SlideShare uma empresa Scribd logo
1 de 26
Baixar para ler offline
BindView
BindView
BindView
BindView
BindView
BindView
Scott Blake
Mark Loveless
Day 2:
Morning
Starting from Nothing
Security Policies
Afternoon
Intrusion Detection
Overview
• Security and networks
• Assessment
– Understand the what, who, and how
• Technology and Policy
– Problem specifics change at internet
speed
– Ways of coping don’t
Security and Networks
• From 643 Respondents to the “2000
Computer Crime and Security Survey”
(CSI/FBI):
– 90% Detected security breaches
– 74% Acknowledged financial loss
– 25% Detected system penetration for outside the
organization
– 19% Reported 10 or more incidents
What the Statistics Mean
• We don’t really know the prevalence of
computer security breaches
• Low response rate to surveys
• Corps and Govn’ts won’t share information
• Successful attacks come from inside
• Actual financial losses are probably
overstated
The Latest Trends
• Old ideas get new life
– Yet Another DDoS Tool: Trinity
– More Viruses
• Alternative Streams
• Mobile Devices
– Web Page Hacks
• Front Page still insecure
• Database insecurities
Assessment
• Starting from Nothing
– Assets - What are you protecting?
– Risks - What can be wrong?
– Threat Vectors - Who might attack?
– Methods - How do they attack?
What are you protecting?
• Each component of the network
– Web servers
– Routers
– Accounting systems
– Mail Servers
– Modem Banks
• Don’t forget the data
What can be wrong?
• Poor software configuration
• Missing patches
• Bad passwords
• No logs
• No sysadmin attention
Who might attack you?
• Hackers
– A few talented people provide tools for
thousands of kids
– rootshell.com, insecure.org contain
hundreds of tools
– Opportunity targets
• Customers
– Themselves
– Through stolen/guessed passwords
Who might attack you? (2)
• Insiders
– Through malice
– Carelessness
– Overwork
• Competitors
– “Denial of Service” attacks make you look
bad
– Customer lists for marketing
How Outsiders Attack
• Look for known weaknesses
– Misconfigured Software
– Lots of sw has “more secure”
configuration which is not turned on out of
the box
– Outdated software with known problems
– Bad passwords
How outsiders attack (2)
• Scanning tools (SATAN, sscan)
– Make finding problems easy
• Exploit tools
– Make taking advantage of problems easy
• Stealth tools
– Make erasing logs easy
How insiders attack
• Exactly the same as outsiders
– Except that they are more effective
What to do about it?
• Policies and Procedures for Security
– What are you protecting?
– What's in place to protect it?
• Training and knowledge throughout the
organization
– Do system managers know that security is
a priority?
– Do they have the skills and training to
execute?
What to do about it?
• Design for Defense
– Separation of Responsibility
– Least Privilege Required
• Tools
– Software to Implement
Governing Principles
• Integrity
– Strong internal controls on security of the applications and
data
• Confidentiality
– Strong security on user access and data transmissions
• Availability
– Failsafe components, error tolerance, internal availability
monitoring
• Accountability
– Full internal auditing, tie-ins to change control systems
The Policy Process
1. Policy Definition
2. Implementation 3. Compliance Reporting
The Policy Process
• High level security process
• Begins with policy definition
• Implementation forms a separate low
level process
• Compliance reporting summarizes
status viz-a-viz defined policy
The Implementation Process
1. Assess
2. Planning
(Reporting)
3. Fix
The Implementation Process
• Lower level IT process
• Assess against pre-defined policy
• Results inform remediation planning
• Implement fixes
• Repeat
Policies
• Know what you want to protect, and
why
– This lets you do cost benefit analysis
• Know who you want to protect it from
– This lets you design your defenses
• Know what to do
– Policies need to define actions
Policies
• Involve the Stakeholders
– Managers to focus on business case
– Technical staff to focus on what's possible,
effective
– Everyone to commit to goals
Why Do Policies Fail?
• Lack of stakeholder support
• Too much complexity
• Organizational politics
Organizational Politics
• Common Organization
– Centralized security body
– Distributed system administration
• Results in tensions, cross-purposes
Questions?
A Distributed Organization

Mais conteúdo relacionado

Semelhante a Security.ppt

Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinarEmpired
 
Tsc2021 cyber-issues
Tsc2021 cyber-issuesTsc2021 cyber-issues
Tsc2021 cyber-issuesErnest Staats
 
Seurity policy
Seurity policySeurity policy
Seurity policyHari Sarda
 
Seurity policy
Seurity policySeurity policy
Seurity policyHari Sarda
 
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian RainsburghEndpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian RainsburghNapier University
 
SECURITY AND CONTROL
SECURITY AND CONTROLSECURITY AND CONTROL
SECURITY AND CONTROLshinydey
 
The myth of secure computing; management information system; MIS
The myth of secure computing; management information system; MISThe myth of secure computing; management information system; MIS
The myth of secure computing; management information system; MISSaazan Shrestha
 
Cybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.comCybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.comAravind R
 
Lec 1- Intro to cyber security and recommendations
Lec 1- Intro to cyber security and recommendationsLec 1- Intro to cyber security and recommendations
Lec 1- Intro to cyber security and recommendationsBilalMehmood44
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information securityKumawat Dharmpal
 
Cyber Security and Healthcare
Cyber Security and HealthcareCyber Security and Healthcare
Cyber Security and HealthcareJonathon Coulter
 
Using Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityUsing Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityStephen Cobb
 
Top Cybersecurity Challenges Facing Your Business
Top Cybersecurity Challenges Facing Your BusinessTop Cybersecurity Challenges Facing Your Business
Top Cybersecurity Challenges Facing Your BusinessNicholas Davis
 
Cyber Risk in e-Discovery: What You Need to Know
Cyber Risk in e-Discovery: What You Need to KnowCyber Risk in e-Discovery: What You Need to Know
Cyber Risk in e-Discovery: What You Need to KnowkCura_Relativity
 

Semelhante a Security.ppt (20)

Your cyber security webinar
Your cyber security webinarYour cyber security webinar
Your cyber security webinar
 
Tsc2021 cyber-issues
Tsc2021 cyber-issuesTsc2021 cyber-issues
Tsc2021 cyber-issues
 
Seurity policy
Seurity policySeurity policy
Seurity policy
 
Seurity policy
Seurity policySeurity policy
Seurity policy
 
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian RainsburghEndpoint (big) Data In The Age of Compromise, Ian Rainsburgh
Endpoint (big) Data In The Age of Compromise, Ian Rainsburgh
 
SECURITY AND CONTROL
SECURITY AND CONTROLSECURITY AND CONTROL
SECURITY AND CONTROL
 
Insider threat v3
Insider threat v3Insider threat v3
Insider threat v3
 
The myth of secure computing; management information system; MIS
The myth of secure computing; management information system; MISThe myth of secure computing; management information system; MIS
The myth of secure computing; management information system; MIS
 
Cybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.comCybersecurity Basics - Aravindr.com
Cybersecurity Basics - Aravindr.com
 
Lec 1- Intro to cyber security and recommendations
Lec 1- Intro to cyber security and recommendationsLec 1- Intro to cyber security and recommendations
Lec 1- Intro to cyber security and recommendations
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
 
Cyber Security and Healthcare
Cyber Security and HealthcareCyber Security and Healthcare
Cyber Security and Healthcare
 
Incident Response
Incident ResponseIncident Response
Incident Response
 
Using Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber SecurityUsing Technology and People to Improve your Threat Resistance and Cyber Security
Using Technology and People to Improve your Threat Resistance and Cyber Security
 
9 - Security
9 - Security9 - Security
9 - Security
 
Top Cybersecurity Challenges Facing Your Business
Top Cybersecurity Challenges Facing Your BusinessTop Cybersecurity Challenges Facing Your Business
Top Cybersecurity Challenges Facing Your Business
 
What to do when get hacked or suffer a cyber breach
What to do when get hacked or suffer a cyber breachWhat to do when get hacked or suffer a cyber breach
What to do when get hacked or suffer a cyber breach
 
Cyber Security # Lec 3
Cyber Security # Lec 3 Cyber Security # Lec 3
Cyber Security # Lec 3
 
Cyber Risk in e-Discovery: What You Need to Know
Cyber Risk in e-Discovery: What You Need to KnowCyber Risk in e-Discovery: What You Need to Know
Cyber Risk in e-Discovery: What You Need to Know
 
Chapter-2 (1).pptx
Chapter-2 (1).pptxChapter-2 (1).pptx
Chapter-2 (1).pptx
 

Mais de ssuser50c54b (14)

CHAPTER8.PPT
CHAPTER8.PPTCHAPTER8.PPT
CHAPTER8.PPT
 
CHAPTER6.PPT
CHAPTER6.PPTCHAPTER6.PPT
CHAPTER6.PPT
 
CHAPTER5.PPT
CHAPTER5.PPTCHAPTER5.PPT
CHAPTER5.PPT
 
CHAPTER4.PPT
CHAPTER4.PPTCHAPTER4.PPT
CHAPTER4.PPT
 
CHAPTER3.PPT
CHAPTER3.PPTCHAPTER3.PPT
CHAPTER3.PPT
 
CHAPTER2.PPT
CHAPTER2.PPTCHAPTER2.PPT
CHAPTER2.PPT
 
CHAPTER1.PPT
CHAPTER1.PPTCHAPTER1.PPT
CHAPTER1.PPT
 
NET7.PPT
NET7.PPTNET7.PPT
NET7.PPT
 
NET6.PPT
NET6.PPTNET6.PPT
NET6.PPT
 
NET5.PPT
NET5.PPTNET5.PPT
NET5.PPT
 
NET4.PPT
NET4.PPTNET4.PPT
NET4.PPT
 
NET3.PPT
NET3.PPTNET3.PPT
NET3.PPT
 
NET2.PPT
NET2.PPTNET2.PPT
NET2.PPT
 
NET1.PPT
NET1.PPTNET1.PPT
NET1.PPT
 

Último

Philosophy of Education and Educational Philosophy
Philosophy of Education  and Educational PhilosophyPhilosophy of Education  and Educational Philosophy
Philosophy of Education and Educational PhilosophyShuvankar Madhu
 
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRADUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRATanmoy Mishra
 
Patient Counselling. Definition of patient counseling; steps involved in pati...
Patient Counselling. Definition of patient counseling; steps involved in pati...Patient Counselling. Definition of patient counseling; steps involved in pati...
Patient Counselling. Definition of patient counseling; steps involved in pati...raviapr7
 
Ultra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxUltra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxDr. Asif Anas
 
CAULIFLOWER BREEDING 1 Parmar pptx
CAULIFLOWER BREEDING 1 Parmar pptxCAULIFLOWER BREEDING 1 Parmar pptx
CAULIFLOWER BREEDING 1 Parmar pptxSaurabhParmar42
 
Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.raviapr7
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICESayali Powar
 
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptx
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptxPISA-VET launch_El Iza Mohamedou_19 March 2024.pptx
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptxEduSkills OECD
 
How to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesHow to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesCeline George
 
The Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsThe Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsEugene Lysak
 
CapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapitolTechU
 
UKCGE Parental Leave Discussion March 2024
UKCGE Parental Leave Discussion March 2024UKCGE Parental Leave Discussion March 2024
UKCGE Parental Leave Discussion March 2024UKCGE
 
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdf
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdfMaximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdf
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdfTechSoup
 
How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17Celine George
 
In - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxIn - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxAditiChauhan701637
 
How to Add a New Field in Existing Kanban View in Odoo 17
How to Add a New Field in Existing Kanban View in Odoo 17How to Add a New Field in Existing Kanban View in Odoo 17
How to Add a New Field in Existing Kanban View in Odoo 17Celine George
 
Patterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxPatterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxMYDA ANGELICA SUAN
 
Easter in the USA presentation by Chloe.
Easter in the USA presentation by Chloe.Easter in the USA presentation by Chloe.
Easter in the USA presentation by Chloe.EnglishCEIPdeSigeiro
 
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdf
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdfP4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdf
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdfYu Kanazawa / Osaka University
 

Último (20)

Philosophy of Education and Educational Philosophy
Philosophy of Education  and Educational PhilosophyPhilosophy of Education  and Educational Philosophy
Philosophy of Education and Educational Philosophy
 
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRADUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
DUST OF SNOW_BY ROBERT FROST_EDITED BY_ TANMOY MISHRA
 
Patient Counselling. Definition of patient counseling; steps involved in pati...
Patient Counselling. Definition of patient counseling; steps involved in pati...Patient Counselling. Definition of patient counseling; steps involved in pati...
Patient Counselling. Definition of patient counseling; steps involved in pati...
 
Ultra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptxUltra structure and life cycle of Plasmodium.pptx
Ultra structure and life cycle of Plasmodium.pptx
 
CAULIFLOWER BREEDING 1 Parmar pptx
CAULIFLOWER BREEDING 1 Parmar pptxCAULIFLOWER BREEDING 1 Parmar pptx
CAULIFLOWER BREEDING 1 Parmar pptx
 
Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.Drug Information Services- DIC and Sources.
Drug Information Services- DIC and Sources.
 
Quality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICEQuality Assurance_GOOD LABORATORY PRACTICE
Quality Assurance_GOOD LABORATORY PRACTICE
 
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptx
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptxPISA-VET launch_El Iza Mohamedou_19 March 2024.pptx
PISA-VET launch_El Iza Mohamedou_19 March 2024.pptx
 
How to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 SalesHow to Manage Cross-Selling in Odoo 17 Sales
How to Manage Cross-Selling in Odoo 17 Sales
 
The Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George WellsThe Stolen Bacillus by Herbert George Wells
The Stolen Bacillus by Herbert George Wells
 
CapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptxCapTechU Doctoral Presentation -March 2024 slides.pptx
CapTechU Doctoral Presentation -March 2024 slides.pptx
 
UKCGE Parental Leave Discussion March 2024
UKCGE Parental Leave Discussion March 2024UKCGE Parental Leave Discussion March 2024
UKCGE Parental Leave Discussion March 2024
 
Finals of Kant get Marx 2.0 : a general politics quiz
Finals of Kant get Marx 2.0 : a general politics quizFinals of Kant get Marx 2.0 : a general politics quiz
Finals of Kant get Marx 2.0 : a general politics quiz
 
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdf
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdfMaximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdf
Maximizing Impact_ Nonprofit Website Planning, Budgeting, and Design.pdf
 
How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17How to Make a Field read-only in Odoo 17
How to Make a Field read-only in Odoo 17
 
In - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptxIn - Vivo and In - Vitro Correlation.pptx
In - Vivo and In - Vitro Correlation.pptx
 
How to Add a New Field in Existing Kanban View in Odoo 17
How to Add a New Field in Existing Kanban View in Odoo 17How to Add a New Field in Existing Kanban View in Odoo 17
How to Add a New Field in Existing Kanban View in Odoo 17
 
Patterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptxPatterns of Written Texts Across Disciplines.pptx
Patterns of Written Texts Across Disciplines.pptx
 
Easter in the USA presentation by Chloe.
Easter in the USA presentation by Chloe.Easter in the USA presentation by Chloe.
Easter in the USA presentation by Chloe.
 
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdf
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdfP4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdf
P4C x ELT = P4ELT: Its Theoretical Background (Kanazawa, 2024 March).pdf
 

Security.ppt

  • 1. BindView BindView BindView BindView BindView BindView Scott Blake Mark Loveless Day 2: Morning Starting from Nothing Security Policies Afternoon Intrusion Detection
  • 2. Overview • Security and networks • Assessment – Understand the what, who, and how • Technology and Policy – Problem specifics change at internet speed – Ways of coping don’t
  • 3. Security and Networks • From 643 Respondents to the “2000 Computer Crime and Security Survey” (CSI/FBI): – 90% Detected security breaches – 74% Acknowledged financial loss – 25% Detected system penetration for outside the organization – 19% Reported 10 or more incidents
  • 4. What the Statistics Mean • We don’t really know the prevalence of computer security breaches • Low response rate to surveys • Corps and Govn’ts won’t share information • Successful attacks come from inside • Actual financial losses are probably overstated
  • 5. The Latest Trends • Old ideas get new life – Yet Another DDoS Tool: Trinity – More Viruses • Alternative Streams • Mobile Devices – Web Page Hacks • Front Page still insecure • Database insecurities
  • 6. Assessment • Starting from Nothing – Assets - What are you protecting? – Risks - What can be wrong? – Threat Vectors - Who might attack? – Methods - How do they attack?
  • 7. What are you protecting? • Each component of the network – Web servers – Routers – Accounting systems – Mail Servers – Modem Banks • Don’t forget the data
  • 8. What can be wrong? • Poor software configuration • Missing patches • Bad passwords • No logs • No sysadmin attention
  • 9. Who might attack you? • Hackers – A few talented people provide tools for thousands of kids – rootshell.com, insecure.org contain hundreds of tools – Opportunity targets • Customers – Themselves – Through stolen/guessed passwords
  • 10. Who might attack you? (2) • Insiders – Through malice – Carelessness – Overwork • Competitors – “Denial of Service” attacks make you look bad – Customer lists for marketing
  • 11. How Outsiders Attack • Look for known weaknesses – Misconfigured Software – Lots of sw has “more secure” configuration which is not turned on out of the box – Outdated software with known problems – Bad passwords
  • 12. How outsiders attack (2) • Scanning tools (SATAN, sscan) – Make finding problems easy • Exploit tools – Make taking advantage of problems easy • Stealth tools – Make erasing logs easy
  • 13. How insiders attack • Exactly the same as outsiders – Except that they are more effective
  • 14. What to do about it? • Policies and Procedures for Security – What are you protecting? – What's in place to protect it? • Training and knowledge throughout the organization – Do system managers know that security is a priority? – Do they have the skills and training to execute?
  • 15. What to do about it? • Design for Defense – Separation of Responsibility – Least Privilege Required • Tools – Software to Implement
  • 16. Governing Principles • Integrity – Strong internal controls on security of the applications and data • Confidentiality – Strong security on user access and data transmissions • Availability – Failsafe components, error tolerance, internal availability monitoring • Accountability – Full internal auditing, tie-ins to change control systems
  • 17. The Policy Process 1. Policy Definition 2. Implementation 3. Compliance Reporting
  • 18. The Policy Process • High level security process • Begins with policy definition • Implementation forms a separate low level process • Compliance reporting summarizes status viz-a-viz defined policy
  • 19. The Implementation Process 1. Assess 2. Planning (Reporting) 3. Fix
  • 20. The Implementation Process • Lower level IT process • Assess against pre-defined policy • Results inform remediation planning • Implement fixes • Repeat
  • 21. Policies • Know what you want to protect, and why – This lets you do cost benefit analysis • Know who you want to protect it from – This lets you design your defenses • Know what to do – Policies need to define actions
  • 22. Policies • Involve the Stakeholders – Managers to focus on business case – Technical staff to focus on what's possible, effective – Everyone to commit to goals
  • 23. Why Do Policies Fail? • Lack of stakeholder support • Too much complexity • Organizational politics
  • 24. Organizational Politics • Common Organization – Centralized security body – Distributed system administration • Results in tensions, cross-purposes