Jay Paz - Thinking outside the security box: Assembling non traditional security teams

close to ten years in that time I was a developer assist admin and architect all kinds of roles as you grow in that environment six years into my stint there I moved into the libraries and I was working with the libraries for all UT System and other Texas universities like Texas A&M we fight but we like each other and we work together really well and we were doing the Texas digital library and it was really a repository of a lot of knowledge a lot of papers and also the workflow by which Texas University Doctorate candidates were submitting their paperwork so it was a huge repository at the time I was working on implementing Indy space which

was a an MIT open source project that was a data repository and working through that I found what I thought was a quality engineering bug it had to do with authentication and authorization I didn't think twice I fixed it I submitted the pull request and it was accepted and so I felt like cool I submitted something in an open source project let me talk about it in that talk the chief information security officer was in the audience and after they thought the talk he came to me and said I think I've got a spot for you on my security team it was like that's cool I don't know anything about security but that's where I cut my teeth it was a

team of four risk analysts that I was a part of pen testers advisory services whatever it is that any of the entities at the university needed in order to secure whether it was their building or their applications or you name it we worked with them to do that UT is a very distributed university so every business unit every college were our clients and so it was very much a consultant type of work in that way and so I became a security analyst in 2008 and I stayed there for Anna three years or so life and family happens and my wife and I decided to have children and so we needed more money and the state doesn't pay and so I

had a ton of great experience I learned a lot but I needed to do something different for me and for my family and so I moved into a security engineer and support developer role at Oak Taro's which is small boutique development shop that does at the time a Magento and Drupal mashup for all of our clients so that they could do e-commerce and content management all within the same platform and that worked really well I manage teams out of Costa Rica Ukraine and in Austin and then I was also the security engineer for the whole company so securing all of our virtual machines securing our platform making sure that that Magento Drupal mash-up was actually

secure both for the administrators but then also for the end users etc so and I continued okay this was more of a hybrid role developer and security engineer and then finally I I moved over to bizarre voice in 2012 you guys know bizarre voice anybody if you do any shopping and decide to do any review or rating of a product not on Amazon not on Walmart they do their own things but pretty much everybody else you're using bizarre voices product and it's a JavaScript drop in that then draws the Dom or on the Dom all of the functionality for that product and I was the only security engineer of a company of about a thousand with approximately

300 developers and so it was a tall order right when I came in they had no security program and so I was lucky that I was that guy lucky because I got to build it all out from the development lifecycle to again physical security policies procedures all of that stuff right when auditors came in they put me in front of them so I had to do it all and I had to be embedded in the development teams as well because we wanted to incrementally improve the security of your product I was there for two years as you may imagine being the only security engineer it takes a toll right and and if you're pushing and pushing and pushing for a

team to be built and it isn't being built then you find yourself wanting to be somewhere else right like it's not a fun job to be the only person because you've gotten other people to collaborate to make you better and that should always be what you're striving to right here you want to make your company better but you also want to make yourself better at the same time and so luckily Rackspace had a spot for me and I went in as a manager of quality and security engineering at Rackspace security engineering falls under quality engineering and it's quality engineering performance engineering and security engineering and I was managing both three teams so I had security engineers

I have quality engineers and performance engineers that I was helping to secure all of the products whether it was bare metal all the way to docker from from Rackspace right as we were putting him out there in the marketplace we're making sure that we were testing them so that we felt that they were as secure as possible sometimes we did it all in-house sometimes we brought in outside help all along this timeline I was a rapid7 client so we had all the product at ut-austin and then I brought it in Hadoop taro so I brought it in at bizarre voice believe it or not I brought it in at Rackspace which was a tall order it took forever

but we did it and because of that ongoing relationship as you guys know opportunities come up and so I had always had my eye on rapid7 local to Austin see all the guys had meetups knowing steam or like all of those things said this is where I want to be right I want to do nothing but security because no matter what role you've had along the way you're always asked to do something outside of security all the time and I didn't want that anymore and so I moved over in August of 2016 to rapid7 to manage help man into the penetration testing team on the services side since then my role has kind of changed and gone back and

forth and now I lead the entire pentesting organization and the consultant development side for rapid7 consultant development because as you'll see we hire folks that weren't consultants and we need to develop them as a consultant and as a pen tester and so we need to do both sides of it right there's always a technical and the soft side of stuff if I want to put somebody in front of a client then they can't just be technical they've got to be able to convey that risk to our clients okay so that's me in a nutshell we're in a squiggly Lane as I think about teams I often think about baseball teams I love baseball I've played it since I was three years

old I still play it now I coach my son's team it's this little guy right here and so baseball is always in my mind right I wake up I look at scores and the afternoon I'm at practices we're playing or we're having our games and and to me baseball is a great team sport and very much analogous to the stuff that I want to do at work with my teams I know it seems kind of funky but it actually works because I think about who is the pitcher right that team lead who's the catcher that guy that has that knowledge of the team for a long time who's my rookie right fielder who's that star centerfielder right who's that

all-star shortstop and you need all of those people on your team in order to make that team really successful right and guess what the right fielder is actually good right it isn't just the worst player on the team that you put out there you want to think about that team as you're building it and this is what helps me so I'm not saying you should think about it in baseball terms but find that thing that you like that you enjoy that makes you think about a puzzle and apply it in a way that helps you to put your teams together right because there's always that right all right so as I started to think about a

team that I was asked to build for rapid7 when I came in you know the director at the time said listen I need you to hire 12 pen testers for this team that you're gonna have and immediately I was like 12 you're nuts like it took you six months to find me it's taken us on average three months to find the next pen tester for the team how are we going to do 12 in 12 months and you said well that's your challenge I said okay challenge accepted right like what else are you gonna do I just got here am I gonna say why I can't do it so I took it on and I said okay let's

do it and so I started to think about how was gonna build that team who my shortstop my pitcher etc and as I was thinking about it I started to go back to all of the roles that I had that prepared me to be a security engineer or a pen tester along the way and I wasn't going to find folks like me out in the marketplace unless I was willing to pay high money right and luckily we're in an industry that pays as well but unluckily we're in an industry that pays well so it's hard to put a team together given budgets etc and so rather than try and find individuals like me or the really

experienced pen testers I had the idea to say let me bring in individual people that I've held the roles that I have held along the way that have an aptitude for security testing that want to do it or want to learn it and that's how I started to kind of say ok I think I can put this team together Austin luckily is a tech hub right we've got all kinds of technology companies there all kinds of technologists in the Austin area whether they're developers DevOps engineers even data analysts etc right now they're everywhere they're there's all kinds of companies and so I started to think about like who are the people that I want on my team that I

think that can help each other to become pen testers and consultants and so I put together and this is just a short list really it's a list of icons that I could find that made sense for the role so that I can put it up on my slide developer obvious right and data analyst Technical Writer malware analyst quality engineer ethical hackers security analysts network administrators and the list goes on and on and on right because every one of these roles I have to know in order to properly pen test my clients environment right if I don't know aspects of this then I'm gonna miss something there's gonna be a gap there there's gonna be risk that I didn't actually investigate

right and so I then took this list and really started to say great but how are they gonna help each other and so this is what we'll talk about right once I found a list then I needed to talk to my talent acquisition team right let them know exactly who I was looking for let them know where to look for them understand what kinds of teams right we needed to be loved what companies I wanted to actually go after what personalities why we were doing it right you can't just expect your talent acquisition person to your recruiter to get it immediately so it took ongoing conversations right and she started mining and then she would put people in front of me and then

be like that one was closed but this is what's needed and so having that continuous kind of feedback for that talent acquisition person to really understand what it is that you're looking for and why right and initially it was way off the mark right it was like nope they're way too junior right a developer they actually didn't even know what security testing might be and so let's do a little bit better right luckily security is penetrating better into all of the other roles right and so I didn't have to find individuals than you nothing about security we wanted to find individuals that already had a security component to the role that they had right that we're already in a

secured development lifecycle or they were already part of the change management team or they were already part of the risk management team or the audit team or the acquisition and mergers team right like all of these components are all of these roles have a security component that helps you to kind of start in the right direction so she started to do a great job she started putting in front a lot of people that made a lot of sense a product tester from plain Tronics a technical writer from the state a malware analyst local you know a recent graduate but had already been super involved in the security community in Las Vegas speaking of besides having talks and

interviews and all kinds of things right like being involved in the community and that's what we wanted to see and it was great we were getting all of these folks but we needed any read them we need to really figure out are these the folks that we want on the team we think we do right they're the right persona they're matching all of that criteria that we talked about with talent acquisition but do we actually want them on the team and so really what it boils down to is to putting together another team right and initially I had no one because there was nobody on the team right I had to hire but we did have other pentesting teams

we had the Metasploit team we had our sales counterparts we had all kinds of other teams that can actually help me to tell is this the right person is this the right person culturally is this the right team fit aptitude wise technical ability do you feel like you can work with them and so put together that interview team that is multiple people right whenever you interview for any of my teams you're talking to five to seven people right there might be 30-minute conversations or it might be an hour with two people on the line but you're talking to that many people because we want to see is this an individual that these seven people feel like should join

the team but not just that they're interviewing you as much as you're interviewing them so by putting together a team and having seven people they get to know more people they get to understand the company better they get to understand their role better and so it's a kind of quid pro quo right they get something we get something at the end of the day if we're gonna make an offer then they already feel like they know they understand the team they know players on the team etc right it's like playing catch and making sure that you want to continue to play with these individuals right okay so before I go in there there's another piece of it that

was really really important and that's talking to your HR department and rapid7 call the people strategy and then talking to your finance department as well right figuring out exactly what that pay band is for this role that you are creating right this was in a pen tester right as a matter of fact the title of it is security analyst whereas we have security consultants senior security consultant and principal right and so they didn't even have consultants attached to it yet because we were looking for individuals that weren't necessarily a consultant that we were gonna turn into consultants right so they helped me doing the market analysis does this fit within the industry and within the industry does the pay band

fit is this where we can actually go and find the people that you're talking about that you want to find right that's really important because then when you have somebody in front of you go ahead

it's awesome that with everything that I already said you already got there right because that's exactly what we were doing right I was putting together a bull pen if you will hello another baseball term right where people could be playing could be catching could be learning could be you know learning how to throw that curve that slider that circle change whatever right and they're building their skills and they're playing along with other experienced professionals that are already there so that they can learn from them as well that's exactly right that's what I wanted to accomplish right the tricky part here is that within that band of financials right they actually needed to make their own money to pay

themselves right so they have to be billable they have to be utilizable that's just our consultant organization works right yes they carry a salary but that salary is paid out of the billable engagements that we put in front of them from quarter to quarter cork and so that was a huge challenge for me to be able to say what kind of engagements can I put these individuals on great and so be thinking about that and we'll talk a little bit about it in a sec cool so they're new right day one here they come in my opinion day one isn't day one day one it is two weeks prior right three weeks prior a week prior whatever that

period of time is right you're already reaching out to them you're already saying hey I'm glad you're on the team here's some stuff that you should know what kind of equipment do you want right for us we've got two separate packages you can be a Mac guy you can be a PC guy and then we'll give you a laptop with an image and another laptop without an image so that you can imagine so I need to figure all of that stuff out to give IT the heads up that they need to provide this for them but it's really about welcoming them right for some of these folks I made the move from Atlanta from all kinds of places right and so

hey how's the move going have you found an apartment you know we're providing your relocation assistance that that come already like being engaged before they land on day one because they're already nervous about that move there pretty nervous about starting a new company and so anything that you can do to kind of set them at ease before they even land it's gonna mean that when they do land they already feel comfortable right if you can if they're local have a happy hour before they even start right I have the team out so that they can get to know the team in a social event and not on day one now they've got to remember however many names right plus

all the others for the office it's an awkward situation you guys have all been there and have all thought god I wish my day my first day was better right so be thinking about that for sure have their station already set up right whatever it is that they told you they wanted then make sure that you acquire it and then you have it set up for them and it's ready for them to use on that day one right we've got like dual monitor setups and standup desks and all of that stuff are like make sure that you've got what they need and ask them right like how do you work better are you a stand-up person

are you gonna sit down person are you a mobile person right you're always like I'll set up wherever we can accommodate all of that at rapid7 think about what you can do where you are and start to put that together for them so that when they get there they don't have to waste time asking for an anti-fatigue mat or a bar stool highchair or whatever it is they need it's there right they're not wasting time not feeling like they've got to do stuff have a new hire journey for them right make sure that that you set out exactly what you want them to accomplish in that first week or in that first two weeks right like what does it look like

to be a new hire work with people strategy work with your office manager make sure that there's a tour have swag set out for them so that they know like a we value you here's some stuff that you can help us advertise out there when you're out there right have expectations and keys to success right like these are all questions say all of you know or or want to know whenever you land that in your job how can I be successful here like what can I do to immediately make an impact and then RIT be ready for shadowing and first engagements they're not here yet but our lead time can be four to six weeks

which means that I can already be setting stuff up as soon as I know that they accepted the offer in that they're coming in right so be prepared just as you want them to be prepared when they first get here you should be prepared for them as well so you know here's these are examples of slides that I actually use for my onboarding stuff you know they they land with rapid rapid seven were moose at singular and it's plural so one moose and so you can see them progress right like they don't have any antlers and as they're exceeding than their antlers beginning to grow yeah it's quirky yeah it's whatever but people notice it right and they under

they see that there's effort put forth into the somme boarding that is not just like wait click here and read this big bulleted list and you know here's a video etc right like make it meaningful for your team help set with that with that personality of your team is with your onboarding materials with with the conversations that you're having right help them understand what kind of team they just landed on here's the other snippets of slides right like keys to success what does it mean to be successful on this team how are we acting as a team etc and then that week one schedule Riley it's not micromanaging you can't micromanage somebody that doesn't know what they're

supposed to be doing on a day to day basis right and so you've got to tell them what it is that you expect for them to do on that day to day setting up their machine setting up internal tools meaning people write all their other roles that are going to help them to be successful here you should be introducing them to them right like don't let them be go out and figure it out because they might miss out on something right so put in front of them all of the folks that you already want them to know and understand right and I know that they're just a representative like arc we've got a ton of Account Executives

and a ton of Sales Engineers but if you find a few that you really like how they work you really like how you work with them together then bring them into the fold and ask them to help you on board your team they're gonna be happy to do it right and so that's that's you know if I focus a lot on what are you gonna do when on the first day that you land I've been in that time line at places where they actually said we don't expect anything from you further for six months all right that to me sounds ridiculous because I'm here to work right I'm here to learn I'm here to produce I want to do better

and I want to progress and I know that that's the kind of people that I'm hiring because I'm hiring them right so I don't want to tell them like oh yeah don't worry about that it'll be a few months that just sounds ridiculous to me especially if I'm expecting them to be billable as quickly as possible so that they can start earning their keep right so I want to put all of these things in front of them and so if you look at some of the stuff on the schedule right there's already some some shadowing you're looking at we've got kickoff calls let shadow one of those we've got a closeout call that's shadow one of

those you we have internal sex Journal Wireless whatever all the types of engagements that we have let's try and get you shadowing as many as those as possible right oh wait you already come with some experience heck let's put you on a billable engagement right let's do a vulnerability scan with validated findings or let's do an external if you've got that much skill right you'd be surprised how many developers are coming to us with OSAP already because they're super interested they want to know it they want to understand this whether they can apply it to their current role now we're taking it out and saying now it is your role right and so there were some that I was able to get

billable on the third week of them joining right because we were able to pair them up with somebody else that was very much experienced or they came with enough experience that I felt comfortable putting a p.m. alongside with them putting a technical writer alongside with them that they'd be able to produce not just the soft skills but also the deliverables that we're going to make our clients happy and the value was going to be there right and so you want to think about that for every single one of them there were other individuals on the team that weren't available for the first six months that they were on the team right and it's not because we didn't have a plan for them

it's just that their plan took a little longer right and so because they they just needed to learn they needed to become and that's the other thing right don't force it if you if you see value in that individual then work within that value right because if you're forcing it they're gonna be frustrated they're not gonna want to do it and you're going to lose a lot of time and a lot of investment because they're gonna walk right and so as long as you feel like you can support it and then be supportive right cool feel free to interrupt at any point with questions I think it'll be all right training I may be showing my age here

but some of you know who this is and the the thing here is right is that you interviewed them do you know where they're coming from you talked about what they wanted to learn you asked what they already learned and so you know them pretty well by the time they started so you should also start to be thinking about where are the gaps and what kind of training do I need to put in front of them so that I can get them billable as quickly as possible right whether it's you know how to write reports or whether it's how to attack web applications or api's or whatever other technology right that they want to test then you want to put that training

in front of them rapid 7 we have application of salt we have network assault so those are easy to say hey take these you're gonna learn a ton from it and then we will send them out to individual trainings as needed right so it's important I you know you and then don't forget about yourself too and I think that that's something that we tend to forget as people manager sometime is that we're so focused on everybody else we're so focused on the business that we don't refresh our knowledge right we know my certification lapsed or I want to go after that other thing but when am I gonna find time to do it carve out at that time really it's

important and then it is about that supporting cast right so we want to make sure just like we talked about earlier that that bullpen was a collaborative environment that they were actually coming into the office right because it's easy to work remotely but we wanted to ensure that everybody had the opportunity and we weren't we I didn't hire 12 people on the same day right it was a period of about 10 months that it took to actually get to the number and so that meant that there were folks on the team that already had a lot more experience by the time that somebody else landed so they now become a part of that supporting cast right how did you

order your Amex oh I know I just did it last week yeah I mean even with that right you need support because it isn't always about the technical right the technical might actually be easier for that individual to learn on their own read a book you know go through a course whatever but it's really about everything else and so you want to have a good supporting guest at rapid7 we're very lucky that we have a full team of project managers to work alongside all of our consultants so they don't have to project manage we have a team of technical writers that are helping to deliver the high-quality reports we have a stable of like 34 pen

testers now which means that any questions right can be asked and answered by the team and that's not just on learning or training it's also on a live engagement right if you're on site and you come across a technology that you've never tested before or you're stuck on then you know that you've got the support of that entire team to help you through that engagement right and deliver that value and so that's important that you continue to to foster that collaboration and that team identity so that they feel like they can reach out to each other and work together right so that supporting cast is extremely important to have you as the manager you know you have to

be there Platt you have to be there defense you've got to move barriers you've got to make sure that they have everything they need to be successful and then you also have to block right anything that is kind of asking for their time you've got to be aware and you've got to be able to say yes you can or no you can and here are the reasons why and don't feel bad about it right I think that if you do it with transparency and you let that individual contributor know why they can't go and help whatever team on this cool new thing that is being built then they'll understand but at the same time don't

just shut the door on things right find a way to enable them to be able to do that maybe right now isn't the right time but maybe a week from now or two weeks from now or let's put together a week of bench time so that thank you so that you are working towards that right and then there's there's a goal for it in mind and then all of this should be a scheduled maintenance right you don't just do it at the beginning you should be doing it over and over and over again right have weekly or bi-weekly meetings or monthly meetings whatever works for that individual make it so that they don't meet right so that it's not on you

it's on them to figure out what it is that they want to talk about how do they want to grow etc give them the opportunity to control what they work on right if all I do is put externals in front of somebody and they're gonna burn out third I don't want to do it anymore they're gonna walk right instead if I have a conversation with them and I find out what they are interested in what technologies they want to test right like I want to be your red team operator all right well you're here and our red team operators are here let's figure out how you get there right but figuring that out should be a conversation

it should be something that they're helping you to understand right recognize and reward good work whether it's a beer or at rapid7 we give out guitar picks whenever we feel somebody did something really well do it right like be good about doing it and don't do it for one person and then forget to do it for somebody else because then they'll notice right so be consistent across it I have clear expectations and then reasonable demands right let them know exactly what it is that you expect on them but then make sure that it is actually attainable right and the expectations shouldn't be the same across the board for your entire team because we're all different and we all

learn different and we all apply our learning different so make sure that you're thinking about that provide challenges and work outside of many responsibilities right for me this is really important because I've got 35 pen testers that I don't want to burnout consulting burnout is a real thing right and so what we do is that we actually carve out a percentage of their time for research for Ben's time for you know making sure that they are feeding themselves and not just feeding the business right that's really important to me the reality of it is that because they're doing that research they're still feeding the business but it's really feeding their own personal growth and their own want to do this right

we're not requiring it they're doing it and they're providing it in that in that back sense but then you know that's let's say two to three weeks that they didn't have to talk to a client they didn't have to write a report they didn't have to dress up to go on site they didn't have to do any of those things right so when they do come back to it they're gonna be refreshed renewed they're gonna feel better about doing it and if you continue that good cycle then you're gonna get good consultants that continue to deliver good stuff right and then reduce the chaos in high pressure situations by planning and preparing right for me that means having the PM's

having the technical writers having the managers for escalation having the principles that are working on our technical solutions so that my consultants are really just thinking about their job and how they can handle that job and they don't have to worry about all of these other things or pushes in pools of their time etc and then you write they say and statistics are made up of 80 percent false statistics or something like that the people don't quit their job right they quit their managers or they quit their leadership and so that's why it needs to be a scheduled maintenance right like make sure that you're providing them what they need as a team and that

they're telling you right and also be open and ask is there anything that I or the rest of the leadership team could be doing better right like what isn't helping what is helping what isn't helping and understand they're right like yeah they you need them to act when you ask them to do something but at the same time I also want to sit down and have beers with them right because we drink and so you've got to tote that balance and and they've got to understand that you're their advocate but you're also requiring that they do the work right so find that balance and work through that that one's not easy for sure no job no job should

be too small for you right that's me up in the corner over there taping our lab we moved offices a few months ago we went to an iconic building in downtown Austin called the frost tower and we landed first in temporary space as they blew out in our building or amazing new space we have to make do with what we had making you with that lab space wasn't going to work and so we put in a little bit of effort to make it what we needed to I need it across the windows because we've got client agreements that says that I've have if I'm testing Hardware nobody else can see what we're doing we needed to get rid of carpet and

put something that wasn't gonna have all the static electricity coming from it and so when I'm talking about preparing your team space for that day one that's exactly what I was doing right I was making sure that when the rest of the team landed in the Austin office they didn't open the door to the lab and say we gotta fix this right I wanted them to open that door to the lab and say hell yeah let's get to work right and so all weekend I probably was high on aerosol like I not probably I was pretty high on air so and you know you bring along some of the guys that want to help because

then they feel the ownership they're gonna keep the lab clean they're gonna want to work in that lab and so yeah no job should be too small right like whether I'm in front of our board or whether on my knees putting floor down it's all for the team right and that's that's what they should see coming from you I don't know what my next light is and it ends abrupt so all of this is to say right like I've been at a lot of jobs and I've seen the good I've seen the bad and I've taken them all to try and make it so that the good is what my team sees as they are

working and rapid7 and progressing yes

I've led teams in all of those and so for me I think it's more of a hybrid for the current team then well I'm leading a team of managers right so that's those are the folks that the report directly to me or the managers that are now kind of leading these individuals and so we have to be very agile but then we also have to be kind of very pragmatic with the things that we're doing and the the upper management that we're dealing with and the clients that we're talking to right and so we're agile at the individual level because I need them to pivot and pivot quickly and so it's very hybrid yeah any other questions yes yeah

work-life balance is a myth I don't like the term but I know it's important so I'll talk about my work-life balance right I think you have to manage it yourself I don't think that you should expect your company to manage it for you we know you as individuals but we don't know where that stress trigger really is and so we can help you to manage it I've rapid7 we have unlimited vacation and so as long as you can work that through your manager and the business then you can be out for two three four six weeks if you need to are scheduled right for our let's just talk about our senior security consultants there's 75% utilizable 25% balancing

right see it's not balanced it's not 50/50 so that's why it's a myth why that 25 percent allows them to then do research or take vacations or do the things that they're interested in doing so that they don't feel the pressures of the job all the time right for me it's playing ball on Mondays it's coaching on Wednesdays playing with the little leaguers on Thursdays and Saturdays and practicing again on Sundays right so my balance comes from being on the baseball field and I make sure that I make time for that right luckily a lot of that time is weekends and evenings and so that's that's how you have to figure out what it is that is going to reinvigorate you

to get you back at work and your best any other questions yeah I think that there is but I don't think they I don't think that the the kind of generalization is truly there right I've hired a lot of young kids and I do call on my kids because they're really young right like I'm 43 years old and I'm hiring 25 24 year-olds right so they're nearly half my age and they're extremely high performing super responsible and they're they're doing really really well to progress yeah that's exactly right right and so what helps is the fact that they've got to talk to seven people that are going to say yay or knee right and so we vet those individuals and that

personality in etc do we miss yes right we had to let go of somebody because after four weeks we realized this is not the person right and that's another thing like quickly here I like if you know that they're going to draw away from your team then let's let's not have them here Riley and that stuff you're affecting a life but then you've got ten other lives that you need to worry and concern about right and then we lost somebody else that after four months they realized the consulting life isn't for me right like I didn't realize I needed to go on-site as often as it was happening and we've got family and all of that stuff and so they decided to go

back to where they were before so we do miss it's gonna happen boy 2 out of 14 it's pretty good for the year it's a great question any other questions sweet I'm all done thank you guys [Applause]

you