B.E. Sixth Semester (Computer Science and Engineering) (CBCS) Summer 2022 Security Policy and Governance: 6 KS 01
- importance of the CIA triad and its components:
The CIA triad is a fundamental concept in information security that represents the three main goals of protecting information: confidentiality, integrity, and availability.
1. Confidentiality: This component focuses on ensuring that information is accessed only by authorized individuals or entities. It involves implementing measures such as encryption, access controls, and data classification to prevent unauthorized disclosure or access to sensitive information.
2. Integrity: Integrity refers to the accuracy, completeness, and trustworthiness of information. It involves safeguarding data from unauthorized modification, deletion, or corruption. Techniques like checksums, digital signatures, and data backups are used to maintain data integrity.
3. Availability: Availability ensures that authorized users have timely and uninterrupted access to information and resources. It involves implementing measures like redundancy, fault tolerance, disaster recovery plans, and network resilience to prevent or mitigate service disruptions and ensure continuous access to critical systems and data.
By focusing on these three components, organizations can establish a comprehensive framework for protecting their information assets, maintaining user trust, and meeting regulatory requirements.
- define and explain the infosec processes of identification, authentication, authorization, and accountability:
1. Identification: Identification is the process of recognizing and establishing the identity of a user, system, or entity. It involves providing a unique identifier, such as a username or employee ID, to distinguish individuals or entities from one another.
2. Authentication: Authentication is the process of verifying the claimed identity of a user, system, or entity. It ensures that the person or system attempting to access a resource is indeed who they claim to be. Authentication methods include passwords, biometrics (fingerprint, facial recognition), smart cards, and two-factor authentication (combining multiple authentication factors).
3. Authorization: Authorization determines the access rights and privileges granted to an authenticated user or system. It involves granting appropriate permissions and restrictions based on the user's role, responsibilities, and the sensitivity of the information or resources being accessed. Access control mechanisms, such as access control lists (ACLs) and role-based access control (RBAC), are used to enforce authorization policies.
4. Accountability: Accountability refers to the responsibility and traceability of actions taken by users or systems. It involves keeping a record of activities, such as log files or audit trails, to track who accessed what information, when, and from where. Accountability helps in detecting and investigating security incidents, ensuring compliance, and holding individuals or entities accountable for their actions.
These processes are integral to establishing secure information systems and protecting against unauthorized access, ensuring that only authorized users can access resources, and providing a mechanism to track and investigate security-related activities.
- What are the characteristics of management based on the method described in the text as the "Popular approach to management"? Define each characteristic briefly.
The "Popular approach to management" refers to a set of characteristics that are commonly associated with effective management practices. These characteristics include:
1. Clear Objectives: Management based on the popular approach emphasizes setting clear and specific objectives for individuals, teams, and the organization as a whole. Clear objectives provide direction and serve as a basis for planning, decision-making, and performance evaluation.
2. Decentralization: This characteristic involves decentralizing decision-making authority and empowering employees at various levels within the organization. Decentralization promotes greater employee involvement, autonomy, and responsibility, fostering a sense of ownership and accountability.
3. Employee Participation: The popular approach encourages active employee participation in decision-making processes. It recognizes the value of diverse perspectives and contributions from employees at all levels. Employee participation enhances motivation, commitment, and the generation of innovative ideas.
4. Open Communication: Open and effective communication is a vital characteristic of the popular approach to management. It involves fostering a culture of transparency, where information flows freely among employees, departments, and management levels. Open communication facilitates coordination, collaboration, and the exchange of ideas and feedback.
5. Flexibility and Adaptability: This characteristic recognizes the need for organizations to be flexible and adaptable in response to changing environments, markets, and customer demands. Flexibility allows organizations to adjust their strategies, structures, and processes to stay competitive and seize opportunities.
6. Continuous Improvement: The popular approach emphasizes the concept of continuous improvement, also known as Kaizen. It involves a systematic and ongoing effort to enhance organizational processes, products, and services. Continuous improvement focuses on efficiency, effectiveness, and innovation to achieve higher levels of performance.
7. Teamwork and Collaboration: The popular approach promotes teamwork and collaboration among individuals and departments. It recognizes that effective teamwork can leverage diverse skills, knowledge, and experiences to achieve common goals more efficiently and effectively.
These characteristics are often associated with modern management practices that prioritize employee engagement, adaptability, and the pursuit of organizational excellence.
- What are the various types of malware? How do worms differ from viruses? Do Trojan Horses carry viruses or worms?
Malware, short for malicious software, refers to any software or code designed to disrupt, damage, or gain unauthorized access to computer systems or networks. Here are some common types of malware:
1. Viruses: Viruses are self-replicating programs that infect legitimate files or programs and spread by attaching themselves to other files. They can cause various types of harm, such as data corruption, system instability, or unauthorized access. Viruses require user intervention or the execution of an infected file to propagate.
2. Worms: Worms are standalone programs that can self-replicate and spread independently without the need for user intervention. They exploit vulnerabilities in computer systems or networks to propagate and can cause significant damage by consuming network bandwidth, overloading systems, or installing other malware.
3. Trojan Horses: Trojan Horses are malware disguised as legitimate software or files. They trick users into executing or installing them, often by hiding within seemingly harmless programs or email attachments. Once inside a system, Trojan Horses can perform malicious actions such as stealing sensitive information, opening backdoors for remote access, or delivering other types of malware. Trojan Horses do not self-replicate like viruses or worms.
So, to answer your question, Trojan Horses can carry viruses or worms, but they themselves are not viruses or worms. Trojan Horses are a delivery mechanism for various types of malware, including viruses and worms.
It's important to note that there are many other types of malware beyond viruses, worms, and Trojan Horses, such as ransomware, spyware, adware, and rootkits. Each type has its own characteristics and methods of operation.
- Define ethics. What are the ten commandments of computer ethics? Enlist them.
Ethics refers to the moral principles and values that guide human behavior and decision-making. It involves distinguishing right from wrong, good from bad, and determining appropriate conduct in various contexts. In the context of computer ethics, it pertains to the moral principles and guidelines governing the use of computers and information technology.
The ten commandments of computer ethics were proposed by the Computer Ethics Institute and provide a set of principles to guide ethical behavior in the realm of computing. Here they are:
1. Thou shalt not use a computer to harm others: This commandment emphasizes the importance of not using computers or technology to cause harm, such as hacking, spreading malware, or engaging in cyberbullying.
2. Thou shalt not interfere with other people's computer work: This commandment promotes respect for others' privacy, data, and intellectual property. It discourages unauthorized access, tampering, or disruption of others' computer systems or work.
3. Thou shalt not snoop around in other people's computer files: This commandment highlights the importance of respecting the privacy and confidentiality of others' information. It discourages unauthorized access or intrusion into others' personal or sensitive data.
4. Thou shalt not use a computer to steal: This commandment emphasizes the prohibition of using computers or technology for theft, fraud, or unauthorized acquisition of others' digital assets, such as financial information or intellectual property.
5. Thou shalt not use a computer to bear false witness: This commandment discourages the spread of false information or engaging in online deception, such as spreading misinformation or engaging in online scams.
6. Thou shalt not copy or use proprietary software for which you have not paid: This commandment promotes respect for intellectual property rights and discourages software piracy or unauthorized use of copyrighted materials.
7. Thou shalt not use other people's computer resources without authorization: This commandment emphasizes the importance of obtaining proper authorization before using or accessing others' computer resources, networks, or bandwidth.
8. Thou shalt not appropriate other people's intellectual output: This commandment promotes the respect for intellectual property and discourages plagiarism or unauthorized use of others' creative work, such as software, text, images, or music.
9. Thou shalt think about the social consequences of the program you write: This commandment emphasizes the ethical responsibility of software developers and computer professionals to consider the potential impact of their work on society, including issues related to privacy, security, and fairness.
10. Thou shalt use computers in ways that show consideration and respect for others: This commandment encourages responsible and considerate behavior when using computers, such as respecting others' time, opinions, and online interactions.
These commandments serve as guidelines for ethical behavior in the field of computer science and technology, promoting responsible and considerate use of computers and information technology.
- What is deterrence? What are the categories of unethical behavior that organizations and society should seek to eliminate? Explain in brief.
Deterrence, in the context of ethics, refers to the use of preventive measures and consequences to discourage individuals or organizations from engaging in unethical behavior. It aims to create a deterrent effect by instilling fear of punishment or negative consequences, thereby reducing the likelihood of unethical actions.
There are several categories of unethical behavior that organizations and society should seek to eliminate. Here are some common categories:
1. Fraud and Deception: This category involves intentionally deceiving others for personal gain. It includes activities such as financial fraud, misrepresentation, falsifying records, or manipulating information to mislead others.
2. Corruption and Bribery: Corruption refers to the abuse of entrusted power for personal or organizational gain. It involves offering, giving, receiving, or soliciting bribes, kickbacks, or illegal payments to influence decisions or gain unfair advantages.
3. Discrimination and Harassment: Unethical behavior in this category involves treating individuals unfairly or creating a hostile work environment based on characteristics such as race, gender, religion, sexual orientation, or disability. It includes actions like discriminatory hiring practices, harassment, or retaliation.
4. Intellectual Property Infringement: This category encompasses the unauthorized use, reproduction, or distribution of intellectual property, such as patents, copyrights, trademarks, or trade secrets. It includes activities like plagiarism, software piracy, counterfeiting, or unauthorized use of confidential information.
5. Conflicts of Interest: Conflicts of interest arise when individuals or organizations have competing or conflicting interests that may compromise their objectivity or loyalty. It involves situations where personal interests influence decision-making, leading to bias, favoritism, or compromised integrity.
6. Environmental Harm: Unethical behavior in this category involves actions that cause harm to the environment, such as pollution, illegal disposal of hazardous materials, or unsustainable practices that damage ecosystems and natural resources.
7. Privacy Violations: This category encompasses actions that infringe upon individuals' privacy rights, such as unauthorized surveillance, data breaches, identity theft, or unauthorized access to personal information.
By identifying and addressing these categories of unethical behavior, organizations and society can work towards creating a more ethical and responsible environment. This includes establishing clear ethical standards, promoting a culture of integrity, providing ethics training and education, enforcing consequences for unethical actions, and encouraging reporting mechanisms for ethical concerns.
- What is the best method for preventing illegal or unethical behavior? Explain in brief.
Preventing illegal or unethical behavior requires a combination of proactive measures and a strong ethical culture within an organization. While there is no one-size-fits-all approach, some effective methods for prevention include:
1. Establishing a Code of Conduct: Organizations should develop and communicate a clear code of conduct that outlines expected standards of behavior. This code should cover areas such as integrity, honesty, respect, and compliance with laws and regulations.
2. Ethics Training and Education: Providing regular ethics training and education to employees is crucial. This helps to ensure that individuals understand ethical expectations, are aware of potential ethical dilemmas, and know how to handle them appropriately.
3. Promoting a Speak-Up Culture: Encouraging employees to report ethical concerns without fear of retaliation is vital. Implementing anonymous reporting mechanisms, whistleblower protection policies, and fostering an environment of trust and transparency can help identify and address issues before they escalate.
4. Leading by Example: Leaders play a crucial role in setting the ethical tone within an organization. They should consistently demonstrate and reinforce ethical behavior, promoting a culture of integrity throughout all levels of the organization.
5. Establishing Accountability: Holding individuals accountable for their actions is essential for preventing illegal or unethical behavior. This involves establishing clear consequences for violations of ethical standards and ensuring that they are consistently enforced.
6. Regular Monitoring and Auditing: Conducting regular internal audits and monitoring processes helps identify potential risks, vulnerabilities, and non-compliance with ethical standards. This allows organizations to take proactive measures to address any issues and make necessary improvements.
7. Continuous Improvement: Organizations should continually review and update their ethical practices and policies to adapt to changing environments and emerging ethical challenges. This includes incorporating feedback from employees, evaluating the effectiveness of existing prevention methods, and making necessary adjustments.
It's important to note that preventing illegal or unethical behavior requires a holistic approach, involving a combination of preventive measures, ongoing monitoring, and a commitment to fostering an ethical culture throughout the organization.
What are the three primary types of public law? What is the difference between criminal law and civil law?
The three primary types of public law are constitutional law, administrative law, and criminal law.
1. Constitutional Law: Constitutional law refers to the body of law that establishes the fundamental principles, structure, and powers of a government. It defines the relationship between the government and its citizens, including the rights and freedoms of individuals. Constitutional law typically involves the interpretation and application of a country's constitution.
2. Administrative Law: Administrative law deals with the legal principles and rules that govern the activities of administrative agencies and government bodies. It sets forth the procedures, powers, and limitations of these agencies and regulates their interactions with individuals and organizations. Administrative law ensures that government actions are fair, reasonable, and in compliance with the law.
3. Criminal Law: Criminal law encompasses the rules and statutes that define and punish actions considered to be offenses against society. It addresses crimes committed by individuals that are deemed harmful or threatening to the public welfare. Criminal law involves the prosecution of offenders by the state, and if found guilty, they can face penalties such as fines, imprisonment, or other forms of punishment.
Now, let's discuss the difference between criminal law and civil law:
Criminal Law:
- Focus: Criminal law focuses on offenses against society as a whole.
- Parties: The parties involved are the state (prosecution) and the accused.
- Burden of Proof: The burden of proof lies with the prosecution, who must prove the accused's guilt beyond a reasonable doubt.
- Purpose: The purpose of criminal law is to punish offenders and maintain social order.
- Penalty: If found guilty, the penalty can include fines, imprisonment, probation, or other forms of punishment.
Civil Law:
- Focus: Civil law deals with disputes between individuals or entities.
- Parties: The parties involved are the plaintiff (person bringing the lawsuit) and the defendant (person being sued).
- Burden of Proof: The burden of proof lies with the plaintiff, who must prove their case by a preponderance of the evidence (i.e., showing it is more likely than not).
- Purpose: The purpose of civil law is to resolve disputes, provide remedies, and compensate for harm or losses suffered by the plaintiff.
- Penalty: If the defendant is found liable, the court may order them to pay damages or provide equitable relief to the plaintiff.
In summary, criminal law focuses on offenses against society, with the state prosecuting offenders, while civil law deals with disputes between individuals, seeking remedies and compensation for harm. Criminal law involves punishment, whereas civil law aims for resolution and restitution.
- What is planning and organizational planning? What is the role of mission, vision, values, and strategy? Explain in brief.
Planning is the process of setting goals, defining objectives, and outlining the steps or actions needed to achieve them. It involves analyzing the current situation, determining future desired outcomes, and developing a roadmap to reach those outcomes effectively. Planning provides a structured approach to decision-making and resource allocation, ensuring that efforts are focused and aligned towards the desired results.
Organizational planning, also known as strategic planning, is the process of developing a comprehensive plan that guides an organization's overall direction and activities. It involves formulating strategies, making decisions about resource allocation, and setting priorities to achieve long-term success. Organizational planning encompasses various aspects, including setting the mission, vision, values, and strategy.
1. Mission: The mission of an organization defines its fundamental purpose, identity, and reason for existence. It describes what the organization does, whom it serves, and the value it brings to its stakeholders. The mission statement provides a sense of direction and guides decision-making by clarifying the organization's core focus and objectives.
2. Vision: The vision of an organization represents the desired future state or the long-term aspirations it aims to achieve. It outlines the organization's aspirations, goals, and the impact it strives to make. The vision statement provides a sense of purpose and inspires stakeholders by painting a compelling picture of the organization's future success.
3. Values: Values represent the core beliefs, principles, and ethical standards that guide an organization's behavior and culture. They define the organization's character, expectations, and norms. Values serve as a guiding compass for decision-making, shaping the organization's actions and interactions with stakeholders.
4. Strategy: Strategy refers to the overall plan of action designed to achieve the organization's goals and objectives. It involves making choices about how resources will be allocated, which markets or segments to target, and how to differentiate from competitors. Strategy sets the direction for the organization, guiding decision-making at various levels and aligning efforts towards the desired outcomes.
Together, the mission, vision, values, and strategy provide a framework for organizational planning. They help establish a shared sense of purpose, provide clarity on the organization's direction, shape its culture and decision-making processes, and guide the allocation of resources to achieve desired outcomes.
- What is strategic planning? What are the basic components of a typical organizational-level strategic plan? Enlist them and explain in brief.
Strategic planning is a process undertaken by organizations to define their long-term goals and develop a roadmap for achieving them. It involves analyzing the internal and external environment, setting objectives, formulating strategies, and making decisions about resource allocation to align the organization's actions with its mission, vision, and values.
A typical organizational-level strategic plan consists of several key components. Here are the basic components:
1. Executive Summary: The executive summary provides an overview of the strategic plan, highlighting its key elements, goals, and objectives. It serves as a concise summary that captures the essence of the plan for easy understanding and communication.
2. Organizational Profile: This section provides information about the organization, including its history, mission, vision, values, and core competencies. It sets the context for the strategic plan and helps stakeholders understand the organization's identity and purpose.
3. Environmental Analysis: The environmental analysis involves assessing the internal and external factors that can impact the organization's performance. It includes a SWOT analysis (Strengths, Weaknesses, Opportunities, Threats) to identify the organization's internal strengths and weaknesses, as well as external opportunities and threats.
4. Strategic Goals and Objectives: Strategic goals are broad statements that define what the organization aims to achieve in the long term. Objectives are specific, measurable targets that support the achievement of those goals. This component outlines the strategic goals and objectives that guide the organization's actions and decision-making.
5. Strategies and Action Plans: Strategies outline the approaches and initiatives the organization will undertake to achieve its goals and objectives. Action plans provide a detailed roadmap of specific actions, responsibilities, timelines, and resources required to implement the strategies effectively.
6. Performance Measurement: This component defines the key performance indicators (KPIs) or metrics that will be used to monitor and evaluate the organization's progress towards its goals. It establishes a framework for measuring success and identifying areas for improvement.
7. Resource Allocation: Resource allocation involves determining the allocation of financial, human, and other resources to support the implementation of the strategic plan. This component addresses the budgetary considerations and resource needs necessary to execute the strategies and achieve the desired outcomes.
8. Implementation and Monitoring: This component outlines the mechanisms and processes for implementing the strategic plan and monitoring progress. It includes defining roles and responsibilities, establishing milestones and timelines, and implementing a system for regular monitoring, evaluation, and adjustment.
9. Risk Management: Risk management involves identifying potential risks and developing strategies to mitigate or address them. This component addresses the identification, assessment, and management of risks that could affect the successful implementation of the strategic plan.
10. Communication and Stakeholder Engagement: This component focuses on the communication and engagement strategies to ensure that stakeholders are informed, involved, and supportive of the strategic plan. It includes stakeholder analysis, communication plans, and strategies for engaging stakeholders throughout the planning and implementation process.
These components collectively form a typical organizational-level strategic plan, providing a comprehensive framework for guiding the organization's actions, decision-making, and resource allocation towards the achievement of its long-term goals.
- What is information security governance? What are the considerations or key aspects the designer should ensure while developing an information security governance program? Enlist them.
Information security governance refers to the framework and processes put in place to ensure that an organization's information assets are protected, risks are managed effectively, and security objectives are aligned with business goals. It involves the establishment of policies, procedures, controls, and accountability structures to safeguard sensitive information and mitigate potential security threats.
While developing an information security governance program, several key considerations or aspects should be ensured. Here are some important ones:
1. Leadership and Management Commitment: It is crucial to have strong leadership and management commitment to information security governance. The organization's top management should actively support and promote a culture of security, allocating resources and ensuring that security is integrated into the organization's overall strategic goals.
2. Clear Roles and Responsibilities: Roles and responsibilities related to information security should be clearly defined and communicated throughout the organization. This includes designating individuals or teams responsible for governance, risk management, compliance, incident response, and other security-related functions.
3. Risk Management: A robust risk management process should be established to identify, assess, and manage information security risks. This involves conducting risk assessments, implementing appropriate controls, and regularly monitoring and reviewing the effectiveness of security measures.
4. Policies, Standards, and Procedures: The development and enforcement of comprehensive information security policies, standards, and procedures are essential. These documents provide guidance and establish the rules and expectations for protecting information assets, ensuring consistency and compliance across the organization.
5. Compliance and Regulatory Requirements: Consideration should be given to relevant legal, regulatory, and industry-specific requirements pertaining to information security. The governance program should address compliance obligations and ensure that appropriate controls are in place to meet these requirements.
6. Training and Awareness: Adequate training and awareness programs should be implemented to educate employees and stakeholders about their roles and responsibilities in maintaining information security. This includes raising awareness about common security threats, best practices, and incident response procedures.
7. Incident Response and Business Continuity: A robust incident response plan should be developed to effectively respond to and manage security incidents. Additionally, business continuity and disaster recovery plans should be established to minimize the impact of potential disruptions and ensure the timely recovery of critical systems and data.
8. Continuous Monitoring and Improvement: The governance program should incorporate mechanisms for continuous monitoring, evaluation, and improvement of information security practices. This includes regular security assessments, audits, and feedback loops to identify areas for enhancement and ensure ongoing effectiveness.
9. Collaboration and Communication: Information security governance should foster collaboration and communication between different stakeholders, including IT departments, business units, legal and compliance teams, and senior management. Open lines of communication facilitate the sharing of information, coordination of efforts, and alignment of security with business objectives.
10. Performance Measurement and Reporting: Key performance indicators (KPIs) should be defined to measure the effectiveness and efficiency of the information security governance program. Regular reporting on security metrics and incidents helps in tracking progress, identifying trends, and facilitating informed decision-making.
By considering these aspects, the designer can ensure that the information security governance program is comprehensive, aligned with organizational goals, and capable of effectively managing security risks.
- Describe top-down strategic planning. How does it differ from bottom up strategic planning? Which is usually more effective in implementing security in large, diverse organization?
Top-down strategic planning, also known as centralized strategic planning, is an approach where the strategic planning process is initiated and led by senior management or top-level executives. In this approach, the strategic goals, objectives, and plans are formulated at the top of the organizational hierarchy and then cascaded down to lower levels for implementation. Top-down planning typically involves a hierarchical decision-making structure, where the top-level executives have the authority to set the strategic direction and allocate resources.
On the other hand, bottom-up strategic planning, also known as decentralized strategic planning, is an approach where the strategic planning process involves input and participation from individuals and teams at various levels within the organization. In this approach, the strategic goals and plans are developed based on the insights, expertise, and experiences of those who are closer to the operational level. Bottom-up planning encourages employee involvement, empowerment, and ownership in the strategic decision-making process.
The effectiveness of top-down versus bottom-up strategic planning in implementing security in a large, diverse organization can depend on various factors. Here are some considerations:
1. Alignment with Organizational Culture: Top-down planning may be more effective in organizations with a hierarchical culture where decision-making authority is centralized. On the other hand, bottom-up planning may be more suitable in organizations with a collaborative and inclusive culture that values employee input and involvement.
2. Speed and Efficiency: Top-down planning can be more efficient in terms of speed and implementation as decisions are made quickly at the top and cascaded down. Bottom-up planning may take more time as it involves a participatory process with multiple stakeholders providing input and reaching consensus.
3. Engagement and Ownership: Bottom-up planning can foster a sense of ownership and engagement among employees because they are actively involved in the planning process. This can lead to better understanding and commitment to implementing security measures. Top-down planning may result in less engagement and ownership if employees feel disconnected from the decision-making process.
4. Contextual Knowledge: Bottom-up planning benefits from the contextual knowledge and expertise of employees who are closer to the operational level. They have insights into specific security challenges and can provide valuable input for designing effective security measures. Top-down planning may overlook such granular knowledge.
5. Integration and Consistency: Top-down planning can ensure a more integrated and consistent approach to security implementation across different departments and units within a large, diverse organization. It allows for centralized decision-making and coordination. Bottom-up planning may result in a more fragmented approach as different units or departments may have varying priorities and perspectives.
In summary, the choice between top-down and bottom-up strategic planning for implementing security in a large, diverse organization depends on the organizational culture, the need for speed versus employee engagement, the availability of contextual knowledge, and the importance of integration and consistency. There is no one-size-fits-all answer, and a combination of both approaches, known as a hybrid approach, can often be beneficial to leverage the strengths of each method.
- List and describe the three types of information security policy as described by NISTSP.
- List and describe the approaches to policy development. Which approach is best suited for use by a smaller organisation and why? If the target organisation were very much larger, which approach would be more suitable and why?
- List and describe three functions that the ISSP serves in the organisation.
- What is risk management? Explain in brief the risk management framework and process.
- What is threat and value abilities? List and describe the categories of threat. Which is noted as being the most frequently encountered and why?
- Examine the simplest risk formula. What are its primary elements? Explain their role.
- What is Mitigation? What are the mitigation plans? Explain them with the help of example.
- Explain in brief Risk treatment cycle with the help of flowchart or steps.
- What is risk appetite? Explain why risk appetite varies from organisation to organisation.
- What is defense strategy of risk treatment strategies? What are the approaches to implement the defense risk treatment strategy? Explain in brief.
