[Music]
there we go threats versus capabilities
i'd rather have more of one than the
other and i guess our speaker is going
to help me decide which of which uh
thomas fisher has spoken at
well this is not your first first is it
that's my third that's your third first
and you've spoken at all of them eh
last three yeah well not the virtual
ones yeah
okay so anyway that's pretty good track
record um i've seen some of his talks
they're pretty good let's give him a
warm round of applause and i'm gonna get
the hell off stage
you thank you trey
well good afternoon everybody um hope
you had a good break got some coffee
still awake it's getting long it's good
been a long day for everybody
okay so i'm not going to go over who i
am you can read it in the booklet but
one of the things i'm going to say is
that if you've been to my previous talks
you know that i try to challenge the way
we think
but i'm not really presenting a solution
a solution or anything like that i want
to present something that i've done what
i've been involved in that'll help you
challenge the way that you think and
help you challenge the way that you you
do things
uh and think differently so let's see
why are we here
well let's face it
despite all the hard work we do in
insert response and detection
engineering and and everything that you
do to protect your environments
for actors are still there they're still
getting in
so i was sitting around and i was like
so why are we still in this situation
that was i started to think about how am
i going to ensure that we protect
ourselves and we're not getting these
we're not in the same situation all the
time
so i started looking at people
i don't think people are the problem the
previous speaker mentioned it we should
be able to mentor people we should be
able to bring new talent into the field
we should be able to grow ourselves in
the field so people shouldn't be the
problem and if people are the problem
we're probably doing something wrong in
terms of mentoring in terms of training
people in terms of getting people on
board
procedures
um this is really a business thing right
or drive to where how do you do things
and things like that you can always
change those if those aren't working for
you change them i mean it's simple it's
a procedure it's a written document if
they are static and they're not living
in your environment then
again you need to rethink how you're
doing your procedures and what you're
doing with procedures
technology so this is the one that we
always kind of end up blaming if you
think about it you're always blaming
technology to a certain extent you're
saying oh this tool is failing or i
don't have these capabilities in this
tool so i can't do this i can't do that
so one day
actually at a recent meeting i was at
this quote came up
this is from buck mr fuller on his
thesis on uh i think it's called
starship earth or mothership earth
and in this he says that basically what
he's saying is the failures are the
consequences of a number of things but
more importantly
that if we specialize too much in our
fields and if we put too much
specialization in we're going to
we're going to fail but and we need more
comprehensive thinking we need to be
able to have multiple talents multiple
abilities and we need to be able to
think differently to a certain extent
and if you think about it you've seen
this in in certain sci-fi movies where
people go to say like mars but it's only
tech it's only like really phd people
and and
and scientists but who's going to build
who's going to do the grunt work if you
only have smart people who does the
grunt work
and that's kind of the the premise of
some of the some of his work and i was
sitting here going
this was being explained to me in a
meeting and i was like satan wait a
minute if i change
oh crap
the slide didn't work out that security
is supposed to point over society
so if you see society's crossed out i
put security in its place
and then if i put tools in place of
specialization
i've now
got
something that applies
to security to a certain extent
are we relying too much on our tools to
be able to do our jobs are we relying
too much on the things that the tools
that are being presented to us as a
solution to what we what we're trying to
do
and this is where i was like
okay
this is a good starting point
you know we always blame tools for not
being able to do what they're supposed
to be doing
um i've been in a number of
conversations the past few weeks where
tools of
the tool vendors are really starting to
get on my nerves
and then
you get this
i found this infographic from
from
scrutiny i think it's really good
because it kind of describes our
environment right now if you're an if
you're a slot if you're part of a soccer
if you're part of a response team and if
you're trying to get into
like understanding what's going on with
with all the things that are on the
market there's so much stuff and there's
so many different directions people are
telling you pushing you to and then
there's xdr right the new thing is xdr i
actually saw i think out of rsa somebody
called somebody said there was an xgr
next gen it's like what the
i mean come on guys it's like stop
inventing words it's still the same
bloody stuff it's still a tool that's
detecting events but presenting the
events to you in a readable format it's
like stop putting labels on things
please please stop putting labels on
things
but and when we talk about labeling
we start to think about
well why is late why are labels so
important but it's not important that's
my problem it's not important
we need to start go back to some basic
principles
what products should the organization
purchase
i out of curiosity what do you think
anybody from the audience want to take a
guess shout out
no so we got av firewall up front now
what matters to your organization
right
this is the problem is we're buying
tools because we're being pushed by
vendors sometimes we're being pushed by
our own management that says oh you need
to look at this new tool it's really
cool i saw it at rsa or whatever and
it's really important and we need to get
that tool on board it's like no step
back
what actually matters to your
organization what is going to help you
solve your problems
a lot of vendors will come and pitch to
you and say oh i have this new solution
for you
i basically now tell vendors to leave if
they tell me i have they have a solution
for me they don't know what my problem
is they have a product they have a tool
that might help me fix my solution
will build my solution but they do not
know what my solution is and i recommend
you actually challenge any vendor that
comes in i'm sorry if there are any
vendors in the crowd
but you guys need to wake up because you
cancel you can't present a solution to a
problem that you don't know how to fit
but you don't know what i have
so
then
mitre
mitre was really great when it started i
really liked it it was simple we had we
had ttps you know we had the techniques
and we could easily identify and
correlate and basically categorize
attacks
in a
understandable and readable way
then vendors got involved
and mida became the bane of my existence
because nowadays it's like oh we do the
vendors are like oh yes we detect all of
these minor attack ttps we can classify
all your events as a ttp i was like no
stop stop i don't care it's like i'm not
going to use that to do detection and i
was really happy when i was in the i was
i was watching the
the presentation yesterday on the
analytics that they did on the t on the
tactics
and they actually said
the people for mira
uh and i'm gonna find that i'm gonna
rewatch the video and get the exact
quote but they basically explained that
you cannot do detections with techniques
and please remember that if that if
you're going to look at detection
technology don't focus on does it do
mitre because it doesn't really matter
because
um
you you you start
you end up having tools that will tell
you that
a simple
lullaby everybody know what a lol bus is
living on the land binaries right
but a low bus is a malware
i've actually seen that i've been in
arguments with three weeks with one
vendor because they are detecting simple
software and they're classifying them as
a v as as like their advanced av
solution is classifying them as malware
and my guess but they won't tell me but
my guess is only because it appears in
certain ttps
in maya because that's the only reason
they would actually flag it as bad
then
it's become a little bit too focused on
threat actors
right and there's a lot of and i don't
necessarily disagree with it with that
what my problem is it's being used
primarily in
the evaluation basis and it's being used
as
a reasoning for a product to kind of
like be the best solution for you right
um or the best tool for you
and that's fine but you don't know what
the unknown unknowns are my problem is
like in this in that list there's
probably
my organization that's probably only one
actor that i'm really concerned with
but there's a whole bunch of other
actors that i'm concerned with that are
not in this list and potentially not in
the really properly defined in the mitre
attack framework
so detection is showing the techniques
or procedures
well actually is i should have
questioned would that phrase that in a
question but is it really showing a
detection when you're looking at
techniques and procedures no a detection
for me is a set of events so you're
gonna have a set of techniques you
probably could potentially have as a
full procedure before you actually get a
detection
so you cover a bunch of ttps but as many
people have done presentations and minus
that what about the unknown unknowns
right until somebody tells midair that
oh you need to put this into the attack
framework
you don't know what the unknown unknowns
are
how are you going to detect them if
you're focused on all on tact on tactics
uh jared atkinson
wrote uh put this up on twitter
in april
um the link is there it'll be in the pdf
or you can download afterwards but one
of the interesting things is it's like
and i was like when you publish this i
was like yes somebody who actually
understands what my problem is kind of
thing it's
he's highlighting here that in an attack
there are a lot of techniques that are
used
but each technique lives in a flow
of during an attack
but
many unique paths exist
from the poi from the start of the
attack to when they compromise your
environment or when they're actively
moving around in your environment and
that's the problem is that we don't have
when you're looking at things like in in
such a structured way
you're kind of losing the visibility
that you should be looking at which is
having a white much wider visibility and
looking at events and processing the
events based on your environment
and that's something that um if you if
you go into fret hunting
um i think joe this morning said it in
his front handling presentation he
basically said it's like you have to
kind of understand your environment if
you're going to do fret hunting properly
and you have to completely you're going
to have to feed that loop continuously
to be able to understand that
so
what can we do differently so my so i
sit in that guy and say so what really
is my problem and my problem is is like
and i've done this a number of times
even before i was i was with my current
company as i was sitting there going
it's like if i'm going into if i'm going
to look at these things i'm going to
rebuild a soccer i'm going to rebuild
an ir team or i'm going to rebuild our
capabilities to do detection it's like
what's my real problem my real problem
is i don't really understand what my
current capabilities are or what i
really need to focus on
and that's
where the challenge is and that's where
i want to kind of try and solve this and
that this is where i wanted to push new
thinking
so i started thinking well threat
modeling right we do fret one everybody
does threat modding when they're
deploying applications when they're
deploying infrastructure right
right
no
exactly
threat modeling works
is nice
but it's also complicated to do takes a
lot of time
sometimes and typically it's focused on
the application
and the infrastructure the application
the other problem i have with it too is
that it's
can tend to be focused on risk
rather than
rather than what am i going to actually
protect my environment against
so it's very much a risk-based approach
risks
are nice
but
have you ever tried to actually map a
risk into detections
it's like let's take take a car an
energy right we know there's a risk of
driving out into
into into the street and that you might
something might happen right so we
prepare ourselves right this is risk
mitigation you put seat belts on you
drive slowly you have airbags you make
sure everybody's seated and things like
that but what's the threat the threat is
somebody running into you
the threat is that there's an external
event that happens and you get and you
have a car accident that's not a risk
right the ri
that's
that's i didn't mean to say that that's
not exactly what i meant
the threat
is what is
what's going to happen
now i lost the train my foot
i need to reboot back up
no i need to reboot my brain
sorry but sorry everybody so
i'm saying so
when we're in the car so somebody's
going to crash into you that's the
threat right somebody might crash
somebody's crashing into you that's the
threat now you've prepared and you
mitigated a risk
which is how much damage you can do to
your environment to yourself or to the
people in your car right
by putting in the seat belts by putting
in the airbags but the fret is still
there
it's like how am i going to detect that
threat
and if you think about some of the
recent stories with the tesla cars and
things like that
on the order drive
they basically are continuously
monitoring the road in front of them to
look for potential threats
right so they're going to stop
all their drive when they hit a
potential when they see a potential
threat
and
this is where
kind of like the thinking process is
well
i'm not going to really be you know
whatever i put into terms of detections
yes it's going to gain my risk but it's
not really what i'm looking for i'm not
really looking to detect my risks
my risks are that my company gets
compromised but how does it get
compromised i want to protect myself
against how it's going to be compromised
and i didn't i don't for me i mean you
can argue this with me afterwards we
can't spend that but i don't see risk as
a good way to
do incident response right it's a
response we're responding to a threat
responding to a threat actor trying to
break into our environment responding to
specific events
and when i'm looking at detection
engineering
i'm not really going to
engineer a detection
for a risk i'm going to engineer a
detection for a threat
right that's why we talk about threat
actors that's why we talk about mitre
talks about the about threat actors as
well
and those ctps
so
i'm so my focus was
that i wanted to a practical approach a
practical approach based on what i can
actually detect but also what i want to
protect the organization against
so you know like
a fret actor coming into my environment
uh
some ransomware attacks
potentially
uh some idiot that's doing that's trying
to fish me right
some things like that those are real
real threats right against my
organization
so
i wanted
to build
a way to identify this through a threat
driven approach
so this is where the fret versus
capabilities comes in so i'm going to
start with a fret and then i'm going to
look at mapping my capabilities so i
want to understand my capabilities as it
applies to how i'm going to protect
myself against the threat
it's going to have i need it needs to
help me define what and how detection is
achieved
and i want it also eventually to
identify how effective my response is
going to be
right so if i know what i can detect i
can i know basically i can start setting
the foundation of how effective my
response is going to be
so the premise of this is
i'm going to first
work to understand what the what threats
my organizations are concerned is
concerned with so i'm going to look at
all the different frets
you can use
any fret mappings that you want you can
use enazar you can use
what's the verizons and things like that
all those reports but i'm going to focus
on the ones that are priority for me for
my organization
probably talk to my cso probably talk to
my security
director of security and say okay so
what are we really concerned with here
what's our biggest threat we know what
some of our biggest threats are
then i want to identify the assets this
is one
phase
that i think we overlook for overlook a
lot as incident responders and as
uh
as sock analysts and things like that
and it was even mentioned earl in the
previous presentation on the cloud ir
it's like if you don't understand your
assets in the cloud
you're going to have a really hard time
time doing ir
um i'm i can't go into what but our
cloud environment is so bloody humongous
i don't even know how we can do it right
now right
we're working on it but you know
you need to determine the detection data
points
so
we know
how to fight these threats we know how
to
how to control mitigate contain
eradicate these threats so
we
can understand what our detection points
are we don't need a tool to basically
tell us oh we need to detect this this
and that if you understand how to how to
basically identify a threat
based on your experience based on your
knowledge based on sharing with other
people you can start to identify the
data points which you want to detect
from those data points you can start to
build response actions and use those
data points to build your response
actions
so
like i said we start with a threat i
just picked this up from the inn is a
that's it this is a 2021 fret
infographic that they use for the threat
for their fret landscape for 2021
but it's got crypto jacking threats
against data malware disinformation
misinformation non-malicious threats
friends against availability ransomware
email related threads supply chain
threats
um i would actually
focus on the more very specific threats
like ransomware malware threats against
my data i'll even go a little bit
further into threats against my data so
if i'm in a european institute i would
probably look at oh
can somebody change the data without me
knowing
so very specific threats like that you
want to go down to the specific level of
threat because that's going to help you
actually better understand what data
points you need
so my approach
and this is an approach
it's a framework
you can build on it you can use it you
can change it you can ignore it i don't
it's i'm here to present a way
for you to start thinking a bit
differently that's my goal
i'm not saying this is the this is the
best thing you can do but i use a mind
map i like mind maps
actually drawing it out helped
me and actually the team a lot to better
understand what things that we needed
and where we needed to put them
and i started with i started with
another framework which is the nist
incident response framework because it
had three components of what i thought
was important
for us to do instant response but for us
also to do
detection engineering
and that was the identification phase
the detect phase and response phase
and specifically the identification
phase i wanted to do
i looked at asset management
because again this is something that we
overlook a lot and we need to understand
when we're doing a certain response for
a start
but it's also very helpful when you're
doing detection because if you
understand what assets you have
you can basically put your detections in
the right place
so i use the my map primarily as a
reference graph
so it's going to be it's going to build
basically an identification of all the
things that i need
it starts with the base at the base we
have the threat but it starts with three
key domains which is identify asset
management detect and respond
and you can quickly use that graph to
basically identify where your telemetry
goes and what information and what
activities you want to
include in your environment in your
systems
so
fret
is the central pivot point
so for example ransomware
so first i'm going to build on my
identify so i'm going to look at what
assets do i am i concerned with what
information do i have on all those
assets
and then going to look at the text so i
know what i need to detect ransomware
right it could come from a phishing
email it could come from a download so i
know i need to focus on how to detect
phishing and email i also need to detect
maybe process launch
maybe file manipulations so things like
that so i know there's probably maybe a
callback because there's a rat in there
somewhere
so all these things are going to
determine what i need to detect
response is what i need to have to be
able to respond it's not the actual
actions of responses
i know what my actions are right i'm
going to
look at the data i'm going to start kill
processes i'm probably potentially going
to contain certain machines and things
like that but i need to understand what
will give me that telemetry to be able
to execute those actions what functions
do i need to be able to execute those
actions
so start to build it up
so on the identify
i start looking at the endpoints i start
looking at network i start looking at
the user accounts people
on the detect i
can look at a little bit of the types of
tools that i want i can look at the
telemetry that i want on the response
i'm going to look at the types tools
that i need for response i'm going to
look at the types of mitigations and
mediations that i want to put into play
and i'm going to look at the analysis
that i need to have to be able to do
those mitigations and remediations but
also to be able to report to be able to
identify to be able to do forensics work
then i'm going to go deeper so end
points hopefully i have a cmdb
hopefully
how many of you guys have got a real
cmdb in your environments
hands up
a few you're lucky are you sure it's
right
i'm looking for network and look at my
ip assignments if you have a really big
network if you're working in the cloud
and you have multiple cloud accounts
you're going to have a crap load of
networks
and they
hopefully are not overlapped but
if you've got a good network engineers
it won't be overlapped but sometimes you
know
for the detection i'm going to start
with the tool so i'm going to look at
the types of tools that i want not the
actual tool so i'm not going to identify
a specific vendor tool i'm going to look
at the type of tool so for example i
want maybe something like an edr
right i want something maybe like a
uh
network
detection
i want maybe something like pcap
detection
telemetry i'm going to look at the
endpoint what endpoints limit you do i
need process execution file
manipulations
dll registry
that kind of stuff
temperature on the network i'm going to
look at
callbacks ips ports
potentially if it's clear text some data
from that clear text
on the response side on that analysis
i'm actually going to be able to if i do
it right i'm going to be able to pull
the the data that i'm putting up in the
telemetry a lot of it's going to map
back into my event data
so i'm building that link between the
detection and then my analysis
then i can use correlation to get
additional data to improve my my
understanding of the data that i'm
seeing to improve my visibility then i'm
going to specify the actions that i'm
going to put under mitigation
remediation
and then i'm going to specify the tools
types
so we keep going down keep going down so
i'm going to have data points i'm going
to have data points are linked to tools
and data points are linked between
phases
and we keep going
and you get to this
so this is this will be inside in the
pdf so you'll be able to zoom in
but
it's a big mess right
yeah because you need a lot of things to
do your detection you need of other
things to do
your your
your mitigations and your remediations
so if i look if we can zoom in a little
bit
[Music]
we can zoom in a little bit thank you
so this is like for example what we're
looking at for process info so the
context i.e username command line
arguments maybe the modules that it's
loading name the reg registry
modifications the path the id the start
time
we can pull fire hashes is it a parent
or a child of or both
the network connections so i'm
basically looking at these data points
these are the data points that i want to
use to be able to build my detections
and similarly for
when i'm looking during my response the
event data
so i'm going to look for is this on a
corporate network or you know nowadays
half of my maybe more than half of our
users are off network right they're
vpn into the corporate environment
because they're working from home
they're still working from home
so is it on a corporate network if it's
not how do i handle that networking
first source port destination port then
i can add dns information maybe i can
add
you know dns the time the time the
ttl of that dns name things like that
uh on the ttps i can start to look at
do i have community shared information
about some of the some of the detections
that i've detection data points that i
have
things like that so this is going to
this builds up
so
what do i do with this well it's nice to
have a graphic right
but at the end of the day how am i going
to use this graphic well
i'm going to build a requirements
i.e a reference manual
so this is going to be a list everything
that i just documented in my diagram and
i'm going to put it out into a list
it's going to immature all the data
points that i need
for that specific risk
it'll help identify which data points
have a different stage helps to map my
requirements to identifying and
selecting the tools
provides the requirements when building
a solution or element of the solution so
i'm essentially building a requirements
document from the ground up provides a
method to establish a gap analysis and
this is where this was the important
part that i wanted to focus on is the
gap analysis i have a bunch of tools
already i have a bunch of stuff that's
working what is actually missing what do
i need to add to make my environment
better more secure
as much as i can be
so
i went cheap i basically use this uh
spreadsheet google sheet
so you see
i determined that there's a provided by
and used by column so provided by would
be
what element of my environment
environment provides this information
used by is what is
who uses this data point you fill in the
columns based on the availability and
use of the data points and you from your
diagram blank gaps are where you need to
address your problems so provided us
tells us where the information comes
from can be multiple sources you could
have carbon black you can have av you
can have a whole bunch of other sources
that are providing you that telemetry
you populate with the source tools and
apps that provide that data and the data
you know we can look at it from multiple
ways
the use by tells us who is actually
using this data so for example it could
be a detection could be a detection my
edr could be a detection in my sim could
be a it could be used part of my
incident ticket but i put into my
service now incident ticket or it could
be used by the sword to be able to do
to do enrichment
and then so this is kind of see how we
got some start to get some examples so
here i've put in so this is the process
info i put in the you know like we're
using an epp and edi i avoided names um
at the time because i figured
maybe we start with just the concept of
the tool before we start with the actual
tool
so and it starts to build up
and you can see like in this example we
have a few
empty spots here so some of this stuff
isn't being detected some of this stuff
isn't being used
right so
then i can see i can go back and say oh
do we need to actually use this should i
be using this
do i actually need this
what what can i do with it right
and we carry on
down the down the list
so what did this provide well it
provided a good understanding of my own
of the organization's capabilities what
can we do what are we able to detect how
are we able to respond
to that threat
it's helping us make focus making good
decisions on on our tooling right so
we're actually looking at improving our
tooling so we know which direction we
need to go we know we need to do and put
in the backlog to improve our tooling
and
it's a framework to poc a new tool
to be honest
now that i know what i need
i now have that framework to poc i can
start pocking tools and checking off the
boxes
cool
that's it
gives us five minutes for questions
according to the clock
[Applause]
we may be tired for different reasons
but this talk
i didn't feel like i was going to fall
asleep for one second so that's
meant as a compliment you got some
questions out here are some comments
disguised as questions statements you
can argue with me i don't mind i this is
arguments get two this is this is one
this is a this is an opinion that i'm
projecting
i could be wrong
you you guys have your own opinions you
have your own ways of doing things and
i'm happy to discuss and argue argue
with it but not maybe not a full
argument but get contradiction the the
person up there was oh thank you thank
you
uh thanks for the talk i i really enjoy
uh
i don't know figuring out different ways
to do things or i don't know thinking
differently yeah thinking differently um
i'm eric julian from octa uh just a
quick question on
i guess i'm not even sure how to uh
maybe phrase this but so in and come up
with the the threats and the risks in
the in the middle of the um the mind map
how specific do you get with the threats
because in some ways like if it's
you know
i don't know if it's going after a
workstation does it like do i really
care if it's third actor x or threat
actor y
if it's trying to put some malware on
there like or do you just kind of keep
it more generic keep it more generic
i'm not specifically focused on the
actors because if you you know one good
thing with one of the good things about
if you actually go back and look at the
minor mappings and the fret actors
there's so much overlap but you're more
concerned with the actual mechanism of
the fret rather than the actor
right does that make sense so you you're
more focused on the ransomware part or
the remote access tool that they're
putting in you know that they're getting
into your environment because they sent
you a phishing link and your user
downloaded it back at any desk and we
launched it right
yeah cool thanks
so hi chris strosti i work for tufts
medicine out of boston um i wanted to
sort of pick your brain one of the
slides you had up uh was about threat
modeling you said that it's hard to do
which i agree um but i think that it's
one of the
more useful things one of the more
useful exercises maybe other than a
tabletop that we can do
um do you have any ideas about how to
make it easier or why it's so hard
so
why it's so hard my experience has been
that basically
when you talk to developers or the
solutions architects you're talking in
vague concepts for them
right unless you and that's the security
aware
a lot of times it's a vague concept oh
like oh you mean you there's a risk okay
but what does that actually mean
right so um you know there's a really oh
they might get into my data so like this
is my data it's like how they're going
to get into my data kind of thing right
so
visualizing that conceptually
it's sometimes it's hard for developers
to actually do
my
bigger issue is that a lot of this stuff
is very focused on that risk aspect
where you know like oh my date i need to
protect my data from the potential that
somebody's going to get into my data but
and then we say oh we've got mitigations
we can put into play
but we're not we're only at really
identifying the mitigations at least
this is my experience right and
my experience has been mitigations are
identified
but we don't actually go that step
further and say okay what am i going to
need to actually detect and ensure that
my mitigations are working
it kind of stops right
now there's different people that do
threat modeling different ways
this is a generic experience that i've
had of a number of companies now over a
number of years and threat modeling's
evolved
but i still see it as a problem it's
like when i when i look at doing
detection engineering and i go back to
some of the app some of the some of the
app developers and some of the app
owners and things like that and i go so
like you're sending me all these logs
but what do you want me to actually
detect in those logs what's your risk
you know what's the threat that you that
you have against that data or that
application
exactly but the problem is i'm the stock
i'm the i'm doing the detection
engineering but i don't know what the
hell your application does i don't know
what your logs are it's like you need to
explain it to me right
because otherwise it's just a bunch of
data streaming into my sim
and that's where i come back to i need i
kind of want to do this
top down like i suppose you could bottom
up approach or top down approach
whatever whichever way you want to look
at it but i want to understand my
capabilities and then map those
capabilities into something that i'm
protecting against
where i'm protecting against something
and i have capabilities that will help
me protect against them
that sounds like what my uh
my grandpa used to say measure twice and
cut once
um
i'm a big fan of asking what problem
we're trying to solve before we get busy
yeah
and i like that mind mapping approach we
have any more questions i think we have
time for one more but make it
going good
twice let's have a round of applause for
thomas thank you everybody today
[Applause]
so we're going to have about a ten
minute break and then we have our finer
final speaker in this block
and so i look forward to seeing you back
here or not if you want to come grab
some belgian chocolates i'm not packing
them back so come they're right there
you