Aloha everyone and welcome to SBA America, where we focus primarily on small businesses in Hawaii. Thanks for joining us again today. We have some interesting things going on and a super guest who I think you'll really enjoy hearing from, learning a little bit more about his business and what he thinks about the big picture, how he got to run this amazing small business in such a short period of time. We're welcoming Raymond Jardine today. He's the CEO for Native Hawaiian Veterans, quite an accomplished firm in 11 years. Ray is an encore entrepreneur himself. He helped SBA out this past weekend with our presentation that we conduct for people who have perhaps left a career, left a job and are looking at becoming an entrepreneur after the age of 50. So he shared with us some of his experiences and we'll talk a little bit more about that today. But first, I just wanted to let you know about a couple of other things that are coming up in our neighborhood to help small businesses. One is next week on the 23rd and it's called our Regulatory Enforcement Fairness Roundtable. SBA will be bringing in people from the National Ombudsman's Office to talk to you, small business owners and other community leaders about how small business regulations from federal agencies actually affect your small business. If you've got something that's really been giving you a problem or you see a better solution to something that a federal agency has required a small business or asked a small business to do, please join us at the HDO, Hawaii District Office for the SBA and that's at 9.30 to 11. You can call my office at 541-2.990 for more information or you could go to SBA.gov and look up our Ombudsman's Office and they can give you some direct information. It'll be a great event, a lot to talk about and looking for more solutions for small businesses. We also have the Native Hawaiian Organization Business Summit coming up on August 24th and 25th, excuse me, and that'll be at the Prince Hotel. You can go to nhoassociation.org to find out more information. There'll be leaders from DOD and SBA officials to talk about how some of our government contracting programs work to help the economic development of our Native Hawaiian community. There'll be a lot to talk about. We'll be talking about new government contracts and new things that have come up recently in the rules and regulations on the FAR that will help small businesses get a bigger piece of government work. So that leads a great segue to introducing Ray and talking about how he got Native Hawaiian veterans started and how they experienced such phenomenal growth. Ray, welcome to the program. Thank you. It's good to see you again. I've known Ray for quite some time and Native Hawaiian veterans is 11 years old now, but they've been growing at a pretty amazing clip. How do you account for that, Ray? I think when we first had the conception of starting the business, there was about three of us that were talking about it, and it kind of started initially with a friend of mine, Mike Irish, who is an entrepreneur. We went to high school together, Kalani High School, and he talked to me when I got out of the military to start a business. So with that, I gave that a thought, met with a couple people, looked at the federal market plays, and then we started determining what type of programs we might want to get into. So you had a long military career as well. So you retired, and then it was, what do I do next? Yes, 33 years with the military, and then a short period of time with the post office as their senior emergency manager. And again, it was Mike Irish that kind of led me towards looking at entrepreneurship. And when we looked into the program, initially we were looking at the Native 8A program. In 2004, they gave Native Hawaiians an opportunity to compete in their marketplace with the Alaskan Native corporations and the federal recognized tribes. So I was looking at that and came on the board of one of the NHOs, Alakena Foundation. But at that same time, the president started an executive order giving disabled veterans an opportunity to do work in the federal marketplace. So I decided to do that disabled veteran program where I gave disabled veterans 3% goal to go into federal work. So that's how we kind of started the company. So the opportunity was right, and so you could just kind of seize the day and go after it. You had a background with IT primarily when you started. Maybe tell us a little bit about yourself, too, because sometimes you don't think that the local kids have a very entrepreneurial mindset, but you're kind of a rascal, huh? Well, I spent a lot of time playing when we were young and having a good time doing that. Then when I graduated from high school and started to go to work and I didn't see college in my career initially and joined the military. And then I realized that a continuous education was critical for any growth that you're going to have. So started going to school, getting educated, and then moved up the ladder in the military. So when we got out, had some skill sets already established that if I'm going to go into the federal marketplace, some of the things I've done in the military actually transitions quite well over to that. So we started initially as an IT, emergency management company, and that kind of grew. In fact, within two years we were getting a lot of opportunities. In fact, one opportunity was a huge opportunity with Siemens, a very large, large government prime contractor, on a contract to do security systems at embassies across the world. And we were one of three companies, small businesses at the time that was brought on with Siemens to go after that work. And that's what helped us kind of take off. And since then we've been doing work in 50 countries, I mean, correct, in 50 states for territories that work in 20 countries currently in six. So we've kind of expanded our horizon. Right. With just a couple guys getting going and you have grown in now a couple hundred to over 200 employees. Yeah, we have approximately 240 employees now on about 140 vacancies. Did you, was this part of your vision when you were getting started? Oh, no. Okay, this is going to start up. We thought it was going to be a small business in Hawaii, you know, hopefully doing a couple million. And the next thing we know it as we expanded our horizon, we just kept going and going and going and to where we are today, which is Hawaii's business of the year. And we came in second overall in the nation. I would be definitely remiss not to point that out to you as well, that Ray is the 2016 small business person of the year for the state of Hawaii. And with that we sent him off to Washington to represent small businesses here in Hawaii and he became second runner up. Did you have any clue as you went into the ceremony that you were going to be honored for your accomplishments like that? Well, I knew I made the top 50 of four because I wouldn't be there, you know, as I represented Hawaii. Wasn't had no clue, but that we would be in the top three in the nation. Yeah, because that award does specifically look at somebody who started a company and been very entrepreneurial, has created jobs, generated revenue, overcome adversity, you know, as well. So I think, you know, you even in the 11 years that your company has been established and been around, you've kind of managed all those different kinds of experiences, hiring lots of people, having to deal with changes in the economy as well. What would you say are some of the what you grew so fast? Was that challenging to manage that? How did you do that? Actually, you know, we were growing a lot faster and then had to kind of throttle back a bit there, can't outrun your cash and that would be easily could have been done if we just kept growing and not thinking about the holistically running a company and all the moving parts that come with it. So as we grew, I had to make sure that we had the necessary finances to continue the growth along the way. And that line of credit we got with the bank gave us an opportunity to expand our horizons. And with the government contracting methodology, it's about we call it the lag pay system. It takes a little while for the government to pay you. So you better have some cash reserves there while the government eventually pays you along. The government is going to pay you just a matter of when, you know, it takes a little while. You have to invoice the government 30 days later. And then the government may pay you anyway from 10 to 60 days later. So you have to have that little buffer about 90 days of cash reserves to continue your growth. So you have to have that capacity in order to get those contracts and then perform on the contracts and then still have a little bit of time before the the payout comes back to you as well with the growth. Besides the cash is you've got to have the infrastructure. So the infrastructure can't get ahead of the growth because then then you're paying out too much. So that's a lag system too. As you grow, your infrastructure is playing catch up many times. So if you get too far, that gets too far ahead of you, then you have issues and challenges as well. Did you have to really keep a keen eye on everything that was going on in your business during those times? I mean, I think you probably still do. No, the difference then was in the military as well as a commander as you you've got to keep pay attention to all the moving parts. And as a president or CEO, I think the three critical elements that you have to do is you've got to pay attention to your operations. You've got to perform.  You've got to keep your financially healthy of your organization. So pay attention to that. Not only your profits, but on how you're running your business and spending wisely and being prudent about what you spend to grow your company. And then the third part is you have to grow your company. Because if you're not growing it and there's a little saying you call it, you're not growing, you're dying. You're not growing, you're dying. So and you have had you've had good luck in bringing in people on board. Do you find have any issues or trouble finding employees here in Hawaii? Initially, it's all about word of mouth. If somebody's going to give you a recommendation, they're putting their name on the line. So it was easy to find people at the beginning.  And that changed the landscape quite a bit. So we have always used a process called Kinole. It's the name of our foundation as well. It's about doing the right thing with the right person at the right time for the right reason and the right value the first time. So when we do that, we have a tendency of finding that right person with the right value. There's a tendency, many times when I speak in the mainland at conferences, people talk about the best and the brightest. And I totally disagree with that. I think it's about that right person at the right time for the right position.  Yeah, I think that's a rare insight that most of the time we are looking for the best and the brightest. But you do really need that whole package. It's a team effort. You've got to have everybody that fits all the different puzzles and go in the right place. Yeah, so somebody who is extremely talented and forward thinking and everything can really be toxic to an organization. So that's one of the toughest decisions and managing people, I think. Yes, you've got to pick that right person the first time. Because it is, and spend a little bit of time doing that. Don't rush through the process of hiring someone because otherwise you're going to have to redo it again and it gets painful trying to do it again. I guess with over 200 employees, you've kind of worked through that system a bit. So some of the other things that you've expanded, because now as you've said earlier, you've gone from a relatively small business working in IT to a number of different areas. And it probably took some time to be recognized or get that experience and gain those specialties. But how did you go about that? Or did that just kind of happen organically? Like I mentioned, we started off with IT and emergency management. But as we continued to grow and bring in new employees, we found out some of the employees had different skill sets. And because of those skill sets, we started expanding and diversifying the business a little bit more. As a philosophy that we had was that if you're too niche, then you could put yourself into an area where if that niche goes away, you go away. So we diversified the company. We diversified our clients that we were going after. So we did work with the federal government, Department of State, Homeland Security, DOD. And then we also did City and County of Honolulu and all the counties in the state doing state work, doing some commercial work so that when one area may not be as profitable or as prevalent as another one might be, so it creates a really good balance for the organization and it allowed us to continue to grow and then pick up some past performance and skills in one area that we may not have in another. Okay. Well, I think we want to ask a little bit more about that. I think we're going to go to a break right now, but we want to talk a little bit more about some of the different certifications you have and how you have used those to help your business as well. So stay with us. We'll be right back. Hey, everybody. My name is David Chang and I am a new host for the show, The Art of Thinking Smart. I'm really excited to be able to share with you how to get the smart edge in life. We're going to have awesome guests in the military, business, political, nonprofit world. So no matter what background you're from, we have something for you. Please join us every other Thursday at 10 a.m. at thinktechhawaii.com or on the art of thinkingsmart.com. I look forward to seeing you. Aloha, everyone. I'm Maria Mera and I'm here to invite you to my bilingual show, Viva Hawaii, every other Monday at 3 p.m. We are here to show you news, issues and events local and around the world. Join me. Aloha, everybody. My name is Mark Shklav. I'd like you to join me for my program, Law Across the Sea on thinktechhawaii.com. Aloha. Well, we're going to continue our conversation with Rage Ardine, our small business person of the year for the state of Hawaii and a great example of how to grow your business and really look at the cultural values and really know what your core business is and how to really move that forward and make a difference, because obviously with the number of employees you have, building an office culture and keeping them focused is a big, big task. We were talking a little bit about your kina oli spirit and that everybody in the office does kind of embrace these values. Can you tell us a little bit more about how you kind of have been able to use that to galvanize your workforce? Two things in that area, our mission statement that we have and then our cultural statement that we have. So our mission statement is to be a trusted partner, earning customer loyalty, while creating profitability for our employees, we call it ohana and the family, and then enriching our community. So those four pillars, right, our customer, our partners, our employees and the community is what we're made up of. That's the construct of what we... And then the values of that is the kina oli spirit where we apply, you know, doing the right thing at the right time to put it all together and synchronize the company's goals and objectives. Can you give us an example of how that works with your staff and how you are seen in the community? From the staff, I'll give an example. We might be in a meeting and everybody has different opinions and maybe the discussion gets a little bit off track or a little heated. And on one perspective versus another perspective and I would just point to the sign right there in the conference room is this is how we do business. This is what we're about. So we go back to our core values. I think we could come up with the right solution and we usually do because of that. Okay, that sounds really good because I'm sure that with a lot of people you mentioned their skills and their experience and being in so many different areas because now it's IT, it's national security, it's cybersecurity, it's facilities management.  I know your capability statement online lists a long, long, long, long, long list of different NAICS codes that you can perform under. So how does all that work? A lot of the two is because of the ADA program it allows us to go after direct awards and do what's called, we call it unsolicited proposals. And an example would be there was a range of operations out of Fort Still, Oklahoma. It was a bombing range for the Air Force and we approached them to say that we had some of the skill sets we thought we could do the work. And actually the command was out in Texas in the Fort in Dallas area. So we went down there and talked to the command talked to the contracting people and as we were able to actually convince them with our past experiences, not necessarily our past performance as a company because we didn't have one as a doing range operations at that time. But they made them feel comfortable enough that with our past experiences being in the military doing things of that nature the command actually felt comfortable enough to say I think these are the people we want. These are the ones that they've said the right things that they're going to perform. And I've done this with another customer once and I said we don't necessarily do everything right.  But then I caveat that it says when we do make mistakes we don't make the same mistakes. We don't make catastrophic mistakes. But there's no company you can tell you that they don't make mistakes because if they are they're lying to you. And the reality is that we're pretty honest we're straightforward and we're going to do our best and we do make a mistake we fix it quickly we get it done and we don't make the same ones. And those honest approaches to the customer I think that radiates a lot more than if you've given them just a standard pitch line how great we are. And in reality then everybody's great and that's not true. So the key is anytime you do a contract things may go wrong and what's your ability to fix it before it gets worse or to anticipate some of the shortcomings and that's been real helpful for us as we've gone after contracts. So being accountable and being willing to remedy situations should they get a little off course. You don't be 11 years in this business and something did not go wrong. I think that would be as you said somebody's not being entirely truthful if they're telling you that's the situation. You mentioned relationships and talking with people in business about doing business with them and why they should rely on you. How important have relationships been in building your business? That's how we got started. Relationships is the most critical element of getting in the door. Even when we started the company I went golfing with Ron Megida who was that time was a chairman of Central Pacific Bank and actually it was at Citibank and then they merged together. And so I told him I was going to start this business and he said okay you know I'll give you your first loan I'll give you $150,000 line of credit. You know I think you'll be successful right so you know through the chairman the president we can make that happen. I said thank you and he says but you know when you want more money from me that's from the bank he says put your house up. And so I chuckled a little says you're joking right and he goes no I'm not. He says the bank is not an at risk organization. Our job is to look for people that are going to be successful and give them opportunities so they can be successful but we want you to have some skin in the game. So no skin in the game nothing out of me. He says so put some skin in the game and we can continue this compensation. So since then you know after more and more lines of credit as we grew understood what he was trying to say is that you've got to show if you got skin in the game you're in. If somebody else is fork in the bill maybe you're not quite as in as you should be. You're not as as committed to the idea and the concept that you're putting forward so but I'm sure since that time you've grown a lot and both in your financial relationships as well so you're probably Ron has been a great friend and our and helped move your business forward but you've kind of moved moved into a kind of a different area in terms of your financial capacity as well. Yes we no longer have to put my house up where the company can stand on its own where we don't have to credit my house anymore. So that helped a lot. Yeah it makes a little easier to to get home and get to sleep at night and reduce the stress. Yes. Yeah so that's great you know. So the SBA designations those service disabled veterans the 8A those really supported the growth in your company and open doors for you. I would say yes for the most part. It's good to have all these designations. You know the federal marketplace has all these preferred programs for HUBZone 8A women owned disabled veteran programs and to have these additional identifiers has made it helpful. Now we have never wanted disabled veteran set aside contracts but it's a good designation to have because it brings us into where the government gets to use that as a criteria. The 8A I used it sparingly. I didn't want that to be so our main focus because there's a tendency actually when you come off the 8A program if that's all you've done your company don't have the the foundation actually to continue on so business-wise went after full and open contracts so we had a more diverse portfolio and not just focused just on the 8A program where like I mentioned a lot of companies after they come off of it have failed because they didn't transition well. They haven't really marketed themselves across the board to a lot of different opportunities and as you said you've diversified pretty well with state city county and then different federal agencies as well. You're in an enviable position right now with a well run company that's pretty successful very successful I'd say and has even outgrown many of those size standards so for the little guy you're a pretty big business right now. What does that allow you to do? What else are you interested or maybe involved with now? Well what we're doing now is actually starting an NHL that native Hawaiian organization with under the native 8A program acquiring two to three more companies to fall under that organizational structure and we're talking to some other NHLs about creating a strategic partnership so that we can grow as a collective entity that we can actually partner with each other on opportunities. It's a great program to give native people in that program alone we have to, some of our profits have to go back into the community efforts so it goes beyond just being the business and about profits that you put in your pocket but it's about giving back to the community. And particularly to foster economic growth and economic development in the native Hawaiian community. It's a great tool. It's also a great tool because when you talk to a potential client or a customer or a contracting officer we lead with the fact that we give first and that was the term that I use on Saturday about you give, you get, you get, you give. And that philosophy actually is that they look at that that you're not just about trying to make money but you're trying to make a difference not only for the customer but for your community. It sells really well. Yeah. And so you have an event coming up that you've worked on that's very dear to you that kind of merges your experience as a veteran with your native heritage. You want to tell us a little bit about this? Yeah, we, you know, with our foundation we do what was called GapKid programs to help youth programs as well as veteran programs. So one of our veteran program is called the Not Coal Wounded Warrior Outrigger Canoe Race. About five, six years ago we got involved in this program and it was pretty small at that time maybe six or seven outrigger canoes racing. And today, in fact, this weekend will be the Regatta and it starts off on Thursday with a reception and then on Friday we have a wounded warrior job fair for veterans that are looking for jobs and then Saturday kicks off the Dukahanamoku Fests with the Wounded Warrior Outrigger Race. And this year we have over 600 paddlers participating in four divisions. We have a veterans division, combat veterans, Wounded Warrior and Gold Star Family Division. So it has grown to be a huge logistic nightmare that we never thought it would get this big. This big. But it's a great cause. Yeah. It sounds like a wonderful experience and a great way to do their place for spectators to come down or other people to... About last year about 1,500 people were on the beach watching the event and it's always more exciting when it's a close race when it's like when it's a runaway you don't hear a lot of cheering going on but when it's a close you hear everybody yelling and screaming and getting involved. So a good family activity out on the beach and supporting our veterans. And there'll be the Marine Corps band performing, playing music as well. Quite a festive day. So what time does it all start? It sounds like it's the place to be. It starts at eight o'clock the blessing because at eight o'clock some opening ceremony from our congressional delegation and then zero nine hundred we hit the beach. Okay. With that performance. Terrific. Thanks for doing that for the veterans and best of luck. Have a... We may be... May we have great weather. So thank you so much for being with us. We'll see you next time. Thanks very much.


And potentially a competitive weapon. We talked a lot at the Kutuban and SiliconANGLE about how we're entering the next wave of cloud, and we all know that Amazon started it off in 2006, and the developers community belonged on to it in 2008 and 2009. Movement to the cloud was accelerated as people wanted to shift cap acts to the very expenses. And then we had their new phase coming out of the economic downturn. In 2010 and 2011, this phenomenon of shadow IT came along, and certainly many people in this audience, companies like EMC, started to focus on the whole notion of private cloud, however that was defined. And then that evolved into this idea of beyond virtualization into orchestration and management. We think now we're entering this third wave of cloud, which is much deeper integration of the business, not just my mess for less, but a true business model enabling. We think this is where your opportunity is. Jim mentioned Amazon's aggressive stance and entrance into the enterprise. Right into your backyard, it's both a threat and an opportunity for you. On the one hand, it's competition from a new player who's not only a gorilla, but they're also the fast mover. On the other hand, it's a huge market. There's tons of white space. No one cloud in size fits all. So we have this massive customer need. We have demand for your services and together the idea is that you all can collaborate with companies like EMC and fill those gaps and help transform companies' information technology operations and ultimately their businesses. So again, welcome to the panel. Can we cooperate to win success with everything as a service? Where are we in cloud, in terms of where customer adoption is? That's a great question. Cloud has, as you said, moved beyond those words to technology that every enterprise is interested in evaluating right now. Two years ago, our public cloud capability was really SMB, very much developer focused. And what we're seeing now is the CIO is making mandates and making their bets on what their cloud infrastructure should be going forward. They're making three to five and beyond decisions on cloud technologies and direction. And part of that is what technologies do I want to embrace. The other part of that is what vendors do I want to be able to play a role in this. So certainly the Amazon is the 800 pound gorilla, as you mentioned earlier, that is challenging in the ways of thinking, historical ways of thinking around delivering computing capabilities. OpenStack has come up as a challenger to that single mentality that everything has to be public. And it's giving CIOs the discretion to choose their deployment models. They now, in the Middle East, you look at the cloud as a public provider, not just a racked space cloud. HP has an open stack cloud. Dell has an open stack cloud. But also look at, do I want to deploy my own cloud in my own? Do I want to use a third market like a racked space or a red hat on HP to manage a cloud in my environment? So the cloud capabilities, I'd say IT has more discretion and more control over the deployment model than they've ever had. And it's creating some unique opportunities for various providers to get in there. You're seeing everything from appliance driven devices to commodity open compute capabilities being able to deliver via commodity software. It's a real gamut. And what we're finding is we're having to spend more time with these buyers to be able to help them really plot that course. Now traditionally, our CIO cycles were relatively short when we come in. We had a solution to an immediate problem. Now we're having more of a long term architecture directional conversation. So very different place than we were previously. So Michael, you've had for a long time been focused on solving back up and recovery problems. How has the cloud transformed your sets of services over the last several years to have the technology? What's changing? In response to that question, I think cloud for me, it's becoming more similar to how IT was purchased before. So for a while there, everybody was thinking maybe cloud would completely change the game, completely change the story and the sense of how IT was procured, how IT was provisioned, how IT was consumed by the enterprise. And I think the pendulum swung back a little bit. Back to more power in the hands of IT. Because now as you see, Amazon isn't the answer to everything. Amazon's the answer for some things, for some of the open open source public clouds, et cetera. And when you look at private cloud, private cloud for me looks very similar to the way services were procured in the past. You're getting the economic benefits of the cloud, the scalability, the cost reduction of the OPEX versus the OPEX. But now they have more control of it. You have more options of all primers. In addition, some of the issues around security, some of the issues around jurisdictional issues, if you're running production in different jurisdictions and you can't move data off the premises, you can't move data across jurisdictions. Now they're looking at different cloud. Now we're looking, especially from disaster recovery purposes, of how do we make our services available in those jurisdictions to solve the specific use cases? So bring the economics of the cloud wherever, whenever in the world they're needed. And so for us, that's really reflected the evolution from cloud that Amazon can do everything to cloud us. Which cloud do you need for which use case? So it's transformed a portion of our disaster recovery services. So of course we're able to, for the specific use cases of Windows and Linux operating systems, we're able to deploy disaster recovery services now anywhere in the world. So before some of our services, you're really restricted to our five principal data centers because that's where we have made our principal investments. Now essentially you can consume a certain layer of a stack anywhere in the world with respect to cloud recovery. So we created an open model to where no matter where you're running your production, we can make that available for you if you're running a virtualized environment. So that was in no way possible prior to the invention of the cloud. And so that just shows one of the evolutions that we've been able to make in summer. All right, so Kevin, in the context of where we are, I'm interested because you have a background in technology and architecture, how the architecture is evolving. Much of the audience here is focusing on hybrid clouds. How is the architectural model changing and evolving to accommodate the cloud? So I think that's a great question because it follows the progression of where people are. And you think about every client I call after less three years of using cloud frequently go to the CIO and they'll know. And so you go back and what they're seeing is their cost and the rears. They're seeing these issues. So when I go out to a client, go to a client in South Africa and they're working with one cloud provider and then they say, I'm working and my infrastructure is 90% VMware virtualized. And then I'm going to work with another cloud provider, say, on the West Coast of the US. And what they'll tell you to play out is either struggling the tidal pieces together to architect an integrated solution. They're struggling to create the management because self-service is great for development tests. But when you get past development tests, there's actual business processes that you want these things done with. And so you find out that huge portions of the state are not being backed up as an example. As you start to find out that they're really not pulling together an integrated solution so they're getting an isolated project potentially driven by a business organization potentially driven within their own IT shop. And then they go to bring it back together and integrate it. It's sort of the role of IT. The pieces don't come together. So it really is changing the approach of A, how do you define your policies? How do you run them through an automated stack so that you can deploy the same policy whether or not I'm putting it into a public cloud which might be perfectly appropriate for some workloads or a private cloud in another environment in which region do I want it in so that I'm protecting my data and country rules in Europe versus my fear of the Patriot Act that we see in Australia. And so how do I define those pieces? So what's changing is the architectural view. And everyone's been working virtualization for the last five years. It's hard stuff. So they're looking for people who can come in and provide the policy and the management across it with the consistent view of how you do that thing. So it opens up the right way to start to drive towards some of that. But in many cases, it's just a percent when we built ours on VMware. So I can take a client and I can say, you know, your work with everyone there can run exactly here because it's built on the same stack. And I have one API that I can reach in every region of the world. And whether or not it's hosted cloud in our late center or private cloud in our late center or public cloud, it's the same API. So I can invest in that automation that actually lets me get my handle around those business policies. And that's what, you know, so changing the architecture. The architecture questions are less of value. What server was that machine doing? And more about how do I interface to it? How do I drive my application to cause the business event knowledge to trigger an IT event in response? And so you start looking at all those pieces and it does change how you have to build it and what skills you need inside your late center. It's not the same guy. It was really interacting and stacking, right? It's somebody who starts the thing through business policy and automation. And so we see a lot of requests that help them get paid policies defined and then get them implemented across the entire state cloud, not cloud across the board.


On Thursday, October 5th, Kentucky State troopers from post 9 paid a visit to the Culveron McDonald's for coffee with a trooper. The officers were able to sit down for a relaxing breakfast while engaging with the community in a low intensity environment. The event also allows community members to speak with troopers about ongoing issues and how to handle them. It gives us an opportunity to get out and interact with the public. A lot of the times when the public has interaction with us, it's probably because they've called 911 or they've needed all enforcement at their residence. So this gives us an opportunity to get out, meet the public.  So it gives the public an opportunity to see us in a different light and to sit down and tell us what's going on in their community, which also helps us when policing in their community. You want to save money and Appalachian Wireless gets that. Right now you can get up to $650 off select devices, including the latest and the greatest on the advantage and limited plan with a trade-in. Did y'all hear me? Up to $650 off select devices, including the latest and greatest with a trade-in. I'm not a math whiz, but this deal, it's amazing and you'll be on the region's premier network. We are you, we are Appalachian Wireless. See Appalachian Wireless.com for complete terms and conditions. Kentucky State Police focuses on community policing and working in tandem with those they protect and serve. By working closer with the public, they can form a stronger relationship together. That's what Kentucky State Police is based on. That's how I was trained as a young trooper years ago is community policing to get out and be involved in the community and that you live, work and police in. And this is an opportunity for us to be in the community setting so where the community comes to. And this gives us an opportunity to meet with them and they get to know us because a lot of, we have a lot of young troopers here at Post Now and the people in the community don't know them. And you know, I actually work where I live. So a lot of the people in the county that I work know me, but this is an opportunity for people here in the cold run area, in the Pike County area to come out and see other troopers that they may have never seen before and get to know them. Reporting from Out in Top News, I'm Nick Collum.


Hi everyone. I welcome you all in this session on multi-layer hardening in Kubernetes in KCD Chennai 2022. My name is Kavya Rangaraj and I'm a software engineer working in Prodap Solutions in the research and development team. And my work includes exploring and developing applications using next-gen technologies like machine learning, natural language processing, depth stack ops, blockchain and so on. The agenda for today's session includes introduction to multi-layer hardening and how to improve the security posture of your Kubernetes cluster through multi-layer hardening by following a three-step approach and the reference pipeline incorporating all the tool chains and guidelines you need to follow at each and every layer with a unified view. The key takeaways of this session which I believe are the understanding of multi-layer hardening and the key components to secure at each layer and a unified view of your Kubernetes cluster in terms of security and how to adopt depth stack ops to your application. Starting with what is multi-layer hardening? So multi-layer hardening is a concept of securing multiple layers of entities under consideration. That means an entity could be an application, a database, an infrastructure or a Kubernetes cluster. So you consider an entity and identify all the layers in the entity and you harden or you secure the entity. But what is the purpose of hardening? The purpose of hardening is to improve the overall security posture of the entity and it makes it difficult for an attacker to get control of your entity. So if you're hardening a Kubernetes cluster, the purpose is to improve the security of your Kubernetes cluster against various attacks. Hardening doesn't confirm 100% security, it just makes it difficult for an attacker to get control of the cluster. So if you take an application, there are multiple layers like presentation layer, business logic and database layer. Likewise, if you take a Kubernetes cluster, there are multiple layers in a cluster like cloud layer where you run your Kubernetes cluster. It may be an on-prem data center or it may be a cloud environment by any of the cloud service provider and followed by the cluster layer. So in the cluster layer, you have all the Kubernetes control plane components and work and work components followed by the container layer where you run your application workloads and followed by the code layer which is the innermost layer and forms the primary layer for an attacker to initiate an attack. But if you see the pattern of adoption versus the pattern of security over the years, the organizations that are using or evaluating Kubernetes is 96% whereas the organizations that use Kubernetes in production is around 69%. The adoption is tremendous over the years. Whereas if you see the security pattern, it's like 55% organizations have had to delay their application deployment process because of container and Kubernetes security concerns and 93% of organizations experience at least one security incident related to Kubernetes and container in the last 12 months, which means as your application, as your entity evolves, like your cluster evolves, the feature of the orchestrator evolves and the adoption rates increases, the attack surface is also increasing, the attack space is also expanding, which is opening a room for more security incidents and new type of security incidents to happen. And this strongly establishes the need for a multi-layer hardening in a Kubernetes cluster. So let's talk about how to implement multi-layer hardening. What are the process you need to follow? What are the steps you need to follow in order to implement multi-layer hardening in a Kubernetes cluster? The first step includes the understanding the attack surface, be it a cluster layer, be it a code layer, a container or a cloud layer, you need to understand the attack surface, the components that are present in the surface and how they interact with each other. Followed by you need to comply each and every layer with industry standards and best practices. If you ask me, most of the hardening work is in this second layer, you need to comply your entity, be it a Kubernetes cluster or an application with the industry standards so that you are safer from the various attacks. And over the period of time, you evolve it into a DevSecOps for Kubernetes approach into your SDLC. So these are the three steps we can follow in order to achieve multi-layer hardening. So now let's talk about the cluster layer in the Kubernetes architecture. Why security? The biggest concern in the cluster layer. So here you're seeing the Kubernetes architecture containing the control plane and the worker nodes. The control plane has components like API server, ETCD, scheduler and controller, whereas the worker nodes runs your application workloads as parts and they have components like Qblit and Qproxy. The more general idea why security is the biggest concern in a Kubernetes cluster is because of the complex architecture. You have various components and you need to maintain security of all these components. So it seems to be very complex. And the second idea which makes the security a biggest concern in Kubernetes is supply chain dependencies. Say you have an ETCD component and you're storing the secrets in ETCD unencrypted. So if in case they are exposed, it may lead to a serious attack, right? So even a small less secure component or a misconfiguration can lead to a serious attack. So this supply chain dependency is one of the reasons why security is the biggest concern when it comes to Kubernetes. And Kubernetes is a promising target, right? Once an attacker is able to get hold or it control of the Kubernetes cluster and can control the underlying resources, the attacker may run a mining mechanism inside a cluster, right? So they can use this crypto jacking whether they run the mining algorithms along with your application workloads and that may go unnoticed, right? They may even keep a similar name for the mining workload like core DNS followed by some ID. So you don't even notice that there is a new or there's an unauthorized workload that is running in your cluster, right? So these are the reasons why security is the biggest concern when it comes to a Kubernetes cluster at a higher level. To add more granularity, we can see the major causes of a security incidents in a cluster are misconfigurations. Kubernetes components are by default, they are misconfigured by default, that means they are open and they are insecure. So this misconfiguration needs to be handled at the initial stage. So if these misconfigurations are not handled, they can lead to a serious impact and failed audit. So the cluster needs to be frequently audited against various standards and benchmarks in order to avoid supply chain attacks. So it doesn't mean when you develop an application, you scan all the code, you scan all the containers, the images and you just deploy it in the Kubernetes cluster, your security doesn't stop there. It actually starts there for Kubernetes. So you have to conduct frequent audits in order to make sure your cluster is in a secure stage and also runtime security incidents. So if you have containerized images for your applications with vulnerability that doesn't follow any best practices or lacking some best practices either in the code stage or in the image stage or in the container stage, it may lead to runtime security incidents. And the last one is the failing compliance. Most of the Kubernetes clusters which are attacked are somewhere failing the compliance with the industry standards. They are not adhering to the industry standards or compliance frameworks. So let's just see how we can overcome all these causes one by one. Starting with the misconfiguration, so the national security agency or the NSA, it has provided certain recommendations to harden the Kubernetes cluster against the attackers. That means the NSA has released certain guidelines and categorized it into these categories like port security, network separation, upgrading and application security practices, audit logging. So under each category, say you take the category network separation, there will be a guideline that you have to make sure you the access to the control planning components is secured through a firewall and you have to enable role-based access control. Whereas if you take the audit logging, you have to enable the audit logging and also the audit logging for your application. You have to have full observability of your application. And also upgrading and application securities practices, like you have to follow the best code practices and you have to see if there are any unused packages and you have to do frequent vulnerability testing and security scanning of your code. And these are the various guidelines that have been released by NSA in order to harden your Kubernetes cluster against attackers. And this falls in a misconfiguration part of it. So by following these guidelines, you can overcome certain misconfiguration and make your cluster secure. The next framework could be the Mitre, adversarial tactics and techniques and common knowledge framework. So it's a knowledge framework containing the tactics and techniques an attacker will use to attack your Kubernetes cluster to get control of your cluster. So it lists all the techniques, it elaborates the techniques in which an attacker can use to get control. So you can evaluate your cluster against these techniques and make sure where your cluster can be compromised. And you can improve the security posture by enforcing adequate detections and mitigation mechanisms. And here is the threat matrix of the same framework. So you can see it starts with an initial access, how the attacker gains initial access to a cluster. So it may be using cloud credentials, you have exposed your cloud credentials or you haven't enabled that much authentication authorization mechanisms. And it's just exposed to the public and you have this application vulnerability, which may form as an initial stage for an attacker to get into your cluster. Once an attacker gains the initial access, the attacker can run their own scripts, their own containers into your cluster. And they need to be persistent, that is they need to stay in the cluster, even though the initial foothold is lost. So they can escalate on privileges. For example, if they got access to a container and through this container, if that container is a privileged container, and through this container, they can get access to the nodes or other containers.  That is, the attacker should not explicitly show you, some logs are running or some unauthorized workloads are running. So the attacker may delete the container logs of the attacker's script. They can name the pod or container similar to that of the Kubernetes control plane components, right? And it can progress till they can explore on what are the type of workloads you run, and what resources use, how your cluster is capable of handling the workloads and what are the secrets you have stored inside the ETCD. So all these things may lead to either data destruction, resource hijacking, or denial of service. In all these cases, your cluster becomes compromised. Having said that these misconfigurations are used to either evaluate or harden your cluster against serious attacks, right? But how do we implement them in practically? So there are various tools available in the industry to scan your cluster against the NSA framework, NSA guidelines, and this Mitre framework, right? One such tool which I would recommend is a tool called Cubescape by Armo Security, which actually scans your Kubernetes cluster against the NSA guidelines and the threat metrics. So here you can see the results of Cubescape of scanning your cluster against the NSA guidelines, right? And also you can see the results of Cubescape scanning your cluster against the attack framework. Now, once you have secured your cluster by following all the guidelines and configured it in the correct way, right? The next issue, which we saw a major cause for a security incident is the failing compliance, right? So you have to follow the industry standards. Your cluster have to adhere to industry standards, right? So the most widely used and widely followed industry standard is the CIS benchmark that is from the Center for Internet Security. So they list all the secure configurations and the best practices to secure your cluster, right?  And there are, again, so many tools to do this. And one such widely used tool to check for compliance against these benchmarks in your cluster is the Cubescape tool. Here you can see the result of a Cubescape tool scanning a Kubernetes cluster, right? Scanning every component, right? Yeah. And followed by deployment, so you can see we are actually like backtracking from cluster to deployment to container all the way through code, right? We are hardening it from the cluster to the code level, right? So starting with the deployment. So deployments are like files which you use to apply to your Kubernetes cluster in order to create a resource like service or any other type of resource, right? So here is a classical example of a deployment file in which you use to apply it to Kubernetes cluster so that it creates a service and a container starts running, right? But is there any issue do you see with this file? No, right? If you take this file and simply apply it to your cluster, it will run successfully, it will create a service, right? But the problem is in the security aspects, if you see it from the security point of view, it's lacking all these specifications, say container resources. So the amount of resource this particular container named app container can access is not specified. The memory limit on the CPU limit is not specified and there is no network policy explicitly defined which means it can communicate with all other containers in the nodes, right? And there are no privilege checks whether it is running as a root user, whether this container will run as a root user or how it maintains access to its file system and there is no security context specified, right? So all these small aspects like it can cause a bigger issue in your in compromising your cluster, right? And in order to avoid this, you have to do static analysis of deployment configuration files before you apply it to your Kubernetes cluster. Then again, there are various tools available to do the static analysis. And these two tools are recommended like Q Blinder and Q Score, which can scan your deployment configuration files against the best practices in terms of security aspects as well. And you can modify your deployment files and include all the security aspects to make sure your deployment files are secure, right? And it doesn't cause any harm to the cluster. Fine. So now we are going to see about how image of container security is very important. So we have seen how to handle this misconfiguration and failing compliance, right? In the cluster followed by the deployment files, which can also become a serious cause of a security incident. Now we'll see about how this container security is a big concern in the Kubernetes cluster layers. So as we can see here, 56% of developers currently they are not even scanning their containers and 98% of organizations, they need container security with runtime security topping their list, right? So there is definitely a need for container security. And this container security, as well as the cluster security, that is the environment in which your cluster is running comes under the runtime security incidents. So there is definitely a need to scan the running containers once you deploy your application. And you also need to scan the host in which the container is running. And if you are using say Docker container, you need to scan the Docker daemon.  And also the environment, say our cluster is running in an environment and you have certain sensitive files, and you need to manage the access of those files, right? And the network connections of your environment, the inbound, outbound connection and see if there are any privileged containers, if there is any unexpected or unusual network connections or activity happening. So all these things needs to be monitored continuously. So the solution for this would be definitely the continuous monitoring, right? So the continuous monitoring of environment as well as the container needs to be done. And again, there is a tool called Falco, which does this continuous monitoring. It's a widely used tool, and it's an open source tool. It's now a CNC of incubating project, right? And it uses the system calls, your Kubernetes audit logs and your container logs as input. So all these will be emitted as events and these events will form an input to the Falco rule engine, right? And Falco has this powerful rule engine with default rule as well as an option to apply some custom rules. So if any of these events is violating those rules, Falco raises alerts of varying severity. Yeah, as you can see, you can pass system calls, Kubernetes audit logs, even cloud activity logs to Falco. And if you can see if there is any rule that is being violated by the event, it raises the alerts. So say you have a pod or a container running in a user space, right? And you have the logs, and you want to scan all these logs. So what you can do is you can deploy a Falco engine to your user space, and this Falco engine will be scanning all those logs, will be taking these logs as input and checking against the rules and giving you the alerts. Whereas for system calls, Falco uses drivers like kernel driver or EBPF in order to get access to the system calls and scan those system calls, right? And here you can see the varying severity of the alerts of the output of the Falco, right? So it can be an emergency alert or it can be a critical or it can be notice or it can be informational or debug and so on. And Falco alerts can also be integrated in various platforms like Teams, it can be published to Teams, Slack, Discord, and Falco offers comes with a UI called Sidekick. So here you're seeing the dashboard of Sidekick which shows what are the rules that have been, you know, violated in the given time range and the events which cost the rule violation, like who is the user of the event and which namespace that event has occurred, all the information will be locked here. You can see, it can visualize all the information in this, using this Falco Sidekick UI. So this runtime security, it can be used for two things, right? Like one is to scan the running containers as well as to scan the environment in which your cluster is running. So we have seen from all the way from cluster security how to secure from misconfigurations and then to deployment, then to containers. And now let's go to the image security. So image security is like your containers will obviously be referring some images, right? And the image security itself is a multi-layered defense because when you create an image, you need to know what's inside your application or when you're referencing other images in your image, you need to know where it came from, the authenticity of those base images and who modified it, right? And you need to ensure the images adhere to the industry standards like CIS benchmarks, right? And you need to scan your registry. Whenever you push your images to a registry, an automatic scanning mechanism needs to happen so that you don't push any vulnerable image to your registry and you need to sign your images. So this image security itself is a multi-layered defense.  And there is a tool called Privy and Clare which can scan the images for various vulnerabilities, right? So now you have come to the code part, right? So this code part, there are three components we can secure. One is the open source libraries or third party packages you use in your code. And this may also cause serious issue. For example, you are aware of the recent block 4J attack that happened, right? So it's an Apache block 4J, it's an open source package and a small glitch in that open source package led to a serious issue, right? So software composition analysis, frequent software composition analysis needs to be done in order to ensure the packages which you use are secure and up to date. And also the application code needs to be tested against various best practices depending on the languages, right? So it's called static application security testing. And endpoints, you also need to scan the endpoints against various attacks like denial of service, right? And this comes under dynamic application security testing. So when it comes to as a whole multi-layered hardening, it's not only about the cluster layer, it's about the cluster layer, the cloud layer, the code layer, as well as the container layer. And here you can find some of the tools and recommendations depending on the language of your choice, right? If it's a software composition analysis, and if it's a Python, you use tools like safety, and if it's a code security analysis for Python, you use tools like Sonar, Cube, Bandit, right? And so on. So for every programming language, we have different set of tools, we have different tools and recommendations, right? Yeah. Now to summarize, we have seen that in order to harden the cluster layer, we are following the NSA hardening guide, the Mitre framework, the CIS benchmarks, the static analysis of deployment files and runtime security of this cluster environment using tool called Falco. And these are the tools which we are used in the above stages. And coming to container and image security, we need to scan the image layers, the image registry, we need to sign your images and we need to check if they adhere with CIS benchmarks. And also continuous monitoring of running containers needs to be done. And these are some of the tools which can make sure all these things are correct. And coming to code part. So in the code part, we have code, we have to check your code against best practices through a technique called SASD, check all the packages, open source packages and libraries through SCA and scan the endpoints through DAST. And these are some of the tools which we use in order to scan your code. Now, so we have this, we have all these layers, we have all these layers, we have seen how to harden each and every layer, but how to apply it as a whole, how to consolidate or incorporate into a single view, right? And that is through DevSecOps. So before going into the reference pipeline that is incorporating all the tools which we have seen now, let's just start with some introduction to DevSecOps and then go with the reference pipeline. So the main aim of DevSecOps is to give a secure SDLC, right? The purpose of DevSecOps is to give a secure software development lifecycle so that your application is secured, right? And it evolved from this, like earlier we used to do security test just before we go like, just before we deploy in production, we do the security test, right? But that is not insufficient in today's ecosystem. So we have to shift our security practices to left that is incorporated into the earliest stages of our SDLC by following an approach called shift left. So shift left means you're incorporating security into earlier stages of your SDLC, but isn't shift left alone enough? Not really. You also need to follow the shift right approach, which does continuous monitoring of your application as well as the environment, as well as the cluster, because only in continuous monitoring, you can know about the runtime security incidents which are about to happen and you can do a proactive remediation. You can identify patterns in your logs. You can get a complete observability of your platform, right? So you definitely need to follow both shift left and shift right approach. So here is the reference pipeline incorporating all the layers which we have seen now and how to harden them, right? Starting with the code layer where you do a SCASD test and with the image layer and container layer and also the deployment of deployment files where you apply to Kubernetes and also the runtime logs, right? So all these layers will have various tools and all these tools will output different security reports or security results, right? And we need to incorporate, it's very tedious to scan each, see each and every report, right? And then come into a conclusion of the security posture of your cluster. So to avoid that, to make that easier, there are various tools, there are various vulnerability management tools that can incorporate results from various tools and provide you a single view. One such tool which I recommend is called Defect Dojo. It's an open source tool which can incorporate various types of security tools which can incorporate reports from security tools and give you a dashboard of what are all the vulnerabilities that are found by each and every tool and how is the security posture of your cluster or your container or any such layer, right? So it's like you can run the reference pipeline which I have shown and while running the pipeline, parallely, the security results gets published to this Defect Dojo and you can view all the findings that are coming under individual tools, like if there is a Q-bench scan, what are the complaints that has failed and what are the complaints it has passed and you can also ensure risk acceptance and you can incorporate SLA management and you can also send these alerts to various platforms like Teams, Jira and Mail and so on, right? And so the aim is to bring out this reference pipeline, like which follows this multi-layer hardening and provide you a unified view. So this exactly shows the state of your Kubernetes cluster in terms of security, right? And you can evolve it over the period of time by adopting a desktop ops for Kubernetes approach. Thank you. If you have any questions, please feel free to post it. Thank you.


All right, welcome back. You have made it to the end of the Electrify Everything course. So we are finally going to talk about how to find an HVAC contractor. And there's a fair amount of philosophical stuff in this one too so that you can get the best results and have it be a fun and profitable relationship for both of you. So let's dig in. Again, we are at the very end of the Electrify Everything course. So we're to finding a contractor. And what we're going to do, we are going to tie a whole bunch of concepts together that we've gone through in the earlier pieces. So we'll start with the church or the kitchen table. So this is where you're going to be.  So you're the one that's going to be writing the checks. Contractors are the ones that sell and do the work. So those are the two parties that really matter. So we pay a great deal of attention to this. We have built the HVAC 2.0 system so that it takes care of both parties really well. We want it to be smooth. We want it to be lots of grease, not a lot of friction. And so it's a very carefully thought out process to do that. And what we're doing through all of this is conquering fear. So again, you're an early adopter. You're leaning forward into this. So if it doesn't happen to be your fear, it's definitely going to be your contractor's fear that you need to conquer. And remember, that's done mainly with math and understanding. So and this is all important because if we're going to scale electrification and have a catch fire, we need the experiences to be amazing for both sides. Contractors need to love it and the homeowners need to love it yourself. You need to be out there to where you want to tell your friends about it. Again, not in an early adopter way, but in a mainstream market way. And we want to avoid the risk of the very high winter bills, a really uncomfortable house or the HVAC being noisy because remember, it won't scale unhappy people on average tell about a dozen people about their bad experience. And now that we have online reviews, it's way more reach than that. So we need to be very careful to make sure that we are reducing risk of failure and we are increasing the odds of success in everything that we do. And doing that, again, tying back to something we've talked about before, we need to deal with the HVAC cone of uncertainty. So if you remember this, we've got the load calc variability risk. Like if you don't have any information about a house, the load calc is pretty much plus or minus an entire piece of equipment. That's plus or minus the three ton heat pump, which is the standard piece of equipment that we use here. If you have energy use, you're starting to reduce the risk in sizing. And if you have energy use, blower door and client information, namely like how many people live in your house and what your thermostat set points are, you can get to where your plus or minus 3000 BTU's on normal size houses. If you're talking a big house, it's a wider range, but you know, 2000 square foot under, which is a huge swath of American homes. That's going to get you to where it's obvious what size equipment you need. And you're going to drastically reduce those risks. So that you get a really nice project that you're proud to show people. And there aren't any weird little things that you have to cover up. Like, yeah, I don't look at that, you know, pay no attention about the man behind the curtain. You don't want that. You want this whole project to be put the whole thing up front. And there's there's nothing negative to say about it. It's just a good experience. Now remember, blower door heavily affects load calculations. Now, if you're in California or another warm market, it's not as big of a swing as what I'm showing here, but it can still be a pretty big swing. You can easily be off by a ton. And that's a lot. That's 12,000 BTU's so that you won't know which size equipment is right. So this is an 1800 square foot house in Rochester, New York. And you can see just by manipulating blower door, the windows are the same. The insulation values are the same. We can be anywhere from a two ton heat pump up to what it has a 70,000 BTU furnace. And we see leakage rates that high, like that happens. We've had several in the five to 6,000 range of tests that have happened this week. So that's not an out of line number on houses that are between sixteen hundred and twenty one hundred square feet. So this can happen. So you need to know what the blower door is or you're really guessing. And here's another quick way to look at that just as review. So it's leakage to square footage ratio. So say you have a 2000 square foot house with a 2000 blower door, or more correctly, the ratio would be a 2000 blower door to 2000 square feet. That's one to one. If you have a 4000 blower door to 2000 square feet, that's a two to one. So one to one is about when houses start to be controllable with HVAC alone. Is it guaranteed? No, it's not. Like you may have some rooms that are really screwed up. And that's why there's extra testing that's done as part of the blower door test because it's relatively easy to figure out if there are major problems in certain rooms that need to be dealt with. Because if you have one really leaky room, you can't HVAC the problem away. Like it's that's not the way you can get there. You usually can't get enough airflow there. All right. So to find an HVAC contractor, there are three things that they need to be up to speed with. So first, they need to have a blower door and that's going to shrink the pool a lot. Like this is going to be a couple percent of contractors. They need to be able to do load calculations, which again is going to shrink the pool a lot. Lots of contractors will say they do load calculations. You need to ask to see some and ask what program they use to do it, because hopefully they're not doing it on paper. And they also need to true that load calculation to both blower door and energy use. And only a few programs are really good at doing that. So these are important pieces of the puzzle. And the last one is air source heat pumps. So if you were in a market that has a lot of gas, the contractors that are used to installing gas furnaces tend to be kind of afraid of heat pumps because they're just used to air conditioners because that works fine. That's what they've known for years. That's fine. But if you happen to be close to the country somewhere, country HVAC, if you're rural, you don't have access to gas. So you can use propane, oil or heat pump. Those are the three options. So lots of country HVAC contractors are used to using heat pumps. The fellow that I work with here in Cleveland, I mean, I'm out in the boondocks myself and he lives not far from me and his shop is not far from here. So he doesn't even blink an eye anymore. He doesn't even ask me for the load calcs when I ask him for a piece of equipment anymore. So what size you want? OK, and he just goes and does it. So he's used to air source heat pumps and that's something you want to look for. And I'll show you how to do that in a little while. But first, let's talk about what the steps are in doing an HVAC project. So we'll get to electrify everything else, we'll electrify everything but HVAC in a second. So for HVAC, that's the hardest piece of residential electrification by far. This is three to 10x more difficult than all the other tasks. So first off, are there problems to solve? This goes back to start with Y. And also starting with Y is all the things that you want to solve. You know, hot and cold rooms, knocking down allergies, helping your kid with asthma, knocking down wildfire smoke. You want to think about what all of those are worth to solve. So not what is it going to cost, but what is it worth?  And then you also really need to know, is your house so leaky that you need to do insulation and air sealing upgrades for a heat pump to be a good fit? Because you don't want that $1,000 electric winter bill. That's real. I've seen them. I've seen $1,500 monthly bills. So you want to be sure. And a lower door test helps with that. You also need to decide, do you need a panel upgrade? So we talked about that earlier. More houses than you might think can get away with a 100 amp panel, but you're going to be pushing your luck. So everything has to be kind of carefully thought out or move to a 200 amp panel, and that's going to be safe on basically any house that has one HVAC system. Then you need to choose the right heat pump for you, your budget and your house. Get it installed and set up well. So I didn't really go into this earlier, but there's something called commissioning. So when a ship is commissioned, they build the ship, they take it out, they run it really hard, they turn it hard, and they basically try to break it.  So she'll do 30 knots, but don't go more than 28 or she might rattle apart. So that's commissioning. And thermostat commissioning, there's all kinds of little tweaks and setups, and heat pumps are really sensitive to commissioning and the setup. So you want to make sure not only is it a good install, but it is commissioned and set up well. And that's not a big deal. It's like 10, 20, maybe 30 minutes of extra work. And that can literally save you $1,000 or $2,000 a year if it's set up well versus not set up well. Although higher end equipment is naturally set up pretty well, the stock settings, it's the lower end equipment that usually has really bad initial commissioning. Then the last piece is while you're doing the project, treat the contractors really well. And I want to talk about that. So we've talked about friction and grease in projects and just in general of working between people. So if you treat your contractors really well and their guys really well, and it's almost always guys, that is grease for the relationship. So this is showing love. This is important love and respect and creating an equal, equal relationship.  This is simple. This is cheap. Buy lunches.  That's fine. You can buy them better if you buy them better pizza because they're going to know the little Caesars is five bucks. But buy lunches for the crew when they're there. Let them know that you're going to be buying them lunch. So maybe it's the second day because most of these installs are going to take more than a day. Have drinks. So pop, soda, whatever you call it in your part of the country. Water and then just snacks. Have some chips, pretzels, donuts maybe, things like that. Just have them handy and out on the counter and let them know, hey, these are for you.  That's a great thing to load up and just say, hey, help yourself to Gatorade or whatever. Let them know what bathroom they can use. You would be surprised by how many contractors pee in a bottle in their truck because they're uncomfortable with this. If you just let them know which room they can go use, which bathroom they can use, that adds a surprising amount of grease. I've always thought like a six pack of beer or a free t-shirt, they pretty much always buy you more than what they cost. So they have an immense amount of value. If you treat people well, you're going to get hundreds or maybe thousands of dollars in additional value from just being nice to people. So show them, you care about them. That's important. At this point here, this may or may not apply to your project, but if there happens to be a result that you're looking for, like say you want a low static pressure, or the key thing that we've found this useful for is when we're doing an air sealing project, getting really good air sealing numbers and blow it on numbers and the reduction you get in a house is really heavily related to how much the technician cares. Like almost 100% of results are in the hands of a technician, regardless of what kind of product they're using. So one of our early projects, it was a weird house. It had double ceilings, double walls, and we had hit it really hard with spray foam, which usually gets massive amounts of leakage out. And we'd gotten like 15%. And normally for the work that we did, we would have gotten closer to 50, not 15. And so I was nervous we were going to miss our target, and we did. I've only missed an air sealing target on a few houses, and that was one of them. So I asked the homeowner, hey, Paul, would you be game for giving these guys a $50 bonus each if they hit a certain blowtor number? And Paul's a blue-collar guy himself. He's like, oh yeah, let's do that. And those guys ran around with cock guns, and they found all kinds of stuff. And boy, he wouldn't have gotten the number he got had we not done that. So we had a chance packing walls, which is completely in the hands of the installing contractor. And if you want to read more about that, that's in the installation chapter of my book, The Home Comfort Book. But super important that we incentivize them to do something. And that's way better than giving them a tip after the fact. So tips are appreciated and they're great, but they don't actually get you what you want. So if you let them know, there's a bonus on the table if you guys can hit this. And even if they miss it, if they're trying, either give it to them or at least give them part of it. But that's important. You want to treat them well, and that tends to spur, if you give them an incentive or hit and result, that really spurs human competition and it makes them really want to do a better job. So very important, all of these things. But this is all really simple. We're talking grand total here, a few hundred dollars. And you're going to be buying an HVAC system that's at least 10 grand. That's the highly likely number here. So a couple hundred bucks may get you way more than that in value. And if nothing else, it'll make the whole experience more pleasant for both sides. Now, homeowner-contractor relationship. I want to spend a little bit of time here. Like I said, there's a bit of philosophy behind what we do. Everything has a fair amount of psychology and philosophy. And we're trying to, again, grease relationships and increase the odds of success in every possible way that we can think of. And I'm sure we'll find more still, but there's a lot of risk reduction and increasing odds built into everything that we do. So the first thing is, I mentioned this earlier, you need to have an equal-equal relationship. This is not master servants. I see this a lot in... There's a white-collar, blue-collar divide. Most of my friends now are blue-collar. They are contractors. I know a ton of them. I love them to pieces. Do not look down on them. If you want to be surprised by judging a book by its cover and then having it being something completely different, judge a blue-collar guy. Holy cow, they are really smart. They're awesome human beings. They will just surprise the heck out of you about all kinds of things. I love them. They're awesome. So you need to set up an equal-equal relationship. So you want to make sure that there's high trust both ways. So they need to trust you and you need to trust them. And again, this is where HVAC 2.0 is built to grease the skids and create that trust. So is it perfect? No, but it's going to drastically increase the odds of high trust happening both ways. And part of this is when they do a comfort consult for you and they give you bids, you need to feel more than open to go out and get other bids. Typically what's going to happen, though, is they will write a specification that's pretty tough. So generally you're going to find fear priced into other bids when you get them. So generally you're going to find that an HVAC 2.0 contractor is going to be your best bet because they will price things fair and they will also do good work that is trickier than what most contractors are used to doing. Another thing to expect is this is renovations. There's going to be bumps. Every project we've done, there's been bumps. Sometimes they're small, sometimes they're big. Be ready for that. And just if you expect them going in, we build in some fudge factor in our projects where we build in one to $3,000 of fudge because our projects are typically $30,000 to $50,000. So we build in a couple grand of fudge because you're going to tear into something and be like, oh boy, that wasn't supposed to be like that. That's a problem. And if you have built in some fudge factor in your mind and you use it, it's not painful. If you don't build it in and you need that same amount extra, it feels horrible. So again, we're just playing psychology. So keep that in mind. There's going to be bumps. When those happen and just in general, communicate and share responsibility. So stop with the finger pointing and the blame game that helps no one. It's like, all right, this happened. How do we deal with it? And go from there. And then most importantly, if you do this right, you're going to have fun. A blue-collar sense of humor is making fun of each other.  There's a line where they're not being nice anymore, but that's play. That's just kind of how it works. So you want to have fun. You want to mess with each other, give each other a bit of a hard time, but just show that you care. And that makes these projects fun. I enjoy working with the crews that I work with because of this. Now back to how to electrify everything but HVAC. So you're going to have the water heater. A lot of contractors don't really want to do water heaters, the HVAC guys. It depends where you are. So where I am, it's not a big deal because we don't have a lot of permitting and other hoops to go through. But like in California, there's a lot of HVAC contractors like, nope, sorry, I just don't do water heaters. So that may be the case in your market. Now, if you have greased that relationship and you've created that love, guess who's going to help you get that stuff done? So either A, they might do it, or B, every contractor knows a guy. That's just how it works. It's a network. So they'll be able to refer you to a good electrician to help you get a new panel run, run a wire for your induction stove, run a sub-panel to your garage. All that stuff needs to get done. Get the water heater plumbed in. And the odds are, again, if you've created a trusting relationship, you're not going to overpay for any of that. So be nice, play nice, have a good time, be kind to people, and you'll be surprised by what happens. So back to those requirements. So we're out of the philosophy and back into the hard stuff again. So they need to have a blower door. They need to be capable and used to running load calculations, and they need to commonly install air source heat pumps. So there's not going to be a ton of these in a lot of markets, but there will be some. Again, look for the country boys. In fact, the country boys in general, and they're fun, and they know how to fix everything. So really key. Okay, let's tie this back into the HVAC 2.0 process. So again, it's predicated on two different questions. So are there any comfort problems to solve in your house? If no, it's a free quote. If yes, it's a comfort consult. Also, if you have a complicated project, you want to do this. Over here, you're going to own the results. It's purposely set up that way so that you're given choices, but there's no free consulting. Because lots of contractors end up owning stuff that they don't want. So if it's a simple change out, great. If you just want another furnace and air conditioner, great. But if you're trying to electrify, that's a complicated project. So that means that the comfort consult is the lowest risk path. And what that helps you decide is, is HVAC alone likely to solve the problems that you have? So even if it's just electrification that you're trying to accomplish, hopefully there's more. Because again, you want to open up a little bit more budget so that you buy the higher end inverter heat pumps, which give you much better experiences than the old-school one and two-stage stuff. But this is by far the lowest risk path. So you'll either find out, can you do... Oh, where did I get it? Can you simply do a tailored replacement or do you need to do more? We'll come back around to the details there in a second. But let's look at what is in the comfort consult and this should be really familiar to you at this point. So it's the Venn diagram. What are your goals? What does your house need? And what is your budget? What is it worth to fix those problems? So goals, we have a very long questionnaire. It's an hour to an hour and a half worth of questions. And we're trying to figure out what are little pecadillos in your house? What does it bother you? And then at the end, we sit back down and we prioritize those goals on a scale of one to ten. From one, I don't care, to ten, there's basically no budget to fix it. Just get it taken care of. For the house needs, you need to run a Blower Door test and then also do a load calculation that is true to the Blower Door number, the energy use, and your thermostat settings. So that's very important. And then the last piece, again, is what are your goals worth to solve? And if those three overlap, you have a viable project in the middle. And so it's going to depend, there's all kinds of different answers that come out of this. So there you are, the Venn diagram gets taken care of in the comfort console. So the good news is, and this is what I was going to dive into earlier and forgot the order of my slides, many or most houses can simply do a tailored replacement because HVAC alone is likely to fix stuff. So we're seeing somewhere in the half range, the 50% range, even in Cleveland, which is a cold climate. You can basically take a furnace, change it to a heat pump, and it'll work fine. But you need to do the math and understand a bunch of things. Now, for those of you that need more, if you have an older house that's leaky or you have a newer house that has some weird room on it, or whatever might be going on. If you have a complicated problem to solve, that is what we built the comprehensive planning process to do. So we started by doing these. We did these really exotic difficults to figure out projects and we created a scalable method for doing them, so scalable and repeatable. The problem that we found was this is like having an intensive care unit, an ICU at a hospital, but we didn't have a hospital or a clinic attached to it. So it was really hard, there was a lot of soft costs to find people that needed this, which is where we needed to begin. So HVAC contractors end up being perfect because this whole thing, over here, it sells a piece of equipment. If they go comfort consult, piece of equipment. If they just do a tailored replacement, comprehensive planning process almost always leads to a piece of equipment. So now we have, this is the hospital here, the comfort consults, and over here this is the clinic. So now we can handle anything from a very easy to a very difficult house. And our guys can lean into these houses knowing that whatever they walk into, they can solve the problem. Because we've built the system to be able to do that. So whatever the level of difficulty of your electrification or whatever project you're trying to accomplish in your house with the HVAC system, this system, the HVAC 2.0 system will help you get there. Help your contractor get there. And it'll be as smooth as it can be. If you want to see what these deeper projects look like, by the way, so we don't call these deep energy retrofits. By definition, that's like 70% or greater energy savings. And A, we don't really talk much about energy savings. But B, getting to that level is really, really intense. And typically you're talking upwards of $100,000 to do that sort of thing. Or an insane amount of DIY work. So we do what we call comprehensive projects. So we're looking to figure out what can we do to get really good results without going crazy far. And so we call those comprehensive projects. So if you go to energiesmartohio.com that's the website for our practice. You can see what some of these projects look like. So if you need a bunch of insulation and air sealing, your project's probably going to look something like that in one of these. And also, so you know, I've been showing you the simplified version of the HVAC 2.0 process. You don't necessarily have to know all the steps to dive in. Same thing for the contractors, it freaks them out because they don't see that it's all coming. This whole thing is sketched out. And it has a lot of different steps to it. And then three different paths. So all of this is here. It's all thought out. It can be worked through and we've designed this. So most of this work about 80% of the work in HVAC 2.0 can be done by entry level talents. So this is doable. Just about anybody can lean in and do this. They just have to be curious and want to learn and dive in and figure it out. That includes you as the homeowner. So just know that even if you can't see where everything's going it's all in here. And so that's what I wanted to come back to. You don't have to see the whole staircase. Just take the first step. So great line from MLK. Alright, back to finding that contractor. So remember at the beginning I talked about learning, planning and doing. So the learning you're now basically done with. This is the end of the electrify everything course. So you signed up to get the free course. You've now taken the time to go through everything. At the end you're going to get multiple options for the plan and do steps. Here's your multiple options. One. And yes, I realize this is pushing people in the direction of our program. But we built this program. It's a really narrow path. We've spent eight years figuring this out. Closer to ten actually. This is a really difficult narrow path to put everybody on and have it come out the other side. So I'm sure there's other ways to get there. I don't know what they are at scale that are completely market based. So if you can find an HVAC 2.0 contractor and so here's the URL for it. It's easy. If you happen to have one near you, call them. The network is really thin still and so option two is to go create an HVAC 2.0 contractor which I'll show you how to do here next. This is going to take some work. You're an early adopter. You take longer, be harder and probably cost more than it will in five years. So you do really want to consider is this something you want to do today or do you want to kick the can because you don't want to deal with the extra friction. If that's the case, kick the can. It's okay. But if you want to help electrification in general, there's nothing better that you can do than to create an HVAC 2.0 contractor. Third thing is you can wing it. Call somebody. Try and work through it. That's a very, very high risk thing, frankly. And I don't mean to scare you, but there's a lot of things that can go wrong in this. Particularly if you are in a colder climate, like where I live. And then the last thing is you could hire us to help you remotely. But that's not going to be a super scalable solution. So if you want to interview a contractor, we've actually set up a Google form for doing this. So you will get a copy of it. So again, it's going to ask for some information for you that you've already given me. Your email and so forth. But this is going to help us as well because when you submit it, we're going to understand who has been called and we'll have an idea of how open they are to the idea of electrification in HVAC 2.0. This is not going to be easy. So, gird your loins. You know, it's put on the breastplate of righteousness and all the other stuff. There's a lot that needs to be figured out here. But here's what it actually looks like creating an HVAC 2.0 contractor. So you want to call a local supply house to you for the brand of HVAC that you are interested in. So I would suggest Carrier or Bryant or Mitsubishi or Fujitsu. And actually train an American standard can be fine too.   So like it's Carrier Infinity Green Speed or Bryant's Evolution Extreme or Mitsubishi Hyperheat that's the cold climate version. So you want to know what the name is of the top of the line equipment. So ask them who buys it and they'll know a couple of people. I mean I used to be an inside sales. I could tell you who bought one just off the top of my head. So then you use the interview form that is towards the bottom of the HVAC 2.0.com slash map page and call an interview two to four of them. So see what you're comfortable with what you're not comfortable with. And if you find a comfort level with these people with any one of them you want to ask them if they're willing to run a comfort console for you. So we've now set up the HVAC 2.0 software so that you can create a free account and you can basically use all of the software up to creating a report and to create the report the contractor needs to pay 25 bucks. Very minimal. Now they don't get any support doing that. So they need to subscribe to get support which isn't particularly expensive either. But at least at that point you can get yourself through the comfort console process and if they're used to doing load calculations you can get a load calculation. So pay them to do the comfort consults and then you may basically just sit down right next to them and work through it and help them figure out the report and how to use the software. So yes I know that's an extra lift but if you want to reduce the odds of failure and increase the odds of success this is a path that I know works. So we have built it to do this. And we're seeing where this is already really starting to change the lives of the people that are involved in the program. So that's how you do it. You can create an HVAC contractor call a supply house ask who buys the good stuff call them and interview them and then ask them if they are game for doing an HVAC 2.0 comfort console. And that is the end of the electrify everything course. So if you do happen to want to hire us remotely at the bottom of the HVAC 2.0 dot com slash map page there is a link for doing that. So you can either hire me or I'll send you to one of our guys and for now they're pretty much all guys but thank you for making it to the end of the electrify everything course. So good luck as you find a contractor hopefully you've got your head around things. This is the first time I've done a course that is this involved. So do send me an email and let me know what you like or dislike what could be improved so constructive feedback is good.  That's that's immensely helpful to improving this because we want to see electrification scale and we've gone to a great deal of trouble to create a system to allow that to happen. So if you happen to get here because a friend sent you the video or forwarded you this email here's how to get the rest of the course so you skip to the end. But please sign up get the course it's free and if you just enjoy this and you don't intend to electrify in the near future you can buy me a proverbial beer. So I'll put a link underneath and you can send a couple bucks my way or a thousand bucks my way you know whatever strikes your fancy but don't feel any pressure to do that I just leave that option there because we are doing this free and it's a lot of time invested and you're getting the benefit of thousands of hours of experience at this point. So if you find value buy me a beer or just send this on to other people so please share this we'd like to have this go and help us build the HVAC 2.0 network because that's probably the biggest piece of residential electrification is to get that system out there and being used by hundreds thousands and eventually tens of thousands of HVAC contractors across the country. So thanks again for watching I'm Nate Adams I hope this was really helpful to you and I'll see you around on social media so thanks again have a wonderful day bye bye