Home Blog Page 238

“An organization’s security culture requires care and feeding”

Ravinder Arora, Chief Information Security Officer, IRIS Software

Ravinder Arora, Chief Information Security Officer, IRIS Software is an award-winning CISO, speaker and trainer. He is the winner of the TOP100 CISO Award (2014-2017), Innovative CIO Award (2017), and Info-Sec Maestros Award (2017, 2018). He also won the Best CIO and CISO Award from Enterprise IT World. Arora is a much sought-after CIO/CISO in India and has served on many panels and committees on Information Security. 

He has worked with India’s National Skill Development Mission (under the aegis of the Ministry of Skill Development and Entrepreneurship) for creating cybersecurity awareness and sharing knowledge with students. 

Before IRIS Software he served organizations like Hewlett Packard and GENPACT. 

In an exclusive interview with Brian Pereira, Principal Editor, CISO MAG, Arora reveals the initiatives and strategies he undertakes to make employees and management cyber-aware, in a very engaging way. We also asked him about the qualities and abilities that make a good CISO.

Are organizations in India doing enough to make their employees aware about cybersecurity? Is it only the larger companies in regulated industries?

Information security has become one of the most important and challenging issues facing today’s organizations. With use of technology and widespread connectedness to the environment, organizations increasingly have become exposed to numerous and varied threats. Outsourcing and offshoring bring new partners into an extended enterprise, with different technologies, cultures, and sensitivities to information management. Contracting, telecommuting, and mobile workers all contribute to new security risks.

A survey conducted by Computer Security Institute with the participation of the FBI’s Computer Intrusion Squad clearly stated that: “Overall financial losses from 530 survey respondents totaled US$201,797,340…”

The report also states: “Cyber-crimes and other information security breaches are widespread and diverse. A full 92% of respondents reported attacks.”

Most Indian organizations (90%) faced challenges regarding employee or leadership cybersecurity awareness and education. I would say many organizations have started working in this domain but still have a long way to go.

We can say “Yes” for large companies. This is a culture change but slowly, small companies are also getting this change in their culture.

What are some of the initiatives you have taken in your company to make employees and senior management cyber-aware?

An organization’s security culture requires care and feeding. It is not something that grows in a positive way, organically. You must invest in a security culture. A sustainable security culture is bigger than just a single event. When a security culture is sustainable, it transforms security from a one-time event into a lifecycle that generates security returns forever.

There are different programs that we run periodically to ensure awareness among employees and leadership. A month ago, we conducted Information Security Awareness Week in our organization. There were floor sessions on cybersecurity, different games, and a drill for identifying security champions. The most exciting item on the agenda was the information security skit. Apart from this, we have data privacy training that are mandatory to attend by every employee.

Apart from general awareness, there is also a need for application security knowledge. Application security awareness (AppSec) is for developers and testers within the organization, and we are doing this as we are a software company. AppSec awareness is teaching the more advanced lessons that staff need to know to build secure products and services. Our AppSec training is based on OWASP top vulnerabilities and guidelines. 

What impact has GDPR and other laws made on Indian organizations? Do you observe a change of attitude towards cybersecurity?

GDPR will replace the 1995 Data Protection Directive and is aimed at protecting the personal data of EU citizens in the new digital world. The regulation covers all the EU member states and citizens, so all global enterprises with operations or customers in EU must comply. Europe is a significant market for the ITeS, BPO and pharmaceutical sectors in India. The size of the IT industry in the top two EU member states (Germany and France) is estimated to be around US$155–220 billion. For the Indian IT industry to keep continuing to do business in Europe, it needs to comply with GDPR.

Indian companies are likely to face increased compliance costs on the back of GDPR or risk huge penalties if they fail to comply. But they could see it as a business opportunity. Moreover, following the Supreme Court’s verdict, a data protection framework has been proposed by the Srikrishna Committee in India. Of course, whether the legislation will satisfy the criteria laid down under the GDPR or not remains to be seen.

Penalties are high for non-compliance of these laws, so we can see a sense of seriousness and change of attitude towards cybersecurity.    

You have won a lot of awards and have been a Top100 CISO in India. What are the special abilities and strategies that have got you these accolades? What are the qualities that make a good CISO?

I would say I can closely listen and be ready to speak with anyone in a friendly and approachable manner. I can make risk-based business-oriented decisions and execute them.

I like to contribute to the information security community and that’s why community also rewards me, with awards. I am also a regular speaker in several colleges in India and have written more than 20 articles on cybersecurity for leading magazines.

Part of a CISO’s job is communicating directly with the board. That will involve reporting on progress, seeking funds for development, ensuring the company’s data security goals and objectives are being met, and being able to explain why, if they are not. Unfortunately for the CISOs, boards generally don’t speak “infosec.” So, their job also means translating their requirements, goals and reports into digestible chunks that a Board of directors can fully understand.

An important aspect of being a CISO is to remember that they can, if they really want, create a super vault, unbreakable and un-hackable, where information cannot escape. But this vault is probably going to impede the business from making money. After all, a business needs information to flow. A good CISO will always be playing a balancing act between what is good for security and what’s good for the business. 

You have worked with the National Skill Development Mission for creating cybersecurity awareness and sharing knowledge with students. What needs to be done in our education system to create more cybersecurity professionals or at least, nurture an interest towards cybersecurity in young minds?

I think there is clear gap in cybersecurity demand and supply of the right skill set. According to a 2019 survey, the current requirement of cybersecurity professionals is pegged at 3 million, whereas, the cybersecurity workforce is less than 0.1 million in India.

There is a lack of infrastructure in cybersecurity training in India. Many Indian institutes have launched courses on cybersecurity. But most of these courses are theoretical, based on presentations. These don’t expose candidates to practical real-world aspects of cybersecurity and the underlying dynamics–which could radically differ from one to another.

The Indian government, along with the top tier technical institutes, needs to improve the curriculum of such courses that comprise hands-on training using technologies such as cyber ranges. 

What is your biggest fear as a CISO? What gives you sleepless nights? And how are you preparing to counter that, with technology and strategy?

I think each morning seems to bring new reports of hacks, privacy breaches, and threats to national defense or our critical infrastructure. As the attacks become more sophisticated and more frequently perpetrated by nation-states, and criminal syndicates emerge, my fear is same as that of any other CISO–that my organization should be protected from any cyberattack, especially ransomware.

To counter these attacks, the most important part is to recognize the warning signs. Compliance lapses, audit issues, and a lack of metrics and transparency can all be harbingers of potential security problems as well. It’s very important to make time for innovation in security strategies and to use the latest tools and technologies.

Online Payment Fraud Losses Estimated to US$200 Billion: Research

Digital Fraud

A new report from Juniper Networks, a provider of AI-driven networks, revealed that businesses in eCommerce, airline ticketing, money transfer, and banking services will lose over US$200 billion to online payment fraud in the next five years. The research report, “Online Payment Fraud: Emerging Threats, Segment Analysis & Market Forecasts 2020-2024”, found that the increasing ubiquity of digital payments provides an ever-increasing attack surface for fraudsters.

According to the study, digital money transfer is a growing area for payment fraud, with losses growing by 130% from 2020 to 2024. Digital money transfer fraud is particularly strong in emerging markets, with payments vulnerable to SIM swapping fraud and synthetic identities, with less robust security measures in place.

Machine Learning to Defend Against Online Frauds

The research also highlighted that machine learning has become a crucial tool in the fraud detection and prevention arsenal as it enables payments industry stakeholders to analyze transaction flows in a holistic way, unlocking hidden insights on fraudulent behaviors. It also stated that the incorporation of machine-learning into fraud detection and prevention software will drive spending forward, reaching US$10 billion in 2024, a 15% increase from 2020.

Research co-author Nick Maynard said, “The rapidly evolving nature of payment fraud and increased sophistication in attack methods requires machine learning adoption at scale, in order to minimize risk. Constant innovation in analytics and data models is increasingly essential to constraining fraudulent behaviors in payments”.

Earlier, in similar research, Juniper revealed that Asia-Pacific (APAC) service providers were concerned over their security infrastructure as they adopted new technologies like distributed clouds, IoT, and 5G. According to the research findings, only 29% were satisfied with their current firewall. Around 65% will upgrade their firewall within the next year. And, 61%t plan to increase spending on firewall products and services in the future. The findings are based on the responses of IT decision-makers from service providers across APAC. The report also highlighted that increased adoption of new technologies forced service providers to scale up and scale-out their security infrastructure to remain relevant and secure.

Trend Micro Reports 10% Increase in Ransomware Attacks in 2019

Hive Ransomware

Cybersecurity firm Trend Micro stated that it found 10% increase in ransomware detections, despite a 57% decrease in the number of new ransomware families. In its Annual Threat Report 2019, the company stated that healthcare sector remained the most targeted industry, with more than 700 providers affected in 2019. According to the report, nearly 110 state and municipal governments and agencies in the U.S. fell victim to ransomware last year.

Trend Micro also highlighted that it disclosed 171% more high severity vulnerabilities than in 2018. In order to defend against threat landscape, The firm also suggested enterprises to adopt connected threat defense across gateways, networks, servers, and endpoints. Additionally, it also suggested few security practices to enhance company’s security posture:

  • Mitigate ransomware with network segmentation, regular back-ups and continuous network monitoring
  • Update and patch systems and software to protect against known vulnerabilities
  • Enable virtual patching, especially for operating systems that are no longer supported by the vendor
  • Implement multi-factor authentication and least privilege access policies to prevent abuse of tools that can be accessed via admin credentials, like remote desktop protocol, PowerShell and developer tools

Jon Clay, director of global threat communications for Trend Micro, said, “Digital transformation has been a business buzzword for decades, and the concept has yielded very positive results over time. But security is often an afterthought, which leaves digital doors wide open for cybercriminals. Despite the prevalent ideals of digital transformation, lack of basic security hygiene, legacy systems with outdated operating systems and unpatched vulnerabilities are still a reality. This scenario is ideal for ransomware actors looking for a quick return on investment. As long as the ransom scheme continues to be profitable, criminals will continue to leverage it.”

U.S. RailWorks Corp. Reports Data Breach Post Ransomware Attack

US Railroad

The U.S.-based railroad company, RailWorks Corporation, reported a data breach to the Office of the Attorney General of California, which has potentially compromised the confidential PII of its employees. Although the description of the data breach occurrence mentioned in the notice given to the Attorney General is not clear, it does suggest the nature of the attack to be a ransomware attack.

Ransomware Attack on RailWorks Corporation

As per the report, RailWorks Corporation was targeted by a ransomware attack on January 27, 2020. During this attack, RailWorks Corporation’s systems and servers were encrypted, and this potentially led to a data breach of the PII (personally identifiable information) of its 3,000+ employees. The breached employee information includes name, address, driver’s license, Social Security Number (SSN), date of birth, date of employee hiring/termination and/or retirement.

RailWorks informed its employees by email about the data breach incident between January 30 and February 7, 2020. It said that no indication of employee PII misuse was recorded till the time of publish, but as a precautionary measure, it has tied up with Identity Guard Total to provide free credit monitoring to those affected with the data compromise for the next twelve months. This credit monitoring service uses IBM Watson Artificial Intelligence service to keep an eye on the Dark Web and alerts registered user if their SSN, credit cards, and/or bank account numbers are found on unsecured online locations.

Ransomware Attack on U.S. Gas Pipeline

Earlier in February 2020, a ransomware attack on a U.S. natural gas supplying facility brought its operations to a standstill for two days when the organization’s incidence response team implemented a deliberate and controlled shutdown to contain the ransomware spread.

In an alert issued by CISA (Cybersecurity and Infrastructure Security Agency), the government agency did not mention the time, date, type/name of the ransomware or the natural gas facility name that was impacted. But it did mention other vital information like the way this ransomware attack was carried out so that in future other organizations can take useful notes in planning their risk mitigation measures.

Japan’s Trend Micro to Help Boost Cybersecurity in Kazakhstan

NCSC and Microsoft Cyber Accelerator program

Japanese cybersecurity company Trend Micro signed an agreement on scientific and technical cooperation with Kazakh security firm T&T Security, to support a government initiative known as the “Concept of Cyber Security” or “Kazakhstan Cyber Shield.” The new partnership is intended to develop and implement local projects in the field of information security in Kazakhstan.

As per the alliance, T&T Security integrates Trend Micro’s existing security solutions to monitor suspicious network activity, malware threats, prevent intrusions, and protect servers and workstations from potential cyber risks. Founded in 2013, T&T Security helps organizations combat new generation of cyberthreats, which are not detected by traditional antivirus technology. The company claims that its security solution “tLab system” is a leading-edge malware protection product that can identify malicious software.

Ruslan Abdikalikov, the Deputy Chairman of the Information Security Committee of the Ministry of Digital Development, Innovation and Aerospace Industry of Kazakhstan, stated that that the partnership will strengthen the security posture of the state’s information systems and enhance its cybersecurity landscape.

Earlier, Trend Micro made a strategic partnership with the developer-first security company Snyk to help businesses cope with potential vulnerabilities without interrupting the software delivery process. The alliance integrated open source vulnerability intelligence from Snyk with Trend Micro’s comprehensive ability to detect vulnerabilities for teams operating in a DevOps environment. Snyk helps enterprises in detecting and fixing the vulnerabilities and license violations in open source dependencies. The company claimed that its security solutions platform is built on a comprehensive, proprietary vulnerability database, and maintained by security veterans in Israel and London.

Only 38% of Government Employees Trained on Ransomware Prevention: IBM Report

A recent survey, “Public Sector Security Research,” from IBM Security revealed the results of the local and state employees’ preparedness toward dealing with cyberattacks. The study, jointly conducted by IBM and market research company Harris Poll, found that 73% of government employees are concerned about potential ransomware attacks to cities across the U.S while adding that only 38% of employees were trained to prevent ransomware attacks.

The study, which surveyed 690 people working for state and local agencies in the U.S., highlighted that 52% of security professionals feel their budgets for handling cyberattacks have remained the same over the years. More than 100 cities across the U.S. were hit with ransomware in 2019, with one in six respondents disclosing that their department was affected by a ransomware attack.

Employees in Public Education Sector

Public schools and government education agencies became the biggest target for cybercriminals in 2019. According to the survey findings, ransomware affected school districts in New York, Massachusetts, New Jersey, Louisiana and other states last year. The effects of such attacks resulted in the loss of personal information, including student grades and qualifications, teacher employment and payroll information, family records and medical health records

The study also found that respondents from the field of education had the lowest amount of cybersecurity training compared to other state and local professionals. Nearly, 44% of employees from the public education sector said they hadn’t received basic cybersecurity training, while 70% said they hadn’t received adequate training specifically on how to respond to a cyberattack.

2020 Elections Concerns

The study also found that 63% of respondents were concerned that a cyberattack could disrupt the upcoming elections. The fear of ransomware attacks feel real to a majority of government employees, with 73% expressing their concerns about threats to U.S. cities. Also, the Cybersecurity Infrastructure Security Agency (CISA) earlier warned that ransomware attacks pose a heightened risk to the elections.

“The emerging ransomware epidemic in our cities highlights the need for cities to better prepare for cyberattacks just as frequently as they prepare for natural disasters,” said Wendi Whitmore, VP of Threat Intelligence, IBM Security. “The data in this new study suggests local and state employees recognize the threat but demonstrate overconfidence in their ability to react to and manage it. Meanwhile, cities and states across the country remain a ripe target for cybercriminals.”

Ransomware Attacks and Data Breaches on U.S. Schools and Colleges Triple in 2019

Ransomware attacks, ransomware, Sinclair Broadcast group

According to a report from the K-12 Cybersecurity Resource Center, the K-12 public school districts and education agencies across the U.S. suffered a total of 348 cyberattacks in 2019, which is three times more incidents that were disclosed in 2018. The report, “The State of K-12 Cybersecurity: 2019 Year in Review,” stated that most of the attacks that were significant resulted in the theft of millions of dollars, stolen identities, denial of access to school technology and IT systems for weeks. The effect of such attacks on educational institutions resulted in loss of personal information, including student grades and qualifications, teacher employment and payroll information, and family records and medical health records.

The report also highlighted that 775 cybersecurity incidents impacted students and educators since 2016, in which over 50% of them were due to insiders in the school community, including vendors and other third-party partners. The second most frequent type of security incident suffered by schools, according to the report, was ransomware attacks.

Douglas A. Levin, President of EdTech Strategies and report author, said, “There are important steps policymakers, IT leaders, and educators can collectively take to help mitigate the cyber risks facing school districts. These include investing in greater K-12 IT security capacity, mandating baseline K-12 cybersecurity risk management practices via regulation and supporting enhanced information sharing and research.”

Ransomware Attacks on K-12 Schools

According to a report from Emsisoft, an anti-malware and anti-virus service provider, there were around 86 universities, colleges, and school districts impacted, which in turn disrupted operations of nearly 1,224 individual schools due to ransomware attacks. The report also shared a list of  top three incidents of public schools being affected by ransomware attacks:

Louisiana public schools: In July 2019, Louisiana Governor declared a state of emergency after three public school districts fell victim to ransomware. A State of Emergency was re-invoked in November when another ransomware attack affected 10% of Louisiana’s 5,000 network servers and more than 1,500 computers.

Rockville Centre School District: On July 25, 2019, Ryuk ransomware hit Rockville Centre School District. The district’s insurance carrier negotiated the ransom demand of US$176,000 down to US$88,000, which was covered by them.

Las Cruces Public Schools: In late October 2019, a ransomware attack infected thousands of servers and devices in Las Cruces Public Schools, New Mexico. The district disagreed to pay the ransom and instead ended up reformatting close to 30,000 devices.

K-12 Cybersecurity Act

K-12 district schools have been a soft target for cybercriminals. To address the same, two U.S. Senators, Gary Peters (Michigan) and Rick Scott (Florida), both members of the Senate’s National Security and Government Affairs Committee, have tabled a new bill called “K-12 Cybersecurity Act” in December 2019.

The K-12 Cybersecurity Act was introduced to address the rising threat prospective on K-12 schools.  The Act directs the DHS Cybersecurity and Infrastructure Security Agency (CISA) to first study the specific cybersecurity risks associated with K-12 educational institutions. Once the study is done, CISA will then be responsible to develop cybersecurity recommendations and set up online tools to help schools with their cybersecurity requirements.

Technical Error in Samsung’s U.K. Website Exposes Customers’ Data

Smartphone manufacturer Samsung Electronics Co. Ltd. revealed that a technical glitch on its U.K. website temporarily exposed the private information of around 150 customers. The issue came to light after some of its customers reported that they were able to access information of other customers on the website.

The South Korean manufacturer said the error exposed customer data including names, contact details, addresses, email IDs, and details of previous orders. However, the company clarified that only its U.K. customers were affected, and no credit card and financial information were exposed in the incident. Samsung halted all user logins into the website, after it became aware of the error until the issue was resolved. The company also stated that it will notify the affected customers.

Technical Glitches in Samsung Galaxy S10

In October 2019, Samsung issued an apology after a user reported technical issues with fingerprint recognition on its flagship Galaxy S10 smartphone. The user stated that she bought a new US$3.50 screen protector for her Galaxy S10 device and then registered her fingerprint for its on-screen fingerprint recognition security feature. She later realized that her husband was able to unlock her phone even without registering his fingerprint with the mobile phone’s fingerprint reader. To double-check this flaw, she asked her sister to unlock the phone using her fingerprint and to her surprise, this worked as well.

It is a known fact that smartphone biometric security features are not as secure as they claim to be but fooling the Samsung Galaxy S10 device with a mere US$3.50 screen protector is difficult to digest. This is not the first time that Samsung faced issues with its biometric security features. Previously, Samsung’s other flagship smartphone, Galaxy S8, was laced with facial and iris recognition biometric security feature issues.

NULLCON to Launch 11th Edition of Cybersecurity Conference in Goa, India

NULLCON Goa

All roads lead to Goa, India’s tourist destination, next week, for the NULLCON 2020 Conference.  NULLCON, Asia’s leading information security conference, training and exhibition platform is all set to happen on March 6 and 7, 2020 at the Taj Hotel & Convention Centre, Dona Paula, Goa. It is one of the largest information security conferences where hackers, industry experts, vendors, delegates from the government, CISOs and other C-Suite executives come together to discuss the current scenario of information security and what lies ahead.

NULLCON started in 2010 and this is the 11th edition of the conference and exhibition. NULLCON offers extensive platforms, technical sessions, panels, and training workshops for the exchange of information about zero-day vulnerabilities, latest attack vectors, and other cyberthreats. Here, security researchers and experts from various fields discuss information security, along with showcasing multiple offensive and defensive security technologies.

The brand NULLCON was derived from “null” – the open security community, a registered not-for-profit society and the largest active security community in India.

Here are some of the highlights of the 11th edition of NULLCON.

NULLCON – Surveillance and Zero-Day:  

  1. Talk: The Metadata Trap: Whistleblowers in the Age of Surveillance and Big Data

Speaker: Micah Lee, Director of Information Security at The Intercept https://nullcon.net/website/goa-2020/speakers/micah-lee.php

Micah will discuss the evidence used against the eight (so far) U.S. government workers that the Trump Administration has prosecuted for talking to and sharing documents with the media, and what this means for the safety of whistleblowers in a world where everything we do is being logged. The surveillance is global, so the lessons are global as well.

  1. Talk: How KRACKing Amazon Echo exposed a billion+ vulnerable Wi-Fi devices

Speaker: Robert Lipovsky, Senior Malware Researcher at ESET

https://nullcon.net/website/goa-2020/speakers/robert-lipovsky.php

This talk will discuss Wi-Fi zero-day vulnerabilities involved in KRACKing Amazon Echo and Kindle. The attack, which could enable adversaries to decrypt wireless network packets, affects Wi-Fi chipsets used in over a billion devices.

NULLCON – macOS/iOS Security:

  1. Talk: Putting it all together: building an iOS jailbreak from scratch

Speaker: Umang Raghuvanshi, Security Researcher, specializing in iOS kernel and browser exploitation.

https://nullcon.net/website/goa-2020/speakers/umang-raghuvanshi.php

This talk will discuss in detail how iOS devices can be jailbroken.

  1. Talk: KTRW: The journey to build a debuggable iPhone

Speaker: Brandon Azad, Security Researched, at Google Project Zero

https://nullcon.net/website/goa-2020/speakers/brandon-azad.php

This talk will discuss a high severity bug found in Apple devices where a local attacker can gain elevated privileges on Apple TvOS and is assigned CVE-2020-3837.

NULLCON – Legal and Policy:

Panel Discussion: Hack the law: Protection for ethical cybersecurity research in India”

Moderator: Apar Gupta, Executive Director, Internet Freedom Foundation

https://nullcon.net/website/goa-2020/speakers/hack-the-law.php

This Panel Discussion will clearly assess the legal landscape, the needs of cybersecurity experts in India and the necessary legal reforms. The focus will be on different government policy and legislative initiatives such as the Cyber Security Policy, the Information Technology Act, Data Protection Bill and even sometimes tertiary laws such as defamation.

To register for a NULLCON Goa 2020 complimentary conference media pass (6th & 7th
March 2020):  https://nullcon.net/website/media-pass.php

CISO MAG’s editor Brian Pereira will be onsite to cover the NULLCON 2020 Conference in Goa.

Milton Security Group and SynED Partner to Boost Cyber Workforce in California

cybersecurty

Cybersecurity firm Milton Security Group announced a new partnership with SynED to increase employment opportunities in the cybersecurity industry in California. SynED is a non-profit organization that works with educational institutions, training partners, placement agencies, and service providers to increase a strong and highly skilled workforce across California.

Milton Security and SynED have established a baseline of skills to evaluate and further develop cybersecurity candidates. Milton Security will share this knowledge to assist other organizations in placing their candidates and building a stronger cybersecurity workforce. The company is specialized in 24/7 cyber threat hunting, monitoring, and incident response services.

Commenting on the new alliance, Ethan Coulter, President of Milton Security, said, “We help passionate people find their path into this industry. This not only benefits professionals seeking to enter our industry, but our customers as well, and yes, even our competitors. Our goal is to help even more people enter the cybersecurity industry and we have established a successful legacy by hiring individuals who do not fit a traditional mold.”

Scott Young, President of SynED, said, “Through strong partnerships, like we have with Milton Security, we will build the foundation of a new approach for developing a robust cybersecurity talent supply chain and subsequently strengthening the overall security of our nation. We are thrilled to work with such passionate and visionary partners.”

California Government’s Support to Cybersecurity Education

The government of California earlier announced its support to cybersecurity education and committed to providing programs and events that help train the next generation of cybersecurity professionals. The officials also initiated a program, the California Mayors Cyber Cup (CMCC), which utilizes cyber competitions to spread awareness about cybersecurity and the many career opportunities that exist within that field. CMCC brings students, parents, teachers, government officials, business leaders, and other stakeholders together to create awareness of cybersecurity issues and reinforce the connection between the community and the educational institutions to highlight the many career and business support resources available in each community.

1...237238239...409Page 238 of 409