Moving from point A to point B is changing rapidly as people are increasingly choosing to write an e-scooter instead of taking a more traditional way of commuting. In this session, we are discussing the highly competitive market of micro-mobility with VoIP, one of the European giants of the industry. I'm Sandri Toivren, Chief Marketing Officer of Slash, and today we have the co-founder and CEO, Fredrik Hjelm and VP of Crowd Karos Hjelm here to discuss how VoIP has successfully scaled their business in the competitive micro-mobility industry. Fredrik, let's start from the origin story of VoIP. When you found that VoIP in 2018, what was the problem you wanted to solve? Thank you, Sandri. It's really great to be here. It's my third Slash now, being here in Paris, and it's getting better every year, so super happy to be here, and great to have you on stage as well. Conscious of that, this is the last session of the day, and we've spent eight, nine hours here in the dark night club that Slash looks like to some extent. We'll try to keep the energy level high, and back to your question. I was the founder of VoIP, one of the co-founders of VoIP, and I'm still the CEO of the company. What we saw back then was really a problem in cities. What we saw was that way too many short car and taxi trips done in cities every day. What we saw was that cities got more congested, more polluted, even though when we talked to cities, we heard the same. We want to move towards a less congested, less polluted future, more sustainable mobility, more electrified mobility, lighter vehicles in the cities, in the streets, less space for cars and heavy vehicles, more space for pedestrians, for people on bikes, for people on e-bikes, for people on e-scooters. That was really the problem we saw back then, that we need to change how people move around in cities. We need to move away from heavy combustion engine vehicles to light vehicles, light electric vehicles. We started with shared electric scooters in Stockholm back in 2018, the summer of 2018, and since then we have scaled our services, both the on-demand shared electric scooters, also long-term rental electric scooters in Sartre City so you can have your own void. E-bikes in several countries in Europe, a resell program where we, after a couple of years, when we see that the vehicles, what we see now is that the vehicles last so much longer than what they did back in the days. We see that they last longer now than they are competitive. So then we refurbish the vehicles after a couple of years and resell them on the second hand market. So that's some of the things we're doing now. We have done more than 80 million trips in Europe throughout the last couple of years, and we're more excited than ever. As I see it, if this would have been a football game, we're in minute nine of a 90-minute football game. So so much more goals to make and so much more time to play on. So great to be here. Absolutely. Karo, I have read that micro-mobility will kill the car. What do you think about this? That's a very good question. I think, as Fredrick is talking about a little bit, I mean, Voj was founded with the vision to create cities that are more adapted to the people that live there with less space for cars, and I think it's quite evident to everyone that change is needed when it comes to transport, especially in the city centers, where we're seeing 25%, 30% of the carbon emissions come from transport. And micro-mobility can be a part of solving that problem. I think, as at Voj, we still believe that public transportation will be the backbone of any urban transport, but that needs to be combined with light electric or non-electric vehicles through micro-mobility hubs, and I think we will definitely, in the future, see cities with less space for cars and more space and better infrastructure for micro-mobility. I think it's absolutely absurd, to be honest, that still 50% of the space in many city centers across cities in Europe is dedicated to big metal boxes that spit out poisonous gas, and that's where we're living and where more and more people also want to live, and if more people are moving into the cities, we won't have space for those big, inefficient, which they are, type of vehicles. However, I don't believe that micro-mobility will kill the car, because the car will still be necessary. I just think that we will have smarter, more shared solutions, and in the end, more space for people and less space for cars. Makes sense, that was a wonderful answer. But we came here to talk about scaling, and I have three main areas that I want to focus on today, and these are different markets and cultures, marketing, of course, and product. But before we jump on a specific topic, I still want to understand how you approach growth, and Karo, when did you realize that you need to expand from Sweden? Good question. So when we started Boy, by the way, I'm the first employee of Boy, so I've been with the company since the start, and when we started Boy, we knew from the start that we wanted to be part of making a big change, right? We wanted to really, and we've had the same vision since we launched the company, a vision of creating better cities for people with less noise, pollution, congestion, and in order to do that, we need to think in, or we needed to think in a big way from the start, because in order to make like a proper change, we couldn't just stick in Sweden. Also being from a small country, Sweden or similar to Finland, the whole market is good, but it's not big enough if you want to build something huge. So even before we launched our first like 16 e-scooters in the streets of Stockholm back in 2018, we knew that we wanted to take the company to at least a European level, and since then we have scaled from those 16 e-scooters in Stockholm to now over 70 cities in all across Europe, which is amazing, and four cities here in Finland, which is one of our best performing markets, so it's really great to be here. All right, but what type of signals are you looking for when you like scan the whole Europe or whole the world, like how do you decide where you go, Fredrik? Yeah, no great question, and I think what Caroline mentioned there is extremely important, I think one key to success for many Nordic companies, that we come from small domestic markets, and if we want to build big companies, we have to go at least European or outside of our home markets and preferably international, and you see that in many other Nordic companies, some of the big success stories, including the ones from Sweden, Spotify, Klana, King, and so on, and we have that belief from day one that we're in transportation and we're in mass market transportation. We want to democratize micro-mobility, first do a million trips, then do a billion trips, then reach a billion users to really have the impact and change that Caroline is talking about. So already before we launched in Stockholm, the summer of 2018, we had an idea of let's move as fast as possible out in other European markets as well. And I back then thought, how do we understand which markets are attractive and not? So I called a friend who was at McKinsey, the strategy consultancy, who are famous for doing this market attractiveness analysis and hired him over the summer. And yeah, we were a very young startup and I was like, yeah, we even get the person from McKinsey to help us out. And so he and some others, they traveled around Europe, they built this model for market attractiveness. And we started in Stockholm. And if you think of Stockholm, it's quite similar to Helsinki today, at least in the winters. It's cold, it's dark. And so people told us like micro-mobility, shadowy school, shadowy bikes will never work in Stockholm. It's too cold, people will never use it. You won't get the economics to work. So we did that market attractiveness model and realized that Spain, Spain is the future. We need to go to Spain. It's sunny, some cities have quite good infrastructure for bikes and so on. A lot of tourists that want to use our e-scooters and e-bikes eventually. So five, six weeks after we launched in Stockholm in Sweden, we went to Madrid. We launched in Madrid. I went down, the full team went down to launch a service in Madrid. But we quickly realized that Spain was something completely different than what we had thought and what we had modeled out in our market attractiveness model. So nine, 10 months later, we had to leave Spain. So it didn't work out at all in Spain. Regulations were not in place. Our product was not good enough. The Spanish market was much tougher when it comes to misbehavior and so on compared to the Nordic markets. So since then, we have continuously tweaked and adjusted our market attractiveness model. And we're still learning. Another interesting thing on that one is that we left Spain after less than a year after having launched a market. One year ago, we came back to Spain. And now Spain is one of our best markets. So it just shows that even if it didn't work back then, with improved regulations, with improved product and so on, a market can change, dynamics can change and so on. So everything is very much about product, market, team, timing fit. We have learned that many times throughout this years. Yeah. And I think that's to build on that. I think that's what we have done really well as well. We have dared to take a lot of risk since the start. With risk, there's either reward or fail. As Fredrik mentions, we have since the start had this urge of moving really, really fast and always wanting to move faster than competition, scale faster than competition, and gain more market share. And having taken those risks early on and failed or getting rewarded quite fast, I think that has been one of the things that's made the success of Boy really. Because we have really dared to challenge status quo and also like broken new ground because eScooters was, and micro-mobility was a quite like new industry when we started back in 2018. So yeah, I mean, I think that's really been the part of the success. Yeah. And yeah, 2018, 2021, now the best performing market, one of the best performing markets. But what are the biggest cultural learnings that you have learned during these three years, like in cultural perspective? Like Sweden and Spain, they are quite different. Like are there any patterns you have found, like how to enter a new country or market? You mean when it comes to scaling the business, going to new cities, new markets and so on? Yeah, especially from the cultural perspective, like how to communicate with the cities and the officials and so on. A great question, nothing. Yeah, a few things come to mind. One is if you want to move fast in an industry like ours where you have on the ground the operations. So I would say it goes for all industries, but especially if you have a business model like ours or food delivery or grocery delivery, where you have a very local presence with people on the ground and so on. You need to be hyper-local to win the market. The only way that I've seen working is if you want to move fast is to decentralize responsibility, decentralize and delegate to excellent country managers, to excellent city managers, to excellent market operations managers and have them make decisions and give them full mandate also to make those decisions. I think it's impossible to scale a business like ours or pretty much any business if you want to keep very, very centralized control. If I need to be involved in the decisions we're making in Milan or Madrid or Berlin every day, we just become too slow. So that's one thing I would say. The second thing is also really around moving fast that Caroline was talking about. If you want to scale a business like ours, where several companies were popping up at pretty much the same time, it was a lot of white space out there in Europe, you have to move fast and you have to be fine with moving uncomfortably fast. Risti is saying that if you're not embarrassed about the product you're shipping, you're shipping it too late. And I think that's especially important in very competitive markets. If you're operating in less competitive markets, then you can allow yourself to take some more time to perfect the product, but in a competitive market, you need to move extremely fast, get the data from the users, get the data from other stakeholders and then just tweak and iterate.   And I think what we did really well there was, again, we put the product out in the street and then we let the users tell us how to improve it. And that is key if you want to go from nothing to a successful startup to then eventually a scale-up and beyond. Yeah, okay.  We can now move to measuring because we don't want to make crappy products. So you're the VP of growth now and of course, when you want to measure the success of growth and marketing, what are the main KPIs you are now following when you enter new markets and how do you distinguish if you are doing crappy business or not? Good question. I mean, I think it goes back to speed for us. When we launch a new market, it's crucial for us that we quickly scale to certain levels of user acquisition. And for me, leading marketing at Voi, that means getting to certain thresholds in terms of how many users we acquire and then how quickly we can get them to through the onboarding, adding payment method, getting on their first e-scooter ride to their third ride and then beyond. So those are the things that we're looking at and we look at those KPIs in a quite short timeframe and if we can't reach a certain goal within the timeframe, we need to make changes and we need to optimize the way that we communicate to our users or the products that we push to them. I think it goes back to what Fred was talking about with having flexible and highly local teams that can make their own decisions because what we see is that some types of communication or some types of marketing activities work really well for some markets, but something that works in Sweden or in Stockholm doesn't necessarily work in Helsinki. So we have a playbook that we launch with but then as we see if things are working or not, we need to tweak it depending on the city and the market dynamics. So basically you have like personalized things in different markets, like you do things differently, different kind of messages, for example in Finland and Spain. Yes, exactly. So in all the markets where we operate, we have local marketing managers that works with finding local insight, finding local partners and really localizing the content or the activities that we create centrally. So we have a central marketing and growth team that builds product that builds automation and scalable solutions and tools, but then the local markets take that, adapt it, optimize it to make sure that we can talk to the customers in a relevant way at a relevant time for them. I think one really good example is that we launched this big campaign where we were pushing our subscription model. And in Sweden, it worked really well to push it during mornings between eight and 10 because that's when people get to work, they could get a pass and then start commuting with Voiv. But it didn't work at all when we looked at the Southern European markets. And then we realized that it worked really well if we pushed the message from 10 to 12 because that's when most people go to work in those markets or when they look at their phone or when they're most open to getting those sort of messages. So yeah, taking learnings from central automations, scalable solutions, but then adapting them according to local insights. And that really makes sense. We really need to focus on product now. We are running out of time. Fredrik, how do you ensure that you create a holistically good product experience? You have the like vehicle and then you have the app and something is happening between them. Like, can you walk us through? Like, how do you create the perfect product? Yeah, and I wouldn't say we have a perfect product yet. Probably never will have. I usually say to my team and others, like we will never be worse than what we are today. We're much better today than we were a year ago, two years or three years ago. And fundamentally, the more components you have in a product.  So basically, we have the vehicles and then we need to connect them to the network. And then we have the software side with apps and so on. How we are running it today is that we have one person being responsible for the kind of full, holistic product experience. And then below that person, we have specialized teams. One team responsible for, yeah, the vehicles. One team responsible for IoT connectivity embedded firmware and so on. And other teams responsible for the app experience, the software. In the beginning, that was not the case, of course. Then we were all doing, yeah, we were all doing all of it. So we were building the product on our own. My co-founders were responsible both for the hardware and for the software at the same time. But as we scaled the company, of course, we started to build out more specialized teams and specialized functions. But then I think it's really, really important to have a person or a few people responsible for the full product experience. Otherwise, yeah, it's just too fragmented. Makes sense. Okay, to sum it up, let's hear, like, tell us how, what boy will look like in five years? And Kaira, you start. So we've made a pledge that by 2030, we will have replaced one billion car trips. So in five years, I guess, half of that. And what I really believe that we will see and what boy will be is like a crucial part in people's everyday commute. We will see cities with better infrastructure for micro-mobility. We will have cities that are actually starting to adapt to life with less cars. Yeah, I truly believe that we will continue to push our vision, cities made for living. So yeah, that's what I think. Wow. And now is the time that I will answer something completely different, that will be spaceships or flying cars or something. But yeah, when we started, what we'll come from is really that we saw the Shadi scooters as some kind of entry point into a broader mobility play. And a broader mobility play that goes back to the problem we saw and still see in cities that way too congested, way too polluted. We think micro-mobility is one tool to mitigate for that. So it's to continue to build out our micro-mobility platform, both when it comes to vehicles, when it comes to business models and so on, and integrate it with the broader urban transportation ecosystem, continue to integrate with public transportation, make it easier for consumers to have a seamless experience. You take a bus, then you take a void, and then you take a train, or then you take a plane or something like that. So just to continue to build on that platform. And as Caroline said, make sure we've done more than 80 million trips now, then we need to get to a billion trips, then to a billion users, and eventually we'll have replaced this one billion car trips that we have pledged to do by 2030. Whoa. Okay. We are slowly running out of time. I want to thank you for joining me on this last session today on Amphitheather. Thank you. Thank you everybody. This was the last session of Amphitheather today on the first day of Slush. I wish everybody has a great evening today, and see you again tomorrow. Thank you. Thank you, Santini. Thank you, Santini.


Mothers out there, you're the best. Especially this momma. Oh my my! Let mommas, let mommas get it. Yay! This is amazing. Your water cup. We kinda ran out of time for them to s-i-g-n-s-i. Props to all the mommas out there. It's a lot harder than it looks to make breakfast. It's hard. Happy Mother's Day, everybody. Yeah, Nana and Cida. Hashtag QD down below. What is your go-to family tradition for Mother's Day? What do you guys like to do? For us, it's basically to try and do nothing and relax, a.k.a. order pizza. Old Chicago's, we're coming for ya. And we just love pizza, but then again, who does not love pizza? That might have been hashtag QD number two. I'm just kidding. So, what is your family tradition when it comes to Mother's Day? Comment below. There are those two pieces of cheese. Yeah, that's for you. Please sit. We love you, momma. That's too preoccupied. I love you too.  But we're getting, we're getting, we're getting her done. Right, momma? We're starting Monday off. Yeah. Right. Right. All the laundry's put away, all the dishes will be put away. Don't you work too hard on Mother's Day? I know. I got on my, I'm organizing my closet. I got my purse and my Gucci. Pulled everything out. Yeah. Too much? Yeah. It's dangerous. Sunlight. I don't really like it. And your angelic state of nature. Come on. You gotta put your laundry away on Mother's Day. Come on now. Come on now. You gotta put your laundry away. Again, Happy Mother's Day, that shot you're looking at right now, it's my mom with her twin. And Happy Mother's Day mom, love you. And Happy Mother's Day to all the mothers out there. Again, if you have time, comment below. I think a lot of people would be interested to hear what your family tradition is for celebrating and honoring and commending and loving on the mothers out there. So if you have a second, 10 seconds, 20 seconds, comment below. That'd be amazing. We love you all. And that is today's B-L-O-G. See beauty? My God. Love each other. We will be back tomorrow, I'm sure. Right? I'm sure. After so many in a row. See you tomorrow.


Hi everyone, Joe for Jaspy's CaseBreaks.com coming at you with 2001 Upper Deck SP Authentic Golf. It's a one box, random pack break, number eight. So there are 24 packs in here. We sold 24 spots, there's 24 packs. What I'm going to do is pop open that box right here, look how old this is, a little faded right here, but still could have that guy in there, it still has the Upper Deck logo seal right here, so let's see what we got, so I'm going to number these first and then we'll randomize names and numbers, good luck everybody. Speaking of SP Authentic, we have a SP Authentic hockey brand you released yesterday, we have that in the shop right now. I don't know if the autos are in the same spot or whatever, but we're just going to go like that. We're going to mark these on Tiger's armpit right there, two, three, four, seven. If you're watching the replay of this video, you can obviously fast forward through this part, it's just me marking packs just for transparency purposes. If you're watching live, you're just stuck with me, watching the number packs. 1024, there we go, nice, alright, so that's all on the recording, great, now let's flip back here and let's roll it, let's randomize it, five into five, ten the hard way, your names first, one, two, three, four, five, six, seven, eight, nine, ten, Chris down to Chris, and then five into five, ten the hard way for the pack numbers, one, two, ten the final time. Alright, so after ten we've got twelve down to fourteen. We are going to do these in numerical order, it's a little bit easier to do it that way, and it doesn't punish people whose names are like Zach, alright, so Chris with twelve, David with ten and eighteen, Caleb with twenty four, Brian with seven, Chris with four, Matt with twenty one, Ben with nineteen, Alexander with one, Matt with two, Dennis with thirteen, Dave with nine, Brian sixteen, twenty three, seventeen, Nicholas with twenty two, Brian with eight and eleven, Alexander with three, Drew with six, John with fifteen, Matthew with ten, David with five, and Chris with fourteen, let's sort by number, you can still see Chris with fourteen and Dave's last spot mojo pack ten, now this time I am going to pause the video while I print out these labels, BRB, alright welcome back folks, so there's the print out right there, here's the final list, so Alexander we're going to start with you, and then we'll just keep going down the list, I've got all these labels printed out right here, so this is two thousand one, upper deck, SV authentic golf, random pack number eight, from JaspercaseRakes.com, there's pack one for Alexander, good luck, obviously all card ship, I'm actually going to skip you Matt really quick because I think Alexander only has one more pack, Alexander W, yeah which is pack three right there, so let's just pop this open, David Duvall right here on a roll, some good looking cards but nothing really significant there Alexander, thanks for trying, I'll seal that up before it gets shipped out of course and just set that aside right here, Matthew Shearer I think has, he's got one a little bit later too, you only have two, maybe I'll do both of yours as well, just have to make sure I don't grab wrong packs, alright maybe we'll jump around a little bit, alright Matthew with two, Chichi Rodriguez, Fairway Grates, Payne Stewart, RIP Payne, remember that Payne Stewart story, that was a wild story, it's airplane, alright there's yours Matthew, let's skip ahead to Matthew's pack twenty, if you don't mind, there it is right here, go Matthew Shearer with pack twenty, that's kind of a nice embossing or whatever you want to call it right there, another Payne Stewart, he always likes his look out there on the links, alright there you go Matthew, thanks for getting in, appreciate that, alright now we'll move on to Chris Day with pack four, how many did you get Chris, he's got a few so we'll get to yours eventually, pack four we'll do first, oh and an autograph, there we go, that's Raymond Floyd, sign of the Times Auto, not too familiar with Raymond Floyd but there he is, there you go, auto popped early, there you go Chris, we'll get to your other packs in a bit, David with five and we've got Focus on a Champion, Tiger Woods, nice David I know you got a few more, we'll keep working on working our way through those, get to yours in a second, Drew, pack six, good luck, still could be numbered card in here maybe an extra autograph somewhere, nice Arnold Palmer, so that's kind of what we're continuing to look out for, alright Brian Crouch, seven and eight, I think you got some more a little bit later too, here's seven, here's eight and a numbered card, that is Gene Sarazen, 144 out of 500, more for David, nine and ten, there's nine and ten, we've got another box of this golf in the store ladies and gentlemen, I think it's just one more, so get into it while you can, I guess if you bought out all the spots it would be a personal box, Brian Crouch, pack 11, Chris Day pack 12, nice Jack Nicholas back there, Dennis Foley, pack 13, this is your first first pack here, good luck, there's Raymond Floyd right there, that's the autograph we had a little bit earlier and a Tiger Woods Focus on a Champion, there you go, so in case you were wondering about the auto we pulled Ray Floyd, Floyd accomplished something late in his career in the Northern Golfers, ever done at the age of 49, he won the 1992 Doral Ryder Open, after turning 50, that same season Floyd was victorious in the GTE North Classic on the Senior PJ Tour, he was the first to win on both tours in the same year, there you go, so that's a little bit on old Ray, alright more for Chris and we've got, is this our, that's a relic, nice, tour swatch, a little dent right there but that's what happens when this is from 2001, alright there you go, so that's for you Chris and pack 14, so you got the relic and the auto, nice, John with pack 15, old Bobby Jones, look at that, alright there you go John, thanks for getting in, alright more for Brian, for that stack right there, 16 and 17, alright 16, 17 right there, David, up there pack 18, I think that's his last pack, so good luck, let's see what we got, there you go David, alright Benjamin, pack 19, almost there folks, Fred Couples, got Retif Guzan, few more to go here, Matt Stubblefield, pack 21, what do we have in here, maybe a low numbered card, another Tiger card maybe, yeah there you go, focus on a champion, his red shirt, alright Nicholas Stone, finally got to you, pack 22, alright not much there but thanks for getting in, Brian there is your, here comes your final pack, pack 23, good luck, there you go, thanks Brian for getting in, Caleb, pack 24, let's see what we got for you at the very end, we got Payne Stewart, Raymond, Ben and an autograph, wow, Lauren Roberts, there you go that was unexpected, are there usually two autographs, that's not too shabby, there you go, Caleb and everyone else, thank you very much for getting in, we got one more box left, I'll show you right now, here it is, got one more box left, so if you want to get in on that, go to JaspeaseCaseBrakes.com, get a random pack, cross your fingers and see what happens, I'm Joe, I'll see you next time for the next golf, bye bye.


Welcome to Toffy TV, proudly backed by Vanorama, driving fan TV through the summer. We're here to talk about the managing situation at Everton Football Club. Now, there's a big chance it's going to be Marco Silva. Everyone's saying it's Marco Silva, but let's throw some names into the hat and let's get into it, because a lot of people on social media and stuff are not happy. What a surprise, the people on social media. That's fine. Where are you with this situation, Baz, because Silva looks like he's the man. Marcel Brands is supposed to be meeting him this week. So, from that point of view, are you okay with that? Yeah, I am. I'm just checking you know. I'm fine, yeah, I'm fine. Yeah, I am, because I've said it a few times. There's no outstanding candidate in there, but I look at it and go, we could have got him, and he's perfect for us. Thomas, social, has been there for a while. Now, PSG might have had a bad with him before Christmas and whatever, but other than him, Emery, which is going to Arsenal, will be really going for that. Do you know what I mean? I don't think it's going to people of throne country. I'm Pellegrini, I didn't want so. I'm quite happy with Marco Silva and Marcel Brands. I've been reading some stuff on Marcel Brands. That PSB, the fellow from PSB was talking about him. It was all glowing, fantastic background and insight into what he does and what he brings. And we need a young coach to work underneath him and go hand in hand, because, as I was trying to explain to some people, it's about the process really rather than the managing now, because there's been too much chopping and changing, having to rip stuff up. So, what I've heard, I'm quite happy with it. What about you? Yeah, because, you know, listen, I can't sit here looking at Silva's track record and being amazed by it. I don't think anyone could, but without knowing the full sort of project of what's going to happen at Heaven Football Club, and as you just said, you've got to sort of look at what Marcel Brands has done in the past and bringing some like Phil Cocker into PSB and working hand in hand with him. That's the kind of maybe relationship he's looking at, rather than having sort of a more established older manager who will have been in charge somewhere else. We sort of had that with Cooman, someone who pushed him to shove it out of the UOM situation. I feel like there is going to be a hierarchy and everyone needs to know where they stand. By bringing in a younger manager, they fully appreciate that and will have already sort of had that situation. Silva was a direct footballer at his first club. It wasn't for too long, but he did the job for it for a little bit before he took over being the manager. So maybe he understands and hopefully understands the situation with that and what is expected from a manager because he will have had to... It's not just about doing the job, it's about how his relationship would have been with the manager at the time. So from that point of view, I'm quite happy because all managers are a gamble, I suppose.   He manages Champions League teams. So if he can't get a tune maybe out of... plays are supposed to be the top class, how's he going to get a tune out of Evan plays? For all, we know it might be easier for him to get a tune out of Evan plays because the plays he has are more willing to work hard and appreciate having a good coach. Do you know what I mean? Where there's maybe the high ego, you start getting those egos that go, hang on, we've worked at this fella or that fella and you just don't cut it for whatever reason. So, would Conti come to Evan? I highly doubt it and I highly doubt it because I think he just wants to go back to Italy. I think his family live in Italy. I think his kids live in Italy. I just think the last year you can see it on his face. He's not happy being a Chelsea. Well, he's come on, said he thinks he's taking a year off the way he's going to do it. So just slow everything down again and then look at his options. No, but he knows Evan. He might have had Marko Silver all the way along in the background but Evan might have tested the water with him anyway and gone. If he got any interest in him, he might have just gone now. You want to go back to Italy and that's that conversation finished. So people going, why haven't we asked the bar and what we might have done? The other thing about him as well, he's made it quite clear this year that he doesn't like people buying players for him. No, because he doesn't play Dinkwater, he doesn't really play Barclay who clearly being bought for him to fit quotas and sell on with the Chelsea tax on. So that's that, isn't it? Again, there's a lot of unrealistic shouts but then there are realistic shouts. Eddie's house name has popped up and it's popped up actually from a journalist saying we'll actually have discussed it at board level and I think that's right that they will have discussed something like Eddie's house at board level because I think that what he's done at Bournemouth in the Premier League has been very impressive for what he's gone and who he manages and you look at how small a club that really is. I think he's done really well so I think they have to do that, they have to have those discussions. From a plus point, you know, as an open common manager, he's never toning, apparently. He's managed in the Premier League for a couple of years and although he finished higher in his fair season I think then he did in the second year, I think that this year's been quite impressive especially the back end of the season with the amount of late goals, Bournemouth score and but he has only managed in England and he has only dealt with one sort of kind of player so it's as he got that knowledge of dealing with the kind of players that ultimately we want to attract to the club and has he done enough at Bournemouth? It's a difficult one for me. I just, he worries me, Eddie, I just see a lot of similarities with Roberto Manes so I will see a manager who likes to play the right way I think defensively they are open, there's anything but they're attacking so they win games they're fantastic at coming from behind they like goals all the time so they're obviously fit he's done a brilliant job there they don't want them at everything and back them, of course so would but I just don't know with them, I don't know It's just a problem isn't it, it's hard to I look at him and I think he to be honest with me, I think he was shandled out in October and I don't think he wanted to step into everything No you wouldn't would you? You know he was quite safe where he was we were in a bit of a mess in November and I think I asked the question and I don't think he was very I think he probably just thought, not right now I think his style of play is honourable I don't think he is a manager personally I don't think he is, I think he has a way of playing but I don't think it's the kind of way that Martin has played where it was all just side to side for Tiki positions No I know what you're saying I mean to just open No I know, so I think his football is a little bit more direct not that like longbub but just more direct a tach, I think that does leave them open but then I also look at the kind of a put I also think that many money he has had he's tried to generally put it into the forward areas as well and he does stick to his guns and I think he goes into games and he won't change his philosophy that's honourable I think at times it will get you results at times it will get you results like Chelsea away but it will also get you the free take Liverpool at home, you know what was your 4-0 on so he deserves a chance maybe he'll have one more year of bone-off and then see what happens but I think he deserves a chance somewhere he's an open common manager so he deserves a chance I think Silver Edgesy because I think Silver's win ratio is actually better in the Premier League in the Premier League in England 59% overall I'm not discounting them but I'm just based on England I'm only using the Premier League as the one because I'm not disproving Silver's but if you look at Silver's you've got to look at Eddie Halb before the Premier League and then you're looking at divisions lower so I'm looking at Silver's is still higher but he has got European experience he's got experience of managing in Portugal and managing in Greece and those leagues might be as good as the Premier League but I think it's still very good experience because you've dealt with different kinds of people you've dealt with different levels of talent you've dealt with different scenarios different owners different problems his work at Estabill was unbelievable when he went in there because that's where he started at the second division in Portugal he got them up one man and said he got them into York with a very small budget took over at Lisbon, won the cup like he said the other day he was sacked for not wearing the club's sheets which is ridiculous went over to Greece, won the league by the biggest man and he's one where he is that's all you can really do and when he comes to Hull I was reading I've been reading up on Silver he had 13 players when he went to Hull he won one game he'd been gone and it was like why have you brought this fella in no one's really remember Paul Mason he'll be someone like Sam Allardyce getting it because this fella like Marko Paula and the next minute if you go and read some jailers to watch them and the training and stuff like March, April time when he'd been there a while when he went to Hull he'd only won one game by the end of the season he won nine that's a brilliant second after the season isn't it by anyone's standards especially with the player he had he had to trade snow grass he brought in Camel Grzegi the winger from Poland he did it his own way from Liverpool he brought in Evandro that's what a player he'd worked with in Portugal and he asked on loan and all of a sudden they were invigorated and he beat Liverpool he drew it, united their old Trafford you know we had some big results he lost games as well he did it his own way I mean when he went to Wafford they looked fantastic till we got involved basically and then it sort of dropped off a cliff he had bad injuries but we said this before you're laying from things like that so you know it's whether he fits into the criteria they're having a look on for but there's other managers out there obviously West Ham have just appointed Pellegrini and a lot of people are saying well why didn't we go for him for me because he doesn't fit the model that we are trying to take up and I know you know you look at it and you say he's won the Premier League but he's somewhere a fellow who was given everything needed to win the league at Man City and just did it and thankfully did it because obviously it was that season but he just did it and at his age he got there I just don't think he fits into the criteria whatever they're looking for I think with brands brands are going to take a lot of that sort of way that maybe he would look to have brands is almost going to be the manager isn't he he's not going to be the coach but he's going to by the sound of it he's managing all of that stuff and that means that the coach can get on with coaching I just think I like Pellegrini for me it needs it needs someone to unite everybody it needs an enthusiastic hard working coach who wants to prove himself ambitious and I think Pellegrini is very dignified he's very quietly spoken not saying he couldn't do the job but it goes against whatever it's trying to do it's not long term another name I throw in is Sean Daish who I wanted in November and I still feel like he's almost like the outstanding candidate but I suppose from his point of view if he wasn't approached in November when he was clearly interested then why would he come to it now haven't signed a new contract finished the season strong with Burnley got European football for me his point of view you had your chance but everything still doesn't seem to have any interest in Daish again it doesn't seem to be an avenue they want to go down again that might be because but isn't that a good thing I've seen people talking about silver and I think Farab he wanted it quite clearly he wanted them in November I think we got all of Daish in to study the ship and give all of Daish the benefit of the doubt for a few months but judging by the fact that Michael Silver wasn't treating any jobs of quite clearly he was in our thoughts anyway and people are going why am I looking elsewhere but I don't know whether we should be we should be praising the fact that he's stuck to his guns he wants this fella he's been suitably impressed by him and brands have been discussing it I'll come on so should we then go unless someone a more outstanding candidate what I would say to Daish what I would say to that and we'll come on to one of the candidates in a minute what I would say to Daish as long as brands is part of the process let me jump on do you honestly believe he would give up his stuff of PSV he's settled job for life everything's running exactly the way he wanted to he's got another two exciting kids there which are highly rated he done that before he even agreed to come he wanted all that had he done he's very very professional he doesn't he said he loves the people he didn't know whether he could give it up so why would you then jeopardise what you've got if your signs if I'm settled and I've got everything in front of me this is great I love the people I work with we just won the league again the third time in four seasons I'm getting all the credit for it because I put everything in place and people are loading me and you're going I really want you you're great we want you to do this for our club but I want to choose the manager and I want to do that I agree and this is where I was going this is the point I was coming to is that if he starts 10 yet in this job with someone else's decision then that's his that's him that's him forever isn't it he's got to start this job with assurance that he can do this job right so yes Michelle Silver was Michelle's man in November but it has to be the consensus of both of them now that he's the right man and it's not like it's not like what's your fantasy for tea alright fantasy for pizza and you go it sounds yeah it's going to be pizza you know what I mean you know one of them you've got to want it it's not just a piece in the owning it's just giving you the job but I don't think he's and that's what I'm saying you've got to start on the right foot and go from this probably before but certainly from around February time them discussions will have been taking place so you can get what have you did this to you know Sam all the dice is in there it's not for me this fellow Michael Silver you're a like what he's done let me have a look I think all of that's gone on for all we now Michelle Eirey could have gone to brands in October and gone deep cut but they've had the talks haven't they so we could have got because that's one of the stories I've seen I don't know how true this is Michelle Eirey went to brands in 2016 the week after he'd appointed Cumin and brands and Cumin apparently he didn't want to work on the Cumin and so he did if you right so I don't know so I don't know whether that's one of the stories that was achieved you might know if that's true I can't say that is too but that might be simply because I've read that they've got to get on and they spoke with each other but the simple fact is he might be like well listen he's alright he's my mate I know that you're a bit like that you know no but that's the thing isn't it so for all we know Michelle Eirey because brands have said we've been having a relationship for two years so we could have gone to Cumin in late October and gone we'll have to get at the Ronald and I don't know what you think or whatever I'm looking at this fella what you think because he looks like he might be good it might be it might be rather than like personality it might be what fits the bill so you know I'm hoping that it is a brand's decision and it's just I just think it's he would be giving too much up to Cumin on the wrong foot do you know what I mean let me just throw this other name in the heart because it's been thrown in the last 24 hours Michela Tether now I honestly don't believe but this is just me personally I don't believe if Arsenal had gone after them too many people would would be making as much noise but obviously I think people feel that because Arsenal went so much trouble to get them for that reason there must be something about them and I think that's got people thinking well I'm gone what's he got that they for whatever reason there's talk that I had to take them down and maybe that's why they've moved on to Emory what's he got that we can use but also I think there's also that thing of we need to get him before anyone else gets him it's that thing of the unknown it's that thing of the Shawnee O'Dayshios that if Silver was English and you knew everything about him maybe he wouldn't touch him with a bite but because he's foreign you will touch him I think people there's maybe that sort of feeling with with our Tether as well well he's an unknown quantity isn't he and so he's not soiled by losing games or having a spat with a player or whatever so it's almost like Davy Classan I don't have it's almost like Davy Classan or Felassith the Leith Nias the less they play the better they became so our Tether all of a sudden is this coot he's pecoa di olaf ar tu and we're just missing a trick I'm not going to get him aye he might have no interest in managing evident because he might look and go there's a lot of work there that needs to be done before I'd consider it Arsenal are more stable in us it has to be said at the moment that might change Everton might have asked the question if he turned Arsenal down why would he accept evident but ultimately it goes back to brands and machinery and they might go you know what I don't want to gamble with a man that hasn't had any experience yeah he might be a fantastic coach you know but David Underwood was getting I know it's not the shame but David Underwood was getting talked up and he took the reins in the middle of the season and it was they didn't quite where you know what I mean and it's Michael R Tethers was he 36 coming in I don't know but I just think when he's one of them he could be magnificent it's like the Fonseche thing Paolo Fonseche Everton didn't even want to speak to because obviously the minds made up on them now Fonseche might have come here and been amazing or come here and been horrendous you don't know because you've got no bar all you can say is people are discounting silver winning stuff in Greece and Portugal why is the Ukrainian league be all an end of the month he's not even managed the bloody youth game you know you know what I mean he's just gone in and been on the bench so you know Rennie Mullustain Mullustain Alex Ferguson said unbelievable coach absolutely unreal right went to Fulham I don't know what I'm just saying went to Fulham, night man Colin Harvey was incredible Brian Kidd who back at city he went to Blackburn as a manager he relegated them Carlos Caeros was a Ferguson was like fellas on incredible got off the clad had a nightmare of Benfica in Portugal Steve McLaren again loaded by Faggy nightmare so because you're a great coach it takes a special kind of person a tether might be that person they might have seen it and gone they have no qualms given in the job but I think Bill Kennaith mentioned that in about February to the book because it was Tom King done the story on it so it was out there then do you know what I mean so I don't know maybe Michael doesn't fancy it or maybe Evan just went listen this time we've just gambled last season and we went wrong and we want someone to Mike Tendon to New York there's a fella he was linked with the Arsenal job Patrick Vieira there was reasons why there was reasons why they found him and if you listen to Ian Wright you get a sense of why Ian Wright's ffumin over that by the way but all some say there's a fella who is actually coaching no no yeah and he's doing very well and playing well a tether it's all one of them what would you have said if it was just that would you have been I know you'd have been against some other people I would have maybe took the risk but I just I don't know I think there's well put it this way I'd rather have and this is going to sound ridiculous I'm going to sound like I've shot myself in the foot but I'd rather have a tether than fancy it and I'd rather have a tether than idea but I think I'm saying that because I'm hoping he's got something to bar him I do think he's got something to bar him I don't think he's this one cuddly Michael at tether I think he's got a bit of stale in him I think he's got he proved that by leaving it he's got a bit of devil in him I think with the managers he's worked out he's got a really good mix as well you know working working under Pep Guardiola playing for Venga playing for Moise can't dismiss playing for Moise what that would have brought him that sense of having to work hard and toughen him up I remember me signing and I was like it won't last five minutes this fella he got toughened up and he took it playing for Rangers, he's a PSG he's been around the block he's got I went out and I'm going on I'm just saying it what do you think though I don't know who he was the manager I'd get behind on that he'd be the best little Spaniard and all that I just think it's a gamble they're all gambles and I think that's it I don't know whether that's a risky gamble because we're not stable I think it's all the gamble I think every one of them is a gamble there's not one of them apart from if you do give it to Pep Guardiola or give it to Marini out that and a gamble, they're all a gamble you've got to put everything you've got to put everything into the right circumstances and it happens everywhere sometimes you get a manager and he hasn't got the right circumstances and then you create the right circumstances for him off the page and suddenly that manager is going well I've got the tools to do this, this and the other and this is what that's all I'm going to figure isn't it the fella for him nodling or something to one of the PSVs that's what brands does everything around the coach so that the coach can do his job gives him the right tools and therefore it's successful and he does that through players, watching players talking personality wise I'm worried the bit that he put in which was really I thought it was key and this is a quote it's not a journalist's amazing he said he looks at a player likes him, then thinks will he actually fit in our system and if he doesn't will he actually buy from it even if he thinks too good or he'll go and watch him for another year and that's what we need chemistry isn't it a few bits of art and it's kind of like Moise chemistry you look at a player and you know as he got it also goes back for players that he's had before he knows the good eggs and can it, does it fit the system so you know as I say it's about the whole thing hopefully when a manager does get appointed they'll come out and give the thinking of why we've appointed this manager because he fit into this system that way and people can get it better we've done this on Peyton on another video of whatever in the media I'd love them to come out brands to come out and go got this manager in because he fit these criteria that are going to take the club forward that's why other people weren't considered or and he's the best man for the job and I'd love them to do that so fans go oh yeah now I understand I think most fans will be bad on board anyway it's not about them being on board because fans will it's just about getting rid of because I've seen it and you know what it's sad I understand I've seen people say things like the club have come out and said they're going to appoint a manager to take us into a new stadium why aren't they saying we're appointing a manager to win his trophies and I get that fully fully get that but brands are sad that but that's just a that's just a throw away line isn't it and the club haven't actually said that jailers have said that on behalf of the club but it's all that does is that just displays long term thinking that's not to be all and end all get a manager to take us into a stadium that means the club won on the point of manager that's going to be here for a few years rather than won that but it is what you say and how you say it that gets you over with the fans every time you speak you speak into the fans and we've said this many a time don't let other people fill the conversation in there you do it you lead the conversation and I think everyone will I think once brands are on the come officially starts his role next week the manager will be in place next week so the two of them will start their roles next week and you'll get all the media stuff the interviews and he'll explain himself and that will be it then it will be done I heard a great line before I think it wasn't about football it might have been about politics but it said silence creates fear there's simply no better line I think I've heard when it comes to the Batonians silence creates fear so hopefully it will be done soon hopefully everyone will be happy but you know what whoever it is let's just all get behind them and try and dive ever in the right direction I hope so yeah well that's it isn't it because we do the best ever is the united ever is everyone punching everyone singing in the same hinge everyone wanting to move in the same direction the fans getting behind it you want that springing step you want to get up Saturday morning and go playing today and all that and what you're going to see fast attack on football and that's what we want to see first and foremost then results will come and hopefully trophies and stuff even the odd trophy let us know your thoughts in the comments who do you want who don't you want who do you think hasn't been considered and should be considered because I know people have been throwing names at me and I've been like to the Google like the guys just left Leipzig and people like that and the guys at Huffenheim and Nagelsman yeah but Nagelsman didn't want to leave Germany no no no but it's all these names that people throw at you you've seen Favreys just gone to Scotland he's old no but he's not a great manager because he is but the age thing doesn't it does matter this time because Evan is trying to create a process it doesn't necessarily matter but it matters because we're also not the only club in the world trying to get a new manager like I said to you before maybe just maybe people have to go looks like Evan have actually planned this and therefore I'm getting on board with it because you want the people who are planning it not to be able to have their mind changed so easily let us know who you want also me and Baz have done a video about director of football in fact we did it in February actually and I've stuck it out there director of football yes or no the debate I've put it out watch it when you watch it remember we filmed it in February you can film it in February I've got a really long head on it and we were both like that and I looked like I just had a cake or seven so watch that as well leave your opinions on that thanks for watching toffy tv we'll see you later


So the first speaker for today is going to be taking of the topic designing secure applications in the cloud. And that is by Adora Wadu. I hope I pronounced that right. Yeah, so Adora is fun to call. She's called Adora. I'm just calling her Adora because yes, that's what I know her by. She is a software engineer based in Lagos, Nigeria and currently works at Microsoft where she builds cloud services related to artificial intelligence and mixed reality. She's also an author of the book, Cloud Engineering for Beginners. If you haven't seen that, you can check her Twitter. It's been there. It's an interesting book to look out for. And Adora has created a blog called Adora Hack, where she publishes articles on software engineering, productivity and career groups. You might also want to check out her YouTube channel where she posts content on useful software development tips. Over to you, Adora. Thank you. Can everybody hear me first of all? Yes. All right. Okay. Hi everyone. I'm excited to be here this morning or good morning, good afternoon, good evening depending on where you are joining us from. Excited to be giving this talk today about designing secure cloud applications. So yeah, let's get right into it. I heard Didis's story and it's interesting. I mean, I've heard it before on its Twitter space, but it's just interesting to hear again and to reinforce that. And to be honest, there are so many people like her that have transitioned into that space and there are so many more people that would do that. And one of the reasons why is because it's interesting and the cloud is also becoming really big if we think about it. Apart from the fact that the cloud is like the bedrock for a lot of innovation nowadays, there are so many benefits to why a business would want to move their computing to the cloud. And there's some of these benefits that are listed here. You can use applications as utilities over the internet. You can manipulate and configure your apps online. You don't need to install any software to your local computer. You can use online dev and deployment tools you have on demand self-service, depending on how you are using the cloud. It can also be cost effective for you in the sense that you pay for only things that you need. It's highly efficient, reliable and flexible. And there's so many more reasons why you would actually want to do your, move your business to the cloud. But the truth is with all of these benefits and things that come with the cloud, comes with some kind of responsibility as well. Yes, if you are using Docker or Kubernetes as well, you will be able to do zero downtime deployment. So it's not because you are trying to deploy code that your customers would not be able to use your service, even if it is for a split second.  But again, with all of these things, because now everything is on the internet and it is publicly accessible over some network, there has to be some form of responsibility. And I want to play this short video. I really hope that my laptop can't transmit sound as I'm screen sharing, but let's see how it goes. Hey there, I'm going to tell you a story about what happens when you do not protect public resources. This house has water supply in form of a bucket at the compound. This is a housemate who actually needs water. He gets on into his bowl and goes back inside. This second person who happens not to be a housemate comes to the public area where the water is and makes it unfit for everyone to use by washing her hands inside. This housemate happened to be walking in the direction of the water and accidentally kicked it. Now all the water is gone. Why did this happen? Because access to the water wasn't properly regulated. How do we fix this? Take the bucket away and keep it in a safe place. Secure the house to prevent outsiders walking by from tampering with resources only meant for housemates. Connect a tap so that housemates get water in a structured way. The end. The water was a cloud resource on the internet. Somebody has come and put what they are not supposed to put inside. Somebody has come and used it in the way that it's supposed to be used. Somebody came from nowhere and was just walking by and accidentally kicked the water and disappeared. And now let me use data as let's swap this bucket of water with actual customer data. Somebody comes and washes their hands inside. Basically an attacker comes and is able to corrupt your data in some way just because you've not protected it properly and because they can. Somebody comes and uses the data how they're supposed to use it which is a normal regular user that needs that data. A normal developer that wants to fetch that data through API calls and has the right permissions or doesn't but just because they are the normal person they are using it the right way and that's fine. Then a third person who is coming and mistakenly kicks the bucket and throws the water which is basically somebody else who is supposed to be using or rather who is not supposed to be in that environment but has access to that data for whatever reason because it's not properly secure or regulated. And then they can just like delete the entire thing or even if it's someone that has permissions to do it it could be someone that doesn't have permissions to do it just coming to copy all your resources and then deleting it or it could be someone that has that is supposed to have permissions to do it but shouldn't have permissions to that level and they make a mistake and they go and delete the whole product and then somehow all your data is gone. Things like that. There's some security risks in building cloud applications. The first one is human errors, human mistakes which I just talked about. Somebody accidentally deleting all of the data because they didn't realize they had those permissions or because they wanted to delete something else and then somehow they went to go and delete the entire production infrastructure and now suddenly you don't have data anymore. Malicious Attacks which is similar to things like, sorry, Malicious Attacks which is similar to people going to wash their hands inside the tap, for example, right? So people coming to your data and corrupting it because you're not properly secured it. And the last one, which is legal and compliance issues I mean to be honest, there's no way you would tamper with a lot of customer data or use PII the way you're not supposed to that you don't expect lawsuits from coming to you or you don't expect security agencies when they do an audit on your business to say that you are not security compliance and this can bring issues for you and could also possibly damage your reputation. So in this talk, I would be highlighting the different architectural patterns for building secure cloud application and also some things that you can do outside software architecture still within your code as a programmer. Or a cloud engineer to also help you in thinking about securing these cloud applications. But before we go deeply into all of this I would want to quickly introduce myself. So hi again, my name is Adora and I'm a software engineer contributing mixed reality on the cloud at Microsoft. I'm also the creator of Adora Hack which started as a blog where I post content for software developers grew into a YouTube channel or rather extended into a platform extended into also having a YouTube channel where I post lifestyle content about my life as a software developer as well as content for software developers in terms of how to grow their careers, productivity tips and all of that. And recently also included a study group for people to ask questions and do peer programming together and learn sort of like having people come every week or every other week to answer all the questions that people have and facilitating sessions that force people to actually own their learning because now they have a safe space that they can get their questions answered. I'm also the author of this book Cloud Engineering for Beginners. It's a book that introduces the concept of the cloud, cloud engineering, different roles and job types in cloud engineering and different parts of the cloud to beginners in a beginner friendly way. Also on the advisory board for VRAR, Nigeria currently trying to do some form of VRAR education in this space advocate for the technology and promote usage of this technology in different industries as we move towards building the metaverse. And I basically live on Twitter. If you are on Twitter, you know that I'm mostly always there and you can find me on Twitter at Adiron Woodrow. So now let's get to it. When you want to start building your application, one of the first things you would do is to have a security checklist. And this checklist actually helps you analyze and understand how your applications need to be secure. So it's some form of defense before you are actually even attacked, which in my opinion is important. And there are some of these questions that you ask yourself, which is will my application contain sensitive data? Where and how are my applications data stored? Will this application be available over the internet publicly or will it just be available internally? How do I plan to verify my user's identity? What sensitive tasks are performed in my application and does my application perform any risky software activities? Asking this question will allow you to be able to think about your application security holistically. And when you ask yourself these questions, you can come up with answers. So if you're asking yourself, will my application contain sensitive customer data? If your application does contain sensitive customer data or what is called PII, you would now go towards thinking about identifying a data protection method for your application so that you can secure that data in transit and at rest. Where and how is my application data stored? You might start thinking about, you know, instrumentation to your storage services client so that you know at what points you are connecting to the client, storing the application. You entirely know the entire, you basically have a holistic view in your application about the entire life cycle in the storage bits. And you can also think about data protection so when you're thinking about where and how your application is stored and you can now properly think about data protection in an effective way. Will this application be available over the internet's publicly or just internally? So for public apps, you can be thinking about data protection methods. You want to make sure that people's data are protected. For internal apps, you might be thinking about, oh, okay, if this app is just available internally to maybe the developers in this company or on this team, you think about granting permissions to internal users. You don't want to give everyone super mean access. You want to make sure that the right people have the right access and no one is over privileged, basically. You can be thinking about how do you plan to verify your user's identity? And that's where you'd have to think of a good authentication and authorization strategy for the application that you are building so that it's secure. What sensitive tasks are performed in your application? You might also be thinking about an authorization strategy that is very key because you don't want people that should not be able to perform sensitive tasks to be performing this task because you haven't properly set the right permissions. And then the final question, does my application perform any risky software activities? And if it does, like maybe downloading, if you are going to be doing risky software activities like allowing people upload things up into your infrastructure, into your storage, you might be thinking about protection against malicious data. You might be thinking about the way to sign the data that comes into your storage before you make that data publicly accessible to many people because imagine people uploading data to your storage and that data is also supposed to be publicly accessible to anyone that is using the application. So it's like, oh, okay, I'm a creator. I can put things here and I can also, you know, I can read and I can write basically to your application or to your infrastructure. If you don't think about protection against malicious data, what's going to happen is that people can upload random things and they're not supposed to upload. If you've not thought of a way to sign that data, if not a way to protect or rather to verify that data that is being uploaded, somebody can upload in my way and something happens to everyone's data and next thing, people are calling you, you're answering lawsuits and different things that you do not want. And based on these questions that have been asked, you can put them into two buckets, the data protection buckets and the identity management buckets. And in this talk today, I'll be talking about three architectural patterns in these two buckets. The first pattern is the gatekeeper pattern which is under the data protection bucket. And the second pattern is the identity management pattern. Sorry, is the federated identity and valet key patterns which are under the identity management buckets. Now let's talk about the gatekeeper data protection scenario. So applications functionality are usually exposed when they accept and process a client request. So if the system is compromised and the malicious user gains access, all sensitive data will be exposed. So enter the gatekeeper pattern which is a way for the system to have a gatekeeper that validates and sanitizes the request before the request is actually forwarded to the service so that you can sanitize this request if somebody is, imagine someone sending a query, right? Somebody trying to just, you know how they pick at your data, still your data and in whatever request they're making to your service, it is a raw query and you don't check and validate or sanitize these things but you just let it go. They're going to be able to even write queries that delete things off of your storage or your database if you've not set these right data protection policies in place and you don't implement this gatekeeper pattern that helps validate and sanitizes these requests. So what happens with the gatekeeper pattern is that a gatekeeper exposes an endpoint to the client that is like a public endpoint. And then the public endpoint is the endpoint to a gatekeeper not the endpoint to a service. And after the sanitization and the validation is done, then a private endpoint that is the call to the service is made and with that, you can call all the different parts of the service, call your storage and stuff like that. So the benefit of using the gatekeeper is, you know requires validation, limited risk and security. And this is like a real life application of a gatekeeper pattern where there is a public endpoint which when you call it, you have like a gate, it gives you a gatekeeper role which is, you know, a limited privileged mode. And then once you are done validating and sanitizing then the gatekeeper can call the internal endpoint. And in that internal endpoint, you have full privilege because now you have a trusted role and you can use the service or the application however you want to. And the next thing I want to talk about is the valet key pattern which, you know, allows you securely control access to data by using a token that expires after a period of time. So this token can be used either for authentication and authorization. So let's say you want to access as a user, me, right? As a user or a client or a customer. I want to access your organization's storage because maybe I need like a read and write role to that storage because I'm supposed to be able to, you know, upload data onto the storage and then, you know, you would now help me process that data and then, you know, people can use it or I can get it back or whatever. I would have to implement something similar to a valet key pattern which is where me as a user, I request a resource from an application and then the application validates the request and generates a token for me, returns that token back to me. Now that I have that token, I can now present that token to the resource and be like, okay, this is the token and this is the action I want to perform on this resource. And then the resource can validate that token and perform the action or tell me that the token is invalid. So I will need to, you know, request another token or just know that I don't have permission to access that resource. And as an application, I can decide to set policies where I can, you know, revoke tokens after 30 minutes, you know, add some specific permissions to tokens so that it's not just anyone that has a token that can perform any kind of action on the resource. If I'm giving you a token that, you know, the claims on that token are only for read access, I don't expect you to be able to write any form of information to that resource and things like that. So this is a code that I got from the internet that explains this in like actual source code. So I hope it helps you. So doing this in like an Azure storage account, for example, I have a blob service client and I have a blob container. And then I'm like, okay, hey, I want to get shared access reference because I want to be able to upload data to the storage account. And then I get the client for the blob, which is like the storage account clients basically. And then I create a storage shared key credential. So I say, okay, this is the storage account name and I pass in the app setting as well for the Azure storage and Milito account key. And then I create like a blob source builder where I pass in my storage container, I pass in the name of the blob that I want access to. I pass the resource and also the time. So if I want to create an access key that allows someone upload a file and I want that access key to be revoked after 10 minutes, I can now add that, okay, my time offset should be 10 minutes. So after 10 minutes, if you're not done doing what you're doing, sorry, you have to request another token. And then I set permissions because you want to be able to upload a file onto my Azure storage, I give you right permissions. And then I create the URI and I send them back to you and then now you can do what you want to do with that. So this is like a code snippet for that sort of thing. The third identity pattern that I want to talk about is the federated identity pattern. So this allows you separate user authentication from application source code and delegates authentication to an external provider. A lot of people don't know that they do this, but they do this today. So if you are using, if in your application, you are not doing username and password, but you are actually using an external, maybe social media sign-on or if you are using maybe Microsoft, for example, you are using Azure access directory or MSI logging or MSI logging rather, you are already doing this sort of thing. And this pattern works like, okay, I am using this identity provider or security token service as a service or as an application, which is like, oh, signing with this thing. And what happens is that I write code in a way that users authenticate and request tokens. And then once they authenticate and they get those tokens, once they authenticate rather, I send a token from a security token service back to the user. And then now the user can use that token or that, yeah, that token. It could be a JOT token or any other kind of token, a JWT, because people have these arguments that is either pronounced as JWT or JOT, I call it JOT anyway. So it could either be a JOT token or any other kind of token sent back to the user. And the user can present this token to the service and that can give them access to certain things in that application. So there are different use cases for this federated identity pattern, single enterprise sign-on, if you have multiple partners and if you're building software as a service application. So this is an example for using the federated identity pattern in a claims-based access control scenario. And imagine a SaaS application that is also as a service application by a tenant company that is using this federated identity pattern. So I trust this provider and basically I can get a token from this provider and then use the claims to access whatever resources and this helps me protect myself from certain scenarios. So even within a company or even within different providers and stuff like that, it's like, okay, this tenant is different from this other tenant and things are groups like different tenants and stuff. And basically if you present a token that is not for my tenants, I can basically kick you out of accessing my resource and stuff like that. So I have talked about three patterns. So now I want to talk about other ways that you can enforce security. The first one is using multi-facto authentication. Recently, I've been getting a lot of emails from different things that I'm signed onto that ask from this dates, we are going to be moving to two-facto authentication or multi-facto authentication. If you've already enabled multi-facto authentication on your account, you don't have anything, you don't have to do anything or perform any action. But if you've not, before this date, please go and enable it, blah, blah, blah, blah, because passwords are not enough these days, right? People have been hacked, they've been in a lot of security breaches in lots more recently than before. Also with this whole remote work and everybody being at home, we have to find a way to secure ourselves a lot more than we did before because now we're no longer in physical buildings in our offices where there's like, oh, intranet and it's like secure and it's shared and all of that. We need to find new ways to make sure that we secure ourselves and we secure all the things that we're doing in the context of the work that we are doing. Implement just-in-time access for resources as well. So JIT access is like, on a normal day as a cloud engineer, you don't have access to cloud resources, production cloud resources in your team. But let's say you are an on-call engineer or you want to make a particular update to your application, you can request just-in-time access and then an admin grants you that access with certain privileges. So if you request just-in-time access for write operations, an admin grants you that access so now you can perform write operations in production and then maybe after like a certain amount of time your access is removed. So that someone else, you know, or at least another entity is aware that you are requesting for access for a particular thing. Not that everyone just has access and then people can mistakenly do things they're not supposed to do. You know, use stable authorization and authentication platforms as well. Require re-authentication for some actions that you know, if you are performing financial transactions, for example, if you go to an AT&T today or if you're even using your bank app or something and you want to transfer money, even if you've logged in with your password, right before you do, you're required to, right before you make that action, you're required to pass a token or a PIN or a password or something like these things actually help to be sure that, okay, this person is actually the person using this thing and I'm authenticating them twice to be sure that they are the ones and they know what they are about to do before they do it. Cause once you do things like this, nowadays things can be reversed but they take a very long process and sometimes even to an extent, some of these things cannot be reversed, right? Reduce your attack surface. Your attack surface is basically the different areas in your architecture, the different areas in your infrastructure that you can possibly be attacked. So if there's, or rather, the different areas in your infrastructure that can serve as entry points for attacks, yes. So basically, if there is a VM that you are not using, go and delete it. There's no reason why it should be there. If there is like, you know, storage or anything that you're supposed to be using that you haven't used in a long time that you don't need anymore or anything like that, go and delete it. Like make that attack surface because what happens to us as human beings most times is we're not using some certain resources. We don't pay as much attention to them and over time they get outdated and they become more vulnerable and then this can become problematic. Properly handle errors and exceptions for, you know, instrumentation and proper telemetry so that you can track what's going on, monitor your services as well and trigger alerts about issues. For example, apart from issues like, oh, this service is not working, there are things that you can trigger alerts for. For example, people have been deploying code over the past like three weeks but somehow people tend to stop at the staging infrastructure. There's been so many changes made and so many code has been checked in over the last two weeks but nobody has gone all the way to a production deployment. You might want to trigger that as an issue because the day you finally do that you might be deploying changes of like five weeks into production and that might break something and there might be an outage. So you might want to trigger these alerts as well to make people not just know about, you know, the health of your service but also not just know about the latency and speed and all of that but also know about the health of your service and things like that. Encrypt sensitive data in transits and at risk and at rest rather. Implement failsafe measures so that if your application is actually failing it's failing gracefully and consider threat modeling. Threat modeling again is like a thing where you can defend yourself before you actually get to the point where you have issues. And it's just like, you know thinking about your application and thinking about the specific kinds of threats that your application can have and, you know, thinking of a way to combat those threats before they become actual threats. And there's this framework called, you know the stride framework where in stride there are six different kinds of threats. So if spoofing attacks can be a possible threat in the application that you're building that is an attack on like, you know, your authentication and you might want to enforce things like HTTPS connections to make sure that doesn't happen.  And you might want to use user valid SSL or TLS certificate. If repudiation is the threat you might want to think about enabling monitoring and proper instrumentation. If information disclosure is the threat that's a problem with your confidentiality and you might want to encrypt all of your data in transit and at rest again you don't only encrypt data at rest. It's also important to encrypt data when that data is moving from point A to point B. If denial of service is the threat that is an availability problem. And you might want to enable monitoring and proper instrumentation. I use the example of, you know deploying to staging for like five weeks and then you finally go to broad, it breaks. So you might want to make sure that you don't have an availability problem. So enable proper monitoring so that you know when these things are happening and you can combat them quickly. Also things like, oh, this particular storage token is about to expire. This password is about to expire.  If the deviation of privilege is the issue authorization is the problem. And then, you know using security identity management is a way to combat that issue. Other things that you can do use secure libraries obeyed service dependencies to prevent vulnerabilities and avoid had coding secrets in your code. If you want to learn more about how to build secure on how to design and build secure cloud applications you can take a screenshot of this because these are useful links that you can check out. I would also tweet these links so you can check my account in a few hours on Twitter. I should have tweeted them by then. I feel like I am past time but I apologize for that and also thank you for listening to my talk. I hope you learned something. If you have any questions you can ask you can tweet at me and I will respond to your questions. Thank you. Oh yeah, you can also ask me questions in the chat. I didn't realize I'm just seeing that. So yeah, if you have any questions put them in the chat and I will be happy to respond. Thank you. Awesome, that was an interesting session Adora. I think everyone was actually into it. Most of us didn't actually know when it was passed away for AD. We don't have any questions yet but if you have any questions like Kershi mentioned you can tweet at her, Twitter handle is at Adora and Waldo. She's very, very active on Twitter so you can, I'm very sure you get a response when you ask your questions.