「サプライチェーン攻撃」に立ち向かう！SBOMを使った脆弱性管理がもたらす品質とスピード向上

Transcript

1. ʮαϓϥΠνΣʔϯ߈ܸʯʹཱͪ޲͔͏ʂ 4#0.Λ࢖ͬͨ੬ऑੑ؅ཧ͕΋ͨΒ͢ ඼࣭ͱεϐʔυ޲্ 
   σϒαϛՆ
2. 4#0. 1
3. લճͷσϒαϛͰ΋ औΓ্͛ͨςʔϚͰ͕͢ 2
4. ࠷ۙɺؔ৺ͷߴ·ΓΛ ײ͡ΔͷͰ ΋ͬͱਂງΓͯ͠Έ·͢ 3
5. ͜ͷਓ͍ͭ΋ ಉ͡Α͏ͳ࿩ͯ͠Μͳ ͍ͭ͜͠ͳ 4
6. ͬͯࢥΘΕΔ·Ͱ ΍͍͖ͬͯ·͢ʂ 5
7. %FW4FD0QTͷߟ͑ํΛ औΓೖΕͯ αʔϏεվળΛ ΑΓਐΊ͍͖ͯ·͠ΐ͏ʂ 6
8. Α͜ͳͰ͢ 7 • +'SPHͷ%FWFMPQFS
   "EWPDBUF • %FW0QTΛ੝Γ্͍͛ͯ͘κ • લ৬·Ͱ͸ओʹόοΫΤϯυͷ։ൃ 4*FS 
   ޿ࠂձࣾ 
   ূ݊ελʔτΞοϓ • ژ౎ʹٚԂࡇ͕ؼ͖ͬͯͨʂ !"#$$%&' (#)*+,%-.
9. ιϑτ΢ΣΞͷαϓϥΠνΣʔϯ • ιϑτ΢ΣΞ͕ຊ൪؀ڥʹσϓϩΠ͞ΕɺϢʔβʔͷݩ΁ಧ͘ ·ͰͷҰ࿈ͷྲྀΕɺ޻ఔ • ଟ͘ͷ৔߹ɺґଘ͢ΔϥΠϒϥϦ΍αʔυύʔςΟʔͷίʔυ ͳͲΛऔΓࠐΉͨΊɺαϓϥΠνΣʔϯ͸ෳࡶʹͳΔ • ιϑτ΢ΣΞαϓϥΠνΣʔϯͷͲ͔͜Ͱѱҙ͋Δίʔυ΍ ύοέʔδ͕૊Έࠐ·ΕΔ͜ͱΛαϓϥΠνΣʔϯ߈ܸͱ͍͏ 8 ιʔείʔυ ґଘ Ϗϧυ ϦϦʔε αʔϏε ࢖༻։࢝
10. ༷ʑͳϑΣʔζʹજΉڴҖ 9 ιʔε ίʔυ ґଘ Ϗϧυ ϦϦ ʔε SOURCE THREATS BUILD THREATS DEPENDENCY THREATS A B C D F G H E ग़యɿ ೥݄೔ (JU)VC
    #MPH
    ʠ"DIJFWJOH
    4-4"
    
    $PNQMJBODF
    XJUI
    (JU)VC
    "DUJPOT
    BOE
    4JHTUPSF GPS
    (P
    NPEVMFTʡ IUUQTHJUIVCCMPHTMTBDPNQMJBODFXJUIHJUIVCBDUJPOT ೥݄೔ (PPHMF
    4FDVSJUZ
    #MPH
    ʠ*OUSPEVDJOH
    4-4"
    BO
    &OEUP&OE
    'SBNFXPSL
    GPS
    4VQQMZ
    $IBJO
    *OUFHSJUZʡ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM ʮ4-4"
    αϧα ʯΑΓ ͦ͜ɺେৎ෉ʁ νΣοΫϙΠϯτ "
    ίʔυϨϏϡʔ #
    7$4Ͱͷ؅ཧ $
    ίʔυͷීวੑ %
    Ϗϧυ؀ڥ &
    ґଘؔ܎ '
    $*$% (
    ύοέʔδϦϙδτϦ )
    ࢖༻ύοέʔδͷબ୒
11. Կ͔ΒऔΓ૊Ή΂͖͔ʁ 10
12. ͷιϑτ΢ΣΞɺ ͷΤϯλʔϓϥΠζ޲͚ιϑτ΢ΣΞ͕ ΦʔϓϯιʔεͷίϯϙʔωϯτΛؚΉ ͷ߈ܸ͕αϓϥΠϠʔ΁ͷ৴པΛ ѱ༻ͨ͠΋ͷͰ͋Γɺ_Ͱ ഒʹ૿͑ͨ ೥ʹ߈ܸ͸ ഒʹ૿͑Δͱ༧૝͞Ε͍ͯΔ 11 ग़యɿ ೥݄೔ (JU)VC
    #MPH
    ʠ"DIJFWJOH
    4-4"
    
    $PNQMJBODF
    XJUI
    (JU)VC
    "DUJPOT
    BOE
    4JHTUPSF GPS
    (P
    NPEVMFTʡ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT ʠ5ISFBU
    -BOETDBQF
    GPS
    4VQQMZ
    $IBJO
    "UUBDLTʡ IUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJOUISFBUTHJUIVCCMPH
13. ࠷ۙͷࣄྫ 12 12 ग़యɿ +'SPH
    ೥݄೔ܝࡌʮ-PH4IFMM
    θϩσΠ
    ஌͓ͬͯ͘΂͖͜ͱ IUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX
14. ਪҠతґଘؔ܎ • ιϑτ΢ΣΞͷґଘ͸܁Γฦ͞ΕΔ • ͢΂ͯ೺Ѳͯ͠ηΩϡϦςΟରࡦ͠ͳͯ͘͸ͳΒͳ͍ 13
15. 4#0.Λ࡞Ζ͏ 14
16. 4#0.ͱ͸ • 4PGUXBSF
    #JMM
    0G
    .BUFSJBMT
    ιϑτ΢ΣΞ෦඼ද • ιϑτ΢ΣΞΛߏ੒͢ΔίϯϙʔωϯτͱϝλσʔλͷҰཡ • ੬ऑੑ΍ϥΠηϯεͷ؍఺Ͱ҆શੑΛ֬ೝɾอূ͢Δͷʹ࢖͏ • ΞϝϦΧͰ͸ɺ੓෎ͱؔΘΔॏཁͳιϑτ΢ΣΞʹ͓͍ͯ4#0. ͕ٛ຿Խ͞ΕΔ΄Ͳϝδϟʔͳଘࡏͱͳ͍ͬͯΔ 15
17. 4#0.ͰҰཡԽ͢Δίϯϙʔωϯτ • ιϑτ΢ΣΞ͕ґଘɾ࢖༻͢Δ044΍αʔυύʔςΟͷϥΠϒϥϦ • ιϑτ΢ΣΞ͕࢖͏ΞυΦϯɺϓϥάΠϯɺ֦ுػೳ • ϓϩϓϥΠΤλϦͳίʔυ • 4BB4ͷ৔߹
    "1*΍αʔυύʔςΟͷαʔϏεͷ৘ใ 16
18. ͭͷ࠷খཁૉ • %BUB
    'JFMET • 4#0.͕ه࿥ɾ؅ཧ͢Δ৘ใΛ໌֬ʹจॻԽ͢Δ • "VUPNBUJPO
    4VQQPSU • ੜ੒΋࢖༻΋ࣗಈԽͰ͖ΔΑ͏ʹ͢Δ • 1SBDUJDFT
    BOE
    1SPDFTTFT • 4#0.Λ࢖ͬͨΦϖϨʔγϣϯΛఆٛ͢Δ 17
19. %BUB
    'JFMET 18 ग़యɿ 4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ 4#0. ࣗମͷ ৘ใ ιϑτ ΢ΣΞ ͷ৘ใ
20. %BUB
    'JFMET 19 ग़యɿ 4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ϑΥʔϚοτ ࡞੒ऀ 4#0. ࣗମͷ ৘ใ λΠϜελϯϓ
21. %BUB
    'JFMET 20 ग़యɿ 4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ίϯϙʔωϯτ໊ όʔδϣϯ αϓϥΠϠʔ ιϑτ ΢ΣΞ ͷ৘ใ ࣝผ༻ͷΩʔ
22. %BUB
    'JFMET 21 ग़యɿ 4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSET IUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ ιϑτ ΢ΣΞ ͷ৘ใ ґଘؔ܎
23. "VUPNBUJPO
    4VQQPSU • ࣗಈԽ͓Αͼ૊৫ͷ֞ࠜΛӽ͑ͨӡ༻ͷͨΊɺ4#0.͸ඪ४ ϑΥʔϚοτʹଇͬͯੜ੒͢Δ • 4PGUXBSF
    1BDLBHF
    %BUB
    &YDIBOHF
    41%9 
    ࠃࡍඪ४ • 4PGUXBSF
    *EFOUJGJDBUJPO
    48*% • $ZDMPOF%9 • Ұ؏ͯ͠ಉ͡ϑΥʔϚοτͰ؅ཧ͢Δͷ͕๬·͍͠ • UBHWBMVFܗࣜ 41%9 ɺ+40/ɺ:".-ɺ9.-ͳͲʹରԠ • ਓؒʹ΋ػցʹ΋ಡΊΔ 22
24. πʔϧͷछྨ • ࣗಈɾखಈ͍ͣΕ΋͋Δ ࣗಈ͕Φεεϝ • ࣗಈͷ৔߹ɺϏϧυ࣌ʹੜ੒͢Δ͔ɺϏϧυࡁΈͷ ΞʔςΟϑΝΫτΛղੳ͢Δ • ਓ͕ಡΊΔܗͰදࣔ͠ҙࢥܾఆʹ໾ཱͯΔ • 4#0.ಉ࢜Λൺֱ͢Δ • 4#0.ΛγεςϜʹಡΈࠐΈ׆༻͢Δ • ผͷϑΥʔϚοτʹม׵͢Δ • ෳ਺ͷ4#0.Λ౷߹͢Δ 23 ੜ੒ ࢖༻ ফඅ ม׵ ·ͣ͸͔͜͜Β ൃల్தͰ σϑΝΫτ ελϯμʔυͱ ݴ͑Δπʔϧ͸ ·ͩͳ͍
25. 1SBDUJDFT
    BOE
    1SPDFTTFT • Ϗϧυ΍ϦϦʔεʹΑΓιϑτ΢ΣΞ͕ߋ৽͞ΕͨΒ 4#0.΋৽ͨʹ࡞੒͢Δ • 4#0.ʹޡΓ͕ݟ͔ͭͬͨΒमਖ਼͢Δ • ਪҠతґଘؔ܎΋ؚΊৄࡉͳϦετΛ࡞Δ • ѱҙ͋Δύοέʔδ͕ʮͳ͍ʯ͜ͱΛূ໌͢Δʹ͸ɺ ׬શͳ໢ཏੑ͕ඞཁͱͳΔ • ґଘؔ܎ͷ໢ཏੑ͕෼͔Γ͖͍ͬͯΔՕॴͱෆ໌֬ͳ Օॴ͸۠ผ͠ɺͦͷࢫΛ໌ه͢Δ 24 ස౓ ਂ͞ ط஌ͷະ஌ ,OPXO
    6OLOPXO
26. 1SBDUJDFT
    BOE
    1SPDFTTFT • ඞཁͱ͢Δਓ͕ద੾ͳλΠϛϯάͰ࢖༻Ͱ͖Δ • ر๬ʹԠͨ͡ΞΫηε੍ޚΛ࣮ݱ͢Δ • ϥΠηϯε΍ܖ໿ͰఆΊΔ • αϓϥΠνΣʔϯͷϦεΫ؅ཧ͸·ͩൃల్தͳͷͰ 4#0.ʹ͍ͭͯ΋՝୊΍Τϥʔʹରͯ͠׮༰Ͱ͍Δ • ͜Ε͔Β΋มԽɾਐԽΛ൐͏͕ɺ੒ख़Λ଴ͭΑΓࠓ೔ ͔Β࢝ΊΔ 25 ഑෍ɾ഑৴ ΞΫηε ੍ޚ ؒҧ͍ͷ ڐ༰
27. Α͋͘Δ৺഑ த਎Λશ෦ࡽͯ͠େৎ෉ʁ৘ใ࿙͍͑ʹͭͳ͕Βͳ͍ʁ • ιʔείʔυΛެ։͢ΔΘ͚Ͱ͸ͳ͍ • ΞλοΧʔ͕4#0.Λ߈ܸͷཔΓʹ͢Δ͜ͱ͸ͳ͍ʢ΋ͬͱଞͷ ޮ཰ྑ͍΍ΓํΛऔΔʣͷͰɺ߈ܸͷରࡦͱͯ͠ͷϝϦοτͷ ํ͕େ͖͍ • 4#0.Λެ։͢Δ͔Ͳ͏͔͸ࣗ༝Ͱ͋Δ 4#0.ͬͯ৴༻͍͍ͯ͠ͷʁ • 4#0.ͷ࡞੒ऀ͕ॺ໊Λ෇༩͢Δ 4-4"ͷߟ͑ํʹ΋ؔ࿈ 26
28. 4$"ʢιϑτ΢ΣΞίϯϙδγϣϯղੳʣ • 4#0.ͷ࡞੒ʹ͸ɺιϑτ΢ΣΞʹԿؚ͕·Ε͍ͯΔ͔ͷௐ͕ࠪ ౰વඞཁͱͳΔ • ιϑτ΢ΣΞΛεΩϟϯͯ͠ɺ੬ऑੑ΍ϥΠηϯεҧ൓ͳͲΛ ௐ΂Δʹ4$" • ੈͷதʹ͸༷ʑͳ4$"πʔϧ͕͋Γɺ͜ΕΛ࢖ͬͯ$*$%࣮ߦ࣌ ʹ4$"΋ࣗಈͰߦ͏ 27 SCA Ϗϧυ 2" ։ൃ ϦϦʔε SCA SCA
29. 4$"Λ࢝ΊΔ • طʹߦ͍ͬͯΔ੬ऑੑ਍அ΍ίʔυͷ੩తղੳʹՃ͑औΓ૊Ή • ಋೖɾ੬ऑੑ͕ݟ͔ͭͬͨͱ͖ͷରԠ͕ଞͷ਍அΑΓָͳ͜ͱ ΋Α͋͘Δ • ੬ऑͳϥΠϒϥϦΛؚΉιϑτ΢ΣΞͷ໿͸ϥΠϒϥϦ ͷߋ৽ʹΑΓमਖ਼͞ΕΔͱਪఆ͞Ε͍ͯΔ 28
30. ΞʔςΟϑΝΫτͱϝλσʔλͷ؅ཧ • 4#0.ͷ࡞੒΍4$"͸ιʔείʔυͰ͸ͳ͘Ϗϧυͨ͠੒Ռ෺ ʢΞʔςΟϑΝΫτʣʹରͯ͠ߦ͏ํ͕๬·͍͠ • ΞʔςΟϑΝΫτ͸ґଘղܾ͕ࡁΜͰ͓Γɺιʔείʔυʹ ͳ͍৘ใΛ͍࣋ͬͯΔͨΊ • ιϑτ΢ΣΞ͸Ϗϧυͷ౓ʹ಺༰͕มΘΔՄೳੑ͕͋ΔͨΊ ؀ڥม਺ɺґଘղܾͰऔಘ͢ΔϥΠϒϥϦͷόʔδϣϯͳͲ ͕มΘΓ͠͏Δ • ΞʔςΟϑΝΫτ͸ϝλσʔλͱͱ΋ʹઐ༻ϦϙδτϦͰ؅ཧ ͢Δ • 4#0.ʹؚ·ΕΔ಺༰͓ΑͼϏϧυͨ͠؀ڥͷ৘ใͳͲ 29
31. εςοϓΞοϓ 30 4#0.Λੜ੒͠Α͏ ΞʔςΟϑΝΫτʹର͠ 4$"Λ࣮ࢪ͠Α͏ ιʔείʔυͷΈͰͳ͘ ΞʔςΟϑΝΫτ΋؅ཧ͠Α͏
32. εςοϓΞοϓ 31 4#0.Λੜ੒͠Α͏ ΞʔςΟϑΝΫτʹର͠ 4$"Λ࣮ࢪ͠Α͏ ιʔείʔυͷΈͰͳ͘ ΞʔςΟϑΝΫτ΋؅ཧ͠Α͏ ஌Ζ͏ɺߟ͑Α͏
33. ͳͥ%FW4FD0QTͷߟ͑ํ͕େࣄͳͷ͔ • ҆શͳιϑτ΢ΣΞΛఏڙ͢ΔͨΊ • αʔϏεͷվળΛޮ཰Α͘ߦ͏ͨΊ ηΩϡϦςΟରࡦͷϕετϓϥΫςΟεΛऔΓೖΕɺࣗಈԽ͞Εͨ ؀ڥΛ࡞͓ͬͯ͘͜ͱͰɺଞͷ͜ͱʹຊདྷूத͍ͨ͜͠ͱʹ࣌ؒ΍ ࿑ྗΛׂ͘͜ͱ͕Ͱ͖Δʂ 32
34. 4#0.ɺ ͥͻ֮͑ͯؼ͍ͬͯͩ͘͞ʂ 33
35. গ͠Ͱ΋ %FW4FD0QTΛ ਎ۙʹײ͍ͯͩ͘͡͞ʂ 34
36. ࢲ΋։ൃऀ࣌୅͸ ηΩϡϦςΟେݏ͍ͳ υૉਓͰͨ͠ʜ 35
37. %FWɾ4FDɾ0QT Ͳ͏าΈدΔ͔ɺ ͪΐͬͱߟ͑ͯΈ·͠ΐ͏ 36
38. 37 ࣗݾ঺հ • ࢁܗݝ௽Ԭࢢੜ·Ε 
    ࢁܗݝ௽Ԭࢢࡏॅ • େֶ࣌୅͸ؠखˠٶ৓Ͱա͝͠ɺब৬Λػʹ্ژ • ೥ʹ஍ݩʹ6λʔϯ͠ɺϦϞʔτϫʔΫͰ࢓ࣄ ࠤ౻ ༝ٱ 4"50
    :PTIJIJTB @umekichi1984 • 4*FSͰΞϓϦέʔγϣϯͷ։ൃΤϯδχΞ΍ΞʔΩςΫτɺ *5ίϯαϧΛܦݧ • ఏҊʙཁ݅ఆٛʙઃܭɾ։ൃʙಋೖɺͦͷޙͷӡ༻อक·Ͱ • ೥݄ΑΓ +'SPH +BQBOͷσϕϩούʔΞυϘέΠτ • ͍Ζ͍ΖͳΤϯδχΞͱؔΘͬͯɺΤϯδχΞ໨ઢͰ৘ใ ൃ৴͍͖͍ͯͨ͠ʂ ग़਎ ܦྺ • υϥΠϒɺ໺ࡊ࡞Γɺ৯΂ΔɾҿΉɾ࿩͢ झຯ
39. গ͓͠͠Ό΂Γ • ։ൃऀ࣌୅ɺηΩϡϦςΟͱͲ͏޲͖߹͍͔ͬͯͨʁ • ηΩϡϦςΟͷઐ໳Ո͕ۙ͘ʹ͍͔ͨʁ • ͲΜͳ͜ͱʹࠔ͍͔ͬͯͨʁ • ࠓ͸Ͳ͏ࢥ͏͔ʁ͜Ε͔ΒͲ͏͍͖͍͔ͯͨ͠ʁ 38
40. +'SPHͷΠϕϯτ 39 ͥͻ਎ۙͳํʹ Φεεϝͯ͠ ͍ͩ͘͞ʂ τʔΫ ηογϣϯ ָ͠Έ·͠ΐ͏ʂ ৄࡉ͸DPOOQBTT΁ https://jfrog.connpass.com
41. ΞϯέʔτͰΞϯΧʔήοτ 40 நબͰ໊༷ʹ "OLFS
    /BOP
    **
    8 খ͍͞ͷʹٸ଎ॆిͰ͖Δʂ
42. 41 Thank you
43. ࢀߟจݙ • ;%/FU
    ೥݄೔ܝࡌʮถ੓෎ͳͲ΁ͷେن໛αΠόʔ߈ܸɺ4PMBS8JOETͷιϑτ΢ΣΞߋ৽Λѱ༻ʯ IUUQTKBQBO[EOFUDPNBSUJDMF • +'SPH
    ೥݄೔ܝࡌʮ-PH4IFMM
    θϩσΠ
    ஌͓ͬͯ͘΂͖͜ͱʯIUUQTKGSPHDPNKBCMPHMPHTIFMMEBZWVMOFSBCJMJUZBMMZPVOFFEUPLOPX • 4ZOPQTZT
    XIJUFQBQFSʮ0QFO
    4PVSDF
    3JTL
    JO
    ."
    CZ
    UIF
    /VNCFSTʯIUUQTXXXTZOPQTZTDPNDPOUFOUEBNTZOPQTZTTJHBTTFUTXIJUFQBQFSTXQSJTL NBOVNCFSTQEG • ʮʰηΩϡϦςΟɾεΩϟϯʱ෼໺ͷιϑτ΢ΣΞߏ੒෼ੳ 4$" ͱ͸ʁʯIUUQTXXXSJDLTPGUKQCMPHBSUJDMFTIUNM • ʮ&YQMPSF
    ZPVS
    044
    EFQFOEFODJFT
    7JTVBMMZʯIUUQTXXXMJOLFEJODPNQVMTFFYQMPSFZPVSPTTEFQFOEFODJFTWJTVBMMZNJDIBFMNVMMFS • ʮ4VSWFZ
    PG
    &YJTUJOH
    4#0.
    'PSNBUT
    BOE
    4UBOEBSETʯIUUQTXXXOUJBHPWGJMFTOUJBQVCMJDBUJPOTOUJB@TCPN@GPSNBUT@BOE@TUBOEBSET@XIJUFQBQFS@ @WFSTJPO@QEG • ೔ܦ95&$)
    ೥݄೔ܝࡌ τϤλ͕ਪ͢αΠόʔରࡦͷ৽ৗࣝʮ4#0.ʯɺྲྀग़͢ΔϦεΫ͸ʁ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • *5NFEJB /&84
    ೥݄೔ܝࡌ 044ʮGBLFSKTʯͱʮDPMPSTKTʯͷ։ൃऀɺࣗ਎ͰϥΠϒϥϦΛҙਤతʹվ͟Μ ʮͨͩಇ͖͸΋͏͠ͳ͍ʯ IUUQTXXXJUNFEJBDPKQOFXTBSUJDMFTOFXTIUNM • ܦࡁ࢈ۀল঎຿৘ใ੓ࡦہαΠόʔηΩϡϦςΟ՝ʮ044ͷར׆༻ٴͼͦͷηΩϡϦςΟ֬อʹ޲͚ͨ؅ཧख๏ʹؔ͢Δࣄྫूʯ IUUQTXXXNFUJHPKQQSFTTQEG • ʮ#FTU
    QSBDUJDFT
    GPS
    JOUSPEVDJOH
    +'SPH
    9SBZ
    JOUP
    ZPVS
    %FW4FD0QT QSPDFTTʯIUUQTNFEJBKGSPHDPNXQDPOUFOUVQMPBET#FTU QSBDUJDFTGPSJOUSPEVDJOH+'SPH9SBZJOUPZPVS%FW4FD0QTQSPDFTTQEG • ೥݄೔ (JU)VC
    #MPH
    ʮ"DIJFWJOH
    4-4"
    
    $PNQMJBODF
    XJUI
    (JU)VC
    "DUJPOT
    BOE
    4JHTUPSF GPS
    (P
    NPEVMFTʯ IUUQTXXXFOJTBFVSPQBFVQVCMJDBUJPOTUISFBUMBOETDBQFGPSTVQQMZDIBJOBUUBDLT • ʮ5ISFBU
    -BOETDBQF
    GPS
    4VQQMZ
    $IBJO
    "UUBDLTʯIUUQTHJUIVCCMPHTFDVSFZPVSTPGUXBSFTVQQMZDIBJOBOEQSPUFDUBHBJOTUTVQQMZDIBJO UISFBUTHJUIVCCMPH • ೥݄೔ (JU)VC
    #MPH
    ʮ"DIJFWJOH
    4-4"
    
    $PNQMJBODF
    XJUI
    (JU)VC
    "DUJPOT
    BOE
    4JHTUPSF GPS
    (P
    NPEVMFTʯIUUQTHJUIVCCMPHTMTB DPNQMJBODFXJUIHJUIVCBDUJPOT • 5IF
    6OJUFE
    4UBUFT
    %FQBSUNFOU
    PG
    $PNNFSDF
    ʮ 5IF
    .JOJNVN
    &MFNFOUT
    'PS
    B
    4PGUXBSF
    #JMM
    PG
    .BUFSJBMT
    4#0.
    ʯ IUUQTXXXOUJBEPDHPWGJMFTOUJBQVCMJDBUJPOTTCPN@NJOJNVN@FMFNFOUT@SFQPSUQEG • ೥݄೔ (PPHMF
    4FDVSJUZ
    #MPH
    ʮ*OUSPEVDJOH
    4-4"
    BO
    &OEUP&OE
    'SBNFXPSL
    GPS
    4VQQMZ
    $IBJO
    *OUFHSJUZʯ IUUQTTFDVSJUZHPPHMFCMPHDPNJOUSPEVDJOHTMTBFOEUPFOEGSBNFXPSLIUNM 42 42