All right guys, welcome to the ODI welcome to our Friday lunchtime lecture series both in the room and live streaming Which is now going anything? So Just a few rules just introduce myself. I'm Jamie force it. I'm a researcher here at the ODI And I've been involved with the showcase project, which is how we've met Martin how I met Martin so yeah Yeah, so Just a few bits of housekeeping We've got the internet The Wi-Fi password on the wall And we're using the hashtag ODI Friday So if we can use that if you're on Twitter if you're a big Twitter user, that'd be great And yeah, so to introduce Martin Martin is from a small cellar called Plexus and he is going to talk us through his great new Thing Well, you'll find out you'll probably be able to articulate that better than I can so Thank you, Jamie.  Well-being So I wanted to start if this thing wants to work perfect I want to start with the the token statistic which which most conversations start with and so In a recent well say fairly recent as recent as these kind of things go 2014 survey 26% of the UK populace will have a diagnosed mental health condition Which is a phenomenal number, but the thing that really got me was also another 18% of people will be living or Experiencing a mental health condition that isn't diagnosed. That's just shy of half the population having some kind of Mental health condition that they they either live with or or don't understand it that it's part of their life On top of that the other start that came out that kind of blew my mind a little bit was 15.2 million Working days are lost each year to stress and stress-related conditions It's like it's very difficult to comprehend that kind of number and the effect that that has but when we're talking about a country that needs to strive to be more independent more more useful more productive more Goal-setting more more creative to lose that amount of talent and time and perception and creativity and everything else that can happen in those 15.2 million days. It's just just just crazy. So it needs it needs to be looked at and it needs to be understood now Beyond that How do I get to this or wherever it? Where's this come to? So back in the very late 90s my stepdad was diagnosed with three mental health conditions And he then spent the next kind of eight to ten years in and out of employment now employment wasn't the cause of the mental health conditions, but it was a trigger and the Employee that he worked for tried to be supportive as best they could but unfortunately It didn't really work out and this thing needed to be stopped And so it came down to my mum to kind of make a brave decision for them to leave Employments and spends some time to to understand what was going on and what they could do to Cope I suppose is the best word with with with what was going on and after six months He managed to get a different job with a different employer And now I can say he's been back in work for seven years as a local caretaker in a community college And everything's great and and yeah, but he's one of the lucky ones not everyone is that lucky and so When we were Accepted to do the the summer showcase last year We'd had this kind of thought going around in our heads about what it was and what we could do and and how we could help people in similar situations because like I said not everybody is is that fortunate and and also what that means to people who are Leaving the workplace on regular basis is or or missing from a long time and what it means in terms of team building in the the unity within a workplace and so Mental well-being is slightly different to mental health And so it's just about being able to understand what effects and what fatigues happen to you on a daily basis through just going to work And so some of the things that we looked at last summer were reduced productivity low motivation Also a lack of loyalty which is really interesting because employers spend so much money getting people into jobs To then have that person leave or not be part of the team as they want them to be it just seems Really counter-intuitive And so what did we do well after I know eight or ten weeks of kind of crazy coding We built plexus version one And plexus was this aggregator and it was kind of good as what it did And and we thought it'd be really good to be able to go and find as a person the the the mental health support systems around you from the NHS and National charity mind and so that was one of the sections We'll also be great to be able to understand how to get back into the workplace how to write great CV How to find new work how to find volunteering which is so important to a lot of people who have mental health conditions being able To get back into a situation, which isn't as pressured Also giving stats around what's happening around you with mental health in terms of the number of people in your area Who have mental health conditions diagnosed number of people who work with mental health conditions? So to give an aspiration that it is possible to do something different because again It comes down to the individual to have to want to make change for that change to to happen and occur Legal rights registrations all these other different elements were were part of this this document And there's a few screen slots from the support services on the left back to work How to write a CV we didn't create any this content all this content existed all we did was aggregate it and we aggregated it from all these places So we used five or six different sets of open data And we use the shed load of data from pretty much any resource or every resource We could find it had some tangibility to what we were trying to do and it was good And it was kind of good and we launched it at the summit Which was really kind of cool and I got a chance to stand up on the stage and go isn't this great And we did this in eight weeks and and that was lovely But then I wanted to take it further and I want to do something else with it I wanted it to become something and so we'd we'd known Bethany green ventures for a long long time And I went and saw Glenn there and he said to me well, it's a great aggregator, but actually there's no business there There's nothing there's nothing we can do with it. So come back when you've gotten a kind of Complete thought-out idea and so and then so that's what we did We spent some time post the summit last year thinking about how we could actually Empower the individual within this process how we could look at the individual and what we could do beyond just giving them data or information Because again, if you if you know good with data information, it's no point just giving you something to try and find So fortunately enough with our idea we managed to get on to the Bethany green platform the accelerator back in January we did 12 weeks of Brain-numbing kind of like just it just just literally shook every Everything I knew I'd run a business for eight years It started like my own digital agency and I thought I was kind of pretty good at running a business and Understood a lot about how to do these things and how to develop and how to grow and it just ripped it all apart It literally shook everything down to the foundations, which is a really interesting experience For my mental well-being and what that posed and at the same time running the digital agency that we still have and so Here are a few screenshots of the things that we were able to give and one of the things we wrote in the application was Having time to think and it's one of the things that I don't get that much of is a real time to just sit down and think and BGV and to a certain extent what we were able to do with the summer showcase gave us two breaks of nearly 20 weeks in total just to sit and think about things and Rationalize all the ideas and the things running around our heads and how they could actually be useful to people and what we could do with them So after that we came up with the theory that actually it's pretty simple Work is quite hard For most people and what work is is really difficult to define and what normal work is is almost impossible to Define because nobody has the same experience as an employer or an employee So there are lots of people who have jobs at the moment who are experiencing things that aren't normal in the workplace and shouldn't be happening And there are also lots of people have lovely experiences at work And somehow you've got to be able to rationalize these things together and build something that can work for anybody someone who's happy and work But also someone who's unhappy and work that wants to change or do something different and how do you balance this out and so We were really fortunate to work with mind for two years with the digital agency And we've been working with them to produce digital tools that empowered sharing within their Federation of Local Minds and join those two years We've got to see a lot of the services they offer and a lot of the things they do and how they support their service users And they also gave us access to loads of really interesting statistics So there's a few on the screen you can see here like one in six employees are experiencing anxiety or stress two and five business saw an increase in this in the last Year and that the one the big scary one is sorry not big scary one The real positive one is that 87% of businesses saw an increase in retention of staff if they looked at well-being within the workplace Sorry wrong way And the second part of it is this has a massive effect on the country business Infrastructure services we're talking about a 30 billion deficit in the NHS and we currently live as a Society that deals with things when they've happened as opposed to looking to become proactive And this is what I feel grace which I'll introduce in a second and Plexus are looking at is bringing in a proactive nature to Mentor well-being as opposed to waiting for something to happen and then dealing with it The thing that got me here was that it was a thousand and thirty five pounds per employee For every business, which is just a crazy amount of money again There's another report that came out more recently which saying which would say if I could speak which says It's closer to seventy seven point seven billion when you take it in the whole well-being area, which is bigger than the entire design Economy that we lord so much in this country at the moment So it's really interesting that this number is just around there, but nobody's really doing anything about it I think it's probably because it's just almost Incomprehensible in terms of when you start to get to those kind of numbers what it actually means So what do we do our first tool is grace And we looked at the NHS five ways to well-being and we also looked at a number of cabinet reports Which looked at using digital tools to empower workplace well-being that have been released in the kind of last 18 months And we came up with our own process which was to reflect to review and to learn and So that's what grace is built around so grace takes less than five minutes a day It's all around self-empowerment and learning and like I said, it's based on the NHS five ways to well-being This is an overview of grace so grace is a messaging platform that sends you a certain number of message of the day We then compile that information you send us and we send it back to you as both a bi-weekly email and also a dashboard that you can access anytime and then using machine learning from what you've given us in your Qualitative answers we then direct you to the knowledge base, which you'll see in a second has been revamped Then it's slightly nicer than it was version one So one thing we didn't want to do is we didn't want to build another app There are far too many apps For helping people and they're far too much work around trying to make these things happen So what we do is we're gonna use everybody else's technology to make ours available to everybody wherever they are So using SMS for people who don't have High-end phones using slack for offices that are using project management tools like that for using Facebook messenger because it's a Really useful tool that can be kind of changed to do what we want to using WhatsApp and by the end of the summer We'll also be using Microsoft 360 at sorry office 360 and Skype They're pretty much the same same platform now that Microsoft owns both of them So where does it start one of our users was really came up with a really nice Well, I think it's really nice It's they called grace a digital cup of tea which I really like the idea of it's five minutes in your day Where you sit down and you just reflect on what's happened in the day And and it seemed to be kind of it seemed to work and it seemed to reflect what we were trying to do We asked for qualitative and for quantitative I'm gonna try and do a live slack version of grace in a second if it works But there we see and the questions currently around confidence challenges positivity and usefulness as I said We're also moving into different platforms. We've got Facebook. We've got what's happened We've got slack working and I'll flick over to in a second And so what it does with slack is it and I guess some of you guys probably you slack within the organizations you're working already It's the on-demand messaging which is really interesting But it becomes more conversational the thing we found with the SMS is it's a little bit like you talk We talk you talk we talk and it's a little bit not unfriendly, but it's not as friendly as it could be What we've also been able to do with slack is we've been able to add in other elements like gifts and like emojis Which aren't necessarily the same and so it's giving people the chance to express themselves in not only words Not only numbers, but also in in pictorial or or image-based Ideas and the thing that becomes really lovely about this is you can just tap into it when you want to it's not set at a certain time The day grace will say hi once a day. Do you want to answer some questions? You can say yes or no And you can carry on from there. So let's see if this works So you can see above here These are so the conversations I've had in the last few days with grace And I can also pull in graphs from the dashboard not I'll show you the dashboard in a second So if I just type in hi You know, right go on Pretty good. Let's go eight. I could spell it be helpful as well, wouldn't it and so on and so forth And it goes through these questions and like and at the end of I'll tell you how we can get involved in So I won't bore you to tears But the other thing which is really nice is we've added in a little bit of help into this system And you can also call up graphs if you want to and I'll show you the graphs in a second Listen up. So let's let's throw a kind of a long one in there. So if I go Take a second honey on the internet And there we go. There's the entirety of me being on grace and using grace You'll notice the thing about graces is it's not something you have to use every day And what we found with most of our users is they've come in for a certain period of time used it Left it for a few days and then come back when something can trigger them to want to speak and again Grace comes along and triggers you and asks you do you want to talk today or do you not and you can set the limits of those as well How often you want to be reminded and poked and so on and so forth. So let's go back to the presentation So you've seen that as I said the Emails that you get what we do there if we take the summation of you know You saw that I gave a score of eight and I was talking about traffic and what it does here It'll tell me what they was my most positive day It'll also tell me what they're famous challenging what they was I'm looking forward to and also What was the most useful day for me? So it gives me these little triggers to so I can mentally think about what happened on those days Or what was going on on their days and then underneath that with the quality of scores No quantitative if I could remember quantitative scores you give yourself It also gives you an average for the week so you can see for example that this week specifically was very challenging It was part one of the last weeks on BGV So it's quite quite a lot of head kind of head thinking and spacing going on like that And what we also do is giving little badges and rewards to try and incentivize people tells you how many days you've done Concurrently it tells you how long you've been on the system It tells you the top scores in each area you've given yourself and so on and so forth So this is what your dashboard looks like and what the dashboard does and again We're trying to iterate this at the moment because it's quite data-heavy and it might and some of the feedback We've had it's quite intimidating if you're not a lover of data So we're trying to simplify and bring more of the numbers and bring in more of the the basics graphics in But what you can just see coming in there are the graphs and I'll flick out to it in a second and show you the The real the real dashboard that I've got there But it what it's really lovely is is you can customize it you can change it you can show what you want to do And you can also start comparing things we've seen some really interesting results between usefulness and challenges and how people relate those informations and those stats and the other really lovely thing about this is This is where you get your five or six items you've entered Consitively or qualitatively Where you can actually review all the things that were really positive about your week all the things that were really Challenging about your week and it gives you that little space just to see all right all these things happen this week And you can start doing it and the way we see it working longer term is how it can come It's our they should have actually wait until the next slide shouldn't I and you can see you know really badly And really if you can read kind of micro writing These are the answer I've given there and underneath there you've got the comparison graphs But this is where the really interesting thing for us starts to come in beyond the use of data is is we start using machine learning here to Understand how positive or how negative your sentiment is within the answers you give and then we also Then start directing you to the knowledge back So if you're using slack and you give an answer you'll be directed straight away to the knowledge base where you can actually start empowering Yourself to learn around certain aspects, so it could be around how to perform more effective in interviews It could be I want to get out and do more physical activities. I want to Understand how to manage my money better and so on and so forth and I'll show you in a second there the additional data sets that we've managed to kind of Bring in to grace and so this is what the new version of grace looks like we got absolutely slammed by somebody Who did the mentoring it? BGV saying what is this the first version and it says far too complicated doesn't make any sense And so what what happens now if you go straight to the knowledge base Which will be a standalone iOS app that you can just download and and have if you want to or it'll be a Open web app if you prefer you go on there and the first thing I ask you are you looking for support? Or are you looking to get back into work and that's the direction you go and from there You're then able to see the various opportunities or how to prepare for work or your legal rights if it's got to that kind of state You can go in and it breaks it down much more effectively much more seamlessly. We use AngularJS to make it a really beautiful experience when you're going through these things And then you can go in and start finding out some really important information about getting some real support around you Depending on what you really need and so it still has the core ideas of what Plexus was originally and what the knowledge base is now So in the last kind of three or four months, we've managed to get Martin Lewis's many money-saving expert the financial data We're going to be able to put that on to the knowledge base now We've been working shelter to get their data on to there around how to better support yourself around keeping your house above your head We're working with I'm in which is really exciting and using their open data sets to give people access to local authority Activities and we're also now looking to help hack me really some open data around the the various services and things they're providing So all this is great, but hang on There's a load of really sensitive data here. What's going on? What do we do? So this is one of the things that we've been really kind of tussling with because what we want this to be is we want This to be a tool that empowers the individual But the only way the individual is going to be empowered is if they can actually make real change in their workplace And the most likely way of doing that is if you involve the employer within this However, most people aren't going to want to share everything they're thinking with their employer. So what happens? I went to a really interesting talk At the weekend about about new co-ops and what what a co-op is and Sarah gold was talking there And she was talking about data licenses, and I think it's a really Amazing idea around everybody being able to actually data give their own data a license and a fixed term that exists for So what we're hoping to do is do something very similar along the lines and plexus you when you sign up You'll actually be saying at that time. I'm happy for my employer to say I'm not happy for my employer to say We want at the very end to be able to release our own open data nationwide around where people are accessing services What they're doing how they're living their lives and being able to get kind of government and and local authorities to affect their Services around this open data and so we want to be able to give people and want to give people the confidence to say Yes, this is empowering to me. This is empowering to my local community This is empowering to actually to the nation to see what's going on And so it's one of the things we're working really hard to make sure that data trust is there We're not going to look to work with post office anytime soon because there's no trust in that organization So we're looking for much more kind of flat management structures or organizations that work in in a much more kind of conducive way So as I said, there is a dashboard that already exists which aggregates it for the client or in case of every user or whatever else And so what it does it gives you a snapshot It's only the quantitative data so it doesn't have any of the quality of information and it just shows the overall wellness of the organization at any One given time and what's really interesting is you can start marrying that to the individual organizations KPIs or ROI's to see the effect that certain announcements or certain things have on the workforce on a daily basis Which will hopefully make the whole system much more conducive and much more balanced and much more Employee led which is a thing because top-down works to a certain extent But for me it needs to be much more kind of like I said flat and that's on a flat management structure Where people are able to put their information in and give their two pennants makes it a much more kind of rich and interesting organization to work For at least I think it is you'd have to ask the people who work for me What are the key features they're probably watching actually Like I said, it's our platform. It's it's we are where our users are You don't have to download anything new most likely you can use existing there We use SMS you nobody really knows how to hide SMS notifications on a phone So it's a really good way of making sure people get the message every day The machine learning not only are we doing machine learning from the point of saying what you're analyzing what you're saying But we're actually now starting to understand when you want to answer your questions And grace will start prompting you at specific times based on how you answer questions And the long-term goal is to allow grace to develop so that it's able to Understand what you say and deviate questions based on how you answer So if you keep on answering in a negative manner make sure the questions are refocused to start asking you things in a positive light So you change your situation and change it because it's the difference between being very narrow and very Dark situation to actually what the the longevity of a space of time is and it's more likely to be more balanced than you think it is And on the other side, you know if this is a business and it doesn't before then then there will be company insights in terms of how this works for the organization Where we see it going It's to empower the staff. It's to empower the individual. It's to make them better at their job It's to make them happier in their job It's to make them more comfortable in their working relationship and it's make make them more confident around the line management or whatever management structure they have it gives the Company a chance to understand your team. What works? What doesn't work? How does it affect what things are going on? And it also will hopefully improve communications because of the confidence that it gives the individual So we're currently running some pilots with different organizations And we've also got a research partner which is helping develop the machine learning which is really exciting for us working with with South Bank uni We've managed to get some really interesting advisors on board to help us direct ourselves And we're also like I said working with these organizations to try and release open data and also express in the understanding in the power That open data has and why it's important for them to share especially within charity sector There's a lot of mistrust I think within that sector and I think open data could really help to Understand how charities can work more effectively together and share knowledge and resource and other things like that. It won't be a won't be a Disposition to the organizations doing it. So what's our timeline? Well, we're running trials like I said in a moment and through the summer We're going to be doing a huge user development between now and the autumn We're working with the South Bank uni between autumn winter to get our clinical evidence in place So it actually proved that actually does something as opposed to me just waffling and saying it does something And then early next year start to market it with a view to be ready to go to to market live early next Next year fingers crossed if everything goes as it should do Apart from me who else is involved well these guys are involved and Sam and if I'll both work for MA, which is the digital company that we ran before Plexus arrived and and some of the organizations we've worked with a little there So so I think we've got some credence within the digital world to do this kind of stuff For me the other really exciting thing and I think this is the last thing I say before I stop talking Is what the other applications are we're working with Cambridge House in in South London a really interesting charity? and and they've seen really really potentially interesting applications around Evidence gathering in their service users in terms of what effect their services have on their service users And I think it could be really interesting at the moment They're doing like monthly or quarterly or half-yearly Questionnaires which are really boring and nobody answers a questionnaire correctly It's just just a waste of time whereas if they got something they can actually track on a daily basis It gives it a much more meaning much more into this at the time we've talked to the DWP around universal credit and Empowering the individual looking for work being able to go into the to the workplace and say right These are the six things that I need help with this week These are the six things I've learned this week These are things that I've actually looked forward to now help me get the job in power in the individual in that situation Which I think is so important because at the moment it's skewed in such a bad way and also looking at how we can better help people in the NHS everybody's talking about patients and Efficiencies and they're both very very valid, but nobody's talking about staff Nobody's talking about the well-being of staff Nobody's talking about how staff are being affected by all the cuts and everything going on there And there needs to be some way for staff to get Their information out and their experiences out because they're the guys that are there every day doing it And so I think Grace could have really interesting implications within the NHS of affecting that and if that's it Oh, sorry last one. Sorry. It's quite a big opportunity Within some research America doing really interesting things around well-being because they don't really have a health service over there So it's down to the individual employer to pay for the health insurance So they're really interested in stopping stuff happening before it starts. So that's currently worth about 8 billion The UK market be worth around 3 billion in three or four years time And I think that's it. Thank you so much Thanks very much Thanks very much. That's really interesting I think we're gonna have time for questions, but actually I'd like to start with one of my own So I'm actually using Plexus already. I think I am the the representative the ODI Trial at the moment the pilot What I would be interested to hear is how So I'm a lot of those organizations are very data savvy kind of very Driven on those sort of things and the employees are probably quite comfortable in those situations How do you sort of get people persuade people that you know How do you persuade the users if they're not as technically competent or not as comfortable on different platforms how do you persuade them that it's Going to not be used as like, you know that the machine learning for instance might sound quite terrifying that this machine is going to You know learn about me and about my most sort of you know Deepest sort of responses. I just want to know what you're sort of doing around that It's basically through the user research. We've already done kind of refocusing the product as it's gone along So it's come through a number of iterations that have now a chance to go through and so the The tool or grace is being refocused time and time again through the way people are using it in the feedback We're getting but but in terms of people being scared of technology We're trying to adapt the platform to work on whatever technology is and give a person a very rudimental experience on a very base Level technology like SMS. So for example, you don't necessarily get all of the machine learning on on SMS If you don't want it because you're actually restricted to what's going on within the platform Confines you are if you're using slack then you've got access to much more But you don't actually need to access it if you don't want to and eventually down the line when we have people kind of signed up kind of Coherently it will be You'll be setting up an account You'll be choosing how you want to act as things you'll be turning things on and off And so you'll be saying this is how I want my day to be to be used or this is how I see My relationship with grace and that will be time so it's not once not like Facebook and everybody else It just says right they are agree now and that's it forever and so we change our minds This is about empowering the individual to make the choices and I think naturally people will become Used to using tools like this because they'll be using them in other other facets of their life And they'll become second nature within the next kind of two or three years And so that will have a massive effect on the way people are used to To owning their data because at the moment people give all their stuff away anyway So it's not like you don't give you stuff away at the moment It's just actually nothing's informed So what we're hoping to do is make that conversation much more open because it's empowering you to be the person Responsible for what you're doing what you're saying Very interesting very interesting. Does anyone else have any questions in the room? Alex I'm gonna plus your microphone Hi Martin. I had a question around incentivization So you talked about the incentive for users being being able to kind of see a visualization of your own data I really like the analogy of a digital cup of tea But what strikes me is that you don't always feel like tea And so how do you incentivize people to consistently use the app so they can get the most out of it for themselves rather than for their organization I'm not sure The incentive is the right thing for me. It's it's it How we get people to use it I think it's by being able to show people the change it's had with people who've already used it I think showing the what happens and what can happen and being able to rate stories because people believe in stories and people believe that other people's experiences hence why everybody uses Twitter now to promote products as opposed to doing kind of Paper advertising or anything else like so it's about making stories and making coherent arguments and discussions around What's already been done? And so I don't want people to use it every day. I don't think you need to necessarily use it every day It's about finding the right rhythm for yourself And I've most of the users we've had have actually mistrusted it the first couple of days It's one of the really interesting things is people have not thought about their mental well-being before Have taken two or three days to get to understand what it's actually doing or why it's being useful And then once they've got past that they understand it and then they buy into it And I'm not sure how we get past that initial aggregation or a kind of Issue at the moment, but it's hopefully something that when we have a build-up of case studies and a build-up of usages and different platforms and different Experiences, I think those natural stories will will allow people to buy into it Or at least I hope so anyway. Yeah Do we have any other questions? Sorry. Can I get you to say your name and organization? I do know Caroline Fawcett Caroline Fawcett one of the organizations I work with is the money advice service and We work with Martin Lewis and a lot of research has been done to show that Debt worries particularly can can compound other non well-being Health well-being mental well-being. I'd be interested to know what sort of data you're going to get from Martin in terms of Feeding in and how that's going to it's still being agreed at the moment I can't really okay. Sorry. I can't talk too much about it because we're still going through it But from from where we're coming from it's it's a roundabout money management It's around about giving resources to how you can better plan how you can better scope Money what kind of how you understand cash flow? Trying to get people to go back almost to an old-style old-style way of understanding when you give away a five Are you've given away something as opposed to tapping a card on something? Trying to re-understand the the physicality of money, which is something that's being lost quite quickly at the moment I think it sounds really interesting should be really helpful. Yeah Oh Hi, hi. Oh, hello. I'm Kirsty. I work for Accenture and You mentioned these data licenses and it's not contact I've heard of before and I just wondering if you could expand on that bit I can't really expand too much on it because it's not really my idea Like I said, I saw Sarah Gold talk at the weekend and she her company project if they're they're kind of pioneering these things And we're trying to set up kind of conversations with her at the moment To see if we can kind of use their data license idea But it's my understanding of the process is it basically empowering the individual to understand that they're giving their License data to these people at these times and being able to say I will share it with x1z people But I won't share it with these people or I will share it with these people I won't share it with these people and so giving everything a certain period of time that has validity for as opposed to just saying This is how I want my data used and never ever visiting again So it's almost like having a shelf life for your data because you will naturally change your relationship to the information You're giving over time So if you buy integrates and use it long-term Then I would imagine your relationship to that data will change over a period of time in the way you Analyze and think about that data will change long-term where you want to be much more proactive with that data And so therefore being able to change your license at that point will be really important for your Sharing on the system. Do we have any other questions? Calistro from the mental health Foundation I was just thinking the argument for business take-up. I think it's really strong, but maybe there could be a bit more balance Just with the kind of personal development aspect Because I obviously there's a huge industry built around self-help and personal development And maybe they do you think there could be more ways to track things that affect personal well-being so like Feelings of connection with others in our lives and how workplace place pressures could be Creating barriers to these predictors of well-being. Definitely. I think I think like I said, we've been doing this for 18-19 weeks and so we're we're very on the very tip of what we think it is But I think having done the research around the NHS five ways to well-being and a lot of things you're talking around there Or whoever you want to say did the world five ways to well-being that's being kind of adopted by so many organizations They're really important It's one of the reasons why we've gone out and found physical information We've gone out and found personal finance information We've gone out and found housing information because we understand it's not just about being in work It's around understanding the ecosystem of your life and being able to feed into the different aspects that are affecting you at that time and Making sure that the tool or the resource or whatever you want to call grace is able to adapt and help you find those things because for Me it's like there's so much it really Interesting and important information out there on government websites on NGOs and charity websites But it's so I'm a sore so hard to find because I've sat there and tried to find it And it's just a nightmare and if you're not tech savvy or you're not used to using Mobile phone kind of what what you know mobile site loads of these organizations don't have mobile sites Which makes it even harder to to do it So what we want to do is be able to become this person in the middle that helps you find Where you want to go through trying to understand what you're saying and also understanding the underlying things that you're repeatedly saying and You being able to see that every Wednesday This is happening and maybe this is something you should look at and what that actually means because it doesn't necessarily mean you hate work It actually might mean something going on on the journey to work. That's actually affecting what's going on I think that's where we want to get to anyone else Hi, I'm a leave from Accenture And I just wonder if you thought about adapting this for children or teenagers to be fed back into Into like the university schools parents. I definitely think there's a place for university students I want to leave children alone. I think they get poked and prodded far too much I've got a three-year-old and a five-week old and if they had half the crap that goes on at the moment in schools and various things going on With them, I'd be kind of fairly upset with with the pressure. They're already put on there I think a lot of that comes down to the parenting and the relationships the parents have and there needs to be a Stepping up a parenting across the country in terms of blaming the state and other things for what's going on with your kids That's probably a little bit controversial. Sorry Um But away from that I think I think for me that that when you get to the later teenage years to when you get to to university There's a real especially university. I left a little stick village in Somerset to come into Elephant Castle In and said day in September it kind of blew my mind And so having something that could support you in these really kind of foreign or unknowns just kind of Circumstances could direct you to help and support I think that the main thing for me is it is when you are having support around mental health conditions You have like one hour or one day of support and then what happens for the next 28 or 29 days Nothing in terms of family friends And if you haven't got those people there having something can tap into that can show you where people are getting together to do some Physical education show you how to pay me look after your money a little bit better that month show you something else It would help support that period of time for you would be invaluable. I think awesome good controversial interesting um Do we have any other any any other questions? Otherwise I can Okay, I can Come up with a few of my own because I've been using the service now for a while And I found that I do dip in and out of it quite a lot I've also found I don't know whether you you're planning any sort of machine learning or stuff around the quantitative questions because I found that I Always score above five. I never have a point where I think oh, I'm gonna score below a five But obviously the variation between sort of five and ten for me is that it's the same as using the full scale I don't know whether you sort of done things around that or because I know we have already talked Yeah, yeah for me it's really interesting because there's a We've talked a lot about psychometric tests and most of those are on scales of one to seven or one to nine because it Stops you it makes you be somewhere on the scale as opposed to one to ten So we're not sure whether we want to adapt it in that way But but we need to do a little bit more user research to find out where people are. It's really interesting Most people aren't like you If that doesn't sound rude, but but but we've had like I'm glad we've had a real variance and and one of the things and one of the reasons why we're looking at the Machine learning is because we want to be able to in future for example tie in a positive message You might record and if you score certain numbers in a row Then we'll link through to that personal message to play it through to you So you get that that boost that you might need that way for your confidence You score three threes in a row for example, then it will trigger the personal message to say well hang on You've got three threes here. Let's think about what's going on. What can we do to better support that system? Oh cool. That sounds really good. I also can't wait to play with the slack integration because I've got currently got the SMS coming through and it is a bit weird because it is in my phone is Does anyone else have any more Alex I work here at the ODI Hey again I just had a really something just pop into my mind about Whether you've been doing any work or any research into de-stigmatization Because one of my thoughts of Plexus is I really like the idea really like the platform, but I Hesitate on the sense that I think that there are people who won't Think that they have a problem and won't want to use the service because they don't necessarily want to admit to themselves that They're suffering with some kind of mental health conditions, so they don't want to work on their well-being I was just wondering whether you thought Of ways of tackling now or for you that's something that's kind of separate that you think will itself evolve Naturally, I think it's starting to evolve. I think what what mental what mental health conditions are I think it's started to become slightly less stigmatized. I think the last six months I've never heard mental health being mentioned so much in press kind of on telly wherever I think people are starting to get to grips with it. Isn't something that happens to to John over there Whoever over there. It's something that happens to Everyone we know people people feel people feel sad people feel low and it's just it's just one end of a scale and so for me It's really interesting what's happened around physical well-being in the last kind of two or three years You've got people going into huge corporations with machines telling people how unfit they are, you know, which I'm not sure is the right Kind of positivity and re-enforcement reinforcement of what's going on But so so we want to take the opposite approach to that not going in and saying everybody's got a mental health problem You should all use grace. Okay, it's about it's about actually understanding mental well-being and the mental well-being is about How you feel and about what's going on under the daily basis with you And at certain times your mental well-being will be high and in certain times it will be low and depending on the situation the circumstances and things around you those things will change and it's about Understanding that and and being able to support yourself when you need help and it's that about it for me It's all about that empowerment the idea of you understanding you have a mental you have mental well-being and you need to Nurture it in the same way you might nurture your physical well-being and when you get to that point It's not about saying I have this or I have that it's about just saying this is what I want to do with myself today This is what I want to do with my life today, and this is how it's going to make me happier as an individual. I think yeah I agree. I was just wondering whether Considering that it is such a personal thing your own mental well-being if if there are people who are who are struggling to accept that That's something they need to kind of deal with whether the blocker Whether there would be a blocker there in terms of that data being potentially shared with their employees It's been an organization, but I think that should be I think they should be able to protect themselves in that way It's not about the the for me the impetus is on the employer to give people the choice to be able to understand their mental Well-being and if they feel confident enough then to say actually you're doing a ship Sorry, you're doing a bad job. This is why you're doing a bad job sort it out I need to work half day at home because it's gonna make me twice as productive because of this this this and this That makes the business better that makes the individual better and therefore the economy better if that makes sense And we're all talking about how the economy needs to be better. So let's get on with it Yeah So, yeah, so that gets put through the machine learning algorithms that we're putting in place now It gets analyzed for being positive or negative and then on the dashboard It will start talking about how positive or negative your answers are on a weekly basis And then it then gets analyzed and it's it's triggered with keywords that are part of the knowledge base And then those are suggested to you directly Does that make sense So yeah, so over time it's not something that's going to work straight out of the box We need to get much more data involved to understand it But but but grace will naturally learn verbs adjectives and things like that and they'll naturally relate to what's going on there And so it'll take time But we're also using some open data sets will help speed up grace's learning around the English language and how it works And the nuances within it Emotionally supportive In terms of in terms of within the application, I think I think it would be potentially weird to have some emotional support from a bot personally I think the idea for me is that that you become in the position where you can empower yourself within whatever situation you find yourself being it trying to get back into work being in work And talking to your manager or being around your friends and needing to talk about things that are affecting you in that situation So for me, that's where it's really important is it's the empowerment of the individual as opposed to giving lectures or giving anything else like that One thing we are doing There's a great startup called talk life, which you may or may not have heard of their social media social network company They've they've launched a 24-7 counseling on Slack and so we're having some conversation with those guys at the moment to see whether we can actually hook into that And so if people are kind of struggling they can actually talk directly to a counselor as part of the package of grace But that's kind of something that we think needs to be addressed in terms of if someone has a direct reaction to using grace There needs to be some kind of safeguards in place to make sure that person isn't isolated or unable to find help if they need it Do we have any further questions? I've got a quick one You mentioned at the beginning that you're sort of planning to release open data out of this So not only in jest but actually release it at the end I'm just wondering whether you could touch on that and what you sort of your vision for that would be Okay, yeah, so what like I said what I hope is through through people being empowered with their own understanding their own data And what they're giving away and what they're doing and how they're interacting will be able to see what kind of things people are using What services they're accessing through the data knowledge hub and be able to release this data saying this number of people are using this in this area And then marry that to sex, age, demographic, other demographics and then tie it into other data sets around there and release a data set That will hopefully be really useful to local authorities or government to shape and structure kind of mental health support and provisions around the country Awesome. Do we have any further questions? I'm wondering whether I should go on to Twitter and encourage people to do that But this seems like a technical step too far, especially with my new phone I think we can leave it there and then if you have any questions that you want to ask Martin afterwards, I think you're around for a little bit Yeah, I'll be around for the next hour or so. Also if anybody wants to sign up and trial, Grace, just go to plexus.support and there's a form there and we'll get you hooked up Awesome. Thank you very much Cheers, mate. Thank you


And this talk is on, you know, CSP which I, you know, I look at it as a browser site firewall, right?  Wow, okay, that's good. That's a good number, 30% and I presume the ones who have not been interested with now, probably in the future, you know, down the line, you would eventually be pushed into it, or at least some responsibility you will have to take up. Or let me ask another question.  Okay, good. Only the people at the back are raising, so because their faces are not visible. The ones here are being very discreet. You know, it's like, yeah, I got attacked, but I'm not telling anybody about it. Okay. So let me, you know, I'll not waste a lot of time. I'll get started directly. A little bit about myself. I'm the founder of Iron Wars Security. We build a product called as S-Boxer. So this is a continuous security monitoring system. And one of the techniques it uses for security monitoring is using CSP, content security policy, right? So some of the techniques we developed for this system, I'll be explaining that here on the talk. And, you know, I've been doing security products, developing security products for about 10 years now. And my expertise is web application security. Okay. So this is the outline of the, of the talk. We will first talk about data exfiltration attacks, what they are. And then we'll look at how they can be detected using content security policy. And then we'll see how, so once I explain, you know, how the system will work, then we'll talk about how that system can be implemented, right? So some of the implementation details. And then finally we'll talk about some of the limitations in that approach. And what you could potentially do to overcome those limitations, right? So that's roughly how the talk is going to be structured. You have any questions in any part you can, you know, raise your hand and we can get it addressed, you know, then and there. Okay. So let's talk about data exfiltration first.  And all three companies were attacked in 2018. And these are the number of credit card details which were stolen, you know. These are big numbers and in fact with New Egg.com, the attackers were able to steal about 45 million credit card information, right? Now, the impact of the attack is serious. But what is even more serious is the duration for which the attack actually took place, you know. So it's one thing to get attacked, which is you can have a single, you know, like she was saying, you can have one weak link in any of your systems and that can be used, you know, by an attacker to attack you, right? So that is very difficult to, you know, actually protect against, you know, not be attacked at all. But once an attack actually takes place, you should at least know that your systems are being attacked, right? And you should be able to, once you know you're being attacked, then you can actually do something to stop the attack from happening, right? But the scary thing here is the attacks, they were high impact attacks obviously because a lot of credit card information was stolen.  In case of Ticketmaster, it went on for more than eight months. And I usually say that if someone got to know they were pregnant when the attack started, then, you know, they would have actually had the baby, you know, before they found the attack was going on and they actually stopped it. So that's how long the attack went undetected. Now, this is a very, very serious thing. You cannot have your systems being attacked and you're not even knowing about it, right? So I'll try and, you know, so that's why the stock was made because this is a kind of attack which is not having a lot of understanding with people. So I'll explain how this can be used, this can be detected using CSP. Okay, now, why did it not get detected for so long? Now, data exfiltration is usually monitored on the server side. Now, data exfiltration, let me explain it for the ones who do not understand. It is, you know, data being extracted out of your environment, right? So you own an asset and if somebody else is able to extract data out of it, that's called as a data exfiltration attack. The monitored data being stolen from the server side, but any data theft on the client side is never monitored, you know? So let's say there's a very overly simplistic representation of your environment. You have your server here and it's being monitored. Now, I've said monitored by IDS, which is an intrusion detection system, but you can have different, you know, systems which are actually monitoring this.  Even if it is not necessarily a security-based monitoring system, even your APM might pick it up, you know? And you might know that, hey, my system is sending data to this external party. But let's say your client side, which is your browser, you load a whole bunch of JavaScript on the client side and if you're, you know, you go to hasgeek.com and let's say JavaScript and hasgeek.com starts sending data to an external domain, then you don't really have any mechanism to detect that, right? So this is how all of this data was actually stolen. I'll go into details of how exactly the attack took place a little later. So here you can see egress traffic is not being monitored, so the attack can go on and detect it for extensive periods of time. Now, how does this happen? An attacker will look for any weakness in your application, right? So there are different ways in which different kinds of weaknesses you can have, but once he finds some way by which he can inject his own malicious code into your site, he will do that. And once he has done that, he will just wait for your users to visit your site. And as your users visit your site and they feed in their details, then the attacker's JavaScript can actually still, you know, collect this information and send it to their servers, right? So technically, it's a very straightforward, you know, attack to perform. Now, there are different ways in which an attacker can inject malicious code into your website. I don't have to go into details here. You have something called cross-site scripting. It's a form of, you know, it's a vulnerability you have on your application, which can be exploited. If you're using external CDNs, which most people do, if the CDNs get compromised and the JavaScript there can be modified, if you're using advertising or analytics, you know, code loaded from external parties, and if they get, they don't necessarily have to get compromised in the sense they don't have to get hacked by the attacker, but even if they are gamed by an attacker, then, you know, your site can get affected. And finally, if your web server itself is compromised by an attacker, then even then, you know, he can inject, you can modify the contents of your JavaScript. Now, this is an example of British Airways. I don't know how clearly you can see the, you know, the text on the slide, but this is the, you know, the JavaScript, which was actually attacked. So, this is modernizer-2.6.2.min.js. Okay, so this is a specific version of modernizer JavaScript file, which was being loaded by British Airways. So, what the attackers did was they modified the, you know, content of the JavaScript file because they were able to get a, you know, get enough access to modify the, you know, JavaScript files on the server. So, they took an existing JavaScript file, which was being loaded by British Airways website. They just added a bunch of JavaScript to the end of this file. You know, they didn't change the functionality. They just included their JavaScript at the end. And any British Airways page which was loading this, which was most pages, had the attacker's JavaScript file, JavaScript running. So, when the attacker from the user enters their credit card information, this JavaScript will take it and it will send it to the server. Okay, so once an attacker is able to inject the JavaScript file, how can they take, you know, data and send it to their external sources? So, they can use different ways. The reason I cover this is only if you know how the data is taken out, we can talk about how they can be, you know, stopped using content security policy. So, the first approach is they can try to load resources from an external site, like for example, I can say, you know, image src slash attacker.com slash and then the, you know, credit card information. So, there will be a request made to my server and my web server log will have the credit card information. Or I can force the user to navigate to an external site. I can put a link. He clicks on the link now that a request is made to my website. Or they can use DOM APIs like Ajax, Fitch and so on to actually send data to my server. That is the attacker server. So, this is the, you know, additional piece of JavaScript which was injected into British average website. So, this is the actual code. It was not like this, you know, beautifully formatted. They had, of course, minified it and everything. But once you expand it, this is roughly how it looks and it's surprisingly elegant code, you know, they have not done much.  And whenever someone is feeding data into it, they take the payment form and then serialize it. And then they put it into an Ajax call and they send it to this domain called bavas.com. Now, bavas.com, you would think actually is, you know, it belongs to British average. But this was a domain registered by the attackers. Right? So, ba.com is actually British average domain. So, they went and they registered bavas.com.  So, this little piece of code is what led to 40,000 credit card information, you know, of British average customers being stolen. And British average, I think, is looking at a fine of about 100 million plus dollars under GDPR, you know, because of this particular attack. So, this is serious stuff. Now, this is how you can steal data, you know, using external URLs and so on. I just talked about it briefly.   So, now I think that gives you a rough idea about what a data exploitation attack is when it takes place on the client side, how an attacker could perform it, you know, how they could actually steal data. So, I think that much is established. Now, that we are not sure because British average has not given away that information, you know, how an attacker, how the attackers were able to actually change the contents of the file that we do not know, right? But irrespective of how it was done, what we are interested is in the end result, right? Like once the file gets changed, it did not get detected, right? So, that's what we're going to focus on. So, I doubt British average would give that information away because it should be very confidential for them, right? Okay. So, in terms of detection, there are two ways in which you can do this detection. One is you can detect it at the JavaScript level. I'll talk about it briefly. So, you have your application code, which is written by your developers, which is here. And then your native APIs. The native APIs are all the DOM APIs exposed by your browser. The application code will communicate with the DOM APIs on a regular basis to, you know, like read data from the local storage or to send information on the network and so on. So, what you can do is you can actually put an abstraction layer in between. And you do this by hooking into the native APIs. So, let's say, for example, you hook into the fetch API, you know, fetch API. I don't know how many of you are familiar with client-side APIs, but, you know, it's an API to perform network communication. So, once you hook into it, so what happens is whenever the application developer is writing code to call this API, then the call will not go to the, go to that API directly, but it'll insert into your code, right, which is your hooked piece of code. And now here you can actually look at to which URL data is being sent and so on. So, you can do some level of monitoring on it and then you can call the native API, right. So, this way you sit in between or you can, in some ways you can monitor the functioning of your JavaScript code, right. This is one approach, but it has a few disadvantages. One is it's complicated because you will have to do this hooking of native APIs and if you, and it's not a trivial thing to do and if you make any mistakes, then it will break your application's functionality, you know, and if it's breaking application functionality consistently, then the, you know, the managers would essentially say, you know what, let's do away with it because it's essentially affecting your productivity, right. You're paying a price for that additional security. So, it's going to take loading and maintenance effort. So, that's money and it'll also have performance impact, right. Because it's changing the speed at which your JavaScript code is running because every time there's a native call, there's another piece of code which runs and it performs some actions and all that and if you get some intern to write that code it's, you know, because like you don't want to spare your star programmer who's working on an important feature. So, that's a good point. The thing is it depends on when you load it. You can load this hooking code as the very first thing which loads into your application, right. So, and if you're, say, using something like CloudFare, you can just configure it at CloudFare and it'll load it at the very beginning, right. So, this will run even before the attacker's code comes in, right. Oh yeah, oh yeah, I mean. Yes, so for example, so that's the worst case scenario where an attacker is able to come into your server has unrestricted access to modify any JavaScript. If they could do that, then of course they can change this code as well. That's, maybe I should add that as another disadvantage, that's a good point. But assuming the person doesn't have unrestricted access, they can only modify some sections. So, this will still hold good, right. But that's another weakness you have with the system as well. Okay, so those are some downsides with the JavaScript approach. Now, we'll talk about the primary approach we're going to discuss here, which is the content security policy approach. How many of you have heard about content security policy or know what it is? Not that many, okay. Content security policy has a few advantages. One is it can be done either by the developers or it can be done by the network or infrastructure team, right. So, it is not strictly a coding effort and it's a much simpler approach because you're not modifying any existing behavior. You're using a built-in functionality in the browser. And if you configure it in the monitoring mode, then it will not break your website's functionality at all.  So, these are the advantages with this approach. And content security policy itself, it's a functionality supported by a browser. It's available in all, you know, supported in all modern browsers. And you can think of it like a firewall for your browser, right. Now, I'm sure all of you know what a firewall is and you would never put a website on the internet or any service on the internet without it being predicted by a firewall, right. So, when you have an equivalent for your browser you should also, you know, make sure that you always turn it on so that you control what your browser can do. Now, what a content security policy does is, it essentially tells your browser what it should and should not do, right. So, one is typically a browser whatever the server sends as a content, it will follow the content, it will first run the HTML parser and JavaScript parser and so on. And whatever code is there it will essentially evaluate all of that, right. But content security policy is like it's an instruction you give to the browser saying, hey, this is how I expect my site to behave. So, irrespective of what code is downloaded from the site, the browser will always refer to this policy. And if the code is, you know, trying to do something which the policy has not allowed then the browser will not perform that particular action. So, that's in essence what content security policy is. And it has two modes. One is you can put it in a blocking mode. So, which means if there is a, you know, behavior the code wants to do which the policy is not allowing then the browser will stop that from happening. That's a blocking mode. And then you have a monitoring mode where if the code wants to do something which the policy does not allow then it will let the thing to happen but it will give you an alert saying hey, the policy said this should not happen but the code is actually doing this thing, right. So, that's the mode in which we are going to, you know, like deploy our policy to look for these kind of attacks. Now, this is an example of what a CSP policy would look. It has, you know, two components. You have these directives. Directives are individual, okay, I will get into the details a little later. So, you have content security policy and content security policy report only. So, report only is the monitoring mode system and if you just say content security policy then it goes into blocking mode, right. And what follows that is the actual policy definition itself, okay.  So, here these are the directives and each directive is separated by a semi-colon, okay. So, you can think of a directive as a specific command which defines one specific behavior of your application, okay. So, these directives cover different kinds of behavior as in, like for example, there's a directive which says what kind of CSP behavior should be there on your site. There's another directive which says what kind of image loading behavior should be present. There's another directive which says what kind of communication based behavior is allowed, right. So, each directive is meant for a different behavior. Now, for the purpose of this specific, you know, attack detection, the directives which are of interest. Now, there are a lot of directives which are supported by CSP, you know. But for this specific attack, the directives of interest are these, script SRC, style SRC, image SRC, you know, like I put a whole bunch of them. I've researched the entire list of CSP directives and these are the only ones which are applicable to the job at hand, right. So, you can just stick to these. And each directive has a value associated with that, right. So, the directive says, you know, each directive controls a certain behavior. The value will, you know, say or it will specify, you know, how the behavior should be. So, for example, the possible values are, you can have none. You can have self or you can specify either a single domain or multiple domains, right. And the domain can be just the domain name or it can be the origin or it can be the origin and even a path included, right. So, it can be very vague or it can be very specific.  For example, here you have connector SRC. Connector SRC defines your browser's communication behavior, okay. So, if you say connector SRC none, then your browser will not make any kind of, you know, DOM communication calls, which is any Ajax communication which is made will be blocked by your browser.  If I say connector SRC self, now here I have script SRC and the value is self. When I say self, then it means load JavaScript files but only loaded from the same domain. So, if you are visiting hasgeek.com, then it can the browser will only load JavaScript files from hasgeek.com, not from any other external domain. Or you can specify a specific origin. So, here it says style SRC and then this. So, this means that CSS files can only be loaded from this particular origin, right. And you can mix and match. So, for example, you can say script SRC self comma abc.com comma, you know, 123.com. So, which means it will load it from the same domain as well as abc.com as well as 123.com, right. So, I think you get an idea of how this thing is, it is very simple, it is very straightforward, nothing complicated here. Okay, so we will quickly go through the different directives and the related browser behavior. So, script SRC, if you have a script SRC like this, you say you know you say script SRC and then you give the name of the site from where you want to load the code. So, then if you have a script tag like this where the SRC is pointing to that domain, then the browser will load it. But if it is pointing to another domain, then this will be blocked by the browser, which means this JavaScript will not be loaded and it will not be evaluated, right. So, similarly for the other origins as well. This is part of my slide so you can, you know, refer to it, right. So, for each of them I have defined which is allowed and which is not allowed. Okay, so now that we know what a CSV policy is, what are its different components, now you will have to write a policy, right. Now, how do you get started with writing a policy, what directives should you use and what values should you set for these directives. So, what you can actually do is, you start with finding out what all content your site is legitimately supposed to load, right. But finding out this information is difficult because your application is typically very complicated, you know, there's lot of JavaScript being loaded from different places, lot of dynamic content and this is all controlled by your developers, right. So, you might not have all the information. So, what you can do is you can actually use CSV itself to collect this information which is you can write a very simple policy which is you set everything, you can start with a baseline policy, right.  So, in your policy you can specify report URI and you can give a domain. So, this URL is essentially a HTTP endpoint, you know, it's a web service endpoint. So, whenever there's a policy violation, your browser will send an alert to this particular domain, that is this particular endpoint. So, you can collect and you can know, you know, what all violations are taking place. So, if you set a baseline policy and this is how a violation report would, this is what it would look like, it will say in which URL the violation is taking place and it will say which content is being blocked. So, in this case example.com slash css slash style.css is not being loaded by the browser and the reason why it is not being loaded is because of this particular directive. So, you have set the directive which says style src cdn.example.com. So, you're saying CSS files should only be loaded from this domain but your site is trying to load it from example.com which is not matching. So, there was a violation. So, you get a report of this kind, right. So, the report has all the details that you require. So, what you can do is you can start with a simple baseline policy. You can set it up on your server and as your users are using it, you'll have a new violation report. You can look at the violation report and from the violation report you can identify what all resources I'm loading and you can start adding those things to your policy, right. So, once you do that then you will have a policy which contains all the whitelisted information and every time you have a new violation you know you analyze it and then you update the policy again. So, this is a continuous cycle. If you would see first thing you do is from the browser to the browser, then your users are browsing the site. As they browse the site you will get CSP violations which will be collected by your endpoint. Now, you analyze these violations and then you update your CSP policy again, right. So, this keeps going on a continuous basis. At the beginning there would be a bit of work. The first time you set up a policy because you have a baseline policy which is not customized to your site. So, you can say in the first week you would have a policy but once you have tuned up the policy like from week to onwards you should not get any violations, right. If you get a violation it most likely is you know pointing to something bad happening on your website. So, now what will happen is once you have this policy stabilized. So, now you have clearly defined who your website can communicate with, from where it can load resources, so where it can navigate and all of that information. So, now let's say the website is someone goes and modifies your JavaScript file and they write the same kind of you know inject the same piece of code which is going to collect your data and it's going to you know post it to some attackers bavas.com, right. So, now what will happen is you will get a policy violation from multiple users saying that hey now there is a new connectors RC violation to bavas.com and then you can be like hey what is this bavas.com. You can do a quick you know who is lookup and then you will see that bavas.com is not really registered to you guys and then you can check with your developers and find out hey guys bavas.com does not belong to us. Do you are you like you know is it by design that you are communicating this with this website and if they say no then you have a problem on your hands, right and it will get picked up in the first one hour or depending on how much traffic your website gets it will get picked up in the first few hours. So, you know the attacker injecting this code and your developer and your users actually getting affected because you will start getting these violation reports, right. So, in the CSP mode any egress traffic you will get a report and you know it will get picked up by your team. Okay. So, to get started you will need an initial policy and this can be a fairly decent initial policy which is for all of these directives of interest of this attack. We are setting it to self which means we are saying you can load these content from the same domain but not from a different domain, right. So, this would mean that only the content being loaded from external domains you will only get violations for those and you can go and update those in your policy, right. But this is a very good starting point you can just copy this policy of the slide and you can put it and you can get started, right. So, there is not a whole lot of customization you will have to do. So, we can use CSP to look for your site's behavioral anomalies and you can detect those kind of data filtration attacks, right. So, now I have discussed the advantages at the very beginning itself of using the CSP approach but there are some limitations to using CSP for this purpose. Now the first thing is CSP is not designed for detecting data filtration attack. CSP's primary goal is to prevent cross-site scripting, right. So, that is what it was designed for. So, what we are doing is we are using it for a purpose it was not originally designed for and all of you know how that works like when you take one system and you hack it to do something else. Yeah, I mean it does do its work but then it comes with its little problems as well. So, the problems here are that it is possible to bypass this monitoring system and I have listed down a bunch of different bypasses. I will just cover them briefly. So, you can have a DNS preface based data leakage which is the attacker can say you know stolen data attacker.site and he can instead of putting it in a script tag or you know style tag or whatever he can put it in a you know preface type of attack. Now what will happen is the browser will make a DNS lookup to stolendata.attacker.site now if I am the owner of attacker.site then this DNS lookup will actually come to my DNS server and if I just monitor all the incoming DNS lookups then I know the sub domain part is the attack is the you know like customers website customers data for example if I am stealing credit card information or credit card information is like what 20 digits. So, I can say credit card information dot attacker.site right. So, when I since I own the DNS server I can just look for all the sub domains which you know came to me and they are all the credit card information right. So, this will not get picked up by CSP you can you know navigate the user to your website by doing something like this you can say location dot href and you can set a new URL the user will be redirected there and this will not get picked up by CSP and or you can just put a href tag a link and you can maybe convince the user to click on it or you know even if by accident the user clicks on it you will get a you know hit to your server that will not get picked up by CSP I can do a window dot open which is I will open a new popup and that will not get picked up by CSP So, those are ways by which an attacker can actually perform an attack and your system monitoring system will not pick that up right but why should we still look at CSP as a valid approach for this attack So, the first thing is yes it is not a perfect solution but it is better than having no solution right because it makes the attackers work harder they will have to make you know you know they will have to put a little bit more effort in trying to bypass your system So, usually you have this thing called you know like a blind brute force type of attack where what the attackers will do is they will scan all the let us say they find one specific you know exploit they will scan all the servers on the internet to see which ones will you know fit this particular exploit wherever this exploit works they will have another script which will go and inject their JavaScript everywhere right so in this case it is not a targeted attack they are just seeing whoever they have one technique they are just seeing where this technique will work and they just you know go and exploit that system usually not customized with you know all these bypasses so your system will pick up things like this right most of the common kind of attacks so that is one the second thing is CSP is not a you know static standard it is a constantly evolving system right so they are adding new capabilities to CSP which will fix some of the bypasses that we just discussed about for example CSP version 3 is adding two new directives prefetch src and navigate to src which will block like a bunch of bypasses that we just spoke about so if you invest in CSP right if you have a policy in place you have the process defined you have your team which is trained on it and you have this you know started this you know discipline of looking at the alerts and so on so whenever CSP is upgraded to the new system then automatically the bypasses also get fixed right so this is prefetch src so the the dns resolution will get taken care of here navigate to a directive will take care of your you know window.location.hrap window.open as well as you know clicking the link kind of a issue right so there is something else also you can do with CSP which is you can use it to identify all the JavaScript code which is loaded on your server so the way you will do that is you will set your script src to none okay you can pick a time when your you know sites traffic is low preferably you know later in the night or whenever you can set just script src alone to none and you can leave it on for like half an hour one hour whatever time and as your users are browsing the site you will start getting CSP violation reports now the CSP violation report will have the list of the JavaScript file your site is trying to load right so from that you can create a list of all js files when I say js files these are not domain this is the exact this is the you know entire URL of the js file which your site is loading so you can collect this list of js files which your site is loading you can keep it with you and you can run it again say after a week and then you can compare the list of JavaScript files and if you see some new js files being loaded then you can go and manually duplicate those js files and you can see if you know it looks okay or if it looks malicious usually if the code is heavily obfuscated then that's clearly a sign of you know something bad happening right so this is another thing you can do using CSP which will also help you you know like address some of the loopholes we discussed earlier okay so with that we have covered the you know entire approach there are a bunch of free tools available for you you have you can use them to generate your CSP policies and you have open source software available which you can use as the CSP reporting you are right so you can set it up on your server and it will process all your incoming CSP violations and it will store it I think in Elasticsearch so that's the talk I would you know be happy to answer any questions you have on whatever we discussed yes CSP policy is essentially a header so why it's a HTTP header all the modern browsers support CSP header right but the kind of directives that are supported some browsers might support all the directives some older ones might not support all the directives but that does not really concern us the reason is we are we are interested in detecting an attack so let's say chrome chrome has like excellent support for CSP right now chrome let's say chrome makes up even worst case scenario if even if it makes up 5% of your user base now if your site is compromised and if it is leaking data externally and if your browser like 100 people use your site so 5 of them are using chrome which means you are eventually going to get those CSP alerts to your server right as a monitoring person will get to know that hey my site is talking to somebody it should not be talking to right so you don't have to get it from all of your users even if you get it from a small portion of your users your objective is met so the browser support is not that big of a deal but chrome has really good browser support and chrome has like excellent market share anyway so I think we are good that way so you had a question yeah so I just wanted to ask like do we configure CSP at the web server level or at what like at what point we configure the CSP these values and all see that's entirely up to you the the idea is to set the header so you can decide as a person who owns infrastructure where it's easier for you to do it you can add a middleware or you can do it at the code level you can do it at the web server level or if you have someone like cloudfire for example you can do it at that level that's that's internal operational decision for you to make right wherever it's easier for you to manage I had another question just like small one so previously you said we can tap into the native 80 APIs of the JavaScript right can those be used as a monitoring tool like every request it makes it just simply like creates a dump on some reporting server or something like that can it be used as a monitoring tool or all the request in your website something like that or you're saying the JavaScript approach if you go down that of course you can do that if you hook into the native API of course you can collect all of that information in fact if you look at things like New Relic APM for the client side that's what they do right but would you want to do that as a big question because you would end up collecting a lot of data and you would be essentially you know like leading to bandwidth consumption for your end user right would you want to do all that if that information is useful for you of course you can collect all the outbound network calls which is being made by your JavaScript you can get a copy of all of that sent to your server that's entirely technically it's possible does this also collect the browser extensions or requests that's a very good question it will collect you know information from the browser extensions as well but you can filter them out from the policy details because you know when there is a violation which comes it will tell you you know it will tell you which is the page on which it is happening and which is the violating you know URL right so there you will know the extensions will have a separate URL and you can filter those things away but it will get information from extensions also however you cannot so the things from extension is essentially noise but if you try to you know use that as a security thing which is to say hey I can use csp to see if the user is to protect the user from the extensions that wouldn't work because the extension developer can just write one line of code which will just remove the csp header itself right so he can bypass the csp so that approach will not work any other questions sure I think there is one so if an attacker has the flexibility to inject some JavaScript code or something like that so wouldn't he be aware of modifying the content security policy also yeah that's that depends that's all I can say because it depends on where you are you know configuring the csp policy and how much control an attacker has like for example if your server web server is compromised but if you are adding the csp header at the you know cloudfire level still the attacker cannot do much but there could be situations where an attacker has enough access to also overwrite the csp policy itself at that point you are just in bad luck right


we've now turned public figures, all public figures into politicians. And so everything is like a statement and an example beings there.   But I, I really just thought I was joining in a conversation like I'm so desperate all the time to learn about people because I feel so abnormal. And I really want to understand people. And I think if I can understand them, then maybe I can be more like them. And then maybe I'll be more acceptable. And so I just want to, I just want to join in the conversation. Like I don't think my opinion is better than anyone else. Even when I came out swinging as like this big feminist and everyone was like, Jamil Jamil, the feminist hero that we need. Like people were hyperbolizing how amazing and extraordinary.  Right. But I like the conclusion you came to with all that years ago. And I don't know if you can still believe it. But the thing of like I'm canceled or whatever. There's no, there is no such thing.  All right. Well, I'm not going to stop. I'm not going to stop. I'm not going to go away. I'm not going to disappear. But what I was saying about the whole like, you know, like me being like hyperbolized, that's how amazing I was. Even then back from the beginning, I was like, no, no, no, no, I left school at 16. Like I'm a feminist in progress. I'm figuring it out. I'm just learning. I've always tried to avoid this idea that like, I think that I am on this soapbox and you should listen to me. I'm just speaking my opinion. And I think the reason they're drawn to me is not because they think I'm always right, but I think it's because they think it's refreshing that I'm willing to just try publicly. I'm willing to show my workings out. I'm willing to make the mistake, get back up, try again. I'm not trying to impress or lead anything. I don't think that I have the right to tell anyone like what to do. There are things that I feel should happen, or there are things that I think are unjust and inhumane, but I'm just speaking about it as one human being who believes this thing. And I think it's publicized because you're good looking and they're divisive issues and it's fun to pile on.   But enough about Pakistan.   And I knew that going on my way up. I remember you saying like, yeah, you were like, I watched these girls shrink from the negative attention except for a few of them who would just go, no, I'm not going anywhere. Yeah, man, I get into trouble all the time and we are treated as women in particular as like, if you've done something wrong, you have to leave forever. You have to, you can't burden anyone else with your existence. We can't, you can't set a bad example for the others that they know that they can also make mistakes.  A lot of the women who disappeared after they were canceled or globally, you know, like piled onto, they actually canceled themselves most of the time. They opted out of all opportunities. Yeah. Not to say that they hadn't lost opportunities, but they just like disappeared from public life because we're taught that our only value is how likable or fuckable we are, how easy we make it for everyone else.  Do you know how lucky you are to be in the room?  I'd had too many years of being like hailed as God to survive it and I was being dragged down. And I did have the thought of, why should I probably leave? I should probably retire and go and do something else or retrain. Coach, yeah. Yeah, exactly. Oh, go and start up a video shot. I'm sure that'll do well in this climate. But then I thought, well, what would a white guy do? Most of the white men that I know would go like, oh yeah, that was unfortunate. But you know what? I'll figure it out. I'll just keep going. I was like, why don't we all do that? But it also doesn't mean any, that's the other, whether it's a white man or not, it's none of it means anything. But you don't learn that until you do it, right? And the only people that I had examples of who would just keep going were white men. So I was like, well, why don't we all just try this? I'm just going to stick around and see what happens. Yes, people find me annoying or unlikable or flawed in some way. Fine. I'm just going to keep going and see what happens. This is going to become my own life experiment.  And in doing so, I realized people move on.  They don't care. The work comes back and you just grow and you do better.  We have so many perfect idols, especially women, like where they look perfect, not hair out of place, like they don't, they have the right opinion or no opinion, the perfect behavior, the perfect smile.  Because that's the standard I held myself up to. And I know these people in real life, they are far from perfect.   My podcast is me learning in real time and being publicly ignorant. I'm not proud of it, but I mean, again, why not? But the other thing with all the, all of the things that you saw as like media things or whatever were nothing, they weren't, to anyone that wasn't you, it was like, I just, they were all ignorable. They weren't, it wasn't like front page. It was like, I don't know. Some of it was front page views. Some of it was really crazy. And I did lose like work from doing so. And I did lose a lot of money from the choices that I made and the fights that I took on. And so it was very real, but it doesn't mean that I can't grow and change.  What are we doing here? Why are we ordering saying anything? They all want criminal justice forms, but not social. Yeah. Yeah.  It's just like, I've more and more distanced myself from that movement. I believe in all the same causes, but the way that they go about it horrifies me. And I own my own responsibility in the fact that I was complicit within pitchfork culture when I was younger. I agree.  I regret is like being scaldy. That's the only part of like the last 15 years that I regret. I regret just being like, yeah.  Because just like, who has ever learned anything who has ever grown from being shamed and maimed? I certainly haven't. I've learned from moments of grace and a bit of space to learn. Right. And then I've grown and I've changed.  And I've become who I am now, who is a very different person, who fights passionately for the rights of women and who really cares. And it comes from really deep inside of me. It's like, I changed. And so we can all change. I have belief in change. I have like an immense amount of grace and mercy I would like to extend to other people that was extended to me once.  It's just it, I find it deeply disturbing. And I'm just like the hypocrisy is too much to bear. And what I was joining in on with my little pitchfork or my little soapbox five years ago was, was me thinking we were a part of trying to change what was bad. I had no idea what this was going to become, which was just like a constant self sabotaging, self mutilating, like witch hunt for each other. Like no big systemic issues helped.  So that has been like a huge shift for me and liberating myself from that has been Yeah, it was a, it was a, it was all performative and it was not nobody was Mine wasn't performative. I really thought we were trying to change something, but I But in retrospect, you're not changing anything.  No, it wasn't helpful the way I spoke to people like when men were really horrible and vile to me online, rather than ignore it or just challenge like, Hey, why are you speaking to a total stranger like this? I just call them an insole.   You have no idea like what their life experience is like. I, I've just the last four years have been so transformative for me to realize that like, none of us have a leg to stand on if we don't treat people with the humanity and grace that we wish to receive ourselves. If someone's telling you how to behave, check your wallet or check your panties. I'd stand by it. Hey, did you like that? Did you like that? Yeah, did you like it though? You want more? Don't want to work? Would rather watch videos of me grab assing with people?  This is like when the weatherman says there's a high pressure system coming in. I'm not really used to the green screen.