All right. It looks like we've got pretty much everybody here. I'm Cliff Lynch, the director of CNI. For those of you who I haven't had an opportunity to meet yet. And let me start by welcoming you to the fall 2016 membership meeting. As you may have noticed, we have record or near record attendance here. And I'm just thrilled to see all the folks here. I'd like to extend a special welcome to our international visitors and members and to those who maybe had a little bit of weather excitement on the way here. I hope there weren't too many, and it wasn't too exciting. But I am very glad you've made it through. I need to say a few things before I get started in my main remarks. First off, I'd like to note that we have a number of new members who are joining us here.  And I'd invite you to join me in welcoming them. We have York University. Lyrisis, who some of you may know, is among other things the home of the collection space and archive space, open source software programs. Colgate University, the University of California at Merced. Vassar College, the University of Sheffield. San Diego State University, the University of New Hampshire. CrossRough, Rensselaer Polytechnic Institute Libraries, the University of Mississippi Libraries, and Texas State University. Welcome all. A couple of program notes. If there are changes to sessions, we will be posting them on the message board in front of the registration desk. You will note some changes in the overall layout of this meeting. We have in response to both a huge number of session proposals that we wanted to accommodate. And the feedback from you over the last couple of meetings suggesting that there were a number of presentations that would fit very nicely in half hour slots, introduced sessions of varying lengths, half an hour, 45 minutes, and 60 minutes. We have had to tighten up a couple of the breaks, which is why it's important that we be done at 2.15 because the first round of breakout session starts at 2.30. And you will find those session slots are of different lengths. In a few cases, we have taken two half hour presentations generally on the same broad topic and put them together into a one hour slot. And for speakers in those, I would especially ask you to stick to your half hour if you're doing a half hour slot so that the second session can get its allocated time. Ben Schneiderman, who will be giving our closing plenary, is indicated that he's willing to be at the registration desk tomorrow morning at the 10.30 to 11 coffee break if you would like to get him to sign copies that you have of his wonderful book, The New ABCs of Research, which will form the basis for many of his remarks at the closing plenary tomorrow. Now, I also want to clarify two things about the closing plenary. First off, if you were reading the overall schedule, you may have had a twitch of deja vu. We managed to put in Julie Brill's title from last December where Ben's title, which is The New ABCs of Research, should go. The abstract on the abstract page for Ben's presentation is, in fact, correct. Also, just to be clear, because the schedule is kind of ambiguous, we will start the closing plenary with a half hour special briefing by Robert Kahn. And then we will go to Ben's closing plenary talk, which will run about an hour. So that's the agenda there. I think that that is all that I want to say about logistics other than to ask you to join me in congratulating two wonderful new Paul Evan Peters fellows that we recently announced. These are Meg Young, a PhD student at the University of Washington, who is working on data privacy and municipal government. And Kirsten Matayuchi, who is at Rutgers, a master's student, whose interests are centered on outreach and engagement in communities for library and information services. And you can find more information about both of these folks on our web. I just had to grin when I read the descriptions of their interests in research. And they were great choices from among a very strong field. These are things that would have so resonated with Paul Evan Peters. So my congratulations to them. OK, so let me get started. I basically want to do two things. I want to talk about what has been a very busy year for CNI and some of the things that we've got done and will be carrying forward that perhaps some of you may have missed or want to talk about a little more. And then I will conclude with comments on six areas. And I'm going to have to go fast here, where I am spending some time. We're doing some work that I think represent important new areas. I have very little to say about overall developments. I think all of you know this has been quite a year of two malt surprises and so forth. Other than to note that I made some remarks in the December 2015 plenary about data dumps, provenance, integrity, disinformation, and similar sorts of things that are feeling almost creepily prescient at this point. And I continue to watch the news with great interest. These are obviously going to be issues of ongoing importance. But let me turn away from those things. I will simply note that both in the United States and among our colleagues in the UK and the European community, there is great uncertainty at this point. Basically, nobody knows how a lot of things are going to play out. There just isn't any information right now. And we are clearly going to be operating in a very adaptive mode. You may have noticed a couple of days ago they decided they'd keep the government open until the end of April. So that's the kind of world we're in right now. OK, but let's turn from that to what I think has been a really good year for CNI. We have been doing a tremendous amount of work in digital scholarship centers, which Joan Lippincott has been leading, and connecting that up to areas like humanities at scale and how to strategies for supporting them. We did a wonderful planning workshop along with our colleagues at ARL late this spring. And we are looking at doing another one in 2017. There is a workshop report. There are some executive roundtable materials out on humanities at scale. And we are continuing to work in this area, which seems to be gathering significant momentum among the members we talked to. I want to note specifically in the area of executive roundtables that basically, due to my own personal failings, we had not been doing a very good job at staying up to date on reporting on those. Over the summer, we caught up on all of these and that we are current now. And we have made a pretty strong commitment to try and get the roundtable reports out within a month or two of our meetings to keep them timely. So you can look forward. I really think we will do better on that in the future. Speaking of roundtables, our roundtable for the spring is going to pick up on a theme that I've been doing a lot of thinking about and did a long interview on earlier this fall about rethinking institutional repositories. And I think it's really time to do this in light of a number of things. One is the way in which open access or public access funder mandates are unfolding, especially in the United States, which don't really seem to be placing much emphasis on institutional repositories. The growth of disciplinary pre-print servers and repositories is really starting to get a second lease on life. We have, of course, the tremendous model of the archive that started in Los Alamos and then moved to Cornell, which continues to move from strength to strength. But just, I believe it was Friday or Thursday, we had the formal launch of the Social Science pre-print server, which is running on a new platform that the Center for Open Science is made available. We are starting, finally, to see some modest but genuine uptake in pre-print servers in the life sciences. So I think it is fairly well understood at this point that pre-print servers that are disciplinary in nature seem to be more effective as centers of community than highly distributed pre-print servers when they exist. We're also seeing some of the major humanities organizations step up in this area or at least begin to. Finally, of course, we have the whole growth of research data management and the very mixed job that we are doing in establishing sustainable disciplinary or funder data repositories as distinct from article or pre-print or post-print kinds of repositories. So I think there's a lot to be thinking about there, especially as new generations of software start coming online and we start struggling with, how do these integrate with other parts of the ecosystem? Rethinking institutional repositories will, by the way, be the topic for our spring executive roundtable. So look for the call for participation for that if you'd like to talk about it. One of the big themes that we have been spending time on for the last year and that I think is going to inform our work for at least the next two years to come is getting a better handle on the new portfolio of roles for libraries when viewed inside the university context. And I really mean looking at this contextually. There are a lot of new services that the university leadership, the faculty, the staff, the students, all are looking to the libraries to provide or contribute to ranging from new kinds of teaching and learning to research data management to various kinds of publishing and data dissemination. We are seeing a fascinating new interest starting to emerge at some institutions about looking more holistically at institutional assets, like museums, herbaria, libraries, archives. And trying to bring all of this into the main line of teaching and learning and research at those institutions to make discovering material across these easier to bring greater rationality in the way they're supported and built up and sustained. We had an amazing roundtable this morning that looked specifically at collaborations among IT libraries, museums, and archives. And I think you're going to find the reading of the report from that to be very provocative. I certainly came away with it with a lot of insights. But one of the ones that really struck me strongly was that this is another challenge for libraries to move beyond classic bibliographic description and into a much broader set of responsibilities and roles about structuring and maintaining knowledge broadly across a wide range of contexts and fields. And that's a theme I think that we're going to see in a number of places that I discuss this afternoon. But it is definitely an area that is moving some people and some organizations well outside their traditional comfort zones. Very, very interesting development. Many of you know that CNI was a co-sponsor, along with a number of other organizations at a invitational meeting of university libraries and art museums that was hosted at the University of Miami in January. The report of that is available. You can find it on our website and also is very, very provocative reading. And we will be continuing to build on these discussions going forward. Another role which we have explored a bit, for example, on an executive roundtable a couple of years ago, was is the new role of library as publisher. And this spring, we took another look at this in partnership with the AAUP and ARL at a meeting that was hosted by the University of Pennsylvania. And here, I'm sorry, by Temple University. What am I saying? Here, we brought together, I believe it was 22 university libraries. And the heads of those university presses and the distinguishing characteristic here is that the press now reported to the library. So it had been mainstreamed right into the center of the campus activities. And we talked a bit about how that was going and how it meant. And it was really clear that there's still a wide variety of integration. Everything from the press continues to be an utterly autonomous thing that just happens to report to the library, all the way through efforts to much more genuinely begin to integrate and find synergies and collaborations between the two institutions. And I think there's going to be a lot more to look at there. Certainly, there is also, particularly in the monograph area, been a tremendous amount of good work, much of which has been reported here, on trying to understand cost models for the production of university press monographs, which is a very important basis for making strategic progress here. I will just highlight one thing that wasn't much discussed at the meeting in Philadelphia, and that I came away with really struck by. If you look at scientific journals and scientific journal articles, and you actually talk to the scientists, the scholars, who genuinely ultimately own the system and are served by it, there is a broad consensus, I would say at this point, that the ideal open end state is some form of open access there, as long as it's not too inconvenient for the scientists. But there is at least that agreement that there are many good benefits and that that's a desirable outcome. If you ask the same question about monographs, and you can try and do this within disciplines or across disciplines, but broadly speaking, this is mostly humanistic in some social science disciplines as a first horribly crude approximation. There is no consensus I can detect on the desired end state. Should they be open access immediately? After a few years when they go out of print, well, but digital books never go out of print anymore kind of. They may go out from under contract, but they tend to sort of stay available forever unless someone does something deliberate. Old print books that have gone out of print, there seems to be a reasonable consensus that it is a good thing to bring those back as digital things and make them available. And a number of university presses have programs where they work with willing authors to do that now. But I do think that it's going to be important for us to collaborate and help the scholarly communities that rely most heavily on the monograph to begin to achieve some rough consensus on this or at least get a better understanding of the alternatives in the pros and cons. Because without that consensus, I think that our efforts to rethink practices in this area are considerably handicapped. In the coming year, we will be starting to have some focused conversations among library leadership and CIOs about what are the most important current and emerging areas for collaboration? What are the most promising areas? What are the most neglected areas? What are the key areas? I think this is a timely thing to do because frankly the world looks very different today both from the point of view of the CIO and the library than it did 20, 25 years ago when CNI first forcefully argued for the necessity of IT library collaboration as a way forward into the emerging world of the internet. CIOs have a very different collection of responsibilities today. Often I find not always and it's terribly dependent on the individuals and the institution, but often I find that there is a researcher academic computing unit that is much more engaged in many of the issues we're interested in than the overall IT organization which is spending much of its money on compliance, fundamental infrastructure that's used by everybody in business systems. Libraries have built up in many cases formidable internal sources of technological expertise of IT expertise to the point where while they may use some common infrastructure they are largely independent of central IT on some campuses or and in fact are moving into areas that were historically the province of academic computing either on a centralized or decentralized basis. So I think it's time to do some additional probing at that and we have another opportunity coming up. In July, unfortunately, very much on the heels of Brexit we had a wonderful opportunity to revitalize our relationship with the Joint Information Systems Committee the JISC in the UK with our biannual joint summer meeting in Oxford and to meet the new leadership there Paul Feldman is their new CIO and look carefully at some of what's going on in the UK higher education world which is very interesting. It's quite a different landscape than ours in many areas, especially around analytics around levels of collaboration in certain areas. In subsequent talking with JISC we've decided that our 2018 meeting and we're just setting the dates and venue for that now is going to focus on an international look at this change, this new roles of libraries within the university in the 21st century as a theme because this is something that they are terrifically mindful of as well as they try and work with their members. So those are some of the exciting things that CNI has made a lot of progress on and is moving ahead on over the next few months. Let me talk a little bit more sort of more broadly about some of the issues that I'm thinking about working on, engaging with and I'd love to have your thoughts about some of these areas at the reception between sessions separately from the meeting anytime we can catch up. And there are six areas that I'm just gonna touch on them at a very high level. So I've been looking a lot at what's going on in the research data management area. And as you know, CNI was very early in drawing attention to this area and there are many, many people who are taking the baton from us about operational implementation although we remain interested in it and helping various parts of their institutions work through this. But I feel like we've kind of missed a bet here. There's an easy problem and easy and hard are very relative terms here. Which is about how do we deal with data that at least once it's published is public. Climate data, high energy physics data. There are issues about wanting to keep it confidential except for perhaps use within the refereeing process until publication and different fields have different norms about that. But when you get all through, the reuse and access of it is mostly about documenting and preserving. You can just kind of make it available and the more people who can find it, the better. Unfortunately, this leaves out massive areas of scholarly work including very, very high payoff areas around medical things, genomic things in some cases. It omits much of the social sciences which relies on data about people. And particularly as we look to a world where we need to be able to reuse data, we need to keep more personalized data for longer or more re-identifiable data for longer. Somehow, I believe it's essential that we focus much more serious efforts on the hard problem here of how we share to the extent that we ethically can and how we reuse data that can't simply be made public. And that's gonna require a lot of thinking about IRB practices and responsible research practices as well as the actual apparatus by which we maintain and share data. Right now you hear, for example, crazy stories about data that's essentially orphaned because an IRB authorized its use in one project and other people can't figure out who to even go to for permission. It's not their IRB, they might be at another institution. This is all part of sorting out how we think about institutional responsibility for data and data stewardship. And these, as I say, make many of the problems about public data look easy, but I think we omit them at our peril and I'm gonna be continuing to search for ways to make some progress on that second area. And some of this builds out of some conferences I've been at over the past year. Some of it was touched on at Commissioner Julie Brill's remarks at our meeting last December. We are increasingly in an age of algorithms and algorithmic prediction and filtering. Much of this involves algorithms that have two properties. One, we don't understand them. I mean, literally we don't understand them. Many of them are driven off of machine learning and you've got these very complicated neural nets that are essentially black boxes that are formed by training data and then let loose on real data and then retrained occasionally when you get enough mistakes and outliers. We also, for many of the most important algorithms, don't have stable algorithms. We have algorithms that are perpetually tweaked. I invite any of you to tell me what the search algorithm is as of this moment for Google search. Well, it probably changed since yesterday. There are some gross elements of it that are roughly speaking conserved, but they have armies of people who are constantly improving that algorithm. And by the way, depending on which one of the many, many A-B test groups that they're running every minute of every day, you happen to get tossed into, you will see subtly different behavior, not just from day to day, but on the same moment from person to person. And that's not just Google, that is every really large scale system we've got. Now there is a growing interest in transparency and accountability of algorithms. And this becomes increasingly vital as these things shape our lives. While I am very, very sympathetic and support these discussions of transparency and accountability, I'm starting to scratch my head about something that's a little bit farther down the street, more elementary. How do we document these algorithms? How do we archive them? How do we record them? This is gonna be one of our next big frontiers in archiving our cultural record. And we can talk all we want about transparency and accountability, but if we can't document it, it's really hard to have accountability about it, I think. So that's one that I'm really scratching my head about a lot, but that's moving rapidly up my list of important problems. There are some very interesting research papers that have come out recently that try and present frameworks for at least beginning to understand how some of these machine learning neural networks are functioning, but I'm not sure there's a magic technology solution around the corner. Next area, stewardship and large scale digital preservation. This continues to be an obsession of mine, of course. And in particular, the question of really understanding how what we're doing does and doesn't match up with a constantly evolving cultural record. I have been privileged in the last year or so to participate in the work of the Keeper's Project and I was very pleased to see this morning an announcement that both the, I believe, UK and European Library Associations, as well as ARL have come together to endorse the Keeper's Declaration, which we, of course, also strongly supported and endorsed. And Peter Bernhill is here and I think we'll be talking more about this and some related topics during the meeting. I should note, by the way, just broadly, many, many of the areas that I have touched upon are represented in breakout sessions at this meeting and the ones that aren't, I think you can look forward to hearing about, such as the work with the publishers at the spring meeting. But let me go back to my list of things I'm worried about. So I think we need Keeper's or Keeper's-like approaches to illuminate how well we're doing in other sectors of the cultural record. I'm also really worried that there are all kinds of emerging genres, and I talked a little bit about the algorithms, that we just don't have on our radar screen sufficiently. I mean, social media is an obvious one that we talk a lot about and seem to get almost no traction on, but there are others and we really need to get to work there. I am just finishing up, literally, a rather lengthy exploration of reading analytics and reader privacy and how these interact with authentication. We did a survey this summer about privacy and authentication practices, which I believe comes out today, finally, as an edge of cause piece, but we've had the report available since September on our website. And that was quite interesting about trying to and help to understand perceptions of privacy and privacy risk by libraries. It also began to foreground a couple of other issues that I spend a lot of time on in this forthcoming essay. One is that I think that libraries, particularly in an age where they're being asked more and more to document impact and contribution and value, are starting to get much more interested in a nuanced understanding of how the resources that they license and make available are being used. And that doesn't mean simply the kind of numeric things that you get, like how many downloads or how many hits. Involves coming up with some reasonable compromises between privacy and demographics of the user base and somehow negotiating data flows with the publishers or the platform operators to try and facet usage information along those lines. At the same time, there has been enormous progress in re-identification of users that goes far, far beyond the old sort of, oh, they set a cookie, and if I go through a proxy, I can avoid that sorts of problems that people worried about a decade ago. There's one other factor too that's worth noting here and that's a very interesting one to me. There's a new player that showed up in this sort of privacy versus reader analytics and understanding usage equation, and that's authors. Authors are getting very pressured to document and understand impact as well. And all of a sudden we're in an age now where it's quite common if you publish in a journal as an author that you get a reader dashboard, I'm sorry, you get an author dashboard which shows how often your paper has been downloaded this month. Sometimes it'll tell you something about the geographic download, the geographic dispersion of the download. And of course, there are at least some authors who would really love to have the names of everybody who read it and to really be able to jump across that all important chasm between download counts and actual reading. I invite you to inspect your hard disk for how many PDFs you have locally that you downloaded with every good intention of reading. This is sort of the digital analog of the flows and mounds of xeroxes of articles that you somehow absorbed by osmosis that were piled around your office. In some new reading environments you can cross that chasm. Ebooks are already well across that chasm if you look at the consumer marketplace. And what you do with that data is a really interesting question and who you give it to and how much you keep. Two final areas I'm thinking about. There is a huge and long overdue shift in the way we think about the management of names and factual biography. Moving away from the old siloed authority control files, the ones that libraries did that were so heavily focused on monographic publication. The ones that, for example, people in the art history and art world did to deal with artists' names and provenance and things of that nature. The kind of phenomenal resources that places like the Getty have built up. We have the work that is underway with support from the Mellon Foundation and others that Daniel Pitti is leading in collaboration with both NARA, the National Archives and Records Administration and the University of Virginia, IAF, that now has a pilot project going with about, I believe it's 18 universities and other institutions that's building out a sort of a authority system like thing for names that appear in archives. Not just authors of material in archives but subjects of material in archives as well and documenting the relationships between them. And our challenge increasingly is gonna be to connect these things up and to begin to integrate factual biography of the sort that might be found in dictionaries of national biography or Wikipedia or places like that with these resources to integrate CVs and faculty achievement reporting systems and things like that into this sort of world. There's a tremendous amount we don't understand how to do, ranging from formats and representations through interchange structures, all the way to right balances of privacy opt in, opt out and these sorts of things might be in this area. But this connects up intimately with our ability to structure the world of both scholarship and of evidence to capture and reuse evidence in the humanities oriented fields as well as the kind of evidence that's produced in science to rethink areas like biography and documentary editing. And I think there are enormous opportunities there. I'm pleased to report that just last week I had an opportunity to attend the latest meeting of the SNAC pilot project that NARA hosted and they are making really good progress. It's a very, very exciting project. Finally, and this is one I've been thinking about for some years but seems to me to be reaching a tipping point and I've had two important things happen this year. The basic question here is what does it mean when you can do digital documentation of objects, texts, images, paintings that are as good or better than the original in most dimensions and that then can be reproduced in copies that are essentially identical to the original. What does that mean for stewardship, for scholarship? What does it mean for curation? What does it mean for collecting and the whole idea of markets and rarity and how these materials are used and reused? And I just note a couple of things here. 3D printing and 3D imaging are both things we've talked about a little bit here in recent years. They're starting to take off at considerable scale. There are also these sort of two and a half D things, numismatic collections for example, which are particularly amenable to easy progress and are important scholarly resources. I was fortunate enough to be at the Getty Center in Los Angeles in August. I had an opportunity to speak at the Pacific Neighborhood Consortium meeting and the Getty is just an astounding venue for a meeting like that. The Pacific Neighborhood Consortium, for those who don't know it, brings together primarily digital humanists from the Asian nations and North America and a few other folks, but it has very strong ties to China and other places in Asia. And there was a very special event going on at the Getty at the time, which was one of the reasons why the Getty hosted this. You've heard in the past about the efforts that the Mellon Foundation, for example, has been deeply involved in to document the Dunlong Caves, these incredible Buddhist shrines. They actually built at the Getty both a number of sort of virtual reality tours through some of these caves, but also some actual scale replicas, which were astounding. All of a sudden, these sites, which are increasingly becoming closed because they are so fragile and there are many others can be replicated if we want to, if the custodians of the sites are willing. There's an article which I strongly commend to you which came out in the November 28th issue of The New Yorker just a week or two ago with this sort of annoying title, Factory of Fakes, but what it's really about is the replication not just of art, like paintings or sculptures, but entire heritage sites like tombs within the Egyptian pyramids that are under threat right now. With so much of the historic sites of the Middle East under severe threat or already destroyed, this kind of ability to document and recreate becomes extremely critical and indeed extremely urgent. This article traces the development of a variety of technologies and projects aimed at replicating everything from paintings to, as I say, literally Egyptian tombs. It's a great source of food for thought and it helped me to understand one other thing too. If you think about physical objects, be they heritage sites or statues or paintings or any number of other things that we're trying to take care of across time, these are actually objects that are in a journey across time that is going to end poorly. It may be a long journey or it may be a rapid decline. And indeed, particularly for some of these heritage sites that used to be very hard to reach and are now major tourist attractions, it's an increasingly rapid decline. It's startling the way this documents the extent to which some of the tomb galleries have deteriorated since they were opened up within the last 100 years. You actually have the ability when you do this kind of digital imaging to not only reproduce an object if you want another copy for study or if you wanna replace one that's destroyed or damaged but to freeze it in time. And in fact, as some good examples are given, you can also back it off. You can restore it or conserve it to an earlier state, something that conservators only do with great care and trepidation because it's so easy to make it worse rather than better with the best intentions in the world and the best current state of knowledge. But here you can do speculative conservation, very, very provocative kinds of ideas that greatly complicate questions about curation and stewardship. And I think this is an area that we really need to be seriously engaging. So those are some of the things that are very much on my mind and my agenda as I look forward into the coming program year. There is certainly no dearth of things to do and as you know at CNI, two of the things we try and do is take on hard problems because somebody needs to and to take on problems that maybe are a little bit over the horizon but that we know are going to be very real challenges, opportunities or surprises except they're really not if we get out in front of them. And I look forward to exploring this terrain and more with you over the coming year. I have actually done what I said I was gonna do and I even have about, by my reckoning, almost 10 minutes for questions. Thank you and I would welcome questions. Please enjoy the session. Joyce Ogburn Appalachian State University. Hi. I think you touched on a lot of issues of authenticity, identity and in a number of different ways, what's real, what isn't, what's a reproduction, how do we know, how do we document that and how that's shifting so much and then you layer on that things like algorithms that you can't identify at all and what they're doing. So I think there's some threads there of not only the curation but the transparency and also information literacy and other things how do we even know these days what anything is or how real it is or where it comes from? I think you're absolutely right there and while this is probably not the place where CNI is necessarily best suited to make a central contribution, I think that many of the things that I've talked about and many of the events of the past year or two have really underscored how badly we have underestimated and how ineffectively we've responded to the enormous challenges of information literacy and the broadest sense that you speak of it as genuinely understanding things like authenticity and transparency and bias and those sorts of things. I think that there is a enormous, enormous, an important challenge there and I think that if nothing else our community can bring tremendous insight into the nature of those challenges. Thank you again for joining us and I really would love to hear your thinking on these things over the course of the next few days and beyond. So thank you.


Hello everyone, I am Dr. Raina Tembe and today we shall be discussing about the normal MRI brain anatomy. Let us start by having a look at the cerebral hemispheres. The cerebral hemispheres lie above the tentorium cerebelli and are conventionally divided into the frontal, parietal, occipital and temporal lobes by the various salsae and fissures. The central sulcus, also known as the rolandic fissure, forms the boundary between the frontal and the parietal lobes, separating the motor cortex in the pre-central gyrus from the sensory strip in the post-central gyrus. Its identification is important when surgery is planned in the vicinity of the motor cortex. So how do we identify the central sulcus? On axial imaging, we first identify the superior frontal sulcus, separating the superior and middle frontal gyrus. At its posterior limit, it forms a right angle with the pre-central sulcus. The next sulcus posterior to it is the central sulcus. On midline sagittal images, we first identify the cingulate sulcus which runs superior to the cingulate gyrus. At its posterior limit, almost vertically above this plenium of the corpus callus, it divides. The marginal sulcus ascends to the vertex. The surface notch immediately anterior to it in the cortex is the central sulcus. On the lateral sagittal images, a y-shaped sulcus is formed by the anterior horizontal ramus of the inferior frontal gyrus and the ascending ramus of the sylvian fissure. The next major fissure posteriorly is the pre-central sulcus with the central sulcus being the next major fissure posteriorly. The parito-oxipital fissure separates the parietal and the occipital lobes. The sylvian fissure separates the frontal and parietal lobes from the temporal lobe inferiorly. The cerebral hemispheres are linked by the corpus callus. The corpus callus is a myelinated tract which appears hyperintense on T2 weighted images and hyperintense on T1 weighted images. On sagittal section, it appears as a curved structure. The genu or the rostrum is the anterior most portion which blends into the anterior commissure. The genu curves posteriorly and superiorly towards the body and then to the splenium of the corpus callus. The splenium of the corpus callus is the most posterior portion of the corpus callus. The fibres of the corpus callus sweep anteriorly into the frontal lobe known as the forceps minor and into the occipital lobe where they are known as the forceps major. Let us have a look at the basal ganglia. The basal ganglia consists of the cordate nucleus, the lentiform nucleus, the clostrum and amygdala. The amygdala is associated with the limbic system and we shall be discussing about it in a separate lecture. The cordate nuclei are C-shaped structure lying along the lateral ventricle. The head of the cordate nucleus indents the frontal horn of the lateral ventricle with the body lying adjacent to the body of the lateral ventricle. The tail of the cordate nucleus lies above the temporal horn of the lateral ventricle and is not readily identified on MRI images. The lentiform nucleus is divided into two by a sheet of white matter into a smaller medial component which is called the globus pallidus and a larger lateral component called as the putamen. The cordate and the lentiform nuclei are together known as the corpus triatum. The clostrum is a thin sheet of grey matter interposed between the grey matter of putamen and insula. It is separated from the putamen by the white matter of the external capsule and from the insula by the white matter of the extreme capsule. The upper motor neuron fibres arising from the primary cortex join the corona radiata and converge on the internal capsule which forms the medial boundary of the lentiform nuclei. It is a milliliter track appearing hypo intense on T2 weighted images. On axial section it appears V shaped with the genu pointing medially separating the anterior and the posterior limbs. The corticobulbar fibres are present in the genu and the corticospinal fibres are present in the posterior limb. These corticospinal fibres have relatively low myelin density and may appear as rounded foci of high signal intensity on T2 weighted images. The brain stem comprises of the midbrain of the pons and the medulla. The midbrain is also known as the mesencephalon and the pons, medulla and cerebellum together constitute the rhombencephalon. Let us have a look at the midbrain. The midbrain consists of pale cerebral peduncles and a dorsal tectum. Each cerebral peduncle consists of the crust cerebrine and the tegmentum which are separated by a pigmented grey matter tract known as the substantia nigra. The crust cerebrine contains the corticospinal fibres. The tegmentum lies ventral to the aqueduct of the sylvius and contains many nuclei amongst which the red nucleus can be easily identified at the level of the superior colliculus. The nuclei of the cranial nerves third and fourth are situated within the midbrain. The cavity of the midbrain is the cerebral aqueduct. The tectum lies posterior to the aqueduct and consists of four colliculi or quadrogeninal bodies. The superior colliculi is associated with the visual reflex and the inferior colliculi is associated with the auditory reflex. The pons has a bulbous ventral portion and a dorsal tegmentum. The ventral portion is continuous with the cerebral peduncles of the midbrain and contains the corticospinal fibres. It mainly contains the transverse fibres which pass posterior laterally as the middle cerebellar peduncles. The dorsal tegmentum contains the cranial nerve nuclei of fifth, sixth, seventh and eighth nerves. The medulla is closed inferiorly around the central canal. This closed medulla extends from the level of foramen magnum to obex. The closed medulla appears pure shaped on axial imaging and may be rotated. The anterior eminences are formed by the pyramids and the posterior column form the posterior eminences. At the level of foramen of magendi, the medulla appears square shaped on either side between the ventral median fissure and the anterior lateral sulcus is an elevation called as the pyramid. Lateral to this is another elevation called as the olive. On the lateral surface of the medulla, there is an indentation corresponding to the post-olivary sulcus. On the dorsal surface of the medulla, we can identify the dorsal median sulcus. On either side are the fasciculus cuneatus and gracilis transmitting the posterior column fibres. Further cranially, the anterior eminences are formed by the pyramids and olive. The posterior eminences become more prominent forming the inferior cerebellar peduncles. The dorsal surface of the medulla becomes the floor of the 4th ventricle. Along the lateral aspect, the 4th ventricle communicates through the foramen of Lushka with the cerebellar pontine angle systems. This is an important pathway for the spread of the intraventricular tumors into the subarachnoid space. The medulla contains the cranial nerve nuclei of 9th, 10th, 11th and 12th norms. The cerebellum lies posterior to the brainstem. The cortical mantle of the cerebellum overlies the central white matter core. The various folia and the interbening selchi are almost parallel to one another. The grey matter of the cerebellum has a tree-like configuration in section and is called as the arborvite. The cerebellum consists of medline wormus which is separated by a paramedian sulcus from the cerebellar hemispheres. The deep transverse fissure divides the cerebellar hemispheres and wormus into three loops each of which is made up of multiple lobules. The primary fissure separates the anterior lobe from the posterior lobe and the posterior lateral sulcus separates the floccular nodular lobe from the posterior lobe. The nodule is the only lobule of the floccular nodular lobe and can be identified posterior to the 4th ventricle. The flocculus is largely separate from the rest of the cerebellum and can be seen extending laterally inferior to the vestibular cochlear nerve. The cerebellar tonsils can also be identified line posterior to the medulla. Three cerebellar peduncles arise from the cerebellum. The inferior cerebellar peduncle or the vestiform body is vertically oriented and passes to the medulla. The middle cerebellar peduncle also called as the brachium pontus is horizontally oriented and passes to the pons. The superior cerebellar peduncle of the brachium conjunctivin is vertically oriented and passes to the midbrain. It forms the part of the lateral wall of the 4th ventricle. The diencephalon is situated between the cerebral hemispheres and brainstem and borders the 3rd ventricle. It consists of the thalamus, the pineal gland, habanular commissure and the hypothalamus. The habanular commissure and pineal gland are together known as the epithalamus. The pineal gland is an ovoid gland situated between the two superior colliculi in the posterior wall of the 3rd ventricle. Two laminae can be seen arising anteriorly from the pineal gland. The superior lamina is the habanular commissure and the inferior lamina is the posterior commissure. The anterior commissure forms the anterior limit of diencephalon. It consists of myelinated fibres within the lamina terminalis. The thalamus are olive shaped paired nuclear masses forming the lateral walls of the 3rd ventricle. They are opposed in the midline at masa intermedia or interthalamic adhesion and are separated from the lentiform nuclei by the posterior limb of the internal capsule, the palvinar projects over the midbrain. The hypothalamus forms the part of the floor and lateral walls of the 3rd ventricle. The infantibulum lies posterior to the optic chiasm and passes to the pituitary gland. Its width varies in different individuals but it should not exceed that of the basilar artery. The pituitary gland fills up the pituitary fossa and is situated above the sphenoid sinus with cavernous sinus on each side. The height of the pituitary gland varies with age but it should not exceed more than 9 millimetre. In females of child-bearing age, the pituitary gland has a convex superior margin. The anterior and posterior lobes of the pituitary gland can be identified separately. The posterior lobe of the pituitary appears hyper-intense on T1-betered images due to the presence of the neuro-secretary granules within. In neonates, the pituitary may appear uniformly hyper-intense. The limbic system comprises of the limbic lobe, olfactory apparatus and septal areas. We shall be discussing this separately. Let us have a look at the cerebral ventricles. In young adults, the ventricular system normally contains 20 to 25 ml of cerebrospinal fluid. The lateral ventricles are C-shaped cavities with corpus callus as their roof. Each lateral ventricle has a frontal horn or the anterior horn which projects into the frontal lobes anterior to the interventricular foramen of mondrone and body which is posterior to the interventricular foramen. The each lateral ventricle has a temporal horn and an occipital horn projecting into the temporal and the occipital lobes respectively. The third ventricle is a narrow midline structure with diencephalon as its boundaries. The fourth ventricle appears triangular in sagittal section. It has an anterior floor and a roof with two sides converging to a posteriorly directed apex. The floor of the fourth ventricle or the rhomboid fossa is formed by the posterior surface of the pons and the upper medulla. The upper part of the roof above the apex is formed by the superior cerebellar peduncle and superior medullary vellum. The roof below the apex is formed by the inferior medullary vellum. The inferior medullary vellum has a midline aperture called as the foramina of magenta. The CSF is formed by the coroid plexuses. The coroid plexuses are imaginated into the medial walls of the lateral ventricle and into the roofs and the floors of the third and fourth ventricles. The CSF flows cordially from the lateral ventricles into the third ventricles and fourth ventricle. The CSF then flows into the basal cisterns and into the cortical subarachnoid spaces overlying the cerebral hemispheres and is absorbed by the arachnoid villi into the venous system. A small amount of CSF circulates around the spinal cord. The subarachnoid cisterns are situated at the base of the brain and around brainstem, free edge of temporium and major arteries. These cisterns communicate freely with each other. The cisterna magna lies between the medulla and the posterior inferior surface of cerebellum. It receives CSF from the fourth ventricle via the foramina of magendi and lushka and is continuous below with the spinal subarachnoid space. It contains the vertebral and posterior inferior cerebellar arteries and ninth, tenth and eleventh cranial nerves. When the cistern is very large, it is called as the megacisterna magna. The pontine cistern is anterior to the pons and medulla and contains the basilar artery and fifth to twelfth cranial nerves. It is continuous with the interpericular cistern superiorly and the quadroginal plate cistern posteriorly. The chiasmatic or supracellar cistern extends from the infundibulum to the posterior surface of the frontal lobe and it has anchors on its ebber side. It contains the part of the sylvian fissure and the circle of villus. Superior to the supracellar cistern is the cistern of lamina terminalis containing the anterior communicating artery and superiorly is the callusil cistern containing the peri-callusil artery. The cistern of vealum interpositum is limited anteriorly by the interventricular foramen of mondro. It communicates posteriorly with the quadroginal plate cistern and contains the internal cerebral vein. The quadroginal plate cistern lies along the superior surface of the cerebellum and continues superiorly towards the spleenium of the corpus callusin. It is the location of the venus confluence of the vein of gallin with the inferior sagittal and straight sinus and contains the posterior cerebral, posterior coroidal, superior cerebellar arteries and trochlear nerves. The ambient cistern surrounds the midbrain and contains the posterior cerebral and superior cerebellar arteries the basal veins of versenthal and the trochlear nerves. The cerebellar pontine angle cistern is limited medially by the pons posteriorly by the floculus of the cerebellum and laterally by the petrous bone. It transmits the facial and vestibular cochlear nerve the antero inferior cerebellar artery the petrosil vein of dandy and trigeminal nerve in the anterior portion. Lastly, let us have a look at the meninges. The meninges have three constituent parts the fibrous dura mater avascular arachnoid matter and the vascular paya matter the subdural space is a potential space between the dura and arachnoid into which hemorrhage or pus may occur its existence is controversial in normal individuals the subarachnoid space is between the arachnoid and paya and contains CSF the paya is closely applied to the cerebral surface the dura has two layers the outer layer is the endosteum and the inner layer covers the brain and forms the falx and tentorium the cranial dura has two layers which separates to enclose the dural venous sinuses the dura appears relatively hyper intense on MRI the falx may occasionally calcify or ossify appearing as region of signal void due to calcification or hyper intense due to the fact within the maroon the falx cerebrae is sickle shaped and extends from the crystal ally anteriorly to the internal occipital protuberance posteriorly it forms an incomplete partition between the cerebral hemispheres the tentorium cerebellyle is attached from the posterior plenoid process along the petrus ridges to the internal occipital protuberance its upper free medial border surrounds the midbrain which passes through the tentorial incisura the anchis and the posterior cerebral arteries lie above the free edge there at risk of compression against the tentorial edge when there is raised intracranial pressure in the supratentorial compartment the free border anteriorly encloses the cavernous sinus and attaches anteriorly to the anterior clenoid process the falx cerebelli is attached superiorly to the posterior part of tentorium it terminates just above the foramen magnum the diaphragm cell forms an incomplete roof over the pituitary gland and is pierced by the infundabulum


Let's get started. So my name is Brian Fox. I'm the co-founder and CTO at Sonatype I'm also a member of the Apache Software Foundation and an open SSF governing board member as well. So I've been living all things supply chain for 15 years And I'll talk a bit about the view that I have on that and how I've seen it unfold during that time So a little bit of context Let's see First slide's always a tricky one. There we go. This is the Maven central repository download So Sonatype has always run the Maven central repository. That's Predominantly Java, but also Scala and some other things. So if you're Developing Java and in the report I saw this morning 50% or something like that financial firms said they were heavily using Java You probably all are you're doing so with open source You're getting that open source from our repository Not a lot of people know that and so that that repository and the consumption patterns gives us really unique Insights into what's going on at least inside of that ecosystem. So we're on track to About 700 billion downloads this year Java shows no sign of slowing down NPM same thing. This is a little bit of an older stat But their their growth looks about the same So if you were to look at Docker hub or anything like that the point being open source consumption is exploding The number of things that the developers have to choose from correspondingly exploding and I pulled these from the Report that Gabe announced just this morning. You guys might not have had a chance to see it yet This is the state of open source and financial services Supports the same thing open source consumption is double the number 48% from what it was just last year The number of people who are prohibiting it are very low getting even lower this year And consumption. Why are we doing this increases productivity, right? That's why open source Continues to be used more and more and more because we're sharing and able to build upon the shoulders of those that came before us the result of this in a modern system is that you're Pulling in components largely most of the modern package systems have binaries that are already built You're not cutting and pasting open source code You're actually pulling the binaries. What that means is you have a supply chain right and from my perspective not enough people are actually Recognizing that and using that pattern to their benefit So if we take a step back for a minute supply chains are everywhere, right? think about it think about your cars think about your food think about the planes and In the supply chain world Edward stemming is kind of like a superhero. He helped the Japanese auto industry rebuild after World War two and focused on a number of key things The important one here, you know is this last one continuously tracked a location of every part I mean, obviously we know we want to choose better parts and all that stuff But from my perspective so many organizations are simply failing to do this thing here Right and this is really important. So if we think about this in terms of real-world Implications I tell a couple stories here that I like this first one is the Chevy cobalt in 2014 They had a little bit of a fiasco Because what had happened was there was some some basically a bug in the ignition switch Where it was too easily turned from the run to the accessory mode And if people had a heavy keychain or something happened it shut the car off The worst part about that is about two seconds after the car was shut off the airbag stopped So not only did their engine stop they lost power steering and power brakes their safety systems turned off too people died The problem was the engineers at some point they fixed this problem and they didn't change the version number of the park Right. So anybody doing software recognizes this. This is the yeah It works on my machine not your machine kind of problem Like I have a different version of a jar than you do right tools like maven and pi pi and npm Have tried to help solve that problem by making versioning very obvious and discouraging this But this is a problem that happens in software and when it happens in the real world people die The opposite of that is back when Boeing 787 launch They had a potential similar fiasco with batteries that were catching on fire at the gate But they were pretty quickly able to zero in that they were all related to a single manufacturer in a single batch Because they did have supply chains. They were able to understand this and they were able to To to fix it very quickly as opposed to what happened to Chevy Because there were parts on the shelf with the same version number that were still broken even after they did the recall They were putting broken switches into cars thinking they were fixing them And then they had to do another recall and pull back all of those to fix it right again because of simple configuration management failures in physical supply chains and then there was a lesson the lettuce industry learned a couple years ago You might remember here in the US. There were a few years We had E. Coli outbreaks it was like two or three summers in a row and the last one the last big one that happened It occurred when the lettuce growing season shifted from Arizona to California when people started to get sick and so because the Lettuce wasn't labeled with the region of origin it made it impossible for them to figure out what was actually going on And so what did we do we threw out literally all of the romaine lettuce and like all of North America And that's an economic disaster. It's an ecologic disaster and a lot of a lot more people got sick because of it So what did they finally do up to three years of this? They started labeling the bags with the region at least if not the farm where it came from so these industries were making mistakes That led to real problems and and I'll tell you our industry is doing the same thing And so we need to start thinking about this in terms of a supply chain and we don't have to reinvent the wheel We can look at patterns from other other industries and and and kind of adopt the same practices So from my perspective, I looked at what's happening Over the time that I've been doing this and I see three distinct phases of what's been happening The first phase is really your old school exploiting open source vulnerability So these are bugs that existed in the code somebody found out how to make it do something It was unintended and then exploited the heck out of it You know when I first started we were talking to financial firms who would tell me things like well one We're not using open source Because they thought open source meant Linux and my sequel and Firefox when in fact those same people were downloading more components from our repository than anybody else in the world because the leaders didn't understand that 90% of their modern application was actually open source components and then they would tell me things like well I don't have to worry about that because I have a security team in a firewall Right, so that was the perspective of a lot of people when I started doing this and started talking about this But the first one that really raised a lot of attention was the first struts vulnerability. This was in 2013 And this is a financial conference. It really resonated within the financial industry We had a lot of customers and a lot of prospects really kind of flipping out about this one because anonymous was trying to make a name for themselves and A lot of banks took their websites offline for maintenance on the same day after this was released So draw your own conclusions from that But I know for a fact that the financial industry really started paying attention to this problem that I'm talking about here way back then Right, so I'm hopefully preaching a little bit to the converted here But but there's always something new for everybody In 2014 we saw shell shock and heart bleed. This was the rise of marketing around vulnerabilities and you started to see it on the news And and people paying attention to it right with outsized impact and and generally the conversation started to shift from I have a security team in a firewall. I don't have to worry about this to Maybe I should pay attention to my open source again small numbers, but it was starting to grow in 2015 Commons collection comments collections a very popular library from Apache that does things like link list and Hashtags and all that kind of stuff. It's so popular It's like log for J could be assumed to be present on the class path of any Java application Or at least the Java container that it's running in And this is a picture of Hollywood Presbyterian Hospital They were ransomware by an attack leveraging Commons collection a full year after this was disclosed at black hat and Subsequently patched right and so this hospital was shut down for a week They had no backups no way to restore it. They ended up paying the ransom in order to get this data back But I I bring this up because you know the old adages humans We don't act until somebody dies right now. You shut down a hospital outside a major metropolitan area It's going to have very real impact on lives There are studies that have said that if you have a heart attack or a stroke in New York or Boston around the marathon days You are significantly Have have significantly worse outcomes simply because the ambulance has to route around the the Marathon route and you know minutes matter in those two things and so, you know Mathematically you can say this very likely killed some people there have been unfortunately some stories since then one in Germany Where a woman had to be transferred for a hospital ransomware? She died because they couldn't get the stroke the blood clotting medicine to her and there was another one I think it was in Louisiana Alabama where a baby died because the ransomware shut off a monitor and they didn't realize a baby was Distra in distress. So these things have very real impact. We're not just talking about stealing of money We're talking about very real societal impact From frankly our collective failure to do the right thing here If we talk about log for shell, right? Who's not talking about this? These are the statistics. Wow, that's really blurry for some reason These are the I have a better slot of this later the early statistics of the adoption and you can see pretty quickly as an industry We got to about 60 percent of the consumption was of the patched versions And then they picked up all of those new ones but about 40 percent of the consumption pattern was still of the known vulnerable versions and that continued Shockingly until about last month. We finally crossed into the below 30 percent But it's taken us a whole year so for a whole year 30 percent of the consumption of this thing has been of the known vulnerable version that Everybody and their brother knew about and was writing about what the heck is going on, right? If there's not better evidence of a supply chain failure than this I don't know what there is and and there's a better picture that shows the full view view of this later So I raised this at this section because despite the wide impact of log for Jay This was a phase one. This was above This was a coincidence of two features frankly that existed in the code base that people figured out how to exploit This wasn't even one of the phase two or phase three types of attacks that I'm going to talk about next And yet we still struggled a bit to deal with this China has been exploiting the heck out of this this came out this summer They this came out in October national security agency has this at the top of the list of Chinese Attacks still all this time not a surprise given that people are still building stuff with it And I don't have a slide but last month they came out and said Iran Attackers were using the same exploit to go against government agencies, right? So some people say log for shell was a big bunch of noise about nothing Clearly that's not true if the government is acting upon this So we think about phase two what started in really 2017 Was was a new rise of it the attackers actually moving to Insert things into the supply chain where previously it was a race between they figured it out Could they exploit it before you could patch it? That's what I used to talk about then in 2017 There were a couple things that happened. This was a study that found that in the npm repository a majority of the things published here or the publishers had weak You know passwords either they were like password or they checked them in the github and it was easily compromised Coincidentally or not. I don't think so within a few weeks after that We saw actually the first typosquadding attacks So typosquadding using a confusingly similar name and underscore instead of a dash and confusing developers like you're probably all Familiar with this term at this point now But five years ago. I was out there telling people this is happening and I felt like you know I was the only one seeing this and what was really shocking about these two instances was that These things were stealing the open-source publisher credentials. They weren't trying to steal so security numbers or credit card numbers They were stealing open-source maintainer credentials and that was like a huge thing for me I'm looking around going am I the only one that sees this because this is really freaking scary that all of a sudden They're paying attention to the supply chain now and then not surprising Right after that we saw an evolution of these attacks back in 2017 2018 I was giving a version of this talk where I was kind of talking about this happened last week Did you hear about this? There is a tidal wave coming and so we have all of this documented at our supply chain report Now and you can see at the bottom lots of details But I felt like I was watching the attackers hone their craft in real time that everyone that came had elements of it It was like it was like COVID where each new variant had attributes of the old ones and new things that made it worse Is basically what was happening here? so the third phase that we're kind of still in now are these Attacking the developers and the development infrastructure itself specifically using those supply chain attacks So one of the first one this was a Jenkins that was unpatched. They were mining Bitcoin back in the day Might be worth less than that now. I'm not sure I should do the math and update the slide But it was a lot of money. It got a lot more and then probably came back down What happened here I lost my pointer and So last year there was another one where an attack got into vercata a camera company where they went in through the Development infrastructure and they were able to move laterally around the organization getting into the actual camera feeds, right? So attacks on the development infrastructure is not just isolated. These are the back doors that allow you to get into an organization and And they're using this through upstream types of attacks. So this was one Code Cove was another one. This was a popular tool that was breached And so everybody who had this tool in their infrastructure also was vulnerable and there were a number of attacks that were attributed to this one as well And so what we've seen is this evolution of additional types of attacks going on within the development infrastructure And if you think about inversion of not inversion Infrastructure is code that exists in many organizations now It means the development infrastructure potentially has the keys to the kingdom to the production kingdom Which is why the attackers are going there and so You know last year also there was a new attack It just started as white hat research saying I if I figure out the name of a NPM module that you're using internally and then I go to the public repo and I publish it with a very high version number Your tool that's looking for the latest can't tell the difference and will download the attacked one So this was initially researched that went out and he collected a bunch of bug bounties But we watched pretty quickly as first there was a huge flurry of of copycats going after bug bounties We saw it was seven thousand percent within the first week of those types of attacks But buried within those were malicious ones where they were taking even the proof of concept code But actually using it to steal credentials and go after actual dropping actual backdoors and that trend actually continues today The attackers are still focused on on this type of problem I have a slide later, but we've identified over a hundred and three thousand instances of this using some of the automated Mlai techniques that we have Because it was the only way for us to keep our customers safe You know these things are happening every single day still and they're getting more and more sophisticated Now why is this happening? Well, this study is a little bit old But still somewhat shocking way back in 2016 the worldwide Global drug trade as an industry was four hundred and thirty five billion dollars that same year with Cybercrime was already a bigger industry and if we think way back then we weren't talking about this, right? This seems less shocking now, but what is still a little bit shocking is that last year it grew to six trillion dollars and It's predicted to get to ten and a half trillion dollars just a couple more days now If you flip this around and you think about the motivations of the attackers This is the VC funds that are investing in them to attack our infrastructure They're getting this money from us. They're getting it from our insurance companies And they're using it to get more and more sophisticated against us because we're making it easy for them Right, so this is why these rise these rise of attacks are happening and why they're not going to go away And also the attackers are engineers So they're looking for the easy way and this was a study that looked at the npm Repository interconnection at the time they found that if you were able to get to just a few Maintainers you could affect nearly half of the components in the entire npm repository And if you flip it around you could target just a few packages and get millions of downloads, right? So of those hundred and three thousand Instances I talked about most of them are in npm a handful of them are in python So far none of them have been in Java and and we can have a side conversation about why that is it has to do with some Of the fundamentals of maven and some of the things we do to manage that repo But they're slim. They're easy pickings for the for the attackers right now And so, you know that growth of those attacks has really exploded in the first few years You know there were a handful like I said I used to be able to walk everybody through the progression when you know I could count them on two hands But then it exploded the 216 following year 430 percent year after that 650 percent and then When we look back over it, it's been an average of 742 percent year over year for the last three years Right, so this rise is not a coincidence with that rise of the money that they're collecting from us And then turning around and being incented to go after more Right, and so this is the the hundred and three thousand slide that I was talking about so We did some interesting stuff here you guys would all probably understand this we modeled our Approach after credit card fraud detection because every new every new type of attack was not exactly like the other So we couldn't we couldn't just build heuristics to recognize what was malicious But what we could do is recognize what was normal and identify the unusual types of things just like when I travel My credit card gets used at restaurants and all this stuff all over the world, but I don't go to Southern California I live in New Hampshire. I don't go to Southern California.  That's that transaction is going to get blocked instantly so we do basically the same thing for new packages and and We're able to protect our customers that way and so it's it's a it's a pretty cool thing We could talk about it outside the conference if you if you want So what do we do about this in the wake of log for J? This was my perception of what was happening in the industry all of these articles were being written that were missing the point They were freaking out like oh my gosh these are free projects and we're dependent upon them and the the feds should get involved and You know, nobody's paying them their amateurs and look open source developers are not amateurs Most of them aren't even volunteers These are the people who want to do nothing else but write code all day every day and they do cool stuff And a lot of times their employers are paying for them But the outside world kind of figured out their thought that this was like a bunch of you know College kids writing code that didn't know what they were doing which really frustrated the heck out of me You know and and freaking out that oh my gosh, we're all dependent on this free software Let's get some policy right so the world kind of overrotated in my perspective towards all these things which I'll call classify as like fix open source educate them make better tools do all these kinds of things and and I think they're missing the point Imagine if remember the Takata airbag imagine if the manufacturer said you know what we're not going to do recalls We're going to pay Takata more and we're going to do a better job next time That's what all those things that the world is asking about open source and reality is they didn't really do that They said no we know exactly which cars are affected. We know when they need to get recalled I just had one in a truck replaced like six months ago because they knew that for the first three years or so It was safe So they were able to phase it out because it had detailed understanding of every part and everything and So this is that log for Jay year on view which kind of tells me a whole bunch of companies out there Don't have an understanding of where those parts are because I can't think of a logical reason why they wouldn't have updated Even if you could prove you weren't exploitable everybody was asking everybody else vendor Consultant type of relationships if they patched and how they mitigated so even if you knew it you were going to update Just so you didn't have to answer yes I'm still using it and then explain why that's okay to your banks and your insurance companies right and yet this is still where we are and so we did some some Studies this year again at that URL you can see the details We looked at the vulnerability the things that were being downloaded that were vulnerable at the time They were being downloaded from central across all vulnerabilities 96% of the time when somebody was pulling something from the repo there was already a fix Available right so all of that work on the left-hand side Why does this keep stopping on me all of that that work on the left-hand side? Is solving 4% of the problem right and so really we need to get organizations to make better choices Have an organizational view of all of the components that they're doing and then be able to manage that response And that's really the part that I've been focused on this whole time because from the download statistics way back When we recognized that that was actually the problem way back in 2011 we looked at it We saw that bouncy castle a Java crypto library the most popular version of it Happened to be the one that had a level 10 vulnerability found and fixed over a year later So even back then we were able to identify this same trend And and not enough people believed us I think but now now we're starting to get to that point so we've also looked at Some studies over the years a few years ago We got to the point where 50% had some process in place and 37% had automated tooling That's great because when we started surveying people these were in the teens, but I'm a little bit of a jaded person Would you accept those statistics for these things if only half of the parts in your car? We're supposed to be there no so so we should be happy that it's not teens anymore And it's 50% but as all of these statistics I've shown you we still have a long way to go And the good news is you know, we have examples where it really works This is an example of someone using Our tooling to help do it when log for shell happened. It was basically a nothing burger for them They had 80% of their 4000 portfolio over mediated in the first four days And they basically hit per hundred percent in weeks after that We've talked to other financial companies where they said yeah It took us a hundred days to understand which applications we had long for JN, right? So that's a big deal I don't know how it was for you guys, but maybe maybe somewhere in between these two things when we look at it across the board You know you can see Fast differences and companies that have tooling in place versus those that don't shouldn't be surprised, right? so So the point being you have a supply chain even if you don't manage it the attackers are using this against you You know if I told you about a new vulnerability today Literally sometimes I get that opportunity something breaks as I'm about to talk and I can announce something Could you tell me are you using this component anywhere in your organization so many places can't even do that basic thing? If you can do that, do you know exactly which applications it's in? Can you track the remediation of it, right? If you don't know what you have you can't even do this and how long would it take you to deploy an update because that's What you're racing against And so worse how would you avoid the next malicious release you have zero time to respond? The thing is taking action as soon as your developers download it They're dropping backdoors They're exfiltrating exfiltrating credentials and in a COVID work from home environment a lot of the Perimeter defenses that might have existed and many organizations don't so where a backdoor might not have actually been able to deliver The payload inside an office if they're at home on their home network or in a coffee shop that may not be true So the pandemic has accidentally made this quite a bit worse, right? And so you know the the point that I want to make here is that You know, we have a factory Deming principles and focusing on traditional application security things focusing on is this thing safe before I ship it and I Release it that makes better products. So in the auto manufacturer. It's making the cars better faster cheaper, right? But what is it not doing? It's not defending the factory against an intentional suicide bomber or whatever type of intentional sabotage That's what the attackers are doing to our development infrastructure in this phase three This is happening every single day, right? And they're they're using it to great effect to move around the organization and then finally a couple years ago We we did some other research and we looked at organizations and we said based on their survey response We kind of put them in the different categories, you know in the first category here Security is the most important thing even if it slows down development and then the polar opposite of them or whatever We're just going to ship stuff as fast as we can security be damned, right? So there's two polar opposites of that and then there are people in the middle that are kind of trying to do the sensible thing Now if I told you that the people that were focused on being fast You know paid a penalty and security and so it's probably worthwhile to slow down a little bit and do some security And that's the right thing after everything. I just told you I think everybody would go Yeah, that makes sense. Let's go a little bit slower because of security matters But what we actually found is when we put it all together is that the people that we're doing both We're both faster and more secure than the organizations who only cared about one dimension or the other And that seems kind of surprising But if you stop and think about it these people who only cared about shipping fast They didn't get a free pass when log for j happened They still had to deal with it, but they had no tooling or process in place to do it sensibly Right and and the people that have very draconian security practices. I mean, of course, they're going slower But because there's a little bit of mashing of gears and everybody's accepting risk and waving things and pretending like these don't matter Things don't get fixed. So it actually reduces their their security footprint, right? So the point being this is one of these classic win-win situations where you can actually be faster be more innovative And be more secure if you stop and think about this think about it like a mature Supply chain and so if you want to think about or see more of this stuff that I talked about Including the last eight-year reports. You can find them all here So pretty much all of the all of the charts that I showed came from one of these these years. So I think that's about my time Thank you for coming. Hopefully this was informative. I don't actually know what time I'm supposed to leave Do I have time for questions? Do you know I have two minutes? Okay? I could take one quick question if somebody wants No, okay. All right. I'm definitely worried about it changing, but I think the attacks will be different So real quick. There's two reasons why that is the case pi pi npm and some other ecosystems Default to updating the latest so every time there's a build unless you told it not to it's going to grab the latest for an attacker That's a ready-made audience. I put something out there. I got millions of downloads So it makes it a target for that reason the other reason is on Maven We have namespacing the group ID which correlates to the Java package Which is usually the company's domain so calm dot sonotype or calm dot fidelity or whatever, right? And so when when people publish the things we Validate that they control that namespace we validate that they own the domain or something else like that or a github project Can only use their github name so you can't show up to our repository and pretend to be Apache and publish something That is a typo away from struts. Nobody's going to do it So because Maven has that and because sonotype enforces it it makes it harder for them to do it But also because Maven doesn't prefer the latest by default it makes it less of a target So those are the reasons why it's happening over there. I am worried and we're doing some work and some other things I think that they will be the next generation type of attack where they figure out how to get nefarious code Into an actual popular project, which is a much harder problem to solve and isn't just a Package repository problem to solve actually so that's that's the reason why that's that's different All right, thank you everybody enjoy the rest of the conference


I'm Jane Loomis. I live in Clemi City, Indiana, on a small farm that we've built from a soybean corn field that we put up our own barns and started farming when we were old enough to know better. And we decided to work with a sauer-grant on sweet sorghum syrup. It was something we were interested in growing and we partnered with three or four other farms and tried to determine whether it's a sustainable product that you can do on small farms, you know, with a small amount of labor and not much equipment. Sorghum is grain but it is also, it grows in a cane like sugar. It looks a lot like corn but with a seed head on top instead of a tassel and it is drought resistant and grown pretty much all over the world. But the cane can be pressed. You can use the grain on the top if it ripens but before that if you cut the grain off the top, the grain head off the top, you have a cane similar to sugar cane. It can be pressed into a juice and then evaporated into a great sweet syrup. We actually take it to an Amish farmer who has a steam press and a steam driven press and evaporator and we grow the cane, we harvest it, haul it to Middlebury, Indiana which is northern Indiana about an hour from here in trailers and he presses it for us and bottles it so it's all done in a short time. Sorghum has a wonderful flavor. It has lots of minerals and vitamins in it and it is much more sustainable. It presses out like seven gallons of juice makes a gallon of of the syrup and that compares the same maple syrup which is about 40 to 1. So it's a it's a lot easier from that standpoint. Last year we grew a honey drip and that's what we're going to grow this year. It did real well, stood good for us. We only had one year that ever went down on us and that was the first year. It's down by the wind. Yeah it goes down by the wind and we learned a little bit down at Sorghum Conference about how to handle that because they had stuff go through a tornado and never went down or a hurricane and never went down but their idea is topping it about a week before they harvest so that's when the head gets real heavy and it wants to fall over and if they get that topped then they'll stand for two or three weeks without no they could have or they said they had a hurricane go through and they were bugging down so. It's a good crop for small acreage use and it's easy to handle and the more we do it that is true we're better you know you start to realize oh yeah this helps with the blowdown this helps with the and we'll plant the same kind now as Urie. Urie Miller we're processing so they were on the same page as him he's going to be ready his equipment will be ready because he's got his acreage process so you start to everything starts to get in sync. The biggest problem has been the marketing in other words the the planting growing it's it's as good any any crop. My role with the project has been working with the farmers who are private family farming on on some of the educational aspects of sharing the news about Sorghum kind of in the community and hosting an event at Mary Lee that the public can come to and showcase the product and the process. We are marketing it to small businesses in the area places that make caramel corn popcorn butcher shops we're working on developing a barbecue sauce based on that we use it in granola and breads that we sell at the farmers market and then of course we a lot of people buy it because that's how they make molasses cookies they use it on pancakes you know you mix it with butter it put it on biscuits it's wonderful so it's really kind of we're trying to reeducate the public on a you know a product that has been used since the 1800s but has sort of fallen out of favor because sugar white sugar is so cheap