Upgrade to Pro — share decks privately, control downloads, hide ads and more …

「サプライチェーン攻撃」に立ち向かう!SBOMを使った脆弱性管理がもたらす品質とスピード向上

 「サプライチェーン攻撃」に立ち向かう!SBOMを使った脆弱性管理がもたらす品質とスピード向上

Fb025419ed38f98df595eb2eafc859f4?s=128

ihcomega56

July 21, 2022
Tweet

More Decks by ihcomega56

Other Decks in Technology

Transcript

  1. ʮαϓϥΠνΣʔϯ߈ܸʯʹཱͪ޲͔͏ʂ 4#0.Λ࢖ͬͨ੬ऑੑ؅ཧ͕΋ͨΒ͢ ඼࣭ͱεϐʔυ޲্ σϒαϛՆ

  2. 4#0. 1

  3. લճͷσϒαϛͰ΋ औΓ্͛ͨςʔϚͰ͕͢ 2

  4. ࠷ۙɺؔ৺ͷߴ·ΓΛ ײ͡ΔͷͰ ΋ͬͱਂງΓͯ͠Έ·͢ 3

  5. ͜ͷਓ͍ͭ΋ ಉ͡Α͏ͳ࿩ͯ͠Μͳ ͍ͭ͜͠ͳ 4

  6. ͬͯࢥΘΕΔ·Ͱ ΍͍͖ͬͯ·͢ʂ 5

  7. %FW4FD0QTͷߟ͑ํΛ औΓೖΕͯ αʔϏεվળΛ ΑΓਐΊ͍͖ͯ·͠ΐ͏ʂ 6

  8. Α͜ͳͰ͢ 7 • +'SPHͷ%FWFMPQFS"EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS ޿ࠂձࣾ

    ূ݊ελʔτΞοϓ • ژ౎ʹٚԂࡇ͕ؼ͖ͬͯͨʂ !"#$$%&' (#)*+,%-.
  9. ιϑτ΢ΣΞͷαϓϥΠνΣʔϯ • ιϑτ΢ΣΞ͕ຊ൪؀ڥʹσϓϩΠ͞ΕɺϢʔβʔͷݩ΁ಧ͘ ·ͰͷҰ࿈ͷྲྀΕɺ޻ఔ • ଟ͘ͷ৔߹ɺґଘ͢ΔϥΠϒϥϦ΍αʔυύʔςΟʔͷίʔυ ͳͲΛऔΓࠐΉͨΊɺαϓϥΠνΣʔϯ͸ෳࡶʹͳΔ • ιϑτ΢ΣΞαϓϥΠνΣʔϯͷͲ͔͜Ͱѱҙ͋Δίʔυ΍ ύοέʔδ͕૊Έࠐ·ΕΔ͜ͱΛαϓϥΠνΣʔϯ߈ܸͱ͍͏

    8 ιʔείʔυ ґଘ Ϗϧυ ϦϦʔε αʔϏε ࢖༻։࢝
  10. ༷ʑͳϑΣʔζʹજΉڴҖ 9 ιʔε ίʔυ ґଘ Ϗϧυ ϦϦ ʔε SOURCE THREATS

    BUILD THREATS DEPENDENCY THREATS A B C D F G H E ग़యɿ ೥݄೔ (JU)VC#MPHʠ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʡ IUUQTHJUIVCCMPHTMTBDPNQMJBODFXJUIHJUIVCBDUJPOT ೥݄೔ (PPHMF4FDVSJUZ#MPHʠ*OUSPEVDJOH4-4" BO&OEUP&OE'SBNFXPSLGPS4VQQMZ$IBJO*OUFHSJUZʡ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM ʮ4-4" αϧα ʯΑΓ ͦ͜ɺେৎ෉ʁ νΣοΫϙΠϯτ "ίʔυϨϏϡʔ #7$4Ͱͷ؅ཧ $ίʔυͷීวੑ %Ϗϧυ؀ڥ &ґଘؔ܎ '$*$% (ύοέʔδϦϙδτϦ )࢖༻ύοέʔδͷબ୒
  11. Կ͔ΒऔΓ૊Ή΂͖͔ʁ 10

  12. ͷιϑτ΢ΣΞɺ ͷΤϯλʔϓϥΠζ޲͚ιϑτ΢ΣΞ͕ ΦʔϓϯιʔεͷίϯϙʔωϯτΛؚΉ ͷ߈ܸ͕αϓϥΠϠʔ΁ͷ৴པΛ ѱ༻ͨ͠΋ͷͰ͋Γɺ_Ͱ ഒʹ૿͑ͨ ೥ʹ߈ܸ͸ ഒʹ૿͑Δͱ༧૝͞Ε͍ͯΔ 11 ग़యɿ

    ೥݄೔ (JU)VC#MPHʠ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʡ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT ʠ5ISFBU-BOETDBQFGPS4VQQMZ$IBJO"UUBDLTʡ IUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJOUISFBUTHJUIVCCMPH
  13. ࠷ۙͷࣄྫ 12 12 ग़యɿ +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱ IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX

  14. ਪҠతґଘؔ܎ • ιϑτ΢ΣΞͷґଘ͸܁Γฦ͞ΕΔ • ͢΂ͯ೺Ѳͯ͠ηΩϡϦςΟରࡦ͠ͳͯ͘͸ͳΒͳ͍ 13

  15. 4#0.Λ࡞Ζ͏ 14

  16. 4#0.ͱ͸ • 4PGUXBSF#JMM0G.BUFSJBMT ιϑτ΢ΣΞ෦඼ද • ιϑτ΢ΣΞΛߏ੒͢ΔίϯϙʔωϯτͱϝλσʔλͷҰཡ • ੬ऑੑ΍ϥΠηϯεͷ؍఺Ͱ҆શੑΛ֬ೝɾอূ͢Δͷʹ࢖͏ • ΞϝϦΧͰ͸ɺ੓෎ͱؔΘΔॏཁͳιϑτ΢ΣΞʹ͓͍ͯ4#0.

    ͕ٛ຿Խ͞ΕΔ΄Ͳϝδϟʔͳଘࡏͱͳ͍ͬͯΔ 15
  17. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷϥΠϒϥϦ • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ • ϓϩϓϥΠΤλϦͳίʔυ • 4BB4ͷ৔߹ "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ

    16
  18. ͭͷ࠷খཁૉ • %BUB'JFMET • 4#0.͕ه࿥ɾ؅ཧ͢Δ৘ใΛ໌֬ʹจॻԽ͢Δ • "VUPNBUJPO4VQQPSU • ੜ੒΋࢖༻΋ࣗಈԽͰ͖ΔΑ͏ʹ͢Δ •

    1SBDUJDFTBOE1SPDFTTFT • 4#0.Λ࢖ͬͨΦϖϨʔγϣϯΛఆٛ͢Δ 17
  19. %BUB'JFMET 18 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ 4#0. ࣗମͷ ৘ใ ιϑτ ΢ΣΞ

    ͷ৘ใ
  20. %BUB'JFMET 19 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ϑΥʔϚοτ ࡞੒ऀ 4#0. ࣗମͷ ৘ใ

    λΠϜελϯϓ
  21. %BUB'JFMET 20 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ίϯϙʔωϯτ໊ όʔδϣϯ αϓϥΠϠʔ ιϑτ ΢ΣΞ

    ͷ৘ใ ࣝผ༻ͷΩʔ
  22. %BUB'JFMET 21 ग़యɿ 4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ιϑτ ΢ΣΞ ͷ৘ใ ґଘؔ܎

  23. "VUPNBUJPO4VQQPSU • ࣗಈԽ͓Αͼ૊৫ͷ֞ࠜΛӽ͑ͨӡ༻ͷͨΊɺ4#0.͸ඪ४ ϑΥʔϚοτʹଇͬͯੜ੒͢Δ • 4PGUXBSF1BDLBHF%BUB&YDIBOHF 41%9 ࠃࡍඪ४ • 4PGUXBSF*EFOUJGJDBUJPO

    48*% • $ZDMPOF%9 • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͢Δͷ͕๬·͍͠ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 22
  24. πʔϧͷछྨ • ࣗಈɾखಈ͍ͣΕ΋͋Δ ࣗಈ͕Φεεϝ • ࣗಈͷ৔߹ɺϏϧυ࣌ʹੜ੒͢Δ͔ɺϏϧυࡁΈͷ ΞʔςΟϑΝΫτΛղੳ͢Δ • ਓ͕ಡΊΔܗͰදࣔ͠ҙࢥܾఆʹ໾ཱͯΔ •

    4#0.ಉ࢜Λൺֱ͢Δ • 4#0.ΛγεςϜʹಡΈࠐΈ׆༻͢Δ • ผͷϑΥʔϚοτʹม׵͢Δ • ෳ਺ͷ4#0.Λ౷߹͢Δ 23 ੜ੒ ࢖༻ ফඅ ม׵ ·ͣ͸͔͜͜Β ൃల్தͰ σϑΝΫτ ελϯμʔυͱ ݴ͑Δπʔϧ͸ ·ͩͳ͍
  25. 1SBDUJDFTBOE1SPDFTTFT • Ϗϧυ΍ϦϦʔεʹΑΓιϑτ΢ΣΞ͕ߋ৽͞ΕͨΒ 4#0.΋৽ͨʹ࡞੒͢Δ • 4#0.ʹޡΓ͕ݟ͔ͭͬͨΒमਖ਼͢Δ • ਪҠతґଘؔ܎΋ؚΊৄࡉͳϦετΛ࡞Δ • ѱҙ͋Δύοέʔδ͕ʮͳ͍ʯ͜ͱΛূ໌͢Δʹ͸ɺ

    ׬શͳ໢ཏੑ͕ඞཁͱͳΔ • ґଘؔ܎ͷ໢ཏੑ͕෼͔Γ͖͍ͬͯΔՕॴͱෆ໌֬ͳ Օॴ͸۠ผ͠ɺͦͷࢫΛ໌ه͢Δ 24 ස౓ ਂ͞ ط஌ͷະ஌ ,OPXO6OLOPXO
  26. 1SBDUJDFTBOE1SPDFTTFT • ඞཁͱ͢Δਓ͕ద੾ͳλΠϛϯάͰ࢖༻Ͱ͖Δ • ر๬ʹԠͨ͡ΞΫηε੍ޚΛ࣮ݱ͢Δ • ϥΠηϯε΍ܖ໿ͰఆΊΔ • αϓϥΠνΣʔϯͷϦεΫ؅ཧ͸·ͩൃల్தͳͷͰ 4#0.ʹ͍ͭͯ΋՝୊΍Τϥʔʹରͯ͠׮༰Ͱ͍Δ

    • ͜Ε͔Β΋มԽɾਐԽΛ൐͏͕ɺ੒ख़Λ଴ͭΑΓࠓ೔ ͔Β࢝ΊΔ 25 ഑෍ɾ഑৴ ΞΫηε ੍ޚ ؒҧ͍ͷ ڐ༰
  27. Α͋͘Δ৺഑ த਎Λશ෦ࡽͯ͠େৎ෉ʁ৘ใ࿙͍͑ʹͭͳ͕Βͳ͍ʁ • ιʔείʔυΛެ։͢ΔΘ͚Ͱ͸ͳ͍ • ΞλοΧʔ͕4#0.Λ߈ܸͷཔΓʹ͢Δ͜ͱ͸ͳ͍ʢ΋ͬͱଞͷ ޮ཰ྑ͍΍ΓํΛऔΔʣͷͰɺ߈ܸͷରࡦͱͯ͠ͷϝϦοτͷ ํ͕େ͖͍ • 4#0.Λެ։͢Δ͔Ͳ͏͔͸ࣗ༝Ͱ͋Δ

    4#0.ͬͯ৴༻͍͍ͯ͠ͷʁ • 4#0.ͷ࡞੒ऀ͕ॺ໊Λ෇༩͢Δ 4-4"ͷߟ͑ํʹ΋ؔ࿈ 26
  28. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔ͷௐ͕ࠪ ౰વඞཁͱͳΔ • ιϑτ΢ΣΞΛεΩϟϯͯ͠ɺ੬ऑੑ΍ϥΠηϯεҧ൓ͳͲΛ ௐ΂Δʹ4$" • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ$*$%࣮ߦ࣌ ʹ4$"΋ࣗಈͰߦ͏

    27 SCA Ϗϧυ 2" ։ൃ ϦϦʔε SCA SCA
  29. 4$"Λ࢝ΊΔ • طʹߦ͍ͬͯΔ੬ऑੑ਍அ΍ίʔυͷ੩తղੳʹՃ͑औΓ૊Ή • ಋೖɾ੬ऑੑ͕ݟ͔ͭͬͨͱ͖ͷରԠ͕ଞͷ਍அΑΓָͳ͜ͱ ΋Α͋͘Δ • ੬ऑͳϥΠϒϥϦΛؚΉιϑτ΢ΣΞͷ໿͸ϥΠϒϥϦ ͷߋ৽ʹΑΓमਖ਼͞ΕΔͱਪఆ͞Ε͍ͯΔ 28

  30. ΞʔςΟϑΝΫτͱϝλσʔλͷ؅ཧ • 4#0.ͷ࡞੒΍4$"͸ιʔείʔυͰ͸ͳ͘Ϗϧυͨ͠੒Ռ෺ ʢΞʔςΟϑΝΫτʣʹରͯ͠ߦ͏ํ͕๬·͍͠ • ΞʔςΟϑΝΫτ͸ґଘղܾ͕ࡁΜͰ͓Γɺιʔείʔυʹ ͳ͍৘ใΛ͍࣋ͬͯΔͨΊ • ιϑτ΢ΣΞ͸Ϗϧυͷ౓ʹ಺༰͕มΘΔՄೳੑ͕͋ΔͨΊ ؀ڥม਺ɺґଘղܾͰऔಘ͢ΔϥΠϒϥϦͷόʔδϣϯͳͲ

    ͕มΘΓ͠͏Δ • ΞʔςΟϑΝΫτ͸ϝλσʔλͱͱ΋ʹઐ༻ϦϙδτϦͰ؅ཧ ͢Δ • 4#0.ʹؚ·ΕΔ಺༰͓ΑͼϏϧυͨ͠؀ڥͷ৘ใͳͲ 29
  31. εςοϓΞοϓ 30 4#0.Λੜ੒͠Α͏ ΞʔςΟϑΝΫτʹର͠ 4$"Λ࣮ࢪ͠Α͏ ιʔείʔυͷΈͰͳ͘ ΞʔςΟϑΝΫτ΋؅ཧ͠Α͏

  32. εςοϓΞοϓ 31 4#0.Λੜ੒͠Α͏ ΞʔςΟϑΝΫτʹର͠ 4$"Λ࣮ࢪ͠Α͏ ιʔείʔυͷΈͰͳ͘ ΞʔςΟϑΝΫτ΋؅ཧ͠Α͏ ஌Ζ͏ɺߟ͑Α͏

  33. ͳͥ%FW4FD0QTͷߟ͑ํ͕େࣄͳͷ͔ • ҆શͳιϑτ΢ΣΞΛఏڙ͢ΔͨΊ • αʔϏεͷվળΛޮ཰Α͘ߦ͏ͨΊ ηΩϡϦςΟରࡦͷϕετϓϥΫςΟεΛऔΓೖΕɺࣗಈԽ͞Εͨ ؀ڥΛ࡞͓ͬͯ͘͜ͱͰɺଞͷ͜ͱʹຊདྷूத͍ͨ͜͠ͱʹ࣌ؒ΍ ࿑ྗΛׂ͘͜ͱ͕Ͱ͖Δʂ 32

  34. 4#0.ɺ ͥͻ֮͑ͯؼ͍ͬͯͩ͘͞ʂ 33

  35. গ͠Ͱ΋ %FW4FD0QTΛ ਎ۙʹײ͍ͯͩ͘͡͞ʂ 34

  36. ࢲ΋։ൃऀ࣌୅͸ ηΩϡϦςΟେݏ͍ͳ υૉਓͰͨ͠ʜ 35

  37. %FWɾ4FDɾ0QT Ͳ͏าΈدΔ͔ɺ ͪΐͬͱߟ͑ͯΈ·͠ΐ͏ 36

  38. 37 ࣗݾ঺հ • ࢁܗݝ௽Ԭࢢੜ·Ε ࢁܗݝ௽Ԭࢢࡏॅ • େֶ࣌୅͸ؠखˠٶ৓Ͱա͝͠ɺब৬Λػʹ্ژ • ೥ʹ஍ݩʹ6λʔϯ͠ɺϦϞʔτϫʔΫͰ࢓ࣄ ࠤ౻

    ༝ٱ 4"50:PTIJIJTB @umekichi1984 • 4*FSͰΞϓϦέʔγϣϯͷ։ൃΤϯδχΞ΍ΞʔΩςΫτɺ *5ίϯαϧΛܦݧ • ఏҊʙཁ݅ఆٛʙઃܭɾ։ൃʙಋೖɺͦͷޙͷӡ༻อक·Ͱ • ೥݄ΑΓ +'SPH +BQBOͷσϕϩούʔΞυϘέΠτ • ͍Ζ͍ΖͳΤϯδχΞͱؔΘͬͯɺΤϯδχΞ໨ઢͰ৘ใ ൃ৴͍͖͍ͯͨ͠ʂ ग़਎ ܦྺ • υϥΠϒɺ໺ࡊ࡞Γɺ৯΂ΔɾҿΉɾ࿩͢ झຯ
  39. গ͓͠͠Ό΂Γ • ։ൃऀ࣌୅ɺηΩϡϦςΟͱͲ͏޲͖߹͍͔ͬͯͨʁ • ηΩϡϦςΟͷઐ໳Ո͕ۙ͘ʹ͍͔ͨʁ • ͲΜͳ͜ͱʹࠔ͍͔ͬͯͨʁ • ࠓ͸Ͳ͏ࢥ͏͔ʁ͜Ε͔ΒͲ͏͍͖͍͔ͯͨ͠ʁ 38

  40. +'SPHͷΠϕϯτ 39 ͥͻ਎ۙͳํʹ Φεεϝͯ͠ ͍ͩ͘͞ʂ τʔΫ ηογϣϯ ָ͠Έ·͠ΐ͏ʂ ৄࡉ͸DPOOQBTT΁ https://jfrog.connpass.com

  41. ΞϯέʔτͰΞϯΧʔήοτ 40 நબͰ໊༷ʹ "OLFS/BOP**8 খ͍͞ͷʹٸ଎ॆిͰ͖Δʂ

  42. 41 Thank you

  43. ࢀߟจݙ • ;%/FU೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH೥݄೔ܝࡌʮ-PH4IFMMθϩσΠ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX • 4ZOPQTZTXIJUFQBQFSʮ0QFO4PVSDF3JTLJO."CZUIF/VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTL NBOVNCFSTQEG •

    ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSFZPVS044EFQFOEFODJFT7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZPG&YJTUJOH4#0.'PSNBUTBOE4UBOEBSETʯIUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ @WFSTJPO@QEG • ೔ܦ95&$)೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTUQSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQDPOUFOUVQMPBET#FTU QSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG • ೥݄೔ (JU)VC#MPHʮ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʯ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT • ʮ5ISFBU-BOETDBQFGPS4VQQMZ$IBJO"UUBDLTʯIUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJO UISFBUTHJUIVCCMPH • ೥݄೔ (JU)VC#MPHʮ"DIJFWJOH4-4"$PNQMJBODFXJUI(JU)VC"DUJPOTBOE4JHTUPSF GPS(PNPEVMFTʯIUUQTHJUIVCCMPHTMTB DPNQMJBODFXJUIHJUIVCBDUJPOT • 5IF6OJUFE4UBUFT%FQBSUNFOUPG$PNNFSDFʮ 5IF.JOJNVN&MFNFOUT'PSB4PGUXBSF#JMMPG.BUFSJBMT 4#0. ʯ IUUQTXXXOUJBEPDHPWGJMFTOUJBQVCMJDBUJPOTTCPN@NJOJNVN@FMFNFOUT@SFQPSUQEG • ೥݄೔ (PPHMF4FDVSJUZ#MPHʮ*OUSPEVDJOH4-4" BO&OEUP&OE'SBNFXPSLGPS4VQQMZ$IBJO*OUFHSJUZʯ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM 42 42