Seminar Institute Commissioner Training – Master Class on Cybersecurity April 9 – 11, 2024
April 9, 2024: 8:00 am – 9:00 am
Breakfast
Welcome/Course Introductions: Billy David, Bo-Co-Pa & Associates
9:00 am – 9:30 am
“ Threat Landscape- Overview 2024 Trends and Forecast to 2025” Earle Hall, CEO AXES.ai and Co-Chairman AI and Cybersecurity Policy Committee, Las Vegas Chamber of Commerce
9:30 am – 10:30 am
10:30 am – 10:45 am BREAK
10:45 am – 12:30 pm “Why Should We Consider Cyber Insurance” Presented by Earle Hall, CEO AXES.ai and Co-Chairman AI and Cybersecurity Policy Committee, Las Vegas Chamber of Commerce
12:30 pm – 2:00 pm
BREAK
“Cybersecurity is a Board Level Leadership Imperative for Building the Security Culture” Presented by Abe Martin CFE, Casino Cryptology
2:00 pm – 3:15 pm
3:15 pm – 3:30 pm
BREAK
“Who Is Responsible To Regulate Cybersecurity?” Presented by Abe Martin CFE, Casino Cryptology and Billy David, Bo-Co-Pa & Associates
3:30 pm- 5:00 pm
April 10, 2024 8:00 am – 9:00 am
Breakfast
How to conduct great tabletop exercises and take them to the next level Presented by Derek J. Olson Wipfli LLP Cybersecurity Consultant
9:00 am – 10:30 am
10:30 am – 10:45 am BREAK
10:45 am – 12:15 pm How to structure and oversee a “Purple team” engagement that validates a casino’s visibility to malicious cyber activity and block attacks like ransomware by Matt Berluti Wipfli LLP CISSP Manager - Cybersecurity Services
12:15 pm – 1:15 pm
BREAK
How to plan and include incident response in the overall business continuity strategy Presented by Derek J. Olson Wipfli LLP Cybersecurity Consultant
1:15 pm – 2:45 pm
2:45 pm – 3:00 pm
BREAK
Securing the human and how to increase a casino’s resistance to social engineering attacks Presented by Matt Berluti Wipfli LLP CISSP Manager - Cybersecurity Services
3:00 pm – 4:30 pm
April 11, 2024 8:00am – 9:00am
Breakfast
Is my Casino at Risk from a Ransomware Attack? Presented by Renita DeStefano, President & CEO Second Derivative, LLC
9:00am – 10:30am
10:30am – 10:45am BREAK
10:45 am – 11:45 pm Top 20 Security Controls for Maximum Casino Cyber Security
Presented by Renita DeStefano, President & CEO Second Derivative, LLC
11:45 am – 12:15 pm Resources, Takeaways, Recap of Events, and next steps for your organization Presented by Renita DeStefano, President & CEO Second Derivative, LLC
4/20/24
Spring 2024 Commissioner Master Class Tuesday 9:30 AM Session Threat Landscape Overview 2024 Trends and Forecast to 2025
1
2
1
4/20/24
Threat Intelligence Sources
• Verizon Data Breach Investigations Report (Annual) • Sophos • Cisco/Splunk • Cybersecurity and Infrastructure Security Agency (CISA) • Federal Bureau of Investigation (FBI)
3
Splunk – A Cisco Company The CISO Report
4
2
4/20/24
Verizon Data Breach Investigations Report 2023
16,312 Incidents – 5,199 Confirmed Breaches
5
Verizon Data Breach Report, 2023
6
3
4/20/24
Backup Compromise • 75% of attempts were successful when the attack started with an exploited vulnerability • 54% of attempts were successful when the attack started with compromised credentials Data Encryption • 67% of attacks resulted in data encryption when the attack started with an exploited vulnerability • 43% of attacks resulted in data encryption when the attack started with compromised credentials
Sophos Unpatched Vulnerabilities: The Most Brutal Ransomware Attack Vector
7
Paid the Ransom • 71% of organizations that had data encrypted paid the ransom when the attack started with an exploited vulnerability • 45% of organizations that had data encrypted paid the ransom when the attack started with compromised credentials
8
4
4/20/24
Recovery Time
9
Median Recovery Cost • $3M median overall recovery cost for ransomware attacks that start with an exploited vulnerability. That’s four times greater than … • $750K for those that begin with compromised credentials
10
5
4/20/24
Trends & Predictions
• 3.5 million unfilled cybersecurity jobs by 2025 • CISO’s will report to the CEO • Zero Day Exploits Doubling • Social Engineering will become #1 • AI will surge as a top attack vector
11
Questions?????
12
6
4/20/24
Why We Should Consider Cyber Insurance
Abe Martin abe@casinocryptology.com 931-CRYPTIC (279-7842) www.casinocryptology.com
April 9, 2024
1
Is insurance STILL a sucker bet?
2
1
4/20/24
3
Cyber Insurance brokers…
• not to be confused with Agents, who work for an insurance company • help businesses find providers and policies that fit their specific needs • are intended to be independent of insurance companies, therefore able to offer unbiased input • may charge a commission, a broker fee, or both (ASK!) • might not know every detail of every policy or provider
4
2
4/20/24
What is Cyber Insurance?
• AKA “cyber liability insurance” • May provide financial protections and/or resources to policy holders in the event of cyber attacks, data breaches and other technology related risks • Types of coverage are critical
5
Types of coverage:
First-Party Coverage focuses on your organization’s data, including customer and employee information. Look for coverage that (at least) includes: • Investigation fees • legal obligations • Recovery/replacement of data • Communication with customers and PR • Lost income and money lost to extortion and fraud • Crisis management • Fees, fines and penalties
6
3
4/20/24
Types of coverage:
Third-Party Coverage focuses on liability claims against your organization. Look for coverage that (at least) includes: • Payments to affected customers • Claims & settlements • Defamation and copyright or trademark infringement • Litigation and regulatory responses • Accounting costs • Other settlements, damages or judgements
7
Policy components:
• Premiums • Policy limits • Deductibles • Exclusions (zero day/third party) • Loss ratio • Application process • Policy changes • Material misrepresentation • Monitoring remote workers
8
4
4/20/24
Pricing and cost Factors:
Generally speaking, a few factors that influence cyber insurance prices: • Type of industry: nature and level of information the business handles • Company size: more employees = more vendors, devices, customers = more “attack surfaces” • Company revenue: yep • Company security: better security = better rate, generally speaking
9
Claims handling/reporting:
• Clarify input from in-house experts (quickly) • Notify provider sooner that later • Identify and connect with [cyber] specialists provided by coverage • Be ready to work with external experts; insurance, investigators and maybe even negotiators • Maintain detailed documents • Overestimate the road to recovery
10
5
4/20/24
Best practices: • Risk assessments/penetration testing • Incident response plans • Cybersecurity training • GOOD data backups • Multi-Factor Authentication (MFA) • Data classification • Identity access management • Strong password policies • Firewalls • Antivirus or Endpoint Detection and Response software Insurance Risk Assessment: • Consider the probability that a given scenario could occur • Consider the impact of that scenario taking place • Intersection of probability and impact can help to guide decisions for insurance coverage as well as other efforts
11
12
6
4/20/24
RISK Assessment exercise:
INSIDER THREAT
The potential for an insider to use their authorized access or understanding of an organization to harm that organization
13
RISK Assessment exercise:
DATA BREACH
A security incident that exposes confidential, sensitive or protected information to an authorized person
14
7
4/20/24
RISK Assessment exercise:
RANSOMWARE
Ransomware blocks the owner from accessing a computer system (network) until a sum of money has been paid.
15
Key Takeaways:
• Perform risk assessments, include local/industry factors • Audit systems/operations against known security framework(s); NIST, ISO-2700 – changes as needed • Consider using an insurance broker • Be VERY careful, and brutally honest in application • Make claims part of incident response planning
16
8
4/20/24
Abe Martin, CFE, CSP abe@casinocryptology.com 931-CRYPTIC (279-7842) www.casinocryptology.com
17
9
4/20/24
Cybersecurity is a Board Level Imperative for Building the Security Culture
Abe Martin abe@casinocryptology.com 931-CRYPTIC (279-7842) www.casinocryptology.com
April 9, 2024
1
Cybersecurity strategy? Is our strategic goal to outrun the bear?
Or just one person?
2
1
4/20/24
Cybersecurity strategy?
Theoretically, the longer we go without seeing a black swan, the more likely it is to happen.
3
Change management:
Top 5 considerations for changing culture: 1. Leadership – people in positions of authority AND the peoples’ champions 2. Involvement – every workgroup with an interest in the operation plays a part 3. Training – consider engagement; fun, game style 4. Metrics – every goal must be measurable, evaluated, discussed and adjusted 5. TIME!
4
2
4/20/24
Top-Down Approach:
We gotta walk the talk!
Consider a few options for tech-challenged leadership: • Independent training • Leadership/peer learning groups • A tech coach • Informational content in leadership meeting agendas
5
Challenge:
During presentation watch for emoji puzzles.The solution to each puzzle is a cybersecurity term. Blurt out answers!
6
3
4/20/24
Security methodology:
Controlling access and permissions are perhaps the two most critical elements.Two common approaches are:
Principles of Lease Privilege (PoLP)
OR
Zero Trust
7
Strong Authentication:
• Passwords: ISO 27001 requires organizations to create strong passwords that have a mix of letters, numbers, and special characters.The passwords must be at least 8 characters long and should not contain personal information such as first names, last names, or dates of birth. Passwords must also be renewed regularly; at least every 90 days. • MFA – Multi-factor Authentication: access requires something we know (password) and something we have (phone, email, etc. • Should we hold vendors/service providers to the same standards?
8
4
4/20/24
Observation skills:
The majority of all (recent) breaches have been attributed to human error. Regardless of a vast array of security tools and precautions a single click can open the door for cyber attacks.
Being observant and cautious has never been more important to an organization’s security!
9
Smishing & Vishing:
• Remember JDLRs • Save known vendors & service provider info to your contacts and only reply through those channels
10
5
4/20/24
Phishing:
11
Phishing – email headers:
12
6
4/20/24
Phishing – email headers:
13
Phishing – email headers:
14
7
4/20/24
Phishing – email headers:
15
Phishing – email headers:
16
8
4/20/24
Phishing – email headers:
17
Phishing – email headers:
18
9
4/20/24
Spoofing:
Access important sites via saved bookmarks
19
Key Takeaways:
• 5 ways to improve change: leadership, involvement, training, metrics and time • Walk the walk, leadership training/resources • Push those authentication rules • Work your observation skills and defenses: • Phishing, Smishing & Spoofing
20
10
4/20/24
Abe Martin, CFE, CSP abe@casinocryptology.com 931-CRYPTIC (279-7842) www.casinocryptology.com
21
11
4/20/24
How to structure and oversee a purple team engagement to validate casino visibility to malicious cyber activity and block attacks like ransomware April 10, 2024
1
Matt Berluti Manager – Cybersecurity Services
Presenters
2
1
4/20/24
Setting the foundation
Overview
Purple team overview – how it’s different
Maximizing security investments with purple team exercises
Critical practices to include in your purple team exercises
Closing thoughts and Q&A
3 3 4 01 4
Setting the foundation
2
4/20/24
Red teams attack.
Blue teams defend.
Purple teams combine the best of both.
5
5
Basic terminology
Vulnerability scanning
Penetration test
External
§ Automated scan
§ Active attempts to
§ VA or pen testing focused on assets reachable from the public internet
looking for software with known vulnerabilities
exploit vulnerabilities and security weaknesses
Internal
Red team exercise
Purple team exercise
§ VA or pen testing focused on assets behind your firewall(s)
§ Coordinated external and internal pen test
§ Training exercise to validate that your security tools provide visibility to malicious activities; tests your ability to detect attacks
leveraging logical, physical, and social engineering attack vectors targeting specific objectives; tests your ability to impede attacks
6
6
3
4/20/24
How it all fits together
7 7 8 02 8
Purple team overview – How it’s different from other security tests
4
4/20/24
01 02 03
Staged scenarios
Stage attack scenarios in your environment to maximize efficiency of the engagement
Purple team characteristics
Customized to your threat model
Leverage MITRE ATT&CK framework to design procedures specific to your infrastructure and most valuable digital assets
Collaborative vs. adversarial
Attacking force working directly with your security team
Ability to rerun attack steps and demonstrate how malicious activity appears in security logs and tools
9
9
04
Learning experience
• Understand what attacks look like in real-time and through your own security tools • See firsthand what it looks like when someone bypasses security tools like anti-virus or MFA on your VPN
Purple team characteristics
05
Safe place to experiment
• Run through various scenarios to identify visibility gaps • Tweak scenarios to validate different perspectives
• Make adjustments to
monitoring tools and rerun scenarios to validate improvements
10
10
5
4/20/24
Designed to prove detection
Purple teams aren’t designed to test preventative safeguards. Assumes defenses fail and test your detection tools and processes.
How it’s different from other security tests
Collaborative & educational
Traditional pen tests happen without direct IT/Security involvement. Purple teams have them actively included.
Staged to create efficiency
In pen tests, most of the time is spent on trial and error trying to bypass defenses. Purple teams stage the attacks to be more efficient.
11
11
Scattered Spider at MGM
§ MGM was breached by Scattered Spider ransomware gang on September 11, 2023 § Scattered Spider identified employees on LinkedIn and used social engineering against the IT helpdesk to obtain credentials § Once inside of the network, Scattered Spider deployed the ALPHV/BlackCat ransomware to access customer PII and ransom the casino’s operations § For 10 days, MGM operated without technology
§ Used paper receipts for casino winnings § Gave guests physical keys for hotel rooms § Resulted in a $100 million loss per MGM’s SEC filing
12
12
6
4/20/24
Scattered Spider and ALPHV/BlackCat purple team exercise
Threat Modeling
§ Identify tactics, techniques, and procedures used by both groups § MITRE ATT&CK framework
13
13
Scattered Spider and ALPHV/BlackCat purple team exercise
Threat Modeling
§ Identify tactics, techniques, and procedures used by both groups § MITRE ATT&CK framework
14
14
7
4/20/24
Scattered Spider and ALPHV/BlackCat purple team exercise
Attackers Build Simulation
§ Attacking force in the purple team exercise builds a simulation of the Scattered Spider and ALPHV/BlackCat attacks using the information gathered from the threat modeling § Intent is to focus on emulating the same tactics, techniques, and procedures to test against the same MITRE ATT&CK boxes as the real attackers
15
15
Scattered Spider and ALPHV/BlackCat purple team exercise
Defenders Identify Target Machines
§ What machines are most likely to be compromised? § What machines are you most worried about if an attack is run against them?
16
16
8
4/20/24
Scattered Spider and ALPHV/BlackCat purple team exercise
Exercise Execution
§ Joint session between the attackers and defenders to run the simulations against all identified machines § Attackers help with threat hunting by providing insight on why certain attacks worked and finding a common denominator among successful attacks § Defenders tune the defensive controls to better detect and respond to the simulated tactics, techniques, and procedures § Regression testing to validate changes improve the defensive posture of the casino
17 17 18 03 18
Maximizing security investments with purple team exercises
9
4/20/24
Log ingestion
Ensure log quality to support
response and investigation
Log access
Log tampering
19
19
Learn how attackers operate
Train and educate security staff with simulated attacks based on real-world attacks
Ability to identify malicious activity
What happens if detective controls are bypassed?
20
20
10
4/20/24
Test detective and response capabilities
Validate the effectiveness of your security tools and procedures to detect attacks
Ability to bypass detection capabilities
What is the detection capability detecting?
21
21
Validate the effectiveness of your security tools and procedures to detect attacks
Process Injection
Authentication Attacks
§ Can you detect forged Kerberos tickets? § Can you detect password sprays?
§ Which process injection techniques can you detect?
Lateral Movement
Native Windows Commands
§ Can you detect network reconnaissance? § Can you detect a threat actor moving in your network?
§ Do standard users need to be running IT-like commands? § How many users need access to PowerShell?
22
22
11
4/20/24
Discover true detection capabilities
Discover cybersecurity blind spots
Test detection assumptions
Time to detection vs Time to response
23
23
Tune detective controls in real- time
Rapid process improvement
Real-time feedback on changes
Fidelity on log availability
24
24
12
25 04 Critical practices to include in your purple team exercises 25
4/20/24
Critical practices
Detailed Planning
Willing to Collaborate
Detective Controls
Regression Testing
Management Support
Continuous Improvement
26
26
13
4/20/24
Detailed Planning
Willing to Collaborate
Detailed planning is critical to the overall value of a purple team exercise § Tailor attacks to your environment and threat models § Attacks are staged in your environment
Collaboration is key to a seamless exercise execution § Mutual collaboration between attackers and defenders § Transparency on the attack and defensive controls involved
27
27
Detective Controls
Regression Testing
Detective controls should be in place to test against § Penetration tests should have been completed § Findings in the tests should be remediated
The environment is constantly changing § Operating systems and AV signatures are upgraded, devices are added to or removed from the network § Automated or lightweight retesting after updates
28
28
14
4/20/24
Management Support
Continuous Improvement
Collaboration between the attackers and the entire security operation § Mandatory participation from executives and individual contributors
Attackers will keep innovating § Need to be perfect to keep an attacker our of your environment § Continuously tuning detective controls optimizes your ability to detect and disrupt attackers
29 29 30 05 30
Closing thoughts and Q&A
15
4/20/24
Purple team exercises help you understand whether your organization can properly identify malicious network activity and respond to a cybersecurity attack.
31
31
Purple team recap
01
02
03
Different from penetration tests
Helps maximize your cybersecurity investments
Key things to include in your purple team
Not a pen test or vulnerability assessment Staged scenarios vs. fighting our way in Designed to validate visibility and response capability to attacks, not preventive safeguards to resist attacks
Prove whether your detective platform is working as intended
Threat models to define the attacks most relevant to your organization Management support to set the continuous improvement tone Regression testing capability to validate incremental changes
Upskilling your team to make sure they know how to use the tools they already have Identify incremental adjustments and tuning to enhance visibility to attacks
32
32
16
4/20/24
Q & A
Matt Berluti
Manager – Cybersecurity Services
matt.berluti@wipfli.com 202.987.2029
wipfli.com
© Wipfli LLP. All Rights reserved. “Wipfli” refers to Wipfli LLP. 2024
33
33
17
4/20/24
Securing the human and how to increase a casino’s resistance to social engineering attacks April 10, 2024
1
Matt Berluti Manager – Cybersecurity Services
Presenters
2
1
4/20/24
Introduction to social engineering
Overview
Email phishing
Microsoft Teams
Vishing
In-person
Closing thoughts and Q&A
3 3 4 01 4
Introduction to social engineering
2
4/20/24
“Social engineering attacks manipulate people into sharing information that they shouldn’t share, downloading software that they shouldn’t download, visiting websites they shouldn’t visit, sending money to criminals or making other mistakes that compromise their personal or organizational security.” - IBM
5
5
Email phishing
Microsoft Teams
§ Attackers can send emails to employees
§ Attackers can send Microsoft Teams messages to your employees from outside of your organization
Types of social engineering attacks
by spoofing your email server or a realistic lookalike
Vishing
In-Person
§ Attackers can place a phone call
§ Attackers can show
up in person claiming to be a privileged person that they are not
pretending to be another employee
6
6
3
7 02 7
4/20/24
Email phishing
Email phishing
8
8
4
4/20/24
Email phishing
§ Today’s phishing emails are more targeted and contain less spelling and grammatical errors § Most phishing emails will have a sense of urgency, ask for information that shouldn’t be given over email, ask for a user to click on a link § Attackers may be able to spoof your email server to send an email looking like it came from an internal user § Attackers can register lookalike domains to trick employees into thinking they are internal domains § Cyrillic characters
9
9
Email phishing defenses
§ Multi-factor authentication § Email spam filtering gateways § Domain reputation § Age and categorization § Employee awareness training
10
10
5
11 03 11
4/20/24
Microsoft Teams
Microsoft Teams
§ By default, Microsoft Teams allows for external tenants to collaborate and message users in your tenant § Attackers can use this to send malware directly to your users via a vulnerability in Microsoft Teams § Attackers can send a message directing employees to visit a website designed to capture credentials § Device-code login to breach account without breaching the account password § https://microsoft.com/devicelogin
12
12
6
4/20/24
Microsoft Teams
§ By default, Microsoft Teams allows for external tenants to collaborate and message users in your tenant § Attackers can use this to send malware directly to your users via a vulnerability in Microsoft Teams § Attackers can send a message directing employees to visit a website designed to capture credentials § Device-code login to breach account without breaching the account password § https://microsoft.com/devicelogin
13
13
Microsoft Teams Device Code Login
§ Attacker can message employee to navigate to Microsoft website and enter code ABC1234 to authenticate § This code can be generated remotely by malicious PowerShell commands § Once a user authenticates, the PowerShell session obtains two tokens from Microsoft, giving the attacker access to the user’s account without compromising their password § Bypasses multi-factor authentication
14
14
7
15 04 Vishing 15
4/20/24
Vishing
§ Attackers will call employees posing as other employees to gain credentials to the network or customer PII § MGM Attack – Scattered Spider performed a vishing attack against the IT helpdesk to gain an initial foothold in the network § Artificial intelligence can do very convincing voice cloning
16
16
8
4/20/24
Vishing Defenses
§ Implement caller verification procedures consisting of hard identifiers § Employee ID number § Last 4 digits of SSN § Initiate a callback § Educate employees on the procedures and not to deviate from them § Suspicious calls should be reported to security
17 17 18 05 18
In-person
9
4/20/24
In-person
§ Some attackers will show up in person to gain physical access to the network
§ Attach a rogue device to the network § Drop USB sticks with malware on them § Access open, unattended, desktops
19
19
In-person defenses
§ Visitor and employee verification procedures when access sensitive areas § Can include offices, network closets, ports attached to gaming machines § Visual surveillance to identify attacker either in the act or once they have left § Policy and procedures for how employees are supposed to
handle visitors or unexpected guests § Implement MAC address filtering
20
20
10
21 06 21
4/20/24
Closing thoughts and Q&A
Social engineering attacks will likely succeed eventually. While we still need to educate users on the threat of social engineering, we as a security community need to take appropriate technical steps to set users up for success.
22
22
11
4/20/24
Social engineering recap
01
02
03
Threats have evolved
Set users up for success
User awareness training
Many phishing emails are more convincing now than 5 years ago Attackers have adopted new technologies and stay ahead of awareness training
Implement spam filtering to prevent phishing emails from ever reaching an inbox Restrict external access to Microsoft Teams Give users policies and procedures to fall back on when in doubt
User education remains the best defense against social engineering Reporting successful and unsuccessful social engineering attacks helps the entire casino remain more secure
23
23
Q & A
Matt Berluti
Manager – Cybersecurity Services
matt.berluti@wipfli.com 202.987.2029
wipfli.com
© Wipfli LLP. All Rights reserved. “Wipfli” refers to Wipfli LLP. 2024
24
24
12
Page 1 Page 2 Page 3 Page 4 Page 5 Page 6 Page 7 Page 8 Page 9 Page 10 Page 11 Page 12 Page 13 Page 14 Page 15 Page 16 Page 17 Page 18 Page 19 Page 20 Page 21 Page 22 Page 23 Page 24 Page 25 Page 26 Page 27 Page 28 Page 29 Page 30 Page 31 Page 32 Page 33 Page 34 Page 35 Page 36 Page 37 Page 38 Page 39 Page 40 Page 41 Page 42 Page 43 Page 44 Page 45 Page 46 Page 47 Page 48 Page 49 Page 50 Page 51 Page 52 Page 53 Page 54 Page 55 Page 56 Page 57 Page 58 Page 59 Page 60 Page 61 Page 62 Page 63 Page 64 Page 65 Page 66 Page 67 Page 68 Page 69 Page 70 Page 71 Page 72 Page 73 Page 74 Page 75 Page 76 Page 77 Page 78 Page 79 Page 80 Page 81 Page 82 Page 83 Page 84 Page 85 Page 86 Page 87 Page 88 Page 89 Page 90 Page 91 Page 92 Page 93 Page 94 Page 95 Page 96 Page 97 Page 98 Page 99 Page 100 Page 101 Page 102 Page 103 Page 104 Page 105 Page 106 Page 107 Page 108 Page 109 Page 110 Page 111 Page 112 Page 113 Page 114 Page 115 Page 116 Page 117 Page 118 Page 119 Page 120 Page 121 Page 122 Page 123 Page 124 Page 125 Page 126 Page 127 Page 128 Page 129 Page 130 Page 131 Page 132 Page 133 Page 134 Page 135 Page 136 Page 137 Page 138 Page 139 Page 140 Page 141 Page 142 Page 143 Page 144 Page 145 Page 146 Page 147 Page 148 Page 149 Page 150 Page 151 Page 152 Page 153 Page 154 Page 155 Page 156 Page 157 Page 158 Page 159 Page 160 Page 161 Page 162 Page 163 Page 164 Page 165 Page 166 Page 167 Page 168 Page 169 Page 170 Page 171 Page 172 Page 173 Page 174 Page 175 Page 176 Page 177 Page 178 Page 179 Page 180 Page 181 Page 182 Page 183 Page 184 Page 185 Page 186 Page 187 Page 188 Page 189 Page 190 Page 191 Page 192 Page 193 Page 194 Page 195 Page 196 Page 197 Page 198 Page 199 Page 200Made with FlippingBook - Online catalogs