So, hi, after all of that, I promise I'm more technical than that looked. I'm Bill Weiss, at Bill Weiss Most Places, bvatpuppet.com, where in case you can't tell from the slides and everything, I work with principle security architect there. I'm here to talk about really why security people shouldn't have such a bad attitude about the DevOps movement, and how many of you are in security? Like security is your job, boy, okay, rough room. More importantly, for the rest of you, why you should work with your security teams, not just be like, oh, there are the people over in the corner there who tell me no when I want to do things, they're fine. I have had that job, by the way. I've been that guy, I'm reformed, I'm now telling people I do not do that, hopefully a little faster. So I'm here to talk about DevOps and... We have this problem where people talk about DevOps, and it's just like, okay, we've got developers operations, that's it. Somebody says, well, but we need the QA people in there. QA is important, so we're gonna do DevOps. Security, it's gotta be DevSecOps, or SecDevOps, or DevOpsSec. And so you end up with this, this. So it really is DevOps for everyone, right? We named it after Dev andOps, because I don't know why that's what they wanted at first, but it's a whole company thing. I'm gonna start by talking about why it matters. And we use some data from the 2017 State of DevOps report. This is done by some folks at Puppet, and basically the entirety of Doro, which is the DevOps research and assessment group. They do a survey every year, they get thousands of people to talk about what their environment looks like, and what their practices are, and what their performance is like, or indicators of performance, to see if there's correlation in their rates. This is the big delta between 2016 and 2017. Companies are bucketed. They group very nicely in respondents into three buckets, low, medium, and high performers. Those groups map, it turns out, extremely well onto companies that do DevOps, that do the things we're talking about here. Between the low performers and high performers, they are deploying 46 times more frequently. Last year, that number was 200 times. I think this is just there's more data, and we're getting a little richer, because 200 was, that's a lot. Lead time for changes, which is interesting, 440 times faster between the low and high performers. So that is, you have a change you wanna make, my security hat on, let's say it's OpenSSL patch day, it's Tuesday, and we wanna make that change. In the low performing group, that window is between a week and a month maybe to make that change. Last year it was between one and four months, so we're doing better. Whereas the high performers are under an hour. From proposing a change, test it, have it live. How much better could that be? A lot. Meantime to recovery, when things go wrong, how quickly do you get it back running? 96 times. And then change failure rates, which is really interesting to me with my security hat on again, how often does that OpenSSL patch just mess everything up? Five times lower. So that is, in the high performing group, it is between zero and 15% failure rate, low performing is between 31 and 45%. How likely are you to make changes in your production that aren't super critical if it takes you one to three months and you have a 40% chance of it going poorly and you have to mess with it? And then it takes you a bunch of time to fix it. So those companies have like week long outages because that patch didn't go well. It turns out you can do better than that, probably. And the biggest indicator of if you're in the high performing category, we do not sell this. Oh, I forgot to give my standard warning. I work for a company in this space. I'm not selling our software. This is not about Puppet. This is about the class of software. It turns out continuous delivery is the big indicator here. If you can get to continuous delivery, you are probably in the high performing group or you're well on your way there. Last year, I found that the practice of make up continuous delivery, I'll talk about those, significantly predict deployment pain, that predict IT performance and change failure rates, IT performance, because like we all want to do better as IT, but what does it mean to the business? IT performance maps onto productivity, market share and profitability. Who here would not like their company to be more profitable? Okay, go. You back there would, we'll talk, I don't know. So it is continuous delivery, because that's a buzzword, a lot of people sell it. It is five things, it's test automation. Can the computer tell you if your software works? Did that change work? Is it safe? Deployment automation, once you know the software works, can you then go run it? If you're a services company or you're like a SaaS, that means deploying it to production. If you are, let's say you make Chrome, you make a browser, they're doing continuous delivery in there. If you make a change to Chrome and it's successful, there's a pipeline that ends up with your laptop. Integrating security into delivery. This is one of those indicators of, are you doing security in your CD? Why? Because if you're doing continuous delivery and you don't have security integrated, you're just making things worse, right? Like you're rolling out new bugs while you find out about them or after you find out about them, which sucks. Continuous integration and trunk-based development. There's a whole talk and argument about the trunk-based thing, like continuous integration. Is the system, when you're making changes, is it automatically telling you, did those changes work? And then version control. Most people see that and say, it's 2017, dude. Of course we're doing version control. That survey, people are not. There are companies out there in 2017 who are like, yeah, we've got software and software at all. They're in production. If that's you, I don't mean to shame you. I will help you get there because it will change your life. So that holds like a lot of work. Like what would it take to get there? Takes a lot of effort.  Nobody says that. Maybe I don't care about continuous integration. I just like running tests manually and that's fine. Companies in high-performing groups spend 50% less time remediating security incidents. 50%, half as much, right? You just doubled the efficacy of your instant response team without having to hire a person over there. You should hire more of those too, but they just get better at their jobs because they can do those things faster. Your engineers, not just the security people, engineering as a whole, spends 21% less time on unplanned work. Right, so that's all that firefighting. For every five people you have on that team, like you get one of them back from firefighting forever. And 44% more time on new work, like actually delivering value. That all sounds great, right? So how do we get there and what does it mean for the security aspect of it? Rack to the DevOps. DevOps, I want to talk about what DevOps is kind of fundamentally. I'm not going to give you the whole spiel. It's CAMS or CALMS. CAMS is the acronym come up with by John Willis and Damon Edwards at DevOps Stays Mountain View in 2010, which stands for Culture Automation Metrics and Sharing. These are the fundamental things of DevOps. Jez Humble the next year suggested adding lean to it because it turns out that the practices of lean software development and lean management matter a lot for this stuff. So culture, what does it mean to build a culture, right? In this case, we're talking about a culture of security. You don't want the security team if you even have one. I should have asked this earlier. How many of you have like a security team in your company? Good, okay, I guess this goes to Jeff. How many of you work in massive companies? How many of those teams are different than like your compliance team? Okay, most people like that, fine. They're probably not a huge part of your company, right? If they are 1% of your headcount, your security team is massive. If you're a 10,000 person company and you have 100 security people, please tell me where you work because I want to talk about that. Probably not, right? Companies of 500 people have one or two. They can't be the only ones that care about this. And the Agile Manifesto, DevOps gets a lot from Agile. We're trying, we want to avoid some of the, well this is gonna be contentious. Some of the failings of Agile in terms of getting super prescriptive. But the Agile Manifesto starts individuals and interactions over processes and tools. This is not a software problem, this is a people problem. Security people, get out of your caves. Like I, it's like I came up as like a hacker kid, right, I like wrote AOL scripts and stuff. And so my idea of what my job was gonna be involved like dark rooms, a lot of techno, and like flashing lights while I was doing things. And the rest of the company thinks that too. Like oh the security team's like over there doing their thing. They even have a dark corner to point out. Your security people aren't there. Security people get in this mindset of like I am here to guard the systems from the users. Like I am the thing between the company and utter disaster.   You can't like watch the packets. You have to get the company involved with, you have to interact with everybody so they know what's going on so they can help you do this. Security can't be the only ones thinking about it, right? Security team needs to be talking about what's going well and what's not. There are rare times you can't do this, right? You, the lawyers say you can't talk about it or the SEC came and had a stern talk with you. Okay, you can't talk about this. It's really handy to just be able to tell people like hey, we had a super bad day. Like I'm gonna show you how we lost a bunch of money. Cause it turns out that when you do that a couple of times people get interested and when you're like hey, guess who found out we lost $5 million last week. I didn't actually, sorry. I can, anyway. But when things go well, right? When you say hey, like we had a, this is one I'll tell, this is a real work thing. I started at Puppet. People heard that I was a security person even though it wasn't his security role there. And our finance people kept forwarding me these wire fraud, wire transfer requests, right? Our finance people were getting like a couple a day very legit looking from our CEO like hey, I'm in China right now, I need you to wire these people money for this partnership. He was not in China. Or he was, but he was not doing that, right? And I said wow, how do you, like some of these look really good. How do you know? And they just went oh, we don't, we have policy we don't do wire transfers here, period.  I got up in front of the company and showed them like here's how many of those we get a week, right? Here's some that look super legit. Like who can tell me why this is wrong? And that was a nice reminder for people. Oh, that happens.  And really, and this is hard, admit things go wrong, right? Getting up there and saying hey, we had a really bad day. The rest of your company, if you're doing some kind of DevOps-y stuff, whatever that looks like, they know when like the developer's having a bad day, right? You know if builds are failing because there's informational radiators. You know you didn't ship on time.  Nobody distrusts those teams because of it, right? When your CFO says, you know, we didn't quite make it work out, you're not like this guy. Never talking to him about money again, no. Says he's doing his job, right? Or is she? It says they're doing their job, right? And so showing people that you're doing a thing reminds them that you're there and that you're doing a thing and that they should talk to you about it. And they're more likely to tell you if they see similar things. We talk about blameless postmortems in DevOps, right? You can do that for things that aren't like the server crashed. We ran out of RAM. You can do it for things like, I don't know why I'm on this wire transfer thing, but we wired a guy $100,000. Bummer. We're not getting it back. By the way, I'm just gonna say, as far as I know, PubBit has never failed that one because our finance team is super awesome at that. They just do not trust email for things that I would. I've got emails where I'm like, I'd call them and ask. Nope, we don't do that. That's culture, automation. Automation, I think security people are really down on automation a lot of ways because it sounds like the computers, which I don't trust, are like doing things to the other computers I don't trust and they're making it like worse, right? Like we're on some software and software is terrible. Like it's all buggy and awful and it's like changing stuff. No. Well, automation, automated stuff is repeatable and audible. Those are words security people like, right? Repeatable is great. We can do it a bunch of times. I can watch it happen and it keeps happening the same way and it's auditable so I know it happened. That is great, right? Those are words I love as a security person. Automated is hands off, right? So a lot of security people, one of their concerns about DevOps is like, well, it means that you're just giving everybody a route. All y'all, here's the root password. Deploy software, do whatever. It can be that. I've been in environments where that was. But it also can mean that things that are happening automatically means no human needs to be in there. Instead of deploying software being like three of our devs are at the bar for three hours, like typing stuff, the software just doesn't. And you know what it does because you've seen it. It's reliable. To go back to that repeatable thing, it keeps happening the same way. If I've seen that Chef cookbook and I know it does the right thing, it just keeps happening over there. If I run another machine, it's in the same state. If it's in the same starting state. AppSec people specifically, because it turns out the whole security industry hates the DevOps thing. I understand why, but I think it's really wrong. If you're an AppSec team and you're like, this sounds really great, let's do automation. Static analysis is amazing. That link there is just a directory of great static analysis tools. And I think there's a problem in the industry of static analysis. There are companies that sell software that does this. I'm not gonna name names. Some of them are really great and they're all super expensive and they're really hard to run. The first time you buy a company of these product, you're just gonna lose your dev team for like a month, like doing that. And so everybody thinks I don't have time for that.  Right, like you search for stuff. That's static analysis. Specific ones that are great. Again, this was a directory of a bunch of them, but how many of you use closure at work or at home because it's fun? Okay, that's not great.  I know, it sounds like a trick question, right? ReadString. It executes code in that string. If you call readString in closure and try to think from the network, like people just run whatever on your machine. That was a puppet bug last year, which was a bugger. And so it's super easy to just have a thing when you check in code to be like, hey, boss, like that readString there, are you sure about that? Calls to exec or a vowel in anything, ever. Scary. Maybe okay, right? There are places that I love a vowing code, but like in general, it's not a thing you do in production, in general. BearSequel, if you see insert or select or delete all in caps in like a string with some stuff being thrown into it, scary. Might be okay, probably not.   If you're a Rails shop, Breakman is in the same spot. There's a free and paid Breakman, paid one's great, but the free one. How many of my former coworkers in this? I ran Breakman once on a piece of software that I was supporting, and it just kind of churned for like five minutes and then gave me like, here are your 10,000 problems in this software. Ugh, that didn't work. This is clearly broken software. Breakman doesn't work. My developers, not my developers, but like we are smarter collectively than Breakman.  Would you look at this? And oh, oh, I have a thing or two to do now. Can you email me that? It's great. How many of you write shell scripts, right? Just like .sh files somewhere in your environment? Thank you. That's where just nobody was raising their hands. There's this thing called shell check, which is this pretty amazing, it like understands the bash and csh and everything, grammars, intimately. It finds terrible things in your shell scripts. And you can just hook it up as a ci thing, it's super. It's written in Haskell, so when you try to compile it the first time, your machine's out to launch for like eight hours, but. But once you get it built or you find a compiled one, it's super. Sometimes, right, some of those things are just gonna be false positives, false positive E, and false positives are really annoying. And so instead of being like, nope, build fail, maybe you just have a robot that sends a, leaves a comment. The GitHub folks, I don't know, five years ago when I saw this talk, GitHub is written using GitHub pull requests and stuff, of course it is. And they have a little robot that just comments on a pull request and says, hey, I see BearSequel on there, or I see Val's, or I see whatever. Would you just find a friend to say that's okay?  And it works great, because nobody wants to be the one who like sees that and is like, nah, it's fine. I wrote that code, it's fine. Now you find a friend to look at it and they either say, it's fine, I don't like that. And you have to treat your security failures as bugs, right, they're bugs. Most chops, most, but not all, as we said previously, check for aggressions, right? You find a bug, you like write a test to make sure you don't do that again. Companies never do this for security stuff, right? You have some like, trivial thing you did that it turns out half the internet was able to run code on your servers, like, for free. People are like, fix that. That ain't gonna happen again. It will. You can also look for that thing in other parts of your code, again, the way you would bugs. If you parse YAML off the network, pro tip, if you don't know this, parsing YAML off the network equals bad day, in general. Because you can have code in there. You're not expecting that, but if in Ruby or Python or whatever you load YAML, you just run code in there. If you're not doing it carefully. The first time you find that bug, maybe take a quick walk through your code and look for other YAML loads. And then occasionally try to load YAML as code in it and see what happens. And then this seems silly, but it's one of those things that again seems super hard. There are automated dependency checkers that you give at your software. It will say, here are all the libraries you use, and here are the problems in it. Here's this one's out of date, this one this, this one this. These will save you from things.  Like really, truly know what version. Because if it's not the latest one, like you're gonna have a bad day. And this software can just like that morning be like, oh, fix that. And it's in that piece of software you haven't touched in three years and so you forgot there's struts in there, hey. Image magic was the example I gave before, but struts, struts are better.  Not all of you work in AppSec, not all of you in security, but not all of you are like shipping sassware. Some of you are shipping real software, I shouldn't say real software like that. Some of you are shipping software that gets put on a disk or gets FTP or whatever. It isn't just a thing you run. And in your case, hopefully you've got automation around all of that. You know what is amazing, is having a way to automatically know when things change. Two jobs ago, I maintained this huge machinery, racks and racks of gear, that all it did was just continually scan all of our IPs to see if it could find things that changed, because we didn't know when people brought up new machines. And so we had to know when they happened to do something with it. What if there was a machine that did that for you and you could just say, hey, run this when you provisioned a new machine. You have a new server, like check to make sure it does the basic stuff you require, right? What open ports are there? What versions of open SSL or what version of SSL does it support, right? If you bring up a new server in 2017 and it does SSL V3 or V2, you should have a strong reason for that. And that strong reason isn't like, oh, it looks that configuration, which happens. Even better, if this is all automated, you can do that before machine's live. You build up a new server, before it gets added to the load balancer, it gets an external IP or whatever. You can just enforce stuff on it before you do that, so you never have that weird window of like, oh, it's live for a little bit, oh, it was vulnerable, we shouldn't have done that. Oh, load average is really high, I wonder why. You can do that before you provision it credentials to the database, it's great. Reproducible provisioning, in general, is really great because you know what's running. And so how many of you have tried to configure like SE Linux or App Armor? Okay, keep your hands up if you didn't give up on it after a bit, because it's terrible. By hand, it's terrible. But by this, you already know what's running, you could just put those profiles there, it'd be fine. Reliable provisioning is also great because all of a sudden, you can replace machines. You've got a machine that's in a weird, hinky state, you don't know what its problem is. Kick it to the curb, right? Take that VM, like, put it in the trash or keep it off in a quarantine to work on, put a new one there, service is still up. And you can automatically reason about these machines. You all of a sudden have code that provisions them, which means you can do things like make assertions in there, watch what they do in a way that you can't if your build instructions are like, Hugh takes this CentOS disk and puts it in the new server and checks the right packages, which one's the right ones, and copies this thing from the server. I spend a lot of time on automation there. I love automation. Lean, let's say about Lean. Continuous improvement is the point, right? And what this means for security teams that a lot of people don't do, is you don't have to build this massive security empire and do everything and make it perfect. You just have to get better most days, right? You need to say, here's the thing we're focusing on, better, better, better, done. And I feel like a lot of security teams always look at this as like, we have to just have these big bang releases of like, here's the policy. Okay, all of the scanning is done. Just start slow and roll it out and measure those results. You can actually see if these things are working and change course. And then, if it's not, kill it. Very few people, especially in security, people in general are willing to get rid of process, right? Because like you built it, it's probably there for reasons. No, kill it. If it's not working and you're measuring how it's working. So cyber kill chain is this term that's kind of military derived that's about hackers. There's not like one point of entry, right? It's not like we had a perfect system, a single thing happened, now we're aquifax or whatever, right? There's a whole line of like, the attacker scanned us and did reconnaissance and did this stuff and exploited it and figured out how to get data back and did a lateral movement. You can use your knowledge of that, hopefully with less terrible terms that sell cybersecurity things. You don't have to do all of it at once. You can focus on kind of anywhere in that thing, right? You can say, you know what? I don't care about reconnaissance right now. Our attackers are probably gonna know where our servers are. All I need to do is keep them from that initial point of entry. Or all I need to do is detect that point of entry and move forward, whatever. Metrics, I think a lot of security teams really fall down on this. And again, I know most of you aren't in security teams. You can help build this for your security teams or if you don't have a security team, you can just build this stuff to do better. I hate to say it, but disasters are really interesting, right? Everybody likes seeing like this went super wrong. Winds are also really interesting if you can talk about why they're a win. And if you're gathering metrics, you suddenly have a story you can tell people about what you're doing and how it's making things better. Figure out whatever's important because companies aren't identical in this and so you may not care about how many compromised AWS accounts do you have a month? Some companies just don't care about that because they don't do AWS or they just don't care about who runs what out there. I don't know. You have to figure out what's important to you, right? How many companies track wire instance fraud attempts? How many of them track tax fraud instances? Some companies care, some don't. And you can make like pretty charts, right? Like, yeah, up to the right, it's great. We're like, going up. Or that chart could be like number of infected machines per month. Like how many viruses we have to clean up? That could be time and instant waits for attention because we don't have enough people to work on it. Right, instance are taking longer and longer to get fixed. You know what will break out some budget for you is that graph in the right place. If you say, yeah, we don't have time to even investigate hacked machines for three months because like that queue keeps growing, that's a big deal. And if you don't have those numbers, you're just the people who are like, we need more people. Okay, all of us do, right? Every team wants more staff. But if you can show this is why I want more staff and that thing's important, it'll matter and it'll happen. Sure, I've been talking a lot about sharing but there's specific things you can do, right? As I said, talk about those things that go wrong. At Puppet for a period, we had a periodic talk at all hands that we called computers are the worst. And it was just a detail like this was really bad. My first one I got to give, which is about two weeks after I started was, let me tell you about the time that somebody checked their AWS credentials into GitHub. This chart that ends in $60,000 is how much that cost us. Please don't do that. Didn't name the person, there was no shame involved.  I didn't name them. And a number of people came up after me, oh, how did that happen? Like tell me more about this so I don't do that. And that made us demonstrably better by just getting up and saying like that was pretty terrible and it cost, I don't know, like a salary. For the record, Amazon is super friendly and we'll refund you on that sort of thing if you seem like you're competent and care about it. If you already have a company like stats, if you have like a weekly or monthly dashboard and you can get some of your security stats into there, even better, right? Here's our cash flow, here's our sales. Here's how many machines and sales like got hacked during that time. That number gets relevant quickly and gets people involved. I'm a big fan of running lunch and learns or something like that where you just say, hey, who wants to learn about this thing? If your budget allows it, buy people lunch, if not, make them bring their own. So these can be literally free for you except for your lunchtime. If you have appsec teams, some of the best bang for your buck you can get in training is run these and run like CTFs or talk about like, let's actually all break in to this terrible PHP app I wrote. Because it turns out once you do that, the developers start going, oh, I wonder if that's a thing we would do. Right, you teach about cross-site scripting and it's like, oh, we don't really do anything with HTML input there. You go to multipliers. Suddenly that whole team cares about security and is doing security stuff for you. It's great. If you're in a sec ops group so you're not teaching CTFs, you still should because they're fun. Instead you could do these about fraud attempts or about times you've actually been hacked or stuff like that. You could run a pretty good 30 minute lunch and learn talking about what wire transfer fraud looks like and how you detect it and how you avoid it. And I guarantee that that will be worth your time because it will save you real money. And this comes down to as a security team you need to seem human. You can't be the trolls in the corner that are like, no, you do not get to get that.   Instead you want to be like a friendly security team that would love to help with things. And then going back to that blameless post-mortems thing, people really want, people are more likely to talk to you if you do not get up and shame them. I did not get up there and say, hey, Steve there made a mistake with his GitHub credentials, his name's not Steve. And he cost us 60 grand, good job buddy. No, we just talked about what happened and said hey, accidents happen, we're fine. And tabletop exercises. These are super important, they're really valuable.  You can just do like an hour long, what would we do with this? There's this Twitter account, bad things daily that is like pure distilled nightmare fuel for ops people. They just tweet once a day a scenario that you could worry about and they all start with like, we would all cry. Right, like that's just, but then what? It's super interesting, you should follow it, it's great. But it also shows, it doesn't just train those things, it also trains your, it also shows people that you are there and you're thinking about these things and gets them used to dealing with incidents which you will have. Am I like super over time? Nobody's, oh okay, I got them. All right, I'll wrap it up. So if you're an app sec and would you like, what would it take for you to want fewer security bugs in production? Like you would pay good money for that, right? That sounds great. Fewer security regressions. Just we make the same mistakes fewer times. Faster mediation, right? When we make mistakes we get there faster and we fix them and we know they are fixed faster. SecOps, you're ops people, same thing. Would you like faster mediation? Would you like fewer failures, right? Those numbers show that if you do these things and if you're doing the DevOps, you're just gonna fail less often which means your stuff's up and you can do the fun things more, that's great. More confident changes, right? How would you like to just worry less about rolling out those patches which you should be doing but right now are holding off because they're gonna be terrible? Would you like more confidence, what's running where? So you actually have an idea of what should be happening? Well, that's what DevOps is for, so we can learn here. Thank you, my dogs.


The craft foods company presents Harold Perry as the great gilder sleeve The great gilder sleeve is brought to you by the craft foods company makers of par K. Margeron every day Millions of women all over America serve par K. Margeron because it tastes so good He a Rka why par K. Margeron made by craft Well another sweltering summer day is hanging over summer field But that doesn't mean business isn't progressing as usual at the water department the great gilder sleeve secretary is hustling around the office and the great man himself is at his desk. In fact, he's practically on it Am I disturbing you. Oh, no, no, Bessie. Come right in the mayor's office called and wondered if you have the vacation schedule made out for this office Oh, yes, must do that. You have your feet on the desk. Do they hurt hurt? No, Bessie They feel fine when summer comes there's nothing like getting the feet higher than the head. I think it has something to do with nature Yes, sir. What are you reading? Yeah, I'm studying Bessie hydraulics and water pressure Well, it's such a nice day. I hardly know what I've been reading. I know what you've been reading baseball Your little book inside the big book is showing. Oh Oh walking down this morning. I saw it on the newsstand. Oh, don't apologize. Mr. Gail to sleep I have my love story magazine here inside my dictation pad. We'll read together Yeah Now Bessie, we can't run a water department that way. What would the mayor think but you I'm the water commissioner Bessie And if you have a love story magazine here in the office, you better turn it over to me right away Well, all right, but I can have a back of five o'clock. Can't I we'll see Bessie. You'd better get to work What a magazine love digest I should throw it in the wastebasket Nice cover Bathing suits certainly have changed In the last month even Don't know how they do well. You'll just leave. Well, I wonder if I shouldn't go to the seesaw or this summer Mr. Mayor What are you doing with your feet on the desk? Are those my feet and what are you reading? I am reading this book on hydraulics and water pressure. You see I see what are those magazines? You have inside the book magazines face balls. Well, and what's this love digest I? Came in here to talk about your vacation schedule, but perhaps a vacation you need is a prominent one Huh, thank you to overgilded sleeve and I'll take these magazines, but you'll never get your reports in on time Now I catch you reading. I never saw such an office run in such a slip-shot manner now. Mr. Mayor I run a very strict office just asked Bessie. That's hard to believe good day Mr.. Mayor yes, can I have the love digest back at five o'clock? It belongs to my secretary We take our vacation this year on key vacation My view the mayor was in talking about that today. Yeah, when's he giving you your junk? Well, he nearly gave it to me this morning We didn't quite complete our discussion Let's go early on before schools out Lira. Let's rent that cabin up in the mountains again, huh? Cabin, why not go to some nice resort where a girl can meet some interesting people. Yeah boys Now Marjorie resorts cost money where I can dance and wear pretty clothes see ya boys Quiet infant, please on key Marjorie. We can't afford those things. France is going to Europe I don't know where her father gets the money. That's the trouble with us. We never have enough money We can't go any nice and poor now Marjorie boys Nobody appreciates me around here. She doesn't know how hard I work for our money I do uncle movies. No We're saving our money. We may try to go to some nice resort this year Never mind birdie. I'll get it It's probably for me birdie. I'll get it. I'm here. Be glad to get it. Never mind birdie. I'll get it Came in here all the way from the kitchen might as well get it. Well, I got up. I might as well get it Let's get it. Thank you birdie. No for corn flakes. I'll get it sit down Leroy Judge evening all right rang the bell twice, but nobody answered even in judge would have been bad to get it Yeah, let's go in the living room Horace I'd like to have a word with you Gilday in your private study. What excuse us Leroy What's in your craw now judge you'll find out soon enough we'd better sit down Well judge and close the door. Oh my goodness Oh There is that satisfy you judge you want me to plug up the keyhole Gilday the mayor is threatening to take your job away from you Oh for it is that why you called me in here judge the mayor is always threatening me this time. It's serious I happen to know that you are top man on the mayor's must list must must go. Oh Where did you hear that well my secretary always has lunch with the tax collector secretary who always has Breakfast with the mayor secretary and the mayor secretary told the tax collector secretary who told your secretary All right judge. What did she say just what I told you and if the mayor catches you neglecting your duties once more out You go let them try it. I'll tell him a thing or two. I've been waiting to do it for quite a while No, no, you can't afford to take that attitude. You have a little family to think of you know Yeah, and if you apply yourself work at your job, who knows Why do you know the commissioner of public works got a $20 raise last month? He did turn over a new leaf You'll live before it's too late by George. I'll do it and may I be the first to congratulate you? Okay Let's open the door. It's getting stuffy in here. Why do you put goose grease on your shoes judge? And I assure you that the matter will be attended to immediately Yours for better service to Summerfield Brock Morton P. Gildersley water commissioner. Have you got that Bessie? I hope so get those letters out immediately Bessie.  Isn't that wonderful?  I'm gonna do some reading. Oh, should I bring you my love digest? No, Bessie. I'm gonna read this book on hydraulics Well, don't stand there with your mouth open Bessie get those letters out. Yes, sir. It's like Annie Oakley Now dictate some more Man starts taking his job seriously and everybody stands around staring at him. Oh, good morning, Mr. Child Oh I'm home Yeah, a lot to do Well, you just stopped that silly work now and come along with me to Hogan Brothers Why should I go to Hogan Brothers? It's been so warm lately. I'm gonna get a new summer play suit play suit And I want you to help me pick it out I don't think I should leave the office to help you pick out a summer play suit. Why not? We'll be playing together this summer Well, I'll try to budget some time for that But I'm pretty busy right now at line running the water department Oh, why do you have to stay around here? All you have to do is sit while people turn it on and off There's more to it than that at line. I'm the executive around here. I do the thinking I'm always studying ways to make the department better. You see I've got a book here hydraulics What is hydraulics? Well, that's the stuff that water commissioners have to find out Gracious you are busy. Well, I'll try to long nice of you to drop in that line. Sorry. I'm so busy Oh, I should get a one or a two-piece play suit one hurry Maybe I should go with you No by George, I'll stay on the job get out of here at line That's the penalty for buckling down Hydraulics chapter one one piece or two Hydraulics, what is it? That's a good place to start Hydraulics is that branch of science which treats of water or other fluids What are you doing with your feet on the desk again? Are they back up there and still reading during office hours? I warned you if I ever caught you loafing on the job again. I mr. Mayer. I'm studying That's what you said yesterday love and baseball, but mr.  Good day He's sorry. I think I'm gonna cry We'll be back with a great gilder sleeve in just a moment You know, I hope this trouble doesn't affect gildy's appetite because according to birdie his eating habits are pretty interesting That man can eat pancakes faster than I can make them Well, no wonder birdie you make such good pancakes and you always serve parquet margarine as a topping He just wolfs them down rolls muffins waffles as well as pancakes and bread tastes better with parquet The fresh sweet flavor of parquet makes it a favorite spread in millions of homes and waffles How bad man choose up those waffles nice parquet is perfect for waffles It's the margarine of craft quality, you know it's made from only choice farm products and yet nourishing parquet is so economical without a doubt Parquet is the best buy for both bread and budget and rolls Mr. Gilles leave these rolls like other many peanuts just flip them down rolls topped with a rich wholesome goodness of parquet are Really delicious next time friends treat your family to appetizing nourishing economical parquet margarine Serve it once and you'll see what we mean when we say parquet tastes so good. That's parquet margarine Parquet a y made by craft Well, let's get back to the great gilder sleeve our overstuffed comfy dump. He has had a great fall And doesn't quite know how to put himself together again Sacked Now what little fat man? The light and at lines window No There's a jolly boy meeting tonight He could go up there though But it's beginning to sprinkle water Gentlemen now that everybody's here that's going to be here I'd like to have the floor about me. We can't start a meeting of the jolly boys before the water commissioner gets here Can we pee vee? You can according to robin's rules of order Yeah, let's get going the commission is slower than the watery pipes into my shop. No, no, no, wait a minute, floyd I'm sure you wouldn't speak of our absent member in this manner If you knew the sad tidings that I bring something wrong jed gentlemen Our fellow jolly boy is no longer with the city How's that he's been fired No, you don't say the commission got the axe Gosh, i'm sorry.  Yes gentlemen a most brevis occurrence Mr. Gilder sleeve was in the pharmacy only yesterday looking just as natural Of course our fence post could have seen it common He wasn't the world's best water commissioner be that as it may floyd I happen to know that when the blow fell gildy was reading a book on hydraulics trying to improve himself I personally called upon the mayor pleading for reason But he said it was the mark of a weak executive to retract orders And that sounds a little unreasonable to me. Well, that's the news gentlemen Now what can we jolly boys do for our friend gilder sleeve? He's a sad and a broken man. Well, the mayor kicked the commissioner out of office.  Are you suggesting recall? No, i'm suggesting we kick him out He lowered the boom on the commission we lower the boom on him right pebe Well, that seems to be the way of the world Gentlemen hey, I think I heard the door open You did? I thought gildy felt so blue he wouldn't be back That's the commission's trail. All right.  Yeah, let's start a song. How about smile? Yeah, that's a happy song Hey, come here. Wait a minute gilder. Well, I'll be right out into the rain. Oh, that's too bad Probably we sounded too happy Yes Gentlemen, I think we should seriously consider a petition for the mayor's recall His honor has been unreasonable and deletory in public affairs before And there are a few little slip-ups that won't look good for him on a petition hot dog You write up the stuff judge and I'll sign it just a minute floyd Judge if you don't mind. I'd like to be the first to sign that petition Oh, we'll all sign it. We'll do it gentlemen, but remember not our word about it to gilders me Unki, are you going to sit around the house all day again? Yeah, gosh, honk Well, I don't feel like going downtown children besides I've been busy reading what ads and making phone calls Have you answered mr. Pavey's and mr. Munson? Well, no, I can't face those flaws Probably all over town that your old uncle's a failure. No, unki. You're not a failure.  Unki will manage and I have a wonderful idea instead of running off to some stuffy resort Why don't we spend our vacation right here? What? Oh To save money uncle go barefoot at all summer No, no birdie. I'll find something else. They can't keep a good man a man down You should have your job back the mayor was wrong and you know it Yeah, the judge came over and told us you were right. Well, you're right all the time, mr. Gillespie. That's one thing I'll say to you. You're right all the time now birdie Yes, you are that man did a wrong thing and whenever a man does a wrong thing he pays for it Well, I was on the job. Sure uncle. Why did you let the mayor fire you?  No lee roy. Go down and tell him anyway and run Lee roy, I don't need you to fight my battles.  Just as if nothing had ever happened. Sure. I'd even go with you.  Yes, sir. Mr. Gillespie when you go down the street people will point at you and say There goes the west best water commission in this town ever had. He's right Well, sure everybody's on your side unki might go downtown at that. That's good news I'll brush up your new suit. Mr. Gillespie. No use being right unless we tell the people about it Yeah, my little family I feel better already Where'd you like to shave friend but skip the tip just sign the petition right here under the other names Well, I don't exactly know what i'm signing. That's all right. It's for better city better city government Oh, hi commish. Oh Try up and sign it Had a boy, but I don't understand what what are you care? You're just a traveling salesman Uh, call again Call again. Goodbye Who's that floyd just a fellow doing me a favor Well, it's good to see you cracked out of your shell commission We missed you at the jolly boys club the other night. Well, I started up there, but other pressing matters came up. Yeah, no How about a shave and a haircut? That's what I came down for floyd sure hop into the chair And uh Until the silver linens show through commission to shave and haircuts on me now floyd things aren't that bad Um, has the mayor contacted you yet mayor? No, I should eat.  Of course, I haven't I've never been afraid of it That's that stuff Why did you say when he fired you commission? Well I think I said So mad you couldn't talk, huh? Cut me think of what I was, you know I never cared much for that guy. What a scheming politician Always has his barber and done up the street just because it's a free-vote shop Yeah, that's the mayor. All right, I mean she'd done you wrong if I was you I'd tell him off Don't worry floyd. I will the next time I see him I've been sitting at home just thinking up a lot of things to tell him and a boy High time. We got a new mayor anyway or put a good scare into this one We'll have his relatives jumping out of city hall like it was a sink and ship. What? And let me let you in on something Most people think they can't hit a city official. You can hit them same as you can hit a plumber Never thought of that. Now. I think if you come into the guy at a slight crouch now, floyd I know how to take care of myself and maybe fake for the right That's why I'm phoning you mr. Peavey. He's been awfully blue. Well, I can understand that my dream We finally got him to go downtown So, uh, if he drops in the drugstore, I wish you'd do what you can to cheer him up. I'll be happy to marjorie Thank you, mr. Peavey. You're very sweet. Where now? Goodbye Nice level headed girl marjorie now, what will I do to cheer that from? Hello, peavey. Come on speak of the devil What'd you say peavey? Hello, mr. Guilty thing Haven't had the pleasure of seeing you around the last couple of days No, peavey, and you know why so let's not bring up the subject. It's a pretty sore one with me All right, what can going to mr. Guilty thing? Care to read the funny paper? I've got an old one around here. I'm playing no thanks Can you imagine the audacity of that mayor? I'm gonna well then I'll read it to you Well, he's not gonna get away with it.   It's yours. He's gonna hear from me and salome. That's the pig says erp erp What Peavey, what are you doing? I'm reading you the funny paper. What for to cheer you up And then mr. Fatback says look peavey if you think I'm unhappy because I'm not water commissioner anymore. You're mistaken. I can take it And gilder sleeve I didn't expect to see you here. How are you old friend? I'm fine And don't you try to cheer me up too judge? Oh Well, I came to pick up the signatures you've collected peavey. Very well. Here they are I have a lot of names. You did well Um, what is this? Floyd was collecting signatures and now you are peavey You know who has heard about you know what and he's plenty worried What's so funny well, thank you peavey see you around gilded Peavey, what's going on here? What are you fellas up to? Well out with it peavey Well, uh about the mayor the next time I see that little napoli and the sparks are gonna fly Because of devil. Well, hello, mr. Gil Slinger, huh? I mean Hello, true illiter. I uh, I've been looking all over for you. I've been looking all over for you, true I think I'll go look for something in your back room. Yeah You wait a minute peavey.   But I do have a little family to think of I accept fine as mayor of summer field I now officially reinstate you as water commissioner water commissioner We let bygones be bygones But commissioner guilders leave the next time I catch you reading pulp magazines during office hours I wasn't reading magazines at time. I can't work for an unreasonable tyrant like you. I resign. I quit quit Now wait a minute mr. Guilders leave a commissioner guilders leave you can't quit. Why can't I I just did You don't want me to lose my job. Do do you what? Well, uh, this is embarrassing for me guilders leave But it seems a silly petition for recalling the mayor is being circulated around by some Some uh public spirited citizen public spirited citizen public spirited. You didn't sign it. Did you mr. PV? No, I wouldn't say that Well Recall petition you say mr. Mayor Well in that case I accept my job back again. Oh, well fine guilders leave and now mr.  There are a few things I've been saving up to tell you shorty Oh In the first place you let me run the water department and stop snooping around my office.  You understand Remember to williger you're not so big. You just comb your hair high And another thing Oh This is fun and another thing The great guilders leave will be right back. So stick around Remember ladies when you buy parquet, you're doing more than stretching your budget true parquet is a money saver But just as important you're getting the spread preferred by millions of women all over america for fresh rich flavor Yes parquet is the perfect topping for rolls pancakes toast bread and hot vegetables Because it tastes so good delicious parquet provides plenty of wholesome nourishment too It's rich in food energy and every pound is enriched with 15 000 units of vitamin a Once you try parquet the craft quality margarine You'll agree. It's the best buy for bread and budget. That's par k a y Parquet margarine made by craft Well, mr. Gilda sleeve congratulations on still being water commissioner. Thank you besie and I really mean it about buckling down I'm gonna work and study and make this the best water department in the country Uh starting september 8 What we're all going on our vacations right now besie Folks this is our last broadcast of the season But we'll be back as usual for the craft foods company on september 8 Before we go, I'd like to thank all the members of our cast for the nice times we've had together during the year There's louise erickson who plays marjorie. Walter tedley our little lee roy and lily and randolph whom you know is birdie Getting outside the family. There's unimercle who came to summerfield this year as adline fairchild And the gloria holiday who is besie I've decided not to get rid of besie And stand for our who plays the mayor thanks to the jolly boys who really helped me out tonight Arthur q bryan and ken christy who are floyd and chief gates and of course with every season that goes by We appreciate more and more our two fine old standbys Earl ross who plays judge hooker and richard legrand who is mr. Peavey John elliott and andy white wrote tonight's script Hi andy and on all of the weeks you hear stories by gene stone and jack robinson We also want to thank john wall our announcer molly frazier for sound effects Ray Ferguson our engineer jack meakin and the orchestra frank pittman for his paternal eye and fran van hardesfeld our director Good night, everybody. See you on wednesday september 8 Listen to the jack curl show on this stage in same time next wednesday and every wednesday until september 8 When the great gilder sleeves starring harrell tarry returns For the last time listen to this amazing offer a stainless steel cake and pine knife with a gleaming six inch serrated blade And a handle of beautiful agatron a dollar and a quarter retail value for just 35 cents And one label from a package of pabstet the delicious cheddar cheese food It's your last chance to get this cake and pine knife at less than half its regular price Send 35 cents plus one pabstet package label to the phoenix pabstet company box 1723 chicago 77 That address for the last time the phoenix ph enix pabstet company box 1723 chicago 77 This is mbc the national broadcasting company


We are entering a new era of cyber attacks. The SolarWinds hack underscored a rising and very disturbing trend, namely that tunneling in through an organization's supply chain.  We're going to talk a little bit about ransomware and cyber with Manoj Nair, who is the GM of Metallic, a Commvault company, and Tim Carbon is a principal systems engineer with Mitchell International. Gents, welcome. Thanks so much for coming on and talking to me about this very important topic. So, Tim, I got to start with you. You're the practitioner. You got to fight this battle every day. You heard me up front. I feel like we're entering a new era. The adversary is highly capable, very well funded. How are you thinking about changes and protecting your data and creating things like air gaps and what are you doing to solve this problem? I think the most important part, and this is just to start off with, is patching. Everything up to date. Most of the time someone's getting in or most of the time one of these viruses is replicating between the different systems, it's due to unpatched environments. And then number two is training. If your resources don't know not to click on something or to hover over something to look at it, then you are just gonna be exposing your environment over and over and over again. But when it all boils down to it and it comes back to what I'm doing in the data protection world, in the backup and recovery, I have to look at not only how am I gonna get this data back, because if a system gets encrypted, we are going to look for recovery first. That's it, look for recovery first. But we also need to make sure that our environment is protected. Lock down our media agents, lock down our storage that we're connected to. And like you had mentioned before, use an air gap. And no one, I mean, everyone's been moving away from tape. And it's understandable. There's a lot of resource utilization involved. There's a lot of people that you need in there, in your data center, moving things around. And it's a robotic machine you have to rely on. Not only that, but recovery times can be slow. What I've found is convults has gone out there and they've offered us SaaS storage. This SaaS storage is somewhere else. We could be in AWS, we could be in Azure, we could be in GCP, but we can still connect to this SaaS storage and we never have to worry about someone having access to a data center and getting to our tapes. We don't have to worry about someone having tenant access and deleting our backups off of a particular tenant, which is something that we are gonna see in the future if it's not out there already. So there's a lot that we have to do and protecting ourselves is very important. And convults is making it a lot easier. Thank you, Tim. So Manoj, I mean, these things have probably been around for a while, but we're seeing really sort of, I talked about mainstream and a couple of things that are really disturbing. We're seeing this malware come in and they're self-forming, they're creating different signatures, but we're also seeing this idea of living off the land very stealthily using your own tools against you. And then really disturbingly, we're seeing when a victim discovers that they're being attacked and they respond, their incident response is triggering a very aggressive counter-attack by the hackers where they've already exfiltrated really sensitive data. Then they've been stealing and making monetizing your data and then they'll just encrypt it, hold it for ransom, threaten to release that sensitive data if you don't let them keep going. It's really, really disturbing. What's your perspective on this raising the bar that the bad guys have done and how we can keep pace? You know, I lived through the nation state attack that happened in 2012, the front door seat was at RSA as part of the leadership team. And at that time it was considered a, hey, this is very unique and it's an advanced persistent threat. It took the resources of one of the biggest nations in the world to mount something like that. And fast forward eight, nine years later, we're seeing that these kind of techniques have now been mainstreamed. You've got a lot of people who are figuring out not just, they may not even care about your data, but they know you care about your data. So they're not trying to exfiltrate the data maybe to look for sensitive data and monetize it. That's just harder. Why not take it directly from you? In Q1 of 2021, the average ransom went up 43%. It's like 250K or something. That's just the ransom. And we saw now that it's impacting day-to-day lives. You saw the long lines of the gas tanks, gas pumps on the East Coast, weekend before last. And here's somebody who had a ransomware attack as the news stories say they paid for the ransom. And that was the recovery after paying five million was slow. So they had to go and figure out how to recover from the backups and that was not fast enough. So defense in depth is something that has really been the mantra and just like protecting a home, right? You're not just looking at putting an alarm on the front door. You have sensors on your windows, you have a fire alarm. You've got to say, if you've got different things to, in terms of really thinking through different threats, and Tim hit on a couple of those things, right? You really think about what is my weak link? What is my vulnerability? That vulnerability is now your software supply chain. So you're thinking about who am I buying things from? Are they taking care of stuff because they are now a new vector and that's kind of the biggest, I would say, new thing that has now been mainstream. Like a lot of these techniques are getting mainstream, but the fact that a software supply chain itself that has been deployed en masse is now vulnerable and that will be monetized. It might have started with the nation state doing that, but then now you'll get the, you know, people trying to take, you know, take it for ransom will start weaponizing those same vulnerabilities. So really that data and making sure that your crown jewels, you have a failsafe way of protecting that. And it's not just, you know, you need to practice the readiness of that like any system, you know, just having them there is not good enough. Like, can I detect issues? What is the ecosystem that's part of? How is my identity tracking who has got access to that? We've seen a lot of interesting things as part of why we're starting creating services like a air gap service in the cloud. The customer doesn't have to worry about managing credentials because even those were getting compromised. People were stealing the credentials to go delete the backup. So the, you know, the steps keep living forward. There's a lot of money going in the research and development of malware and the industry in partnership with customers in partnership with local and federal authorities are going to have to figure out how to tackle this together.  And I would imagine for you as a practitioner, it's challenging because you don't have a blank checkbook. I mean, yes, you can spend, you have to spend on cyber, but you have all these, you talked about, you know, digital transformation in an earlier discussion that we had and you've got to figure out, okay, how do I apply AI and automation? You've got a talent gap.  So you don't have this unlimited budget. I saw a stat, there's a company, it's cyber security ventures. They said by 2025 we'll lose $10.5 trillion annually to cyber attacks. And I think, you know, if I look at who's ever numbers, you look at IDC, I think has one of the higher numbers out there, it's like a hundred billion that we spend each year on cyber. So it's infinitesimal compared to the value that the bad guys are extracting. So how are you dealing with that complexity, fragmented, you know, security tooling, lack of talent turnover and all this stuff and the budget challenges. How do you deal with all that? And I do not want to use this word, but it's as easy as research and staying on top of everything. Everyone knows you update your virus definitions. You keep that up to date. You close your firewall holes. You have denies at the very end of every firewall. You make sure you keep track of these small things.  The Commvault IDA has a feature that keeps track of changes or modifications on a server. So if I have a server that's actively getting hit with a ransomware, Commvault reports me an alert and tells me, hey, we have had this many files modified within this time period, look at it right now. So on top of everything else we have because it's not a replacement for our virus protection, but it does help us and it does keep track of things. And Commvault as well as a lot of other companies out there are doing some great things in closing up small little gaps and adding little features that could really help us move forward in the future and keep us more protected, I guess I should say. Yeah, well Manoj, I mean the backup corpus is sort of the last line of defense. It's also could be a first point of attack because all the valuable data's in there. So I'll give you the last word here on this segment. Thanks for doing this with me guys. How do you think the industry needs to approach this?  That collaborate, share risk vectors, making sure that systems are connected and they're not siloed and that will really make sure our customers are getting the best out of all of us and you have to build an intelligence of the products or anything static. Just like you said, the backup is where the crown jewels are going to go after that. So your backup systems need to have AIML. They need to be able to detect any kind of suspicious activity. You can't just kind of code it in and just expect that what you thought will work in the lab is how it's going to behave. So, but in general, unless there's a bigger penalty in terms of the response to these kinds of attacks, as long as they keep getting paid, they're going to keep doing this thing. So you got it, follow the money is the simple word. Let's take that rich ecosystem that's funding them and replace it with a tight partnership between companies and customers and partners and governments. Guys, well, I mean, the equation is pretty simple. Value equals benefit over cost. If you can increase the denominator for the bad guys, it'll lower their ROI and that's kind of your job. And so keep up the good work, Gents. Thanks so much for coming to theCUBE and talking to me about this very important topic. Really appreciate it. Thank you. Thank you for having us. And thank you for watching this CUBE conversation. This is Dave Vellante. We'll see you next time.


Welcome to All Hands Up. I'm Petty Officer Matthew Halls with your headlines from around the fleet. Secretary of Defense Chuck Hagel has ordered the services to retrain, re-credential and re-screen all sexual assault prevention and response personnel and military recruiters. A Pentagon spokesperson said Hagel directed the retraining to address concerns over recent allegations of sexual abuse and harassment by military members in the positions. The Navy exchange recently announced a change to its price match policy. The next will now match prices shown online at Walmart, Target, Amazon, Best Buy and Baby's RS websites. The qualifying online price can be presented on a mobile device and verified by a next associate. You can read more about these stories at navy.mil. From All Hands Up Date, thanks for watching.