Working Against The Clock: Cyber Security - The Infinite Game - Ryan Pullen

oh no no fine brilliant thank you very much for coming so my name is Ryan Pullin I'm director of cyber security for a Bristol based mssp called stol we provide 24/7 cyber security services pen testing and everything in between um my talk today is is a little bit about some of the lessons I've learned uh probably the hardd way and trying to dispel some of the myths and some of the rules that I've learned along the way um my career I've done everything from instant response to pen testing to consultancy did some pen testing on oil rigs and bumped into various threat actors like lapsus and Aira and maiz and all sorts of other weird and wonderful

people along the way so this is something that exists in our industry um regretfully but the the stories that I'm going to tell today is obviously going to spare some of the information but the learning that comes from this is the key point because I don't think it's things that you can learn from courses and you learn typically by you know either being smacked in the face or uh learning through long nights and making simple mistakes okay and so throughout this talk I'm probably going to come across things which seem ambiguous but there will be a point towards the end okay so my first large incident and what it taught me respect begins with remembering names so

when I had my very very first significant incident this was a very very large company and it was a complete top down wipe out of their systems ransomware attack everything was impacted right all of the systems were offline I was the person that took the very first phone call from the head of security that I was speaking to the I probably about 6 months prior we were teaching a training course and something I've learned probably the the hard way is the greatest purpose is to serve those that serve others it's a quote by Simon Sy there's a few little Simon syn bits throughout this talk but what that means is you know using your skills and

using your abilities to try and protect those that probably don't understand probably shouldn't understand and try and utilize your skills to benefit them and so what I learned from my first significant incident was all of the Fallout that occurs the hard way and so my talk is is about the infinite game and and I'll talk about the infinite game in a moment but the hard way was we saw 250 staff come into work the next day and not know what to do we saw people probably contemplating what where are we going to be in two weeks am I going to get paid and those sorts of things and when you think of cyber security or you think of an incident or

something like that those well it certainly wasn't when this happened you know probably eight or nine years ago and and for me it was really seeing that take place quite literally in front of me and I had to kind of step up and try and make this a good situation for them there was only a lose lose situation then and I it was my job and my team's job to try and turn that around and so my rule number one respect begins with remembering names is those people don't know left and right it's your job to guide them or it was my job at the time and it was very very important a moment for me I was was working with

someone who was very very senior I I kind of looked up to and they knew who I was and they're very it was an intangible skill that I learned from that very first moment was I felt relevant in this space and it really willed me on to try and do the very best I could to change the situation and to change the narrative that that was kind of in front of us I spent probably 33 days on site um weekends and everything and and we were able to get people back up and working now that wasn't just me but I was impacted by other people making you feel like you you can make a difference here and so now I'm a

director in a company is something that I really really strive to achieve so every single new starter in our business um all of the directors meet them because it's very important to understand who's coming what they're here for and what the mission statement is so that's rule number one cyber security the infinite game so Simon Sy has a book called The Infinite game and in Game Theory there are finite games and there are infinite games for example football is a finite game there's known teams so you've got Manchester United verus versus Manchester City for example you know the rules you know there's a time limit you know the objective is to score the most goals and come out a winner for

example and then there's infinite games which there is no defined objective there is no defined goal you don't know who all of the teams are you might know who some of them are for example I mentioned some threat actors a moment ago and they're you know kind of their brand names but also they have affiliate programs you so you don't know everybody behind the scenes and this is something that I learned because I was quite uh goal orientated so when I started working in offensive security and doing penetration tests it was it was quite literally a finite game you get the scope you do the Rules of Engagement and and everything in between and you deliver the report

and that's the end of the engagement but more recently we've or my career has turned to continuous Operations Security operations and keeping people safe and there is a true definitive reason why that is an infinite game and it's because when there's a cyber instent other stuff still happening in other other places you know you can't just turn that off and so rule number two is to save phone numbers a Lifeline in unexpected moments because for me being able to phone the right people you need when you need to bring more players into the game because you don't know who you're up against is really really important and there was a specific moment on the incident that I

pre mentioned previously and it was it was it was around Ransom negotiations and it just so happened that I had met someone from the National Crime agency a few years prior and I was able to find them up and I was able to find them up and they were able to come in and support the narrative for that cause now that might seem insignificant but during that moment and that chaos having somebody else come in and reassure from a an authoritarian perspective and someone that probably does this on a regular basis really really provided that gravitas and so every single person that I meet that I engage with I save their their phone number because you don't know when you

might need it so a little bit of a an image to Define kind of finite and infinite games this really shows the differences and I didn't come up with this Theory this is Simon syak and and his book but when you relate it to cyber security you can really understand and this is something that I pose to people during interviews because lots of people are goal orientated and that's absolutely fine and some people are are happy for that that larger ethic or that undertone to be the reason and their cause for being able to push through this career and so everybody that works in our security Operations practice aligns more to the goals of an

infinite game and being able to support and being able to drive that narrative for example one of our clients is is an NHS trust and so one of the questions I ask in an interview is you know what motivates you and some of those things and there's a common Trend which is you know borderline helper complex wanting to be able to support other people which gives them their fulfillment right that's a commonality with lots of different people but when you can take a very technical complex high pressure environment skill and understand that tomorrow is not going to be any easier it really drives that abilities for sustainability we hear about turnout and we hear about turn over and burnout

sorry in um in security operations and cyber security and you know it being quite vast in some roles this is something that I've tried to utilize to understand if people are doing it for the right reasons if it's their first role because realistically speaking you don't want to be caught in that situation you don't want to be on a night shift by yourself and you know kind of in yourself is not right you don't want to go down that path and so what I Tred to do is guide people from that perspective and that's why my talk around the infinite game really represents some of those hard times and it's when it's you're in that more

extreme circumstance if you like and so I kind of learned this the hard way because of instance that I I I was kind of put into I didn't have a defined role um a few years ago and I was involved in a bit of everything and when I found that I was able to really like influence these people's uh situations and make situations better for them it really gave me that that boost and fulfillment and that's not to say not to say you can't in other areas like GRC and penetration testing and open source intelligence they all play their place they all play their role but for me it was really the investigations in finding

out what had happened when it had happened and given the the confidence that the same situation is unlikely to happen again you never say never in this game obviously but it was unlikely and so my third role is be end of day not end of week the reason being is if you're end of day and not end of week you're probably seven times quicker right and so if you can speak to the client or speak to the person in trouble or speak to the the the issue that is occurring at the end of each day they come in the next day reassured if you don't do that and this goes for all situations in my life

whether that's a team member going through difficulty at home whether that's um you know sustainable development or what whatever it is I try and apply apply end of day not end of week now that's not always practical because you need more time to be able to give people a tangible update but them knowing that that process is under is underway is really really key and I learned this the hard way because there was an incident occurring and I was the person that was uh kind of principally investigating it and it was my job to provide updates to the board and it it was felt that it was kind of out of control because they didn't know what

was happening and it was because you know data was paring and whatever else perfectly reasonable reason from a technical perspective but what they were trying to understand was is finance going to be a back up and running do we need to start letting people go and so I then made sure every single day I gave an end of day update so they understood exactly where we were at to inform their next day decisions so human behaviors and emotional intelligence in cyber security this is this is challenging because you're coming at it from lots and lots of different perspectives lots of lots of different goals as well so lots of people are fighting for availability some people are fighting for

confidentiality and integrity Etc and so the aggregation of marginal gains and wonder great change is kind of famously published by Dave balford who was the performance cycling coach for sky and he took our our cycling team to all sorts of wonderful successes because he looked at small in tangible differences that when you extrapolate over a longer term made a huge impact for example one of the things Dave did was every Hotel the team sleeped in on their tour or on their training programs when they're going through the mountains in France Etc was he he made a team designed to take mattresses out of those beds and put the right mattress in the beds so their body composition didn't change and

when you don't change your body composition and you're a performance athlete that 1% makes a huge difference over time and they didn't look at time they looked at ther so they looked at the amount of energy that they would expel and they know they knew if they kept up to 4 400 repetitions they would beat everybody there no one else was was training to do that and then there's aerody aerodynamics and everything else in between what does this mean mean in cyber security this means don't just look at the big goal break it down into small pieces and sometimes if you look at a a significant incident like a ransomware attack it can be quite

overwhelming and it's your job sometimes to see the wood from the trees and provide guidance to this organization that okay there is tangible steps there is a Next Step here's what we can do and if you do that and you look to improve 1% each day or one degree of change if you start on the same parallel lines and you change by one degree where you end up in the end it's really really quite different and so that incremental difference is really really key and so that's not trying to solve everything in a week that's trying to solve things over a longer period of time like a year okay and for me when you try and build a

team that's focused on that and you give people the time and the creativity some of the changes and and what comes out of it is way way way better than you could have ever you know stipulated it you know if people who are empowered to create that change it can be really transformational on the r return side remote working has changed the way we collaborate quite significantly and I'm sure most of us here probably work from home to some extent um or or in some capacities and the reason why I felt to put this on the slide here and align it to the infinite Gamers lots of teams don't meet each other anymore and it's difficult to build those

relationships and especially when you're putting pressured situations so for example you've got a deadline or you're working on something collaborative Now teams and zoom and all of those sorts of services are great but being able to build those interpersonal connections has really really transformed the way I think difficult challenges represent and so what I try to do is be available be available and be present where you can and so if you're on a client site and you're able to shake people's hands it builds trust and it builds confidence that you've got the problem and you've got the solution couple that with the other rules so far you're moving in the right bouns you're able to be available

you're able to contact people and you're able to represent you know the challenge and the goal that is at hand now this is the biggest one when it comes to emotional intelligence now people are going to make mistakes we've all made mistakes well I believe we probably all have whether you like it or not um and for me it's understanding okay what do we do when that thing goes wrong what does that thing represent when that thing goes wrong because I think Elon Musk said this once and you know put your political views to aze he says if I give people the opportunity to be able to create they're going to be able to create the pro the

the solution for the challenges that they are seeing which I am probably not and so being have being able to have the flexibility in the foresight to be able to improve those things will have compounding effects now I've got a young son and I had four weeks paternity leave by removing me out of the way and letting people just get on with stuff because where people would have invited me to a meeting or I would have thought about it from a different perspective some of the most transformational changes in my practice occurred because people took it upon themselves and put you know put the backpack on if you like and and started leading and so if if you

are in a position of influence maybe try that maybe try hackathon maybe try giving people the opportunity to be able to have that creative flare where they know they can't fail so there's a lovely quote um I can't remember who say it said it sorry but they said how big would you dream if you knew you couldn't fail now that's quite profound and that's quite inspirational Etc but realistically is if you're a leader in a business or if you're a new employee and you think like that and you and you're able to think you know over the boundaries and over the barriers you can really really have small tangible impact that extrapolates on a bigger scale

which is your one one degree of change and so my rule number four is Master the present and control what you can try not to worry about what you can control because worrying about every threat actor or this isn't quite good enough isn't probably going to do you too many favors over the long term but if you focus on incremental changes on a consistent basis where you start by day one and where you start by day 365 will be a very very different

place this is probably one of my favorite quotes comparison is the thief of Joy has everybody been in a situation where you feel like you don't belong or you're not good enough or you're insignificant etc etc right now this isn't weird everybody has this in some regards whether you're at the shops whether you're in a career whether you're is doing a hobby you're doing a hobby for the first time and you know you feeling that like kind of social anxiety and everything else in between that's something that exists for everybody in different capacities okay and so for me in cyber security there there's this big bravado you got these big figureheads and there's this you know this hack happened over here

and this company's been hit and everybody's saying their pieace and saying this you know you should have bought this silver bullet product you should have done this you should have done that now everybody's dealing with the same information okay they're dealing with the same information and they're looking at it from the same perspective because they probably don't have any information more than you and so if imposter syndrome is something that impacts you focus on the one degree of change because if you're playing an infinite game everybody's playing the same game everybody's playing with the same amount of Fitness everybody's playing with the same amount of stamina and everyone's playing with the same amount of time and so imposter syndrome

can be your biggest enemy feeling like you don't belong when actually you might be the person that the the next person is suffering as well but they just don't show it and so when you combine forces and you can work as a team you can make huge impacts which brings me to my fifth rule look at those look at that transition um I was doing that last night um First Impressions shape lasting perceptions okay so if you go in feeling you know this imposter syndrome and you don't belong and you're not significant and you shouldn't be there that person in rule number one that remembered my name completely changed that for me in an instant completely and I was able to

focus on what I was doing not am I am I doing something wrong because there's this person with 15 years more experience now that person probably does know more than me but it's not going to be so much so that I'm not able to do what I need to do and help them achieve what they need to do and so first impression shaping lasting perceptions is something that I really try and fortify you know strong handshake for me is something that I I always try and represent and for me that's because I want to be there I want to be present I want to be in the room I want to control what I can which is the

last Rule and I want to focus on what am I there to achieve and you know move my phone away and I don't want to have those distractions because for example if that's a team one to one I want to give them the time and attention to represent what their challenge is and see it from their perspective and listen and help if it's a customer I want to give them the time and attention to be able to represent the challenge and it might be something that I have no idea how to fix but that's when you take it to the team for assistance or that's when you start going look I've not fixed this problem before I've not been in

this situation and I'm going to try and uh appropriately you know amend you know the issues ETC and take that feedback onone which comes down to Performance versus trust now this is another Simon cynic thing I really need to come up with my own but it's just it really encapsulates uh the values and the reasoning why the infinite game is really really important to me and so I focus on enabling trust and enabling honesty everyone starts with that I'm I'm I'm reasonably unforgiving when people lie or deceit or or try to manipulate things right and so Simon talks about High performers and high trust and this is a relative scale and he talks about this in a in a much more

eloquent way but what this represents in cyber security is you're only as good as the information you have and you only are as good as the information that is communicated to you and that's something that's really difficult in this industry because things move so quickly and because things move so quickly you can't communicate all the time and so you need to be quite succinct and so when I'm hiring I don't hire based on necessarily skills unless it's for a specific task right and it's probably a short-term Challenge and I need that skill and I need it now I look to build High trust in my teams because I believe you can learn skills and I

think I can build an environment where you're able to learn skills from other likeminded people and when you put two people on a task and you're working together and you've got a paddle body you're able to take that challenge on together and so what Simon talks about is you want everybody wants the high performer of high trust right so they've got the skills and everybody loves them and everybody trusts them now a medium performer of high Trust might be someone who's newer to the industry but they're always going to tell you what mistake they've made they're always going to tell you what pitfalls they have and you are able to make confident decisions based on what they can do confidently

and what they can't now a low performer of high Trust might be a new person into the team or they're picking up a new skill right now where you don't want to lean or from my perspective at least is anywhere towards the low trust spectrum because they might be fantastic at their job but other people are probably going to suffer and so if you are playing an infinite game in particular where there is no end and you just solved that incident and you've just solved that problem and you know next day is going to be different and Monday's coming around the corner and you've got to turn up you want team who trust each other

and see each other as a unit and it's not an individual's effort it's the team Collective goal now all of that sounds all high and mighty but I think when you collaborate sorry corroborate that into a long-term pathway you might have superstars in your team but the real Difference Maker and this is something that I really celebrate in my teams is when there's an incident right and you need out of hours escalation Sport and you bringing somebody else in and they don't say what's happened let me get involved they take on all of the other stuff that no one wants to do that's high trust because that's the the understanding the goal that's understanding the team and that's

understanding the challenge at hand wa that was a that was a crazy one so rule six always be honest always have a plan and always expect ad viry so the ideal team player when hiring so everyone can write a CV chat GPT great everyone sounds lovely and eloquent great grammar is no thing big deal um this is what I focus on great book by Patrick lenon is called the ideal team player and how you how you try and find the in the intricacies from each of those individuals and what it makes to build a team player now this rule is no surprises but be the teammate you always wanted because when that person turns up and

you really need that trouble some help and they're able to even if they can't fix that issue but they can can take some of the stuff off like whether that's like super small things like go and get food or order your pizza or whatever small things that you don't need to do it really just gives you that morale boost in those times of difficulty everything I'm talking about is the things that you can't learn on a course in my opinion these are things that I learned the hard way and I've I've focused on this for probably two and a half years and my team has exceptional tenure in high pressure circumstances and it's because that's what we look at and

that's what we reward now everybody has their own attributes and everyone has their own skill sets and disciplines but what we look at is the team goal things that every single individual needs to look at every single individual needs to pull their weight and for me that's such a key principle when building a team is to look at how they're going to integrate and and the interoperability so this is all a bit manage management paragraph and pyramids and all that sort of stuff but what this is actually focusing on is what's in green so self-actualization is the real epitome of everybody's fulfillment and this is M maso's principles and hierarchy of needs and self-actualization is you know

you're you're very happy you're fulfilled you can earn enough money your home Life's good you've got enough work life balance and you're able to do what you need to do out of work to fulfill what's inside of work is is the principle now my favorite bit of all of this is understanding that you don't need to have all of the answers you don't need to have all of the fixes for everything but when you bring the right pieces together and you can work collaboratively it can really have a profound impact and so the Navy sealers have this rule the one is zero and two is one you're not allowed to do anything by yourself okay now in in business land that's not

very efficient it's not very practical but when you're facing a problem and you're not a able to overcome that problem asking somebody else who has doesn't have all of the information that's coming from a completely different perspective might just be that person that gives you that light bulb moment it's happened time in time against me always happens when I'm walking the dogs right and so I had uh two people um leave this is this is quite a few years ago but two quite High influential people in my team leave at the same time nothing to do with the business not just personal circumstances because they had better opportunity and they were able to do weird and wonderful

things that it was their passion huge respect for that and so in myself I didn't know how to fix this challenge right and it was only me I knew what we needed and and I kind of really self-imposed that pressure and so I worked all weekend trying to figure out the challenge and this isn't associated the self-actualization thing but the one is zero and two is one I asked one of my colleagues how you know what approach we should take and effectively we just went on offense and we went and found what we wanted and we thought about different tooling and we thought about different Personnel we thought about okay can we build up from

within and that one moment was all that that it kind of took to really emphasize and influence for the larger goal and so the rule is what the what is zero and two is one rule for me really represents the be curious not judgmental which is a quote from Ted lasso which is a quote from an American public poet sorry um and for me what that means is don't judge things that face you know face value try and be curious try and understand the challenge try and understand the situation because by asking the right questions and being specific when you ask questions can make much easier when you come to the actual outcome and the goal and when you seg

mment it and you implement the 1% Rule and you're trying to improve over time things can become a lot more segmented and a lot easier to digest so you don't have to have all the answers I think I've done yeah I have so this is from a book called radical caner I learned a lot from books I only started reading properly you know a few years ago and I've learned tremendous amounts about you know kind of my inefficiencies and things that I probably would have seen the challenges differently I'm going to put them all up here and the rule as well so rule 9 approach with purpose question with Precision I touched on that on the last

one so radical cander is the principle of making sure that you are driving the end goal for everybody's needs and so be open honest and directing feedback don't pull don't pull the punches but you don't have to be disrespectful right so you can ask for help and if people are slacking you can you can say you're better than that I really need you in this moment and then people might go oh right okay yeah or they might divulge you know other challenges that they may be might be facing sorry listen actively actually listen and digest what they're saying don't interrupt don't provide Solutions just understand their perspective don't try and fix the problem Simon s calls is sitting in the

mud I don't like I don't really get that but um avoid ruin of sympathy so don't withhold back feelings sorry feedback and to spare the feelings so people sometimes need the hard truth they need the challenge to be able to improve themselves I think we probably all know someone that probably could do better if they just told you really need to like tighten these bolts up you need to go that extra mile or you you can achieve more if you want to but they probably haven't seen that or they're you know self-deprecating they're having imposer syndrome or they're not seeing what you are challenged directly and caring personally is balancing honesty with empathy so that's that's just a real

synopsis I really recommend you read the book it's it's changed the way that I approach the challenging situations when you are looking at something quite uh binary and there's probably more context to the situation now how does this all tie into the infinite game if you approach situations with some of these rules and some of these approaches it can really change the perspective on how you face The Challenge and that challenge you know sometimes will be significant it might be for yourself it might be how does someone you know progress in their career it doesn't really matter you know it might be how do I achieve you know my first job in cyber security for

example asking questions with purpose and being concise to make sure you get the right answers is something that I've learned the hard way you know everybody's had an email where they've written a question and the person's just completely ignored it or they've answered something different from a different context be precise if you can think about you know from a different perspective if you don't have all the information how you would answer it coming to the end now so my 10 rules I've only shown you nine my 10th rule is operate with integrity and never give up so this all sounds you know high and mighty and quite leadership driven and and focused from that perspective but if

you are a player that is driving the an infinite game you can't give up because the team needs you there's goals at fo if it's not right that's not given up that's changing game right and so open operate with Integrity is because everybody needs you to play your part I play your piece of the puzzle and so for me I learned all of these the hard way or I was taught them by other people and it's massively shaped my career because I try and do these things you can't do them all at the same time obviously but if you do these things your probability for success in what you want to achieve will be true to who you

are and what you want to establish and and you know take home with you I do have one last slide and you can scan it if you want but that's me on LinkedIn my I've I've only put my letter in my surname but it actually is a LinkedIn QR code but don't scan if you don't want to it's not going to blow up or anything um and so feel free to connect with me if you have any questions that you want to ask um more than happy to answer them I know I've gone quite quick but there's quite a lot of content and different narratives and different stories at foot how long we got for questions so

we've got about 10 minutes for questions cool okay so uh first things first testing this microphone works which it doesn't hello hello hello nope as if we tested it beforehand hello hello hello there we go perfect question oh yeah this is a Pity [Laughter] question I think your rules two and have a plan perhaps a little bit more in the we but around um I go the go to the Galaxy don't panic but or glasses whatever you want to say they um do feeding plans would you say that organizations or support organiz organization are support things with those not indidual no question so I can't remember who said it but if you if you don't plan

your plans to fail etc etc same thing applies right and so one of the things one of the first things we do when we're on boarding a new organization and we want to work with them and we want to be able to en en Foster that trust let them have the responsibility you know let them be able to dictate how they wish to operate with us you know what are your critical assets who do we phone if something goes wrong but principally what what are the key First Steps in containment and understanding what challenges you know are represented to you as a business for example if you're a finance broker or whatever that system must stay up online and so having

a Playbook around that to say this is how we protect this asset and this is how we play booked it against these threat actors and common Meador operandi etc etc it's really really Co yes fantastic thank you anym for anymore questions um anyone can write an amazing TV yeah what gets someone in front of you what you look out for that's a good question um so sorry could you repeat the question yeah of course so the question was everyone can write an amazing CV uh what gets people in front of me and what stands out to me now I'm I'm probably the worst person to ask that question to because I'm quite sporadic because I I I'm quite gut L

right and so I was giving um a talk to to a seminar of people who are going through a conversion program it's quite famous one that you know people go through a six we 16 we training course cyber security all this sort of stuff um and I gave a talk and there was two people talking about you know personal lives and all that sort of stuff and I I I turned up um and that that car carried on for about six or seven minutes I have no issue with that whatsoever I'm there to you know try and help her Etc and one person stood up and said guys should we get on with what we're here

for we can talk about this any other time and that really stood out to me because it's putting yourself out there it's putting your head above the parit and exposing yourself and I heard him I heard him because I thought I can work with that and it wasn't just based on that obviously it turns out he's a triathlete and he's you know very endurance L and so I was thinking right okay where does this take some of the boxes yeah right right yeah cool and so then we taught the skills and so that inner Instinct and way that he held himself and the first impressions matter and all of those sorts things really really made a difference to me and so

I've hired lots of people you know I've hired people who were scaffolders and come work for us people who fit home Cinemas we've had vets we've had um lots of ex-military ex-military are you know traditionally speaking expect adversity in different uncommon situations and so those are the things that I look for in interviews I'm not I like I care about your CV but I don't think it defines you because my journey into cyber security my first interview came from um my mom found a job application on Gumtree and the person happened to have recognized my surname wasn't related didn't know who I was but it got me an interview took the opportunity and I worked with

people who are sat in this room took the right chances said yes in the right situations and so there's always a bit of luck involved right the last cyber security analy position we had we had 800 applications in the first day and so be being a CV is not good enough really and that's really really disheartening and like hard to say but coming to events like this shaking hands meeting people meeting people like me because if if I remember you and you ask that question and you apply and you go I was you know that's there's something there you know it's a little bit different any other [Music]

question how would you de with someone [Music] this is where I get in trouble um so I move fast and so I hire fast I promote fastest but I also get rid of people quite fast too and so it's it's difficult in those regards and there's always always a commonality or a cause for it not looking for it people either haven't you know and it's not get one chance and and then it's done but for me if there's inherent positioning or the way that you choose to operate or you're not looking out for the team to be honest if you're looking out for yourself and you've done something you've taken something off somebody else those things are definitely not going to

go in your benefit and so your longevity in post often you know is stunted based on that but that's only with me I don't think other other organizations run that way no problem got time for one more question so any takers no in that case um thank you very much thank you very much