Hi, I'm Kali Emory, Group Manager of the Workplace Relations Implementation and Safety Group in the Department of Employment. I'm also the Commonwealth member on the Safe Work Australia members board. Thank you for joining us today for a presentation by Professor Dennis Els as part of the virtual seminar series on the Australian Work Health and Safety Strategy. Firstly, I wish to acknowledge the traditional custodians of the land we are meeting on, the Ngunnawal people. I acknowledge and respect their continuing culture and the contribution they make to the life of this city and this region. I am delighted to introduce Professor Dennis Els as today's presenter. Dennis was formerly Dean of Engineering and Science and Pro Vice-Chancellor responsible for organisational development and change at the University of Ballarat. He was the Chair of the National Occupational Health and Safety Commission from 1996 to 2002, a predecessor of Safe Work Australia. As the NOSH Chair, he was instrumental in the development of the National OHS Strategy 2002 to 2012, which is the precursor of the current Australian Work Health and Safety Strategy 2012 to 2022. Dennis' contribution to Work Health and Safety is truly inspirational. He developed the first Australian standard for OHS management systems and improved the quality of auditing processes and performance measures. Since 2006, Dennis has combined his academic position with a strong business focus as the Group General Manager Sustainability, Safety and Health at Brookfield Multiplex Australasia. His role consists not only of increasing the focus on safety across Brookfield Multiplex, but also representing the company as a board member of the Cooperative Research Centre for Low-Carbon Living based at the University of New South Wales. Please join me in welcoming Professor Dennis Els. Thank you, Colin. Thank you very much and it's a great honour to be able to reflect on the progress that we've made as a community. The opportunity is quite rare that you get asked to sort of do this reflection on the past, the present and look into the future and then highlight some challenges and where the opportunities may lay. And in doing that preparation, it was really quite rewarding to see the progress that has been made by us as a community and that's a vast number of people putting their efforts over a long period of time to improving the health, the safety of people at work. Now, I think probably what I should just say that is that I've looked at the data and of course the data is not necessarily very good for working out what we've achieved in the health area. It's much stronger in trauma and in the area of fatalities. I think we've probably in the last 30 years reduced the fatality rate by around about 70% in this country and that's about as good as I've seen elsewhere in the world. I think the German Beruf Gnossenschaft over 30 years got about the same reduction and that was from the 60s through to the 90s and that was a period in which they had this wonderful combination of focus on health and safety but also productivity and that all done within industry sectors and it was a lovely model that their structure enabled them to use. But we may have achieved a lot but there's still much to do. I mean if we look at the moment we've probably got a couple of hundred traumatic fatalities per year in this country. We've probably got about three times that number, 600 new mesothelioma cases per year and we've probably got ten times the number of traumatic fatalities that are occurring as work related fatalities due to occupational cancers, respiratory disease and other matters that we would put down as occupational disease. So there is a huge amount of work still to be done and I think it's really important that the successes that we may have had in targeting trauma are reflected upon and then applied to the real challenge ahead which is in the occupational disease arena. So a lot of people have contributed to where we are today and they've contributed over many, many years. I mean if we look at the, nothing can go wrong, go wrong, go wrong. If we just look at a sort of timeline for me, I don't actually go back to 1830s to reflect but for me the industrial revolution and then in the wake of that starting to have inspectors with a few people riding around on horseback paid for the hay but other than that it was a calling amongst those people to do good work and those early factory inspectors in the United Kingdom, the work going on in Germany and in the United States are very, very important work and in those days there are also a lot of sort of interest in health matters and I wonder why we've not made as much progress in health as I think we have in fatalities and I think part of it are the difficulties of measurement and as a physicist myself, I got into occupational health and safety via physics and an interest in noise and occupational deafness. So for me the sort of grand old man of occupational disease is Thomas Bar, a Glasgow ear surgeon. I married to a wonderful Gleswegian woman and so I can imagine how he may have sounded it but he in those days he couldn't go out and as I was able to access specialised equipment for measuring hearing and noise so he had to improvise and the improvisation was to use his pocket watch and he would just use a pocket watch and a yard stick wait till the person could say that they could hear the ticking of the watch out came the yard stick and measure the inches of hearing. So he had three groups of workers so it's early epidemiology and he had letter carriers, iron moulders, foundrymen, they would be called in those days and most of them were men, boiler makers, in actual fact it's interesting I don't think the language was as sexist then because the jobs were all going to men so you didn't have to specify you see letter carriers it's not postmen, iron moulders it's interesting I think anyway but now the letter carriers that's not 5,674 inches of hearing for one postman that's distributed across two years and a hundred people so you're talking of what was that about 28 inches away or 70 centimetres by the time you get down to the iron moulders you're down to about 16 inches rather or about 40 centimetres and by the time you get into the boiler makers you're practically squashing it into some of their ears it is about three and a half inches away on average sort of nine centimetres. Now back in those days they had ear plugs they had disposable ear plugs they had this new material called plasticine that they mixed up with cotton wool and made themselves disposable ear plugs but one they didn't have was real controls of an engineering type or controls at source it was all down to the individual. The as I say the letter carriers were probably all men but the factory inspectors were also all men and over here it was the same by about 1893 the first female inspector in the UK was appointed. South Australia of course always the lead in innovation by 1894 had appointed our first female inspector Augusta Zado and she was an advocate for women she set up the first women's trade union over in Adelaide and really did a vast amount of work on the clothing trade and the sweatshops and she died about 1896 while preparing a report on the early factory tax. She's still commemorated by South Australia's Augusta Zado scholarship which is sort of introduced on her centenary of her appointment I think and for anyone that is wishing to apply it has an interesting sort of requirement that is for individuals who have contributed to women's health and safety so a very very powerful advocate and I think the trade unions have over the years you know had a very important role to play as advocates of this subject of health and safety. Now these early pioneers they were quite quick to recognize that you really wanted to find a control that was sort of upstream and was was going to be technical in nature rather than just trying to rely on on people to change what they do and the earliest example I've got is in the work of Sir Thomas Legge who was the first medical inspector of factories back in 1897 in the UK and much later back in the 1930s so he was probably giving the equivalent of this lecture you know as they they give you the opportunity to speak on these issues before you fall off the perch you know and and anyway he's he came out with a number of axioms and it's it's it's really interesting I think to see what he was wanting to to tell people about. The first one was unless and until the employer has done everything and everything means a good deal the workman can do next to nothing to protect himself although he is naturally willing enough to do his share so it sort of shows that it's it's both need to be playing their part secondly if you can bring an influence to bear external to the workman that is one over which he can exercise no control you'll be successful and if you cannot or do not you will never be wholly successful and so there was this push to go upstream and engineer out problems and you then had in you know that got expressed in a number of different ways by the the 1930s it was within occupational hygiene it was called a hierarchy of control um and we tended to use that term and it's it's embedded in our legislation today now it's it's I think this is really important because it's it's a lasting legacy of that sort of period of focus on the technical part I've now got and now realize that of course this system of a red dot is really a method of measuring how nervous you are when you're speaking it's a lovely it's a lovely system right so now so the idea is that if you are um controlling things by eliminating substituting isolating or engineering out then you've got more effective and more robust controls if you're relying on administrative controls or personal protection then you're less robust and you're going to need more supervision in order to make sure that that works I mean it's fairly obvious but it's central to much of what we do and you know there's paper published last year by Michael Bem who who actually attributes Australia's national strategy and it's involved its focus on safety and design as changing the US in their approach to health and safety because he says he could get no interest whatsoever in safety and design in the US until we became so open about its importance at a sort of a government level now Michael last year published a paper in which he looked at what was it something like 250 investigations of incidents across about seven organizations and what he found was that if we were to go and look at the administrative and personal protection area down this end then the recommendations of 80 percent 80 percent of the investigations had focused on that as where to control of these 250 or I think it was 247 preliminary but anyway of these incidents there were only 20 percent where the focus was up here now that's a challenge for us I think a real challenge as we go forward and you know that technical emphasis or focus has been followed by a focus I think given quite a push forward through the 19 sort of 50s after the sort of second world war and the involvement of a lot of engineers getting involved in engineering problems out of the workplace and doing the right thing in that sense I think the the engineers started to focus on the human factor and I think they started to see people as a problem and you've got to engineer around those people I mean it's a good concept in one sense I think and it reflects what Thomas Lager had been saying about taking the control away from the individual but I think there's also a bit of a problem I mean the I ran a department one time a school of engineers and I remember the the joke at the time was you know how do you how do you detect a a people-centered sort of engineer and and the the answer was well he's the engineer that looks at your feet rather than his own feet when you say hello to him now there's there's a tendency for engineers to be quite sort of compliance minded and focused on the the the engineering um I one stage tried to change the nature of engineering and then we found research that really showed that many engineers have chosen to be engineers at very very early ages you know so in fact you can't really do it change the nature of engineering after they joined engineering because you've already got a uh self-selected population but anyway in in this period of human factors research it's all about error how do you stop error wonderful work being done wonderful work being done by people like James reason with a model the swiss cheese model in which you have defences in depth and layers of defences and you try to make sure that the the little holes in the swiss cheese don't all line up and such that there's a sort of accident trajectory that runs through all those defences um it also deals with the the challenges of the sort of not just direct pathways of causation but also latent pathways where perhaps the failure to do something on behalf of uh uh somewhere in the system uh means that the defences are not there when you want them so there's lots of really important work done there and I remember one experiment which really is is quite thought-provoking that was done by the psychology department at Harvard University and it's actually it's it's really important to the point where we sometimes at Brookfield multiplex use it with new groups of young cadets to give them a sense of how they should not rely on human beings being able to recognize uh the growth of circumstances and problems it's many of you will have I'm sure seen this before but it's a the experiment is is something which for instance we would have a group of say I'm the one I can remember would be a group of 28 new cadets they've come fresh to your industry they're really keen to be successful you're briefing them the first time they're going to be working with senior managers and getting to know the business and working with each other and they're really really trying to impress one another and you play them a video produced by Harvard which is two groups of three people one dressed in white one dressed in black and there each team has a ball and they're passing the ball between the their respective team members and bouncing it on the floor and you get the people a difficult challenge and that is that you want them to count the number of air passes and floor passes bounces that occur whilst the video is playing and these two teams are just sort of passing this ball around a net a basketball net behind them and at the end of the little experiment you ask them uh you know how many air passes how many bounce passes some of them get it right phenomenally accurately but then you see a bit of unease in the group because the example that you see in in my memory is out of the 28 there were only I think it was two that were showing unease and with great temerity one puts the hand up and says well it but but the gorilla and the other sort of 26 turn around say what gorilla and in the midst of this video it turns out it's a woman in a gorilla suit has walked in front of the camera and is waving her arms like this you you cannot believe that people could have missed it and that uh well in nature of fact we I remember this particular circumstance because we had another cause of their entries about a year later and we redid it but I couldn't make it to the first day of the program so we did it on the last day of the program they now all knew each other they all were comfortable being in the presence of senior managers and each other and probably given it was a Friday morning that had some drinks the Thursday night so they were very very comfortable and about half of them saw the gorilla so it's a good way of getting across to young people that some of your best and most focused workers might be the ones that are going to miss things and that video has been was used in part of BHP by one of my master's students increasing the near miss reporting because you changed a near miss from being something that silly people are involved with to a gorilla moment and the low that language was used within the site I've had a gorilla moment and the reporting went went up so psychology has a lot to offer us um but around the um probably the 1980s as was mentioned in the introduction I you know I probably have to own up to having been involved in helping to set up you know the the Australian standard on management systems and you know to many senses I think we it has helped us to go into a little bit of a a side branch and and move a bit slowly with a great focus on paperwork and bureaucracy doesn't have to be that way but I think it it has probably been a bit that way so it was meant to be all focused on continuous improvement it was the era of you know improving productivity and quality anyone that was alive then like I was you you probably have been to events where you felt you were in a Billy Graham sort of revivalist movement and you're going to be asked to come up to the front and affirm your belief in quality at any moment you know there's this huge interest in quality and people started to put quality that plan do check act thing together the whole idea was that you had lots of focus on continuous improvement that wheel in the middle and minimal but enough of a chock of assurance to make sure that gains in performance that you'd achieved didn't just slip away but I think what we have delivered to our community is that image which is a huge chock of paperwork and hardly any time left over to get on with talking to people and continuously improving our systems so you know I think you know we have problems in this country we have safe work method statement still that a 28 pages long the concept of a safe work methods statement started as something which was one page and had three columns and got you to think about what and plan what you were going to do understand what the risks were and what the control should be and focus on them with that hierarchy of control in mind to get controls that were robust and I suppose I'm suggesting that there then came a sort of realization that it's not one or the other of any of these it's really the integration of them all and trying to get the right mix and that means it I mean it's a bit like I remember my my mother at one stage sort of I was crying about how I was quite a good cook at the time and then she said to me test of whether you're a good cook is on a Friday evening and there's nothing that you've bought but there are scraps in the in the fridge and you can make a beautiful meal that's the test of a good cook and I think that's the test of a good health and safety person you know a good health and safety person advising organizations is not one that brings in new products from the supermarket they're the person that looks in the fridge sees the scraps that are there from previous attempts to improve the performance of the organization but then can weave them together in one blend them in magnificent ways produce to produce a meal that will improve the performance of that organization and I think that so with with respect to my mother her words guide me still and I think with integration that's what we're about we're about recognizing that you do need the suitable organization and management systems you need the well-designed physical environment you need the competent knowledgeable workers and you need fit for purpose equipment being brought in and suitable rules and procedures and those all go together and I would just like to acknowledge David Boris I think is appearing in another one of these sort of virtual sort of seminar series for the authorship of many of the ideas of bringing that together it's also instrumental in our thinking as we started to realize that really with human beings adaption takes place and I think that we're now on the in a time period when we ought to be admitting more to the fact that human beings constantly adapt if they didn't adapt nothing would actually work it would they need to be adaptable they've been designed that way by that great big designer in the sky so so I would argue that there's the what is coming is bit of a shift and I think the shift is from the human being as a problem to the human being as a wonderful part of the solution in complex systems but the only way we're going to get the benefit out of that is to communicate with people in a far more honest manner about the reality of working lives and workplaces and stop making out that everything is perfect out there and it all works to a wonderful system everything out there is a first approximation and you know when once the battle begins all the plans are out then we get reality again so in fact it's life is constantly replanning constantly changing and the human beings are our sort of biggest opportunity there so adaption I'm suggesting is inevitable and that means that you get perhaps that adaption can take place and there's probably a boundary beyond which you get a bit worried when people are adapting because they may now go to the point where you're not comfortable that those adaptions are taking place and very easily you can get a shift between the work as you are imagining it's being performed and the way the work is really being performed and you get this drift occurring and it happens over time and it happens for the very best of reasons because people are trying to perform and they're trying to perform well now as we do this I think that you know really what the challenge is going to be for us to surface where adaption is taking place and I can assure you it's happening everywhere right but surface that adaption and then have the conversations to find out which bits of adaption you want to actually learn from because it improves performance and which bits of adaption you want to find ways of damping down because it's a bit risky and that means that we're really in the in the realm and acknowledgements to David Burris again something he's produced this year which has really come down to I think admit that the sort of conversations that take place are the very lifeblood of health and safety in our workplaces and you know so and storytelling really is the the the sort of food on which we we we grow the organization we we are elastic or as he tends to be now calling sort of plastic as you start to shift but what you're trying to do all the time is surface this drift that may occur into failure which in most of our organizations we have no processes for picking up that drift no processes and and out of this I think what we've got is a a shift which is demonstrated in the the workings of uh hit the wrong button whole nagle you know and it's quite instructive when he starts to demonstrate it in an image like this you know that's that in fact failure is occurring very infrequently and successes they are all most of the time so why are we only learning from the failures why aren't we learning from the successes and then applying that that all of that opportunity into uh reducing the the failures and there are a couple of books that I would like to mention because I think they really are a worthwhile read as we start to look to the future and one of them is the book by whole nagle which is moving from protective safety to productive safety and argues for a reframing so instead of in safety one thinking of as fewer things as possible going wrong we start to think of as many things as possible going right in the way that we manage we become much more proactive and much greater focus on anticipation of developments and events in our explanation of accidents we we recognize that these things are going on all the time um the the the adaption is there pretty constantly so let's face up to it and understand it and in terms of human error shifting from that problem the the view which I suggest was early in that human factors sort of focus of uh the human as a liability um to now human seen as a resource for getting system flexibility and resilience where resilience here is you know very much a system sense of resilience not what sometimes is being talked of in individual people being resilient this is about a system being resilient and the the role of performance variability instead of being harmful um and we should stop it and constrain it what what we move to is a view in which we're saying that uh it's inevitable but it's also most of the time useful so we should uh monitor it and and manage it and uh Olnagel tends to present this as a little sort of continuous loop with the focus on the work not as imagined but what's actually being done out there um let's focus on what variability is occurring let's look at success and failure and learn and improve and and in that I think it's a challenge is that we should be applying that not just to trauma but to occupational disease factors so for me that's that's the historical sort of past present and I think where the future's going to take us um when I come to challenges I think there's this when I started writing the the challenges down most of them turned into opportunities anyway so I ended up with really only one that I could only see as a challenge and not could turn it around into an opportunity so I'll go to really one uh strong image and I think myth that is pervading our society not not in Australia particularly it's around the world in the the western world anyway um and it's an image that it's a real demonstration of how if you can think of a a diagrammatic form it can take on a whole life of its own and this is the safety pyramid um and a former colleague Andrew Hale wrote a lovely paper about it oh 20 years ago I suppose in which he used the not in the title but to use in the text the the words the the myth of the safety pyramid and this myth goes the following way and that is that if if you focus on the first aid injuries and you'll reduce lost time injuries if you focus on the lost time injuries then you'll eventually reduce the fatalities now that's a total misrepresentation of what the early researchers were doing all they were doing was saying we've been out there and we don't get anywhere near as many fatals as we get lost time injuries and we get an awful lot more first aid injuries they didn't make any causal links between them but when once you put these things in a triangle or a pyramid other people do make the links and much of our community in Australia is still so haven't I know it's much moment in our global industries it's the same it's this focus on lost time injury rates now there is so much evidence about to say that that's not what they should be doing because there aren't causal links there if they want to express something in a triangle and people often do then at least express something that if you you might get the right story out of and and that might be this one which is okay why don't we learn from every near miss that relates to our critical risks and that might stop some fatals and plenty of papers as mentioned there but just consider the importance of what this diagram is doing you know if you take the very very important work that Andrew Hopkins has done over many years now taking disaster reports and commissions of inquiry that everyone wants to just put on the shelf and forget and pulling them out and telling them and taking the learning from that and forcing it back into our community it's a wonderful thing that he has done Andrew Hopkins and you just go back through his disaster reports and how many of them have these sets of circumstances in which people have been convincing themselves that they have got risk under control and they go out rewarding people for getting risk under control and where they're that because they haven't got many sets of data that they can use to give them a sense of fatality risk they're using this minor injury risk and studies that where you know if you take countries that have probably are more invasive than we are in terms of insisting on data collection you know if you take a country like Finland I'll always think that Scandinavian countries almost sort of put a barcode on your body when you're born so that they can keep the data well and but there are some great benefits from it so here runs of data on fatality rate in the construction industry in in Finland over I think it was 15 years and look at the count what looks counter-intuitive to start with that the counter-intuitive that when you've got the let's get it right the lowest fatality rate you seem to have the highest reported injury rate and you can go in all other sorts of places to get similar confirmation of that yeah a little bit later than this data from the airlines industry came out and showed that the the the same is true in terms of reporting rates for different airlines all the correlation coefficient shown in table one I'm reading for flight safety report are negative which means that carriers with higher rates of non-fatal accidents incidents had lower mortality risks furthermore the correlation shown become increasingly negative as the events become more severe if you look at the the in the United States and you look across the quite recent paper wherever it is 2013 that states with low non-fatal injury rates have the high high fatality rates and vice versa how weird well it's because of reporting I think but I don't know if we look at reporting a study of a sort of closed system where you had all the you had both what people were reporting as companies and you had what the actual was because you were running the insurance records as well so you can actually look at what the real data were so and they what they did was to classify the I think it was around about a hundred subcontracting companies in terms of whether they would be perceived as having a good safety culture or a poor safety culture and surprise surprise they had exactly the same injury rates now I don't find that surprising because if the poor safety culture company was saying it had very high injury rates it wouldn't get any work so of course it's going that but it may be that that's what was coming through to them directly shouldn't be unfair but if you now look at what was unreported even the good safety one there was about an equivalent number of cases that went unreported but you had five times that unreported in the poor safety culture so most of these measures are more about reporting than anything else so beware the safety pyramid and I think it's a challenge which I would encourage you all to accept to go out and champion to get rid of the use of lost time injury rates in the the way in which you assess organizations and make decisions on subcontractors or decisions in the supply chain and so on you know otherwise we are promulgating this lie so let's turn to opportunities and I think you know first one is there's an opportunity I think for leaders to be focused more on critical risks help them to move away from lost time injuries and put their focus up there on permanent incapacity you know sort of class one class two type injuries and fatalities but bear in mind the elephant in the room you know we're talking fatalities here probably people's minds are going to trauma fatalities but how about all the occupational disease that's up there that's the big one so we need to make sure that our learning from traumatic fatalities where it's a bit more obvious is really honed and sharpened so that we can apply it with great gusto into occupational disease and one of the ways that certainly you I must pay tribute to my colleagues on the executive board of Brookfield multiplex I mean they've they've accepted having an idiot academic present with them for the last eight years in there all their decision-making in relation to the board so it's not just health and safety is about everything we do because we have a strong belief that the health and safety flows from the decisions that you make as a business and so I'm there through all of that lot and they have taken on board these things seriously and then taken on board the old adage of what interests my boss absolutely fascinates me so that unless they're prepared to put time and effort into something and cascade it through the organization by virtue of the conversations they have and the interest they show then nothing new is introduced we don't introduce things off the supermarket shelf down around the business if it's important we'll buy into it and cascade it through the organization and for instance the first one of those was probably safety and design which I'll come to in a moment but the the second one was really getting this push to learn about the variation that's taking place and learn about the significant potential incidents that are out there but you know in in the old world in the safety one world probably you know the the strong culture of a project would be tested by does any bad news leak from this project you know it's how tight is this team in holding in bad news and the cultural change required by the senior management is to demonstrate a different world in which a complaint is a gift there's learning in this and that in actual fact we want to hear bad news and we we want to hear bad news to the point where we are prepared to come to the board table and share our problems and take the other members of the board through significant near misses that that that we ought to learn from and then cascade that as a as a as a culture through the organization and so when you do that you can get remarkable changes in the amount of information that flows up and your challenge is not now to really get hold of the information it's to run the systems that can live up to the invite you've given to people to tell us about things that are going on out there and that is an organizational challenge because you need to be able to triage that and focus on that which has the most learning in it and then transfer it around the whole organization that's not an easy thing to do but i i we we all have to face up to it and do it and so that's just the the growth of those things and it's interesting that you see challenges for people in this because of course um you know if you're part of a large group then you start to raise concerns in the larger group because suddenly it could look as though you've got lots of significant problems out there but really all you're demonstrating is that you are more open perhaps than the rest of the group or the norm and that that requires strong leadership to be able to take that message and take it to your parent and and fight to change their view of these things as well and and change the industry and i i've been pleased to see the way that the organization that i've had a chance to sort of spend a lot of time with has been up to that challenge so um we're still on opportunities the big one the big big opportunity that i see is actually going upstream and i would characterize this in in sort of saying that we we have tended to look at um health and safety just where the the daily work is being done but the the work may be being done there but it has been planned and organized often somewhere else and it is in that planning on an organization often upstream from where the work is being done that is your biggest opportunity to have an impact on trauma risk and occupational disease and i liken this to there was there was an old sort of joke about the the person comes out of the pub and sees someone under a lamppost scrappling around looking for a coin and i've shows how old the the the little anecdote is because it was a sovereign that they were looking for and so another person gets down to help them then a few more people come out of the pub and they they they're all scrambling around looking for the coin and then last one comes out of the pub and this is probably not enough room for them to get down there and they ask the question so where did you drop it and the first person says well i dropped it over there but the light's much better here and i think that is what we've done or in danger of doing in health and safety we put a lot of effort into the area that where the work is being done but we really need to go upstream and why don't you do go upstream you get some very positive outcomes you actually this is going back in brookfield multiplex 256 of our past sort of projects and you realize that when once you start working upstream that's the area where you can get maximum reduction for lowest cost in terms of the maximum improvement in performance and you know we've got lots of studies going over 30 years in different industries showing that the front-end loading of a project or the setting up of the business makes a huge difference to the performance outcome and it's where you can get the biggest return and this of course fits quite neatly with safety and design if you put buildings up like sort of brookfield multiplex does this one shelly street in in uh in sydney and this it's got this weird external skeletal framework now that that would be originally planned to put that up in sort of in in the air as it were but thinking behind it was well actually should we be changing this should we be going off site much more fabrication off site because bear in mind that the moment you make the decision to move from doing this in a construction area to doing it in a manufacturing you sort of halve the fatality risk if you're taking to account what the risks are for instance this is us data but for steel fixers you're getting a sort of probably five-fold reduction in risk and that means that we can quite dramatically reduce the hours that are on site move it into a factory environment reduce the risk and probably get something of the oil to river 75 fatality risk reduction and bear in mind the elephant in the room is that you can control the exposures of people to the chemicals uh products from welding fuel and whatever so much better when they're in the factory environment so storyline for this really is look we've got a huge opportunity um but we've got to get that conversation going between people and in all of those areas upstream it means lots of people talking to one another and i think you know that old saying you know you've got to walk the talk well i reckon there's you almost got to reverse it and you've got to to sort of talk the walk and the and the fact is that we need people whilst they are walking around doing much more talking and listening to people uh as as about the real conditions and doing this is quite quite consistent with getting higher performance out of our organizations if you look at the sort of studies that have been done on what makes for a high performance workplace they're they're they're very strong and other sessions in this seminar series go into that in much more detail but there there is such a wealth of experience now showing that getting the the sorts of things that we're arguing for here in this more listening version of health and safety is consistent with higher performance the the example i'll use is a study by daryl hull in which they went out and got companies to put forward organ within their organizations workplaces that were good and workplaces that were exceptional and so they then looked at the exceptional workplaces and saw what were the differences between just having a good workplace and a really high performance workplace and they then um this diagram looks a bit like a bubble diagram which shouldn't be shown when in camber but the um that what it's trying to represent is that the further you are or the closer you are into the center is a greater importance explaining more of the variance and so what you find is that good working relationships way above anything else are what produces the exceptional performance in the workplace and yes feeling safe is a is a really important part of that you're a little bit further out but it is still part of that uh importance and having a well-built environment where people have thought about hitting you up to be uh able to do the job well is really important as is learning etc etc i won't go any further with that but just say all of that comes together you know we it means that companies that actually do this are going to outperform the rest and here in australia there was that lovely study which um west bank kindly sort of got their analyst to do which was to take a construct a portfolio of companies with good oh s uh arrangements across all sectors of the all ordinaries and then rerun the data as a back test if you'd had a portfolio of those good oh s performers would you make more money and yep you would so the there is a good association between good oh s arrangements and good financial outcomes i'm not saying one causes the other or whatever but it does mean that there are a lot of people that are now starting to produce reports for investment analysts so that they can actually use the health and safety arrangements of a company as an indicator of how well strategically managed that company is as an indicator of its ability to deal with risk and you know westpac stuff coming forward was even more powerful so i would just like to sort of draw to this together and indicate that you know the strongest message probably is the one that isn't up on the screen because i've emphasised it time and time again is the shift in terms of us being able to do fatality risk well but now apply that to occupational disease and within that i'd say that the the opportunities are let's let's you know we need to understand critical risks and the critical controls that have to be managed for those critical risks we have to understand and articulate how workplace health and safety can actually add value to a business and the particular business understanding this particular business on what does health and safety have to offer because it does and it's just a case of looking hard and being able to articulate it we need to integrate the health and safety with the other business decisions and we need to i think provide a sort of roadmap that aligns with where a business is hoping to go it's really trying to understand strategically where an organisation is going or an enterprise is going and then map the health and safety within that journey and focus on social processes not just paperwork and i think you know all of us get involved in going out into organisations and i most leaders now in organisations do try and get out into workplaces but i think we've got to cascade that through all the organisation and make sure that managers in the middle of the organisation are having the conversations with the people doing the work you know finding out what worked well what did not go according to plan or was difficult or frustrating what could have gone better and what can we do to improve things around here and i think if we take an interest in the the understandings that people in the workplace have and take as much of an understanding as those early players like bar laying an augusta zado dead then we'll be all right and we will make a big difference thank you thank you janice um we have time for a couple of questions so if anyone has a question if they could raise their hand yes down the end here i should just wait for the mic and introduce yourself please uh david say grot australian health and safety services denise i'm interested in your move forward just from uh the management systems approach into adaptation yet what i'm seeing happen is a resurgence of the management systems approach where there is a significantly high level of focus on the paperwork audits compliance rather than the focus on the um the actual identification and management of hazards and risks in workplace more so and i'd be interested in your comments on the challenge that that presents in actually making the move forward but i think it is a big challenge because if we have a society that we've managed to lull into a sense of comfort that having all these paperwork systems is making big difference um and i'm not trying to imply that it hasn't been important i'm sure it has but it's the ability to now simplify to reduce the amount of them it it's now the hard work starts because you've actually got to make the hard decisions as to how you can make this more effective which things are you prepared not to have a lot of rules about how do you resist the temptation to respond to an incident by adding to the administrative arrangements around that job when in fact you really know the job will get done the way the job was done before but you can walk away feeling comfortable that well i've tried now that's it's i think it's harder this area of accepting that there is uh adaption and the safety too is actually harder but i think we'll find that people in workplaces will be surprised that we're talking about reality again thank you um another question yes hello Dennis mc puterson uh Dennis just a question about how we can share our successes and our failures better across industries and within industries and who should be driving those sorts of processes the um that almost sounds like a Dorothy Dix i've spent years trying to get um a process whereby there is a sharing of the innovations between organizations um and i i think that i'm i'm almost coming to the point now of realizing that perhaps things you don't it's it's more what happens within an organization than seeing something come from outside i think i'm uh now having worked for the last eight years in one organization trying to effect change i have lesser belief that codifying and producing good ideas amongst people that are already have very busy will actually get picked up and use and so i put much more effort now into teasing out the the few from the many and then putting a lot more effort into how do we get the conversations to take place around these learnings and i think that's been a shift in me over the last eight years whereas you know before i thought if we could just capture all these good ideas obviously people will pick them up and use them it's nowhere near as easy as that thank you um i think we have a question over here yes windy elford um i'm a futurist and agonist my question is about wellness to illness as a continuum and if it's context defined so if you're looking for zero harm we're going to have a problem um i guess shifting people towards understanding that if you're not sick how well are you and how can we put the resources in whenever we're trying to close um the system um through um i guess missing injury when promoting wellness is actually quite an expensive thing as well there's a lot of gains to be made and zero harm i think is going to be something that we'll have to be realistic about yes i think what the words you use there zero harm is something we have to be realistic about is really important because i think they are laudable as the aims are and i think you know there are proponents that will have uh able to articulate the strength of it i i i find that um there is a challenge of of people not believing that that fits with the reality of the lives they see on a daily basis you know and um i remember there was work done by dump fee and state looking across many australian organizations and they came to the conclusion that health and safety was often used as the litmus test by people in the organization as whether the mouthings of senior people about you know people are our biggest assets or whatever whether it was real or not because they could see what one of my being delivered on a daily basis compared to what i'm hearing and i think that that's that's one of the issues with zero harm that you're often expressing a view about it but what people are seeing on the daily basis may be a bit of a dissonance there i think it's it's more important that we we focus on sort of very serious harm because i think that resonates more with people and i think the other party a question in terms of how do you have an impact on some of those other wellness issues i would not underestimate how important being heard is in terms of wellness and just listening honestly to people about the real work they do and valuing them as specialists in whatever it is they do they're always specialists in some small part of the business processes and ought to be recognized for that and i i think we we we often miss a huge opportunity to increase the wellness of an organization and certainly in the brookfield multiplex organization our we run opinion surveys every couple of years and i've inserted a whole range of questions in there which relate to whether people feel that they're being listened to and if they have issues can they rely on someone acting on them because if if they can't but i don't think we're living up to some of the value statements that we make terrific well thank you very much Dennis for that interesting and challenging presentation i was particularly fascinated by your discussions about the different ages in health and safety and the advances that have been made i think it's really important that we look back at the technical and scientific developments and the human factors and management systems which have contributed to improvements in health and safety but i think you've also reminded us that we need to engage with the adaptive age and that is how we tackle health and safety issues in the workplace and we must always increasingly constantly involve to meet the challenges of an increasingly complex world but importantly you have talked about the importance of communication i think that's always a good thing to remember so to all of you out there don't forget that you can view this and other videos that showcase the latest work health and safety thinking research and innovations during the virtual seminar series on the Safe Work Australia website thank you


Welcome to all hands update. Here's what's happening around your Navy. The Navy's newest and most technologically advanced warship, USS Zumot was commissioned Saturday in Baltimore. The Zumot features an electronic propulsion system, wave piercing tumblehome hull, stealth design, and the latest warfighting technology. If it was a soft ship, USS Iwo Jima conducted a dexwap of personnel, supplies, and three superstands with USS Mesa Verde off the coast of Haiti. The Iwo Jima took the lead for the Navy's support of humanitarian assistance and disaster relief missions in wake of Hurricane Matthew. Department of the Navy joined the Department of Energy in a dedication of a solar facility in California. The facility will provide one-third of the energy needed to run 14 Navy and Marine Corps installations meeting the Secretary of the Navy's one gigawatt goal. You can read more about what's happening around your Navy at Navy.mil.


Okay, so welcome to another Crypto Village Talk. I'm Matt Singlethee, this is Trey, and we'll be talking about PKI, a public infrastructure, revocation the frailty of PKI, so specifically about some weaknesses in revocation. We're not here to drop O-days, but sort of to talk about the state of the industry and some things that are kind of challenging for the encryption that we pretty much use every day on the web with applications, probably the most commonly used kinds of encryption there are. Okay, so revocation began as something that you did directly to distrust certificates. When you've set up PKI, you have it working, you're gonna find certificates that get compromised, that have problems, they get lost, stolen, whatever, and you have to make them distrusted. So this is what revocation is meant for. And when that started scaling, it's evolved over the last 20 years. The after direct manual certificate revoking, which you do directly on your own device, or on a specific device, non-network related manner, the idea of bringing different kinds of devices together for certificate revocation. So CRLs are a way of taking a lot of certificates and bundling up in a file that can be dispersed. That evolved again because it didn't scale. If you have to have a large file with every certificate that's being revoked, that grows and grows and grows, it gets out of control. So OCSP is the next evolution of that, and OCSP is a protocol that think of it like a database query. You're saying is this certificate good and it'll come back and tell you within a time span, yes, it's good or no, it's not. So you don't retrieve all of them, you only get the stuff that you need. Down the road, so we'll talk about the weaknesses of these things, and then down the road, what the alternatives are. Shortlist certificates are constraining the timelines to do the same, try to accomplish the same goal, and an effort by Google called certificate transparency. So RFC 5280 is where these things are defined. In theory, there's two different states for revocation, which is revoked and held, but the reality is it's just the most common one is revoked. So a little bit of background here. When certificate authorities provide certificates that are signed, they do so in kind of three general assurance levels, that's known as in the industry, the CA industry, as DV, OV, and EV. The reason this is related to revocation is that they have different requirements. So you have a higher level of assurance with the extended validation, because the certificate authorities will go to much greater depth when they're vetting the entity that the certificate's for. And one of the things that go along with that that you get is that OCSP is a requirement, so that most current kind of revocation check is made available. So this means that when you buy that $400 certificate from your CA, they're effectively obligated during that two-year timeline to provide an OCSP server in response that will help, that will redress that. That way they're not compromising their intermediate and again, it's one of those things that's required. So this is, so when you hit the green bar in your mobile OS and you see the green lock and all that, that's typically involving OCSP at this point in time and CRL is still built into these devices, but less than that's commonly used. It's kind of grandfathered in. The CRLs are still there, just not as commonly used. So there are other assurance levels, I won't go into details other than to say CA's will do their own extra magic sauce for other levels. So for explicitly revoking trust, the methods vary by operating system. Mac OS X uses the key chain as a GUI and then the security as the command line tool. It's one from my work that I'm the most familiar with and that those settings for revocation are found ultimately in the system trust settings P list. Windows, I've got the TechNet article there to say it also has a GUI and you can dig in, again, exercise left to the reader. You can go and take specific certificates and mark them as untrusted.  I've got the command here for how Mozilla handles certificate revocation. A good example being a recently compromised certificate or at least a certificate from BlueCote that was not being handled according to the agreements that Symantec and BlueCote had. So it's one that you'd want to have pervasively across the internet no longer trusted or used. So to take another further example to dig a little bit further on Mac OS X, the security dump key chain will give you all of the system root certificates. There are about 190 or 180. Apple updates these on a quarterly basis or semi-annual basis. And that's, again, the root certificates. Removing a root is not the same as revocation. So revocation happens between the intermediates and the leaves. That's how the revocation gets managed. But again, to manually trust or distrust for the whole chain, you could take a root certificate and do a security add trusted cert deny. And then that certificate will then no longer, and all of the things that are a chain up to it will no longer be trusted. So with this command, you could, for example, remove trust to certificates from Turkey or China, things like that. So it's useful. But there being only 180 in the OS, if you drop the Verisign certificate, maybe you'd lose a third of all of your connections. So you have to do this kind of carefully. I don't think Apple wants to have this being commonly recommended. But if you do really need to lock down a machine, it's comforting to know that this is there. OK. So again, that's at the level of the root. So what we'll do for the rest of this talk is step through certificate revocation lists, CRLs, the old way of doing it, and then OCSP, the protocol that's more common and standard currently. So CRLs are encoded as a Dura-Rapim file, and effectively it's just a file that's being hosted. Within the X509 header of a certificate, there'll be an EKU, an extended key usage that basically designates where the CRL will be for that certificate. So when you're doing the chain evaluation, it knows where to check. So you would have a domain setup and a domain name associated with that, that when the certificate is used in a circumstance in which revocation has to be checked, which can also be a requirement in the X509 header, it will go out and make that connection and do that check. So OpenSSL, CRL, there's a command. I don't see it on the slide, but anyway, there's a command in OpenSSL to create the file that could be hosted that way. And then I just want to note in passing, in addition to the X509 headers, the certificate policy statements from the CA will also have these and describe how they're operating and how they're handling revocation. Next. So here's how to make Apache serve CRLs. There's a Apache config directory, SSL, CA revocation path, or SSL, CA revocation file, and you point that to the file where you're hosting these and then when the request gets made typically over HTTP or HTTPS, then that file gets received and the stack that's evaluating the chain will see all those things to revoke and prevent them from being evaluated as trusted. So basically, again, a CRL is just this bag of certificates that are untrusted that grows over time. Also OpenVPN has a directive that's related. So next slide. We're at other places you can find these things. Here are a couple of little Google strings that can help you just find scads and scads of certificate revocation lists that are hosted out there. The certificate authorities largely host these and large organizations that are doing PKI will also keep these collections of untrusted certificates. Once it's untrusted, it kind of sticks around forever. These things, the contents of those, you never want to say, well, we've been untrusted all this time, but we'll take it out. I mean, you have to kind of keep maintaining these lists and they grow, which is why OCSP is a more attractive option. Also want to point out that the policies for checking CRLs and handling revocation sometimes are at the operating system level and sometimes they're at the application level. So it takes a little bit of kind of thought to figure out when you're using an app, you know, is it your OS making the check or is it the app making a check? And a good sort of example here is Firefox handles it all within its own app. So it'll have the entire stack in Mozilla Firefox by itself. Mozilla has a nice feature that pushes CRLs in a compressed form out in every, on a three week basis. So Firefox is doing some really cool stuff. There's a file format for compressed CRLs there, I've shown. And then the patch where Mozilla has done that. Next slide. The reason that Mozilla and Firefox are doing this is that they're kind of keeping up with Google Certificate Transparency Initiative where you have large sets of certificates that are not trusted and yet not necessarily the ability to scale with a lot of requests because if you make a request it's more overhead every time you do an SSL request. So it's kind of hard to find but if you dig for it or if you watch your traffic for a three or four week period on Firefox you'll see it make a request out to this blocklist.adons.mozilla.org to pull down that set. And then again some links to Mozilla policies about where the CAs can report revoked certificates. But by and large it's not really in the certificate authority's interest to do a lot of this reporting to the public. It's more headache, it's things that don't work instead of things that do. So they're not terribly incentivized economically to keep the CAs or to keep the contents of the revoked set made public. So it would be good for us to keep the CAs on track and make sure that they're actually doing their job and handling revocation correctly. Okay, so onto OCSP. Again the online certificate status protocol. It's encoded in ASN1 with all the joys and tribulations that brings with it. So ASN1 is abstract syntax notation. It's very compressed encoding format. And it's as a protocol you basically are making an outbound request for given certificate or given chain to see if it's valid or not. Again run with very high availability requirements on and very low ping times for the big CAs. On the client side the requests are good for a given span of time and there's the span of time in which the CA can provide the response for, which might be you're good for the next year or something. And then there's the actual caching of that check by the OS or the application. So there's a lot of different sort of time slices to keep in mind when you're troubleshooting and working through this. Like I said, there's the official, here's what the OCSP server will tell you and then there's what the actual clients are doing with it. Those are very often very different timelines. So you'd want your browser or your device to check on a fairly periodic basis even though maybe the certificate's good for a year or two years, which is typical for EV, the next day maybe that was revoked. So how do you know it's still good? So there's this kind of set of different timelines about under what period of time the certificate is good. All right, next slide. Okay, right now we're just gonna walk you through working through a basic example of going through an OCSP query. And these are actually pretty straightforward. This is an open SSL command, the commands at the top, the first bit of the output. These are kind of long outputs. But basically what it's gonna do is start going to get the certificate. The next thing you would wanna do is save it as a file which is that last little redirect I've got at the end. And then literally it's this one open SSLX 509 command and this is all you've gotta do to parse it and you'll get this URL. And this is basically telling you the OCSP URL, URI. And that's basically all you have to do to verify where it is. For the next example, we're looking at how you actually do the query if you've got a chain. And this first step is the same. We're just gonna save the certificate to a file so that we've got it. But then this part we're gonna do is grab the certificate chain. And this is gonna vary in length, depending on how the certificate's signed, number of intermediaries, also sometimes where you're at if you've got an intermediary or whatever listening on your network or through your country or whatnot. But this is gonna pull all that data and you can start seeing inside of it all the different issuers of who all's in the certificate chain for that. The next thing is this is just a simple command. We're gonna save the chain to a file. And then this is inside of that chain file. And if you look at this right here, you see the I, I is the issuer.  So this is the thing that you're gonna have to pull out of that. And then this is where you're actually gonna verify the certificate with the issuer. And you can see what we did is we pulled the chain as the issuer. We did this for DEFCON. And then we actually are going straight to the certificate provider for the DEFCON OCSP URL. And that's gonna be a site. They're usually something like this, OCSP.SSLProvidersName.com. The important thing is not to be fooled by this successful response, but make sure that the cert status is actually good. So this can be a little misleading. You wanna make sure that you're actually getting the cert directly certified from the issuer. Okay. So maybe we'll just stop for a second. Any questions so far? Yes. So that those responses are signed. So they're signed by the issuing CA. There's an issue that we're gonna talk about. On the way, yes. Okay, yes? Can you repeat the question? So let me repeat the question and make sure I get it. So you're saying with this, the timeline for the next update, is there a reason for the client, is there a requirement for the client to go and make another request after that expires? So the question is, are the OCSP queries cached? Yes, the answer is yes. And the policy for that can depend upon the requesting stack. So most browsers and operating systems will have a cache for OCSP queries for that reason. And they'll all have timelines for when that's done. So when it does the evaluation, there's a time check every time. Hopefully that's helpful. Okay, next question. Okay, so just some words about revocation on iOS. These aren't typically things that you can access unless you've got a jailbroken device. The CRL is located in VARDB. The OCSP daemon is there. These were used in previous jail breaks. And so they've been attacked. It's part of the infrastructure that gets attacked. The revocation cache is in a SQLite file. And again, you can't do this on your iPhone unless you jailbreak it and directly work with these files. But when you get that SQLite file, you can actually take a look at the contents of a SQLite in SQL and query it out and see the contents of that. If you want to reset that, or basically, I think the only thing I can find that's sort of like officially sanctioned by Apple for interacting with revocation is, other than when you receive the certificate and it's not signed, you have the option to either trust it or not trust it at the very beginning, but is to use the reset network settings, which will blow away the cache. That's kind of awkward though, because then it gets rid of a bunch of other settings at the same time. So there's not a whole lot of granularity for this on iOS. But again, the goal is to make these slides a general resource for people investigating revocation. So maybe some helpful things if you want to look further and some pointers as to where to look. So in some ways, OCSP is a privacy disaster. And I think there's one takeaway from this talk. I would like it to be this, which is that as you're surfing and you hit a site where you need to, you haven't visited before, but say you go through an online commerce store and you visit some products and then you go to the checkout site, which is HTTPS, that will initiate the OCSP request when it's not cached. And so you effectively leave a trail of requests out to the OCSP infrastructure of where you've been. And it's not very commonly talked about that your browser history for HTTPS sites is being leaked or given to the OCSP server operators. It's called a responder. So you have to have a very high level of trust with your CA, the people who are running that server, because effectively you're giving them that snapshot of your browser history that includes every site that you visited that has an HTTPS connection on it. It would be good if someone kind of queried the big CAs to make even more clear whether they're using that data for any purposes. It would be very valuable for data mining. And it's not that there's a right or wrong answer to whether that should be done so much as the policy should be very, very clear to the general public what the use of that data ever could be. I've got to slide a little bit later that'll show the different levels of logging on OCSP server and they can pretty much get, I mean they're gonna get your time and date stamp, they're gonna get your IP address and they're gonna get the domain that you're requesting. Some user agent browser? That's correct. That's true. So let me repeat the question. The question is what about the non-domain cookies? So to be clear, this isn't your web traffic that's being exposed. It's only a check for verification of a certificate that belongs to the domain of the secure one. So you're not getting inside traffic. All your leaking is the domain name. Yeah, because it's cached, it's also not as powerful as a cookie where you're gonna see like that. You're just seeing the initial connection the first time that browser goes to a site that has HTTPS. So it's not as much information as Google cookies. So you only get a check for that domain. So it's not traversing. That's correct. It's on a per domain basis, but let's say, you know, if let's an example path might be like you go to Amazon and then you check out and so you visit a couple web pages for products, none of that would be leaked. What you'd leak is when it's not cached, the fact that you hit the HTTPS, you know, store.amazon.com or whatever site and the time and date when that happened. But again, you're effectively, it's pretty likely if someone wanted to go after that data, they'd be able to get a lot of specifics around what kind of device you have. There's a bigger issue is if you have a large scale aggregation of data, let's say you're in a repressive country or something and a whistleblower goes to a site and uploads some information and stuff, it might identify that whistleblower. So it's situations like that where it can become a much more dangerous scenario rather than the day-to-day user might have. Yeah. So what happens with the OCSP query fails? Yes. So the response where it doesn't know anything about it is actually then a pass because it's saying it's not revoked. So before I jump into the answering the question about man in the middle with multiple CAs, I wanted to point out that there are different levels of failure mode here. Sometimes the fail is hard, sometimes it's soft. So what does that mean? Does, do you continue on with that session enabling that encryption to occur or do you hard cut it off? And that's really up to the browser and the policies in your OS. And the different operating systems handle that differently. It'd be cool if we had a nice table showing how they all handle them, but they're a little bit different. So hard fail and soft fail is a difference. And if you don't mind, we'll keep going on the presentation and get back to the man in the middle thing a little bit later. So you noticed when we did the OCSP request it had that the date range at the bottom. They are time sensitive and basically again the cache is held by the device and it should can only be good for that. But you could have a certificate that gets compromised out within under that time window. So it's good to think of this always in terms of a timeline. So again, your EV certificate is good for two years but if you're looking at how this revocation infrastructure works it has to be able to provide effectively an ongoing 24 seven availability of is this certificate known to be compromised or not. So it helps to think of it in terms of the failure modes of the system as always having a time element to it. Okay, next slide. So revocation is not just for SSL. SSH certificates are quick show of hands. Who's a SSH user familiar with authentic keys? Okay, awesome.  Open SSH 6.8 has a feature called key revocation lists. What this lets you do is have a set of keys, SSH keys that are revoked. So the normal model for SSH authentication is you have a key pair that you exchange that you're allowing in. You can graft on PKI to that authentication and this is a mechanism for taking certificates that are bad. So if you had a red team come and own a couple boxes on your enterprise network and they left some keys around it'd probably be good to drop these in a revoked keys list so that they couldn't be used anywhere else. And in general I think having the mindset of managing SSH keys by revoked keys list puts you in a much better position to respond to attacks and challenges with compromised keys. So again, just some directives here in your SSHD config to turn it on. It's called a KRL, which is a key revocation list and you basically provide that as a file which basically stores all the bad keys as hashes and then every time you're authorized in it'll check that against it. So just good to know I don't see this in heavy usage out there probably because the PKI authentication integration for SSH is not all that common but hopefully it'll be more common in the future. So you want to take that? Oh, okay. And this is like we were just kind of pointing out that if you've got traffic that you can capture either on your network or from your browser and your host and stuff. Wireshark has a built-in OCSP decoder and so you can actually run Wireshark or T-Shark, capture that data and start looking at what's going on on your network. This is useful for a number of reasons. You'll also see things like might be software or operating system updates on your network. You might catch a lot of different things. When the OCSP queries are being made via HTTP rather than the HTTPS connections.  But that's already built into Wireshark and we just kind of wanted to point that out real quick. Yep, there's been built-in support for OCSP since Wireshark 1.0, which is kind of cool. It's a protocol that's been around a long time. All right, if you want to run your own OCSP responder, you can do that with OpenSSL and pick a port. I believe there's not a standard port for that. 2560 comes to mind, I don't know. But in this example, 7654. So you basically give this OpenSSL command and use an indexed file that when you set up the CA, it basically keeps a list of certificates that are under management in that file and then you mark them as revoked. So there's a little bit of a question about how well just OpenSSL by itself scales for traffic. So typically the big CAs, in fact, every CA that I know of isn't using OpenSSL. They're actually using another thing called EJBCA. So EJBCA is Enterprise Java Beans, difficult authority, it's like a suite for managing a CA out of prime key. And they were, I typically, you know, at RSA and Black Hat, anybody from prime key in the house? Okay. They're a really great solution. It's Java and Oracle back, so it'll scale like crazy.  It's got three logging modes. So you can log, so what I'm describing here is the logging behind the scenes that as you're hitting these OCSP servers, it can go on. There's just log4j for doing kind of daemon level logging for just troubleshooting the daemon and that it's got network connectivity and whatnot. Then there's transaction level logging which can be customized.  So if you turn on audit logs, if those audit logs are turned on, that's where you just get a complete stream, you know, of everyone's request for this stuff. That's kind of the privacy scare story right there. So again, these are features that are built in already and if that data gets streamed off and captured for data analytics purposes, again, it's neither good nor bad. It's just I think that the public could use some insights into, you know, if the CAs are doing that and what they're doing with that data. So also to say that, you know, it's a really, really dominant solution. Every OCSP responder I can find is backed by Primkey's EJBC. It's really, really dominant in the marketplace. And when you see that kind of monoculture, like if there was a flaw in that and someone could, you know, take down those servers, it could be pretty crazy. It's a little bit of a risk aggregation for global PKI usage. So short-lived certificates in terms of alternatives to OCSP and CRLs, like maybe this could be kind of like where we're going with the future. Short-lived certificates are one of those options. It kind of came into vogue around 2012. There's a Dan Bonnet paper about short-lived certificates in which they very clearly declare that OCSP is as good as dead. And I guarantee you it's probably the number one revocation check going on right now. Doesn't look like it'll change anytime soon, but it's good to have alternatives. The recommended timelines are like weeks or days, things of that timeline. And basically it would mean that the CAs would be just issuing, you know, very, very short-lived certificates. So it's gonna be pretty heavy lifting. If you think about, let's say your Apache servers would be replacing their certificate every week. I mean, it could be kind of challenging to get that set up. And it will also make the usage of PKI a little bit more dependent upon the CAs. They're kind of in favor, I think, in some ways, but it's a pretty complex topic. There's a lot of challenging effort that would have to go in to make this actually work. But that's one option. Again, with OCSP you get this validity timeline, but the certificates are all the same. You only replace it when it fails. This would just be a continually replaced certificate, like on a weekly basis. The ACME project at Mozilla Firefox would fit very well with that vision to be able to very quickly validate that a certificate is good from the CA for a specific domain. That's actually still under discussion. The industry at large, the CAs, the browser and OS companies are all debating that right now. Yeah, there's a variety of issues with the IoT. There are IoT providers that have ways to manage certificates or having unique clients' certificates on each one of their devices, but there are hardware manufacturers that might just do stuff in bulk that can create huge problems with these kind of things. So yeah, there's a huge issue with that. There's also a huge issue for apps, not necessarily because of the app stores. The app stores are frequently doing the right thing, but if somebody writes bad code on the back end on how it's checking in, there's multiple layers where that can occur in software. So there are other issues there, too, for sure. So another alternative for revocation infrastructure is called certificate transparency. And it's not really a CT talk for those familiar with it, but I'll just give a quick highlight. CT is a Google-driven effort and it basically applies a blockchain to this problem. And it's being already implemented in Google's operating systems and browsers, so it's kind of in place and going. As far as I understand, anyone from Google here? Chrome is not making OCSP requests as a habit. It's using CT instead of that. A good place to kind of see some of the CT logs. The census.io from Michigan has a nice sort of description of the statuses on all these CT logs that are in operation. So I think of these as blockchain servers that are able to provide statuses on certificates. And then with the future of certificate transparency, there's a debate ongoing about how redaction is handled, which would basically be the ability to make exceptions for presence in the blockchain. So kind of a current topic that would open up lots of challenges to the future of CT. So I'll just leave it at that. And the certificate transparency.org site, which Google operates, is a great source of information. Right, right, so with CT, that would be a policy. So the question is, would CT handle every certificate that gets issued? That would be a policy level question. So the certificate authorities would answer that question for you, and they would either say, yes, we're gonna operate this route with that assumption that every certificate comes out of here would be in the blockchain, or they may not do that. And right now we're in a situation where the most of the routes out there don't have CT support by default. So there will be a transition period where, if that is the goal, that we'll have to take some halfway steps to get to that point. So how is CT better than OCSP? Yeah, so it doesn't require an outbound request. The revocation typically gets bundled and then sent out on a periodic basis. Again, the timeline question applies. It's better in the sense that there's an automated, there's a number of reasons. It subjects the issuances to an automatic process that would provide you some level of assurance that it has been issued and the details of that issuance, which right now there are human factors that could get in the way or things that are not logged. So it just provides automation, among other things. But again, this is not really a CT talk, but it'll probably be a future talk here at DefCon on CT, I'm sure. So in summary, you have to take your need to revoke trust about as important as your ability to establish trust. So revoking a certificate creates kind of a failure of PKI. This is where the website doesn't work. You can't reach the site, you can't get authenticated, stuff does not work. But if you don't have a fluid mechanism for handling revocation, you're not in a good position. You should be able to revoke as easily as you can grant on some level. And then we kind of walk through examples for CRL and then another example for OCSP. And for those of you joining late, the slide deck provides a nice kind of worked example that you can use to kind of run this on your own operating system. And then online real-time revocation checks are kind of a privacy disaster and require you to place a level of trust in your certificate authority that exists there, of course, because they're your CA, but in addition, as you use, you don't think of, so list all of the certificate authorities out there as you browse, you don't sit there and say, oh, I just went to, in order to pair shoes online, now I just told that to DigiCert, or I'm gonna go, what's another good example, or hit a messaging server and now Symantec knows that I did that, right? But those are the things that are actually happening with these outbound requests for the use of revocation. What's that? Yes. Or whatever your vice of choice is. So, yeah. Something else that we noticed that kind of comes up, it's not necessarily in who CSP or CRL thing, but there's an issue where people are not checking the certificates in line when they're surfing. And so if you're in a repressed country or repressed corporation and maybe they've got blue code or something like that, we talked about the blue code one that might be revoked, but checking the chain of certificates is gonna tell you if there are people that are decoding traffic. If you've got a certificate added to your box where people can sit there, be it the corporation you work for, whatever, or government or whatnot, it's gonna show you who else can decode some of your traffic. So it's a really important check. And it's something that most people don't think about. So it's something worth looking into. Again, it's not directly related. We ran across a lot of different certificate issues and certificate issues with like IoT and stuff like that. They're not revocation issues per se, but they're definitely interesting things to, you know. So how do you check the OCSP response signature? So that will be in the log for the example, but that's handled by Libre SSL, OpenSSL, your stack will make that check and fail out with that signature is not correct. How do you revoke? So revocation would be the presence of that in your OCSP server, right? So when that responder has that in its database, then that would be providing that as a revoked certificate. So again, if you look at the protocol, you can see it's a HTTP plain text, you can read it and see that that's taken place. Does that answer your question? You're saying you're trying to verify that the OCSP server certificate is valid. You could actually make the request that we showed earlier to check against the certificate server and the way that OCSP communication is authenticating is whether you're gonna know whether it's the same one. You'd have to manually do that. I mean, there's nothing in the software that checks that on a regular basis. Yeah, if the CA is compromised, you could. It only applies to the one who issued the search. Okay, next slide. Oh, okay. That's correct, but the other requests are signed. Okay, so it shouts out to the DEF CON goons, DC 206, DC 408, DC 404. The CA browser forum has a revocation working group that are working on some of these topics and they're hard at work trying to kind of improve the situation. So shouts out to those guys. The Apple ProdSec team, Team Obsters and Hi Mom. I think we're good. So other questions and we are out of time, yes. Yeah, so the question of OCSP stapling. There's specifically a flag with OCSP must staple, which is not in common use, which basically allows the server that you're talking to to make that request out to the OCSP server and give it back to you signed rather than the browser or operating system making that server directly. So that's exactly right. I should have a slide there for that. So OCSP must staple is a promising way forward that resolves some of those privacy concerns. Yeah, the only thing is we don't see that many people using it.  So the question is, which browsers are supporting OCSP must staple? Off the top of my head, there are common browsers that do support it. Chrome, I'm pretty sure Safari does. I think that refers to the gentleman behind you's point about the CA pinning and I think, yeah, you're correct, that does prevent a lot of this stuff. The issue that we end up running into is that like, you know, if you're in a repressed country or something like that, you may not have ever connected to the site in the whistleblower case to be able to have the pinning set up to be able to really help. So it's kind of a, yeah, and I agree with that. I think that more controls are better because you don't necessarily know how the browser or software, it's not necessarily a browser is gonna implement the checks. And so the more checks, the better it's gonna be the case. Okay, thank you.


The objective of this study was to compare the prevalence of tuberculosis, TB, among school-aged children in two different regions of Tajikistan. In Dushanbe, the capital city, 10.7% of children tested positive for TB, while in the rural area of the DJ. Rumi district, the figure was much higher, at 16.2%. Additionally, three children from the rural area had never been diagnosed or treated for TB before, compared to only four in Dushanbe. This suggests that there may be a lack of regular tuberculin diagnostic testing in the rural area, as well as a general lack of awareness about TB among healthcare professionals. This article was authored by UIU Syrojitanova, O.I. Bobokhachev, K.I. Pirav, and others.


So, we are going to titrate our buffer solution with our base, which is sodium hydroxide, and this is a strong base. So, in order for us to do that, what I did after I made up my acetate buffer solution, I put 125 mils of it into a 250 mil Erlenmeyer flask. So, the first thing to do is to measure the pH before we start any titration. Measure the initial pH after you have made the buffer. So, this would be at the volume of zero because we have not added any acid yet. So, I mean any base yet. So, we have to put that initial pH when no base is added. So, we measure this pH and notice I, in order for me to get into the Erlenmeyer flask and measure the pH of my solution correctly while it's mixing. I have to detach the electrode from the pH meter stand and immerse it enough into the liquid, into the buffer, and make sure that it is not in the path of the stir bar. So, I look at my pH reading and it's saying it's 4.74, so that's my initial pH reading. So, I make sure I document that initial pH of buffer and that is 4.74. And then, I'm going to titrate with my base. So, what I do here is record the initial reading on my burette, which is 15 mils. So, that will be able to give me an idea of how much sodium hydroxydam added each time. So, initial burette reading is 15 mils. And what I'm going to start out by doing is to add 0.5 mils each time. So, I will add 0.5 mils first and then I'm going to mix it on my stirrer and then I'm going to record the pH each time I add 0.5 mils. So, when I add 0.5 mils, my burette should go, the volume in the burette should go to 15.5. And then I'm going to stir on my stirrer plate and then I'm going to record the pH while it's being stirred. So, the pH did not go up by much, which is expected since it's a buffer. So, the pH is actually 4.77. So, after I add 0.5 mils of base, it's now 4.77. So, I do this again just to show you for illustration purposes. I go again and I add 0.5 mils of sodium hydroxide. So, I wait until the burette reading is 16. Then I mix and then I record the pH and this is the pH after we've added 1 mil of sodium hydroxide. And when the pH reading has stabilized, it's saying it's actually 4.81. So, it's going up a little bit, but not by a drastic amount. And this will continue to go up gradually, gradually, gradually until you get to a point where the buffer no longer functions like a normal buffer. If you should add a small amount of sodium hydroxide, the pH reading is going to spike. It's going to move from probably about 7 and spike up to almost 10. So, in order for you to do this, you have to make sure that you're careful in only adding a small amount of sodium hydroxide at a time because you could miss the point where it actually spikes from when it was a lower range up to a higher range. So, as I continue, I will go on to the point where I get to almost, when it's outside of the buffer range. So, the buffer range for the acetate buffer is 3.8 to 5.8. So, when I get to the 5.8 mark, I'm going to lower the amount of sodium hydroxide that I add. So, instead of adding 0.5 at that stage, I may add probably 0.2. And the closer I get to about 6, then I go to just a drop at a time, a drop at a time. Make sure you record the volume each time you do it. Make sure you record the pH, and that will give you enough points, enough data points in order to make a curve. So, that is basically how you collect the data in order to get your titration curve for your base.