that you need to improve because security is a process. You can't do all of that overnight. I once wrote a framework for SMBs called Minimum Viable Security. You can find it online. It's everything that my team and I did in the bank over five years. So it's every control we put in place, most of it for free because we didn't have any budget in five years. So VC so that comes in now and then it does something and then pops it in the next month might make a lot of sense. So every week we have more breach disclosures, right? We've heard of a few really large ones recently and a lot of large companies that still have things like RDP open to the world leading to a breach or unsecured S3 buckets. How should SMBs approach security differently than large businesses? They shouldn't. The vulnerabilities and the risks are the same. The scale of those is different. Just look at what happened to a large bank recently, right? They have a great security team in place, but because they didn't do the basics, they didn't do the checklists against their firewall configurations and against their S3 configurations and insider had inside knowledge that they used against that company down the road. It was a simple thing to fix. It wouldn't have cost them anything hardly to do. It should have been part of their normal processes. So think about that when you're looking at security.  Remember, your vendors aren't going to distribute active directory and a secure figuration. They're not going to send you the devices so they're set up securely. They're going to put that on you. They want the money. Then they want the money on the back end to teach you how to use it. So be cognizant of that. It's on the screen right now. Most security is just good architecture, which prevents other problems anyway. Everyone agree with that? Everyone agree with that? Does anyone disagree with that? Which part? What are we agreeing on? The bottom one. Most security is just good architecture, which prevents other problems anyway. Oh, absolutely. Um, so I definitely agree with Swift, um, most days. Uh, no, they're phenomenal and that's a really great resource if you don't follow Swift already, you should. Um, but I would add to the point of, yeah, we can say, we can say patch your, patch everything. We can say, hey, you know, do better vulnerability management. Um, but the truth is, uh, you know, we're going to find holes in different businesses for different reasons. Um, you know, maybe there's an old, old software out there that's only compatible with Windows XP. I've been in a lot of environments. Um, ICS environments are notorious for it. Uh, hospitals are notorious for it. You have some of these old scanning machines and they're not, they can't upgrade because of X, Y and Z reason. Um, and so knowing that, finding the mitigation in between and I will say it every day of the week, uh, defense in depth, like, have multiple triggers. Like, you know, make sure that you have eyes on, ask for logs. Like, there are never enough logs. So, and I know it costs money, so like, get more intelligent with the logs you're asking for.  Um, and so I, I would say yes while patching is great, uh, sometimes it's not possible. So put a, put something in between that can mitigate that attack if it's going to happen. Yeah, so the, the whole patching front, who's, who's ever been a sysadmin?  Uh, you know, stuff goes down. Sometimes you don't have downtime windows. Sometimes like, yeah, I mean, in healthcare, we had a Windows NT server that was sitting there that, that department never got the budget to replace that software. That software was doing a lot of business and it just wasn't as, you know, it wasn't as high on the priority list as a new CT scanner or, you know, anything else of a million other things that they spend their money on, they're like, well it's still on, it's still running. You just need to do architecture to fix it. So you put it on its own VLAN and you segment it away and don't let it talk to anything. Um, but yeah, that's a good point. So one of the things, I, I started a business many, many years ago, 25 years ago and I wish I had started a business now because there are so many cloud based solutions that would have taken the load off of me as a administrator within the business, uh, any, you know, Office 365, those kinds of things, subscription based services that keep my security profile much better than it ever would be. So I would encourage you to take advantage of those things. Uh, a friend of mine is a CISO at Walmart and he was, um, we were talking about the security of OneDrive and the things associated with Office 365. And one of the guys at our company wouldn't let us use OneDrive to store data because they thought it was insecure. Well, CISO at Walmart goes, you're kidding me, right? He says, they have a private cloud for us and their stuff is much more secure than we are. So we use it for our stuff. So that was, that was a re, an eye-opening experience for me to look at outsourcing that sort of thing and taking that load off of my plate and our team's plate. Sorry, I was trying to find a slide I want to talk about next. So what about compliance? You know, a lot of organizations do security only because they have to meet, uh, you know, PCI a while ago or today HIPAA, uh, or GD, uh, GDPR. So has this helped small to medium businesses to think about and implement better security programs? Uh, I'll speak to his compliance in just a second, but first, commenting on what he was saying. So for your SMB, as Amanda also was saying, you can actually segment off, you can architecture those things the way that you can't fix, which means, in the hold, you can do all of the basics really, really good and better by far than any large company can ever do. With the cloud comes certain new risk profiles that did not ex, exist before. But overall, if you go to the cloud as an SMB, you'll be more secure than you ever were before. So it has a lot of potential and as long as you have that masochist who cares enough to find out that you shouldn't create public S3 buckets for internal documents, you'll be really fine in the cloud. On compliance, some companies only have one way to get a budget, to do anything, to hire, to replace a tool, to do refactoring of applications and that is get some compliance dude who's doing a check anyway, give him some hints as he's doing the assessment. I'd like to see this, I'd like to see this, I'd like to see this and you'll find report. And the items that get put in as critical and high, you may actually get the budget to fix them. So as much as I hate it and it's not security, some companies really need compliance. I would agree to that point and say that one of my earlier, earliest experiences in security with the university, the security team getting, getting particularly the medical staff to be compliant was the tool they needed in order to implement security for the hospital. So compliance was actually something that we used as a tool to get a better posture and without compliance checks, we would have, it would have fallen on deaf years, especially if, if anybody has ever worked at a medical organization and worked with doctors, you know, it's, it's a great, it's a great tool to have and, and you can usually argue for a little bit more if, if you want to, you know, just to, to, to have better practices in place and, and kind of extend it beyond and make everything better for everybody. So how many people in the room have companies that accept credit cards? How many of you have been through PCI compliance audits? Wow. So my question is a small business is why would you ever do that? Right? That is the hardest compliance to get, very difficult, very expensive, and it's all about scope with that, right? So if you're building a business, you're in a small business, you're accepting credit cards, figure out a way to offload that. You know, companies like Chase Bank, Capital One, some of these others provide payment gateways that will integrate seamlessly within your website or how whatever way you're taking credit cards and will remove your need to be PCI compliant 100 percent, right? It's all about scope in that situation, but if you don't understand what that means and how that works, you're really going to open yourself up for a can of worms that you don't want to be involved in in that case, right? Other sides of compliance. Why is compliance good? Why is it a good thing? It goes back to some of the things we talked about with the CIS benchmarks. It gives you standards, procedures and practices that should be in place in your business. One of the problems in compliance is people will bring in an auditor set up the compliance policies, but your owners of those policies don't know how those policies are supposed to work and they don't apply them. And a good auditor is going to go and find that out because they're going to ask you, take me to the owner of that process and they're going to interview that process owner and they're going to find out very quickly that you're not doing what you say you're going to do. So these things are all done to benefit your business and to take the load off so that you don't have to worry about the mundane stuff and do all that reactive stuff, you can take your time and get back to making your business grow. And so the other side of that, don't always trust your vendors that say they're compliant. We at one point in time had, you know, they take like payments at the bedside now for, I don't know, for more money I guess. And there is a credit card swipe vendor that swore up and down they were PCI compliant, we were fine, they could just checkmark the box, no worries. But every time you swipe the card it was just keyboard emulation into an HDP site on the back end. So just make sure you check because even though they say they're PCI compliant, I mean they may have gotten an audit that said they're PCI compliant. We know not all those auditors know what they're doing either. So do SMBs in large businesses have disparate threat models?  And the size of the business being a determining factor in the threat model. I don't really agree with that but I'd like to hear what you all have to say. So anecdotally I was with the Sands Defer Summit, I think two weeks ago now it's the whole traveling thing's been a blur and presented with some very wonderful folks from Google. And part of our war game was sitting a bunch of Defer people down all from different backgrounds at similar tables and saying except the lowest viable like whoever is most vulnerable at your table that is now your security company. And we had a checklist and everybody was coming from different size companies. We had everything as big as Fortune 5 to or Global 5 to like very very very small micro businesses. And what we found at every group is they all had the same vulnerabilities. Everybody was kind of coming from the same, they all had the same pain points. And I think a lot of us don't like to admit it. But if we really started talking we would find that we all deal with the same pain. And the benefit, and I would say where it is disparate, is at a small to mid-sized business you can get a tighter posture quicker rather than all going up the chain and getting approvals and dealing with lawyers that come with the larger businesses. So I would actually argue that while budgetary issues are a thing at smaller businesses, you're actually in a better place to get more creative with your solutions and get them implemented faster than some of the giants. I can't remember what I was saying. So it's kind of an inverted threat model, right? So what's the biggest, what's the highest priority for security? It's people first, right? And they're also going to be your greatest weakness within a business because they do things that break things. They're the easiest way for somebody to compromise your business. So every business has the problem of securing its people from both the from the data perspective and from the personal safety perspective. But as the business gets larger, hopefully you've trained your people well enough to know that they're your security minions on the street, right? They're watching out. They know why somebody shouldn't tailgate in. They know why somebody shouldn't leave passwords on their desk, why they shouldn't leave their computers unlocked. But this is all a training process that you have to implement. And if you're in a small business, you're in a unique position that you can start that program right from the ground up so that now you can build your security team so that it's also an HR that it's in finance, that it's in every department within the company. It's just not within information and security. So you have to be able to figure out how to do that.  But for the most part, it's all the same problems everyone else is having. We're going to take questions in like just a few minutes. We're almost done going through our slides here. I actually have a question for the audience. Who here at your company allows your end users to check their personal email on the work network? Raise your hands. Go ahead. All right. Who of keep your hands raised of you? Who is at a larger company? Okay. That's interesting. So smaller companies usually I find have a better chance at shutting that off. A lot of the attacks I've been seeing because yes, our users are our weakest link. It's, we, we can have defense in depth all day. If you can check your personal email on your, on your work network, unless you have a really good endpoint plan, I've seen a lot get in that way. So, I would very much encourage all of you as a strategy to go back. Those of you are at smaller business, larger, larger companies, I'm sorry, it's going to be hard. But smaller businesses, you know, if you can, if you can get that shut down. I'm, I'm actually going to go out of my branch here. The tweet you're looking at, what does he sell? What does lands from sands? What does he sell? His cell security awareness.  And you should. You can reduce the number of incidents you have down until a certain point. But you're not securing your organization by doing this. You're reducing your SOX workload. And that is the main reason for doing this. People cannot be fixed. We can't train the human firewall perfectly. We need technology to take up and be the compensating controls around the fact that we're human. So you need prevention and you need detection. Do your security culture. Do your security awareness. But do everything else at least that's good. Thank you Klaus. Alright, we're going to take some questions. We have about 10 minutes left. I saw a hand over here go up really quick in the second row. If you'd like to come up and ask your question on the mic, I am going to grab you one of these books that Amanda Berlin signed for us. It's the same guy. Yeah, so I would be interested to hear your take on preventive and detective controls. If you could choose just one, which one would you choose and why? Yeah, I know they close each other off, so which one would you choose? I have an answer for that. The one for a Windows based organization where you can pipe all incoming scripts to Notepad instead of opening them in the scripting engine. I don't have a good answer for that. In between defensive or preventive measures, do you have one? Yeah. So that's a conundrum, right? So log all the things, right? So that would be your first compensating control. If you had to have anything do that first. The problem is with a perimeter and preventive control, you don't know what's already gotten inside your network, right? The idea that we have this castle doctrine and we're preventing the world from coming into our network is complete crap. That's not security, right? People are already in people's networks. You just don't know it until you start gathering the information and doing those compensating controls to see what's happening. You'll never know. So that would be my take on it. I guess I do have an answer because I actually do work for a logging company, so I'll go with that. I don't think I'm allowed to answer this question. All right, next question. Tuna. So my question for the panel is how does the picture change when a company is 100% remote? There isn't a data center. Everything's in the cloud. There's a new way of working. A lot of startups and a lot of companies, subsidiaries are embracing. What would your take beyond that as far as how does that picture change for securing the kind of business? Could everyone hear that? What if your company is 100% in the cloud? How does that change things? 100% remote, I'm sorry. Yeah. I think it, you know, if we're just talking small to mid-sized businesses, I think that it just changes what you look at.  It's the same questions that we're asking if people are, you know, in an office but just different landscape. The other thing is when you're looking at user training with remote users, I used to do a lot of insider threat cases. It gets much more difficult. So what kind of end points are you giving them? If you're giving them max, can they sync to their iCloud account? Like thinking of these things and, you know, how sensitive is the data? Making sure your user groups are very, very tight, you know, principle of least privilege. I think these things become more enhanced as we see more remote workers just because that tendency to, if you have remote workers to merge work life and personal life becomes much more prevalent. The list of the basics, the security hygiene things, it changes. So you need to enumerate it from scratch but it's still there. One thing that I've noticed when you go all cloud and all remote, and I've done that for three years, is that the life cycle management of employees and their access becomes hard. You need someone to have the dedicated responsibility of keeping track of who has access to what and granting and revoking in a timely manner, automated if you can.  So one of the trends is going towards instead of, you know, VPN connections back to a central point and all of those sorts of things that control networking is more the zero trust network setup. And there were some good talks at B-Side San Francisco, not this year, but last year by some guys from Google that give you a good overview of how that works. And it's really something that I think is going to overtake a lot of these trusted networks as opposed to doing VPN clients and those sorts of things.  Where are we in the cloud? Do we own our network? How do we control the endpoint devices? What do we allow? So it's a complex question. How do you solve that endpoint? At our company, we control what they do and how they connect to our networks because some of our networks are somewhat old school. But at that point we provide the devices, we provide the connectivity, we manage all of those things, the access control very closely for them. I would say just one more thing that I forgot that I've been, I've been lit on fire with quite often is USB management. If you have a completely remote, you know, user group, they'll plug in anything.  No, I wasn't going to bring up that. Okay. Any more questions? Yes, sir. Do you mind coming up and asking? You can always can I repeat if you want. We're going to give you a T-shirt for the question. Yep. So I'm here, I'm here sort of representing NIST and I wanted to put in a word for the, the cyber, the cybersecurity small business corner website that NIST has published, which has a very long list of resources from all across the government and internationally. But I wanted to ask the crew here, what, what are the regular resources you go to podcasts and so forth to keep up to date and get new ideas? Yeah, I can't believe we didn't bring up NIST. I recommend it all the time. They have made, they have, they have, yeah, yeah, they have so many resources. I mean, from policy and procedure templates that you can download to just everything. I absolutely love it. Can you remember? Oh, I mean, I hear breaking down security is really good. NIST, and I mean, a lot on Twitter. I mean, I pay attention a lot to different things on Twitter. There's a lot of really good security podcasts out there too. I'll go ahead and plug some of my favorites. So David Cowan's deeper lunch of all of his stuff that he does. I keep up with that. I keep up with a lot of the Sands folks for educational materials to keep up with vulnerabilities. Honestly, I still go to Twitter for everything. I find it usually first there and having a good network there. And then for Intel, you know, if it depends on what you're looking at, I still very, very much advocate if you don't know what it is, go through Passive Total first rather than tip your hat. But, but otherwise those, those are the main ones. I must admit that I keep up with the break safe podcast on a regular basis. I also listen to the purple squad podcast with John Snot here. That's his Twitter handle. I use Twitter for keeping abreast of anything that's going on. I use Peelist when it's something I don't need urgently, where it will be elaborated over time by a lot of communities that will make the answers better and better. And I don't use LinkedIn at all. It's poison to me. So, so one of the things you can use too is the thing you're at right now, right? There's some amazing people here and everyone that I've met is very friendly and you never know who you're going to meet. Ask questions. You can't know at all, but you meet people here. You'll get to be friends with them. Link up with them on Twitter. LinkedIn if you want to for some people that use it, some don't.  But use those contacts because for me, the networking that I've developed with people has been just irreplaceable. I couldn't have done what I've done at my job without the people that I've gotten to meet at these different events. So. Thank you, Jim. I think that's an excellent note to end on. I would agree 100 percent.  Participate in the community. Participate in your community. At 10 conferences, most major cities now have a B-Sites conference. If you don't, there's probably one not too far away. Go there and learn. So I think we're done. We're out of time, but we'd love to hear more from you. We'll be around. Please feel free to come ask questions.


As you may know, I am a big fan of Nickelodeon. I loved SpongeBob as a kid. It's sad to hear that Steven Hillen bird passed away. I was actually crying when I found out he died. He was my childhood. So in honor of him, I taught every SpongeBob DVD from season 1 to season 10. I also found a guy in front of the street who was selling a lost SpongeBob episode DVD. I told him how much. He said it costed one dollar. I dotted and turned on my DVD player. I was curious about the DVD, so I popped it in. The first thing I saw was the Nickelodeon fish floating around. I was really back in memory lane. But then I noticed something. The fish's eyes were bloodshot and the fish itself was red. Well, I didn't really care about it, so I kept watching. The menu screen was just a stretched out PNG of SpongeBob with a title called SpongeLost.MP4. I clicked on it. The first thing I saw was the intro. I was glad to see my childhood. Until the title card came up. The background was just dark and there was a pentagram on the back of the wall. The title of the episode was called Lies. I had a mysterious feeling about the episode. During the title card, a creepy backwards music box was playing. The first thing that showed up was SpongeBob eating some kelp next to Gary. It looked like a normal episode so far. Well, Gary, I am heading to work. See you later, Gary. After SpongeBob left the house and off to work, he saw a fish hanging from a tree and it zoomed in on its detailed face. There was blood coming out of its eyes and his skin was decomposing with flies all around him. I was really scared at this point. SpongeBob screamed and ran as fast as he could to the Krusty Krab. When he walked in, there were people who were waiting in line for Krabby Patties. Then I heard Mr. Krabs yell out, SpongeBob! The only thing off was that it wasn't the original voice actor. It was a man who sounded like he had a cold and lost 65 years old. These customers are on a frenzy here. You must make those Krabby Patties immediately. SpongeBob ran into the kitchen without saying a word. He started making Krabby Patties. Then it was just a loop, like the Flintstones, of him flipping Krabby Patties. And this is where the whole episode just goes down, yo. As the loop pulled SpongeBob flipping Patties kept on going, a metal door shaking could be heard out of nowhere. Later on, screams of innocence could be heard. It sounded like a torture room. I started to shake. Then, SpongeBob started melting, until his rib cage started showing. The room got more darker and the screams started to get louder. The whole kitchen was set on fire. And eventually, the audio stopped. SpongeBob stared at the viewer. He said, People think I'm a good person. Lies, lies, lies. Then everything came back to normal. He called Mr. Krabs. When he came, he was confused. SpongeBob already knew how to make Krabby Patties. But then, the most craziest thing happened. SpongeBob grabbed Mr. Krabs' head and smacked it onto the stove that was already heated. He kept smashing his head into the stove until the only things that were left was blood and pieces of Mr. Krabs' head. SpongeBob started laughing with blood all over his face. He went to Squidward. Squidward told him to bug off. SpongeBob said in a demonic voice, You will face the wrath of SpongeBob.  He grabbed Squidward's chest and ripped it open. He ripped out his heart and soon enough, Squidward fell onto the floor. Dead. While SpongeBob was looking at the beating heart, It showed a close support of the heart and it wasn't your normal cartoon heart. It was a real heart that looked photorealistic. I didn't have a bucket with me, so instead, I threw up on the floor. As I kept watching, SpongeBob entered the gym. He saw Larry and gave him a protein milkshake. As Larry drank it, he started throwing up blood, But it wasn't your normal cartoon blood. It was either Mountain Dew Code Red or Real. As he fell on the floor, he was completely white and a pool of blood was right next to him. SpongeBob was laughing eagerly, As he showed the viewer he had put some cyanide pills inside of the milkshake. Next, he went to Sandy's tritone. Sandy was working on a brand new invention that looked like a filler buncher. SpongeBob then picked up a rock and threw it into the glass. The tritone cracked a little until it broke. Sandy then died because of the rock that SpongeBob threw it through a window, And when SpongeBob saw her floating dead body, he then said, I just need one more kill.  Patrick was scared and was biting his fingernails, Even though he didn't have any nails or fingers. SpongeBob opened the rod. Patrick screamed. Then it cut to a pitch black scream that said, I used Google translate on my phone. It meant, you are next. Then the scene cut to SpongeBob's house. Then, it showed the inside of the house, Which was all dirty and trashed. There was also a pentagram on the wall, And it was the same thing in the title card. The next room had Gary in it, Dead Wings his cell broken and I slipped.  SpongeBob was lying in bed with a knife in one hand, And a sad face covered in blood. He said, He sighed and said, I guess this might be the only way out. SpongeBob slipped his wrist and wrote lies on it. He died shortly. Then the episode ended. Up having no giant suicidal thoughts. But luckily, I found a therapist to help me out. I still like SpongeBob, But I will never look at him the same ever again.


DD, who cheats more men or women? Well, from what I understand is women now are right up there with men on the physical cheating. Women tend to have more emotional sex with men and men tend to have more physical sex with women. But I think women are now right up there or close to the numbers or the relatively close to one another. At least that's what I've heard.


In this presentation we're going to talk about the operating cycle for a merchandising company. When we think about the operating cycle for a merchandising company we can contrast this to a service company, a service company providing a service in order to generate revenue, and a merchandising company providing merchandise. The merchandise now being an added factor, adding a bit more complexity to the cycle and is of course what we want to concentrate on as the new thing, the different thing, the thing that we need to get practice with as we move from a service company to a merchandising company. The cycle will look something like this, first we're going to be purchasing inventory. So the inventory could be anything that we are going to purchase for the purpose of reselling in order to generate revenue. Once we have the inventory at some point in the future we will hope to sell that inventory to a customer. We're going to say here that we're going to make the sale on account. Now we could make the sale for cash and receive payment at the point of sale, but in order to work through the standard cycle we're going to work this cycle and we're going to say we sell something on account, meaning we invoice the client, we provide the inventory to the client selling the inventory and expect to receive payment at a later point in time. And when we do receive payment then of course we're going to collect the cash decreasing the accounts receivable and increasing the cash at that time and this will be the standard process. We're going to purchase inventory, we're going to sell it to the customer, we're going to receive cash. Now this is going to be just an idea of what we want to keep in our mind of course when we are a merchandising company we're buying inventory, we're marking it up in order to get a profit margin, we're selling it to the customer, we're getting that cash and the cycle then will continue. Don't mix this up with the other cycles that we have talked about which are going to be the standard purchasing cycle where we can think of just the purchasing in and of itself in other words. We may not be purchasing just for cash, we might be purchasing on account and have a similar cycle in this process as well, meaning we're going to purchase inventory on account and at a later time we're going to pay what we owe pay off the account and this cycle over here when we're dealing with the customer of course is the receivable cycle where we're typically going to invoice the client, have an account receivable and then collect payment at a later point and of course we could at some point receive cash directly from the customer. The idea of this cycle is to differentiate from the service company in that we have this added factor, this added factor of inventory and this process will be happening in one form or another where we will be purchasing inventory, the goal of the purchase of the inventory is to mark it up, that's how we generate the revenue. Once we mark it up we sell it to the customer at the marked up price and if we sell it on account then we increase the accounts receivable and we increase the sales then of course eventually we collect the cash and once we have the cash we have the funds in order to repeat this process to generate more revenue.