Network Security Tools

Jerry Grugin

In this blog, we talk about Network Security Tools, to include:

• NIDS/NIPS
• FW/HONEYPOTS
• PROXY SERVERS
• PROTOCOL ANALYZERS
• PENETRATION TESTING

NIDS/NIPS

It would be nice to be able for a human being to look at and analyze every packet
that goes through the system and find all the bad things within it. Unfortunately, that is
an impossible task. A human being cannot possibly look at and analyze all these packets
and find all the bad stuff. That's why things like Network Based Intrusion Detection
Systems (NIDS) and Network Based Intrusion Prevention Systems (NIPS) were created.
These systems can do what human beings, by themselves, cannot do. These systems can
watch all the traffic. These systems can detect vulnerabilities inside the traffic flows.

Intrusion Prevention systems are designed to actually stop the vulnerabilities.
Intrusion Detection Systems are designed to detect these vulnerabilities. It is imperative to
know the difference in these two types of systems. Intrusions are exploits against
operating systems and applications. These intrusions can involve things such as buffer
overflows, cross-site scripting, just to name a few. One of the things we, as security
professionals, have to watch out for is the dropping of legitimate information. It is possible
for an IPS to identify legitimate information as threats. We want to stop the bad stuff and
allow the good stuff. We need to find a happy medium that allows the maximum amount
of safety and satisfies everyone.

A fundamental technology used in IDS's and IPS's is something called a "signaturebased
match." We want to be able to look at the exact code going over the network. If
we see a signature of an identified threat, we want to be able to stop that information
from entering the network. Some of these signatures can be very, very detailed. Once we
have identified these signatures and we have these in place, the prevention system is
looking for exact matches of these identified signatures. If the system sees the exact
match, it will either detect it (IDS) or prevent it on-the-spot (IPS).

Another fundamental technology is called an anomaly-based detection. An
anomaly-based device builds a baseline of "what is normal" on the network. If the network
or certain aspects of the network go well above the normal range, it becomes what is
known as an anomaly. It is something that would not be normally seen on the network. If
the system sees an anomaly, it should provide an alarm. An alarm could be given if, all of
the sudden, more than the normal amount of users try to log into the network at the same
time. The system would identify this as an anomaly.

A behavior-based technology can also be used to identify threats. A behaviorbased
technology is similar to anomaly-based technologies. With behavior-based
technologies, we may be looking at the behavior of users that is considered normal. The
system watches the behavior of users. If the user tries to do something that is outside the
normal behavior, then the system should give an alert.

Heuristics is another technology used to identify threats. It is an emerging
technology, but it's been around for a number of years. It has continued to be made better
and better. Heuristics can be described as a bit of artificial intelligence. This technology
looks at information that comes over the network to see if it changes. If the packet flow
changes, it might be indicative of a threat.

In summary, I have explained NIDS and NIPS and have given the definition of
vulnerabilities. I have identified 4 technologies used with NIDS and NIPS to detect threats:
Signature-based, anomoly-based, behavior-based, and heuristics. I hope this has been an
excellent overview and has been a good blog to read in understanding these things as it
relates to Security+.

FW/HONEYPOTS

Firewalls can be hardware based or software based.  An organization could combine hardware and software techniques to make a firewall that uses both.  They use both to enforce the network access security policy.  This is the first real step towards security.  Modern firewalls will do a lot more than just packet filtering and network access control.  They will do different types of access control, they will terminate VPN tunnels, they will provide QoS (quality of service) with rate limiting, they will provide redundancy.  You can get total confidentiality, integrity, and availability (C.I.A.) out of modern firewalls.  Hardware, zone-based firewalls are superior.  Some models even provide multiple virtual firewalls.

Honeypots have been around for a while and we associate them with firewalls because typically honeypots are placed out in demilitarized zones at the perimeter of a network.  A honeypot is actually a trap to deflect, detect, and to counteract attacks and any unauthorized access of information systems.  Honeypots lure would-be attackers, malicious users, malware spreaders, and spammers into the system.  A honeypot is typically a computer.  It could be a Linux server or it could be an entire subnet.  Two or more honeypots is called a honeynet.  A centralized collection of honeypot tools is called a honeyfarm.

PROXY SERVERS

A proxy server is really a gateway that can provide lots of different services at different layers of the OSI model.  There are proxies that can operate at the network layer, the transport layer, the application layers.  By definition, a proxy is a gateway or intermediary device between two different domains or two different networks to provide quite a few different types of services.  Web server proxies and other application proxies serve as gateways for:  translation, caching, filtering, and inspection.

PROTOCOL ANALYZERS

Protocol Analyzers are valuable tools to monitor wired and wireless networks, not just for capacity planning, growth, optimization, and for adherence to security policies, but for security.  It is also a vulnerability.

PENETRATION TESTING

This last tool is more of a process than it is a tool.  It is a tool in the sense that it is a useful mechanism for evaluating security, doing risk assessment, and doing risk management in the organization.  It is part of the initial process to determine vulnerabilities and weaknesses.  Penetration testing is done by professionals to try to penetrate defense systems, to find out if defense in-depth is deep enough, broad enough, and comprehensive enough.

Operating System Hardening

Jerry Grugin

 

In this blog on operating system hardening, we will take a look at four key areas:

• Service Packs and Hotfixes
• Patches and Patch Management
• Group Policy:  Security Templates
• Configuration Baselines

Service Packs and Hotfixes

The process of releasing network operating systems, applications, and programs to the market is a very competitive one.  Typically, the first company that can get a system out to the market is going to get a much needed market share.  Sometimes, these products and systems do not really undergo the necessary pilot testing before they are released to the market.  Thus a lot of network operating systems do not go through a full-fledged development cycle because of the rush to get to the market first.  Because of the rush to market, there is a great need for service packs and hotfixes that will follow.  Service packs and hotfixes are needed to fix things such as security holes that were not initially discovered, to enhance interoperability with other vendor's products, to fill operability loopholes, to add additional features, or to bring the product up to speed with international standards.  Further, and this should be understood quite clearly, support packs, service packs, and other such things are all part of the normal development process.

It is important to know that all service pack updates should be authenticated with certificate authorities (CA).  It is also important to know that not all service packs can be rolled back.

There are also different types of updates besides application updates.  There are also updates called operating system updates.

Patch Management

A patch is a small chunk of code to fix problems or update computer applications and supporting data.  This can be improving usability, improving interoperability, improving performance, sealing up some security holes, fixing problems, or fixing bugs.  Accordingly, patch management is talked about under the umbrella of change management, which is an open process that is used in ITIL, Microsoft's MSF, for example.  Change implies that something will definitely change.  Therefore, we have to have a way to manage these changes.  There needs to be set scheduling to manage these changes.  This could be time based or event based.  Time based management could be every few months or every few weeks.  Event based might be based on attacks to a computer.  Patches or updates need to be tested in a prototype environment.  However, some companies do not have this luxury.  It is important to remember that change management is the vital component to the patch management process.

Group Policy and Security Templates

Group policy is actually a feature of the operating system.  The goal should always be improved productivity and improved security.  Group policy is a very popular tool to use in small to medium sized business all the way up to enterprise organizations.  It is a way to allow these organizations to define rules or policies throughout the organization.  They can apply these at different levels of the organization.  Group policy allows organizations to control such things as registry, NTFS security, audit and security policy, software installations, scripts, and application settings (IE).  Group policy uses administrative and security templates.  These are predefined settings at a workstation or a domain, for example.  Group policy objects (GPO) have a built-in inheritance.

Configuration Baselines

This is the initial system that one has when the operating system is installed.

Organizational Security

Jerry Grugin

Organizational security covers four main knowledge areas:  Redundancy Planning, Redundancy Components, Disaster Recovery Procedures, and Incident Response.  We will look at these topics, not necessarily in the order listed.

Alternate Disaster Recovery Sites

In case of some type of disaster, whether it be natural or man made, there needs to be a recovery site.  These recovery sites are classified according to hot sites, warm sites, and cold sites.  Business functions have to be restored if there is some large scale loss of service due to any number of activities or events.

A hot site is an entirely separate location where a business can have duplicate operations up and running within hours.  This is the most expensive approach.  This would include the network infrastructure being duplicated, telecommunications, network connectivity, systems, preconfigured software to meet all the needs of the organization, replication of data.  Sometimes, companies will have mobile hot sites located several miles away where they can relocate if necessary.  The hot site is sometimes referred to as the active backup model.  The hot site might also include office space and other components needed for business functions because the business will have to have a core group of employees at the backup site.  If every company had the choice, they would opt for the hot site option.  Not every company can afford the hot site option.  This leads into the next type of site - warm sites.

Many companies, because of costs, look for a compromise.  They choose a warm site.  The warm site will have a lot of functionality of the hot site, but there will be some level of administrative and staff installation of configuration and systems that can resume operations.  There may be the basic telecommunications, infrastructure, as well as servers there, but the company will still have to go through the process of replicating data, or bringing systems online, or doing some level of application installation.  The warm site isn't exclusively for a single company's use.  It could be for several companies.  In this way, companies can minimize costs.  They are gambling that no more than one company will need to use this shared warm site at one time.  These agreements between companies are also known as reciprocal agreements.

A cold site has almost no preconfiguration.  A cold site may simply just be a building that has electricity going to it.  It is not immediately ready to put into use.  A cold site is a place to resume activities to a limited degree, but it does not provide a built-in infrastructure to support operations.  A cold site will probably be used when a company is going to be there for an extended period of time.  Cold sites are the least expensive to put into place, but if needed, they will require the most planning and most work to resume business operations.

Redundancy Planning

Redundancy Planning includes topics such as single points of failure, RAID, Redundant Servers, U.P.S., Backup Generators, and Spare Parts.

A single point of failure can occur not just from a security standpoint, but in all of the mission critical devices and services.  It can occur in email servers, database servers, file servers, SharePoint servers, routers, switches, multi layer switches, firewalls, intrusion prevention sensors, etc, etc.  The list goes on and on.  Knowing where all the single points of failure are, and then implementing redundancy, is going to be a key part of disaster planning and recovery.  It is simply planning for redundancy.

RAID -  We want to have redundancy of data.  We do not want data to be a single point of failure.  Companies simply cannot afford to lose data.  Therefore, most companies use Redundant Arrays of Independent Disks.  All mission critical systems should be using RAID arrays for their data.  In a RAID 5 Array, we use disk striping with parity.  We want to have extra drives because of RAID 5 Array.  If one drive goes bad, we still have the data because of parity, but we want to have a spare drive in case a drive goes bad.

SPARE PARTS - Not only do we want to have redundancy of data, we also want to have redundancy of parts.  For instance, if the power goes out, we need a U.P.S. to provide temporary power until the main power source can be restored.  U.P.S. stands for uninterruptional power supply.  We also need to have spare drives and spare modular components.

BACKUP GENERATORS - If there is a need to have power restored to an entire facility, companies need backup generators.  This is a key aspect of disaster recovery and redundancy planning.  Many hot sites, warm sites, and cold sites will have backup generators stored there in times of emergency.

Types of Disruptions

There are three types of disruptions:  Non-disaster, disaster, and catastrophe.  A non disaster is where the business process in unavailable, but for a certain period of time, maybe a few minutes to a few hours.  A disaster is where a business loses operability or services for at least 24 hours or longer.  Typically, in a disaster, only a certain percentage of the facility is destroyed.  A catastrophe is a situation that destroys the entire facility.

Disaster Recovery Objectives

The objectives of disaster recovery are as follows:  Protecting data, Protecting people, resuming of business functions, minimize decision-making during disaster, and to have rehearsed plans and procedures.  These objectives are not necessarily in order.  Protecting people should be at the top of the list.

Disaster Recovery Procedures

Disaster recovery procedures include the following:  planning, exercises, backup and storage, restoration.

Incident Response

An incident is an adverse event or occurrence that has caused damage or has the potential to cause damage to a company's assets, to personnel, or to reputation.  Incident management is the exercise of developing and maintaining the ability to manage incidents within an organization so that the impacts of the incident can be contained and the company can recover within the specified time objective.  Thus, incident response is the company's capability to effectively prepare for and respond to any unanticipated events.

General Cryptography Concepts

Jerry Grugin

 

·    Definition of Cryptography

A larger discipline of cryptography is called Cryptology.  Cryptology is the science of making secret codes and breaking secret codes.  Cryptology is broken up into two disciplines:  Cryptography and Cryptanalysis.  Cryptology involves making and using codes.  Cryptanalysis involves the breaking of those codes.

Cryptography is mainly used for encryption and authentication.  Cryptography involves taking a clear text or plain text message and scrambling it up into some unreadable format.  It is unreadable to anyone or any system that has the KEY to unlock the encrypted message.  Thus, encryption is the process of rendering data unreadable.

Cryptography can be used for authentication.  It can be used to make sure that two systems are who they say they are, or that participating users are who they say they are.  Cryptography can also be used to encrypt message content.  Thus, Cryptography is used for encryption and message content.  The reason it is used on message content is to achieve integrity of the data so that the data does not change in transit.  So, we are really talking about two processes:  Encryption, which is taking plain text or clear text and translating it to a cipher text AND Hashing, which is the process of taking an original message, running it through an algorithm, and then getting some fixed linked result.  That result is appended to the original message.  Then, the results of the hash are compared at the receiving end.  It is important to remember, though, that encryption changes clear text to cipher text.

Julius Caesar is one of the first people that we know about that used cryptography or cryptology.  There exists something called a Caesar Hash.  It is a relatively simple cipher.  The original Caesar Cipher became what is known as a substitution cipher.  For example, let us consider the Western alphabet:

A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z

Now let us assign different letters to the alphabet:

 

A  B  C  D  E  F  G  H  I  J  K  L  M  N  O  P  Q  R  S  T  U  V  W  X  Y  Z

W  J  X  K  Y L  Z  M A N B  O  C   P   D Q  E  R  F  S  G   T   H  U   I  C

 The first line composed of the Western alphabet is called the KEYING VARIABLE.  The keying variable is based on a mathematical formula.  Here, we have 26 letters for the keying variables.  We need to know this because it tells us how vulnerable we are to a brute force attack, also called a brute force cryptanalysis.  In a brute force cryptanalysis, the adversary is going to try every possible combination of keying variable until the decrypted plain text is understandable.  It wouldn't take very long for a substitution cipher.

The second line under the alphabet is called the CRYTOALGORYTHM.

If I wanted to spell out my name, Jerry Grugin, which is the plain text, we would get a resultant cipher text.

Jerry Grugin = BYRRI ZRGZAP.

"Jerry Grugin" is the plain text, and "BYRRI ZRGZAP" is the cipher text.  Thus, when the keying variable is combined with the cryptoalgorythm, it is then used to encrypt plain text into a cipher text.

We use encryption to provide confidentiality to a wide variety of the OSI layer.  For example, we might encrypt application layer data, layers 7 to secure email, or to secure Lotus notes messaging sessions.  We can secure database sessions for SEQUAL or ORACLE.  We can encrypt session layer data using SSL or TLS.  We can encrypt network layer data.

 

·         SYMMETRIC VS. ASYMMETRIC ENCRYPTION ALGORYTHMS

What makes encryption algorithms good.  They should be able to do the following:

             1.  Resist cryptographic attacks

            2.  Should support variable and long key lengths

            3.  Should be scalable

            4.  Should have the ability to import and export the keys

            5.  Want to have something called the avalanche effect.

There are two different concepts involving keys.  You can think of a key as input.  A symmetric key means than you have the same key to encrypt and decrypt a message.  This key is often shared using a wide variety of methods between the two parties.  An asymmetric encryption process uses different keys to encrypt and decrypt a message.  Asymmetric encryption algorithms are typically part of a Public Key Infrastructure where there is a public key and a private key.

·         INFORMATION ASSURANCE & C.I.A.N.

Information assurance is the practice of managing risks to data.  It seeks to protect information and information systems and it does it using cryptographic methods.  These cryptographic methods provides us assurance through four different tiers:  Confidentiality, Integrity, Availability, and Non-Repudiation - C.I.A.N.

Common Network Ports

 

Jerry Grugin

 

Overview:

When it comes to the security plus examination, it is a good idea to memorize the following information about ports and how information is transferred over these ports.  There is no getting around it.  You will need to know these things.  Just go ahead and memorize these things.

In computer networking, a port is an application-specific or process-specific software construct serving as a communications endpoint in a computer's host operating system. A port is associated with an IP address of the host, as well as the type of protocol used for communication. The purpose of ports is to uniquely identify different applications or processes running on a single computer and thereby enable them to share a single physical connection to a packet-switched network like the Internet.

The protocols that primarily use ports are the Transport Layer protocols, such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) of the Internet Protocol Suite. A port is identified for each address and protocol by a 16-bit number, commonly known as the port number. The port number, added to a computer's IP address, completes the destination address for a communications session. That is, data packets are routed across the network to a specific destination IP address, and then, upon reaching the destination computer, are further routed to the specific process bound to the destination port number.

Note that it is the combination of IP address and port number together that must be globally unique. Thus, different IP addresses or protocols may use the same port number for communication; e.g., on a given host or interface UDP and TCP may use the same port number, or on a host with two interfaces, both addresses may be associated with a port having the same number.

Of the thousands of enumerated ports, about 250 well-known ports are reserved by convention to identify specific service types on a host. In the client-server model of application architecture, ports are used to provide a multiplexing service on each server-side port number that network clients connect to for service initiation, after which communication can be reestablished on other connection-specific port numbers.

Examples

An example for the use of ports is the Internet mail system. A server used for sending and receiving email generally needs two services. The first service is used to transport email to and from other servers. This is accomplished with the Simple Mail Transfer Protocol (SMTP). The SMTP service application usually listens on TCP port 25 for incoming requests. The second service is usually either the Post Office Protocol (POP) or the Internet Message Access Protocol (IMAP) which is used by e-mail client applications on user's personal computers to fetch email messages from the server. The POP service listens on TCP port number 110. Both services may be running on the same host computer, in which case the port number distinguishes the service that was requested by a remote computer, be it a user's computer or another mail server.

SPECIFIC PORT NUMBERS (MEMORIZE THIS)

FTP -   FILE TRANSFER PROTOCOL -     tcp/21(control)-           tcp/20(data in active mode)

SSH -  SECURE SHELL -    tcp/22

SCP -   SECURE COPY -      tcp/22

SFTP - SECURE FILE TRANSFER PROTOCOL -            tcp/22

TELNET-        tcp/23

HTTP- HYPERTEXT TRANSFER PROTOCOL-   tcp/90

HTTPS- HYPERTEXT TRANSFER PROTOCOL SECURE-        tcp/443

FTP OVER SSL-        tcp/990(control)          tcp/989(data in active mode)

NetBIOS- NETWORK BASIC INPUT/OUTPUT SYSTEM-         tcp/139(session service)

TFTP-  TRIVIAL FILE TRANSFER PROTOCOL-            udp/69

Evaluating Common Threats

SECURITY +

Evaluating Common Threats

Jerry Grugin

 

            How do we evaluate threats to computers or computer systems?  In order to evaluate threats, we need to know what these threats are.  We need to be able to differentiate between various system security threats, which is the first step in security risk assessment.  We need to know certain basic fundamental concepts about systems.  When we know these things, we will be better able to protect systems.

First Security Fundamental - Privilege Escalation

            We don't give individual users or systems access to areas to which they are not supposed to have access.  One of the first types of measure that may be taken against a system involves privilege.  It involves escalating privilege or increasing permissions beyond those that are allowed by the security policy.  Therefore, we want to ensure the concept of least privilege where users are only given access to the things they are supposed to have access to based on the credentials of the user account being used to log into a system or the membership of some group.  Privilege escalation can happen on purpose or by default, or it could be an actual category of attack that looks for vulnerabilities on systems and services and then uses the situation to take advantage of them.  Escalation of privilege is tied very closely to permissions.  In an escalation of privilege attack, the attacker tries to escalate the permissions from a basic user and change them to administrator permissions.  We need to know the difference between system permissions and normal user permissions.  System permissions allow modify, read & execute, and write.  A normal user, though, can read & execute, list content, and read.  So an attacker would try to escalate from a basic user to an administrator or system account.

Malware

            One of the primary reasons why an attacker would want to escalate privileges on a system is to introduce something called malware into a networking environment or onto a system, maybe even a server.  Malware is short for "Malicious Software."  It refers to software programs that are designed to damage or perform some type of unwanted action on a computer.  The types of malware include viruses, worms, trojan horses, and spyware.

Categories of Threats

            Malware can be introduced via several types of environments.  The first type of threat is intentional.  These are threats that are lodged against a system by a malicious, knowledgeable user.  The second type of threat is unintentional.  This is simply an educated user that accidentally downloads malware by accident.  The third category of threat is an internal attack.  Over sixty percent of attacks are caused by an insider.  The fourth type of attack is external.  It is important to understand that malware can be introduced through different combinations of the four threats.  For example, a threat could be an intentional internal attack or an intentional external attack.  In the same way, an attack could be an unintentional internal attack or an unintentional external attack.

Virus

            A virus is simply a computer program that can do the same thing as other computer programs do.  It is a program that spreads by first infecting files or system areas of a network.  A virus makes copies of itself.  Some are harmless, while others will damage a computer.  In today's times, viruses are primarily spread using email messages.  The types of viruses are polymorphic, stealth, retrovirus, multipartite, armored, companion, phage, and macro.  Importantly, a polymorphic virus can modify itself to avoid detection from antivirus software.  These viruses attack systems, servers, and hosts.  They will display messages on computers.  Sometimes they will delete files from the system.  A polymorphic virus can actually encrypt parts of itself to avoid detection.  This is called mutation.  Basically, the polymorphic virus modifies its signature in order to bypass antivirus detection.

Overview of the Security+Exam

When I first started studying for the security+ Exam, it would have been helpful if I would have had an up-front overview of the exam itself.  I didn't, though, and it made it difficult to grasp the entirety of the test.  This blog gives an overview of the different sections of the Security+ exam.

What is the Securty+ exam?  The exam is about security of your computer or the security of other computers for which you are responsible.  Studying for the exam gives one an in-depth view of security techniques.  This is foundational knowledge.  One can build on what has been learned.

The Security+ exam is a 90 minute exam composed of 100 questions.  As a result, before one takes the exam, a person has to decide how much time to devote to each exam question during the exam.  This is imperative.  Not having a strategy for taking the test can mean the difference of passing or failing the exam.  You have to take some time in determining how much time you will spend on each question.  A passing score is 750, which is graded on a scale of 100 to 900.  The 750 number is not a percentage because every question on the exam has a different associated weight.

There are six domains to the test.  Domain 1 is Network Security, which comprises 21% of the test.  Domain 2 covers compliance and operational security, which comprises 18% of the test.  Domain 3 covers threats and vulnerabilities, which comprises 21% of the test.  Domain 4 covers application, data, and host security, which comprises 16% of the test.  Domain 5 covers access control and identity management, which comprises 13% of the test.  Lastly, Domain 6 covers cryptography, which comprises 11% of the test.  For those who are visual and can understand things in chart form, the breakdown of the exam is as follows:

Domain & Network Security                                           21%
Compliance & Operational Security                                18%
Threats and Vulnerabilities                                              21%
Application, Data, and Host Security                              16%
Access Control and Identity Management                       13%
Cryptography                                                                   11%

Notice that Network Security and Threats and Vulnerabilities each comprise 21% of the test.  This is a total of 42% of the test.  So, when studying for the exam, you may want to concentrate more heavily on these two domains.  After that, you may want to focus on Compliance and Operational Security.

I would suggest getting study materials.  There are study materials available from numerous sources to include the following:  CompTia, local libraries, and the internet.  You may want to consider taking a college course on Security+.  Additionally, there are private persons who offer paid schools for the exam.  Hopefully, you will work for a company that provides paid training.  If not, there are a number of other options for those who do not have the financial resources.  YouTube is a great place to learn how to look for resources in reference to the Security+ exam.

On the day of the exam, be sure you have had a good breakfast.  Also, be sure you are comfortable with comfortable clothing.  Take the bare minimum number of items with you.  The CompTia website tells you what you can bring and what you cannot bring.  Be sure to get there on time.  On the day of my exam, I got there a little bit early and they let me go ahead and start.  During the exam, just relax.  If there is noise coming from the outside, do not wait to let the exam officials aware.  You have the right to take the exam free from outside distractions.

During the exam, be sure to watch your time.  You have the option of marking questions so that you can come back again to them later.  Time management is very important.  Once all questions are answered, go back and check your questions and answers again to make sure you did not initially misunderstand any of the questions.

If you fail the exam, do not worry.  There are many people who do not pass the exam on the first attempt.  Get a copy of your scores.  There should be a breakdown of percentages which should tell you on which areas you need to study for the next exam.

I hope this blog has been informative.  Good luck studying and good luck on the exam.