Bamberger case Study- topology artifact views for Layer 1, Layer 2, and Layer 3 of the Bamberger computing environment.

profileDavid2021
CompletedBambergerExpansionProject2021JAN.pdf

Bamberger Corp. Completed Denver Expansion Project

1

1

2

3

4

5

REQUEST FOR PROPOSAL (RFP) 6

IMPLEMENTATION OF 7

DEFENSE IN DEPTH 8

FOR THE 9

DENVER EXPANSION PROJECT 10 11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

60 PINE ST 28

NEW YORK, NY 10005 29

(301)225-8593 30

[email protected] 31

32

33

JANUARY 2021 34

Bamberger Corp. Completed Denver Expansion Project

2

SUMMARY AND BACKGROUND 35 36

In the early 2000s, Bamberger Corp completed a major corporate expansion project into the 37

Denver, Colorado metropolitan region. Although the expansion went smoothly, a lack of 38

focus on Information Technology Service Management (ITSM) and periodic architecture 39

technology refresh has allowed the infrastructure to fall into disrepair. Failure to invest into 40

upgraded equipment driven by ‘here is how we do business at Bamberger,’ has kept the 41

company largely in an antiquated technology environment. Modern concepts such as Cloud 42

Computing, Bring Your Own Device (BYOD), or wireless integration are largely foreign 43

concepts. We have noticed several major areas of concern in the area of information security. 44

Specifically, the implementing contractor did not provide architectural drawings, nor do they 45

seem to have implemented any Defense in Depth. In short, the Denver expansion did not 46

consider cybersecurity as a fundamental aspect of the Information Technology (IT) 47

environment. 48

49

The purpose of this request is to solicit proposals from various candidate organizations (Case 50

Study Groups), conduct a fair and extensive evaluation based on criteria listed herein, and 51

select the candidate (Case Study Groups) who best represents the direction Bamberger 52

wishes to go. 53

54

Bamberger Corp is a large business, with distributed quasi-independently operating mid-size 55

operating business units, that was founded in 1985. The company is focused on the 56

manufacturing of Gizmo1 and providing consulting services to start-up small businesses in 57

the Gizmo sector. In the past, Bamberger prided itself as a leader in the implementation of 58

best practice processes and solutions, and wants to take steps to return to this business 59

practice. Our client base consists of commercial businesses as well as local, state, and 60

federal government organizations. 61

62

Bamberger’s headquarters is based in New York City, with an established presence in 63

Washington, D.C., Chicago and Atlanta. Denver was selected as the central site for 64

Bamberger’s engineering and manufacturing functions as well as regional management 65

offices because of the company’s desire to significantly expand operations in Western states, 66

especially California. The Chicago location for the corporate university location was selected 67

due to under-utilization of the existing workforce. Atlanta was selected for its ability to 68

support Data Center operations. 69

70

1 GIZMO is a non-sensical term that refers to any kind of physical product or service that the Case Study Group

determines it to be. Depending on what the Case Study Group determines GIZMO to be, drives the direction of the

industry and thereby case study requirements of the project. If, for example, GIZMO is pharmaceutical in nature, the

laws, standards, regulations, privacy, security requirements, and industry specific best practices are driven by that

industry. If on the other hand, GIZMO is defined as financial, then the financial sector drives the direction of the

group. Step 1 of a successful (A-grade) response to the Case Study is therefore determining what GIZMO

represents!

Bamberger Corp. Completed Denver Expansion Project

3

1. PROPOSAL GUIDELINES 71 72

This RFP represents the requirements for an open and competitive process. Proposals will be 73

accepted as announced per the posted deadlines (syllabus) and assessed per the posted 74

selection criteria (rubric). Any proposals received after announced deadline will be returned 75

to the sender (Case Study Group) without consideration (i.e. failing grade). All proposals 76

must be individually signed by all official agents or representatives of the company 77

submitting the proposal (Academic Integrity Certification, and individual Canvas 78

submission). Companies (Case Study Groups) may not outsource (plagiarize) any portion of 79

the work and must include a statement (Academic Integrity Certification) in the project plan 80

certifying that all work in preparation for this project was the sole work of the company 81

(Case Study Group) and that the work described therein shall be accomplished only by the 82

submitting company (Case Study Group). 83

84

Contract terms and conditions will be negotiated upon selection of the winning bidder for this 85

RFP. All contractual terms and conditions will be subject to review by Bamberger’s legal 86

department (NVCC Academic Integrity Policy) and will include scope, budget, schedule, and 87

other necessary items pertaining to the project. 88

89

Contract award will be based on corrective action taken as presented by the final RFP 90

deadline (rubric). 91

92

2. PROJECT PURPOSE AND DESCRIPTION 93 94

The purpose of this project is as follows: In order to provide Defense in Depth for the 95

Denver expansion site, senior level management has determined that a comprehensive 96

information security management plan be available to ensure Bamberger keeps data secure. 97

Bamberger is seeking an information security management plan provider (Case Study Group) 98

that can provide a turnkey solution that integrates a Defense in Depth implementation, 99

integration of modern wireless and BYOD technologies, and adoption of Cloud within the 100

Denver computing environment. The proposal must include a system description that 101

addresses the Bamberger specification (course objectives, rubric) and are in line with the 102

following Bamberger Denver computing environment. 103

104

Project Description: 105

106

The bidder is expected to ask for clarification on any portion of this document via the 107

established communication channel (Ask the Professor | Case Study sub-thread). Failure 108

to use the designated communication channel or clarification outreach will likely result 109

in a less than favorable submission consideration. 110

111

There are a total of four buildings. Two 2-story buildings are co-located on a campus in 112

north Denver, conveniently near to both the airport and railroad terminus for shipping and 113

receiving. One of these buildings (DB1, for Denver Building 1, 12,000 sq.ft.) is for the 114

Engineering group. The collocated DB2 (16,000 sq.ft.) is for manufacturing. The two 115

Bamberger Corp. Completed Denver Expansion Project

4

buildings are connected by underground conduit and have plenty of spare multi-mode and 116

single-mode fiber strands. A third 2-story building (DB3, 8,000 sq.ft.) has been procured for 117

IT infrastructure and support staff, but it is located in the Denver Technology Center (DTC), 118

south of town. The fourth facility (DB4, 17,000 sq.ft.), per the desires of the new Western 119

Region General Manager, are four adjacent floors in a downtown office tower. 120

121

The building locations are: 122

123

• DB1/2: 4730 Paris St, Denver, CO 80239 124

• DB3: 5251 DTC Parkway, Englewood, Colorado 80111 125

• DB4: 16th Street, Denver, Colorado 80202. 126

The Engineering group has 450 employees. The Manufacturing group has 300 employees. IT 127

has 50 employees and the downtown facility houses 125 employees. The 125 personnel are 128

broken down into: 15 personnel for the Regional General Manager’s office (floor 9), 20 129

employees for Legal (floor 8), 15 personnel for HR (floor 8), and 75 employees for Sales 130

(floors 6 & 7). 131

132

The Engineering group has 300 people on the 2nd floor and 150 people on the 1st floor, as 133

there is a large lab on the first floor. All the Engineering people have their own dedicated 134

desktop PC and access to a printer, with an average of one IP addressable printer per ten 135

people. 136

137

The Manufacturing group has 100 employees, who each need a dedicated desktop PC and 138

access to a shared printer with the same user load as Engineering. The remaining 200 139

employees share a pool of 50 “public” PCs and 10 printers. 140

141

In DB4, all 125 employees have their own PC and access to a printer at a rate of one printer 142

per employee; this is due to the large number of user dedicated printers (e.g. the GM wants 143

his own printer) and special (e.g. high speed color) printers. 144

145

For the IT group, everyone has their own dedicated desktop PC, and access to a printer at the 146

same 10 to 1 ratio common in the company. Additionally, 30 of the 50 employees have 147

access to a dedicated Unix workstation, 10 for management and administrative functions on 148

servers, databases, etc., and 20 for a small development group building in-house applications. 149

150

IT manages a collection of server farms in DB3 dedicated to departments in the following 151

manner. The Engineering farm is composed of 75 Unix servers. The Manufacturing farm has 152

10 Unix servers. The Sales farm has 10 high availability Unix servers and 20 Microsoft 153

Windows servers running critical sales applications and databases. The Unix servers are 154

deemed 24x7 critical, and extra measures must be taken to protect against network failures 155

and security risks. The Corporate farm has 10 Microsoft Windows class servers, shared 156

among the HR, Legal and GM Offices groups. While not deemed operationally critical, 157

these servers do contain company sensitive information that calls for limited access due to 158

Bamberger Corp. Completed Denver Expansion Project

5

various privacy compliance mandates. Additionally, Corporate data must remain separated 159

from non-Corporate data at all times. 160

161

Some traffic estimates were developed based on typical file types. Engineering and Sales in 162

particular move fairly large data files averaging 30MB in size every working hour (6 a.m. – 163

9.m. Mountain time) for each employee. Engineering personnel data are extremely sensitive 164

and recent regulatory developments require that only the Western Region General Manager, 165

the General Counsel, the Engineering Manager and specific Engineering workforce have 166

controlled access to specific proprietary Gizmo data. Additionally, Sales has the need to 167

participate in desktop video conferencing using streaming technologies. Sales has both 168

transaction and analytical databases in the server farm. Corporate, Legal, HA, and 169

Manufacturing have no special traffic considerations as they move simple Microsoft Office 170

type of files averaging less than 1MB in size. In order to ensure a virtually transparent work 171

environment with the rest of Bamberger throughout the United States and to ensure product 172

quality, network delays for all Denver based employees must not exceed 2.5 seconds for 173

local network transactions, while wide area network transaction delay must not exceed 6 174

seconds. The bidder (Case Study Group) must demonstrate that each member of the given 175

Bamberger group will have at least the following bandwidth (considered an appropriate blend 176

of average and peek needs) to their local Denver servers: 177

178

• Engineering: 5 Mbps 179

• Manufacturing: 1.5 Mbps 180

• Sales: 5 Mbps 181

• Corp/Legal/HR: 1.5 Mbps 182

A design goal is to isolate traffic within groups as much as possible. Thus, the Director of 183

Manufacturing doesn’t want a heavy network traffic load from Engineering and Sales to 184

impact his production. Similarly, the Regional General Manager doesn’t want some clever 185

engineer sniffing the network and gaining access to highly sensitive, company private 186

documents and correspondence; similarly, for HR and Legal. Confidentiality, integrity, and 187

availability of the network and data are a must! 188

189

The Engineering and Sales servers back up files and services that are run out of the New 190

York office. This is done one night per week and the estimate is that this function requires a 191

fairly constant average of 500 Mbps for 12 hours. 192

193

All Denver personnel need access to the corporate intranet with applications running out of 194

New York. The average load of this traffic during working hours is estimated to be 15 Mbps, 195

with peeks of roughly 500 Mbps. 196

197

All Denver employees need access to the Internet. 198

199

The Western Regional Sales Director has his own local web servers (2) serving up sales 200

information, contact requests, and a significant amount of privacy and financial data, among 201

other information, to potential Western state customers. This information is kept up to date 202

Bamberger Corp. Completed Denver Expansion Project

6

with information found in the Sales server farm. Customer traffic to this site is pretty light, 203

no more than 10 Mbps average and 100 Mbps peek. Bamberger business forecasters predict 204

that 84% of Western state customer business will likely originate from California. 205

206

Bamberger does not own a cable plant within the greater Denver metro area and buildings are 207

connected via third party provider. 208

209

Bamberger’s current network address space used for all Bamberger locations other than 210

Denver is 135.172.128/22. Network engineers have already determined that insufficient 211

address exists to accommodate the existing Denver expansion despite the new address 212

location provided by W3C. Bamberger has made arrangements with W3C to obtain address 213

space 135.160/24. 214

215

Network robustness and security is a vital concern for Bamberger. Gizmo is a highly 216

advanced technical device whose production and operational function are highly sensitive. 217

As a result, detailed product data are strictly controlled by regulatory statue to specific 218

Corporate and Engineering personnel. There are 15 Corporate personnel (the Regional 219

Manager, two Senior Counsels) and 12 Engineers with access to the Gizmo data must be 220

isolated from the rest of Bamberger the personnel without access to Gizmo data. Bamberger 221

must have a method to bring non-sensitive data back and forth across the isolated 222

environments. Bamberger estimates that up to 20 GB of data, amounting to 6,000 files per 223

week, move between the environments. 224

225

While the rare outage of a few hours would be acceptable, anything longer than this would 226

not. Sales is particularly concerned about access to their 10 high availability Unix servers. 227

Therefore, the successful RFP bidder must ensure to address both continuity of operations for 228

all Denver operations and near 24x7 operations for the Sales high availability Unix servers. 229

230

Because of the forecasted California business base and our government partners, the 231

proposed plan must ensure compliance with published statues, policies, and best practices 232

within the Gizmo sector. 233

234

3. PROJECT SCOPE 235 236

The scope of this project includes all planning, architecture, and technical computation 237

artifacts necessary for demonstrating the veracity of the bidder’s proposed information 238

security implementation plan. The bidder is expected to deliver the following for review and 239

consideration (grade): 240

241

• Deliverable 1 – Requirements Definitions 242

o The submission must address both functional and non-functional requirements 243

either directly stated or implied in the provided documents (this case study 244

packet), any functional and non-functional requirements derived by 245

governance requirements stemming from the Gizmo definition (statute, 246

standards, industry best practice. etc.), and Bamberger expected outcomes 247

Bamberger Corp. Completed Denver Expansion Project

7

(syllabus course objectives). Additionally, requirements may arise as per 248

clarification questions invoked by the bidder and as documented in the official 249

communication channel (Ask the Professor/Case Study sub-thread) identified 250

above. 251

• Deliverable 2 – Project Plan 252

o The submission must provide a project plan and associated proposed 253

development methodology, a work breakdown structure detailing the 254

contribution of all participants, and rough project resource (budget) 255

requirement. 256

• Deliverable 3 – Enterprise Architecture Approach 257

o The submission must provide a description of the overall Enterprise 258

Architecture Approach, detailing how the proposed IT system (the network 259

and associated technology solutions) fits within the stated Bamberger vision. 260

• Deliverable 4 – IT Service Management Approach 261

o The submission must describe how the proposed IT system (the network and 262

associated technology solutions) and non-technology solutions of the 263

proposed IT services will be managed to ensure IT value. 264

• Deliverable 5 – Cybersecurity & Risk Management Approach 265

o The submission must identify the security approach (Security Framework) and 266

ensure correlation to an established Reference Architecture to ensure that the 267

established cybersecurity industry’s established Common Body of Knowledge 268

(CBK) domains2 are addressed. Detailed coverage must be included in the 269

areas of Software Security Engineering, Supply Chain Management, 270

Continuity and Recovery Planning, Security Testing & Evaluation, and Risk 271

Management and the associated assessment methodology. 272

• Deliverable 6 – Best Practice Policy Review 273

o The submission must identify ANY TWO PUBLISHED Security Policies of 274

any two organizations, and provide a comparison of the two policies.3 The 275

comparison must identify which of the two policies is in better alignment with 276

the documents identified in Deliverables 3 through 5, and explicitly identify 277

which of the Security Policies is better aligned for adoption (after 278

modification) by Bamberger. 279

280

2 (ISC)2 defines the domains as: Security & Risk Management, Asset Security, Security Engineering,

Communications & Network Security, Identity & Access management, Security Assessment & Testing, Security

Operations, and Security in the Software Development Life Cycle. 3 It is recommended that the identified Security Policies are selected from the same industry as that identified for

Gizmo under the System Description & Purpose section of the submission. This is NOT a requirement only a

recommendation. Selecting Security Policies from the same industry sector as Gizmo will allow for easier

revision/adoption of one of the policies as a baseline for meeting the Deliverable 7 requirement.

Bamberger Corp. Completed Denver Expansion Project

8

• Deliverable 7 – Proposed Bamberger Security Policy 281

o The submission must provide a new (or Best Practice Policy revised) draft 282

Security Policy that addresses all requirements per Deliverables 1 and 3 283

through 5, and specifically: 284

▪ at least FIVE of the eight 1.0 Network Security Policy outcomes stated 285

in the syllabus (course objectives) for the proposed TO-BE network 286

environment instantiation, 287

▪ at least SIX of the nine 2.0 Security Design Principles learning 288

outcomes stated in the syllabus (course objectives) for the proposed 289

TO-BE network environment instantiation, and 290

▪ at least SIX of the eight 7.0 Wireless Security learning outcomes stated 291

in the syllabus (course objectives) for the proposed TO-BE network 292

environment instantiation.4 293

• Deliverable 8 – Bamberger Topology Artifacts 294

o The submission must provide, as a MINIMUM, AS-IS5 and TO-BE6 topology 295

artifact views for Layer 1, Layer 2, and Layer 3 of the Bamberger computing 296

environment. 297

• Deliverable 9 – Security Controls 298

o The submission must provide a sample of 18 controls that mitigate the risks 299

either directly stated or implied in the provided documents (this case study 300

packet), any functional and non-functional requirements derived by 301

governance requirements stemming from the Gizmo definition (statute, 302

standards, industry best practice. etc.), and Bamberger expected outcomes 303

(syllabus course objectives). The controls shall be evenly presented across the 304

control categories Physical Controls (6), Technical/Logical Controls (6), and 305

Administrative Controls (6), and represent a sample of how risk is to be 306

mitigated. 307

4 Wireless/BYOD/Cloud implementation: The bidder shall only address ONE of these requirements, i.e. EITHER

wireless, BYOD, or Cloud, not all three. The FINAL version of the DRAFT Security Policy SHALL include a sub-

policy that specifically addresses the selected implementation. If wireless is selected, this means that wireless

technology must be used to connect the Bamberger buildings, i.e. implementing LAN 802.11ac or any LAN

variation of the 802.11 standard DOES NOT count as implementing wireless. If Cloud implementation is selected,

the submission must provide details on the Cloud variant (IaaS, PaaS, or SaaS). If BYOD implementation is

selected, the submission must identify if the BYOD is corporate owned or individually owned, and provide a

management plan for either approach. 5 The AS-IS topology artifacts must be shown as described in this case study document, i.e. the bidder shall not

include network devices that are not specifically mentioned. The only exception is repeaters / hubs / switches /

routers that are implied to be necessary for a basic wired Fast Ethernet network to operate. 6 The TO-BE topology artifacts must show TWO DIFFERENT versions of the proposed TO-BE network. Version 1

shall be a WIRED network with the addition of any necessary network devices to meet good network security

design principles and are in keeping with the specifically stated or implied case study requirements per Deliverable

1. Version 2 shall be a wireless, BYOD, or Cloud implementation that updates Version 1 of the network to include

ONE of these technologies and is in keeping with footnote 4.

Bamberger Corp. Completed Denver Expansion Project

9

Submissions are expected to meet the following specifications: 308

• Preferably ONE consolidated document, but no more than two documents. 309

• Acceptable document formats include: MS Word (.doc), MS Power Point (.ppt), 310

Adobe Acrobat (.pdf), and WinZip (.zip). Other formats will not be accepted for 311

review and consideration (grade). 312

• Evaluation of acceptable submission will be in accordance with published evaluation 313

criteria (Canvas posted grading rubric). 314

4. REQUEST FOR PROPOSAL PROJECT TIMELINE AND INCENTIVES 315 316

As per announced deadlines (syllabus). Deliverables that fail to meet the announced 317

deadlines will be returned without consideration. Draft review submissions may be submitted 318

via the official Canvas Group X Case Study Discussion Thread for consideration, guidance 319

and feedback prior to official evaluation an unlimited number of times until 72 hours prior to 320

the ON TIME deadline for the submission. Once the 72-hour window has been reached an 321

unofficial courtesy evaluation can not be honored. Courtesy reviews will generally be 322

provided within 72 hours of submission. 323

324

Performance Incentives 325

326

Individual Case Study Group members may submit an INDIVIDUAL revision of the 327

Case Study Group work for up to 5% extra course credit no later than 6:30p.m. EST on 328

the last Sunday of regular course session BEFORE finals week. An individual revision 329

submission must be submitted via the dedicated Case Study extra credit communication 330

pipeline, and must be submitted with an explanatory statement why the work was submitted 331

as an individual submission in lieu of incorporating the work into the group submission to 332

achieve the greater good. The individual revision must SIGNIFICANTLY extend the group 333

submission in significant depth in FIVE of the technical evaluation (rubric) areas.7 The 334

revision submission does not need to meet extra credit criteria that all labs must be completed 335

for the extra credit to count. 336

337

Bamberger has identified needs in support of several additional technology projects. 338

Individual Case Study Group members may submit an INDIVIDUAL submission 339

proposal that support ONE of the following proposed projects for up to 10% extra 340

course credit no later than 6:30p.m. EST on the last Sunday of regular course session 341

BEFORE finals week. The submission must follow the same structure of the Denver 342

Expansion project.8 343

7 CAUTION: This option is NOT intended as a way out of working within the group! I urge you to expend the extra

energy needed to earn this extra credit within the group structure rather than outside of it. You should look at this

option as a way to recover points from poor exam or quiz scores. Additionally, in-depth advanced work must be

demonstrated in one of the following evaluation (rubric) areas for extra credit to be earned: Security Controls,

Topology Artifacts, Cybersecurity & Risk Management, IT Service Management, Enterprise Architecture,

Requirements Definition, WBS, or Rough Resource Requirement (Budget). 8 CAUTION: This extra credit is NOT intended as an alternative to the course content assignments identified in the

syllabus! I urge you to expend the energy needed to earn this extra credit on studying and completing readings,

Bamberger Corp. Completed Denver Expansion Project

10

• Project 1: Bamberger Corporate University 344

o Bamberger is looking for a turnkey solution to stand-up a Corporate 345

University that can support its entire workforce. 346

o Requested Solution: Provide a plan to establish/create the technology 347

environment to establish the desired goal. 348

o Work with the following assumptions, and ask for clarification as necessary to 349

implement the project. 350

▪ All evaluation criteria outlined for the Denver Expansion project 351

apply. 352

▪ Bamberger wants to make use of its Chicago facility to establish the 353

University, and seamlessly connect to the rest of the Corporation. 354

▪ The University (facility) must be able to support BOTH onsite and 355

online training. 356

▪ The University must have 4-6 traditional classrooms that each support 357

up to 24 students, 1 large “Convention Hall” that supports up to 200 358

students, 1 advanced (and isolated) network security 359

(hacking/malware/network attack) lab for up to 15 students, and 1 360

emerging technology classroom for up to 20 students. 361

▪ The entire network must be built from scratch (specific hardware and 362

application identification is required). 363

▪ The available facility space is 25,000 sf. 364

▪ Assume that ALL classrooms / labs must deliver training 365

simultaneously. 366

▪ The University must be able to support ALL 2, 505 Bamberger 367

personnel (New York – 300, Atlanta – 630, Chicago – 250, Denver – 368

925, Washington D.C. – 400) with their training needs online. Online 369

student load is expected to be up to 300 online simultaneously 370

connected students with 24x7x270 availability. 371

▪ Online training must be accessible from all Corporate locations and 372

from employee homes. 373

▪ Training must be tracked and records are considered private. 374

▪ Employees must be able to be assigned mandatory training and self-375

enroll in training. 376

377

homework, labs, quizzes, exams, and the case study. However, I understand that as individuals we all have strengths

and weaknesses. Some prefer theory, while others prefer a more applications focused approach. If you have an

application focus and know that you do not do well in theoretical areas (quizzes, exam), attempting one of these

additional extra credit projects may be an option for you. Again, this is extra credit. You cannot substitute one of

these projects for the final or midterm, or all quizzes since the point value of a project will NOT overcome the point

loss of not completing exams/quizzes. It is only a mechanism to recover lost points.

Bamberger Corp. Completed Denver Expansion Project

11

• Project 2: Data Analytics Center 378

o Bamberger is looking for a turnkey solution to stand-up a dedicated Data 379

Analytics Center to leverage the valuable data the corporation generates. 380

o Requested Solution: Provide a plan to establish/create the technology 381

environment to establish the desired goal. 382

o Work with the following assumptions, and ask for clarification as necessary to 383

implement the project. 384

▪ All evaluation criteria outlined for the Denver Expansion project 385

apply. 386

▪ Bamberger wants to make use of its Atlanta facility to establish the 387

Center, and seamlessly connect to the rest of the Corporation. 388

▪ Access to Center data and tools must be available from BOTH all 389

onsite Corporate locations and from secured employee home 390

connections. 391

▪ The entire environment must be built from scratch (specific hardware 392

and application identification is required). 393

▪ The available facility space is 10,000 sf. 394

▪ The Center must be able to support up to 500 remote connections on a 395

24x7x350 availability, with latency of less than 1 second. 396

397

5. PROPOSAL EVALUATION CRITERIA 398 399

Bamberger will evaluate all proposals based on the detailed criteria (rubric) posted separately 400

on Canvas. 401

Joseph T. Walker 402 Bamberger Corp 403 60 PINE ST 404

NEW YORK, NY 10005 405

(301)225-8593 406

[email protected] 407