Lecture 1 PDF

Lecture 1 More. Nice to see you all again. I think we've got some new faces that I haven't seen before, which is great. Okay, make sure that you have used the QR code to register your attendance. I know that some of you that have been on this course for some time will know what to do, the newer one...

Lecture 1 More. Nice to see you all again. I think we've got some new faces that I haven't seen before, which is great. Okay, make sure that you have used the QR code to register your attendance. I know that some of you that have been on this course for some time will know what to do, the newer ones. Then if you can make sure you get your attendance registered because it will count towards your final grade. Okay, perfect. All right. Okay, so today's class is around public private partnerships, that's the module lessons that you're going to be taking this next week or so. We wanted to finish on this from the MasterCard side because we rely very, very heavily on public private partnerships when it comes to cyber security. My background is obviously in cyber threat intelligence and my entire career I have worked through partnerships with other agencies, with other not-for-profits and just with other businesses to be able to catch cyber criminals. Now I'm trying to, I know some of you on this call but there's some faces I don't recognize so it would help me just to remind me what kind of organization that you work for. So can I start in the top of my screen just with Elizabeth. Can you remind me what organization you work for Elizabeth? I work for a security organization in Singapore. Thank you. And Tiam, who do you work for again? I work for a small media enterprise as a director for IT security. Thank you. Alan? Hi, good morning. I actually work for an oil and gas company in Singapore. Great, thank you very much. CY? I work for a small SME for IT kind of support company, SI, system integrator. Perfect, thank you. And Lyn, or Bee Lyn, sorry. Yeah, I work for, can you hear me? Yes. I work for a non-profit by a government agency and I'm in charge of a crowdsource portal and hence this course. Thank you. And Chunlin, or Liu, sorry. Yeah, I'm working for a security and brass consultancy firm. Okay, great. Wei Qi, or sorry, is it Zhang? Morning. Now I'm working in the SME small company as a consultant. It's an infrastructure company, yes. Okay, perfect. Thank you. Nathira, can you remind me who you're working for? Working for a large computer IT company. I'm a DevSecOps working for a security firm. Yeah. Super, thank you. Chris? I'm currently in a healthcare company in the IT side. Great. Sheng? Can you hear me? Yeah, I'm currently in a digital forensic company. Okay, great. Thank you. Harry? Yeah, I work for a utility company as a security testing and risk management. Great, thank you. Tan? Or is it Kui? Sorry, I'm not sure. Thank you. Hi, morning. Currently, I'm not working. Formerly, I'm a security compliance officer doing more of the standard ISO doing 7001, several essential and several trust framework. Super, thank you. Guang? Guangzhi Tan? Yeah, I'm working for a smart city consultancy firm. Thank you. Jimmy? Good morning. I'm working as a president at one of the cyber security firm. Okay, thank you. Esther, I think I know where you are. Hi, I work for the government contractor company in Singapore. Thank you. Eileen? Hi, I work for IT company doing technical support work. Thank you. Dora? We lost Dora? You're on mute, Dora. She did put something in the chat that camera wasn't working. Yeah, camera wasn't working. Yeah, I'll come back to her. Loki? Weijun. Weijun? I'm from one of the government agencies from Singapore as a project manager. Okay, thank you. And Samuel? I work in the jewelry industry in the management information systems. Okay, great. Thank you. So, the reason I'm asking you all which industry that you're working in is because of the speakers that we're going to have lined up for you for this lesson this coming week. So, we have the Financial Services Information Sharing Analysis Centre or FS-ISAC. We have the Health-ISAC for the healthcare industry. We have the Global Anti-Scam Alliance. We have Interpol. And we have the Singapore Police. And finally, we have Shadowserver. Shadowserver is a not-for-profit that all of you should be working with regardless of the industry that you're in. And I'll come on to talk about them just shortly. So, you've identified oil and gas, healthcare, security, government, all these different types of industry sectors have a need to share information. Mastercard actually work with the Monetary Services Authority in Singapore. We have a memorandum of understanding with them. And we try to share information. Now, I don't know if any of you have been following the press, but has anyone here heard of Recorded Future? Put your hands up if you have. One or two. So, Recorded Future is the largest cyber threat intelligence company in the world. And Mastercard have just purchased them. So, we now own them. And if you're going to work in cyber threat intelligence, they are also a company that you need to be aware of. And you will definitely need to utilize services like Recorded Future's services or Intel 471 or Flashpoint, which are their competitors in any cyber threat intelligence work. Now, what we rely on in Mastercard and in most of the Fortune 500 companies is a mixture of free intelligence and privately purchased vendor intelligence. And what you're going to learn about in this lesson is that free intelligence and the difference that it can make to the protection and mitigation in your organizations. So, I actually created a partnership in Mastercard with FSISAC. So, they are set up to service the financial services industry. So, if tomorrow you leave your organization, you go to work for a bank or a fintech, the chances are you're going to come in contact with FSISAC. And they actually have a base in Singapore. So, they're based in the US and they're based in the UK and they're based in Singapore. So, you're very lucky to actually have them on site. If you go to any of the cyber conferences in the next year or so, you may well see FSISAC talking at these conferences. They're going to go into more detail about what they do, but the way in which Mastercard use them is that they have a sticks and taxi feed, which you would have learned about on your cyber threat intelligence module. And so, we ingest the data into our sim, or into Splunk, and we utilize the indicators of compromise to help protect Mastercard. Now, these indicators of compromise come from all their banking members. They have thousands of members around the world that share data and information about attacks that they see hitting their IDPS or their firewalls. And Mastercard do the same as well. So, we share information into FSISAC, we get information back out. We do the same thing with the HealthISAC as well. So, Mastercard was the first executive sponsor for HealthISAC. We've now been joined by Google. And so, we have a very strong relationship with the Health Information Sharing Analysis Center, which is based in the USA. It's actually based in Florida. And they share information from their health members. So, not all countries around the world have private health care. The UK and a lot of Europe actually has public health care. Singapore, you kind of have a bit of a mix. But all health care companies, whether you're a dentist, a doctor, a hospital, whatever you might be, it's a good idea to join the Health Information Sharing Analysis Center. It works on the same principles as the Financial Services Information Sharing Center. So, you share information in and you take data feeds back out. The good thing is you're getting data from your own sector. So, the bad guys might be targeting other hospitals, other health care providers, health insurance companies, etc. And so, therefore, you may well be next on their list. You just don't know it yet. Singapore Police is obviously going to be very, very important to you guys if something happens in the companies that you're working for. I can't remember. I know that Singapore was moving to something similar to GDPR, whereby it was going to be mandatory. I think it was mandatory anyway under the Monetary Services Authority of Singapore for banks to report. But I'm not sure about other businesses or industries in Singapore. But I imagine there's some kind of mandating in Singapore to report a data breach that occurs to your companies or your organizations. Has anyone here ever worked with any external partners sharing information? Or do you know that your companies do so? Put your hands up if you do. No. So, the most important thing that you can do in cybersecurity is to share information. And I'll come on to the reasons why for that in a second. So, the Singapore Police, you have to know where you go to report incidents that happen to your companies. You're going to learn all about Singapore Police agencies and how they deal with scams. You're also going to learn about Interpol, how Interpol then take the information from the financial services authorities and the healthcare authorities. And they take reports from different agencies, even from the Singapore Police. Because the chances are that the offenders that are targeting your business in Singapore are not going to be based in Singapore. So, you can't report directly to Interpol. You report via the Singapore Police and they report to Interpol. Interpol then coordinate with other police agencies around the world in targeting the cyber campaign. So, when I was in Interpol, we dealt with one of the biggest extortion scams. It was 150,000 victims globally. I've dealt with the United Nations hacks, Sony entertainment hacks as well. So, all the information gets collated by the Singapore Police from all the different businesses that report incidences in Singapore. And then once we can identify the rough geographic location of where we think the offenders are, then that's when Interpol come in and start the coordination with the different police agencies. GASA, so the Global Anti-Scam Alliance. So, Mastercard is also a partner with GASA, as is Amazon and Google and Dell and some of the other big organisations. So, this is all about reporting phishing. So, Facebook is a big partner of theirs as well. So, they see a lot of the scams that occur on Facebook because we know that social media is the number one platform for scamming. Yes, CY. Are we supposed to see slides or you're just... I'm just talking. Okay. Thank you. Just tonight I'm talking. So, for Facebook, they report in a lot of the phishing scams that they see. And that then is shared out into the community. And we actually use some of the phishing scams in our internal tests, phish tests that we do every month with our employees. So, they have got a really good presentation that they've put together for you. So, you'll get access to the PowerPoint recordings after this. Shadow Server. Has anyone heard of Shadow Server? No. No one's heard of Shadow Server. So, Shadow Server are like the unsung heroes of the internet. They're like the ninjas of the internet. They're a not-for-profit that was started by Cisco more than 10 years ago. They're based in the USA and the UK and have a couple of people operating in Europe. Their CEO was actually from Poland. They were set up to find the infrastructure that the bad guys are spinning up. So, if you think of Game Over Zeus or some of the major bots or malware campaigns, Shadow Server will undoubtedly have been behind the data and intelligence that is used to take down or sinkhole a lot of these bots or malware. They're a tiny little team. They have about 15 people and you're going to learn about how they utilise IP addresses and the information that they get from law enforcement. They work very closely with the FBI, Secret Service, UK National Police, Singapore Police actually work with them as well. These are the people that actually offer your company a free scan of your digital infrastructure. So, what you do is you provide them your IP netblocks and the IP addresses that you own. For free, they will scan on a daily basis every single IP address that connects to the internet and they will tell you if your company or organisation is being targeted or what vulnerabilities that your network is operating with that you need to patch or you need to block. So, once you've done their presentation, I really, really recommend that you reach out to Shadow Server. You can go to their website and you can contact them. As I say, it doesn't cost anything and nobody else is given your data. So, only you give authorisation for Shadow Server to scan your IP netblocks. So, they're primarily comprised of a lot of ex-law enforcement or ex-cert people. They give free data and information to about 190 certs around the world as well. Certs like Singapore Cert obviously operate as a government entity but they have thin margins and so therefore they work with all the information sharing authorities around the world. Now, Mastercard actually has a fusion centre that we are standing up in Singapore. We have one in Brussels and we have one in St. Louis, Missouri. We have centres in Vancouver, Canada and we also sit in Interpol in Singapore and we sit in some of the other government agencies in the UK and we share information with these agencies and they share information back with us. We could not do what we do without information sharing and the reason is that the bad guys operate with utter impunity. They don't observe any laws. We have to observe every regulation, every piece of legislation and we tie ourselves in knots globally because of the restrictions that we have on sharing information. Now, Mastercard up until recently did not own any of its data. All the banks that put transactions across our rails owned our data. It's only with the acquisitions that we've made with Recorded Future, with New Data which is used in Singapore, with Risk Recon, with Ethica, with Akata that we've started to own our own data and now we can actually start sharing information. We were never able to do this before but the information that Mastercard shares with our third parties is usually the data that hits our enterprise network because what we find is if it's hitting us, it's hitting Citibank, it's hitting Bank of America, it's hitting UCB. We tend to share that information but now we have commercialised data that we obviously share and our acquisition of Recorded Future is part of that. One thing I'll tell you about as well that we weren't able to let you know about previously is that Recorded Future actually offers a Cyber Threat Intelligence University certification and because it's the largest Cyber Threat Intelligence vendor in the world, the accreditation is a good quality accreditation so it's something that you might want to look into. By Wednesday I would hope that you will have got halfway through the modules or the lesson plans for the public-private partnerships. I'm going to be testing your knowledge on Wednesday night around these cyber partnerships. I am hoping by the end of this course that you will actually be signed up to some of these intelligence feeds through the organisations that you currently operate in, particularly if you are part of a security or a government organisation. It's definitely something that you want to get because I know budgets can be tight when it comes to Cyber Threat Intelligence. Now, is anyone aware of any other information sharing organisation in Singapore that you might already benefit from or that you think you've heard of? Has anyone heard of any organisations that might share data in Singapore? Put your answers in the chat for me. Anyone got any that you've heard of in Singapore? No? So CSA, thank you Raj. Has everyone heard of the CSA in Singapore? Yes? No? Not sure? So the CSA is the Cyber Security Agency of Singapore and they work with the government, they work with the monetary authorities, they work with the other regulators, your telco regulators as well, and they actually share information. Singapore CERT, good Esther, yep. So they share information between them so that they know exactly who is targeting Singapore, Singapore businesses and Singapore organisations. Has anyone heard of the Singapore CERT? A couple of you noting? Yes. Good. So has anyone had any dealings with the Singapore CERT? Has anyone had any cause to talk to the Singapore CERT? No? So that's someone else that is worth reaching out to. CSA, Singapore CERT are all worth talking to in the organisations that you work with because actually they probably don't have you on a list. So if something happens in your sector or even to your business, it is good for them all to have a contact that they can go to to share information with. Also, it means that you get invited to meetings with other organisations and other companies in person where you can talk about the things that you're seeing, even on an anonymised basis, and share information. Cyber security does not work well in a silo. If your organisation is not connected to other agencies or businesses that can help you understand the cyber landscape, then you're essentially fighting the cyber fight alone. And that's not a place that you want to be in cyber security. And it's something that they do really well in the USA, because this has been around for a lot longer. Some of the organisations you'll see started in the USA, like FS ISAC, Health ISAC, etc. And the reason that they did is because they were probably one of the first to be targeted. And most of the major government organisations and private organisations like Google X, Facebook, etc., or Meta, are now, you know, are all based in USA, but they may have branches in Singapore. So they learn the hard way about why you need to share information. Now, we had a case whereby we had a government agency come to us telling us that they were seeing a number of IP addresses that were hitting their perimeters and their customers in a particular country. They actually thought the offenders were coming out of Mexico, but it actually turned out they were coming out of Ecuador. And so it was only by sharing the information in the community and with us that we were able to tell them that they were actually on the wrong track of where they thought the offenders might be. And this is important as well, because oftentimes when you are attacked, when your business is attacked, these bad guys, this is not the first time that they're hitting your perimeter. And if you can get information to identify the IP addresses that they're perhaps coming in on or have used in the past, you can do a post-mortem on your logs to check and see whether you've seen any of those IP addresses before. And that might actually tell you the earliest date they have actually penetrated your network or been pinging or testing your network. This is not information that you're necessarily going to get on your own. It's information that you're going to get from the ecosystem within which you operate. So we do this a lot. We speak at FSISAC conferences. We have FSISAC to talk at our conferences, the same with Shadow Server, Interpol, the Singapore Police and GASA. Rajesh is able to tell you, we've just had a conference in Singapore. You want to talk a little bit about the SCAM conference, Rajesh? Yeah, actually I can do it in my slides a little bit. I have it. Oh, okay. Perfect. Okay. So Rajesh is my colleague from Singapore. He is the one that has helped put this together with us. And so I want to, he's worked in the government sector before, but I'm going to get him to introduce himself properly. And he has some information that he's going to share with you around the public-private partnerships and government organisations that Mastercard and Rajesh has worked with previously. Take it away, Rajesh. Okay, cool. I'm just sharing my screen. Let me know once you can see it. It's black. Oh, there we go. It's come up. If you just go into slide mode. Yeah. Okay. Is it better now? Perfect. Yes. Yep. Thanks. Thanks again, Rebecca. I mean, firstly, I think this is the last module, if I'm not wrong, for the whole cohort, for those of you who have stayed throughout the program. So big congratulations. And it's a big milestone for Rebecca and myself as well, because we were the ones actually putting the class together this time last year. So it's nice to see the first cohort coming out. So thanks again for being part of this journey. So as Rebecca mentioned, so I'm based in Singapore, although I'm dialling in from Sarawak right now. But yeah, I spent most of my career in the Singapore public service. And in the last few years in the private sector, I've actually focused on doing essentially public private partnerships. And that's the nature of my job, even in Mastercard. And I work in the same group as Rebecca, essentially the cyber intelligence group, where we look at all things cybersecurity, financial crime, which includes scams as well. So in this next few slides, I'll be talking to you mainly about the background of a bit more high level of public private partnerships, and Mastercard's role. And I think that the key message of my sharing in the next 10 minutes or so, is that public private partnerships is very wide in nature. And it's a very powerful mechanism in which we can use in no matter which kind of organizations we are in to solve a lot of society's problem, including the growing threat of cybercrime. So in this particular slide, I was just looking at the classical definitions of what public private partnerships are. And if you look in history, the original definitions tend to focus a lot more on, you know, private sectors involvement in financing and developing infrastructure together with the public sector, which is what the first definition that you see on screen from the European Investment Bank. And as the years went by, the definitions got broader and broader. And if you look at the latest one from IMF, for example, is just two lines. And essentially, it doesn't just cover public infrastructure anymore, but also public services as well. So the nature of public private partnerships continues to evolve. In fact, I first heard of public private partnerships, I think probably in the mid 2010s. And you know, but if you look at history, it's gone on for a few hundred years, actually. And the key reason why it's existed so long, because there's quite a lot of benefits from this kind of model of engagement to solve issues in society. For example, efficiency gains, there's a lot of empirical evidence that suggests that, hey, even for public projects, private sector management does lead to efficiency gains. And as I mentioned, large infrastructure projects, a lot of developing countries tend to use public private partnerships primarily for such infrastructure projects, because they're heavy on the finance and they need private sector money. In some instances, there is a huge risk associated with a particular national project. And therefore, public sector may choose to apportion some of their risk to private sector and manage them through contracts. In some instances, and we saw this during COVID-19, there is a very strong impetus for innovation and the government cannot solve the problem by themselves. And therefore, there's a very strong need to include other people in the ecosystem where, for example, independent think tanks, research institutions, private sector companies, and I'll share the example of COVID-19 in a while. And finally, I think one of the other reasons why public private partnerships continue to proliferate is because of sustainability of a project. Oftentimes, when a particular service or infrastructure is created, the government gets very concerned about funding it perpetually through taxpayers' money. And instead, what they find a more useful way to or sustainable way to run the project service is to get private sector to run it as a business or organization, and then it becomes sustainable in the long term. In terms of public private partnerships, it's not a recent phenomenon. In fact, when I was preparing for this module, history of this goes back about 1000 years, you know, all the way in the UK, construction of London Bridge, in the US, when obviously, the Western influence came in the building of railroads, railways, electric grids, most of it was funded by private sector organization under the authority of public sector. And in Egypt as well, public works were actually, there was minimal cost for a lot of public works, because private sector organizations then actually took on the risk that in the colonial period, we saw a lot of chartered companies coming up and actually creating development and trade in certain areas, which they eventually became nationalized. And the last example is, of course, it's not really limited to development. There's also a lot of public private partnerships that happen in the culture space as well, whether it's in the theaters, in the museums, or libraries even. So it's not just for one type of use case. And I wanted to share these three concepts with you. These have been useful in my own thinking when I think about public private partnerships and some of the key principles behind them. So the three theories I wanted to share firstly, and this comes from economics. My grounding is actually in economics, but we talk a lot about public private partnerships in economics as well. And the first is the public goods theory in public private partnerships. So if you think about cybersecurity, especially for critical infrastructure, it is often treated as a public good, which means that it benefits everyone, whether they contribute or not. But here's the problem. Public goods like secure energy grids or financial networks are prone to the free rider problem, where private companies may hesitate to invest in cybersecurity when they can't directly benefit whether monetarily or not, and governments alone may lack the resources. So that's why PPPs or public-private partnerships are important. They pool the resources to protect public goods. And for instance, cost-sharing models or platforms like what Rebecca mentioned from Shadow Server, allow both sectors to collaborate addressing threats collectively. So by combining public oversight with private expertise, we ensure that the public goods like cybersecurity are adequately protected and accessible to all. So that's the first theory, the public goods theory. The second theory that I found very useful in framing our thinking around public-private partnerships is game theory, actually. And cybersecurity partnerships often involve a lot of strategic decision making, which is where game theory becomes very valuable. So imagine a public sector agency or government and a private firm responding to a ransomware threat. Should they share intelligence or withhold it for competitive advantage? So that's the question, right? So if both share, they benefit from stronger defense. So that's one scenario. But if one withholds the information, they might gain a short-term benefit while weakening collective security. So this particular dilemma that I just put forward is what we call in classical game theory called the prisoner's dilemma. So the solution lies in building trust through agreements, secure platforms, and incentives for cooperation, for example. And this is why frameworks or groups like FS-ISAC, Health-ISAC become very important because they encourage the sharing of TTPs through neutral platforms and allows the sharing of benefits through stronger cybersecurity cooperation. So game theory in this way helps us to predict behavior and then circumvent that by implementing strategies to ensure that it's in everyone's interest to collaborate and cooperate. And really the third problem or the third theory that I thought was very useful to understand is the agency problem in public-private partnerships. When we talk about public-private partnerships in cybersecurity, one key challenge is the agency problem. And imagine the government outsourcing cybersecurity operations for critical infrastructure to a private company. Now you know the government's goal is national security, but the private company might prioritize profits instead. So this misalignment can lead to underinvestment in robust security measures or focus on cost cutting. So for example, a private sector company might even delay necessary upgrades, assuming the government will step in or it's better to do it later on when the financial situation of the company is better. And this is the classical case of moral hazard. So to address this, PPPs must have safeguards like clear contracts, regular audits, and incentives for exceeding cybersecurity benchmarks, aligning the goals of both parties to ensure they work together to protect critical infrastructure effectively. And these are some examples of public-private partnerships that came to mind. For example, during COVID-19, you saw in the U.S., for example, there was this program called Operation Warp Speed. Essentially, it broke down all barriers which fostered cooperation from pharmaceutical companies, regulators, and even university think tanks as well. And it allowed for rapid development of the COVID vaccine. In Singapore's example, the PUB, which is the utility board, works with desalination or water companies to develop their capabilities to make Singapore more self-reliant with regard to water. And this particular program as well, the FlexiMasters, is also an example of public-private partnership. So the CSA announced that cyber threat intelligence was a gap area in their curriculum. This was about a year and a half, two years ago. And when we heard that, we engaged the CSA, we engaged different government authorities to say that, hey, we do have this competency. We have people like Rebecca in our global organization. And we put together a curriculum, we brought in our global experts, and then designed this particular program with NTU to solve a situation which Singapore and the region was having, which is basically there was a lack of cyber threat intel kind of course in the country. And I'm very glad to see that this has been addressed. So very quickly, the next few slides, I'll give you some examples of how Mastercard participates in public-private partnerships to solve issues around the world, particularly in the cyberspace. Maybe something more broader first, one of the things Mastercard is best known for is our Centre for Inclusive Growth. And this is the philanthropic arm of Mastercard where we essentially invest in NGOs and charities around the world that have a very important cause around financial security, in small business growth, women's entrepreneurship, and even bringing capability upgrading for non- profits through data science. So essentially, Mastercard invests in them to run those programs in developing countries and also build capacity of NGOs so they can do their work better. And globally, I think we fund about 97 organisations in 47 countries. So this is a big part of what Mastercard does across the board for important development goals. In terms of cyber security, depending on the region, Mastercard plays different roles with regard to cyber security capacity building with public sector organisations. In the US, those take the nature of participating in cyber defence exercises with critical infrastructure, with their version of the CSA. In Europe, it's about building centres to essentially promote cyber resilience. And in the US, I forgot to mention, there's also a lot of strong cooperation in building cyber security standards. In Asia, our cooperation is more around building training capacity, for example, sharing basic cyber security foundations, but also some niche areas as well, for example, cyber threat intel. So depending on where the needs are, we tailor our approach and we partner governments for cyber security capacity building. And one way we started doing this a bit more deliberately is through the Centre of Excellence, where we started building curated centres, which has a dedicated focus on bringing curriculum and content, but also doing joint research as well. So this centre that we have with NTU, actually the primary activity is research and that IP is then shared with the university. And that IP is then used to benefit other companies and particularly Singapore enterprises. And we are repeating this whole model in Indonesia as well currently. So whatever we are doing in Singapore, we are replicating around the region. And then Rebecca spoke about CASA. So this is one organisation that we have adopted and we have started to bring them to Asia because we realised that scams are quite, I mean, they are on the cyber value chain as well. In fact, scams tend to be the downstream impact of cyber breaches early on. And we realised that there wasn't an organisation that could bring different private sector and public sector organisations together to share intelligence and information. So we brought CASA, which was primarily a European body, to Singapore about a year and a half ago. And together right now, we already have about 20 large companies, including your Google, your Apple, your Amazon, and even your Singapore Police Force, your Grab and even local universities. So it's become quite a robust platform and we organised a summit with around about 400 people in person, 600 online just a month ago. And it was a very good platform because it was not just promoting intelligence sharing in Singapore, but also around Southeast Asia as well. So it's become quite a very powerful platform and we hope to kind of grow this not just as a Singapore entity, but now as a Southeast Asia entity. And you will hear more about this in the sharing by CASA in your course. One of the great things that I think they do, which we also finance and fund, is the development of their scam reports. And the reason why it's important is because in many countries, there is no quantification of the scam losses. And if you cannot measure the problem, the problem technically doesn't exist in the eyes of certain government agencies or people that are tasked to solve the problem. And CASA does this work where they actually try to quantify the scam losses and then they engage government agencies to try to solve it as well. So that's one of the important roles CASA plays. It's essentially providing intelligence and resources to countries around the world, particularly developing countries. And maybe one last example of the kind of work we do with helping governments around the region is this particular project, also in the world of scams. And this was with the United Nations Development Program. And essentially, working with Cambodia, if you read the newspapers, anything about scams, it's almost impossible not to have the word Cambodia mentioned there sometimes because Cambodia has become, unfortunately, a scams hub. And it's associated, unfortunately, also with a lot of human trafficking as well. So we collaborated with UN and the different public sector organizations in Cambodia to essentially help them address the scam problem and realize that when we flew down to Cambodia, there was nobody actually looking at the problem because the government didn't know how to understand and measure the issue. And they didn't know which agency was the correct one. So we launched a mission where we created a program with UNDP to start measuring the impact of scams. And we got all the relevant agencies from the finance industry, which is equivalent to MAS, to your police, to your MHA. And we started doing studies there where we financed together with the UNDP to measure the impact of scams. And through that, we're now in the stage where we are developing a response architecture where we look at the scam journey and the intervention strategy and also the different levers as well that the different arms of the Cambodian government can put in place to deter scams. So it's quite a heavy-duty investment on our part, but it's the kind of things that we do to ensure that the ecosystem remains the same. And once we do it in one country, then we replicate it in others. But this, again, is an example of the deep level of intervention that we do with certain governments for public-private partnerships. I'll turn back the time over to you, Rebecca. Thank you, Rajesh. That was really great. Thank you very much. How many of you here have been to a cybersecurity conference in Singapore or in the region? Put your hands up. Two. A couple of you. How many are aware of cybersecurity conferences in Singapore? A couple of you. Okay. And how many of you are planning to attend a cybersecurity conference in 2025 now that you've done this course? All of you. Yay, right answer. Basically, the cybersecurity conferences, and a lot of them that Rajesh alluded to, are where you will learn what is going on in your ecosystem or your sector. It will also give you a network to help you share information, to learn about the latest tools, techniques, trends, tactics that the bad guys are using, and what other companies are using, either free or paid for, to fight the good fight in terms of cybersecurity. When I first went to the FS-ISAC conference some 10 years ago, there were 750 men and five women. Now, when I go to the FS-ISAC conferences, it's much more of a 60% men, 40% women. But it just shows you, by going to these conferences, you see the evolution of cybersecurity and the different type of people fighting the cyber problem, especially over the last 10, 15 years as well. For Wednesday, for your knowledge check on Wednesday, I want you to look up some cybersecurity conferences that you would like to attend next year, and we will talk about them, and we will identify which ones might be the best ones. Also, I'm going to do a knowledge check on the first part of the lessons that you will have gone through between now and Wednesday. You will have the usual 30-question quiz that you will have to complete, and there is also a written assignment which is comprised of a PowerPoint that you are going to give to your fellow students on the following Saturday next week. So, what I want you to do for the assignment is that I want you to look at your own organisation and how it might benefit from public-private partnerships, and what they might be, what they might look like, and what the benefits might be. So, I'm looking forward to your answers next Saturday because you're all in pretty diverse types of organisations, so we should have some different types of responses. Does anyone have any final questions for Rajesh based on his presentation or myself? Please put them in the chat. Rajesh gave you a lot of great information in his presentation, so if anyone has any questions for him. By the way, is the slide uploaded? What was being presented just now? Rajesh's one isn't, but we can upload it, I believe. Can we, Rajesh? Yeah, I'll just put it in the chat here as well for convenience. Otherwise, I'll put it on the e-learning platform. Thank you.