My name is Lee. I am coming from a company called Aqua and I'm a security professional as you can see from my alphabet soup after my name and If you have people in your organizations with that alphabet soup, then that means they're security professionals, too So the question is what do we want? except from life happiness and the rest of the world security people want to make sure that applications organizations Businesses run securely, so I'm going to start with a very very basic premise of Where security actually fits in in the world? I? Been new to the DevOps world. I've been security professionals for about 20 years or so been in the DevOps world maybe for a couple of years and Somebody had to explain it to me So I'm going to explain it to you the way that it was explained to me So let's start if you take a piece of code that does something useful and you Put it on a server where it can run and you take that server and put it in a data center that's accessible from the outside world You're going to get an application that people can use so far so good like so Where does that fit into the security world and why do we care about this very simple or simplified? Construct of how applications are running well because we need to Not just run that application in isolation. It needs to be to do something and unfortunately there are Dangers in the world that it needs to to deal with so if we overlay security over that We actually get a business because you can you can take an application and you can have a great idea until you've done the security work until you can run it in a way that is going to be Wholesome and predictable and safe for people to use. It's really not an application It's not really not a business. So so where does business fit in when we write the code the code needs to be secure meaning that the Program that you write is going to be predictable in its behavior. It needs to run on servers that can only Run the software that you want them to run that they're not going to be used for any other purposes It means that your operations need to be secure meaning if you people start to rely on your applications It has to be available. It has to be up and running It has to be done in a way that gives people the confidence to run it and Your users are your users that you intend to the application to be used with but there also could be the users that We don't want to use our applications. They are the bad people of the world and Unfortunately, they're there and as we've seen too many times There is a tendency to Maybe assume that everybody is going to use the application the way that you want it to be used But a lot of times we need to take care of cyber security. So what do? Security people want Security people want low-risk code meaning that it you know doesn't do More or less than it should do running on hardened servers in a controlled environment with constant vigilance and Proving compliance. So let's break that down a little bit low-risk code is the guarantee or close to a guarantee that the Way that you write your applications is using good coding practices. It's using the The latest technologies but in a way that's safe to do and it is not going to allow for Weaknesses in the code to be exploited So that the application might be used to do other things Running on hardened servers means that the servers that we are running on are Dedicated for the set of applications that we want them to run on and that they are not susceptible to excess administrative action That they are not susceptible to misuse and that is there is relatively or as much as we can guarantee No backdoors and no misconfigurations that will allow those servers to execute A controlled environment is the same thing just scaled up So our entire data center from physical security if you're running your own data center to Security in the cloud to multi-tenancy to backup to recovery All the services that are used to guarantee the sustainability of the application and constant vigilance which is a term that encompasses a lot of things means that Security needs to guarantee that we know what's running. We know who's running it We know under what circumstance. It's running. We can see what happens. There is auditing in place There is a lot of elements that deals with just monitoring how things run not for you know, CPU usage or memory usage or the the scalability but for security the ability to to really understand and then do root cause analysis, right all the Intrusions that we've seen over the last few years all had to be analyzed and over analyzed And we need to make sure that we know exactly what happened and then proving compliance is kind of the odd job of security professionals nobody likes to Issue reports about the inventory of situ of the the applications What the maintenance window is? whether or not we've changed passwords or we don't have a password that is admin like somebody did not too long ago and Really getting to a point where you can certify that whatever that you're running is running based on compliance, right? So again so far so good. It's really simple I know that you feel like super dumb right now, but that is the basics of Security and you really got to understand Where security people are coming from because all the things that they request from Developers from operations really come to address these now There are other things that are not here because they they deal with user security endpoint security You know don't click links and emails and all the other good stuff that happens But from a data center operations, this is this is what what we're dealing with so how does that fit into? The DevOps process right because so far the previous slides had a little bit of a waterfall situation as far as the rollout of the application We start with the code. We also do a server and and eventually they meet what happens when infrastructure is code What happens when code is infrastructure? What happens when we start to? automate things in a very fast moving way where we fail often where we do agile development when we have Multiple releases of the applications when we run in the DevOps and not even containers even even DevOps pre containers there is still a lot of Elements that are kind of killing the security model and in return security is probably going to kill the DevOps model because if you try to introduce The existing security controls or the security controls that security people expect into a DevOps process Things start to break down if we need to analyze Our code and it needs to be done in a tool. That's not integrated into the environment That means that there is a break in the chain if we need to have configuration management done Before the infrastructure as a code runs before we have our automation Build our server and then we want to start to deploy on it immediately because that's part of the same function If we have to stop and ask for configuration management, that's a break in the process And the same thing with network with host access controls. How do we separate automations from humans? How do we make sure that our intrusion prevention and protection is still laid intact when everything is? moving so fast, so I put DevSecOps as a question mark because I Have the feeling that everybody pays lip service to the idea of this DevSecOps It would be really nice if everybody collaborated and talked together But it is really really difficult and I have experienced with organizations that we work with and I think everybody has their own story either from the security side talking to DevOps or from DevOps talking to security and really not being on the same wavelength and that's that's pretty much the Problem with DevSecOps today and that it's hard. Those are different domain expertise automation Enterprise management data center management are things that deal with Aspects of IT that are very different than what security deals with. There are different motivations You get measured in different ways in your organization different cost structures And and all of the things that are just different domain expertise all together Another thing is that security is not really automation friendly Security controls are by their nature a little bit messy. There's a lot of opinions in there Vulnerability management, for instance, is not a clear-cut operation. There's no good or bad. There is good until we Get some mitigation on it or bad until we have a way to deal with some of the Risks that we have in in vulnerabilities Even configuration management we always deal with exceptions. They're always rules, but they're always broken. So there's not a lot of clear-cut answers that can be answered by a program and security is not really automation friendly And the flip side of that is the DevOps is built for speed. We need to deploy quickly We need to to get our applications out there And it is not easy to do that when we have security as gates preventing us from doing what we need to do And then we add on top of that Dynamic cloud environments that deal with constant change And the predictability is not there and there's nothing that security people hate more than not being able to predict and not being Able to do something and then make sure that it doesn't change anymore. So DevOps is hard There is though something that is Going to be very counter-intuitive and that is that as we move to more Containerized environment as we move towards the delivery of microservices It seems to be a continuation of this mess because now we've taken at least three aspects of the DevOps process and kind of merged them into one right so we not only Have infrastructure as code and code as infrastructure. They're actually all pulled together in one image, right? Your image now has infrastructure. It has An operating system. It has prerequisite software. It has your own application The way that it's rolled out is rolled out with with automation So now we've rolled out and compressed the ability to deliver our applications in an automated way The consumption of application is still there, you know, the hackers are still there It's still being attacked more or less the same way, but the way it's delivered is really really different So it's it's a problem and and the knee-jerk reaction of security organizations when when we start to convert some of our Applications to microservices roll them in DC OS with orchestration underneath is to basically say no, right? We just don't want to deal with this too too much too much change too much of a sensory overload how do we actually get get from under that and There's got to be some way in which you guys who are DevOps people I assume we'll need to engage with security people and Come to terms with the fact that this is a really big disruption to To running it so where does that leave us? It leaves us first of all with security on the outside looking in so all those services that were you know A little bit disruptive or annoying with pre-container DevOps are almost done right impossible with post-container DevOps It's it's very hard to do static code analysis or stop for understanding what the networking requirements of an application is or how to Monitor the environment for intrusion on how to do configuration management Where everything is bundled together everything is shipped together everything is running on the same host everything is broken apart to microservices and there's a lot of API work around that so the old model is just not going to work and just Psychologically, you really need to understand that the when when you start to do a containerization effort when you start to do a Migration of the application. It's really going to cause real stress to security people so Let's flip a page a little bit and see what is really our way to maybe make things a little bit better So here's a promise what what if we can actually merge that what if we can actually make security part of the process and not having it from the outside Looking in and I want to propose two scenarios to you. One is a very security operated Security program oriented approach and the other one is more of a pipeline approach and we'll explore this together a little bit and see See where we get to so the way that Remember what security people want they want safe code Unhardened servers in a controlled environment with vigilance and compliance So let's put a security program in place that is using the inherent Properties of containerized applications to deal with some of those those aspects So the first thing is is running secure code. How do you run secure code? Well, we do code analysis and there are services out there There are a lot of times are being used today in the pre-container world or in the DevOps pre-container world to do code analysis your vera codes of the world and so on those are Services that are pretty well integrated into the DevOps process. There was usually in your in your tools that do Compilation in the tools that do the packaging there's usually a step out there that does the code analysis And that's pretty well integrated and that's actually should be our model, right? because that part because it's been with us for a long time is Actually a model that we can employ to Use with other parts of the containerized environment, and I'm talking specifically about the base Operating system and the base images that we're going to use to build our containers on and if you think about Why why are we having this this step and why not just you know do?  There are regulations that need some hardening There are vulnerability assessment things all these need to be part of the deployment of an image so one of the things that we see and we talked to a lot of organizations is that the practice of having a pipeline for base images is starting to emerge as a way to kind of jump start the collaboration between Dev Ops and security because that's an area that everybody can agree on and there's some know-how in the organization So how do we actually do that? We take the people that used to build servers, you know the ones from the kind of middle of the the waterfall process and take That organizational know-how the processes of what vulnerabilities should not be there. What is a good configuration? What is your password policy? What is your naming convention? What is your? Key strength all of those can be co-opted and can be put together to create your own base images and we start a cycle there and you're gonna see that does those these arrows that kind of do a cycle here because The same way that you will you know fail a code analysis and then have to fix your code and you run it through it again Until you get it right is the same way that we're gonna do our base images We're gonna take something maybe off the internet we're gonna take a sent us image or a boom to image or Alpine image and we're gonna test it for compliance with the organizational needs and We're gonna build on it and we're gonna have some iterations assessing the risk again and again until we get to a Configuration that is gonna be at least from a security point of view pretty much the same as your servers used to be Because we know that those servers are in line with your with your policies And that's a great way to do a little bit of collaboration with security on and stuff that is Probably don't matter to you as much right because it's it's not your code Once we have the this system in place What we want to do is we want to build an image that is actually going to be that image That's gonna run as our container and we do the same iteration again We're gonna do the image risk and the image build Until at the other side of the pipeline we get an image that is Absolutely tailored to both your application, but also for the organization security needs and that means Reducing bloat that means that the image really should have the minimal moving parts that it needs to do its job That means that the image is gonna be well configured. That means that we have the right Security posture to it and remember this has to go up with reports right the same way that security people needs to provide For compliance reason, what is the state of the server environment? We anticipate that eventually they're going to need to provide what is the state of the image environment So might as well do that and gather that that information Because of the nature of containers from there on it's really just preventing Deviation from that image so as containers are being rolled out We want to make sure that there is integrity so that What you put in the registry and pull to the registry is the exact same image So you know sign your images calculate hashes of your images, you know Make sure that you follow the image ID basically make sure along the way that you have some integrity of the image and then once you're deploying it Really this should not have any more disruptions in it. There should not be any human interaction There shouldn't be any more patching. They shouldn't be any more Touching of the image there really nobody should exact into any container Nobody should even SSH into any node that is running in the in in the the data center And that's actually that represents one of the biggest changes for security because their role basically stops, you know about three quarters away from the Left-hand side of the slide once something goes into production There's really little way in which we can affect change on it and by change We mean even fix things that that that may be broken and we got to get in the habit of fixing security problems In the pipeline and if we need to fix a security problem that's been discovered afterwards to actually go and do that From from the pipeline so let's take a look at patching as an example of that when we talk about patching again We audit the server we have we found that there is a configuration problem on a server And we're talking pre-container. What do we do? We go into patch the server We update a package or we change a file or we we update that server in production means maintenance windows means Disruption means downtime means we need to audit we need to see what administrators did on it So there's actually a lot of trouble that goes on with patching Contrast that with the ability to identify that there may be a vulnerability or something wrong with an image down the line in production Let's leave it where it is go back. Let's say to our base image Update the packages on the base image so the next next shell shock of the world comes on We need to update our bash in all our images Instead of going to a thousand servers and update that manually or have something like chef or puppet or answer We'll actually try and do that Let's patch our base image run our CI because that's going to be very predictable and then slowly You know DCOS marathon Kubernetes is going to deploy that new patch over in the environment That's something that is very hard to secure for security people to understand But once they understand it it it really points out that all the benefits that we know about running micro services Can actually be extended to security and all the things that we know and like About DCS about marathon about about Kubernetes the ability to automate things on a large scale Security can co-op that and actually make it part of That of the flow to fix security problem So this is this is the DevSecOps security programs if we are being Container oriented the things to remember is we need to make sure that we have a good base image program And we need to make sure that we understand where security stops and that is as the the images is deployed We really don't have a way to affect it. So anything that we need to fix has to go back to the the beginning So that's that's one picture Another way to look at things is from a pipeline point of view And I think that's probably going to be a little bit more relevant to to how you actually operationalize this this whole thing so This is our pipeline And our pipeline has distinct phases, you know build chip run whatever the flavor between two two and three of those but basically Securing the build phase when when when we have an image what do we need to do? So as we said use an organization endorsed base image that has already been corrected and published And it's not just base image. It could be a library of this base images You could have your basic sent us basic sent us plus Java lean and mean go go and do it basic image plus node JDK JRE all these web technology can be packaged together and be made available and create consistency across your development streams And not it's not only going to be good operationally. It's actually going to be good for for security We need to evaluate the risk based on both configuration and Content so what you put in the image besides the executables. Did you leave an SSH key in it? Do you have? The right controls is your HTTP server Managed with SSL certificates. Where do the SSL certificates come from? How do we actually mount them and that we'll talk about a little bit later when we talk about secrets But basically what's in the image is important because those are going to be distributed Along the the pipeline and may result in a in a large footprint along all the servers Scan for vulnerabilities. That's usually what people are concentrated in but scan them against a policy Don't just you know send me an email with all the vulnerabilities that I have in my image because if everybody has The the service on the Docker hub where you get your vulnerabilities Does it make any sense to you?  No, because there is really no Straight way to know that because we need to compare it against the organ the the Paul the organizations policy for Vulnerability and something that might be relevant to one group of of services may not be relevant to another group of service So scan for vulnerabilities, but evaluated Against a policy and then make sure that everybody's on the same page There are the information. Let's say about an image is what that image is what it contains. What is it going to run? What's the entry point? What's the vulnerability posture what the risk posture of the image that those bits and pieces are Going to be at different places And we got to make sure that everybody's on the same page at both development and security and operations Know that this image is good enough to run because it has the right entry point We've assessed it We know what the risk posture is the risk posture is relevant to what that image is going to do if that image is in scope for Pick your favorite regulation PCI HIPAA whatever that is We need to make sure that that is the right way and everybody should agree that this image is good enough to run And that usually happens from again the CI side Probably at the end of the build going into test, right? We don't want to waste test time on images that are eventually going to be out of compliance for for the organization The next step is to start to accept only those known trusted images that we've been that have been through the Evaluation process into your test and then beyond in the pipeline So only accept note images approve images based on the risk again relevant to the environment that it's going to run in Maintain the integrity of the image. So sign it take ashes of it Do whatever you need to do in order to make sure that that is the same image And then start to keep inventory, right? One of the things that security needs to provide is measurement of control measurement of compliance inventorying and Understanding what has been pulled where what is running where is an important part of the process the next thing is to operationally as we start to then deploy things into our data center into our clusters is to differentiate between what's going to be out of automation which is More predictable less error prone than what humans can do even though there could be errors in automation and we've all seen those But they are a lot more predictable So if things go bad, they go really really bad and if things go well usually they go well But we need to separate what is automation and what is human and that's really really important because one of the things one of the artifacts of this whole program is that your auditing becomes binary everything that you Get out of your container system is either something that is part of the application part of the intended use or deployment of the application or something that is not and I think it's kind of a good time to tell you a little bit story and Imagine yourself as working in a security operation center and you get all these screens and everything is is Flushing you know logs of everything and suddenly you have a cluster and there's a lot of of Networking events and suddenly you see on one of your production servers that runs an application a you know call out to I Don't know Google for a search or trying to get into a Microsoft website or to a Linux website Or basically anything out of that server. So that's usually out of the ordinary right a production server should not kind of you know Send an HTTP request outwards or at least attempt to do that the question on the security operation center is What what is the significance of that? Is it good? Is it bad? Should I be worried right every security professional in their head is going to do an immediate triage on that and The question is well, I don't want to raise alarms because it's it's a pretty harmless operation Especially if it goes into a familiar site and not somewhere in Russia But on the other hand, you know, is it in the maintenance window? Is it something that an administrator might do? Maybe somebody's debugging a problem and they had to go on the server and while they're on the server They you know used a curl command to search something or to upload a file. So there could be a lot of Situations where it's a gray area. We really don't know if it's a problem yet That's the problem of separating human action and dealing with people that have to go in a server environment And actually do things that even though we think that we run a very automated environment in the cloud and everything is scripted And everything is code. There is always going to be that instance where somebody needs to fix a problem And they're going to go on a host and actually fix it That really should not happen in containers, right? Because even the most fundamental Problems with containers is take that note offline your automation is going to spring up another node so we're not going to lose service and Let's debug this offline so so separating those those automation from human actions is something that is very fundamental to the way that we run With microservices and with containers and with that now that we control human action. We can control privilege elevation We can make sure that whatever is running inside of the containers Nobody patches them nobody adds software to them and we also need a continuous audit trail off the containerized environment so that we have a good understanding of what is a human operation versus and and an automated operation and that is going to be really what's going to eventually Create a lot of trust between development and ops and security is the fact that if we put out all the rules up front We're going to get a situation where all our data is such that it's very easy to decide if something is bad or not And we don't have to do that triage and do all this data management in the security operation center And that extends into what containers are running so so keep track of the user context in containers understand what is the appropriate level of access that you should get inside of the application if you can use a Service account to run the application Please use a service account to run the application do not think that you can run everything on the route Limit your executables of what you have in the image to only the approved functions something that is really needed so don't don't put a whole bunch of just a bin directory from your vanilla flavor or eunuchs in something that maybe needs RM LS and you know ping and Make sure that you have some context to where network controls, right? So there's a benefit talks this this week and and the the networking the ability to put overlay networks the ability to associate containers even on the same host with the right Networking controls is important and then secrets management Because we can't put anything sensitive in the image We have to distribute that in real time into the containers and luckily for us all the major orchestration tools Have the ability to then have secrets management and that's something that Can be augmented with third-party solutions and you can even integrate it with your Organizational secrets management in case you need to access services that are outside where your environment is So if we do all that we start to give security what they actually want right because we can give them low-risk code on Hardened images not hardened servers anymore hardened images by the way the servers themselves. They're going to be hardened by your Clusters, they're going to be hardened by the manufacturers of the operating systems Mesa's fever is going to take care of the hardening of the orchestration tool the fact that nodes can communicate securely Docker does a lot of good things with making sure that Docker nodes can communicate securely in Kubernetes at the far end Who has trust between nodes so that there's a level of hardening on the platform itself That needs to extend into the image so that we have good overlay on the image Controlled environment doesn't you're not going to have a more controlled predictable and secure environment if you do containers the right way and that is something that we start to educate security people on because we need to give them the tools to then go to their management and prove that There is security and there is compliance in the system and then the constant vigilance becomes a lot easier because now We don't have that gray area again if we do this right every time something needs to be stopped That means that it's not part of the application. There's not going to be triage anymore We don't need mountains of data in a security operation center when we talk about containerized environment We can pretty much predict what we're going to be Part of the application and what's not so I'm going to leave some time for questions But one summary slide which is about communication so Please talk to your security colleagues Understand what your security needs are right the security needs of a bank are different than the security needs of a hospital And are different than the security needs of a manufacturer. There are some basic things that everybody should uphold but the level of Security might be be different ask about compliance really try to try to ask what security people need to convey further Either to compliance or to their own management and please offer your expertise around automation Tell them what automations can do for them. Tell them that there is a great deal of benefit that can come from given the patch Management example or give them the ability to view the containerized environment You know in a containerized Environment again if it's well built it's pretty self-documented We don't need cmdb's anymore with a lot of data on them And if they still resist tell them that I said that containers are good for security because they truly are and I was convinced basically The five minutes after I did my first docker run command it Shocked me and then later. I said well that actually is really cool But we're going to need to do a lot of education. So please be patient with your security people please understand what the motivations are please offer your support and Whatever you do Don't steam don't don't don't steamroll over them because at one point even if you do get the permission to run your Application or start your your containerization project at one point you're going to hit compliance and you can steamroll security You really can't steamroll compliance. So that that's my sub box. Thank you very much. I'm going to open it up for questions Yes, sir Yeah, so so no They're counterintuitive if you try to think like this that's that's where the problem is and I think security is still Stuck in this model where everything happens sequentially where there are Distinct gates between things when there is time to do things when there is When security basically had more clout, you know, maybe 10 15 years ago That's where I think the mindset of more security and compliance people is I think what we need to do is we need to tell Them that they can execute even a better version of this model in the DevOps world With containers because the middle part of trying to do security where where all these things are are Automated and fast, but also in a server environment that is that is very prone to change and Where you still have administrative action where we're so so that that's the middle world of DevOps before containers is is where we have a problem and and my view is that we can execute a model that is going to kind of leapfrog that with containers and And break that that problem so think think think think about the the tolerance for change, right, so so Well, the problem is that there's still a lot of moving parts there And I think it's the distinction is that you're still running a configuration tool to configure Servers that are still multipurpose where there are still a lot of processes that run on them that may or may not be needed For the application that is put on them. And there's a lot more noise There's a lot more complexity in there that makes it hard for security to discern between Lawful and unlawful operations. Oh, we're getting there No, but but look if so think think think about it this way in Maybe in the organization you run a super controlled super tight super predictable DevOps, which is awesome But in most organization what's going to happen is that the way to put that discipline into the real world is Where containers come in because you cannot? Run in any other way a server that is single purpose and dedicated Because once you got the image running and it has an entry point then as you deploy it It's going to remain the same only in super tight super control organizations do the DevOps of servers and the provisioning of machines happen in such a way that that it does remain the same as the day It was provisioned awesome Any more questions? Yes, sir. Well, does it give you code host operations and cyber security? Yeah, so so that's that's where there's really no right answer right in in most organizations What we found is that? Docker is going to take care of Docker So the security of the platform is awesome on the other hand, you know 80% 90% of the code That's going to run in a cluster is not going to be dockers. It's going to be your code So how do you protect your code vulnerability management is one thing? configuration management which Docker doesn't touch the ability to Identify images so image signing is one of them But image signing only tell you that they're intact and who provisioned them. It doesn't really associated with risk so there are some things where Docker security is going to fill a lot of those requirements It may not be the whole picture, but that's okay a single service usually doesn't fill the whole picture But it's but it don't don't go into a discussion with your security people and telling them Okay, Docker is going to take care of all my security because that's factually not true And they're going to see right through it and then you're going to lose credibility, right? So so we got to understand tell us what your security requirements is I'll tell you what Docker can answer and if we need to fill those gaps with policy with with solutions with Open-source solutions, whatever then then we can do that and that makes the discussion a lot more intelligent Yes, sir So I think it's a multi-pronged approach, right? We need to scan the images now It's it's not just that humans are fallible It's also that over time things get discovered that you might have not seen before right so we need to understand what our Risk posture for an images continue to evaluate it all the time and see if something needs to change in our replacing or patching but also the way that the way that containers are run If we reduce the bloat if we reduce the attack surface the less stuff that we put in an image The less stuff can be exploited the less stuff is subject to to to to vulnerabilities. So one of the things that I personally am not a big fan of is to Scan actually running containers all the time because that's a very costly operation CPU resources and so on so I'm more of a proponent of Let's make sure that we have good control over the integrity of the images and of the containers as they are run and Then if we know the risk posture of an image, we're then able to Reflect on the containers that run from it and extrapolate that data and find that That vulnerability in the container So it's it's an operational model that that relies on the fact that that the the lifespan of containers is fairly short and We're able to replace them and we're able to replace them on a large scale So if we if we do good assessments of the image we can then roll them out Well, I'm not I'm not saying that the container is gonna run But but we've seen that people release Multiple times a day and it's not because containers are not gonna run for very long But because just the way that software is is updated. They're just gonna be replaced over time I would also say that that so in principle I agree with you that that containers don't have to basically be replaced but what we've seen in reality is that because of release cycles and Because of the fact that you run with orchestration that is free to kind of move containers around and when they do that They actually re instantiate them from the image so so the The life's the lifespan of container is Relatively short especially when when when concerned with with servers But that's really where we are right if we if we limit what's in the image to begin with and then not allow any addition executables or or administrative action on a container We can With a great degree of confidence make sure that we do our security vulnerability assessment Ongoing on the images and that will give us an accurate picture of where we are vulnerability-wise on the Containers and if something needs to be fixed we can fix the image and then roll a new version of all the containers As see you're not convinced Well, you Know no see so is gonna ever tell you that they're damn center about everything Okay, well, okay when I say should I actually mean that 99 plus percent. Okay, that's that's that's where I am but but What's one thing that you'll see with security professionals that we are we are a non-committal bunch because we've been burned so many times All right people I'm standing between you and beer so Thank you very much


Family Theater presents Esther Williams and Richard Denning. From Hollywood, the Mutual Network in Cooperation with Family Theater presents Double Crossing, starring Richard Denning. And now, here is your hostess, Esther Williams. Thank you, Tony LaFranco. Family Theater's only purpose is to bring to everyone's attention a practice that must become an important part of our lives if we are to win peace for ourselves, peace for our families and peace for the world. Family Theater urges you to pray. Pray together as a family. And now, to our transcribed drama, Double Crossing, starring Richard Denning as Steven and featuring Alan Reed as Luke. Come in. Good morning, sir. Coffee? Oh, yes. Thank you, Stuart. For you, sugar. Black one lump. First mate Thompson. Oh, yes, doctor. I was about to stop in your cabin. How's the skipper this morning? Is he having any pain? Well, even so, you give him my compliments and say that if he puts one foot out of bed for the rest of the crossing, he'll have a mutiny on his hands. Yes, yes. Tell him I'll look in later. Bye, doctor. Excuse me, sir. Yes? I couldn't help overhearing your conversation just now about the captain. Oh, he seems to be much better this morning. Oh, I'm glad to hear that, sir. It's not a pen to cite us, after all. Come in. Are you the captain of this floating squirrel cage? Why, no, ma'am. I want to see the captain now. Excuse me, sir. I'll clear the coffee things off your desk. Oh, thank you. Well, I'm afraid that'll be impossible, ma'am. You see, the captain's quite ill. Then who's next in charge around here? Why, customarily, the first mate. Excuse me, ma'am. Oh, not at all. Mr. Stephen Thompson. And where is he? At your service, miss. Sinclair. How do you do? Very poorly. Oh, you're Thompson. Yes, ma'am. Well, now perhaps I'll get some action. How can I help you? Debra, she's vanished. Debra's vanished. I've looked everywhere. The promenade deck, the A deck, the B deck. I see. And I know she must be starving.  Oh, I understand. Well, perhaps she just wandered down to the galley. Never you fear, they'll give her some meat scraps and water. Meat scraps and water? Well, they're quite good about that. My airdale loves to make this crossing. Debra is not an airdale. Oh, I didn't expect so. That would be a coincidence, wouldn't it? Mr. Thompson, you don't seem to understand. Now, don't worry, Miss Sinclair. We'll find your Debra for you. Approximately what size is she? She stands just a shade over four feet. You mean on all fours? She doesn't travel on all fours. Debra is my 11-year-old sister. Your sister? As I've been trying to tell you. But you said she eats dog biscuits. She likes dog biscuits. They're good for the teeth. Miss Sinclair, I'm a busy man.  I'm looking for my sister. Well, an 11-year-old child doesn't get lost on an ocean liner. She'll turn up some... She will not turn up until we find her. What do you mean? She's hiding. She's having one of her moods again. Oh, it's a game. It's not a game. Debra is a very imaginative child. She has a potential IQ of 135. What do you mean potential? She still can't read well enough to take the test. She sounds brilliant. Well, she's got to be found. All right. I'll make an announcement over the loudspeaker for the ship's personnel to be on the lookout for her. I don't think that'll do it. Miss Sinclair, I'm up to my ears and problems. The captain is sick in bed with acute indigestion. I have a customs report here on my desk to be on the lookout for a suspected smuggler who... Oh, what's wrong? I swear I brought it down from the captain's quarters last night. Oh, you've lost something? Yes, that customs report. Well, that makes two of us. Because I've lost something. My kid's sister. All right. And you've got to find her. We'll make every effort, Miss Sinclair. Believe me. I'll believe you, Mr. Thompson, when you produce her. Hello. It's me. Yeah? Let me in, let me in. I've got it. No kidding. What do you got? Where's Mrs. Harrison? She's shaving. I just got back from breakfast. In there? Yeah. Pancakes. Oh, hello, Bobby. You look cute without your white wig. Oh, I'll cut the comedy. Yeah, yeah. Cut the comedy. I'll bash you. I got the report. Now, let's see. Yeah, I want I should bash him one, Mitch. Yeah, simmer down. Looks pretty complete. I'm feeling right for it. I just had breakfast. What? Pancakes. They've got much dope on you. They've got it all. Arrests, convictions, aliases. How'd you get this? Sneaked it out of the first mate's office. You'd better get it back there before he misses it. What's it say in the letter, Mitch? It says the customs boys in New York are going to be waiting. Them customs bums, they're so smart. They are. Yeah, yeah.  Sure, sure. You're going to use the same plan, then. Yeah, yeah. That's how smart they are.  Sure. Them bums. Keep it the way it is for the time being. Good enough. I'll have Luke take me for a stroll around the deck this afternoon and get the people used to seeing the wheelchair. It's a good idea, and I... And what was that? What? Sounded like a cough right here in the room. It wasn't me. I don't hear anything now. I never cough. I never even get a sore throat. Okay, okay.  You told me all about it. Would you clam up? Sure. Measles. I guess I must be hearing things. Maybe it was something in the ventilators. They often make no... That wasn't something in the ventilators. It was a cough. Seemed to come from over here by the bed. If it's someone coughing, they got a cold. Button up, would you? I'm buttoning, buttoning. There's someone under the bed. Cover up, Luke. Hey, you bet with my heater. You, come out of there. Hey. It's a little girly. Oh, what have you got to say for yourself? Good morning. There, good morning to you. Knock it off. I was weird always to answer politely. Will you hang up? Sure, when spoken to. How long have you been in here under the bed? Well, about an hour. I'm a stowaway. I bet this is the kid they're looking for. Who's looking for? I heard an announcement over the speaker on my way down here. Didn't say who. Nobody's looking for me. I'm an orphan. I sneaked under the boat three nights ago in Kidney Pool. What? She means Liverpool. Kidney Pool. Well, that's sick. Well, I was close. You see the Kidneys.  I've been sleeping in a smokestack. This kid's got a couple of boats loose. Look at those clothes. She's an orphan like I'm Gary Cooper.  All right, all right, Luke. That's what I mean. Gary Cooper's a big tall guy in the movies. Luke, what are you saying is he ain't Gary Cooper? He sure is. If his name's Eddie here, it's how smart he is. Would you forget it? Coming around here with a story like that.  Well, I am an orphan. My parents died two years before I was born. Do you tell him, Gary?  I take our best, you one after all. If they died two years before she was born, they were into parents. Simmer down both of you, I got an idea. All right. If they were in her parents, who were they? You're so smart. How would I know? You for the last time will you not get off and listen to me? Sure. Gary Cooper. And where was it you found her, Edwards? In Mrs. Harrison's stateroom, sir. The elderly white-haired lady who came aboard in the wheelchair. She's not a lady. She's a man with a big, deep voice. Deborah. I can see what you're up against, Miss Sinclair. She is. And she's a smuggler too. I mean, he is. I'm afraid, sir, that glass can be traced to the letter that Mrs. Harrison noticed was stuck to the bottom of my tray. Undoubtedly. We had to read it to determine its owner. Naturally, Edwards. I understand. I'm sorry, sir, roughly handle that. Not at all. Glad to have it back. And our storeway here. Incidentally, Mr. Thompson, Mrs. Harrison promised not to breathe the word of its contents. Oh, fine. And neither, of course, will I. He's in with him. Deborah. That's quite all right, ma'am. I have a son about this age who's equally imaginative. Deborah, I won't listen to any more of these lies. They aren't lies. You be quiet. I think that'll be all, Edwards, but thank you very much. Not at all, Mr. Thompson. I can't tell you how sorry I am. Don't mention it, ma'am. Only too happy. Goodbye, Mr. away.  I heard you. Deborah, that's enough. Pleasant crossing, Mrs. Sinclair. Thank you. Well... Now wait, Mrs. Sinclair. Losing your temper won't help. Patsy, they're all smugglers. All three of them. Deborah. May I, Mrs. Sinclair? Would you mind? Go ahead. Deborah. They're all crooks. Just as you are an orphan and a stowaway? No. That was make-believe, wasn't it? Yes, ma'am. Let me finish. Do you understand the difference between make-believe and fibbing? I'm not fibbing. Make-believe is when you pretend to yourself that the world is not as it is. Fibbing is when you pretend the same thing to others. Do you see the difference? All three of them are crooks.  I'm too old for a spanking. You're too old to be making up stories, too. I'm hungry.  I'll do better than that. I'll put you on a leash. The big one's name is Luke and he had pancakes for breakfast. That's enough. You come along with me. Mrs. Sinclair. I'm very sorry, Mr. Thompson. Oh, you mustn't feel that way. It's been a... Well, it's been pleasant, really. Really? Really. Well, thank you. And speaking of breakfast, do you have any plans for dinner? We plan to eat it. Deborah. Well, in that case, would you consider eating it with me? Why, that's very kind of you. We'd love to, wouldn't we, Deborah? I don't know. We'd love to, Deborah. Isn't that so? Of course. You're raking my fingers. Well, then I'll join you in the dining room at, let's say, seven o'clock. That'll be perfect. More coffee? No, thanks, Dee.  That's bad. I say more coffee, and you say no thanks, but I forget and pour it anyway, and you drink it. Yes, I know. Anything wrong, Pat? Oh, I just don't like to see it end. That isn't going to. Well, I mean, the crossing will be in New York tomorrow morning. Yes, and by tomorrow night, we'll be in Philadelphia, letting your parents scrutinize me closer. You make it sound like you're going to the gallows. Are they any relation to the Sinclairs? Oh! Oh, come on. It's not that bad. Oh, it's a word. Are you suggesting that I keep my ready wit and check on this first visit? Oh, no. It's one of your most appealing characteristics. Well, I hope my appeal registers better with your folks than it has with Deborah. Oh, she... You mustn't mind that, Steve. She's still pouting because I told her I don't like little girls who tell fibs. Oh, that's about the size of it. And, well, this may sound as though I'm defending her, but she's so stubborn about insisting it's not a fib that I really think she's convinced herself it's true. Well, you told me that's a favorite trick of hers. Yes, but usually she gives up once she's caught in the fib. This time, though, she's hanging on like grim death. That man who pushes Mrs. Harrison around on the wheelchair is named Luke and he carries a great big gun. Oh, brother. And the old lady herself is Mitch. It's Mitch this and Mitch that. Is that the name she said, Mitch? Yes, why? Wait a minute. What? I want to take another look at that customs report. Oh, is there anything wrong? I don't know, but, well, see this list of aliases the man is supposed to have used? Jones, Reed, Wolfe, Gilbert. And his real name is Waldo M. Brown. M for Mitchell. All right. Is that written there? See? In parentheses. Well, the steward told you that Deborah heard him and Mrs. Harrison going over the letter to find out who it was. Well, even so. Mitch. That's an odd piece of information to remember just from overhearing a list of names. Do you think there's a chance she could be telling the truth after all? I don't know. Where is she, up in your statement? Sulking in her tent and eating dog biscuits. And she still says the whole story about Mrs. Harrison being a man and a woman's wig is true? Well, to be honest, she stopped saying much of anything. All she does is sit on the couch and glare at me from behind a comic book. Come on, let's go up and talk to her. Deborah? Deborah? Isn't she here? Oh, she must be. I told her. Deborah? Well, maybe she went out for a walk or something. Oh, my gosh. Look on her pillow. What is it? A note? Oh, of all the nonsense. What's the word? Oh, good grief. Let me see it. I should have put her on a leash. Dear Patsy, I'm not a fibber. I don't fib. I only make believe. They're all crooks and Sam mugg... What's this word? Sam mugglers. All crooks and Sam mugglers and your steward... And your steward? Your steward, Eddie, is to a crook. Is to a crook? Is to a crook. And I'll prove it within an inch of my life. Oh, Steve. It was very truly Deborah Sinclair. Oh, what's she done? What does she mean? It doesn't make a bit of sense to me. Well, she's gone.  Well, now, take it easy, take it easy. We'll find her. Oh, what does that mean? She'll prove it. Honey, I don't know, but we'll find her. We did it once and we'll do it again. Who is it? It's me, Eddie. Hello, Luke.  You can go away. You better let me in. You can go away, will you? I'm with the FBI. Don't go on. Get out of here.  Oh, no, I'm not. Huh? I'm like those people who are communists for the FBI. So you are not. Sure I am. I'm a little girl for the FBI, but I'm really a big girl. Yeah, you don't look so big to me. I'm a little girl for the FBI. I'm a little girl for the FBI, but I'm really a big girl. You don't look so big to me. Hey, look. What are you letting Eddie stand out there for? It ain't Eddie. What are you talking about? See? Get her in here. She says she's a little girl for the FBI. You clown. What'd you open the door for? I thought it was Eddie. Why would I cave your skull in? Well, that's who she said it was. Oh, you really fixed us good. And now we're stuck with her until we get off the boat. I didn't want no trouble with the Federals.  We gotta think. See who it is. Yeah. You make a peep, girlie. I'll feed you to the fishes. Yeah, who is it? It's Eddie. Let him in. Well, I didn't know the last time I let him in it was her. Would you let him in it? I'm trying to use your head. There's just no police in you today. Listen, something's up. I just saw the first meeting that Sinclair girl. Oh, but this is what they're looking for. Uh-oh. You're all smugglers and crooks. What do you think we ought to do, Eddie? Let me take it back right now. I'll say I found her walking around the observation deck. It won't work. What are you talking about? I left a note for the FBI. You see? What did I tell you, Mitch?  And it proves you're all crooks. You're all surrounded. Put up your hands. It's a chronic liar, Mitch. Let me take it back. I don't know. It might not work twice. It's the only chance you've got. You can't keep it here. Why not? There's room. She could sleep on the couch. It's gotten up. I'm trying to think. No, Mitch. If she's gone much longer, they'll go over the ship with a fine tooth comb. I don't know. Whoever it is, get rid of them, Luke. Let's get over here behind the door. What if it's the first meeting that Sinclair girl? Yeah, yeah. What do I say? Call out. Wait a minute and don't sound nervous. Wait a minute and don't sound nervous. I just said what you said.  If it's Thompson and the girl, say you haven't seen her little sister since sometime yesterday at lunch. You're sorry, but I'm not feeling well. You have to give me a sleeping pill. You got that? The sleeping pill. Okay. Open the door. Yeah? I'm first mate Thompson, and this is Miss Patricia Sinclair. How do you do? I haven't seen her since lunch. You got that? Whom haven't you seen? A little sister, a kid with the FBI. The FBI? And I'm sorry you're not feeling well, but I have to give Mitch a sleeping pill. Goodbye. Just a minute. Who's Mitch? Did I say Mitch? You did? I meant Mitch's. Mitch's Harrison, the old lady I worked for. But the first. With the white wig. I think you'd better let us in. I'd like to talk to her. You can't. She's asleep. Come on. Let him in. Bonehead and lock the door. I just said what you said. Deborah. Didn't I tell you there were crooks? No, Mitch's Harrison, I take it. You take it right. Sit down. Over there, the three of you. Cover him, Luke. Didn't I tell you she was a he? I'm glad you did, honey. What have you got in mind, Mitch? I got in mind to get off this boat when it talks tomorrow without any trouble. It's not going to be easy. You win this, too, Edwards.  I'll do the talking. What are we going to do? We can't keep them here. Yeah, I say push them to a porthole. It won't work. It's an inside cabin. What's wrong with that? They're inside portholes. Well, I figured to push them through the inside of the portholes. That's not what I mean. Well, where else could you push them? Luke, forget it. To the outside of the porthole?  I'm telling you. Sure. To the wall?  Mitch, you'd better face it. You can't keep us here indefinitely. You could be wrong, Thompson. They might not miss the two girls until after we dock tomorrow, but I'm temporary master of the ship. He's got a point, Mitch. If he's missing, they won't even let the boat dock till they find him. Maybe not. No, maybe about it. Climb up, climb up. I've got an idea. Luke, frisk him. Sure. Get his wallet. Everything out of his pocket and don't know what you've got in mind. I bet you don't. You know what you're going to do, mister? This is everything, Mitch. All right. What am I going to do?  What? Oh, you can't. Mitch, I'm not going to have any part of this. Why would he want to commit suicide? Will you calm down? Smuggling, yes. Murder, no. Who said anything about murder? How else can you do it? Well, if he don't want to go, we'll just have to send him. Will you climb up? There isn't going to be any murder. Well, then I can assure you there isn't going to be any suicide. That's right, Mr. Thompson. But for the next 12 hours, it's going to look like there was. What? Let's see that stuff, Luke. Yeah, yeah. Here. A wallet. Customs report. A note from Little Miss FBI. That's a personal letter. You shouldn't read it. Okay, honey. I won't read it. I'll just file it under unfinished business. I think I'm beginning to understand. Let's see if you do. I write a suicide note. All right. And you put it in my cabin, along with my wallet and other things. And your wrist watch. You can take that off right now, if you will. You're very thorough. I try. I try. Just lock us in here until you're off the boat.  And by the time they find us, you're free and clear. Not bad, huh? Not bad at all. But what if I won't write the suicide note? Then we'd have to get rough. Oh, not with you. You look like you could take all sorts of it. We'd have to get rough with the ladies. What do you want me to write? Deborah, will you please stop moving your feet around? Can I kick you again? You'll kick me again. I'm sorry.  It's always dark when the lights are out. Keep your feet to yourself. I'm sorry. Pat. Yes? Hold up your watch again. I want to strike a match.  Okay. Do you think they've delivered that phony suicide note yet? I know for a fact they haven't. They don't want to stir anything up until the last minute. When do we dock? In less than two hours. It's funny they didn't tie us up or anything. There isn't any need to until they leave for good. Say, what's this hanging on the wall? What? Okay, Eddie. Let's go. Why can't I go with it? Everyone has to stay here and make sure they don't bust out of the closet. Yeah, well, how come you got to go? To be a looker while Eddie's planting a note in Thompson's cabin. Look, would you quit trying to think?  That's because I ain't wearing my dress either. Oh.  All right. We'll be back in 15 minutes. There's just got to be a way to get out of here while they're gone.  Well, I don't see what to say. What is this? What's what? Hanging here on the wall. It feels like a corset or something. Let me see. Oh, it's just a life preserver. Really? Yes. It's one of those things you inflate by pushing a button. It blows it up in case you have to jump overboard to save yourself. Jump overboard. What? I think I've got it. It's worth trying, anyhow. What's worth trying? Those inside portholes. One of them opens onto a companion way and it's dark by now. What are you talking about? They turn off the lights at 3 a.m. Steve. Shh. Luke. Say, Luke. Yeah, what do you want? Do you have to point that gun right at my nose? Yeah, I wouldn't want it to go off and miss you. What do you want? Listen, this is going to disgrace me. What?  And now it'll turn out I not only haven't committed suicide, I haven't even tried to. Yeah? Is that fair? You make a liar out of me and wreck my whole life?  Of course not, but at least I want to make it look as if I tried. I could wing you in the shoulder. I've written a note saying I'm going to drown myself. I can't wind up shot. Oh, yeah. But what could I do? You could push me out a porthole. Do you drown? No, no, look. What's that? A life preserver. I could float for hours toward New York. Go on. I could. And then tomorrow afternoon just before I got picked up, I dropped the life preserver and say I swam in. That'd explain everything. Yeah, you might float in the head of the boat. Impossible. There's a strong headwind. I'm a first maid. I know all about this stuff. I don't know. Look, all I'm asking for is a break. Just push me through the porthole. I'll take my chances. Well, it's little enough. Okay, come on. Okay, so long, girls. Goodbye. We'll see you in New York. Say, wait a minute. Mitz said these were inside portholes. Well, sure, he's right. He is? Of course, but on the other side, they're outside portholes. No kidding. Any sailor knows that. That Mitz, you're always playing it so smart. That's all he knows. Yeah. They're only inside portholes from the inside, eh? That's right. Some wise guy. Well, he isn't. Well, let me open this one up here. How about him, Mr. Know-It-All? Would you mind hauling my life preserver while I climb through the porthole? Won't you need it right away? No, no, I can tread water until you throw it to me. Oh, okay. Well, thanks again. Here I go. Okay, Luke, throw me the life preserver. Hey, I didn't hear no splash when you hit the water. Of course not. You're in a soundproof cabin. But I heard a thump. That was when I kicked the side of the ship. The ship ain't soundproof? Just the cabins throw me the life preserver, huh? Yeah, here you go. Thanks. Boy, it's dark out tonight. Yeah. I thought he was here no stars or nothing. Well, that's because we're not on the starboard side of the ship. Is that right? Didn't Mitch tell you that? No. Oh, he's got a lot to learn. Yeah, that Mitch, he's so smart. Well, I better get started or I'll miss the Gulf Stream. Thanks a lot, Luke. Dad, don't mention it. You know, you've got a lot of nerve doing a thing like this. Oh, ain't that the truth? Damn! Who? Mom and Dad down under the door. Those my future in laws, huh? If they'll have you. Oh, there shouldn't be any trouble about that. I'm brave and genius. I round up smugglers. You and five able-bodied seamen. Carrying rifles, Janet.  That's something I want to ask you about, Steve. Mm-hmm, yes. Pat said you probably saved our lives last night. I said he did save our lives. Oh, now, girls. Well, you did. All I did was wait there in the companion wing to Luke close the porthole, and it was a simple case of rounding up an armed guard and placing him and the others under arrest. Well, that's what I want to ask you. What you told Luke? You mean about wanting to jump overboard and float into New York? Yes. Oh, that was marvelous. And the part about his not being able to see the stars. Because he was not the star for the side of the ship. Oh, I could hardly keep a straight face. Oh, excuse me. Debbie, what did you want? Well, I'd like to know. Was all that just make-believe? Oh, of course. Oh, are you fibbing? This is Esther Williams again. You know, each week we receive letters from listeners all over the country.  Recently, however, we received an unusually beautiful letter. It so completely sums up the entire purpose of family theater that we'd like to know and the entire purpose of family theater that we'd like to share it with you. Here it is. The other night, my husband should have been studying his physics and I should have been mending his socks. Instead, we were listening to the radio. Secretly, I was worrying. Will he be called to the service? Will we ever be able to have a home of our own? How much will it cost for a nice chicken for Christmas this year? Then, suddenly, I was aware of a friendly, calm, quiet voice saying something about prayer and God bless you. It was the family theater program. For a few still moments, I was aware of the most important kind of peace in the universe, the peace of God which passeth all understanding. You people on the family theater were very close to me. You were among my dearest friends, my most loved, well, somehow we all were with God. For a moment, I felt certain that the world isn't going to the dogs after all. The outworn proverb that says it's always darkest before the dawn suddenly seemed true. You made me feel that perhaps the dawn is just an hour away. Perhaps the world's distress is a kind of, well, a kind of spiritual labor pains and in a while, with faith in God's help, pain can be turned to joy. We'd like to take this opportunity to thank the writer and we hope that our program will mean as much to you as it did to her and that you too will experience what we mean when we say the family that prays together stays together.  From Hollywood Family Theater has brought you transcribed starring Richard Denning. Esther Williams was your hostess. Alan Reed was featured as Luke. Others in our cast were Charlotte Lawrence, Gayan Kelly, Lou Krugman, and Alec Finlayson. The script was written and directed for Family Theater by John T. Kelly with music composed and conducted by Harry Zimmerman. This series of Family Theater broadcasts is made possible by the thousands of you who feel the need for this type of program which will network which has responded to this need and by the hundreds of stars of stage screen and radio who give so unselfishly of their time and talent to appear on our Family Theater stage.  This is Tony Lofrano expressing the wish of Family Theater that the blessing of God may be upon you and your home and inviting you to be with us next week when Family Theater will present No contest starring William Campbell. William Gargan will be your host. Join us, won't you? Family Theater is broadcast throughout the world and originates in the Hollywood studios of the world's largest network. This is Mutual, the radio network for all America.