RSA Conference 2011 Keynote - "Who Are You?" When Security Hinges on Identity - Francis deSouza

Good afternoon, and thank you all for joining us this afternoon. We have a terrific panel lined up to discuss the topic, "Who are you? When security hinges on identity." Now, as we go through this panel, there are gonna be lots of questions that go through your mind. Questions like, "Are these guys gonna use this panel to sell some of their products?" No, not really. Two, "Will I learn anything useful?" Well, we hope you will. 3, maybe, "Have these guys ever done this before?" Rest assured, we have. But one question that probably won't go through your mind is, "Is this really Francis D'Souza?" And the reason that won't go through your mind is because you'll have a lot of cues around my identity. You'll have the advantage of seeing me up on the stage. You'll see me interact with the other panel members, all trusted third parties who appear to know me. And you'll see a big slide behind that has my name on it. And so all those give you the necessary visual cues for you to establish my identity to your satisfaction for this situation. Now, if only it was this easy online. But the reality is it isn't. There are a number of reasons, in fact, why it's getting even harder than it ever has been to establish identity online. Firstly, more and more enterprises are moving their applications and their identity stores to the cloud. Secondly, employees and consumers are using their mobile devices increasingly to access enterprise applications. Thirdly, it's getting more important for, for enterprises to actually share information outside their boundaries with their partners and their customers, because that's the way we do business today. Today. Given those dynamics, it's, it's even more important today than it ever has been for us to make sure that we know that the people who are accessing our information are who they say they are. Think about some of the high-profile breaches that have happened. The Stuxnet breach, where people were trying to get access to critical infrastructure. The Hydra attacks from a year ago, where people were taking control of Gmail accounts. The hacks on Facebook, WikiLeaks, and most recently the HBGary incident. The reality is that today it is more important than ever for us to do everything we can to make sure we know who is accessing our enterprise applications and our data. We're fortunate today then to have with us four experts who really understand the importance of online identities in terms of providing security. Together we'll talk to them about some of the best practices that they have seen around technologies, around policies, and around processes to make sure you can verify the identities of people accessing your store. They'll also talk to us about some of the industry trends that are happening out there around the creation, for example, of online identity ecosystems. Now, as we're going through this panel, I want you to think about some of the challenges you face with identity as you start to work down the path of making sure that only the people you want have access to your information. So with that, please join me in welcoming on stage the panel. First of all, we have Michael Waters, who is the manager of enterprise information security at Booz Allen Hamilton. Welcome, Michael. Thank you. Next, we have George Tangadurai, who is the general manager of the PC Client Services Group at Intel. Welcome, George.

Thank you.

And then we have Jonathan Penn, vice president from Forrester. Welcome, Jonathan. And then Michael Barrett, the chief information security officer from PayPal. So Michael, I thought we'd start with you. Uh, Booz Allen is obviously one of the leading federal system integrators in the world. Uh, it's critical for you that you are able to collaborate, uh, with your ecosystem, with your customers, with your ecosystem of partners. Uh, what do you do in terms of, uh, strong authentication and using technologies like PKI to make sure that you securely enable that collaboration?

PKI is what we rely on. We started implementing upgrade to our PKI environment a couple of years ago, and we looked for a standard that would enable our government clients to trust our identification. And the federal government was developing a standard at the time called PIV Interoperable, which is what we pursued. And with the help of Symantec, we started issuing PIV Interoperable identity cards a few months ago. There was a press release from Symantec this morning, many of you may have seen, I talked about them being certified as the first issuers of PIV interoperable. What that gives us is trust between our identity cards through the federal bridge so that our federal government clients can trust our identities, whether that's signing emails or encrypting emails, but also eventually to give us access to government websites using our internal identity cards rather than having to get separate government identity card to access those sites. Because we can prove that we are who we claim we are because of the strict standards that have been applied to issuing these PIV I cards. So our PKI is a step above and is trusted by the federal government through this federal bridge.

So easier for your employees to use and yet providing a whole different level of security.

Dramatically easier. Way more secure than a user ID and password. In fact, at Booz Allen, we don't use passwords. We use passphrases, which have to be at least 15 characters long. You can imagine how much our staff love those.

You're a popular guy.

Yes.

But with our PIV-I cards, it's two-factor authentication, the card and a 6-digit PIN. So it's a lot easier for the users and more secure. So the user adoption rate has been great. We have over 5,000 issued to date. And we're rolling very fast on getting them deployed.

It's very exciting. Now, George, you've had some news. You recently just announced actually a new password technology, a new one-time password technology. Can you comment on that and sort of your plans in that space?

Yes, Francis. It was exciting news, last announcement last week where together with Symantec, we, you know, We announced the integration of Intel's identity protection technology, also called embedded OTP, into Symantec's VeriSign Identity Protection Service, also called VIP. What we are trying to do is trying to make sure that any software solution, in this case, a multi-factor authentication, it has tie into the hardware because we feel the robustness of the solution actually is much higher in that case. So what the embedded OTP allows is have partners like Symantec access the secure portion of our chipset where the OTP credentials reside, where the one-time password can be generated and retrieved. What we are trying to do in this— with this is trying to make this ubiquitous. One of the problems we see with authentication solutions is what is the ease of use? right?

Absolutely.

Because, you know, we don't want people to be carrying hardware tokens or fobs or this card, smart cards. Instead, if you can make this as a baseline embedded capability of— think of your token embedded in the hardware. In this case, we are starting with PCs because PCs are today, you know, we have hundreds of billions of PCs, new PCs coming every year and connecting to the internet. How do you make this as a baseline capability? Capability where partners who provide authentication services like the VIP service can integrate this capability and are able to bring this much more easily, much more cost-effectively, and provide a consistent experience to the ecosystem. So that was the philosophy behind it. We are actually, you know, proud in a way to have Symantec as the lead partner to understand the value of it. And we integrated this into the service. And hopefully as we go forward, we'll find enterprises and more website properties, you know, now get over the barrier of, you know, deploying the multi-factor authentication in a much more ubiquitous fashion, either for enterprise access or for VPN access or for SaaS application access or even to provide more secure account access to the users.

That's very exciting. I know that we at Symantec are really fired up about it. I know that it's also part of the same theme we talked about, Michael, which is, you know, there's a real opportunity here with this relationship around our one-time password, our VIP technology, again, to provide dramatically better security for consumers, but do it in a way that's much easier than even what they do today. So it's very exciting. Now, George, I have to ask you, Intel's been very public about the fact that security is the third pillar of the corporate strategy, right behind connected computing, energy-efficient computing, and in fact, the rumor is you've even done some acquisitions in the security space. So I'd love for you to comment, what does this mean for Intel, especially around your strategy around the private and public cloud adoption?

So, you know, Intel, historically has been, you know, as part of drive being the building block supplier for the internet, trying to, you know, now as we move to the cloud model, the focus was on energy-efficient performance. Obviously, performance is what drives the experience at the end of the day to the user. The second one was how to make connectivity, you know, simple and easy to use. Those are the two things we focused on. We— those part of what we call our pillars, and we really brought it to bear. You know, we take it for granted now. Obviously, as we— as this evolves and as we talk more and more about the cloud, clearly security has become a big focus area for us. We think it's a pillar. We think we need to address it. And as Intel's unique portion of, you know, shipping hundreds of millions of platforms, starting with PCs but going to other form factor platforms as well, how do we make sure that the security building blocks are embedded in the hardware that our security partners can take advantage of it and deliver solutions? A good example is authentication, the one-time password we just talked about. But not only that, it's beyond, you know, data protection, asset protection. So— and consistent with that was, of course, our acquisition of McAfee. So, but regardless, we will continue to partner with our security partners like Symantec, which is a multifaceted relationship on the security space, the management space. But clearly from a cloud point of view, what we want to make sure is from the clients, we have— provide security capabilities that are what I call client-aware but enable cloud services like the VIP service, like the anti-theft service. That we are also collaborating with Symantec. And at the backend, at the server level, how do you provide— make sure there's a root of trust with the trusted execution environment with TXTs. So basically, both from a cloud point of view, you want to make sure the clients are addressing security, and from a backend point of view, we have the building blocks there as well so that the root of trust is there both at the endpoint level as well as the server level. So that is how we are focused on with respect to security.

Well, George, I can honestly say from Symantec's perspective that, you know, we are excited to see security as one of your pillars. We know that we have a relationship that goes back, you know, over a decade. And given the announcements we've made recently with you around anti-theft, around the VIP technology, it's clear that there are a lot of areas where, you know, having security as a focus area for you will be good for us and great for our customers. I can't say we're excited about all your acquisitions, but I think in general, I think it's goodness for everybody.

We are proud of the partnership, and I really look forward to bringing a lot of security solutions, working, partnering with Symantec.

That's great.

It's been exciting.

Now, Jonathan, you've actually published a really interesting study recently around enhancing authentication to secure the open enterprise. Some really interesting stuff in there. You want to share with us some some of the key findings?

[Speaker:ENRIQUE SALEM] Yeah, so we set out to really understand about some of these big technology trends and changes that are happening. Cloud, Web 2.0, SaaS, mobility, consumerization, a lot of the key themes that people are hearing about today because it represents a tremendous challenge for security. And what we're seeing is that adoption is certainly taking place at a rapid pace. So take SaaS, for example. 20% of the organizations that we surveyed, and these are enterprises, have 6 or more SaaS applications, and that number is going to grow to 30% within 12 months, okay? So tremendous rise in that. Web 2.0, too, unstoppable trend. Mobility as well, right? iPhones, iPads, Android phones, I mean, the floodgates are open for that, right?

There's no control.

Stop for a minute. You said, what's the SaaS statistic you said?

Yeah, 20% have 6 or more SaaS applications today.

I'm actually surprised that it's that low. I think it's underreported. I remember I was watching one of the keynotes a couple of days ago, and one of the speakers said they did an audit, fairly medium-sized company. They were surprised to hear they had 15 SaaS applications. I'm willing to bet a dollar that they have over 100. And they found 15. I mean, if you start to look, they're way more pervasive.

Right, right, absolutely. So, so take, uh, uh, Web 2.0. I, I did another survey, uh, not too long ago where we looked at, at Facebook, right? So I surveyed Fortune 100 companies, right? They should have a good sense of what's going on in their organization, right? I'd hope so. More than 50% said that they don't allow Facebook. Use of Facebook.

More than 50% of Fortune 100 think they have no Facebook users from work.

That they don't allow Facebook at work.

How many of you, put your hands up if you believe that's true. One person over there does believe it's true.

That guy, right. Let me give you another statistic. More than 50% of them have official Facebook pages.

They have an official page even.

Right.

But they're saying we don't let people use it.

So for those mathematicians in the audience there, right? —something's going on. And this is a great example. You know, the lack of visibility into what's happening with the use of technology. IT and IT security just doesn't know what's going on. It's so easy to bypass them, either just, you know, go online and start using a service, use your credit card to requisition some computer storage resources and get around IT procurement processes, right? And if security doesn't doesn't help to enable that, safely enable that, then they're going to become irrelevant and they're not going to know what's going on.

I'd like to add present company excepted. I do have— we do allow Facebook, but we do have a web proxy, so I know we have Facebook. And in the event of a threat, we can turn off access to certain things. But you're absolutely right. If security does not enable the business, Users will find a way around it. So that's been a key driver in what we try to do. We try to make security something that people will buy into. Because if they don't, they'll find a way around it.

Right. You've got to work with them. And for those companies that don't block, or don't allow Facebook, and maybe they're effective at blocking it, you walk around their cubicles and everybody's going to be on their phones, right?

Right. On that point, can you talk to us about some of the challenges around identity, especially when it comes to mobile access?

Yeah, so mobility probably represents more than anything a lot of all these trends put together. People coming inside and outside the organization, people using devices that IT doesn't procure or manage. And so with that, it's just, again, this issue of visibility into what people are doing, control into what people are doing. So traditional notions that have been the foundation of our security strategies, right? Inside versus outside, trusted versus untrusted, especially with these low and slow APTs, right? These break down, they become obsolete. We have to totally rethink security. And the approach that we've always looked at is you've gotta start with authentication. If you don't know who people are when they're coming in, then you can't really, make any kind of security decisions. Mm-hmm. And so we see, in fact, that where people have been adopting strong authentication very selectively, right, for remote access, for example. Yep. Right? They're now recognizing that the same level of risks exist for employees accessing applications even if they're sitting in the corporate network. But the fact is that they're gonna be outside a lot, and they're gonna be accessing those applications that are outside the network. You've got partners that are coming into your internal applications that you've opened up. You've got communications with customers now. So everybody's outside, everybody's untrusted, right? So you start with authentication. We see that where it's been adopted selectively in the past, there's— is growing use of it both enterprise-wide as well as with these other communities, your partners, your customers. And a lot of it has to do with the innovations in the technologies that traditionally people haven't adopted it because of the cost and inconvenience, right? And, you know, but what we're seeing, you mentioned 15-character passwords and things like that, right? Passphrase. Passphrase, right. That it can be a benefit to users as well as getting rid of that IT help desk burden and no longer alienating security from the business by adopting strong authentication. And so innovations like strong authentication as a service or risk-based authentication, which is very transparent to users, are bringing this to the fore as well. Great.

Well, Michael, you have, as the chief information security officer at PayPal, you have a lot of dynamics that probably make your job one of the most interesting in the world. You deal with money, so it's hugely important IP. You have a lot of innovation going on within your company. You have a technical employee base, thousands of whom probably tell you how to do your job every day because they think they can do it better than anybody. And the price of being wrong is very high. So maybe I'll start with asking you, do you allow your employees to use mobile devices like the iPhones and the iPads? And if you do, how do you think about security?

[SPEAKING ENGLISH] [Speaker:ERIC SCHMIDT] So there's a rather short answer to that question. But before I give you that, I'll let me give you some sort of philosophical background. I guess I got my first scars in this general area in the late '90s when we started playing with Enterprise SSO. And we all thought, "Oh, that's just authentication. So this is really easy." And a couple of years later and a whole bunch of money and pain later, we discovered that wasn't true. And then when we sort of rolled into the early 2000s, identity and federation and so on started to become terms that everybody was thinking about. And Phil Becker, who ran Digital ID World at that time, had this saying, identity is center. And he was trying to suggest that identity was actually what security really rested on. And I remember having various discussions with him about that, and I don't think I ever quite bought it. But he's right in some sense, which is When you get to answer that question of, well, which devices do I let on my network and where, you have to worry about, did I provision this device or not? What state is it in? And those two questions, by the way, there's an implicit device identity in there. Who's the person behind it? And it's some sort of factor of all of those three that ideally you'd really want to use in making a decision about where you let it in. As well, and you alluded to this earlier, in our culture, although in many ways we're regulated as a financial services company, we're based in Silicon Valley. Our sister organization is eBay, and you know, they're a fully e-commerce outfit. And so culturally, we're of that milieu. And so in many financial services companies, they can just say no. In many ways, I don't have that luxury. [Speaker:ENRIQUE SALEM] So the short answer is, it depends. But actually, it depends on the circumstances. So we'll let pretty much most devices on our guest network. And that gets you out to the internet. And you can't actually get into our corporate network from there. We'll put our issued devices, under some circumstances, onto our primary corporate network. And then our call centers, to the earlier question about Facebook, that's a much more locked-down environment. So in there, they're not even allowed to have mobile devices at their desks. And if you try that, you can get fired, because it's a much more restrictive environment. So in that environment, going back to Facebook, we don't let them access Facebook at their desks. There are terminals out in, shared PCs out in the break areas that can absolutely get to it. But they're on a different network segment. It's a very segmented—

Exactly. You're acknowledging that people are going to use these things, but you're segmenting where they can use it.

Because you have to from a safety perspective. If you just say no, as we said earlier, they will find a way around it, and you're just in denial if you think that's not going to happen.

So let's shift a little bit. That's looking at the internal employees, internal network. Let's talk a little bit about how you think about account takeover or some of the other types of online fraud. And at a very broad level, how are you thinking about addressing those issues? And what do you think are some of the more interesting techniques around that?

[Speaker:ERIC SCHMIDT] So it's funny, because I was on a panel on this, on a fairly closely related topic to this yesterday, on authentication. And the problem with authentication, I think, is as an industry, we have a dreadful habit of thinking of it as a binary thing. You're either authenticated or you're not. Well, okay, so at some point you have to get to a decision where you say, am I going to allow this action to take place or not? But I think it's actually way more subtle than that. I mean, the first question is, do you actually know who you in fact associated with the account? So there's a real identity. I mean, I'm Michael Barrett, and then there might be some account out there that is an electronic representation in some sense. It's a me. And hopefully it's me that created that account, and it's me that created that association. So that's the first barrier, is am I, am I who I say I am when I create the account? And in financial services world, that's all know your customer and blah blah blah, and there's a bunch of regulation around it. But it's actually a really important principle that should apply to any business that's got customers, and as I recall, most businesses do. And then the next question is, uh, how do you then authenticate them? And, uh, we very much fall into the risk-based authentication category, uh, where there are some circumstances where we do not force our customers to log on at all. Small transactions, devices we know, contexts we know, and so on. Uh, and then there are other, other situations where, um, it isn't just user ID and password. We'll kind of do other probing kinds of questions under some circumstances. We also have a hardware-based two-factor authentication program that we let our customers use. We don't force them to use it. We let them use it if they wish to, because that's the other piece of it. We believe philosophically that customers should actually have some control over how much risk they want to take and how much pain they want to go through from an authentication perspective.

[Speaker:ERIC SCHMIDT] Makes a lot of sense. All right, so now I'm going to sort of switch gears completely and throw this question out there. So look, there are a number of countries around the world that have successfully adopted national IDs, but we haven't really gotten anywhere with that in the US. Why do you think that is?

I think there's huge cultural barriers to it. The United States, wonderful country, but I think in general the population is a little leery of national identity card concept, that much trust in the federal government is a bit lacking, as opposed to some of our European friends who are more trusting of their governments. Germany, I know, is rolling out a national identity card with strong two-factor authentication and a lot of fabulous capabilities for online transactions, which would be wonderful, but I think the I mean, the cultural differences between the way the Germans view government and the way the American citizens view the government control or access to their information is very different.

[SPEAKING GERMAN] [Speaker:ERIC SCHMIDT] We were founded on a distrust of government, right? [Speaker:ERIC SCHMIDT] Right. [Speaker:ERIC SCHMIDT] That's what the Second Amendment is there to support. But yeah, so I think that something that is that is driven and forced by the government is something that isn't going to work. And we, you know, look at Real ID and that kind of experience, and that hasn't worked. But there are cases commercially where there's value, and I think there is, you know, opportunity there, right? So, you know, we look at like CLEAR programs and that kind of thing, right? And George Kurtz was talking about getting his retina scanned at the airport right before this. And so taking your fingerprints, getting background checks, if it's something that would make our lives more convenient or has other value, what's in it for me, in other words, right? Then we're willing to do that.

[Speaker:ENRIQUE SALEM] I think privacy and trust, those two are what users are looking for. And whether they can trust the government, whether my privacy is guaranteed. I fully agree with what was said here. I think at the end of the day, it's ease of use. When people find it easy to use, I think, and they have some kind of confidence in the privacy and security, trust aspects of it, sooner or later, I think, they will adopt it. The cultural barriers might be different. I know in India, they're doing the national ID. It's a project, it's a very big project, trying to have a national ID, unique ID for every citizen, which is more than a billion people. So I think there it's driven by a different objective of making sure benefits reach certain, you know, the people that it's supposed to be, intended to be. So I think sooner or later I think these, the ease of use together with the privacy and trust will drive towards people accepting it in different form or the other and ultimately converging.

[Speaker:GROVE] Got it. So you're saying, look, it's a combination of we have a very low tolerance for inconvenience, and we don't really trust Big Brother. And those two have made this dead in the water.

I think the other comment I'd make, though, is if you look at what's been called at this conference NSTIC, or the National Strategy for Trusted Identities in Cyberspace, the folks in the White House recognize this. And so Jeremy Grant's been here, Andy Osmond's been here, Howard's been here, all talking about that. That whole strategy is not based on about the US government issuing digital identity cards to the entire population. Rather, is it about trying to catalyze the emergence of an ecosystem where government has its role to play in kind of like helping form that, but basically private industry is expected to play its part in issuing digital identities at different levels of strength. I mean, so you can look at like, say, Facebook Connect and say, it's a great identity platform, but in kind of identity terms, it's an assurance level 1 platform. You can't really use it for anything e-commerce-wise. Companies like ours, on the other hand, are clearly out more in the level 2 space. And so there's kind of, you know, the expectation is that that ecosystem is going to start to develop. The trick here is this, and I think this is actually the real core of the identity problem. Whenever internally in the company we talked about the sort of opportunities that identity represented, we always had a discussion that kind of went along these lines. There's going to be this rich ecosystem of identity-enabled services, and it's going to be absolutely wonderful. Um, and then you'd say, okay, well, why would, why would businesses go out and develop all these identity-enabled products and services? Because there's no consumers out there that are enabled. And then you say, and there's going to be there's gonna be all these consumers because there's this, and it's circular. And so, I mean, what it essentially is, it is a network bootstrapping problem. And if you look back historically, there are very few times when new networks get bootstrapped. I mean, so PayPal's owning company eBay is a network. Facebook is a network, but there's relatively small numbers of them commercially. And each one there were some very special circumstances that caused it to kind of self-bootstrap. And that's the trick with this. When you talk about consumer identity is how you cross that chasm. I mean, what—

any other thoughts on what would it take to have NSTIC take off?

I think that one of the things, and I think Michael explained the issues and the approach very well, is one of the roles for government I think would be around liability and insurance and that kind of legal framework, because that's a big issue, right? And certainly there's the incentive issue, but let's let the commercial sector work that out, right? But underneath it all is why would somebody trust this identity, right, for a person who's going to a service? And that's where we really need some help.

Any other thoughts on that? So this is going to be sort of a lightning round, but look, there's a lot going on in the identity space, right? I mean, it's a space that's rich in innovation, goes in a whole set of different directions. I'd love to hear from each of you, what do you think are the most exciting innovations or technologies in the identity space right now?

I think the consumerization of IT is happening, right? I mean, at least from the place I work, I think it's true for many others, right? We used only the piece, the employee-issued PCs were used to access. Now, I can use my iPhone or my BlackBerry, I can use my iPad, right, to access my corporate network. So I think what I think is both a trend and I think is an exciting opportunity is how do we have this consistent security building blocks which relate to authentication that address, you know, the security issues, you know, who is— who who I am or who am I, who I am, and that's the kind of trust relationships in a consistent fashion that as it's enterprise or website properties can really look at, you know, I have solutions, it is tied to the hardware, it is consistent, it's cost-effective, I can scale it, it's ubiquitous. I think that is an exciting opportunity I see that is being driven by the consumerization of IT, and that's where as transformation of IT takes place, I think the authentication is going to become more and more important, because you're going to have different types of devices, different form factors, all coming to access either for good reasons or bad reasons.

I'd argue it's actually the consumer problem. So, and what I mean by that is this. So when I was running the Liberty Alliance back in 2002, I remember talking to consumers back then and saying, "How many internet identities do you have?" And, well, at first they'd say, "What's an internet identity?" And you'd say, "It's a user ID and password." They'd say, "Oh, I don't know, maybe 5 or 6. Why do you ask?" Whereas now, there is a sense of outrage. I mean, I was talking to somebody yesterday who said his 80-year-old grandmother was complaining that she had more than 30 IDs and passwords and couldn't remember them all. So, I mean, that problem is— absolutely out of control in the consumer space. And there is no question that they compromise their security by, in way too many cases, picking the same password that they use absolutely everywhere. And to go back to the account takeover question that you asked earlier, that's one of the root causes. So I think part of the answer here is going to be substantial easing of consumer pain around operating on the internet, as well as if we do this right, I think we can make a big big dent in the way in which bad guys victimize consumers.

[Speaker:ERIK SCHMIDT] I think that pain gets exacerbated when we start to talk about multiple devices. It's not just mobility. I'm now mobile. I'm not replacing my PC with an iPad or a phone. I've got all these things. And as far as consumer identity and that is concerned, we're where we were 15 years ago with enterprise identity, with enterprise single sign-on, which was just a kludge. I thought it was a very effective kludge and a wonderful kludge, and there were a lot of cost savings. But just basically storing passwords, right? So we see with like RoboForm and LastPass and those kinds of guys that they're helping people manage not just all the identities I have, but all the identities I have across all the devices that I use. We need— we definitely need something that's a service that goes beyond the passwords, right, and beyond that kind of pain, because they are vulnerable, to something that's a more trusted and trustworthy type of credential.

I think ease of use is basically, you know, if I can get rid of my username and passwords, I fully agree. I also forget my passwords, my username sometimes, they're all different. If you can get rid of username and passwords, ideally it's ease of use and have a robust identity protection or authentication end-to-end. That's what we want to do.

Well, with that note of optimism, I want to say Michael, George, Jonathan, Michael, I know with your experiences. We could spend a whole lot more time talking about this space, but we're going to wrap it up. And I want to say thank you so much, and, and thank all of you for spending the time with us here today. I hope you enjoyed it. I hope you found something that you could take away with you. So thank you very much.