From 3a3447c9f8b826541b779097de85442a1170fbf5 Mon Sep 17 00:00:00 2001 From: eric-intuitem <71850047+eric-intuitem@users.noreply.github.com> Date: Sat, 13 Apr 2024 15:34:02 +0200 Subject: [PATCH 1/3] add TIBER-EU --- backend/library/libraries/tiber-eu-2018.yaml | 482 +++++++++++++++++++ tools/TIBER/tiber-eu-2018.xlsx | Bin 0 -> 16225 bytes 2 files changed, 482 insertions(+) create mode 100644 backend/library/libraries/tiber-eu-2018.yaml create mode 100644 tools/TIBER/tiber-eu-2018.xlsx diff --git a/backend/library/libraries/tiber-eu-2018.yaml b/backend/library/libraries/tiber-eu-2018.yaml new file mode 100644 index 000000000..4049adf7a --- /dev/null +++ b/backend/library/libraries/tiber-eu-2018.yaml @@ -0,0 +1,482 @@ +urn: urn:intuitem:risk:library:tiber-eu-2018 +locale: en +ref_id: TIBER-EU-2018 +name: TIBER-EU FRAMEWORK +description: How to implement the European framework for Threat Intelligence-based + Ethical Red Teaming +copyright: "Copyright \xA9 for the entire content of this website: European Central\ + \ Bank, Frankfurt am Main, Germany.\n\nSubject to the exception below, users of\ + \ this website may make free use of the information obtained directly from it subject\ + \ to the following conditions:\n\n When such information is distributed or reproduced,\ + \ it must appear accurately and the ECB must be cited as the source.\n Where\ + \ the information is incorporated in documents that are sold (regardless of the\ + \ medium), the natural or legal person publishing the information must inform buyers,\ + \ both before they pay any subscription or fee and each time they access the information\ + \ taken from this website, that the information may be obtained free of charge through\ + \ this website.\n If the information is modified by the user (e.g. by seasonal\ + \ adjustment of statistical data or calculation of growth rates) this must be stated\ + \ explicitly.\n When linking to this website from business sites or for promotional\ + \ purposes, this website must load into the browser's entire window (i.e. it must\ + \ not appear within another website's frame).\n\nAs an exception to the above, any\ + \ reproduction, publication or reprint, in whole or in part, of documents that bear\ + \ the name of their authors, such as ECB Working Papers and ECB Occasional Papers,\ + \ in the form of a different publication (whether printed or produced electronically)\ + \ is permitted only with the explicit prior written authorisation of the ECB or\ + \ the authors." +version: 1 +provider: ECB +packager: intuitem +objects: + framework: + urn: urn:intuitem:risk:framework:tiber-eu-2018 + ref_id: TIBER-EU-2018 + name: TIBER-EU FRAMEWORK + description: How to implement the European framework for Threat Intelligence-based + Ethical Red Teaming + requirement_nodes: + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + assessable: false + depth: 1 + name: 'Adoption and implementation ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node3 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The TIBER-EU framework is adopted and implemented by each jurisdiction + in the EU. (optional) ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node4 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: If a jurisdiction decides to implement a TIBER-XX framework, then + the framework is formally adopted by an authority, and the TIBER-EU Knowledge + Centre is informed. + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node5 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The jurisdiction adopts the TIBER-XX framework as a supervisory + or oversight tool, as a catalyst, or for the purposes of financial stability. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node6 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'On adoption, the core documentation of the national TIBER-XX framework + is published, and the sector is informed. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node7 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: "The jurisdiction determines which entities should undertake a\ + \ test \u2013 either on a voluntary or mandatory basis. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node8 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The jurisdiction conducts a legal analysis of its TIBER-XX framework + to ensure it complies with national laws and regulations. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node9 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The jurisdiction puts in place appropriate governance structures + and allocates adequate resources to implement the TIBER-XX framework. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node10 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The jurisdiction has a centralised TIBER Cyber Team (TCT) to manage + the programme, oversee the tests and liaise with the TIBER-EU Knowledge Centre. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node11 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'In case of cross-border entities, the test is initiated and driven + by the lead authority. If another relevant authority seeks to initiate and + lead the test, the lead authority must agree to it. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node12 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: In case of cross-border entities, the test is conducted jointly + between the lead authority and other relevant authorities. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node13 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node2 + description: 'The TIBER-EU test is conducted by independent third-party providers, + i.e. external threat intelligence (TI) and red team (RT) providers. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + assessable: false + depth: 1 + name: 'Preparation phase ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node15 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'For each test, there is a White Team (WT), independent TCT (and + Test Manager), and external TI/RT providers. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node16 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'The national intelligence agency/national cyber security centre/high-tech + crime unit is involved in each test. (optional) ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node17 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'Once the procurement process has been completed, there are appropriate + contracts in place between the different stakeholders, with relevant controls + embedded into the contracts, to facilitate a controlled test (in a discreet + manner). ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node18 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'Prior to conducting the test, the WT conducts a risk assessment + and then puts in place all the necessary risk management controls, processes + and procedures to facilitate a controlled test. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node19 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'Throughout the end-to-end test process, in all documentation and + communication between stakeholders a code name is used to conceal the identity + of the entity being tested. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node20 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'At the outset of the test process, there is a launch meeting which + includes the WT and TCT. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node21 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: The launch meeting also includes other relevant authorities and + the TI/RT providers. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node22 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'The scope of the test includes critical functions (CFs), as well + as the people, processes, and technology and databases that support the delivery + of CFs. This is documented in the TIBEREU Scope Specification document and + signed off in the attestation by the board. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node23 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: The entity expands the scope of the test beyond the CFs and includes + other functions and processes. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node24 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: "During the scoping phase, the WT (with agreement from the TCT),\ + \ sets \u201Cflags\u201D, which are targets or objectives, that the RT provider\ + \ aims to meet during the test. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node25 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'The test is conducted on live production systems. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node26 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: "Only the WT and TCT are informed about the test, its details and\ + \ the timings \u2013 all other staff members (i.e. Blue Team, BT) remain unaware\ + \ of the test. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node27 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node14 + description: 'Only TI/RT providers that meet the minimum requirements set out + in the TIBER-EU Services Procurement Guidelines can undertake the TIBER-EU + test. The TI/RT providers will be TIBEREU-certified and accredited once the + EU has these capabilities in place. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + assessable: false + depth: 1 + name: 'Threat intelligence and red team testing phase ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node29 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: 'For each test, an external TI provider produces a dedicated Targeted + Threat Intelligence Report (TTI Report) on the entity being tested. Where + infrastructure has been outsourced and a third party is included in the scope + of the test, the TTI Report also includes information about that third party. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node30 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: "For each national implementation, a Generic Threat Landscape Report\ + \ (GTL Report) for the country\u2019s financial sector is produced and maintained,\ + \ and is used to help inform the TTI Report. (optional)" + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node31 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: For each threat intelligence report (TTI and GTL), the national + intelligence agency/national cyber security centre/high-tech crime unit is + involved to provide feedback. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node32 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: For each TTI Report on the entity, the TI provider sets out multiple + threat scenarios which can be used by the RT provider. + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node33 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: The TI provider holds a handover session with the RT provider, + providing the basis for the threat scenarios. + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node34 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: Following the handover, the TI provider continues to be engaged + during the testing phase and provides additional up-to-date, credible threat + intelligence to the RT provider, where needed. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node35 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: 'The RT provider develops multiple attack scenarios, based on the + TTI Report. This is documented in the Red Team Test Plan and shared with the + WT and TCT. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node36 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: The jurisdiction, in its implementation of the TIBER framework, + allows physical red teaming in the scope of the methodology for the TIBER + test (e.g. planting a device at the entity), provided all necessary precautions + are taken. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node37 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: "The RT provider executes the attack based on the scenarios (with\ + \ some flexibility) in the Red Team Test Plan and goes through each of the\ + \ phases of the kill chain methodology. Where needed, a \u201Cleg-up\u201D\ + \ will be provided by the entity. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node38 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: "During the test, the RT provider keeps the WT and TCT informed\ + \ about progress, \u201Ccapture the flag\u201D moments, the possible need\ + \ for leg-ups, etc. The RT provider takes a stage-by-stage approach and consults\ + \ the WT and TCT at all critical points to ensure a controlled test. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node39 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node28 + description: "The duration of the red team test is proportionate to the scope,\ + \ size of the entity, complexity of threat scenarios, etc. Sufficient time\ + \ is allocated to testing to guarantee that a comprehensive test has been\ + \ conducted across the enterprise. Experience suggests that a period of at\ + \ least 10\u201312 weeks is required. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + assessable: false + depth: 1 + name: Closure phase + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node41 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'At the end of the test, the RT provider produces a Red Team Test + Report, outlining the findings from the test. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node42 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: "The entity\u2019s BT is informed of the test and uses the Red\ + \ Team Test Report to deliver its own Blue Team Report. In the Blue Team Report,\ + \ the BT maps its actions alongside the RT provider\u2019s Team actions. " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node43 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'At the end of the test, the RT provider, the BT and the WT conduct + an interactive replay of the test, where possible using live production systems, + to review the impact of the actions of the RT provider. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node44 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: The TCT, supervisors/overseers and TI provider are also present + during these replay workshops. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node45 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: A purple teaming element is added in which the BT and the RT provider + can work together to see which other steps could have been taken by the RT + provider and how the BT could have responded to those steps. (optional) + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node46 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'At the end of the test, there is a 360-degree feedback meeting + which includes the entity, TI/RT providers and TCT. In this meeting, the parties + review the TIBER-EU test process and give feedback. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node47 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'After the BT and RT provider replay and 360-degree feedback workshop, + the entity produces a Remediation Plan to address the findings. The Remediation + Plan is agreed with the supervisor and/or overseer as part of their planning + and control cycle. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node48 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'The entity produces a Test Summary Report, which it shares with + the lead authority. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node49 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: "The entity\u2019s board and the TI/RT providers sign an attestation\ + \ to validate the true and fair conduct of the TIBER-EU test (to enable recognition\ + \ by other relevant authorities). " + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node50 + assessable: true + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'If mutually agreed, the lead authority and/or the entity share + the Test Summary Report and attestation with other relevant authorities (where + applicable). ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node51 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'The TCT in each jurisdiction analyses the results of all the TIBER + tests and the lessons learned from the 360-degree feedback meetings to produce + high-level, aggregated findings. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node52 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node40 + description: 'This information is used to enhance sector resilience and improve + the TIBER-XX framework. ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node53 + assessable: false + depth: 1 + name: 'Abbreviations ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + assessable: false + depth: 2 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node53 + name: 'Term ' + description: 'Explanation ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node55 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'BT ' + description: 'Blue Team ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node56 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'CF ' + description: 'critical function ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node57 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'GTL ' + description: 'generic threat landscape ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node58 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'HUMINT ' + description: 'human intelligence ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node59 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'NDA ' + description: 'non-disclosure agreement ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node60 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'OSINT ' + description: 'open-source intelligence ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node61 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'RACI ' + description: 'Responsibility Assignment Matrix (RACI stands for Responsible, + Accountable, Consulted, Informed) ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node62 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'RT provider ' + description: 'red team provider ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node63 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TCT ' + description: 'TIBER Cyber Team ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node64 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TIBER ' + description: 'threat intelligence-based ethical red teaming ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node65 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TI provider ' + description: 'threat intelligence provider ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node66 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TKC ' + description: 'TIBER-EU Knowledge Centre ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node67 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TTI ' + description: 'targeted threat intelligence ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node68 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TTM ' + description: 'Team Test Manager ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node69 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'TTP ' + description: 'tactics, techniques and procedures ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node70 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'WT ' + description: 'White Team ' + - urn: urn:intuitem:risk:req_node:tiber-eu-2018:node71 + assessable: false + depth: 3 + parent_urn: urn:intuitem:risk:req_node:tiber-eu-2018:node54 + name: 'WTL ' + description: 'White Team Lead ' diff --git a/tools/TIBER/tiber-eu-2018.xlsx b/tools/TIBER/tiber-eu-2018.xlsx new file mode 100644 index 0000000000000000000000000000000000000000..607a2adc1e0e144adc7d8dfd09581b73d32a4c87 GIT binary patch literal 16225 zcmeHuQ+Oa-)@W?owr$%^I<{@ww$-uCj%}-BqvLe!`k0>=-h3r z2?{`fDDnV+zW)E;>woYH3?|Rm_A|f?UnM=jsn#fC?=Z+BhYWn+uou;Xk75ZE&yz&L z2DN_2*3T?~3l>-_R>XdN^>r|UA2}N~r4Bdmq!#Ttj)2iVY<9R+>XiR}%bh?-S(qDBPxq>Sv*(~DrT??%(0d6yh5?J%#kLj3e5`6d3k6uF3$0qs?JyTon8j`j9~aoD_dn22@jRD(ttsUIamlD!{UO zQOzhZ%+_CgJKqBpON#vr;vc*vpG0E&_#F_ox#Lefd?^zr6M~3sXm*PI{E&E$v@0QA zVu;+1hX8#o@%MIKxg+=p+#G`!D(mc)*tp?oKoVfQ*{zm~KV1(f?Oj*%bC|K5!&+sW zZ0^3;@ADHFK;hq*vssma`0k71WWIP0`inXB98Ij9=;{8r|1VSi59Y*wnR->Cto#52 zOz4%wTiEF1(q=q@khGhiL-W2%@#)$Smo>(c$wLx#AN2Zd`_9989yvV7^WZDO&7 zYms_{8M<#+kjTY2p=i7r0h+_I8e4`>HGoS($`{q4b*=1qr%5wee#@yPC$RkCoHFP0 z8K|R9hGwfZ-lNup_s>|W%I2IFb%wc)Ttpsv#@4;JB3V7i@7}a>*`rECEJ#mGGvXtp zdG~&rO)S?FIUa-TkOP&YzsCZj@XNNo^wfVciBx%s!OPc*hyw!vU;#h?x?9u#jZfU{ z9IXuP?5zIKVgKM6z%NDih2?+t)tNYDImiGLd==6iG}q;j_@OY)&QQ zYi(4{@9~M#h&reSzFkz~=s734 zhcz$LA~Hu2!R-iZ&=+Rx+0JI0MJFb%+ZTKG8WVaf0y-%#mbM|#;!PJ#0|?Y3H(xtx zcVGlqLxj%(=Nn0>bQ_5B8}p#^f{1W06^oR-{S242|J*iV86-=DZ=}SE|%M|~E zquS>w^natAMueMypI=lH0|@{C|3wmCl=H7NQ>AKSx5t6-;XD5xrro5cJmL`~5~2z; zMyu3OL9xE&BSgkHWQpX|qFh$-e#H(4a_q?EuvuA#yuLp&Gs(l;_R(1_wI2dC=FZD- zonnL4H0{xMS{m?dld9pf5Ffb+O6egBeng#e^lP`aN89d)yRQ9*HGlvu_>ok(OK|+; zwT5ZUIz-<~HH*K~fCwHe*iQ+s<I_dCLD|Cb!ZGD3P>tlB2ej8=wO)FEKkI=V zXZF6ItE#9IplROaH2_!_65pTWY=W;l5Ugj6>@gF=Kzt0i!obyto(L*;{84fG>fRU3 zF^ZNfNdtF$5T^L;ohEnh6I1RC$aR9Mmh~iynN>5zB#We=OUxM=yciC#Uu*?g&Wa33 z&kfgyRzwDZvaf;_XGtxjSb+)Me(Pg^l9KMSw4`+!@}QivPApP(E--P_<@gkwB3ULBLMY6^?|8)D2fYk0Q$Ei@0_&6? zW{+?7x&h(@DMook`hHB(cFTp1nA@|Ozj-#)ZR7#?P(64nrj{NfJRv*4V*eTuCSG{8 z6Ae+2og`NMa5Fm#yZ}s_ZL^tZ(;9S9W-yd6oYnQ&cy}9?zy4Z-`!nWuz+4Oul%#yj z1#u;Gw*{}~#g-S~Q>z6#o<_bJ@WTDu{u=stu3GQU`g~E#{#a91hHd+exQnJMP2COX zs+C7W>XXv^l(s?|m?U?Uj{Q_vuKa}-t-K|^n0DHPL|PEU+FS2ZUGv}VMw#b!8R+f%h$+JpcWEt&wrSO<(ib%*m=Cq*1zPQ zsT13s7x~iTmPXW?6!sX;ea_9Sd&acO7n!yZ2~B~Fecv76DxL_InDxLm1o4(1BlG32 z*U39J;b`Q+SyM{{$vuo?UcTDBrnqk;*0}h%3EFImTU$sj1LKOZWxC**H)_%2rJ-|! zeue3_f}C@%+VAFnw+nsT@sXrwnZ~1I!SU(J+0-@nN}4{3TP+^Gwqc5;Z;dNmc$(38 z5qAT98S%eFsu@u$DN7prZTH3C|EW9{G`0klzC=LOmw`F-lr$?1#fda+`wp9WhQ#Od3n>fXG@vrJzVM?m$YC;(m{m@TYWO#aTx^}Qd0hay zIg>G`hxp568OSMk3I8{iA_5{`_p9?552E>S4A&8z7kjKU%~h;J&qC`!ae>7U{Rh<( zJ1VDIf`Ru6mYSYIZmM1+!^Gh>v^4_g@}N=B>4Gxj%}8phr+Irbn(_m~^^A2No0eCX zMB(#Isy%mSYcOBU#pyT=TI6gK-`7_sGjWH~&)kn^gVT)GI4q)pkd*j?{Vf3mu z7fzu*($+M~!dU1ybSy+eq%Up7`Th3~WWupa!M{&wmD}MswMz@k`f6(KGLeakIG-Fha(JGUqu=;5)Gv&HgYR-{C+tm|=o7t|K5Om9 z(JOe#FJ>(WCpU8LkXd(h2eW?q$mP<73pKqF-YKxRUenS9BG@d?_OZ#PR%z6S0{N}) zo)d_#t!p;#Fcf-X2~h`lvVfDK_$qjQV-_}5>LAG-MT#HES}@{P@_*-lqX%+ z6Ywo_8S*V-Z%hvjl;Egqb6;GOIe)La!H;or!C4o}SZ|g_ZKl2@x^EpYu+{M-=^sZ3 z#%Yj_#{~;||CRar&=I=jzySb;3I6as{HcGP%}s1f=>NPk{=tIh8dFi&>?l3xFZ?i0 zZf~snaim*2GuBC)B*r<(IL$5RifYVEiJjQUK%|`aN)$!KX+n0q$@2ohuw8d?kR(kf z_;ch_E5y}@Bw5x{ny#=>;vZe5rH{G3p101|^Ihql;_1-+iK%+s3OBsj(JSdB3#ooq z926|x@)F6>h$fJ>&(Jh)((B)S9T9EDAVyYzpGBgQBRs* zzdz6*6drP{bcsv2c4Lss$c?w>HUCI~gyd`fO#1!{y_FtqPK`|D5KKeZHt&|L{`Wxf>9oFy=&q-BNcEX6k709N5;DZk^}mFfiA z)~udRV;gQoT*z{sieFtQK1}{SdM9_+1YX)ik{ZMvh;|KfM9LY(c-YEwC1n|PBKAYg=u0L(0DmAQ63M->AsG2t zh=w0g6r4MQ>!b@1NOqw}Wcoi;C}E{kpKAF6K1zrqTNs#%Qgrkq)UlNw+zkiEWLn;+ z^Oo2N=yQ3!K7OCvhV}6J-5oy<=ry!8Q%T!`lPW7;F2(76zQ3by>Ggd4KD}l?StP&i zAMAO1o=EHYyym*E+uJ~;@AkR5IY~m__PPHhABVfPj)R;2n=qpOcg?QR6} zAb-vvgV1220OGN0+2zD2kggWNX}?R|MgKaE`Y>oGPmk4VJN|VWNo+=~SUu>5QM43OnkPD$z9w8-`Exn-B!A-ArxS)DDzcE%ACA6B~Su zgTXhv{BU@}oKEpviBp7;6}LOe_<+gLuTPw;hMq*kGm`T5#fTc)l$PgE@iMbtOiD$7xL_adgm^431DV!7WG<-8*iTTZC5_N1=gnqZP8H z|J{`62k3!iW-@vBi^()@eP?t=7e2akU|p2S8c)kg^Hc;gH`i@>%3248vUBt>hF2?} zllrUy^Te;Vxo<@JDY)lSRn()?s`uIYfF_9*RzE2n(;%o#9dfpM0^QLlA`rKW zp0PwWrF1wBvsFBEV&PZ^seSDlNA&f! zcrUs^Fug4?2_9M>rVtdZ0(lHVA)sK;Hv_{_KeR=1DmASyle1Q`*x-Rt#MHWwlMZ5r zW+EEM-`vLW+yI@xK;yKoUz54AC`^8d1T;cE;?r1pn&)ox+9y^y{q#_E(p`G`e628D z(B-Q&nYPNf)f~QmxEHj{==2U4C%d{i&Xw=1KV&9MzMKFZ>JW1C0qLBJ24^T+S8OM5 zvjm(bddg%?r`bp*rrmcS<0ofYi<^bf6gJuH&5o40S8-=1%QGqpbD>84K3n}Nck3P( zvmj^IR@I(a4h@?4>`tj2Bb+8xa;(XFwN<@%=6kH-rjZ6lvATd^AY+QH=z^iB2PcH0 zYZk1#nxQ`DtUjl3nwGCA=5PqbV1tV4e)zB>+I1KvxF#5Cij(}y2(`2+qcge&YC1#A zGl{u815m+`o|z!dS$VbH!NbzUqM}Q*h?Y3oxiN-eo*@u@mxg;P^;KiIJtJ(9Nxsdn z4cn3VGzK2gN|cEFM*ta_^6VhD?Q^pwL@O0Bi`6soF~-2MJ6Id>q856A@())`$z0nf zH-l76^oB5zWG?L_xp6SYgmkauL0UapzZ6)OIh+C;>TmuCe46{20@V0f4hYWNqwY+7 z#1^5O7>c=a_yN1hHTEABL)*AjB&#_6UHCC^UBFzw*b$4=)#<6hV{cgKtW$&?aLU^dP7NDdi)!RED@> zs7<`rX`i}K!SCoNC~CtkoV@^Q8_bHjTGWm#(_QW#(oTgSMn%c!O`0{gt@Mzi5^7&sKC;H^%iz{DeUp1I7_y6D2 z?;qx`levkBvlIQFk3V&Ac9OJRAp=UtBk`19UFWYuk|t3?RiVg|c^a_=kE)n95NZtO zmfK^M+wEUKvYM1xWk~wKT-%(>-MQQNs=^QYRf{%K#Qa4dn)%YJwn{Iz;+LCBhPZap zTgPZhFEFWF^n8Aq_)V*8SiOiOO>D)@PC7^+YKwV4?p?rXKgydFH+CymL0Xu5Cj^T! z{X-0JDCo4fkdT~Ug}raTNMC z%-Y8(>+sCvDUR-_co6rpk_fCKnXZr|$`Fg@NErA%(Z25LXz+Ru5(@!tmZV_tFP? zHyu{D+iica2`i_?)qcAvLn$x%w7u-|;JQ+|5%yTf<@c-A*>-)*S9+mUc3EY5nYJ#5 zqhh@Bx_!_<_sHNoW3mxH*o)tXAzYJ{u@oUcq!G%{P}mA;5SDvTM^R(Bx2Z{4m70R4 zgv&cdFc@K^$rguThVCav&?OS-M(jWE31({4cLW@VOSrg?K^PxSn=)mlPLZ^Vcawlmdk)c$1NcuTm;Y5Gpw0f0U-%3Rg-hN8&VNRcD>3`lm17I8E6%*H)K zBlYUzq8gT-;y}EA^T1(%u^ww>^9eyt(t}W79|_ecpkkrz@G7pNSIJ8@Yo1|V^iILK zFK)ijt|;?E10!c788crNTbvQn%s^$NC?juCoBq}+$dG8NpFlL72DvFda*P2g7{kCn zI{us@`J->vc>w8|#GbF{1L-Rs@MW_8x%>^35;F4lvNTdNlhkUXlCsqGs!X%Y-;^lE zWoG>ArEj2n3reJ*B%eu1pW7I8#Vie_ED^)as*2)Mzv}_*AFr<-r~N`VK{qQZNnQEF z|M{PmuqLKJN+J>ffFU~o0LtH_fs?s`qlvMyv!jKr*`Ee+lh(Q|&IqCp`;MRaZ&H$8 zQc_Sx9H9b1#$?%*1`tcoXW4Y=tMhOt4fz@SHjf+r14@A#z~>n6$R3hkDsD42ZYP8R zJS&N=uI(KaXO5>T7ZX>Pw=$b2<3%Rdr#sJMjljiGWzh>n9xlHfK1?4j0+?JB1_jm7 zUY7dAvVyLrdp=H!8Jqh%LOfjRs?L^HPs$@wx!@-y+vY)YX~wDGE#DfYNGdHpD@^(n6mkK&vi%zAWmr2FyfHlT$h+ACGRzcU{ zcAfKle^!~bO5al^ihAIwqt-f7p?ezmdB&$)u1KVlYNOKYbgUloL=CsFIME<=HdUV; zRlCYs%U6LP<(PBAF?WhYUd@sw2~AhDpEQ?HzGjp0OWl?r)EbU*&E`e?TR?zBiH4v- zIb~%G6}9TP4*3LDK^msq*p-MNt}(VU{w+2~Jk1Zw3RR1|LdSeG3q%w}EaRpShAD!b z2+y^I!iMmyvZIy^xjI7yd%I(x*P->4iq_NVYax-mK4sp#gRj@+kK1V_4x4xr(z{W=p_k=Q zz2U-!@`Cz|i|*>uTo((wcr;Yw@&M9Epru2y#gxo5f^T8B6VHe#>B7ql{CEIFq;=QY z`_mRkYrfI9x0ZRsG_ZAL(%Qvt_Ch}}gTpYLf&eVpz0c6NH5`k|-;VOf)_f?2{h-e4j3& zB1YM|zzX{chYpRis4Ow@#;Hk$V$cYiZj&uVRC0zQ7rYBjl=W}2+!`HxaEc|O@N`uS z)`Zv}E*XU1*4*vGkwK{B3{n9Qq76f8V#$Vc9#zMK)f`pH@Bp$B_Wd$n&19qiAX`Tx z?}&h)z7HqBgh~=l7-tA6*8(P1cA67cbsn4WKa9IY2-Og!c3y)A%F98ju98eN2+D;S z?gBKnXYayS^19tS!-tR*?=e|&m5KQI(;hGg8Po4k`c1rhrASAxHqf4HnV0c4l_}((Hh~TAHhuN*4zE9Hf^I5;t70(M!K`nLV}^IU&?*jyE+$C?)<3p z4x7Irihvj7mu76r2tsqApkEFE4hbApF-a=`4#5qEBPjCz-s(r&K)~4Z`Cum^!>As* z%~giPM{pGbH+h?6fnjQYHQ<(9-+?YOV-<%NN>VN}rF5HChL;FLEY^y2y&nZiVtr}#)sRp|Ye`eK|( zlAz=g@^=xQIjm?PIF-u+ZKG}!GzrQ2Z?ziR1cX=lVpe)(3c$)^QA{E)SYVt8kH@%;Ky&8N7#hjJ~ub` z@drvhl$Oe~RijXRuHV!Q$jC@2&8}9E^m18*=p(6&dMZsy&m#hebFW4!vq?CI1z0>P z$J`@eV{|2jpS5;mm(>f+XnAi4&I4iw;^cKN1ISn$sNNwHQ(6Nc4xRjZeU`8G^?s*c zlxcqc+Ooil<5Rz2(m`?wE8t*ePA*&?jD)SDY&4mGNr0d9DH*UU#lbh$USaFJ+aBm&aa&Eu4dtSSZ%E^1(IKg*2vQ9^&jO>Q539B$ zItUH~fdGn4ML}TlfEh^g5f1B?_j_ZtX_*jQXc_Z*-;wJ00LSkaoU5*!)oNtias>Dp zum{21az-NcqZ2$QxE~5@v4^?Aw90L_&5ZGO!Av8v(cQkSfOl&J1bGz8lSu{iYV!~& z>p(SEDaE0a?t+fnG=q4EJCEmN0J!tgLBav)*9gW8qlLX-7@?ygIF`vLA~V@G1&9do z+?F`5jPwg|v^DAn>lgLbyZ|xc1bCx5Th}jE)8RQzzbkb5`Mux`aZBt2x%I>@HMlXBrFf*QcFu|Xj5@$-E;duSD+{*Yi%>_ic1S+<>JZr2Gqed43A5| z8$+tO{Hy|?)k>bNm>hzvoVd`w2@7u}o_OJEU%~?86Y?f*B6lVxnq-s@UliU_(ItdC z(r`MiF2jX}*jg>R(|{riZbF5MbHUY+SmX!HPqN=+-5a9Wm;^xSbArkdJRL=A(~oCP zf5gZv7%a8*NoXeGCZAnXoYwLNL1E8%6+3T$+|;RjOiVo?X^qw%?ghOW03~t2L4iKm z)`GC2hrN!zW1pNrUmG~sLAlG<$itEz(_1V`N2uoIr*-KVF<+sx5Eut!zUJDoN@fdV z&Ob3w2Mf1*P$%A1NWTjiyqA#rwle}d`=h;GyaNzBiNG#Vr*DGS z56u7b4YWc%v5BKNXp!5pZ=xz0&i`qMqf<(yE#9x-%=gdJM6pY1LDJoVVo}IO> zeMYZWNG2FSw7a2^!>3(#r4mK|-gD~;2=>$ui?*SIbwvlfu>MD+4i@=g`*8&!_^;mB z_0IWJ$;$v$;FcL+4*CJUAAH!nbH~y!N)_6+@`{f7V_cV&afMDF$9QYV&scT)hdaGW z_VIB=ia;MGg3>IjWyTAx*qm4cuWQO

1R#9V)e=62?4L=gn8ByU`_a6|Q883RCt= zEmNj)I>Ml&6|-`@i=-sfj6HXZyE(W`f*MDIhU;@QfLM5Y&-A_GYC!Nh`_a*o8)CB=$8Pbm$%ILW;cNgM}8up5o=|LC|Z?upu=q0_< zNLQ*`uY1A2*P)tYN#g>+2pA(k!;iOdlk)DY=Aypcvd@^-r#{4lox&>y^R>r9U!=05 zum{@WPMOD~q~J>*=TbJi_qk3Q36E%pKBr#GfR6hit!XFrP!=nO zJ;-&JGiOA6j1Ce}8FsjnXgzxEFkP&rzP$709I0ppXXnPx>n-hGuOb901E-p3Q`dx? zO^QEtWQO!ZwJC^}GBsJc^E7A^{~#6dS5R+uk}D@C9E&a1AYLS}85*d)$^^0|5H z-_JKkl|hEVRqmn8?hln0dFbfYBDQ&`6mSV7QrqHd&|y>NmrzCD%}@mY`!tL#6}a1^ zjE3OU7%-Sx_}7fvZ0Go~nRP%6uQ+KEX42IqNeZX~pj#n1=S@9O7q z;WAS@2BQdOVN_%<;WalAYT%>c6*J?kHVz;I5qftAzXz}Mx-*`Js&gj?A0?V(+Z~(} zLmHgU;ZY7KIwb8re_vnR&)iyY(_*vGhIwBW@%nzO4>iF?Hl){koB?<*V`Vf=b-*W) z?(VEkGBwG^|2o>c@yrxp4>VH9A16p|7pTuf0qWiYb4l5%6xNU)J~CEk{lOao945FF65zyTVLKf9Kx(7Py8l%&wSDd&34~R6Uowe zaVOCcF%Iv;+?H4B@w@|?^Z^Ah5ctWDEiWQ(4)c>#SIYR<(?8mEp>noMtzrgLGd z$*h9p-O>8~BDJ81~=T4_{0amyd7D6V}qCTCUWEW?R4zYz&gS@ zLN0T!kUG3x{CCvT3q2A(&P`|en6a<8qFK}5>^&70Y3#|5fh~PuE>m&q6 zk>g=}B)MiEUMze2ooms@>vvbF+yr34*hsQ0Eq(!U(sxGj95;ty&?>qZtlP7`Q7IyJmYV}%|0TAx?R}gW!jD$g!IwHvH_=b z^!cR|Y1mt0ZeODa`PJpY*nG#kO(sC#2%}-875fsI3!>}ICJIQIec9Lc=6-co!EJeB zWEbb~yzX3bk;NF<62fv50-YW3wY>XGeuODs>O(F1uHWXn4xzBP1u>$Q2$ z*kf;zS=Nntcohy_9Y>0KbliT5d+gBKDy9tHTMkLKBzmxGTc`1=?x>9|k61))O9z`U zfO4tVZx7^9$J+j&zd6U)fnGYI^dEpx*|0G~U zRQ1DrS8D?x_bU^k&*!sWwKVpY5D|0A8MoVYPj>WIkk_p3bYy~)heMM z*TxM3pkbolEb{+MfNoy)(rTHO0^k{B=B~xr^N+umPd90yiwg+F$RCl*_gJSJ|Jgm} z=x~6BkI42T-2ai31UKTl9s-y!)76$OJJNTZ*+#4B{qf`5IhrPhbMlIu9 zfY-1&91N-o^_p4~ng=I5#EDy{O2&S(08DV<`yA42Fb9ivtnU+~4ItG6?@_Qec@Tb2 z)Ng7yZWDv=qet3F1_GI0;eftuoqoCvo&}IiP>3|7JWo4$vt8i=fKCvY2gI320{+3~ z1hSl10T_fu`3kYqaQ1Q8=emUsQL|@$*9KslYPl=#*<+Axtl14YO>4=Fgf=lwAZ+J+ zTtjvT)1O~qqcoTjF^kI?$!_`ES}m^U^-PvZg!SxI-=+o}%Mn?To;#oR@<{x&U% zDS)$`;%T8Cut4@zVv!n)*6}B6g>e5wor6o^UqJxgv2{j%pHX!bU2H}7iDPGdv0&w58IR@Bq=??a*Y0QUt zbvNUwm*@)!G5>ev>a>pmvsqaHi?)MFd8h&e-KSt_jXm-DqmQnYsvkKm$GkR z86SqT$(np~H)-Y@K*k1FEZ$H_kKQ6?4rbb06O5HbM>cULj$n_V<fz{Zvaw+#I6eTr{wKdnQw51%|B zVqX5Ftv{Wl*_!LN`y4RuDMa{n)wPn~89>t|_)5;ulMCmDN|T3I%LNwF$?hUy^rDDc zv6Km6sovc_uTM{%-9Fu2*?w=YXS*ZI!cOi#-X9;{**+glIC$P{Us@mOKi}GXH@5h@ z{d{?O-j`s)(r&$Ga{`$%CIi>s&SugUp09sRJYVOq(iIOkEloi|(?TL7T(YHL4@cUTbRdRdcbdfe!Yo)y&a^ZC0sr~U&iu)61Np*(XG!{O07UY zN769W6A{ph%j*Urj!zIF=L;Ij<^CPPaXNE7$xQC(-x286z8sAy0~&`IHZs8S`R`~b z!=~7!=`}vE*c8@(eF@yD30*G2rQbfJkqN>Vw3naB65?;EuwPJYEOZvDBh9K}RfD_| zS__9z=NQ>a&l6mqTRkyux(RmeU8;05z}}{rHMrSzBl-PDgj0t3Xv}uAVMq;RH(Xd zZ90^B4dYp{nFB)s0uW+}KZlTwO{yJj{7u1u2zMfWG7HHYn-Eq_t)2@IfMn0NbA(jU z1hdK+{Lz|R_vs0HSkYjY3$8p~2pswf2lQ0}od&zDQRA4|Rt zxPIK9oGXO0i z|D0Ga{xgfd6O@JqgjIGw9EeaarOz;>OAV>bU~?7&+yXCGrAwFm9k;vT!dyE8^g`#I zKe^{uhj2n_!{atwRQ)03UogmB{m9%1mmF?HGv@Qg`2rB`1>fBJk2D(^9MySS>ESQE zzJB@JsP-XU2^_!L-L66Y=#!`Kk3Rpk@sA1ewgMvmYwKBbHKG?QL`z|>PJmPqNYqYqUhNG!HP|7`nt7m5FzX5Us z=(6~|A*elSIb{$~#{-SkV27r=8ZgRS;l0dy8UJtzWZ==maHPjw7lg7KZaL$!&Rx{i zA)vlRA1&%b#Z{)H-P$j_)&U)S*!5doC9(jR%H-}3bWj(l1{rG&TnTQXEjb*= zcp(-Z{S8y3={V6?tB&)qVznLN`?1oZNz-tmq!gVMibd$!zzt%ghZD)=M2jiD=0KFT z5mYx!YBYviTA+l2t3Ww2O6o>HLajncBU8DP{4KHsnCcLt?Eo+MWLe6iI9{3)J@-ax z&iO{lBYL~?<107&|63T$;miV9;wwUC^Hp+#_*G3{Y-gn4XlL(4Z)E3a^2gcXtMKN3 ziwM4yV|3z#+yDcL$fLxY@PW@B4^(6oNs7Dkl9U8WzzXJTOLI8xgsbH1BZnk*;CNs$ zuTz{^jrJsb16+5n`dk?jsbVycLe;L2jr3iEZZIcQRbk{;#8jbxSe>P|rWUFM(h7zr zLoCPv$a+U|9H~UQ$w>}5nsz;)i0uaMa7fmO#O1@hMP2zpvekcqqk9Mm=WtPR15lV3 zX%2F1HGI)a`4M26VUa+PGwSQC#;*%5w#Exosy}3Iz0PLY z$QL^EeW!KlrmYqWYUv^pumWltf>}Vvs6w1ry{_mL{#2)=7r9)^NVZz*ImQm;cgKFn z>-_GjPs%RfP5``kD3#eEYlojYy+X?H2~D(_L1OiOb`fOT*meg%&rwI+KnTy!6F%dZ zL}rpZ8(}V>Y5+Z-#Qj&g@qeCR?eDVmdcVkT=qvP#@UP@&U~m7w)b~Ypf4{Pob>ue~ z5WH&_KjU9=oMMF)T^ys=f+D4gc^v}y3Wip-X^^-Z(vIi#;*!DJ4I(Vy_*8Eqoxy5Dy(HT*#A1JWAx-&SQmjR_!p9KR7$U_|?=3d41 z!GZkQrB8%}?r#8$C}EC~X(Jz^IB)@o4=9|rZs8aYXHe6)PbS0Xhj88fr=JY3#n2fg zQ15Yu(6L(#Camlx@obt*6;*dRz{{IdR{hnp8&P8^=V!leEBW2{HcZt>C9|t^IXP*_ zAwFdHhJV7Q)3KBsXR$qgw2z%*BJk0Em?)l0*{6qTWxyFxg-6vneY+>gYG~#0>+iI^ z1NUP7kZO}byQYFe=ct7Ic>6pc{@TC4Q9U3K?N^?`e=kG+$1eZl`Cp2X6{PLXUyF(UiRtajBK=Eg(O-f8T88jX z;Loq*tS{hy7A5=@^shAPu|VSd zZ3cf$CiyFdzZ&oV#4ttoU&ryMDgRe2|E|CPiQ`M0ekHd2hc^E!_`l2Fe+7@@{1@=Q aOJfCT&@USKqc#^BVEF665W@4v+y4PoZ%}6d literal 0 HcmV?d00001 From dd4ee42d408b21d3c7142d9217bf9c64ed0db596 Mon Sep 17 00:00:00 2001 From: eric-intuitem <71850047+eric-intuitem@users.noreply.github.com> Date: Sat, 13 Apr 2024 15:35:28 +0200 Subject: [PATCH 2/3] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f327706f8..837d61909 100644 --- a/README.md +++ b/README.md @@ -85,6 +85,7 @@ Check out the online documentation on https://intuitem.gitbook.io/ciso-assistant 20. RGS v2.0 🇫🇷 21. AirCyber 22. Cyber Resilience Act (CRA) 🇪🇺 +23. TIBER-EU 🇪🇺 Checkout the [library](/backend/library/libraries/) and [tools](/tools/) for the Domain Specific Language used and how you can define your own. @@ -97,7 +98,6 @@ Checkout the [library](/backend/library/libraries/) and [tools](/tools/) for the - Tisax - AI Act - Part-IS -- TIBER-EU / TIBER-FR - SecNumCloud - SOX - and much more: just ask on [Discord](https://discord.gg/qvkaMdQ8da). If it's an open standard, we'll do it for you, *free of charge* 😉 From 7ba01a93a3672515d32b94cde7c53d604c9df613 Mon Sep 17 00:00:00 2001 From: eric-intuitem <71850047+eric-intuitem@users.noreply.github.com> Date: Sat, 13 Apr 2024 16:22:44 +0200 Subject: [PATCH 3/3] add link --- backend/library/libraries/tiber-eu-2018.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/library/libraries/tiber-eu-2018.yaml b/backend/library/libraries/tiber-eu-2018.yaml index 4049adf7a..902ad6985 100644 --- a/backend/library/libraries/tiber-eu-2018.yaml +++ b/backend/library/libraries/tiber-eu-2018.yaml @@ -2,8 +2,10 @@ urn: urn:intuitem:risk:library:tiber-eu-2018 locale: en ref_id: TIBER-EU-2018 name: TIBER-EU FRAMEWORK -description: How to implement the European framework for Threat Intelligence-based +description: 'How to implement the European framework for Threat Intelligence-based Ethical Red Teaming + + https://www.ecb.europa.eu/paym/cyber-resilience/tiber-eu/html/index.en.html' copyright: "Copyright \xA9 for the entire content of this website: European Central\ \ Bank, Frankfurt am Main, Germany.\n\nSubject to the exception below, users of\ \ this website may make free use of the information obtained directly from it subject\