Hello everybody and welcome back to my video log, my channel, so I've been away for a little bit of a while. Oh, so many things to do, so many people to see, so many, you know, life can be complicated, can't it? So let's stop me dribbling on about this. Let's have a little look at what we're looking at today. So here is a kit on AliExpress, two pieces, the NAMNAP250. This is a kit that will be working between 15 and 40 volts and it is up 40 volts and 80 watts amplifier from what I can tell just by looking at the description across here. Now I've built these, well I've built one of them and I'm going to say straight away that it didn't have this capacitor that I'm sort of like over here, this 10 microfarad. It didn't have that, there's a canister on those. I'm electrolytic. But never mind, never mind, I expect these things change anyway. So let's have a quick look down here, what we've got a mod version, right, well mod version, I don't know if they're trying to get themselves away from the original NAMNAP250 by saying it's the mod version. I don't know. So let's have a look, see what it says. No, if you choose the order you need to solve it yourself, yeah. So NAMNAP250 mod version, mini circuit board, blah blah blah. AB works in AB mode instead of A mode, so it's going to be more efficient. Now it's got a THD and noise equals 0.01%. To be honest with you, I find that hard to believe. But look, take a look at it. And when we click there for product photos, they're going to be below. Looks like they've been doing some different bits and pieces with their website. Yeah, this is just a bunch of the close soundstage. I don't, you know, I mean, I expect there will be some good reviews, but I don't tend to go on reviews. So unfortunately, I found out with another big company that's very much similar to this, that reviews go up as soon as people buy things. They will say things, oh yeah, this is great, great. I can't wait for it to arrive and for me to build. Well, until it's arrived and you've built it and you've played with it and you know, come on, but that's the way things seem to work these days. I'm just going to show you just a quick circuit board diagram. Now I've not gone through this to see if this is exactly the way this particular circuit is, but it gives you something to have a little look at. And there's a bit of information out there. Now this is a proper NAMNAP 250. And this is the review on the website What Hi-Fi. And of course, it's going to get a very high rated review. And I would think for 5,700 British pounds or 8,999 American dollars or 13,500 Australian dollars, you'd expect it to sound nice. And all they want this one is to sound as good as the last one. So I just want to give you a little bit of a thing about NAMNAP. They've been around for a long time. They're very good. They're very well revered. And I really don't see you getting the same solid sound quality out of this. But hey, we're not here to judge. We're here just to check it out. That was me just knocking over my phone. It's my camera in this instance. And I might have to chop that bit out. Yeah, so, you know, that's the way that is. So let's go on with the tests. Have a quick look at the actual thing itself. And then we'll go on and do some tests. So this is the kit actually built up and put onto a heatsink. Remembering the input isolators behind these. They come with these rubber things. You can use those which are ideal. That's why they come in their kit. Or you can use the ones the way put in. Micah, which is what I tend to use early because I bought a big massive pack of them. Pack them up one stage because it was so cheap. So I figured I should use them. But I'll just use them here. It's just something that's worth pointing out. This is that these are all well and good. And it does make life easier, actually, not having to solder or, you know, screw on using these spade connectors. 63 mil these are. The one down here can be a bit tight fitting. But, you know, it all seems to go in there pretty good. That's a bit better than a wipe probably because my cat's been jumping over this. But everything seems to be okay. There we got that nice little thing underneath. That nice little, can't quite make it out of the eyes. Which way around that actually goes. There it is that way around. Always funny when they put those underneath there. And it's the same thing that JLM is it for lgm, lgm at foxmail.com. My eyes are not working at all today. Okay, we got the modified version. I don't know if that stops them getting its trouble with copyright or whether, you know, they just don't really care. So let's stick that on then and see what it looks like. See what it sounds like. No, I don't know. See how it responds on the test. We're going to be using this analog discovery too. 14 bit because I got it. I should use it really, right? So let me get it connected up. Simple enough.  And then you've got your power negative. Because remember, this is positive and negative supply on to this. So you need a positive VCC plus VCC negative and the common ground, which is connecting a negative and positive together to make that a common ground. This gives us that swing. So we're going to just connect that up. And then this is our input positive negative. But I remember correctly, we've got positive and the negative input here. We're going to connect our waveform generated to there by our signaling. And we'll just see how it performs. It's using all the standard stuff that came with it. Some of this stuff is actually interchangeable. These transistors here. In actual fact, there's quite a lot of the stuff on it that you can interchange with other components if you want to. But we're not going to get into that right now. We're just going to set it up and just see how it performs in the mathematical way you know what we're going to get as an output reading. It's not a reflection particularly apart from the distortion meter. It's not a reflection really on the sound quality when we do the square wave. Because it doesn't work like that. Right, let's get it connected up and let's get it on the go. Okay, okay. Okay, that's that connected up. Looks a bit of a cluster mess. But you know, that's how we've got to do it. Now you can adjust the quiescent current on here, which I quite like. Let me just zoom in some reasonable. You can adjust the quiescent current on here with this little variable resistor, which is pretty good because I did find on one of the other kits I've built. It could rise a bit high, but you know, I could have probably changed that by putting the bigger heats in. So it didn't start doing this. I missed it as well. I need to find that bit of video maybe and show you. But anyway, so we can adjust that on there, which is pretty good. We can get it so once it's all warmed up and settled in, get it to where we want it to be. Now quiescent current and just let that settle there, put a bit of a little bit of something on there to stop it from moving with the, you know, with the various variations of temperature and movement, whatever. Right, let's start with the test. Let's get this set up for what we want. We want eight ohms. We want a doubt for that. All right guys, so we're back here. THD plus noise versus the frequency, right? THD plus noise, that's still on that one. Here's a good go. Channel one, THD nice, just checking everyone, the parameters are correct. 10 to 30 hertz. Let's go. Let's just hit run on that. Okay, well, that's, it's not the greatest we've seen. Okay, but this is incorporating noise as well. So what we can do is actually we can just filter out the noise. We can just look at the output of THD. All right, so that's filtered out the noise. If I put that back with the noise, without the noise. According to their specifications, this is supposed to begin down here, 0.01. And as we can see, it's not, you know, it's not exactly there. That's one of the highest points there. We've got a 0.18. You know, that's not, it's not terrible, but then it's not particularly great either. We'll do the power one afterwards. We'll look at the frequency response first. So you set this up, point channel and 0.2 in 50 steps on this. Let's give this a go on the frequency response and actually we're going to go 100 steps there and run. Yeah, I don't want that like that. I want this here and I want this here. Sorry, my bad because I want the zero here. So you can see it easier. And as we go up and down the scale, so let me just run that again. We're right there. Well, there's the frequency response. And we can see here, I know it's junction here, this is 20 hertz. Now, I wouldn't be bothered about that if it's, what would that be down there? That's there. We've got a 0.00 in this middle line, which is where we like to be all the way down here, nice and flat. At least I've seen better outputs. I'm not going to say I haven't. I've seen better outputs, but this does not look particularly bad at all. Even when we get to like the highest peak, let's say that's around about here, 0.10 DBR, sort of like up against reference input. All right. And that's that sort of like five, six, ten kilohertz and you worry about it too much. I don't know too bad. It's all really the look too bad at all. So let's have a look at this THD versus power. Now, remember we are eight ohms load. Let me just change that. We're on an eight ohms load. We are going to be running from one to 100 watts. THD noise, that's the settings that's there anyway. And we're going to stop at 1% THD, right? As soon as you get to 1%. I mean, it's 1% THD, you can hear it. It's quite a bit really, but you know, we're going to stop there. So we're just going to see what we can get from our 32 watts. Now I'm giving it the maximum current allowed and it'll only draw about like one and a half ounce anyway. This, but we'll give it a go. We'll run it from here eight ohms and let's just see what we get. Again, that's not too bad. If we look at the 0.1% line, that's nice down here and here's our 1% distortion and that's at 52.99 watts. If I just put it on the crossover, I prefer to put it there 52.99 watts. Yes, sorry. And when we're down here, you know, we're at 45 watts down here at 0.105. Round about here again, you can see again how it's like just risen up slightly here like it did on the frequency response. But that's not too bad. It's not too bad that type of output. Again, it's not the best. I've seen pretty sure I've seen, you know, a little bit better than that, but it doesn't make any difference. It doesn't make any difference. That's not too bad at all. What does that mean on sound quality? Well, not a lot really. It doesn't seem to particularly work like that. So now we're going to do a square low test, channel one. We're going to keep this level at 200 millivolts going in. RMS, of course, not peaked. We're going to use a 1000 hertz. We could do like 800 and 5k, 10k, but we're just going to use this 1000 hertz because it keeps everything nice and simple. And I'm just going to do a single hit on that. We'll just see what it shows us. All right, so that's our 1000 hertz. Now what I would say to me just like this is just, you know, there's hardly anything going on there. I wouldn't even be too bothered about it whatsoever. We're just going to go down to, let's say, 500 hertz. We'll have a quick little peek at that single. Yeah. Again, you know, there's hardly anything there. Nothing really worth writing home about. Hardly anything there. Let's drop it down now to 50. We should see a difference on this. Just hit on the single. All right. All right, we see some drop off now. This, I mean, again, not too bad really. It's just that is bass drop off, but it's not too bad. I mean, it's not as low as down here, but it's certainly not down here. Just, let's have a little quick look on that 20 hertz because to be honest with you, for most people, when they bother going down less than 60 hertz, just because your speakers are probably not going to be able to represent that anyway.  You know, it's all right then. And what we did see, actually, there was a little bit of a loss, wasn't there, on the frequency response. Let's just have a quick look back at that because that will still be there. And we can see our 20 hertz. See the drop off there? And we can actually scale it to there. We can say our 20 hertz, we got a 0.11 dB drop off compared to the reference going in. All right, so it's hardly anything. So I'd say that it's looking all right. It's looking all right. Let's just go up the scale a little bit then. Let's go to, let's say, 5, 0, 0. So we're at 5K now. Do a single shot. Yeah, lovely. Yeah, nothing wrong with that. Let's go straight to, let's say, 15. Is it on a single? Again, not really that bad. Yes, there's a little tiny bit of, you know, it's losing its rise time. But hey, you've got to be able to measure this as well. And I've got to be able to put that into it. And I'm not sure if this is capable of shoving it in so we don't lose any of that rise time now. But let's just do another one at, let's say, 25 just to go for the extreme. This, look at it as a single. Yeah. So being honest with you, that's not too bad. Now the test will be, of course, the sound. But I'm going to say this now about doing these sort of sound tests is the whole thing about doing these sound tests is it is all well and good for me sat here with my little setup. Let me just get this going on this. Yeah. So it's all well and good.  And it will sound okay. You already can, you know, put them over to the speakers here. These floor sound is these monitor audios. And I'm sure that it's not going to sound too bad at all because it doesn't seem to come up as any big problem on anything. So I'm going to go out on a limb and just say, I don't think it's too bad. Just what it's given out here is not too bad. But this is not going to tell you about sound quality. You know, the outputs on this will not tell you cannot determine to you what that sound quality is going to be like because a lot of times the sound quality with these things is a personal thing. It's your personal preference, how you like to hear the stuff. So I can tell you now that the actual amp that I'm running at the moment is the L12-2. That's what I've been using at the moment to listen to that. And I can tell you that just moving my speakers around to get them closer, a little bit wider, a little bit too far away, a little bit closer, for my personal preference, it's my personal preference. And so you're all going to have that. And because I've not run the L12 on these little speakers, I've got to put my bench here again. On these ones, I've been running down on either, it's going to sound different. And that's all going to be down to your personal taste. That's all subjective. It's all going to be down to your personal taste. So we'll have to just see. And if you can, if you can see over here, we can have a little look and see the quiescent current over there. When it's just sat there with no input really, it's all on, but no input. You can get to see what's going on there. So if it was at high voltage, let's say there was 40 volts on there, it would probably be more like 46, maybe even 50. That's fine as well. Okay. Well, that's, that's it for this. The next thing will be the sound test. And I will do it, but trying to feed you that, trying to give you that all I can tell you is what I think. I can't really put it across your well enough. I've got nothing here that will pick this up and get it to you. So you can hear it out of your system, your side. I don't know what you're using. If you're listening through a phone or laptop or a high five system, whatever. I can't do that for you. And to me, it just seems it seems a little bit unfair to try and say, yeah, it sounds great here. But I'll tell you now, if I remember my speakers, it's going to sound slightly different to me. Yeah. So where do I put them to tell you how it sounds? All I can let you know is no, there's no distortion. No, there's no popping as you're powering up and powering off or whatever, you know, sound description that noise makes. Yeah. So there we go. Anyway, guys, I think this has been way too long on the on me getting there and giving it to you. Like this and it will be in a few days, maybe four days, I'll do the old 12. All right, which I know there's quite a few people have asked me about the old 12. What do I think of the old 12 and all that. And and I'll give you a, you know, I'll give you the rundown of that in the next few days. All right, guys. Hey, if you tuned in, you got this far, thanks for watching. Give me a feedback if there's any other way that you think I can test this, that you think without having to go and buy equipment and do bits and pieces with the kit that I got here that I haven't shown you just let me know and I'll try and fit in the little shorts or something and do that for you. So the next one, take it easy. You're all safe and everything and speaking soon. Bye for now.


in today's video we're back with another brand new method for easy shiny hunting in pokemon scarlet and violet but before we get into today's video please subscribe to the channel remember you can always unsubscribe later if you'd like to now today's video is going to be focusing on getting an easy shiny tad bulb and belly bolt in pokemon scarlet and violet we're going to go through all the details in a minute but as always just a big shout out to sucroto gaming who actually discovered this spot for shiny hunting easy tad bulbs in the game now in your game you're going to want to head to glasero mountain and it is exactly this spot here so you're going to be right next to the glasero gym but you want to take like a northeast direction away from the gym until you find this sign this is the sign that you're going to be wanting to look for once you're here this is the first step of this method so once you're here you're going to want to set up a picnic to start things off as always you probably want to come to a bit of an area where it's a little bit flatter because of the terrain up here you're going to find it difficult to find a spot to get the picnic set up but if you eventually kind of just try and find some of these flatter areas here you're going to be able to get it set up no trouble at all there we go okay so you will have to just move around it is in this kind of dipped area here where you're going to be able to set the picnic up you can set it up elsewhere if you want it just going to take a little bit of time extra for you to fly to glasero gym and then up to this area but you know if you find it difficult on top of this area to make it then that is another option now I will as always put sandwich recipes on the screen now we are going to need sparkling power level three for electric and that encounter power for electric as well but like I say I always link all of the updated most relevant papa hair fair recipes let's say in the description down below so you can have a look at the link in the description and get the most relevant sandwich recipes that would be easiest for you because obviously you can mix hermimusica now you don't need to rely on just salty or you know these minimal ingredients but I do prefer minimal ingredients just for these videos just to speed things up there you can see we've got the encounter and sparkling power level three for electric set up there and that is all we need for this obviously it's worth saving before you start this method just in case you get no luck on your first time out and there's no guarantees obviously it does give you a better chance but you know rng can be rng at some points so once you're here you want to just turn to your left and then you want to head down this mountain here and you'll see two ridges there'll be a ridge to the right and a ridge to the left and you want to head to the ridge to your left here which is the one we're heading towards right now and there'll be a waterfall in the middle and this is the spot that we're going to be using to get our tad bulbs so if you come over here you'll notice that tad bulbs are spawning on the other side of the waterfall here so they're just going to keep spawning in as well now you can take your camera on like this and just kind of keep an eye out for them now you're going to be it's going to be difficult so the other option what you can do is come to your home menu come down to your system settings come down to your system and then find this option that says zoom and this will be here just turn this on just make sure it's on so it'll be off normally when you come to it if you haven't toggled it on before just toggle it on come back into game and then what you can do is double tap your home button and that will allow you to zoom in even more so you can get your camera on and then zoom in a little bit further and you should be able to identify now the tips of the tad bulb tail are going to be red so that's what we're really looking for the best way to get the further zoom in is turn your camera on and then double double tap that home button to get that additional zoom when there's no more spawning in here what you want to do is just run to the other side of this ledge and then because you can't set a picnic up here unfortunately and then you'll see them all despawn and you want to just run back to this area again turn your camera on and then double tap your home button to get that extra zoom and you'll be able to just kind of see all the tad bulbs spawning here and this is basically the method this is all you're going to do to get tile bulb it is one of the more difficult shinies to get just because of how difficult all it is to kind of spot them because it's only the tip of that tail that is a variation of the the color to the pokemon and like belly bolt which goes from green to yellow which is super easy to identify so it can be a little tricky to do but this is the method so this is all you would need to do just repeat this backwards and forwards take your camera off and you can see if you just run to the other side of the ledge they'll all despawn and then once they're despawned like that you want to just come back to the edge again put your camera on and then double tap your home button menu and then you can just sit and watch them spawning and hope for that red tip tile bulb to appear and I think we've got the shiny there we go I think it's there so you want when you do get it be quite quick you could drop a save shortly after because you don't want it to despawn that's the thing and you want to be yeah so we should be able to see it there yeah we should be able to see it there if we get the camera on we're going to be able to have a quick look and identify where it is just there there we go and there is the shiny so we do get it which is nice we just need to try and encounter it now critical catch and there we go we've got the shiny tad bulb so this method is a very simple way to do it although it is a bit tedious because it's so difficult to kind of spot the shiny you definitely if you are paying attention you will definitely see it spawning and that took quite a long time so we don't have that long left on our shining power so you can make the most of it you can head back over to the other area if you've got a decent amount of time left just to see if you can spawn in another one because why not or if you've got a decent amount of time left then you could potentially go after another electric type because you've got that sparkling part active but like I say what you want to be doing is just coming back and forth to this I would suggest putting the zoom function on because it does definitely make it easier to spot the shinies when they do spawn in here it's just a case of just wait until no more start spawning in then if there's no shiny there just running to this side of the cliff here and then coming back and just kind of parking yourself get your camera set up and that zoom in function on and just waiting for the shiny to spawn and that is it the shining power is done but we do get the one shiny tad bulb which is awesome to see and they're really nice shiny as well because when you do evolve it you get a very cool one of probably the best shinies in it in the new games I would say because it's so obvious unlike some of the other ones that aren't so obvious but it does use the thunderstorm to evolve tad bulb and when you do use it on tad bulb you'll be able to evolve it into belly bolt which is normally that green color but when you do evolve it in a shiny form you'll see that you get this beautiful specimen of a pokemon the yellow belly bolt which is just an amazing pokemon I love the shiny form of this pokemon probably one of my favorites like I say in the new games which is great so that is everything for today's video friends thank you so much for tuning in I hope you found this useful this can be quite difficult because they're hard to spot but if you use the techniques that we've used in this video the zoom and then the camera to try and identify the shiny when it spawns in it shouldn't be as difficult you're just going to have to concentrate on those areas but good luck shiny hunting tad bulb to get yourself a shiny belly bolt in these games if this video has been helpful please drop a like do subscribe to the channel for more scholar and violet content and I'll see you all in the next one until then take care of yourselves and bye bye


So, hello everyone, we're very excited to be here today at the 2017 OASP Convention. This is our third time actually. Recently we've spoken at the AppSec in Europe, and this time we want to talk to you about a very important matter. The Game of Thrones. But not just any thrones, the product throne and the security throne. Now how many of you are Game of Thrones fans? Woo! Okay, how many of you don't know what I'm talking about? Okay, it's half and half. So you should look at the series, you can catch up with us later. It's one of the most popular series and one of the best actually in my opinion. And even if you haven't heard of it, maybe you've heard that recently a certain politician said the Game of Thrones can be used as a handbook for politicians. So we think it's not just for them. Specifically the first scene during the meeting between Jon Snow and Daenerys, shown in the last season, season 7. Now I'm sorry for the spoiler, but just google it, trust me. That scene is how this lecture was born. DLPM, I was recently came to you to warn you about danger approaches. The army of hackers coming, they're going to steal all our customers' data. What? That's just a fairytale. We've had a strong firewall for years and there's never been a breach. Listen to me, I was there, I was behind the firewall. I saw them, the hackers are here. And you have three strong development teams. Why do you not put them on the task to close all vulnerabilities we have? Then we can spend the chance. Yes, I understand you, but there's a bigger issue here. I received the last garden report. And our competitors have our place, the upper right quadrant. That belongs to us. If anything, I'm sending my teams out on that task. After that, maybe I can help you defend our customers. Unfortunately, it might be too late. It might be less than a place to defend. So you get it right, Jon Snow. Hi, Derek. Thank you. But what do you think? Does this conversation happen between the business and the security? Never. I was just going to ask you how often do you think it happens if you think it happens, but you're right, it never happens. It doesn't happen. Actually, in reality, this wall is not in the land far, far away, but it is right here. Now, luckily enough, Elena is a security officer. Elena, you can come closer to me. Luckily enough, Elena is a security officer, and I'm a product manager, and we do speak a lot, actually. So we've come to share with you our knowledge and tools about how you can break this wall in your organization. But first, we need to find common goals, a common language. And what is the mother tongue of all product managers? Can you guess? Money. Of course, money. Seriously, what real goals which product manager and security person can share? Really, we have actually a big list, but in big picture, we can say that we both want to build our customer trust while we create the solid reputation for our company, and definitely we want to get some profit during this process. But needless to say, this can only be gained with joint effort. Those of you who saw our former presentation know that we are strong believers in joint effort and team spirit, and this can only be gained if you not just start talking but also act as one team. So who are we and why we are standing on the stage today? Obviously, to illustrate you that product manager and security lead can talk when they have shared goals. And our goal today is to share with you our experience and knowledge and to illustrate how you can get our knowledge and apply in your organizations too. So Elena represents the security side of the project. She brings vast experience in both software development and security areas. She went through various roles such as software developer, technical lead, system architect, and for the last four years as application security lead. And the front represents the product side of the team responsible on roadmap feature prioritization budget. And also she has a very deep knowledge and experience in both software development and product and project management. That's me. So first, before we dive into the practical aspects, I would like to give you some deep insight about the product management role. Who is the product manager and what does he do all day? So as we heard before, the mother tongue of all product managers is money. But is that really reality or is that just a stigma? So let's look at the stigma versus reality table. So first of all, we have the busiest person in the company who sees only dollars versus innovation and technology. He is the anti-start, anti-security, anti-technology, anti-technical depth, anti-automation, and anti-everything that is efficient. On the reality side, we still have the busiest person in the company, but did you ever ask yourselves why? This is because the product manager engages in various stuff, such as product definition, roadmap definition, feature definition, meets with customers, participates in sales meetings, strategy mapping, competitive analysis, and of course defines the product lifecycle, which we will talk about in a minute. And dollars versus technology? Of course, but that is only because there is a budget after the pricing model, the licensing model, that is the sole responsibility of the product manager. And the anti-start? Well, the product manager has to take hard decisions of prioritization, and maybe this is why everyone views him as the anti-start. So as you can see, the product manager has to juggle so many balls in the air that every ball that you put in increases the chance of everything falling. So do we blame him for overworking security? Yes, we do. Obviously. You just should not do this alone. If two people juggling together, we can have more balls in the air and have much bigger ball effect. So how we suggest to solve it? We suggest to align product management processes with security processes. Did you say processes? That's my point. I just love processes. So now I want to explain something to you, the product lifecycle. This is a product lifecycle that every product undergoes. It's called the PLM, the product lifecycle management. It is an enterprise-wide discipline that provides guidelines and management for a full lifecycle, for a full product lifecycle, from design and concept through manufacturing and production to service and sales. The PLM integrates between systems, people and processes. It's very similar to the project management lifecycle, but from the content point of view. And it is not just only for software technology, it is also a business strategy. Let's go over the stages in short. We have the inception. This is where we conceive the product, where we just lay down our wish lists and thoughts, our roadmap with no limits of efforts and capacity. Wouldn't that be great? There's the definition stage where we define the features functionality. There's the planning stage where we do the planning together with the development teams and prioritize. There's the design stage where we define more features, prioritize more, get into more details. I'll talk about that later. We approve POCs and approve demos of done features. This is where the manufacturing gets done, the development and the QA. Then we have the release. The product manager approves the sign-off and we have the release of production. And then we have service and post-production, where the dev gives support, and the product engages in up-sales and stuff like that. Now, when we wanted to combine the PLM with the development lifecycle, we needed to align to the development methodologies, which are, as you guess, or which is, as you guess, agile. So we're looking at the agile. We looked at the agile principles to see how they can come to our benefit. And this is what we found. Principles like short cycles, rapid delivery, continuous delivery, and immediate response give us stuff like reduced time to market and short turnovers. Principles like transparency, empowerment, sync ceremonies like dailies and scrums and early detection give us improved quality and improved reliability and also improve our forecast for cost and timelines. Principles like prioritized backlog at all times and MVP give us an option to give the customer exactly what they need, right? So we're not just effective, but we're also efficient. And in addition, it gives us an option to keep the customer advantage if something changes in the market. Principles like cross-function collaboration give us maximized supply chain cooperation. But, you know, there is a misconception that agile is an hierarchy. The endless iterations give you a feeling that you can endlessly revisit scope. And if you don't make it on time on this print, you can always postpone to the next print. So we needed a framework to combine the PLM principles with the agile principles. Something that will align to the dev life cycle, something that will align to the security life cycle. Something that will give us pace, heartbeat and milestones. So this is why we defined our own product life cycle management framework. And this is the framework we defined. Okay? As you can see on the purple background, we have the product life cycle stages and on the blue background, I don't know if you can differentiate here, and on the blue background, you have the dev stages. We want to show you how we align them. So first of all, in the inception stage, as I said before, this is where we conceive the product. We also do the market research and the competitive analysis. We define the vision and the strategy, and the development does not have a corresponding stage here. But then when we get into the definition stage, as you can see, we combine the definition and the planning stage, which in the PNM were two different stages. Here we combine them. We aligned it to the planning stage of the development. It's where we break down the themes and break down the features, do the priority, talk a little bit about high-level effort estimates. Then we get into the design stage. The design stage is the big circle. This is where we break down even more to user stories. Talk about the UI and the UX. Get down to the practical stuff. And of course, the correspondent development stage is the dev and the QA, where we manufacture the product. Of course, in reality, it's iterative and it's done upon some sprints, not just one, how it looks here. So as I said before, this framework is easily adjustable to other frameworks like the dev framework and the security framework. Let's talk about secure development and lifecycle management framework. It's a, as I said, we need framework to ensure that we have all security controls embedded on proper development stages. So we created this framework. We presented it exactly one year ago on our previous talk. So I'll just shortly remind you this main idea of this framework. You possibly familiar with such frameworks from Microsoft or maybe Oracle or other big vendors. So what we do, we just command security activities on relevant development stages. For example, the performance security plan on planning stage, the trade modeling and design stage, et cetera. Even this framework was built originally for big legacy products with wonderful development. We quickly understood that we need to adjust this framework for modern reality. And modern reality is agile development. So the simplest way as Microsoft, for example, did, they create a separate framework for agile SDRC. In our case, we already have the framework fully embedded in our organization policies and processes. And so we weren't so flexible. And we just started to study deeper the agile principles and understood that we can take exactly same activities, make them shorter, more lightweight, and with faster return and run them iteratively. So we didn't make big changes in our framework. We just adjust our activities according to agile principles. So maybe you're asking yourself why do we need this? We are big believers in the embedded of security on early stages of development. So how many of you already heard the term shift left? Do we have someone who didn't hear it? In any case, we prepared this slide so we have to remind you about this importance and meaning of this movement. So historically many organizations started the security program in reactive order. It means someone who didn't hear it. It means that. I'm just wondering, everyone can hear Elena because she's a little bit far from her. Just remind the situation. You want to build something.  We have fire department. Call them when fire starts. You seem to have a very old approach. It was once upon a time. We just had a conversation with one product manager. Fortunately, not from our organizations. And he said, why aren't we here about security? We have security department. In another word, call them when fire starts. So many organizations already understood the problem and started to implement security activities before release. But after, all development finished and all got fully implemented and all resources moved to next release. The shift-left movement, let's move to the big circle. This is our endless iteration cycle of design development and test. And many people think if we are there with security activities, the mission is accomplished. Yes, it's a great achievement. It's a really great achievement. But we want to be even left. We believe that planning is a crucial part of any successful security program in organization. If I continue the analogy with the construction, we want to be here when we plan the building even before the first drawing started. Because it might affect your material selection. It might affect the amount of windows and doors you need to create. It might affect, I don't know, supply location and maybe you need to have proactive controls such as sprinklers, for example. So SLM is our answer on this demand. We use both frameworks in the same, exactly on purpose. Because we want to say that ideally, someday we will have only one framework, Product Secure Life-Econ Management Framework. Let's say this again, Product Secure Life-Econ Management Framework. Meanwhile, from different reasons, organizational, cultural, tools-wise, these two frameworks exist in parallel. And our goal is to connect the corresponding stages of these two frameworks and attract the attention of product manager to make him or her a real security ambassador. So how do we achieve the connection points between these two frameworks? So first of all, of course, we need to identify the connection points of the two frameworks. Then we need to align the activities that happen in these connection points. Then we need to define the responsibilities and deliverables of everyone. And then we need to track the progress, of course. So we wanted to make the security element an inseparable part of the product lifecycle management. So what we did is created neutral checkpoints. Now, you might remember from our previous presentation that we had five main checkpoints when interacting between security and development. You can see them there. When communicating between security and product management, we have only three checkpoints. You can see what we have in every checkpoint in every one of the disciplines, the development of product manager and security. So three checkpoints, that's less than five, which makes it easier and less intense for you to adopt, right? So let's dive in into the checkpoints. So first, we have the kickoff. The kickoff is actually our first all-hands meeting, where all the governance team meets together. What we do here is we briefly talk about the roadmap in terms of content and timeline. Then we dive into the upcoming release, and we talk a little bit about the features explaining what we mean. We talk about the timeline, and of course we talk about the definition of done of this release, the release criteria. And let me underline that security criteria is part of the release criteria. Also, we talk about the capacity and effort estimates in high level, and we make sure we have a security bucket in place. As you remember, this is done in conjunction or just before the planning of the dev, so we make sure we have a security bucket, and we ask the security team to get back to us with any inputs or efforts that can affect the dev team. We think this meeting is very, very crucial in laying the expectations from the product manager side, where I lay my expectations, from the governance forum, the dev, the QA, the security, the marketing, the documentations, the operations, and this way I create a core team that works together towards a common and clear goal. How do we do this? Well, it's a scheduled meeting. We have a presentation template. In the presentation, of course, we have all the tasks aligned with due dates, and for every task we have a governance team provider and a governance team consumer. And of course we also have our planning tool in which we do the capacity calculations and the effort estimates calculations. So just to give you an idea, this is not exactly how it looks, but just to give you an idea of some screenshots of what we do. So this is the roadmap for 2017. We look at how many releases we will have, how they're aligned with sprints, when we have the stagings, and go live. This is a drill down to the upcoming release. As you can see, we can see when we have the kickoff, the sign off which I will talk to you about, and the design state which, oops, I'm sorry, I will talk to you about. We can see when that happens. Then we have the tool of the governance team. As you can see, we have focal points from all the disciplines, product marketing, pre-sales, and R&D, and etc. But what I underlined here is that we have the security focal point as part of the governance team. And Elena, of course, is that focal point. I had to raise all the other names. In addition, we have our planning tool which we use Excel for anti-planning, and of course the features effort estimates per team and with priority, of course. So just to tell you here, you can see that we have a lot of tools. But this shouldn't stop you. The main tools is because you know in an organization every discipline uses another tool. But this is a challenge, but we still do it. And we want to show you where there's a will, there's a way. So the design stage that comes after the kickoff. You might remember this is the manufacturing point. This is where the DEV and QA and security meet to manufacture the product. Okay? So here what we do is the product keeps getting more mature and detailed input into the R&D teams. And it is where the input gets into the factory and is digested by the DEV teams and QA teams and also the security teams. Now here in the design stage we have the five checkpoints that we talked about before. We have bi-weekly ceremonies between DEV and security that we talked about in our former talk integrating security in agile project management. Now if you didn't hear that you can Elena will dive into that shortly and she will illustrate how if you bring in the product manager into these joint checkpoints between the development and the security team in the main development stage you get the business on your side. This is real-time prioritization. You get resource allocation changes if needed and you get waiver's approval review maybe if you need them and risk approval review if you need them and you get an engaged product manager in the main stage of the development. I would like to deep dive now in the security bi-weekly meetings that we have. Now we will have short flashback and we talk about this too. Three checkpoints we have in development and security process but as Fred said these checkpoints always come in coordination with product manager because we do a lot of activities here content review, threat modeling and security assessment and any of these activity might lead to content changes. For example, threat modeling might lead to complete feature redefinition or just add a couple of new user stories to it. So let's take a look at the checkpoints content review. I'm sorry, the two clicks. You see RPM has all resources and we need to coordinate with them. So first of all content review. What we are doing on content review we perform security impact labeling. We take all new content, we do this iteratively every time when new content inserted in the release we are doing the security impact labeling. This help us to identify most recommendations to our release and concentrate on them. The activity performed by security with and developer for components. At the end of the activity we have very variable outcome we know complete picture of the release from the security perspective. We have prioritized backlog item list for security assessment stage we will talk about this later and we have candidates for design review very important activity which we are running continuously. So design review this is developer friendly name of threat modeling and it's not only light of pronunciation but we also running it in the lightweight mode. Because according to agile principles flexibility MVP and fast turnover we need to perform this as soon as design of the feature started. So we have our own methodology of threat modeling. I cannot elaborate it here due to the time restrictions but in general what we are doing we split this feature on different data flows put these flows in 9 security patterns we define such as authentication, authorization, security communication etc and apply theoretical threads on every flow in every pattern. And the end of the activity we have list of theoretical risks which might be inserted by this feature and development teams admitted relevant user stories already define the feature accordingly. And as I said it must be done with coordination with product manager because it requires reprioritization and my very definition of the content. Next very important security activity this is security assessment this is manual for penetration testing we are doing when feature is done it provides us confirmation that code implemented properly from security perspective the agreed mitigation were implemented and no new vulnerabilities were inserted. This activity done by penetration tester experts external or internal external might be third part you can invite on demand contract risk we have penetration test is different from the classical penetration test which I did doing upon product deployment because we very restricted time, we very focused so we selected the white box approach it means our expert have full access to product inside such as direct communication with development team or even code access Any case security assessment is very important it's always done when feature is done because you cannot run penetration test when feature is not functional so and as I said the code manager principles we need to fast turn over so our recommendation approach is to automate security assessment as well you can use any security assessment tool such as static analysis, dynamic scanner, third party scanner, infra scanner in any combination in your own timelines it means you receive feedback on almost every code change or configuration change or dependency update we raises this topic here because again this is very powerful tool but requires resources and budget so you should have product manager on your side to successfully embeds your commercial project in your development life cycle and finally we have the sign off that's the third checkpoint now I want to tell you something about these checkpoints these mutual checkpoints are very very critical for the communication because it is where we can identify together with the governance team all the gaps and risks and we can find the proper measures to fix them so the sign off is the release status this is where we get the big picture we look at the release criteria the definition of done we check our KPIs we look at the bug numbers and we look that it doesn't exceed the release criteria we look at all our risk assessment forms aka waivers that they're all signed we look at our security grade as I told you I'm talking about the release criteria more but of course we look at the general release criteria and of course we also have statuses during the release but that's a project management role I'm not talking about that now I'm talking about only the product management checkpoints so the product management the manager gets in here in the sign off and gets the full picture all this data is presented to him and he can compile he or she can compile all this data and according to the benchmarks and standards in our organization decide if there is a go or no go to the release how we do this we also have a scheduled meeting we also have a presentation and we of course have a meeting and see that all the forms are signed so I just want to show you screenshots again of the release security release criteria because that's what our talk is about of course we have more release criteria so first of all we have the executive summary where we can see how many critical high medium and low items we have and of course calculate our security score then we have a form that tells us what level we need to have approved that security score which is me can be an SPM, a VP a VPBM or whatever and we have the acceptance risk form the waiver this is another form here you can see only the first page with the process of the risk acceptance that the product manager has to undergo an answer in order to either approve the risk or return it into the backlog as an action item of course now we can't show you the whole form and put it in their presentation this is just so you can read the process that a product manager has to do in order to accept the risk and to tell you that we have such a form and we advise you to have such a form too and I think that's it that's the final stop in our journey and the mutual checkpoints but why is it on form? what's the weapon? the weapon, what's in it for me or you? what's in it for me for you we gain information, information is priceless we have the information about the upcoming release and information about the roadmap at all and we got it earlier at the right place and right time to raise the security concerns, requirements and depths from the previous releases from the front point of view we also get information information from the security, from the development and we can plan property we can manage the risks and we can control the consequences and from the products side of course we have the continuous alignment of the team and the continuous alignment of the content which gives us flexibility that's not me which gives us flexibility and proper risk management and we have even more we will not drill down in every each of them because we have something more important that's the company shared with us we have stuff like cost reduction efficiency, short turnover collaboration, quick maintain customer trust increased revenue, increased quality decreased reduce, compliance innovation, team cooperation shared goals and in short money and at the end we want to provide you some general recommendation which you can take with your home and try to implement in your own organizations so first know your partner know your partner's limitations timelines and methodologies find the common language define the shared goals take responsibility get out of your comfort zones and be each other's ambassadors make your all activities to reach this unicorn product secure life cycle management framework meet and sync periodically have joint mutual checkpoints don't close your eyes, communicate listen and break the wall use tool ensure that all your decisions are audited and finally formalize and brand yourselves in what you're doing infuse security awareness into product management in your organization and finally we want to leave you here today with a precious quote by Benjamin Franklin a quote that we think best represents the shift left movement which we are so passionately promoting in all our sessions an ounce of prevention is worth a pound of cure and even more if you will go to bed winter is coming for those of you thank you questions yes, first of all I have a compliment being with Nora sorry you're right said that as a product manager it's quite abnormal for me to have a security awareness and to get interest in security and what was it that raised my security awareness so I said I take it as a compliment that I'm abnormal so the truth is it was a process Elena did this when I first met her and I saw the passion and I saw the seriousness in which she treats this I don't know, something just got me and then we started to work together and invented this process and we saw that it worked and we saw that we got better security scores than the other groups we saw that we're preventing stuff there are many many times where we saw that we needed to mint the architecture and the feature design so it's only the practical tips and stuff that we did that made me security aware but again I just fell in love with Elena from my side I had a lot of meetings with product managers on every label pretty similar to the first scene but we broke the wall at the end but we have the successful process yes how much has this filtered out so you can say in the HB how much has this filtered out that was the question how much other groups do this really in our organization it's a common process for every product we're developing in our business it took us four years but yes it took I'm at the position more than four years it was a challenge here we have people who know this was a challenge but now we succeeded to invest in our business unit in every leaders I must tell you that I'm working at Intel now I worked together with Elena for four years in HB and also our previous talk about integrating security and agile projects as a project manager and now as a product manager I take all these tools and insert them into Intel so I can tell you it's also starting to work in Intel but it's a small scale right now but I'm working on it in my group so yes the question was how long do the development cycles have to be in order for this to work so I can tell you when I work with Elena you can say what happened after I left we had the development cycles of a release every two months and we've also done this started to do this in a release every month so it can be done sometimes we do the security assessment and tests in major releases like not every month but in three months but it does work in two months I can guarantee I can say it worked even one month releases we have a couple of products with monthly deliveries meanwhile we don't have something short we currently investigate the possibility to work with agile principle feature based feature done, feature tested, feature closed but it's we are not still there we are doing security impact and threat modeling on feature based but a security assessment is going for every new content inserted plus main patterns as I said we always check authorization, authentication, communication that it's not affected by new content I think you also if you get the security ambassador within the team you can talk about it you have your security champion within the team, it's a developer that is responsible for all the security elements maybe you can do this also in user stories and bugs and take it even to smaller deliveries like in two weeks but what we've practically done is one month it would be interesting to try yes how many projects get one security person living far away the question was how many security how many projects get one security person doing parallel that's not the best person to ask yes, agile based agile based currently responsible about four products running in the fast delivery mode and about four products in legacy waterfall mode with half of year delivery in case it's hard to meet more people yes you need more people well, Elena is not our we get hearts here from our team yes any other questions, yes sorry again, the delivery time what is the difference between the delivery time when we do agile based delivery and their regular waterfall delivery so I can tell you and then we'll give you from her groups I can tell you the waterfall delivery we've had one delivery in six months or in a year and with agile we've been once in a month and once in two months any more questions great, thank you