Download - First 90 days State Cybersecurity Update
![Page 1: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/1.jpg)
First 90 days March 30, 2015
State Cybersecurity Update Reducing Risk with the DoIT Risk
Assessment Framework SIAAB Fall Conference
October 26, 2016
State of Illinois © 2015 Confidential : For discussion only
![Page 2: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/2.jpg)
Kirk Lonbom Chief Information Security Officer State of Illinois Responsible for information and cyber security for entities
operating under the Governor 64 Agencies, Boards and Commissions 50,000 state employees Compliance areas including FISMA, HIPAA, PCI, CJIS, more
![Page 3: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/3.jpg)
3
![Page 4: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/4.jpg)
4
![Page 5: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/5.jpg)
5
![Page 6: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/6.jpg)
6
![Page 7: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/7.jpg)
7
![Page 8: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/8.jpg)
8
![Page 9: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/9.jpg)
The State of Illinois is under constant attack
Attacks against states are rising Attacks are increasing in
intensity
Various levels of security practices across state agencies
Working to better protect the state from the threat
![Page 10: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/10.jpg)
Critical life, health and safety systems must be available Public Safety Crucial Services to Citizens
The State holds billions of confidential records PII PHI Intelligence Other Confidential
Information integrity must be
maintained We must be able to withstand
and recover.
![Page 11: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/11.jpg)
![Page 12: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/12.jpg)
![Page 13: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/13.jpg)
![Page 14: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/14.jpg)
RISK ACCEPTANCE IS A BUSINESS
DECISION TO BE MADE AT THE
EXECUTIVE LEVEL (NOT BY I.T.)
![Page 15: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/15.jpg)
State Business Risk Life, Health and Safety Delivering Services to our
Citizens Delivering Services to our
Employees
![Page 16: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/16.jpg)
Financial Risk Lost Revenue Breach Costs Fraud and Theft
State Business Risk Life, Health and Safety Delivering Services to our
Citizens Delivering Services to our
Employees
![Page 17: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/17.jpg)
Financial Risk Lost Revenue Breach Costs Fraud and Theft
Privacy & Confidentiality Risk Personal Information –
Identify Theft Confidential Information
State Business Risk Life, Health and Safety Delivering Services to our
Citizens Delivering Services to our
Employees
![Page 18: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/18.jpg)
Reputational/Political Risk Elected Officials Agency Directors Program Managers
Financial Risk Lost Revenue Breach Costs Fraud and Theft
Privacy & Confidentiality Risk Personal Information –
Identify Theft Confidential Information
State Business Risk Life, Health and Safety Delivering Services to our
Citizens Delivering Services to our
Employees
![Page 19: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/19.jpg)
Information Security Protect information from
unauthorized disclosure Ensure information is
trustworthy Guarantee reliable access to
mission critical information
Cyber-Resiliency Ability to anticipate,
withstand and recover from adverse cyber-events.
Evolve and improve in pace
with the ever-changing cyber landscape.
![Page 20: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/20.jpg)
![Page 21: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/21.jpg)
Data Breach Causes, Malicious or
Criminal Attack, 50%
Data Breach Causes, Negligent
Employees, 23%
Data Breach Causes, System Problems -
Both IT and Business Process
Failures, 27%
Data Breach Causes
![Page 22: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/22.jpg)
![Page 23: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/23.jpg)
![Page 24: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/24.jpg)
$ 86
![Page 25: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/25.jpg)
$ 86 (what’s in YOUR database?)
![Page 26: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/26.jpg)
Daily Phishing, Brute Force, Calls, SQLi Ransomware DDos Attacks – States and Law Enforcement Insider Concerns
Indications of Increased Nation State Activity
![Page 27: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/27.jpg)
27
![Page 28: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/28.jpg)
28
![Page 29: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/29.jpg)
• The longer it takes to detect, the more it costs.
• 70% of attackers move from the initial victim to a secondary target within 24 hours.
• An attacker is in your environment for over 200 days before detection
• Victims MUST report incidents quickly!
![Page 30: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/30.jpg)
$0
$50
$100
$150
$200
$250
Cos
t
Mitigating Breach Cost
Cost
![Page 31: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/31.jpg)
We DO know what we DO know! (known software vulnerabilities)
Phishing is still the biggest sport (it’s easy)
63% of breaches involved weak, default or stolen passwords (we just don’t get it – Multi-factor!)
Social Unrest = Increased Attacks
Web Applications have weaknesses (many easy to fix – just find them!)
We all make mistakes. (human errors cost us)
![Page 32: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/32.jpg)
32
• Governor Rauner has prioritized cybersecurity as a priority issue
• Spoke of the ongoing cyber threat that faces the State
• Referenced recent breach at a State of Illinois agency
• Has charged DoIT with oversight and direction of cybersecurity matters for all agencies under the Governor
• Requested support from the Directors in completing comprehensive cybersecurity assessments across all agencies
![Page 33: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/33.jpg)
THE PROCESS
![Page 34: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/34.jpg)
Assessment Planning •Primary Contacts •Communications Plan •High Level Schedule •Data Request Management
![Page 35: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/35.jpg)
Assessment Planning •Primary Contacts •Communications Plan •High Level Schedule •Data Request Management
Assessment Discovery • Information Gathering •Policy Review •Security Roles Identification
![Page 36: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/36.jpg)
Assessment Planning
•Primary Contacts •Communications Plan •High Level Schedule •Data Request
Management
Assessment Discovery
•Information Gathering •Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
![Page 37: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/37.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level
Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment
• ID/Verify Applications and Data
• Identify Cloud Usage
•Security Controls Review
•Risk Rating
![Page 38: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/38.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
•Information Gathering •Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately •Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment
•ID/Verify Applications and Data •Identify Cloud
Usage •Security Controls
Review •Risk Rating
Business Impact
Analyses •Identify Resiliency
Requirements •Identify Incident
Response Requirements •Identify Compliance
Requirements
![Page 39: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/39.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level
Schedule •Data Request
Management
Assessment Discovery
•Information Gathering •Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately •Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment
•ID/Verify Applications and Data •Identify Cloud
Usage •Security Controls
Review •Risk Rating
Business Impact
Analyses •Identify Resiliency
Requirements •Identify Incident
Response Requirements •Identify
Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery •IoT Devices •Remote Access
(employess, contractors, vendors)
![Page 40: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/40.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
![Page 41: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/41.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
Reduced Vulnerabilities
![Page 42: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/42.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
Better Security Controls
Reduced Vulnerabilities
![Page 43: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/43.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
Reduced Risk
Better Security Controls
Reduced Vulnerabilities
![Page 44: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/44.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
Reduced Risk
Better Security Controls
Reduced Vulnerabilities
Disaster Recovery
and Resiliency
Plans
![Page 45: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/45.jpg)
Assessment Planning
•Primary Contacts •Communications
Plan •High Level Schedule •Data Request
Management
Assessment Discovery
• Information Gathering
•Policy Review •Security Roles
Identification
Vulnerability Scanning
•Address High Risks Immediately
•Remediation Plans •Risk Acceptance –
Directors •Commence Initial
Monitoring
Risk Assessment • ID/Verify
Applications and Data
• Identify Cloud Usage •Security Controls
Review •Risk Rating
Business Impact Analyses
• Identify Resiliency Requirements
• Identify Incident Response Requirements
• Identify Compliance Requirements
Infrastructure Identification
and Classification
•Network Device Discovery
• IoT Devices •Remote Access
(employess, contractors, vendors)
Critical Data Protection
• Identify Data Sharing Agreements
•Classify Data •Apply Security
Protections •Establish Data
Monitoring
Reduced Risk
Better Security Controls
Reduced Vulnerabilities
Disaster Recovery
and Resiliency
Plans
Data and System Protections
![Page 46: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/46.jpg)
Risk Assessment • ID/Verify Applications and
Data • Identify Cloud Usage •Security Controls Review •Risk Rating
![Page 47: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/47.jpg)
![Page 48: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/48.jpg)
![Page 49: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/49.jpg)
49
![Page 50: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/50.jpg)
50
• NIST-based model
• Includes robust Threat Analysis (TARA-based - Mitre)
• Lean implementation to make success more likely
• As automated as possible (Risk Management Workbook) • Roles, Responsibilities and efforts aligned with the
organization –Agencies/clusters
![Page 51: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/51.jpg)
51
Illinois Department of Innovation & Technology Risk Assessment Framework
![Page 52: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/52.jpg)
52
Illinois Department of Innovation & Technology Risk Assessment Framework
![Page 53: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/53.jpg)
53
Illinois Department of Innovation & Technology Risk Assessment Framework
Information Security Component Domains Sub-Domains Governance & Oversight 2 5 Management Processes & Controls 6 43 Culture & People 1 4 Monitoring, Communications and Reporting 1 5
75 Specific Risk Statements (each with multiple guidelines)
![Page 54: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/54.jpg)
54
Illinois Department of Innovation & Technology Risk Assessment Framework
![Page 55: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/55.jpg)
55
Illinois Department of Innovation & Technology Risk Assessment Framework
Score Strength Breadth Rigor
1 Little to no protection Little or no application across the
organization Ad-hoc process; not formally
documented
2 No significant protection Some application in selected
areas across the organization Repeatable process; not formally
documented
3 Meaningful protection with little to no consistency in
enforcement Application in critical areas
across the organization Standard repeatable process;
formally documented
4 Strong protection with consistent in enforcement Application in most areas across
the organization
Managed process with defined metrics driving toward control
objectives
5 Maximum protection and consistent enforcement Application in all possible areas
across the organization Optimized process; continuously improving; automated if possible
![Page 56: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/56.jpg)
56
![Page 57: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/57.jpg)
57
![Page 58: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/58.jpg)
58
Illinois Department of Innovation & Technology Risk Assessment Framework
IR-8 The organization: Develops an incident response plan that: - Provides the organization with a roadmap for implementing its incident response capability; - Describes the structure and organization of the incident response capability; - Provides a high-level approach for how the incident response capability fits into the overall organization; - Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; - Defines reportable incidents; - Provides metrics for measuring the incident response capability within the organization; - Defines the resources and management support needed to effectively maintain and mature an incident response capability; and - Is reviewed and approved by the appropriate authority;
![Page 59: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/59.jpg)
![Page 60: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/60.jpg)
![Page 61: First 90 days State Cybersecurity Update](https://reader033.vdocument.in/reader033/viewer/2022042120/62581325dbae9950da7a6349/html5/thumbnails/61.jpg)
| 61
Thank you!