1 00:00:00,000 --> 00:00:01,440 data breaches, cyber attacks. 2 00:00:01,440 --> 00:00:02,880 You hear about it every day, right? 3 00:00:02,880 --> 00:00:04,800 It's almost enough to make you want to check your phone 4 00:00:04,800 --> 00:00:07,800 in the river and I don't know if you live in a cave, haha. 5 00:00:07,800 --> 00:00:11,080 But before you go full, hermit mode on us, 6 00:00:11,080 --> 00:00:14,000 let's take a deep dive into incident response. 7 00:00:14,000 --> 00:00:16,000 That's what the expert call it, how they handle 8 00:00:16,000 --> 00:00:17,640 these digital disasters. 9 00:00:17,640 --> 00:00:19,960 And wouldn't you know it? 10 00:00:19,960 --> 00:00:22,400 You send us some really interesting stuff about this. 11 00:00:22,400 --> 00:00:24,600 Looks like a chapter ripped right out of a cyber security 12 00:00:24,600 --> 00:00:25,400 manual. 13 00:00:25,400 --> 00:00:27,000 Don't worry, we'll break it down for you. 14 00:00:27,000 --> 00:00:28,320 You know, it's fascinating. 15 00:00:28,320 --> 00:00:31,120 Right off the bat, this source makes a really clear 16 00:00:31,120 --> 00:00:34,040 distinction between those everyday IT snags. 17 00:00:34,040 --> 00:00:36,840 We've all hit, you know, the printers jammed again, 18 00:00:36,840 --> 00:00:40,600 the software's crashed and a real security incident. 19 00:00:40,600 --> 00:00:43,520 And that difference, that's crucial because it changes 20 00:00:43,520 --> 00:00:44,280 the whole game. 21 00:00:44,280 --> 00:00:46,320 So it's like the difference between your smoke alarm 22 00:00:46,320 --> 00:00:49,520 going off while you're burning toast and your whole house 23 00:00:49,520 --> 00:00:50,800 actually being on fire. 24 00:00:50,800 --> 00:00:51,520 Exactly. 25 00:00:51,520 --> 00:00:53,120 One minute, it's a minor inconvenience. 26 00:00:53,120 --> 00:00:55,640 The next you're dealing with a five alarm situation. 27 00:00:55,640 --> 00:00:57,240 Slow internet, that's an event. 28 00:00:57,240 --> 00:01:01,280 Sure, but hackers holding your entire customer database 29 00:01:01,280 --> 00:01:02,280 for ransom. 30 00:01:02,280 --> 00:01:05,000 Now, that is a full blown security incident, my friend. 31 00:01:05,000 --> 00:01:07,360 And it needs a fast organized response. 32 00:01:07,360 --> 00:01:10,920 That's where the incident response team, the IR key steps in. 33 00:01:10,920 --> 00:01:13,680 So it's not enough just to have the latest anti-virus software 34 00:01:13,680 --> 00:01:14,280 these days on. 35 00:01:14,280 --> 00:01:17,560 You need a whole team ready to go specifically for this kind 36 00:01:17,560 --> 00:01:20,880 of thing, like a, what a SWAT team, but for cyber threats. 37 00:01:20,880 --> 00:01:22,080 You got it. 38 00:01:22,080 --> 00:01:25,040 This source makes it clear, a dedicated team is essential. 39 00:01:25,040 --> 00:01:26,800 They're the ones with the plan, the expertise 40 00:01:26,800 --> 00:01:29,280 to come in and neutralize the threat. 41 00:01:29,280 --> 00:01:31,880 Now, speaking of the plan, let's unpack that a bit. 42 00:01:31,880 --> 00:01:32,680 Shall we? 43 00:01:32,680 --> 00:01:35,960 The source lays out a very clear incident management process 44 00:01:35,960 --> 00:01:36,840 step by step. 45 00:01:36,840 --> 00:01:37,680 OK, I'll admit it. 46 00:01:37,680 --> 00:01:38,880 This is where I get a little excited. 47 00:01:38,880 --> 00:01:41,680 Like, it's a recipe, but instead of flour and sugar, 48 00:01:41,680 --> 00:01:43,440 we're talking firewalls and encryption. 49 00:01:43,440 --> 00:01:45,040 So where do we start? 50 00:01:45,040 --> 00:01:47,680 Well, every good recipe or incident response plan 51 00:01:47,680 --> 00:01:49,920 in this case needs the right starting ingredients. 52 00:01:49,920 --> 00:01:51,760 And in this case, that's detection. 53 00:01:51,760 --> 00:01:52,680 Seems obvious enough. 54 00:01:52,680 --> 00:01:55,560 You got to know something's wrong before you can fix it, right? 55 00:01:55,560 --> 00:01:57,640 But I thought it was interesting how the source pointed out. 56 00:01:57,640 --> 00:02:00,040 It's not always some fancy algorithm or system 57 00:02:00,040 --> 00:02:01,240 that catches it. 58 00:02:01,240 --> 00:02:06,000 Sometimes it's just a user, a person who notices 59 00:02:06,000 --> 00:02:09,600 something's off a weird email, a suspicious link, 60 00:02:09,600 --> 00:02:11,080 a file acting up. 61 00:02:11,080 --> 00:02:11,720 Absolutely. 62 00:02:11,720 --> 00:02:14,680 It's that human element, often the first line of defense. 63 00:02:14,680 --> 00:02:17,080 Even with the most sophisticated security setup, 64 00:02:17,080 --> 00:02:20,360 you can't beat a train eye, seeing something's out of place. 65 00:02:20,360 --> 00:02:21,560 It's like in those movies, you know, 66 00:02:21,560 --> 00:02:23,560 when a character spots that one tiny detail 67 00:02:23,560 --> 00:02:25,120 that seems insignificant, 68 00:02:25,120 --> 00:02:27,520 but it ends up being the key to the whole mystery. 69 00:02:27,520 --> 00:02:30,520 So let's say someone they spot something fishy going on. 70 00:02:30,520 --> 00:02:31,480 What happens next? 71 00:02:31,480 --> 00:02:33,240 That's when response kicks in. 72 00:02:33,240 --> 00:02:34,560 The incident response team, 73 00:02:34,560 --> 00:02:36,720 they're sometimes called the computer security incident 74 00:02:36,720 --> 00:02:39,280 response team are Cesar Tarty for short. 75 00:02:39,280 --> 00:02:40,200 They jump into action. 76 00:02:40,200 --> 00:02:40,920 Hold on, hold on, hold on. 77 00:02:40,920 --> 00:02:41,680 Back in the second. 78 00:02:41,680 --> 00:02:44,320 Cesar Tarty, do we need like a whole glossary for this? 79 00:02:44,320 --> 00:02:47,040 Ha ha, no need to get bogged down in the acronyms. 80 00:02:47,040 --> 00:02:49,320 The important thing is what they do. 81 00:02:49,320 --> 00:02:51,960 Think of them like a specialized fire crew, 82 00:02:51,960 --> 00:02:54,320 arriving at the scene, you know. 83 00:02:54,320 --> 00:02:56,880 They're assessing the situation, figuring out 84 00:02:56,880 --> 00:02:58,960 how to contain it before it gets any worse. 85 00:02:58,960 --> 00:03:01,080 They're figuring out how big the problem is, 86 00:03:01,080 --> 00:03:02,360 how much damage is there, 87 00:03:02,360 --> 00:03:05,120 and what needs to be done to stop it from getting worse. 88 00:03:05,120 --> 00:03:07,120 So they've sized up the situation, right? 89 00:03:07,120 --> 00:03:09,040 They've like, sound of the alarm. 90 00:03:09,040 --> 00:03:11,480 What's the next play in this incident response 91 00:03:11,480 --> 00:03:12,840 playbook we're talking about? 92 00:03:12,840 --> 00:03:14,160 Containment. 93 00:03:14,160 --> 00:03:16,160 The source calls this the mitigation phase, 94 00:03:16,160 --> 00:03:19,040 and it's all about stopping that problem, 95 00:03:19,040 --> 00:03:21,360 whatever it is, from spreading. 96 00:03:21,360 --> 00:03:23,760 Think of a spark and a dry forest, 97 00:03:23,760 --> 00:03:26,040 if you don't get it under control immediately, 98 00:03:26,040 --> 00:03:28,320 you're gonna have a massive fire on your hands in no time. 99 00:03:28,320 --> 00:03:29,560 Okay, yeah, that makes sense. 100 00:03:29,560 --> 00:03:30,720 Gotta make that a priority. 101 00:03:30,720 --> 00:03:33,160 But how do you actually contain a cyber incident? 102 00:03:33,160 --> 00:03:36,320 It's not like you can just pour water on a computer virus, right? 103 00:03:36,320 --> 00:03:38,520 Ha ha, no, it's definitely a bit more complicated 104 00:03:38,520 --> 00:03:42,080 than that containment could mean isolating the systems 105 00:03:42,080 --> 00:03:44,600 that are affected, maybe taking them offline, 106 00:03:44,600 --> 00:03:46,800 even shutting down entire parts of the network 107 00:03:46,800 --> 00:03:48,280 if it comes to that. 108 00:03:48,280 --> 00:03:50,440 And yeah, that can be disruptive for sure. 109 00:03:50,440 --> 00:03:52,720 But sometimes a little short term pain, 110 00:03:52,720 --> 00:03:54,680 you know, it prevents a whole lot of pain later on. 111 00:03:54,680 --> 00:03:55,520 I get it. 112 00:03:55,520 --> 00:03:58,400 It's like ripping out a small section of drywall 113 00:03:58,400 --> 00:04:00,920 to stop mold from spreading through your whole house. 114 00:04:00,920 --> 00:04:01,600 Yeah. 115 00:04:01,600 --> 00:04:03,360 Better to tackle it, head on, 116 00:04:03,360 --> 00:04:06,280 than let it fester and become this huge expensive mess later. 117 00:04:06,280 --> 00:04:07,120 Exactly. 118 00:04:07,120 --> 00:04:08,800 And speaking of bigger misses, 119 00:04:08,800 --> 00:04:11,280 this is where things get even more interesting. 120 00:04:11,280 --> 00:04:13,840 Remember those acronyms we were talking about before, 121 00:04:13,840 --> 00:04:16,960 like PII and PCI DSS? 122 00:04:16,960 --> 00:04:19,840 Yeah, vaguely is something about sensitive information, right? 123 00:04:19,840 --> 00:04:20,680 Right. 124 00:04:20,680 --> 00:04:23,280 Yeah, that's personally identifiable information, 125 00:04:23,280 --> 00:04:24,720 things like security numbers, 126 00:04:24,720 --> 00:04:26,080 addresses, credit card details, 127 00:04:26,080 --> 00:04:28,160 all that stuff you really don't want getting out there. 128 00:04:28,160 --> 00:04:31,680 And PCI DSS, that's the payment cart industry data security 129 00:04:31,680 --> 00:04:33,960 standard, basically a whole set of rules 130 00:04:33,960 --> 00:04:35,920 about handling credit cart information. 131 00:04:35,920 --> 00:04:38,200 Okay, starting to come back to me now. 132 00:04:38,200 --> 00:04:41,920 But how does all that tie back into incident response? 133 00:04:41,920 --> 00:04:43,400 Well, the source makes it clear 134 00:04:43,400 --> 00:04:46,640 that if an incident involves this kind of information, 135 00:04:46,640 --> 00:04:49,320 if there's a breach of PII or your in violation 136 00:04:49,320 --> 00:04:53,280 of PCI DSS, then there are some very specific reporting 137 00:04:53,280 --> 00:04:54,120 requirements. 138 00:04:54,120 --> 00:04:56,760 You can't just sweep it under the rug 139 00:04:56,760 --> 00:04:57,760 and pretend it never happens. 140 00:04:57,760 --> 00:05:00,120 This is a whole legal and compliance angle to this too. 141 00:05:00,120 --> 00:05:02,560 It's not just about fixing the technical problem. 142 00:05:02,560 --> 00:05:04,280 You have to deal with the consequences 143 00:05:04,280 --> 00:05:05,280 the potential fallout. 144 00:05:05,280 --> 00:05:06,360 Precisely. 145 00:05:06,360 --> 00:05:10,440 And that brings us to our next crucial phase reporting. 146 00:05:10,440 --> 00:05:13,000 This is where the incident response team, 147 00:05:13,000 --> 00:05:16,440 they document everything, what happened, how they contained it, 148 00:05:16,440 --> 00:05:19,480 the potential impact, any regulatory requirements 149 00:05:19,480 --> 00:05:20,680 that come into play. 150 00:05:20,680 --> 00:05:23,320 It's detailed work, pretty meticulous, 151 00:05:23,320 --> 00:05:26,840 but it's absolutely essential for transparency, accountability, 152 00:05:26,840 --> 00:05:29,680 and of course avoiding those big fines or legal battles. 153 00:05:29,680 --> 00:05:31,120 This is like writing up the accident report 154 00:05:31,120 --> 00:05:33,600 after a car crash, making sure everything's documented. 155 00:05:33,600 --> 00:05:34,600 That's a great analogy. 156 00:05:34,600 --> 00:05:36,760 You need that clear record of what went down, 157 00:05:36,760 --> 00:05:38,680 who was involved, what steps were taken. 158 00:05:38,680 --> 00:05:40,640 Okay, so they've contained the damage 159 00:05:40,640 --> 00:05:42,040 that got the paperwork in order. 160 00:05:42,040 --> 00:05:43,200 Are we in the clear yet? 161 00:05:43,200 --> 00:05:44,040 Are we good? 162 00:05:44,040 --> 00:05:45,440 Not so fast. 163 00:05:45,440 --> 00:05:47,640 This is where the really heavy lifting comes 164 00:05:47,640 --> 00:05:49,480 in the recovery phase. 165 00:05:49,480 --> 00:05:51,120 You make it sound kind of ominous. 166 00:05:51,120 --> 00:05:52,800 What's so tough about recovery? 167 00:05:52,800 --> 00:05:53,760 Well, think of it like this. 168 00:05:53,760 --> 00:05:55,800 You've just put out a fire in your kitchen, right? 169 00:05:55,800 --> 00:05:58,840 Flames are gone, sure, but now you've got water damage, 170 00:05:58,840 --> 00:06:01,800 smoke damage, and a whole lot of cleaning up to do 171 00:06:01,800 --> 00:06:04,240 before you can even think about cooking again. 172 00:06:04,240 --> 00:06:05,240 Okay, I see what you mean. 173 00:06:05,240 --> 00:06:06,480 You can't just snap your fingers 174 00:06:06,480 --> 00:06:08,840 and expect everything to magically be back to normal. 175 00:06:08,840 --> 00:06:10,080 Exactly. 176 00:06:10,080 --> 00:06:13,120 Recovery is all about rebuilding those systems, 177 00:06:13,120 --> 00:06:15,040 restoring data from backups, 178 00:06:15,040 --> 00:06:17,640 and basically making sure everything is back up 179 00:06:17,640 --> 00:06:19,360 and running the way it should be. 180 00:06:19,360 --> 00:06:23,080 And you can imagine this can be incredibly complex, 181 00:06:23,080 --> 00:06:25,600 time-consuming, especially if there was a lot of damage 182 00:06:25,600 --> 00:06:26,440 in the first place. 183 00:06:26,440 --> 00:06:28,720 And this is where those backups really come in handy. 184 00:06:28,720 --> 00:06:30,160 It's like having that spare key 185 00:06:30,160 --> 00:06:31,560 when you lock yourself out of your house. 186 00:06:31,560 --> 00:06:32,400 That's right. 187 00:06:32,400 --> 00:06:33,400 You got it. 188 00:06:33,400 --> 00:06:36,920 Having a good backup in recovery plan is absolutely critical. 189 00:06:36,920 --> 00:06:38,760 And this is something the source really emphasizes. 190 00:06:38,760 --> 00:06:40,800 You don't want to be scrambling to recover data 191 00:06:40,800 --> 00:06:42,240 after an incident. 192 00:06:42,240 --> 00:06:43,600 It's like trying to bake a cake 193 00:06:43,600 --> 00:06:46,480 and realizing you're missing half the ingredients. 194 00:06:46,480 --> 00:06:47,800 It's not going to be pretty. 195 00:06:47,800 --> 00:06:52,080 So they put out the fire, cleaned up the mess, rebuilt what was lost, 196 00:06:52,080 --> 00:06:55,000 were finally done right, time to clock out and go home. 197 00:06:55,000 --> 00:06:56,200 Almost. 198 00:06:56,200 --> 00:06:58,200 But we're not quite finished yet. 199 00:06:58,200 --> 00:07:00,400 Before we can close the book on this incident, 200 00:07:00,400 --> 00:07:02,240 there's one more critical step. 201 00:07:02,240 --> 00:07:03,680 Remediation. 202 00:07:03,680 --> 00:07:07,000 Think of this as the detective work after a crime. 203 00:07:07,000 --> 00:07:09,200 So it's not just fixing the damage, 204 00:07:09,200 --> 00:07:11,360 but figuring out how it happened in the first place. 205 00:07:11,360 --> 00:07:12,760 You got it. 206 00:07:12,760 --> 00:07:15,520 This phase is all about root cause analysis, 207 00:07:15,520 --> 00:07:18,440 figuring out what that vulnerability was, that weakness, 208 00:07:18,440 --> 00:07:20,400 that allowed this to happen in the first place. 209 00:07:20,400 --> 00:07:22,560 And then you fix it so it can't happen again. 210 00:07:22,560 --> 00:07:25,760 So if this incident were like a break in at your house, 211 00:07:25,760 --> 00:07:28,840 this would be like figuring out if the burglar picked the lock 212 00:07:28,840 --> 00:07:31,480 if they smashed a window or if they walked in through it 213 00:07:31,480 --> 00:07:32,680 on lock door. 214 00:07:32,680 --> 00:07:33,720 Exactly. 215 00:07:33,720 --> 00:07:34,920 You need to know how they got in. 216 00:07:34,920 --> 00:07:37,080 So you can reinforce your defenses and make sure it doesn't 217 00:07:37,080 --> 00:07:37,920 happen again. 218 00:07:37,920 --> 00:07:38,280 OK. 219 00:07:38,280 --> 00:07:42,000 So we found that vulnerability, that unlock door in our cybersecurity. 220 00:07:42,000 --> 00:07:42,840 Yeah. 221 00:07:42,840 --> 00:07:43,360 Now what? 222 00:07:43,360 --> 00:07:44,840 What do we do with that information? 223 00:07:44,840 --> 00:07:47,440 Well, that's where lessons learned comes in. 224 00:07:47,440 --> 00:07:50,080 This phase is about taking everything we've learned, 225 00:07:50,080 --> 00:07:53,040 the good, the bad, the things that almost went wrong, 226 00:07:53,040 --> 00:07:56,120 and using it, using it to actually improve our security 227 00:07:56,120 --> 00:07:57,280 going forward. 228 00:07:57,280 --> 00:07:59,760 So like a debriefing after a big mission, 229 00:07:59,760 --> 00:08:01,640 everyone sits down talks about what happened. 230 00:08:01,640 --> 00:08:02,480 Yeah, exactly. 231 00:08:02,480 --> 00:08:04,120 The incident response team, they get together 232 00:08:04,120 --> 00:08:05,520 and they go over everything. 233 00:08:05,520 --> 00:08:06,560 What worked? 234 00:08:06,560 --> 00:08:08,120 What didn't work so well? 235 00:08:08,120 --> 00:08:10,120 Did we have any miscommunications delays 236 00:08:10,120 --> 00:08:12,040 where their gaps in the process? 237 00:08:12,040 --> 00:08:14,680 And I bet this is where all that detailed documentation 238 00:08:14,680 --> 00:08:17,560 they did in the reporting phase comes in handy. 239 00:08:17,560 --> 00:08:20,240 It's like watching game film after a football game. 240 00:08:20,240 --> 00:08:22,760 You can see which plays were successful, which ones weren't, 241 00:08:22,760 --> 00:08:25,560 and use that to make a better game plan for next time. 242 00:08:25,560 --> 00:08:26,560 Exactly. 243 00:08:26,560 --> 00:08:29,040 And the really important thing here is to make it a habit 244 00:08:29,040 --> 00:08:33,040 to constantly be improving every incident, no matter how small, 245 00:08:33,040 --> 00:08:36,320 it's a learning opportunity, a chance to make the organization 246 00:08:36,320 --> 00:08:38,040 stronger and more secure. 247 00:08:38,040 --> 00:08:39,960 So incident response, it's not just 248 00:08:39,960 --> 00:08:42,440 about putting out the fires, it's about learning from them, 249 00:08:42,440 --> 00:08:43,800 making sure they don't happen again. 250 00:08:43,800 --> 00:08:45,440 Yeah, that's a great way to put it. 251 00:08:45,440 --> 00:08:47,400 You know, one thing that I find really interesting 252 00:08:47,400 --> 00:08:50,440 about the source is how it emphasizes 253 00:08:50,440 --> 00:08:53,800 that this isn't a one time thing, this incident response, 254 00:08:53,800 --> 00:08:54,640 it's a cycle. 255 00:08:54,640 --> 00:08:56,280 Right, you don't just check it off the list and say, 256 00:08:56,280 --> 00:08:59,080 okay, that incident's handled, we're good. 257 00:08:59,080 --> 00:09:00,520 It's ongoing, right? 258 00:09:00,520 --> 00:09:04,480 It's preparing, detecting, responding, recovering, 259 00:09:04,480 --> 00:09:07,120 and always improving, always evolving 260 00:09:07,120 --> 00:09:08,360 as new threats pop up. 261 00:09:08,360 --> 00:09:09,200 Exactly. 262 00:09:09,200 --> 00:09:11,040 And that's a really important takeaway for everyone, 263 00:09:11,040 --> 00:09:13,400 even if they're not tech people, 264 00:09:13,400 --> 00:09:15,800 understanding that cyclical nature of incident response, 265 00:09:15,800 --> 00:09:17,760 I think it helps you approach security differently. 266 00:09:17,760 --> 00:09:20,440 You're being proactive, not just reactive. 267 00:09:20,440 --> 00:09:22,600 It's like that old saying, an ounce of prevention 268 00:09:22,600 --> 00:09:23,960 is worth a pound of cure. 269 00:09:23,960 --> 00:09:25,160 You got it. 270 00:09:25,160 --> 00:09:28,840 And that's exactly why I think even just a little understanding 271 00:09:28,840 --> 00:09:31,120 of this whole incident response world, 272 00:09:31,120 --> 00:09:34,120 it's so powerful, it helps you ask the right questions, 273 00:09:34,120 --> 00:09:36,600 spot those vulnerabilities, you can even advocate 274 00:09:36,600 --> 00:09:38,680 for better security practices where you work, 275 00:09:38,680 --> 00:09:40,080 with your family. 276 00:09:40,080 --> 00:09:42,640 So for anyone listening who might be, I don't know, 277 00:09:42,640 --> 00:09:45,280 little overwhelmed by all this talk about cyber threats 278 00:09:45,280 --> 00:09:47,760 and incident response plans and everything, 279 00:09:47,760 --> 00:09:51,400 what's the one big takeaway you want them to remember? 280 00:09:51,400 --> 00:09:53,640 Honestly, knowledge is power. 281 00:09:53,640 --> 00:09:56,560 The more you know about how organizations prepare for 282 00:09:56,560 --> 00:09:58,600 and then deal with these security incidents, 283 00:09:58,600 --> 00:10:00,880 the better prepared you'll be to navigate 284 00:10:00,880 --> 00:10:03,960 this whole crazy world of cybersecurity. 285 00:10:03,960 --> 00:10:05,360 Because it is a crazy world out there. 286 00:10:05,360 --> 00:10:06,960 I love that, knowledge is power. 287 00:10:06,960 --> 00:10:09,520 It's about being in control, being informed, 288 00:10:09,520 --> 00:10:13,200 not only fear when, especially when there's so much uncertainty. 289 00:10:13,200 --> 00:10:14,040 Absolutely. 290 00:10:14,040 --> 00:10:15,760 And remember, there's help out there. 291 00:10:15,760 --> 00:10:17,520 You know, don't be afraid to ask questions, 292 00:10:17,520 --> 00:10:20,560 find an expert you trust and never, ever underestimate 293 00:10:20,560 --> 00:10:22,200 a good cybersecurity handbook. 294 00:10:22,200 --> 00:10:23,040 Could agree more. 295 00:10:23,040 --> 00:10:25,200 This has been a fascinating deep dive. 296 00:10:25,200 --> 00:10:27,480 We've gone through the, what, the, why and the, 297 00:10:27,480 --> 00:10:30,480 how of incident response. 298 00:10:30,480 --> 00:10:32,440 And hopefully we've given you some practical things to think 299 00:10:32,440 --> 00:10:35,080 about, you know, for your own digital life. 300 00:10:35,080 --> 00:10:37,320 Until next time, stay curious, stay safe, 301 00:10:37,320 --> 00:10:39,200 and remember, in the cybersecurity world, 302 00:10:39,200 --> 00:10:41,520 the best defense is a good offense. 303 00:10:41,520 --> 00:10:43,520 Or is it the other way around? 304 00:10:43,520 --> 00:11:06,680 Just kidding, they prepared folks.