Hi, I'm David Cantor with the Law Offices of David Michael Cantor today I'm going to talk about juvenile advisory hearings in Arizona now after a juvenile is arrested There can be an advisory hearing to tell him what his charges are and it can be done the same time as a detention hearing What's a detention hearing? Well, if you go to dmcanner.com You'll see that I talk about that in another blog that I've done Now if a summons has arrived meaning if the juvenile wasn't arrested then this will be the first court appearance the advisory hearing The court will advise the juvenile of the charges, his right to private or court appointed counsel and the judge will set release conditions These can be released conditions to a parent, a relative or a legal guardian There can be our curfew set or home arrest, there can be a probation officer who's assigned who will monitor the juvenile And also there can be an ankle monitor that would be a GPS tracking device Now the probation officer, the PO will first do a background check on the juvenile for the judge to use He will talk about school, job history, drug history, family support, arrest history So the judge is going to have all of that before he makes his determination on release conditions Now to adjudication hearing, what is that? That's a trial In juvenile courts people get adjudicated, they don't get adjudicated guilty, they get adjudicated delinquent or not delinquent Now this adjudication hearing must be set within 45 to 60 days of the advisory hearing A disposition hearing, that would be a sentencing if the juvenile is found delinquent Or he pleads guilty on the spot at the advisory hearing Then the judge will also set it out for the adjudication disposition hearing Or he can actually do it right there if it's a simple misdemeanor So if you or a loved one have been charged in the juvenile court system give us a call It doesn't cost anything to sit down and talk with us but it does take about 30 minutes We'd love to help you out with this and we look forward to hearing from you soon


Hi, everyone. How's everyone doing? Good. So my name's Richard O'Carroll, as I've said. I am the CEO and founder of East London Connect. But before I start, this is my first time, and it's an honor and privilege to be in front of you guys today. I wanted the things I wanted to practice. It's my first time in Alabama, my first time in the South. So I'm going to practice my southern accent, and I want you to tell me whether it passes or not, OK? So, how are y'all doing? Good. No? No? Very British. Very British. OK, OK. So, once again, it's a privilege to be with you guys today, and today what I want to speak to you about is the hidden purpose of leadership. How many people even knew the purpose of leadership was hidden? Anyone? So everyone knew it was hidden? All right, I can't see any hands. You didn't know? Brilliant. So today, that's what we want to talk about. But I think one of the key things I want you guys to know, and I think what's important about future leaders, I see quite a few young leaders, is it? Yeah, I think it's more senior leaders. One of the things is leadership is a great privilege, a great honor. It's something that I think is so important in the military, in the US Air Force. But sometimes, how you define leadership changes over time. So I want to just talk to you briefly. So I'm only going to talk about theory for a few minutes, and then we'll get into more practical things. Sound good? Yeah. So the theory. Why is the purpose of leadership hidden? Who knows? One of my theories is, firstly, at the start of the 19th century, you had Friedrich Taylor. I don't know if you have learned about Friedrich Taylor. And he had this book called Scientific Management. And this book was about how you lead efficiently, how you lead as a team, how you basically make sure that everything's efficient and works almost like a scientific experiment, hence the name. So as I can see, quite a younger generation, my generation as well, in the 80s, there was a different movement about what leadership was about. So leadership was about, there was a book called In Pursuit of Excellence, Tom Peters and Waterman. And that basically said, to be a leader, for you guys to be leaders, all you have to do is be excellent, be pursuit, be in first, be amazing at what you do. And that's one of the ways you can become a great leader. So that was just one idea. And then you had some other ideas from Japan. I don't know if you know, it was called Kazan Leadership. So this is the idea that some of us are like, oh my gosh, to be excellent, that's just, how am I gonna be, to lead excellently is quite a challenge. Would anyone agree? No? Yes, it is. So what this other idea says that Kazan means incremental changes over time.  So I don't know, on your projects, on your assignments, on a deployment, that's not saying we're gonna change a whole deployment, we're gonna change where we're going, but that's saying, can we change the time? Can we change how we work together? That's that kind of idea of Kazan Leadership. And a more exciting one, and a one I think fits in with the lead-ex conference, is this idea of disruptive leadership. Has anyone heard of disruptive leadership? Yep. So it was pioneered by a person called Clayton Christensen. Does anyone know that name? No? Anyone? Yes, one person, good. So, and this is the idea that to be a leader, you have to be completely different. You have to break boundaries, you have to think outside the box, you have to go against the grain. So those are just some definitions of leadership, but that's one of the reasons why the hidden purpose of leadership, why the purpose of leadership is hidden because there's so many different definitions. If there's so many different definitions, how can you understand what the purpose of it is if it always changes over time? Yeah? And then the second thing, especially for us, as we look forward to the next generation and to the future, a second thing is uncertainty. So what it means to be a leader today in 2020 might be different in 10 years time, in 15 years time, and in 50 years time, it might be completely different. So for those two reasons, changing definitions of leadership and also uncertainty, for those two reasons, it's very difficult to know what the purpose of leadership is and that's why it often goes hidden. So that's enough theory for now. So now I wanna give you a practical example from some of the work I do and how we can relate it to the work you do. So as part of my work, I work with young people from London who are predominantly from ethnic minorities or from working class backgrounds and what we do, we try to make them the leaders of the future. We try to make them leaders that they never thought they could be. So this is one of our projects that we did. Can you see it? Yeah, this is one of the projects we did last year and we take them to places like this. So does anyone know what this place is? It looks like a... It looks like a library, yeah, exactly. So am I suggesting that to become a leader and to discover your hidden purpose, you go to a library? Not exactly, because this is not any ordinary library. This is a library where it's the Cambridge Center, so, sorry, I should say, I'm studying at Cambridge University in the UK and this is the Center for African Studies at Cambridge. It's a very unique place in the sense that it has books and materials on every single country in Africa. So it's a collection of materials that you don't really find everywhere else. So it's not just a normal library. And so what we're trying to achieve here is get these young people who are from, originally from maybe Africa or from the Caribbean or just maybe not from the UK. We wanted them to discover their origin, read about people, read about leaders, read about different things in the hope that it inspires them about their past, give them a new sense of their history, but also allows them to change history and be leaders of the future. So that's one of the interesting ideas that we did. So, back to the question. So where is the purpose of leadership hidden? Am I suggesting that after the lyrics, everyone goes back to a library, a local library in Alabama or in a different place and reads about leaders, learns from their histories, what they're good at, what they're bad at and then tries to implement it? Does that sound exciting? No, no. It's very simple, it's very basic but it's more complex than that and more interesting than that. So what I'm suggesting is the hidden purpose of leadership and leadership in general lies beyond the surface. Who knows that phrase that says there's no time like the? Exactly. So in the here and now, it's all about projects, it's all about completing that objective, it's about galvanizing your team, working together, trying to make the next thing happen. However, in that hustle and bustle of life, we never or we don't get a chance to look beyond the surface. What leadership, oops. What leadership do you guys want to embody? Well, for the senior leaders, what leadership are you embodying? What is it rooted in? What leadership is it rooted in? So that's the first clue as to discover where the hidden purpose of leadership is. It's firstly rooted beyond the surface, beyond what you can see but actually, if you start to dig, you might discover the hidden purpose of leadership. So that's just the first clue. And the really exciting thing about speaking here at the Ledex and here in Alabama and Montgomery and at this air base is the history, leadership history, fantastic leadership history is right here in this place. So note, does anyone know who this is? Who these two, who do these two people, ooh. Who these two, ooh, oh gosh. My slides are going a bit crazy. Ooh. Yeah, so does anyone know who these two guys are? Exactly. So there's no prizes for guessing who they were but they were pioneers in the aviation industry. They transformed what leadership looked like but it wasn't just their achievements in aviation, it was they inspired a generation of people to believe in the impossible. So I believe the hidden purpose of leadership, here's the answer, it's to leave a legacy of leadership. They haven't just left tools, ideas, they haven't just left ways to build, ways to build aircrafts, they have inspired generations to believe that they could make a difference. So whilst models and leadership ideas are really, really helpful and useful, one of the key things is to leave a legacy of leadership. So if you're young and if you're slightly more experienced, the question I'm asking today basically is how do you want to be remembered? What leadership do you personify to your teams? And how can you make sure that you come together as teams from whatever unit you are in to galvanize and to make a difference? But there's a caveat. The caveat, the caveat is this, if you, it's not just copying leadership histories, so not just the Wright brothers or local histories of aviation role models, but actually you have to ask yourself the question, what are the seeds of your leadership that you're producing? So what I mean by that is everyone, I believe everyone here are future leaders or currently leaders. Is that true? Yeah, does everyone believe that? Yeah. Good. If you are a current leader or a future leader, the key thing is to be, I think they mentioned it earlier in one of the talks, be authentic. And one of the keys to be an authentic is understanding the seeds of leadership that have been planted in you. And that might be your personality, that might be your values, your beliefs, but it will influence not only what is important to you, but how you lead as a leader and the leadership that you want to, the leadership that you want to give on to the next generation. So, as I almost wrote to a close, I wanna give you another example of one of our projects that we run. So our project that we run is a university mentoring scheme. So we help young people who have not necessarily had the background in going to university. They don't have a parents who have gone to university and we help them by connecting them to someone who is at university. They work together as mentor and mentee and the idea is this leaving a legacy of leadership. How can the older ones who are in their 20s inspire these younger ones who are 14 or 15? So the idea is to make sure that they can be leaders that they never thought they could be. And in essence, these mentors are becoming leaders who leave a legacy. And finally, I wanna talk about a very, very dear project to my heart. And I want to talk to you about this person. You probably don't know who he is. I know who he is. He's a, we worked on a project in Cambridge in the criminal, in the criminology department. Is anyone studying law? No? Okay. But we worked together on a project in the criminology department. And this guy works in prisons and it's a project called Learning Together. You can search it on the internet. It's called Learning Together Cambridge. And what they do is they work with people in prisons to change their lives through education. So it's really, really cool. They did a conference. And I remember going to the conference, it was in a prison and one of the people who spoke, he talked about himself. He talked about how education changed his life. And I spoke to him afterwards and it turned out he'd been convicted, he'd been convicted of quite a serious crime, but you'd never know. And he talked about how education transformed his life. So this guy is one of the, this guy was one of the main organizers of this project. And we were hoping, I don't know if any of you saw Neil Stott's speech earlier in the other building, anyone? Yeah, and he was talking about social innovation. So the idea last year, December, over a course of time was to teach people in prisons about how they can make social change and how social change works. And this was a really, really interesting project. And we were meant to meet in the second week of December, but this young man unfortunately was killed in a attack doing his job, basically working with people in prisons. And one guy who just for every reason decided that he wanted to be violent and basically kill people. So I give this example because I want to speak to the younger generation. I want to speak to you guys because this guy was only 25, sorry, there's only 25. There's lots of clever people at Cambridge. There's lots of people in his college, but he is one of the few who have now been remembered not just for what he did, not just for the work he did, but he was on national news and his legacy lives on. So for you young people, don't think that you can't discover the hidden purpose of leadership. That is to leave a legacy of leadership. At the age of 21, 22, 23, however old or young you are, or young at heart you are, the key thing is to build your skills, your talents and your leadership competencies so that you can leave a legacy of leadership that outlives you. Thank you so much for listening today. Tomorrow I'll be speaking in more detail about how you can do it in a practical level, whatever area you are in your career. But it's been a privilege speaking to you and I look forward to hearing more, meeting you personally later on. Thank you very much.


Yeah, so yeah, my name is Cisco for Lee I work for the document foundation and Yeah, I don't I didn't know how to title this Talk so I just say that's coverage in liberal office. I'm gonna split So few years ago I Decided well like I found that we had Sometimes fixes in liberal office that didn't have a unit test Along with the fix and I found after being involved in QA for some years that Yeah, that we had regressions that we fixed and we even have a Regression fix and then the same regression happening again. So Yeah It the pandemic came and I had a lot of time and I Yeah, I decided okay, I think it's it's time to Learn how to because I already knew how to write some some test but for instance CPP unit test I didn't much Didn't know much about that. So I decided okay It's it's time to to learn it and try to Improve the test coverage of liberal office. So Yeah The problem I found is that well we have After the project was fork, then we had a long list of comics and It was for me difficult to find which which test which Fixes had a fix Sorry, which fixes had a unit test and which was which fixes didn't have any Any coverage or any way to to be tested automatically So then I started to think about that and I thought okay It's hard to For instance, we have some commits in liberal office where the Author of the commit of the patch just gives a Short explanation of the fix, but if there is no bug ID normally when you Comet a patch then you normally if there is a Baxilla ticket related to that you normally mention it in the in the commit message message You say TDF and then the bug ID of the ticket in Baxilla so yeah, I found that for For a third person like me trying to add unit test It was easier to find Those issues in in in Baxilla because normally you have the documents to reproduce the issue You have the steps to reproduce the issue So then I started to think about that and I came with the idea of creating a script to list All these fixes that didn't have Unit test assigned to them so for that Well, I just used the the lock of of Git So I decided okay. I'm gonna start a random date, but yeah after the fork of liberal office So I decided okay. I'm gonna take the log since the beginning of 2012 and then I'm gonna do it in reverse order why in reverse because sometimes we have Comets fixing an issue and after that Sometimes we have the unit test or the test covering the fix and the fix itself in the same commit but sometimes it's not the case and we have Maybe one after the other we have the fix and then we have the unit test or we may have the fix and after two weeks or one month or sometime we have the unit test so the way to to for me to test it was to know if Yeah, there was a unit test or not was to do it in in reverse order and then Then we look for the pattern and well the the script looks for the pattern So normally nowadays we use that the pattern the TDF pattern But in the past we also have this this FDO or bug or LO and then for each Comet we check the Modified files in that commit so LibreOffice Structure in folders it's in a way that Every module we have for instance SWU for writer or SC for calc inside these Folders we have a sub folder called QA That's common pattern in all the folders where all these Unit test or yeah with the well all the tests are in there. So I thought okay I'm gonna look for in every commit for for the modified files and then if there is QA in one of the Pathies of one of the modified files, then I'll assume that there is a Unit test for for for that fix and if not then we can Yeah, we can assume that there is not a unit test for this fix and after that We go to Baxila and we check with the rest API Some parameters like okay, let's check if the bug is Close or fix because sometimes There is already a fix in the in the log in in in in git But maybe the developer will I add the unit test after after that and in this particular case because testing performance Performance issues is kind of difficult. I decided to avoid these Issues that we have in Baxila which have the keyword perform perf with means performance and then once we have the list of of fixes that Doesn't have a unit test with them Then we just the output we use the media markup for that and then we Just put it in or in my case I just put it in this website which I'm going to show you and The reason I say it is good for history. It's a well and let me show you So, yeah, I'm hoping it many times. So basically. Oh Now I don't see it here Yeah, so basically this is the Wiki page that the script creates So, yeah, basically it says the there's the this report is created by this script with which is in in the LibreOffice Core then VIN Slash check missing unit test and then when this report was created the number of comics that you read it there Yeah, so the number of comics that were analyzed since 2012 Then the branching master and the the the last committee that was analyzed. So basically Well, what I do is to group the the different missing unit test by parts of the of the code, but now you we have a list of Missing unit test so and then you have the date where the commit was done the Priority of the of the bug and then you have the description of the bug and also you can have a link to this ticket so then if you want to Try to add the unit test for this. You just come here to Baxila. You read the steps. You have the the files there so, yeah Basically, the idea was to have a place where we can list of the all the missing test that we don't have and try to you know, like shorter the the list because for instance if we go to Yeah, like right there. We have for instance forum do we have 36, but then like we have many It goes really long Yeah, so Just to be clear It's not about all the the code in LibreOffice I'm just trying to pick some parts like SWU and then Sorting them by the path of the of the Files that were modified in the in the fix to group them But they are still missing parts here, which are not because sometimes it's really hard to to have a test for I don't know and and I'm also excluding some parts on purpose because there are some fixes like okay I want to change the label of Dialogue then I don't think that makes sense to test. It's just a label and it can be changed any way any time So yeah back to the presentation You see it now, yeah So Yeah, then now that we have this list Well, if you want to write a test for Specific fix then some ideas then you can check Because you know, you you you have the fix of the issue and then You have the fix of the issue so you know which Files were modified to to to fix that issue then you can check the log for each of these files and see if other fixes Containing a unit test are already in the in the log so you can already know. Okay. I know this this fix In a similar in in the same file containing this unit test then Probably the unit test can be similar. So you already know you have a Starting point then one question to to ask yourself is okay Do I need to write a UI test or CPP unit test? Well, we have other ways to test also in liberal office But right now these are the main ones and for a starter then it's Well, you I test is Basically when you are doing something with the UI then You should write a UI test. The problem is that when it's running Jenkins. It's only Executed on Linux and then we don't have it executed in on Mac or Windows and They are slower than CPP unit test, but then in other cases other than UI then you should normally use a CPP unit test and we already have a bunch of test is test as examples, so then it's a kind of That's not that difficult to to write your first test. Yeah Can you explain in a sentence or to? how tests which Consider the rendering output like what appears on the user on the user's Application screen can be written when it's not, you know Numeric output in the file or something that you can easily compare in code Yeah, so Basically when you let's say open a dialogue in liberal office You are using a Juno command. So with a UI test framework You can just call this a unit command and then it will open the the dialogue and then you can just get the top windows as a As a variable and then you can Examine it like okay. I have this widget like I have a text text box So then you can get that text box and see the properties of of it So that's the way. Let's say you expect to have a text box say in table one So then you just get the properties of this specific widget and you assert that it's a The text in the in the in the widget is table one Does it? Okay, and I can explain you and then in well, I continue in in in many cases. Yeah, so ideally when a test needs to be written then the Yeah in a way to test that it's a Properly implemented Well, the the the fix should be reverted So if you write a test Then it passes and then you revert the fix it should not pass The problem is that we are checking fixes since 2012 and revert in a patch from like five six six years ago. Sometimes it's tricky and difficult but That's the the ideal Solution there Basically, I don't know nothing about test strategies like you explain now, but wouldn't it be wise to start Backwards in creating those unit tests or otherwise is it is it really a good idea to create? Something to test the bug fix which is let's say eight years old and has no regression since then So or can we just Check it and okay, it works and we don't need we don't need to create a test for that Yeah, you're right, and that's a good question and I forgot to mention before in the website here when we have the The list of issues Let's say I updated once every month Then I can come here to the history where the bear is to real see history and then If I see the differences between changes I Can see that here in blue These were fixes added in the last month without a unit test so now, okay because for me, it's easier to revert this fix than eight years old fix so that's kind of the way to try to Catch up. Yeah, exactly. So But anyway, I like it like I decided, okay some fixes from the past are also Easy to revert some of them like minor this is Fixes so I decided, okay, I'm gonna like show all the log But yeah, we could change like let's say We could analyze only the last three years or four years or one year would make sense It would the the list would be shorter, but yeah, that's that's a matter of taste, but yeah, you're right and Yeah, so in some cases the the issues are specific to Specific documents so in that case when we create a test for that The idea the ideal test would have a minimized document because we don't want to well if we start actually when when you create a patch, there is a Maximum size of per file of half a megabyte but yeah, there's the the smaller the document the better and then just If it contains the minimum information inside the document, it's it's better and then once we create a commit Then don't forget to to add the TDF and the then the ID of the of the issue So then the next time The list is updated. It will be gone from the from the list and Yeah, finally I have Some data here. This is about SWU source. So inside SWU source. There are few folders There is one for UI which I excluded here because as I explained Yeah, in in many cases those are cosmetic changes and well, I ignore ignore them. So since 2012 2300 more than 2300 bags were fixed and Yeah, we have a coverage of 61% and yeah, the idea would be to increase it and ideally Both both charts should go parallel. Yeah together. Yeah, exactly Yeah, yeah, so here that the blue one was going like steeper and now kind of the the orange one in the last year is going a bit steeper Then for SC we have a 57% of coverage Yeah, then SC SD sorry, it's around 50% and Then we have other modules which were the coverage. It's a really good 85% and I think Yeah The philosophy here was always to have a unit test and maybe it's because It's easier. I don't know like But it's really good here in this module or in this folder Same for writer filter. We have 92% coverage and Then yeah, like this one. It's Getting better since 2018 but yeah, still 41% and Yeah, those were just some examples. I didn't want to like Choose like all the folders in in in LibreOffice because We could be here for four years, but yeah, those were just some examples. I wanted to share. So, yeah, thank you very much And do you have any question? I don't have a question I wanted just to Give a personal thank you as a developer because having the unit tests that catch up helps us helps my work and helped me to prevent regressions and to and Answering a bit of the previous question well, of course please your use your time wisely, but if you have time to create unit tests for something from 2012 Please do that Any other question? I have one I have a small one you you mentioned that you should add the Kind of hashtag of the of the bug when when you create a unit test. This means that You're supposed to update on Garrett the Sorry on Baxilla No, yes on Baxilla when you only create the unit test you mentioned you you have to Do to hashtag the TDF the number of the bug where? Well, you have to do it in the git commit Yeah, so then once it the test is pushed to master then the Baxilla ticket will get a comment with a notification that there is a A new commit related to The ticket and also for the script the next time is executed then the the buckets gone from the list Thank you, I don't have a question either But I have a comment that we are also using this missing unit test page for mentoring So this is a task for people who have done Some beginner easy hacks and now are doing some medium level easy hacks and Cisco is also Helping as a consultant In that phase Yeah, I wanted to add that last year. I think or two years ago. We had a Google summer of code student helping with this Will to reduce this list, but unfortunately Disappeared in the middle of the project so but yeah There is what the elmarie say that it helps newcomers to Get involved as well with more Yeah, interesting task and thank you. Yeah


So it has USB 3, 2 USB 3 and HDMI and SD card slot. How, how, what's the thickness? Okay, it's 16 millimeters. 16 millimeter? Yes. How big is battery in there? Okay, the battery is, you can use this for about six hours. Six hour battery life? Yeah. This is all the specs here, right? Yes. And you can open it up again. So it's 1080p, 4GB with the, so the, when you say 340, is 128GB SSD, yes. And there's 4GB RAM included, right? Yes, of course. And if you want 8GB RAM, how much more? Okay, if you want, maybe the processor will be Intel, Intel Core M5Y71. And memory with 8GB and SSD with 512GB, the price would be, with a moment, the 5 price is about 500. 500. So there's all these different configurations here. And you already have mass production? Yes, of course. For this production, we have imported it to the Korea market. This is very cool. And how many laptops you make every year in the factory? Okay, in the factory, in this one, in Shenzhen, we make about 3 million laptops. 3 million laptops every year. So that's 10K every day, no? Yes. That's a lot, or maybe more, I don't know. It's a lot. So let's go over here. We can check this one out also. So what is this model? OK. For this model, it's a slim book, too. But it is plastic cover. And it will be cheaper than this one. It's a little bit thicker. Yes, a little thicker. And there's also USB 3 and HDMI. What is this? Ethernet. RJ, RJ45, USB over here also, SD card slot. All right. So what's the price for this one? For this one, if you want Intel i3 CPU and 8GB memory and, of course, 1GB HDD, no SSD, the price would be $360. And also the MOQ is $500. All right. So do you have customers in every country in the world, in Europe and USA? Yes, of course. For now, we have customers in France and South America, in Korea, in Japan, and in Asia, and also in Africa. Africa also? Yes. So people just contact you? Yes. And they can visit the factory? Yes, if our customer want to visit our factory, we're very pleased and welcome. But you don't make Chromebook yet? No, not for now. No time? Because our engineers are focused on the Windows laptops for now. And we are making new products like mini-PC here. We don't have the product here. All you want is this and tablet.  Yes. You never use other CPU? For now, we don't use other CPUs, only Intel. All right. And your design house is at the factory? Yes, our design house and Audi Center are also in Shenzhen. How many people at the design house? OK, in our factory in Shenzhen, there are about 3,000 employees.


Good morning everyone. I am Dr. Rupali Bansalpareek, fellow under Dr. Hemangini Thakkarman at KAM Hospital and my topic is complex anomalies of the body wall. Are they that complex after all? My aim is to explain by examples the definition and classification of complex body wall anomalies which is not a very well understood topic. I will be presenting four rare cases of body stock anomalies. My first case is that of a 23-year-old primary gravita who came for a routine scan at 17 weeks. The scan showed a closed neural tube defect arising from the lumbo-sacral spine, sacral agenesis and a cyst within cyst appearance that is a myelocystal cell. Liver gallbladder and few bowel loops were seen outside in a herniated sac. One kidney was not seen and one was hydronephrotic with paper thinning of its parankaima. Urinary bladder could not be identified, severe oligohydraminous was seen, bilateral club feet were also seen. This in a loop shows a very short umbilical cord, actually almost no cord was seen at all. On termination of pregnancy, the abortus showed the closed neural tube defect, the anterior abdominal wall defect and the herniated contents which included liver and bowel loops. Bilateral club feet were also seen, anal swinger was not seen, also no external genitalia was seen except for two small nubbin structures on either side. This is the edge of placenta which was seen directly flushed with the fetus with no evidence of any visible umbilical cord. Abortus ultrasound confirmed the findings of unilateral renal agenesis and controlateral hydronephrotic kidney and a myelocystocene. Final diagnosis was given as body stock anomaly type 4 along with exostrophy of cloaca. My second case is that of a 22 year old primie who came for an NTNB scan. The scan showed an 11 weeks 4 days old fetus lying continuously in the star gazing position. The spine appeared short in length, the cervical part of the spine appeared absent or deficient. There was an occipital encephalosil with herniation of posterior fossa structures, the subcutaneous tissue was thickened posteriorly. This in a loop shows the encephalosil along with the cystic hygroma. This in a loop shows the fetus stuck anteriorly to the placenta resulting in inadequate visualisation of the thoracobdominal area. Also we can see the scoliothic spine. We gave the final diagnosis as Indian kefali abortus and the parents went ahead with an MTP. Post delivery, our findings of a short spine with deficient cervical spine were confirmed. Myeloscisis was also seen at the cervical level. Abortus also showed a short umbilical cord and thoracobdomino scises, a finding that we had missed antinatally. Abortus radiograph confirmed our findings. Final diagnosis after seeing the abortus was then changed to body stock anomaly type 6. The third case is that of a 29 year old G2P1L1 who came with 16 weeks of amenorrhea for her malphoscan. A large defect with herniation of bowel loops and entrolitis was seen, herniation of liver and gallbladder, bilateral club feet, kyphoscoleotic deformity of the spine with a closed neural tube defect, terminal visceral organs appeared unformed likely suggestive of inelotrisia or cloacal malformation, genital organs and bilateral kidneys could not be appreciated, severe oligohydraminus was noted. This in a loop shows the fetus stuck anteriorly to the placenta, kyphoscoleosis, neural tube defect, abdomino scises and that's the club foot with an extremely short cut seen in the image above.  On ultrasound of the abortus severe kyphoscoleosis and closed neural tube defect were confirmed. The large umfalocele showed herniation of liver, spleen, gallbladder, bowel loops as well as urinary bladder, while intra-abdominal contents included normal bilateral kidneys. Final diagnosis was given as body shock anomaly type 4, we didn't think it was a case of cloacal exostrophy as both kidneys were intra-abdominal and normal. Case 4 was one which honestly took us all by complete surprise. A 30-year-old G2A1 came for her first scan at 19 weeks of amenorrhea, kyphoscoleosis with closed neural tube defect was seen, a large abdominal wall defect with bowel loops and free fluid within the sac was seen, severe oligohydraminos, a midline inter hemispheric cyst which we reported as corpus callosum dysgenesis, echogenic bilateral kidneys and only one foot was seen which showed clubfoot. Hypotelidism was also noted, however the orientation of the pharx versus the orientation of the face was not corresponding. Nevertheless, in view of neural tube defect, abdominal wall defect, one clubfoot and likely some craniofacial anomaly diagnosis of body shock anomaly was given. Post delivery we were surprised that this was a case of con joint twins that is craniotoracob domino pegas along with body shock anomaly. Here we can see the short cord, omfalocelan both, no anal complex in either along with unformed nexonal genitalia, bilateral club feet and both the fetus. This in a loop shows the abotus and here we can see the full body radiograph of the same. Abotus ultrasonic drivel kyphus calliosis and a closed neural tube defect in both the twins. There were two livers, two gallbladders both intraabdominal, while bowel loops in both twins had herniated out. We could see a total of three lungs along with a single heart. This in a loop shows the first twin cerebellum, cerebel peduncle, thalamine, common third ventricle and the second twins thalamine, cerebel peduncle and cerebellum. Here we can see the lateral ventricles of both the twins and here we can see the cerebellum of both the twins. There were four ecogenic kidneys with no obvious CMD which probably explained the severe oligo hydrimenose. Final diagnosis was given as body stock anomaly type 4 in a case of con joint twins. Body stock anomaly includes three obligatory components that is a body wall anomaly, abdominals kaisis or thoracobdominos kaisis, a spinal anomaly and an umbilical cord anomaly and two accessory components that is a structural or non-structural limb defect and anal genital or urinary defect. Lim body wall complex has two obligatory components, limb and body wall. A third component may or may not be same that is craniofacial anomalies. Actually limb body wall can just be classified as a subset of body stock anomalies but since craniofacial anomalies are additional some people consider it a different entity. OEIS complex on the other hand has all the features of BSA except short chord hence some consider it a subset. However as an obligatory criteria of BSA is not met it should not be considered in the same spectrum. Pathogenesis includes three theories the vascular disruption, the early amniol rupture and the disturbance in embryonic folding. Incidents of BSA anomalies is between 1 per 14,000 to 1 per 31,000. They are not associated with chromosomal anomalies, have no specific gender predilection, no increased risk of recurrence in X pregnancy and are invariably fatal. So I ask again complex anomalies of the body wall are they that complex after all? No they are not. As long as you have checked for all the obligatory and accessory criteria and the classification is in its place this seemingly complicated topic can also be made easy. Another thing to remember is that this is a first trimester or early second trimester diagnosis as an MTP is absolutely essential in these cases. These are my references. Thank you.


Okay, good afternoon. My name is Michael and we'll talk about security and trust today. Just a bit about the plan of this presentation. So, first of all, we'll talk, it was on. It's Okay. Do you hear me now? Fantastic. So, the plan of today's presentation will talk about the HS2 security team, our plans and what we plan to do through this year or at least to the end of the year and going forward. Then we will ask our colleague from South Africa, Potlaki Malawi, to share the experience from their organization, how they deal with security issues at scale. And then, depending on the remaining time, we will either have a Q&A session, either we will go through kind of a checklist or a list of the recommendations for security engineers, security officers and you're also welcome to ask questions in the community of practice. The link to the community of practice topic is attached to the invitation to this meeting and it will be also shared by Zoom for remote participants. To begin with, let's talk about the major risks in cybersecurity. If you look at any recent report 2021-2022, the list is pretty the same. And many of these things are the same as they've been many years ago with some clear candidates to be favorites and just let's go one by one. Hardware fellows been with us for many, many years since the very first time when we started using computer equipment. Yes, the equipment becomes more and more reliable, but at the same point of time, we always hear reports about network outages. We hear about broken hard disks. We have various problems with the end user devices. So everything that impacts availability is still an agenda. Then we have a pretty new actor, ransomware and crypto miners joined together although they are different category. This is the worst insurable security risk ever. So if you talk to any insurance company that offers cyber insurance, they will probably tell that their price for cyber insurance is ridiculously high and most of them will refuse to make any kind of assessment even if you have quite a good security profile. Even if you handle a lot of sensitive data and you don't have an information security management system in place, there will be quite hard to get a good coverage. Then another thing that is gradually developing through the last years is class of attacks related to digital supply chain. As you know, modern computer software has a lot of components. Third party libraries various online dependencies and attacking the dependency stack, attacking the providers of the software components, libraries, modules and so on is like one of the most favorite attack targets. So this is what we are facing now more and more. COVID-19 times brought a lot of remote work and in addition to the secured perimeters, the organizations now face the need to protect users and their devices when they work remotely in the field and so on. So it's quite a big change that nobody could expect and even most of the companies and organizations deal with it quite efficiently. There are a lot of risks associated to that and probably it is the weakest point nowadays. And then in addition to all these four, the lack of cybersecurity talents, the lack of staffing issues is the concluding risk that we have. If you look for the cybersecurity experts demand in the last years, it's growing and the global amount of specialists that are yet to be hired is roughly a couple of millions. So it's a huge gap that is not possible to fix immediately. So it takes years to get an indication or to train necessary skills for that. So there are some other risks that are important, but these are probably the most concerning and we are pretty aware of that. And that's why we list them just as a reminder of what potentially can go wrong and what we should pay attention to. When we started the security team at DHS2, we defined three or three plus one core errors we would like to focus our attention on. So we have three core domains, which is the DHS2 application as a software product itself. Then we have it's in the center. Then we have the DHS2 implementation support program where we support implementers all over the world to make, to deploy and maintain systems. And then we have our own infrastructure within his center where we build and test the application and where we maintain our own operations. And to cover all this, we thought that it's good to add a kind of the overarching level, which is called the security compliance framework, which we used as an interaction layer or communication layer between all these three components and any other external dependencies. For example, compliance standards, any kind of methodologies, rules, practices, so how our products and processes interact and parade in the wider environment. So this is kind of the model that we have. We discussed the priorities for all these three core domains and the current internal working assumption is that we focus on the implementation first. So we need to help the running systems and we need to help to secure running systems. Then we focus on the application and changes and problems within the application. So this is what helps us to make the systems better and makes them the new features and the product itself more secure. And then we focus on the support of the internal infrastructure, which is relatively small compared to the scale of the application itself and to the whole program in general. And as I said, we are aligning all the efforts according to this compliance framework. We, just as a formal part, we have some objectives and we decided that we will focus on security risks, global security risks that we just discussed in the first slide and aligned with the industry standards because in the open world and open and interconnected world, it is the most important to be compliant and to be compatible with other activities and everything that happens around. For the program itself, we focus on capacity building, which addresses the risk of lack of the cybersecurity talent. And for us, as for the first iteration of the like dedicated security program, it is important to focus on the feedback. So that's why during every session, we ask for the feedback, we ask to provide the opinions on how security works in your implementations, how security does not work in your implementations and what can and should be improved. So establishing this kind of channel is maintained by David and me and we are very, very open to all kinds of comments. And looking into implementation issues is a core thing for understanding the understanding the risk better and having like a better response to the security issues. Then there is a security quality assurance product, a process, sorry, which we would like to make as automated and as verifiable as possible to ensure that whatever we build can be easily tested and confirmed from the security perspective. And most of the compliance frameworks that we'd like to adhere to, they are literally requiring that. And if we look at the product itself, we'd like to become secure in default and audit will at scale so that every installation that happens would be sufficiently protected in the default configuration. And the users will be able to audit the potential security issues easily. A special note about compliance. So compliance requirements as we discussed for the data governance session, they become more and more like visible and more and more relevant in the digitalized world. So we are building a matrix of other matrix compliance for privacy compliance for different industry compliance and for different governance requirements. So at least we thought about implementing these three different types of technical methodology and privacy compliance domains. And this list will be expanded as we go. Also as a part of the connection to the open world, we are working at the CD program enrollment. So we'd like to have better control on the issues of security vulnerabilities and communicate actively with the vendors. Also, we would like to give a kind of a good example for other players in the industry to sign up to CNA program and CD program and to have a kind of coordinated response to security vulnerabilities. So it gives more control and more visibility in how vulnerabilities in the product are tracked and how they can be maintained and how we control disclosure. Then we have a participation in the OpenJ working group on security and privacy, whereas I'm going to work to implement privacy requirements and better security guidelines. And we have an unofficial bug bounty program and we are rolling out a whole thing for the vulnerabilities, which is working progress. As a side note, most of these things that we discussed, these are plans for this year. Some elements of all these are already in place. Some of them will be rolled out to the next months. Some of them have more long-term plans and they, of course, are subject to having better or more precise priorities in the next quarters. Another important thing that I've mentioned is capacity building. So we are working on the training materials and we would like to have a special communication with the implementers teams or what kind of training, what kind of educational support is needed. So we have different internal plans on what to tell and what to teach and what to deliver. At the same point of time, it can be very, very counter dependent and organization to organization dependent. So that's why we really appreciate any kind of thing back on what you'd like to learn from us. These topics already discussed multiple times and just to emphasize, we are working on implementation checklist and audit checklist, something that will help the implementers to install the secure configuration and be able to audit and verify the security of their configurations. The challenge is, of course, that we have to run the software on the multiple different platforms of different stages of legacy, new systems, legacy systems and so on. So it means that we will also call for testing, we will call for verification of this checklist before we officially found them. So we will reach out to the participating members of our security community to test different parts of this checklist to ensure that they are metal proof and we can use them in production and actually recommend as a default security secure configuration method. And in addition to that, another stream is a research errors. We will be initiating and rolling out a research program on different errors of like high concern. Generally, if you look, for example, on the research about cyber attacks in the health area, there is not that much like dedicated research. There are different studies which actually don't tell a lot about health specific problems, but they are focusing on the general industry problems like technology or technology problems rather than on specific cyber protection in healthcare. And also another like emerging topic that we discussed already internally is about digital identities and handling of personal data, which requires more and more attention. This is a short summary of what we were working on. And before, let's say we move to the next like more practical session, I would like to ask my colleague Patlake to continue with sharing their experience from South Africa on how they do security. Hello. Afternoon, can everybody hear me? Good, good. My name is Putlake Mulloy. It's a suit to name. It means hasty. So I'm going to do a sprint through my presentation. Thanks, Michael. So we've drafted this presentation between the three of us, myself as senior manager at HISP for systems infrastructure, and it was a collaborative effort with my cybersecurity officer, Tatum Afouk and his deputy, Rene Russo. Just as a disclaimer, HISP South Africa by no means experts in cybersecurity, but I just want to take you through some of the things we've done on our sort of compliance journey on screen. So the thing with cybersecurity is I think the underlying issue is you don't have much cybersecurity if you don't have physical security or if you don't at least address physical security first.  So what we did is we went and rented space at a private data center provider in South Africa and in that environment we, you know, it is their core business to sort of provide us the right levels of physical security. So the heating ventilation and air conditioning systems, lock doors, access control with biometrics. So that allows us at least to sort of take the burden of our hands so that we can continue with the business of HMIS for our national department of health. And so that at least helped us to address the issue of physical security. What we then did was we, at the beginning of 2021, we completed a restructuring process within the organization where for the first time in South Africa's history we officially appointed a cybersecurity officer, Mr. Tatumafouk. And then what we noticed was as time went to address the human or to address the risk of cybersecurity fatigue, you know, if you have one person sort of looking after all of your cybersecurity infrastructure, there comes a time when they might, no problem. So after a while it just becomes a bit routine and they might start getting a bit fatigued from looking after the threats from every other angle. So towards the end of last year we placed the second deputy, Mr. Rene Russo. Once that was done we then addressed what I like to believe is the foundation for any organization is governance. So making sure that we've got our cybersecurity policy in place and making sure that we've got the associated SOP, an incident response plan, which basically details how to react, where to react, internal and external communication in the event of an incident. Both of which are sort of NIST aligned and we try and align all of our processes with the CIS controls framework. It is a very interesting topic we had with David yesterday. A lot of organizations are ISO 27001 certified. I hope you can still hear me. I'm sorry, I'm going to fiddle with the mic a little bit. A lot of organizations are ISO 27001 certified, but are they indeed aligned? It's no use. If you're certified it's a box ticking exercise. You've got the certification. Sure, it looks great. You look amazing on paper, but are your processes really aligned? So we are not yet certified, but a lot of our processes are aligned, at least with that framework and they're auditable. So we do use appropriate levels of encryption, address and in transit. We have initiated security awareness and training across the organization, which is also auditable. So we do have sort of reporting where we can track our staff throughout the process from when we initially did security awareness and training and we review that sort of annually to make sure that we're sort of moving ahead and we're improving on our security stance. And as part of that, as part of the alignment we've got, as part of alignment and change management and onboarding, what we do in the security awareness and training is do a lot of education around password managers.  So for my infrastructure team, we've got key pass and we went specifically with key pass for protecting our infrastructure because at least the database file, we're able to hold and keep that ourselves in our infrastructure as opposed to relying on somebody else's vault in the cloud. If that vault is broken into, you know, keys to Fort Knox. So as part of change management, basically not IT service management, change management, but sort of organizational change. We first had to constantize our staff and our independent contractors. So it's everything I've just mentioned now. So the use of password managers, password length and complexity, encryption and, you know, just making sure that any sensitive documentation is password protected and that we have the right sort of levels of access that nobody has admin access where they otherwise shouldn't. And then just constantizing our service providers and our customers on the, you know, the risks of the personally identifiable information that we share, making sure that we've got all of our operator agreements in place. So South Africa's equivalent of GDPR is Papilla. And from his South Africa's perspective, where we manage information on behalf of National Department of Health, we're seen as the operators of their data. So we've had to make sure that we've got all of our agreements in place. Yeah. So moving right along, I'm going to work this slide from the bottom upwards. Once we'd placed our cybersecurity staff, something Michael mentioned earlier was lack of talent. So although we'd had before 2021, although we'd had some of our systems engineer sort of in an acting role on cybersecurity, once we'd officially placed them, the work is now underway to make sure that we upskill them so that we've got so that we maintain the talent to make sure that, you know, just because a guy has been acting and winging it that, you know, the education sort of bolsters and allows us the more informed approach towards response. So getting the formal qualifications and the certifications as well. So anything in like a CEH or OCSP certification, those are the kind of qualifications we're looking for for my guys. And then, yeah, tricky one is the ransomware insurance. I think that one, that one is a definite one that we need to get my boss and indeed Elmerie in the crowd today. Elmerie mentioned it on Monday to say with cybersecurity, with breaches, it's never an issue of if you get broken into it. It's an issue of when you're broken into and are you sufficiently prepared. So one of the things we're looking into right now is one of the things we're sourcing is ransomware insurance to make sure that when we're broken into that we're at least able to sort of prepare to cover that risk. And then I'm going to, I want to speak a little bit on the tools that we've used. We've got, we've deployed Monit currently for monitoring our operating system processes. So this helps us, I think on it's not exactly an intrusion prevention application. It's more like the policeman in your operating system. So we are indeed looking for any sort of suggestions on a decent intrusion prevention application. But with Monit, it's an issue of once there's sort of suspicious activity running on your operating system environment, it acts as a policeman and it's able to sort of isolate the threat and then notify sysadmins that there's been an issue, either your sysadmins or your SOs. And then for intrusion prevention, I don't think I, oh yes, it's, it's a, I added an underreacting agent, but it's actually an intrusion prevention technology CrowdSec. In the past we'd been using fail to ban, but for our production environment we're rolling out CrowdSec. Both of them do exactly the same thing. So they'll look at number of failed login attempts.  So it allows you to specify sort of metrics, number of failed logins, and then it just blocks that IP or it adds it onto a blacklist. And yeah, so the other thing is we've created a few more, you know, in our, in our generation six of servers, we're trying to add a little bit of complexity in how we build the system. In generation five, we'd rented about 25 physical machines at the data center, and each of them had a public IP allocated to it. So each of those machines were reachable from anywhere in the world. Of course, there was fail to ban on them. So any number of failed attempts would easily be blocked, but the problem is they're still public facing. So in generation six, what we've done is to reduce, yeah, I know. It shocked me as well when I understood what we were doing. So but one thing, what we've tried to do in generation six is we've procured 18 servers, and of the 18, I think about three or four are only really publicly accessible. And so once we slap CrowdSec onto there and do some geofencing with our broadband provider, that should allow us at least to sort of counter any sort of risk from anywhere outside of South Africa. And then the rest of the private systems, we've sort of like our monitoring agent, our Zabic solution, and most of our internal systems we've placed behind a sort of virtual private network. So they're not publicly accessible. Yeah, so then came the daunting task of securing our users. This is actually not so much daunting, but it is a bit tricky. I use the word daunting because cybersecurity, I think it has three pillars, people, processes and technology. The two you can sort of do something about adequately. And once you put something in place, it's usually just familiarizing yourself with any new changes and then, you know, just sort of applying those applying adequate changes. With users, it gets a little bit tricky. Human beings, we tend to fully understand the process and then over time deviate from the process because it's in our best interest. Because, you know, every time I have to click yes to apply admin access, it's a bit of a problem. And why don't I just drop the UAC in Windows so that, you know, that prompt stops coming up. Then, you know, I don't have to, oh, I can just speak to my network admin, please give me admin access, right? Then I can install my own apps on my device. So that's why I say it's a little bit daunting. So with human beings, you constantly have to have an adequate sort of review mechanism in place. And so one of the first things that we did was to get, was to onboard a third party provider of cybersecurity awareness and training, no before. I think they're based in Europe. And so what they do is some of the content that they cover is password management, MFA, and I think social media use. So there's quite a long list of content that they cover. And it's very informative, very educational, and it's light. So you can watch a video for about five minutes and then do a quick test of about five or 10 questions.  So it's very easy for us to say, look, you failed this re-enroll. And the notifications go out, the systems, sorry, to the cybersecurity officer and our capacity building teams. So if somebody's consistently failing a test, we're able to see, we're able to monitor them and we're able to just coach them until, until they get to, you know, an adequate level of stuff, cybersecurity. And then we're using a few other tools for enterprise asset and software management. We've got an application called Komodo that allows us endpoint security. So we're able to install, we're able to sort of manage devices remotely. HIST South Africa has been working remotely before COVID. So about 80% of our staff are working remotely before COVID. And once COVID struck, I think all essential services, everybody that was coming into the office then started working from home. So it wasn't a major shift for us. But the sort of, the emphasis was then on how do we remotely track our assets. Something that we had been doing before, but before COVID it was easy. Most staff were able to travel were very much mobile. So, you know, our technical support staff were able to just catch up with them at the office when they visited time and time again. But once COVID struck, everybody was mostly at home. So we really needed something where we could track assets and make sure that staff aren't, you know, plugging in, buggy, flash drives with viruses or malware on them. And Komodo allows us at least to track each and every sort of staff laptop. And it allows us to remotely sort of push updates, push operating system updates, security updates, and antivirus updates down to the machines. So that way at least we're able to sort of ensure that, you know, our assets are mostly secure. I imagine this is something we're all sort of used to. And then on our DHIs to front, something that we're looking at is deploying multi-factor authentication. We've already initiated that in-house on our Microsoft platform. So, for exchange or teams or SharePoint to any of that, you know, we've had to onboard staff and make sure that everybody has an authenticator app. We're fortunate in that most hispians or all hispians have a smartphone, so they're able to sort of scan the QR code and get an authentication code to their phone. So that was largely successful in-house. And something that we're trying to get rolled out now is across all our DHIs to instances. So it is taking a little bit of time because we're managing about plus or minus 150 DHIs to installations on behalf of the national provincial departments of health in South Africa and other ministries of health across the continent. So, you know, in some countries, smartphone units hasn't, it's mixed. It's people that still use sort of legacy phones. So they're not going to be able to scan a QR code. So one thing we'd really like sort of some support from Oslo or some pointers or some help with is how can we have multiple or multi-factor authentication and not just using an authenticator app. Moving right along. So I'm going to deviate a little bit. I want to speak a little bit on infrastructure. The slide on screen is a representation of the architecture for one of our flagship projects, the human resources information system. And basically everything between these blocks here is our in-house infrastructure. So how this works is we're building a data warehouse for the ministry of health in South Africa to maintain visibility over all of the healthcare workers. Am I correct Omari? And what we're trying to do is what Omari's team is doing is trying to predict the movement patterns of all the stuff within the ministry of health. So using things like SuperSet and MLflow, which are machine learning applications, we're trying to sort of predict when stuff are most likely to resign or exit the public service and the ages of the times that they're most likely to onboard into the public service. Please correct me if I'm wrong. I hope I'm okay. Thank you. And so you would understand, you would anticipate that we're going to need high performance computing for that. And so with the sixth generation of servers that we're trying to onboard onto now, the migration is actually starting this Friday. So unfortunately I'll be traveling, but I'm going to be touching base of my team on Saturday afternoon just to see how that went. Touch wood. And so you would anticipate that a lot of kick you will be required from your server hardware. So what we're trying to do now is or what we were doing in generation five is we were using hardware, we were renting from the data center provider, all the hardware, so all the servers, the switches and rack space and sort of IP addressing and networking devices. What we're doing now with generation six is we're just going to the private data center provider. We're saying just give us space in your facility. We've gone out on tender and we've procured our kit and we're just packing the kit inside of the DC. And then we're sort of doing an entire build. We're moving away from individual hypervisors. We started in generation four with VMware. Generation five, we moved to Zen, the free version. And now we're moving to free and open source open stack. What open stack now allows us is one horizon dashboard to view your entire infrastructure. The other major I think benefit with open stack where it beats the other two is or at least where it beats Zen is live migration. So with live migration, if I need to do maintenance on my underlying hardware, it's easy for me to just migrate my instance to one of the other physical machines or one of the other physical environments within the stack, complete my maintenance and migrate back. That's one thing we couldn't do with I think versions 7.4 upwards of Zen. What we could do in 7.2 and maybe 7.3. We moved from VMware because of, you know, ultimately we're building these systems for national departments of health. And I think the entire DHIs to or indeed the free and open source community is quite big. And everybody since Monday, since I got here, everybody has been talking about moving away from proprietary systems, right? So because you want to make the experience as cost effective as possible for your customer who is essentially any ministry of health within for wherever you're working. So what we didn't want to do is to slap the ministry with, well, the application is free, but it's going to cost you a million a year for this hypervisor. Firstly, that's not their core business. So the minute I say that to my biggest client, Mr. Mule Trabuco, that the hypervisor is going to cost you 100,000 grand a year.  So to allow Mr. Trabuco and the National Department of Health to carry on with their core business, you know, we try and from operating system all the way up to the application level free and open source as far as possible. That makes it easier for the internal IT staff at the ministry to take over the system and run with it themselves. Coming back to this high performance infrastructure, the next slide will probably give us a little bit more detail now. But before I go into it, you will imagine that we're going to get a ton of data from different data sources. So we've got a nursing council in South Africa which manages all of the nursing practitioners in the country. And then we've got a health professions council of South Africa, which basically makes sure that every health professional practicing in the country is registered and is legally allowed to practice. Please correct me if I'm wrong. I have to say for myself specifically, I focus a lot on infrastructure and that is my entire background for the last 15 years. So on the health side, I'm a little bit rusty, so I keep referring to my colleague up there. But I think we're doing okay. Thank you. So we have a ton of basically we have a ton of primary data coming into the application and then we run an extraction and transformation process and we reload the data and then we push it into our dimensional data store. And then that pushes it into a machine learning workflow and a DHS to instant instance. And then we're able through the different web portals to sort of visualize that data. So there is a ton of processing that is required on this end on this side, probably sure, but not as much as on the back end. And so this is why we have to this is why we've chosen to move into what we call stack six or generation six of our hardware. So with the new kit that we've procured allows us up to four times the sort of processing capability. And in the past, we had a one gigabit backlink between all the servers. This one allows we've now got a 25 gigabit per second fiber link between every physical component. So for your back end processing, you know, it happens like that on the fly.  And if they don't, it'll probably be either a pipkak era. So the problems either between the keyboard and the chair, or it is the customer's own sort of data line that connects to these systems. But let me just give you a we sort of representation on our what we call what I am conceptualizing as a high performance computing infrastructure. So we've got we've got we've got our incoming. So the red is our public link. And the green is our 25 gigabit per second fiber link. And that runs on the back end across all of our physical servers.  We've got two mass controllers. And that basically allows us to provision our physical servers a lot quicker. When the past provisioning a physical machine, it would take us maybe four hours to order it at the data center. And we had a custom spec that they gave us. So we had a custom spec that we gave them. And that's why it would take four hours to provision the machine. From that four hours, it would take us two hours to install Zen to upload an ISO install Zen, you know, but essentially, a day is lost just provisioning a physical machine. Now with Mars, this literally takes minutes. I'm sure some of you in the room now are incredibly familiar David familiar with Mars metal as a service. And then we deployed our open stack using three node controllers and the rest of the servers and 12 control 12 compute nodes. And so basically, this is where on the compute nodes, this is where our entire infrastructure or our DHS two instances are going to live, including the ML machine learning instances and the AI instances that we saw previously. That was his journey to his South African journey to cybersecurity. And like I said, we're always happy to get suggestions where by no means experts, this is our first rodeo. Thank you very much. Thank you. Okay. And we have one more remaining part of the day session. So we've just heard a story about how security is implemented at scale. And the typical question was, we should we start with or what would be our plan for security? And what we will briefly talk about now it's 10 steps in from our perspective in the grouped by priority starting from first to 10, growing the complexity, the maturity level of what can be used as a kind of an initial roadmap for building security in your organization. We will go, we have not that much time left, we'll go through it quite fast, all the materials will be available later. And we also expect some feedback, we can have a conversation later, we can ask the questions in the community practice. So we'll go through the slides and you probably will see how we suggest implement security. So the first natural step is to define roles and responsibilities. And this is what I'd like you just talked about, that is important to have people who are on the ground, who are aware about security issues, who are willing to learn about security, and who treat it as a part of their responsibility. Overall, on the organization level, there should be someone who is responsible for that as well. But at least it is important to have someone who can be a content who can be trusted internal peer for security matters. The second one is having an inventory of assets, because if we don't have an inventory, we don't know what to protect, as simple as that. And the bigger amount of stuff left outside of the known inventory, the bigger risk we have with something that we don't know. In fact, security is maintaining, or part of the security process is maintaining the things that we know, and reducing the part of the issues that we are not aware about. Something that is out of our sight, something that is out of our control. This is pretty easy. The third one is backup to data. So we had multiple cases of our lack of backups, failed backups, and so on. And once you have identified the assets, you can understand what to backup, what should be the schedule, and who should be responsible for that. The fourth, after you have made all the precautions, look at the authentication policy. Authentication is one of the strongest protection, but also it's somehow a weakest link, because it is super easy to apply brute forcing, apply different solutions and techniques to bypass authentication. So any security attacks, the cheapest attack will start with attacking the authentication. It is as simple as that. Number five is review access and permissions. So we start with authentication, and it's about not letting people in. But once we have authorized users, or once we have an attacker who has just obtained access, we need to ensure that the permissions assigned within the system, within our secured perimeter, are corresponding the roles and responsibilities and that our users don't have too many permissions and that the permissions don't match their job profile or roles. Number six is review network configuration. As but like I said, you had a bigger network perimeter and every server could be a target for attack. If you know your network perimeter, if you have asset inventory, you can think about protecting it, taking care of different protocols, taking care of security on different levels of network and every connected device, again, it adds a potential attack vector. So it's important to review the network perimeter and check the security configuration to network. Number seven is typically one of the most complicated keep software updated and every software update process is a part of change management, typically, and there are both risks and some benefits that come with that. We talked about supply chain risks and this is a kind of emerging risk. The more software we install, the more dependencies it may have and the legacy software can have much more risks than the new one and the issues that are discovered in the supply chain, the components that are used by software, they affect the target product that you install as well. So this is an increasing risk and even more severe than in the past years. Number eight is collect event logs. In the same way as we talked about network, about asset inventory, sorry, it is important to collect event logs. Once you know the inventory of your assets, once you know what to protect, it is important to get the feedback from the systems to have a live response from your environment about what's going wrong. If you don't do that, you're literally blind and it is important to check and test the security attacks using your event log infrastructure. Number nine is ask for a second opinion. Security is a very complicated topic and even if you have best-in-class professionals in your team, it is always wise to talk to the peers from the community, from the organizations and our current interconnected world where public knowledge on security is literally easily available. It is quite easy to ask experts, to ask for peer opinion, to ask for independent security review, bug bounty program, community advice, dedicated consultants and so on. And there is quite a lot of knowledge that can be obtained, it's just to check that they are following the right path. And number 10 is keep your profile in top shape. Every day we learn about new vulnerabilities, new issues, new attack vectors, and whatever we learned yesterday may be not relevant today. The world is developing too fast, especially for those who don't keep up. So that's why it is extremely important to read news, to follow the vulnerability trends, get regular security trainings and also talk to your colleagues and peers from the environment. We have a couple of minutes left for questions. If you have, please ask. So the question from the gentleman was what do we do about disaster recovery? Correct. So at the moment, we have all our servers, our production environment, hosted in Johannesburg. And so what we do is we've provisioned a dedicated server in a separate facility in Joburg for our, what we call onsite backups, although they're not exactly onsite at the same facility, but we have, we replicate that to a separate facility in Cape Town. And then what we'll do is, because we've now done an outright purchase of all this hardware, it's going to take us forever in the event of an extension level event in Johannesburg, to get those servers back is going to be some time. We're going to have to do an insurance claim and that's going to take months. So our disaster recovery process would be to rent Generation 5 style, everything from the previous data center provider, the guys that provide us the servers, the, the servers, the bandwidth and all of that. And we just build Generation 5 style using those backups in Cape Town and we redirect our DNS there. That at least allows us within 36 hours. That's our sort of recovery objective or RTO recovery time objective to sort of get back up online within 36 hours while we initiate the process of doing an insurance claim. Covered. Thank you. That's actually a great question. Yeah, yeah. Yeah, yeah. That is a risk. I'm happy for them. And I think it's probably good because the last thing you want is for lack of a better word is a slight level of complacency with cybersecurity. So sometimes you want the fresh of the blood and you want to get new guys, not entirely new, but you want them to sort of have decent level of experience and you keep upskilling those. But I mean that's always a risk that we run. But I think it's my role as a manager to make sure that I don't, you know, I read somewhere that people quit bad managers, not bad jobs. So as long as I make sure that myself as a manager, I motivate my people, there shouldn't be a reason for them to leave, even if the job sucks in some aspects.  But I think with cybersecurity, there's enough to keep them there. But if I'm doing my job properly and leading my guys the way they expect me to lead, there shouldn't be a reason. We hope and pray, right? Then they shouldn't leave. I hope I've come in. Sure. Elmarie? Yes, it's on agenda. So the question is do we have different settings on security and the improvement on how administrators can control user devices or user experience in relation to security? So yes, the answer is yes. We collect feature requests first. So what can be implemented? We have list of current features. And one of the tasks for our small security team, David and me, and the biggest security team involving quite a lot of people in this room who represent the HS2 center is to go through these features and not only say let's have a mandatory password every three months, or let's allow administrators to reset it every two months. But to look at the user experience and say if we ask our users to reset passwords too often, it will probably hit us more than we have a password that has like six months' retention period. If we have a better UI workload, if we have a better set of edge features, or maybe we should skip the password authentication completely and think about something else on the more long-term perspective to use a different authentication. So starting how user experience and the issues of that is also a part of what we should work on. But generally, some recommendations and some opinions on how user authentication should look like, they are part of what we are going to provide. I just wanted to add that we do have, oops, that's good. I just wanted to add that there are a number of enhancements that we've made more recently to user security specifically within DHS2, and that's something that we're ongoing and working with the whole security team to improve. For example, the automatic, basically scheduled deactivation of users that haven't logged in for a certain amount of time, something that was introduced recently, additional password policies or username policies to prevent people from using certain tricks to basically impersonate other users within the system and those types of things. So there are several enhancements that have come in very recently and are continuing, are already on the roadmap as well. Is it working? That's great. I mean, as Michael was saying at the beginning, we are very open to feedback and suggestion in general for what are your concerns, what you feel that we should focus on stepping up and building the security program, but also on security features. So we have a Gira board, right? I think it's still open, and we encourage every one of you to send them those suggestions. As you have seen already, my colleagues have said you are working on some security features, security improvement, but we may lack these type of use cases. So it would be great if all of you just help us to submit these features and then we'll for sure take a look and plan our roadmap and implement all of these. So yeah, thank you. Thank you for that, Michael. For me, it's the issue of multi-factor authentication. I think for us in South Africa, we believe it's agent because the QR code, it's a bit inhibiting in the sense that it's only multi-dimensional. So if, for instance, now I do not have a high-end phone, then I don't have that authentication. So I think we should perhaps, if you can move it up in terms of Gira processes, we would appreciate it because I think with us in South Africa, unfortunately, we are audited by the entire general using the best practices. And so therefore, there are certain authentications that perhaps we should explore because, for instance, for low-end phones, for instance, if you get an authentication or your code via SMS or via email as a start so that then we can get the feature implementable, it would be appreciated to us. So it's a request, not a question. Thank you so much. Yeah, right. We have it on the list of the feature requests and it was asked multiple times during the last two weeks, have multiple authentication methods, so we'll discuss them internally. I think it's a known issue. Okay, thank you. Yeah, I just wanted to, I had one use case request for setting up PHIs to that is HIPAA compliant. I don't know, is that something that the security team have in plan? Because my understanding is probably not yet in there. We can discuss this separately. Yeah. Thank you for that very good presentation. Thanks a lot. So I think we talked a lot about infrastructure, security and policies and so on and you're doing very impressive work in that one, guys. I just wondering, because another aspect that you probably should think about is also the DHS2 configuration itself. Because as you know, like the DHS2 is very configurable, you can do a lot of things, which means there's a lot of options for making mistakes. So even if you have the strongest VPN and firewall and things, if someone gives public sharing to your confidential program data or gives all access to a guest account or something like that, then it doesn't really matter that you have the strongest firewall. So do you have any kind of checks or verification in place for detecting is potential kind of misconfigurations in the DHS2 as well? So I think in South Africa, we have a maybe a unique situation where we focus on separation of roles a lot. So the Portuguese infrastructure team are the only people who have actually got access to the server and they don't have access to the database. My team, we've got a software team and a data science team, so the data team that works really in the database, they have got access to the database but nothing on the server side. And we essentially that helps us a lot in determining who could actually do what because for certain actions, I'm reliant on his team who is then performing a second role of checking sense check. Is this advisable? What about if you do that then ABC could happen? So that helps us a lot in that separation of roles. So we don't have someone who is the super user on DHS that is also managing the server. Not that they can't. Many of the developers can get a bit frustrated but we allow them then a different environment where they can do that. But on a production environment, we definitely have that separation of responsibility and roles. In terms of the configuration of DHS itself, I did a presentation on Monday in terms of base practices and we were perhaps a bit rigid in saying this is how systems should be developed because we initially we found someone would make some sort of configuration mistake that has an influence on users in the system. And essentially in another system, we have already figured out how to solve that problem but we just not communicating that solution well enough between ourselves. So it's been a long-term process but we built these base practices for system development and those type of things. And yes, we still pick up configuration issues that could be problematic but I think we largely don't really have a lot of those type of things. Thank you. We ran out of time so if you have any extra questions we are here and we can discuss them outside of this room. Thank you so much.