Alright, if I could have everyone's quasi-attention here. My name's Humperdink, or as you can all see from the slide, my real name's John Miller. I'm the Senior Security Engineer for Cover Systems, we're a company based out of LA, and today I'm going to be talking on how you can secure your Windows Internet servers. What I want to hit on is a little of the old stuff, a little of the new stuff, and hopefully, what I really want to stress is, no matter what Windows OS you're running or any OS, if you have good fundamentals and use common sense while setting up your server, you're going to be fine. So let me start off here with the first slide. Let me turn this mic off. Oh, and there's my email address and a little thingy. Alright, number one, anytime you have, let's say you guys are running an NT4 server and you're looking to upgrade 2000, should you do that? Never, it is like one of the worst things you can ever do. I remember there were problems, there were originally issues with upgrading from NT4 to 2000 with leaving password list accounts and stuff like that. And so I've always tried to use a fresh install no matter what you do, even if let's say you're redoing your site, try to use a fresh install for everything, or if you guys have one set server, do like a ghost image and just ghost image everything, because I've seen a lot of people where they actually have a compromised machine and they just keep upgrading it and stuff like that and the machine's still compromised. Always use NTFS. I see people out there running file systems on web servers and stuff like that and you always screw up with the file permissions. What else? When you upgrade, your default security settings are not applied. You have to go into the MMC every time you upgrade and load up your security template and reapply everything. Make sure you have the current service packs. A lot of times you might be a week or two late on stuff and stuff will go by it. A lot of companies I do audits for, this seems to be a killer item. They're either running legacy applications and they don't know how to respond with current service packs and so they just let them go. Always test it if you're running something, this legacy that's dependent on it, try finding a new solution. HF NetCheck is a great tool that allows you from an administrator account on the network to run a check against any IP. As long as you have administrator access on that computer and it'll tell you what hot fixes are and aren't installed and it'll give you the TechNet ID and you can go and locate everything online. Mod file systems, NTFS or FAT. When you're running NTFS, you get the actual file permissions that you don't get with FAT. So never, ever, ever use FAT. Services. I see a lot of people who decide that they're going to run, let's say, an iOS server. So when they go and they do the full install, they figure they'll just install everything and either disable what they don't need later or they'll use the idea of, well, I might not need SMTP on my web server but it never hurts to have it there. This seems to be a killer because people end up running things on servers that they don't know are actually running. Lots of people when they do a default iOS install will have an anonymous FTP running but let's not know. That always seems to be a problem. Always make sure that you actually go through and don't install anything you don't need. In a corporate environment remote administration is always a problem and so lots of places if they decide to go with Compact hardware like Compact remote inside manager, PC anywhere, terminal server. You'd be surprised. VNC is very popular. You need to, before you actually install your server, you need to decide what you're going to run because if you want to set up terminal server, the time to do it is during the installation. Similarly, I like using VShell which does SSH and SFTP for Windows. It is not free but it is a great program. It's available at VanDyke.com. Okay, this is something like 99% of the people out there who run Compact hardware, Compact actually ships with their Compact RestoreDisk which has Windows on it. You actually use that server installation and installs all of the Compact software which includes Compact remote inside manager and stuff like that. Compact remote inside manager operates on port 2301. You might want to scan your machines for it. In reality, a fairly insecure web server that there are oodles and oodles and oodles of exploits for it that your local neighborhood script kitty can get a hold of. So it is the devil. All right, next slide. All right, now we need to talk about network configuration. A lot of places, if let's say you're running an iOS service, they'll decide to run Windows networking and just update the website via a network share or something like that. Any Windows machine you have that is actually physically touching the Internet should only be running TCPIP. That should be the only protocol. Use TCPIP filtering which is, I mean, more or less, it's a firewall built into Windows that's been there forever. Since as far back as I remember, NT4 has it. Barely anybody uses that. It's pretty straightforward. You just go to the advanced user settings on your actual TCPIP protocol and you can set in what ports you actually want to allow TCPIP traffic to and from on your machine. So if you're running a web server, and let's say you have Van Dyke's SSH on there, so all you have to allow is 22 and 80, and you can have people do SFTP uploads. You can actually SSH in, restart services, and you can have people browsing the web onto that machine. So it's wonderful. If you ever get back door, it prevents a lot of problems with people watching services on ports that aren't applicable. Always end map your servers, port scan them to make sure you don't have extra ports running.  That just kind of gives you an extra level of protection to make sure it's okay before you put it on the internet. Never ever ever put an iOS server on your corporate domain. For the sheer fact that if there's one Microsoft server that is the most compromised, or actually it's probably the most compromised server ever known, it would be iOS. And so by doing that, you're allowing people to actually compromise your iOS server, which is more or less inevitable. If anyone's determined enough, they can compromise an iOS server, no matter what you do. And then it gives them a stepping stone on your entire domain. So always put your iOS server on an external IP, on a DMZ, and just leave it alone. Another way I personally like to do it is you can put it in two ethernet cards. You can do a private card and a public card and then just do SSH or whatever on your second ethernet card. So the only port that anyone sees from the web is port 80. It's also great, I love telling people this, that I've seen people running Microsoft FTP forever and ever on all their iOS web servers because, hey, we need to update with front page and stuff like that. And before SSH for Windows, the best way to do that was burn it to a CD and walk it over to machine and upload it. So having a second ethernet card is great, especially if you have it on a totally separate address space, if you have it on a separate class C or something like that, if someone's scanning, they won't even find it. Using the Microsoft Management Console, most people do not use this. I wouldn't be surprised if half the people in the room do not know what the MMC is. More or less, when you go to computer management on your NT server, all that is is a snap in for the MMC. The MMC is a mystical, magical thing you can use to do almost anything to your Windows server. You can access it by clicking your start icon by clicking on run and typing in MMC and it will pop up. It's a great, great tool. What is it? Through it, you can manage your security templates, which allows you to do user policies, ACLs, what else, account restrictions, everything. Never use a default Microsoft custom security template. Either you can take one and customize it to your own needs or you can build one from scratch. If you're doing this in a corporate setting, you need to establish standards for what you actually want these servers to do and build a security template for each machine based on an original security template. And then every time you build a machine, apply that security template. Security configuration. Password complexity. I can't tell you how many times people out there who have web developers and email users, people do not apply password complexity rules through the security template. So you have people with password list accounts, people with dictionary words and stuff like that. You can actually, through the MMC and your security template, set complexity rules and always make sure that your passwords are at least a minimum of eight characters long. You can also do the settings where your PDC or Active Directory Server will actually remember passwords so they can't be used again. So if your machine does get compromised and somebody obtains the SAM file and cracks it, hopefully by the time you set your expiration date to by the time they go back, the password won't be valid anymore and it can't be reused. Event log access. Lots of people have, especially with NT4, they did a lot where you could have public read access to your event log. And by your event log, I mean that's your security log, your application log, everything. So always go through a series of registry changes you can find to change that. Define permissions for services. Most people don't do this, which is funny though because on almost every Linux machine, you always have, you know, a patch and he's running as nobody and stuff like that. People don't really define permissions what everything can run out. So you have services that don't need it running as an administrator. Always rename your administrator account.   I like to actually create a new administrator account and you can do registry changes to disable your original one. Common sense. With IES, especially, people like to just do a default configuration and everything's up and running and leave it at that. What you need to do is actually go in and think like a hacker and what they actually exploit with a lot of stuff like Code Red, you did use IDA, crap, script mappings and stuff like that. Delete them out if you're not using them. Most hackers, when they go and actually compromise your machine the only way or the easiest way and they can do it directly from a command line to upload files to your machine is to use TFDP.  Number one, if you're configuring like Cisco devices or anything that uses TFDP from a web server you're probably not going to use the Microsoft default one. Go out and download the Cisco one. And also a great thing you can do is rename your command prompt from CMD to something else. So let's say a new worm comes out that does directly and transversal or something like that and actually launches a command shell from a web browser if it calls for command.exe and your command is shell.exe. You're fine. Do you really need Microsoft TFDP? No. Rename your command prompt. What I like to do with IS web servers is do not put them on the same partition as your system files. Just create a second partition just for your actual web hosting. The nice thing about it is it's easy to back up. It's easy to maintain. If you ever need to restore something you can just blow away the old partition put in the new one and you're fine. Yes, people running IAS on exchange. I would say the most important computer in any corporate structure is the mail server. Everybody uses email. When email goes down, productivity comes to a halt. Do you really want IS running on your company's most important server? IAS is compromised a lot and do you really want to risk someone compromising IS and reading people's emails? Or at the very least halting your email server? I would web access on exchange 2000 and exchange 5.5. It's beautiful. CEOs love it because they can check their email when they're on the road and it's pretty and it looks like Outlook. But then again you're doing the exact same thing where you're running an IAS server with not only are you running an IAS server on your email server, you're running an IAS server that's capable of changing user passwords. It's just not a good idea. You can go to Microsoft Security Works website. It's really a great website. Not that many people know about it. It's Microsoft TechNet slash security slash notify.asp. They will actually, Microsoft will notify you when new security alerts come out if you're not on bug track or something like that. All right. Configuration for IS-4 and IS-5. Try to run base services. Don't run SMTP or FTP. Get away from that. These are on an entire server. If you're running a sole IAS server, these are the only services that you need running for that machine to actually work. You need your event log, your license logging service, NTLM security support provider, your RPC service, your NT server, IAS admin service, MSDTC, road-wide publishing service and protected storage. With that, you can actually stop every other service on the machine and your web server will run beautifully. Stuff to remove. Do not ever leave sample files or admin scripts on your web server. It's just too easy for people to mess with them. I don't like using iNet Pub at all. Like I said, I'll make a new partition and I'll just call it HTTP files and just upload everything to that. Remove your HCW mapping. It's one of the tabs you can actually do in your internet service manager. It's more or less useless. Remove your IAS admin password. That is the actual file that allows people to change passwords using Outlook Web Access. If you are going to run Outlook Web Access, I would recommend removing that anyway. When people click on the Change Password button, they'll get a 404, but you don't have to worry about someone getting in someone's email and then changing their password and marking them out. Remote data services, don't need them. What else? I have more stuff here. Parent pass. You can actually disallow the use of directory transversal. It's great, but 90% of your web developers out there use it in their actual code. So if you disallow that, there is a possibility that you're going to end up breaking the website. That's something that you'd probably want to talk to your developer or whoever makes the site before you actually host it. That is where you can go to change that. You can open up your web server properties, the home directory configuration, app options, script mappings. All of those script mappings you do not need. They can all be removed.  IDA, you know, printer wrappings. You do not need those. This is the place to go to remove the script mappings.  It's a bit of a mouthful. By the way, if anyone needs any of this, you don't have to write it down. It's actually in my PowerPoint on the DEF CON CD. Miscellaneous stuff. Never allow anonymous access to your computer for anything. This will take down you don't have to worry about null sessions. And this is the registry key where you go to actually change that. Permissions, second ACLs. A lot of people out there don't really know what ACLs are. Stands for access control list. It's your permissions that tell your computer who can do what and what not. I'll get into it in the next page. Make sure your IS log files are not publicly readable. That is the directory. You can actually go and change the option on that using your properties and your security tab. And you can view that it's not readable by everyone. What else? Ooh, that goes quick. Okay. You can set down that CGI should not be run by... These are the only people that should be able to execute CGI's. Which use the four file extensions there. What else? Crip files. Everyone needs executable permissions on that, administrative, full control, system, full control. What else here? Include files. It's the same thing. Just make sure this I take a note of. Make sure you do this when you deploy an IS server. Static content isn't really that much of a problem. Everyone... you don't need execute properties. All you need is to execute and just give administrative full control. Okay, now let's get into the world of exchange. All right. For a while, send mail is getting into it now and it's working rather well. But exchange for the longest time was one of the few email servers that would actually do outgoing mail authentication rather than using relaying. Even though it was capable of doing that exchange 5.5, still did the default permission of using your servers in open relay.  Try using your encrypted file system. Nobody's really played with that much. It's going to be a big player in .NET. I mean, I can't think of a better thing to use it for than exchange.  You don't want people reading that if they compromise the system. Anti-virus. Always make sure you're running anti-virus on your email server. Otherwise, you're going to have much larger problems down the road where you have users infected with all sorts of viruses and the easiest way to stop them is write your exchange server. Internet mail connector. Oh, Internet mail connector. I had no idea what that was for a while. Okay, you can actually use that to limit your outgoing size so you don't have to worry about people like blasting your pipe or spamming. You can do, I mean, more or less no users should really be throwing over 100 meg emails on a T-run. I mean, that'd really fill it up. Here's kind of a neat thing you can do. Let's say that you guys want to run Outlook Wide Access because somebody high up said you guys need to and so you have no real choice. Well, what you can do is you can put a send mail server or another exchange server out on the DMZ so it's on the public space, lock it down to Friday and then relay the mail to an internal exchange server using Internet mail connector. There it is right there. You can add the, this is just when you do it, when you're actually installing the exchange, make sure you add the Internet mail connector and you can add it to your existing exchange server on the DMZ and you don't even have to you don't even have to add mail boxes or folders to the one on the DMZ because all our access is a relay, your internal exchange server will sort everything out so you only have to manage users in one place. Oh, exchange administrators. Instead of using the default administrator account for 2000, they have exchange administrators where not all administrators on the machine are full administrators of an exchange server.  These are the three different types of exchange administrators. Jesus Christ is hot. Alright, the security page. Make that registry setting and you will actually get one more page in your exchange setup that allows you to do other security options. Tracking logs for your exchange server. That one. I can't point to it. But remove the read permission for everyone, more or less anyone with an email account and the ability to log on locally would be able to read your exchange tracking logs. You can do it through the file permissions at that location. I work with Access. Make sure you lock down IAS quite hard. The best way to do it is using SSL what's it called. Just do an automatic redirect from your standard ACDB to an ACBS so even when people screw up they'll still get to it and you can just generate your own certificate and it'll be fine. One of the neat things with Outlook Web Access is it supports something called front and back end mode. This is front and back end mode. It's kind of like if I knew how to go back a slide, which I don't. There you have the background. You can read more about it at that address on the Microsoft Web site. Again it's on the CD. This is more or less a diagram of how it works. You do a front end exchange it was just like I was saying with the internet mail connector.  There are default rules here that would make everything work peachy. If you have to do it and you know little or nothing about firewalling a lot. Again on the CD. Tools. Perfect. There are multiple tools that you can use for securing your Microsoft web servers. URL scan is a great tool by Microsoft. It actually sits in between the internet and your actual iOS server and scans URLs for transversals that shouldn't be happening. Baseline security analyzer is a great tool by Microsoft. It's more or less a it's exactly what it is. I'll pop it up here in a second and show you what it looks like. It allows you to type an IP or a host name of a computer on your corporate land. You have to be in the administrator to run it. It will run HFNet check against it. It will check for common misconfigurations and stuff like that and tell you what you need to do. Everyone should really check that out. I'm going to all of these tools on my 23 order account. At the end of it I'll give you the address of that. And you can download them there. The iOS lockdown tool. I heard good things and bad things about this. Originally it was fabled that it was useless and it actually left your server open more than it locked it down. I personally don't like to use it. It comes with URL scan both into it. But that's just because I like to know what I'm doing to my server. If it's one of your first signs installing an iOS server or you just don't really care that much it's a great tool. Give it a try. SecureIAS is a tool by a company called EI. I'm sure they're here. You can buy it from EI. It was originally it's claimed to fame was that it discovered the code red worm. What it does is it acts just like URL scan only to a much greater extent and it is much, much more expensive. It's great if you work in a corporation and you know $5, $6,000 for a piece of software to sit on your web server to give you an extra layer of security to pick it up. Tripwire for NT which is a little bit of host-based iOS. It's a great thing. Again it's expensive. It's great for a web server because if it gives you that extra notification if any of your web files ever get defaced or anything like that. It's a great tool. Tripwire is talking to them. They're going to come and hook up free software for attendees and stuff like that but everything fell through at the last second. I'm probably going to have stuff up for them on my website in a little bit where people can go and download evals and check it out. It's a great tool. There's a lot of corporate backing behind it. They're a great company. I really recommend checking it out. Always make sure you're running a good antivirus. I can't stress that enough. I'm just getting owned by the class virus and stuff like that. If you run antivirus on all of your web servers it cuts down on a lot of problems that the desktop admins and anyone internally are going to have to deal with. You can always hire computer companies such as Covert Systems to come out and do a full audit and lock you guys down and take care of all of your needs and you can sit back and drink a cold beer. That works too. It's kind of passing the buck. If it's not your job that's what I do. That's the website address where I'm going to have all my tools at. Right now the directory is not viewable by the public. I'm going to go and have that fixed right when I'm done with the talk. I kind of forgot about it. All you have to do is connect to it. It has a picture of me when I'm 7 years old staying in my hallway holding an AR15 go down below and click on tools they'll take care of you. What else? We have like 10 minutes for questions. Anyone have any questions? It depends what script mapping. You're going to have to customize that on an actual it depends what scripts for ASP. That's something you'll have to get together with whoever's designing your ASP Yeah. What's that? Removing everyone from the authenticated users. Is that what the trouble is? I'm totally not here. Removing everyone in cases and only allowing authenticated users. Authenticated users to do what? To manage to what? You can do that but then again you might run into problems that Microsoft actually uses to everyone group instead of not having to administer you'd actually have to go through and make sure that you have administer added to directories where the only group allowed is everyone. Yeah. I've done it before and it does break things. So I wouldn't recommend doing it but if you have the time you can customize one, do it and it just goes to silver and use it over and over again. Any other questions? I can't hear you at all. If anyone has questions why don't you just come up to the stage and ask me. Alright everyone, have a good night. Thanks for coming out. Drink a lot of beers. Okay.


We are, hopefully, constantly growing and evolving and learning throughout life. How can you hold yourself accountable for a level of consciousness that you didn't have five, ten, twenty years ago that you have now? Okay? You can't hold yourself to the same standard because of the things that you know now. And to even go a little deeper into that, you wouldn't be where you are now without those learning experiences. So you see, you have to understand that as you're growing and evolving and learning, you're becoming a more well-rounded person.  You're learning more about yourself and what you like and what you don't like and what makes you happy and what makes you sad. And maybe without going through those events or you said something to this person or whatever it may be, you wouldn't have learned that that was the wrong scenario for you.


I'm not sure I showed you this painting, even though you probably saw it many many times, a bit. This is a painting that my best friend drew. He drew it before I ever had any sort of business success. The irony, the funny part, is that I actually have a matching, perfectly matching suit and tie combo that costs about $2,000. You want to have friends that believe in you. It keeps inspiring me. My friend, he wants to be a singer and an actor and I keep helping him get inspired and showing him the possibilities. That's what good friends do. They keep showing each other the possibilities and really pushing each other to be the best that they can be. Cheers.


Christine Graham, thanks so much for being with us today. I really appreciate talking with you from your beautiful home with your nice backdrop. Oh, thank you. I've experimented with this. The beds and guestrooms don't work so well. Yeah, no, that's good.  And we're having, obviously, a worldwide pandemic. What kind of reactions are you seeing with the folks that you work with in the last week or so? Well, first of all, I would say that I work with all kinds of groups, everything from health care to libraries to art centers and schools and environmental organizations. So I've been really bombarded with a very broad range of needs and services and everything else. And my overwhelming reaction is that the creativity that organizations are showing and the flexibility that they've shown in being able to just transform their service delivery overnight is so remarkable. And everything political and haggling and arguing and changing minds, all of that stuff is out the window. And organizations are just making things happen. Some of the delivery services are just amazing and accommodating things like kids who are home from school, even kids where there was no curriculum in place, free schools, daycares. All of a sudden, there are resources online for them and for their families to be able to put into place right away. Actually, one of my little concerns is that a lot of people who are isolated and have a computer don't have a webcam or they don't have a camera built into their computer. And I'm worried about people who are truly isolated. But a lot of neighbors are contacting them. And even I'm calling around to my neighbors and just saying, are you OK? Do you need anything? Everybody healthy? So it's a really inspiring time if you can just get past the panic and anxiety. So I know that in our case at CCTV and town meeting TV, we have retooled our whole operation and gone from in-person meeting coverage to taking Zoom meetings and streaming them and emergency announcements, getting them up quickly. What are some other examples that have are inspiring and best practice, do you think, in terms of nimble, problem-solving, reinvention? Well, let me focus a little bit on fundraising since that's what I do. And every organization now needs money either to pay for the new services they're providing or to keep their staff employed or to try to just keep the heat on in the building. Too bad this didn't happen in the summer, but we do have to keep heating our buildings. So from a fundraising point of view, one of the things I find most inspiring is that, first of all, many funders are stepping up and giving away so much more money than they were in the past. Family foundations that had a strict 5% a year donation rate are doubling it. And they're giving faster. If their grant application was due last week, they're going to hand out the money this week. They're not going to wait until July. So I'm seeing much faster action and much more giving dollar-wise, although a lot of it is in small chunks for quick emergency fixes. A lot of the restrictions on grants that are already in place are being lifted. So if an organization got a grant in February to do a very specific project, if they call their funder, the funder may say, don't worry about the restriction on those funds. Use the money for whatever you need it for. So that's a powerful thing. And loans are becoming more possible. Some foundations which have been able in the past to give away to individuals or businesses under certain circumstances but never used to are now considering helping small businesses that are in trouble, especially in small villages and providing important services. So I'm finding that all kinds of donors from individuals, family foundations, business corporate giving, every kind of giving, they're just moving faster, giving more, and being more flexible about what they'll support. And how do you know this?  How is this information being shared? Well, yes, a lot of people call me. And my policy right now has been, if you can get me, I'll answer your questions to the best of my ability. And also to understand that I also never lived through anything like this. So my experience is long but flawed in this circumstance. So I'm talking to everybody I can talk to and emailing with who I can email with. My colleagues and I in my business have started an occasional memo that we're sending to groups that we work with and groups we've worked with over the years making suggestions about what we think they should do. But I'm also really inspired by the way nonprofit groups all over the state are getting together and collaborating. So I was part of a call this morning with anywhere from 45 to 60, I'm not sure, leaders of different nonprofits around the state. It was set up by the Community Foundation in United Way but there was just a very, very wide range of both funders and organizations and individuals who work in the nonprofit fields and the consulting fields. Just talking about what's going on so that we're careful to not leave anybody out in supporting them and also being careful that we don't duplicate services because the need is so broad we wanna make sure you're capturing everything. And I think that that's a group that will continue to meet by Zoom or some online mechanism at least every week and continue to communicate. So organizations like the Community Foundation and the Vermont Food Bank and a lot of the statewide organizations are also highlighting things that are happening in individual towns and villages and everything from networks of volunteers and neighborhoods that are helping each other out all the way up to statewide distribution of food. And one of the things that I was really reinforced for me was that if a community has a need they shouldn't be afraid to call or email a statewide organization. If they don't know whether they can have people walk on their trails, call somebody at the land trust and ask them what their policy is. If they need a food distribution site in their town and don't have one, call the food bank and see if they can set it up. Normally that would take a long time but it's not gonna take a long time now. So I think that all of the nonprofit sector is talking to each other and coming up with interesting solutions. And so you said you've been sending out memos. What's the top three pieces of advice you have for nonprofits at this time? Well, I'd say that my number one first advice is to communicate with your people. And your people are the people who receive your services or come to your events, people who are your donors, people who are your prospects, people who are your neighbors and to be communicating with them and telling them what you're doing. Everybody feels like they wanna help and nobody knows really what they can do. And when you communicate, you're showing them that you're doing things but you might also be helping them to understand how they might be able to help. I'm not advising out and out aggressive fundraising but I also think that people are so aware of the need for giving these days that if you tell them what you're doing and it sparks something inside of them they're going to give. And I've heard of a lot of donors that without even being asked once they hear what you're doing, they give. But I also think that part of this is being honest. If an organization is in dire straits because they've lost something, for instance, like an arts organization that might have been depending on a single event in April for a third of their budget for the whole year they need to tell their donors that many of the people will be able to help and will give. And if they're not able to help, at least they understand why the services might be cut back some way. So I think communicating first of all about what you're doing and then being honest about what your situation is is so important. Those are probably the biggest things. And I think also to be kind and understanding and not to make assumptions that people won't give but also not to pressure people because everybody knows the need. Well, and also the people who have assets are taking a beating in the market. They are, but if you have enough assets that the market beating is hurting you this might sound a little cynical at this moment but you can take losses on your offset your income when you do your income tax next year. And so it used to be that we would encourage people to give appreciated assets but, and that was a better way to give. But if you have losses and you give you should sell your stocks or mutual funds and then give the money. And then later when the recovery's in place and you're declaring your income on your taxes again you'll be able to take the losses. So does this have echoes with 2008 or is this a different, I mean from a financial perspective hit on nonprofits or is this a different kind of situation? I think it's different because it affects it affects the health and the wellbeing and the service delivery before it affects the financial piece.  In this case, the need is accelerated or just hugely increased before you even see the financial hit. So I think it's different. And I'm not a financial wizard but when this first started I heard an interesting comment from somebody who said that this market crash was, I think the word was exogenic, something like that that it was caused by something that we couldn't predict from understanding the economy. And I think in 2008, there were economic things that caused this. And when it's caused by a virus it's out of everybody's financial understanding. So I think that the financial, the dollar amounts may be similar to 2008 but nothing about the cause and the impact on service delivery, nothing like it. Do you think that Vermont has particular resilient systems in place that position us well for this time as horrible as it is? I think the sense of neighborly goodwill and kindness and ability to reach out and just knowing our neighbors is our biggest asset. Biggest asset, lots of states have things like Front Forge Forum but not to the extent that we have it in Vermont. That is helping I think practically every community right now. And it lets people who aren't usually in the mix of community leadership step up and say here's something I could do, who needs it? And that really just looks to me like a kind of neighborliness we don't see anywhere else. I'm so glad I'm not in New York or LA or Houston right now where I live in an apartment building and don't even know anybody in my building. I'm in North Bennington right now and I know everybody who lives around here. It feels so reassuring. Are you, I'm feeling that it's hard to find the time to change service delivery and then look at my financial picture and do business planning and I'm not really sure how much revenue dropped to plan for. Are nonprofits talking to you about that? Do you have any thoughts about how to think about the revenue side? I don't think any nonprofit has actually asked me how much loss they should plan on. I think, I actually think everybody is so busy just like you are trying to just do the work. We know there's less money, but we don't have time to count it. We'll get to that point, but right now we're just trying to manage and I'm kind of glad that people are putting service delivery ahead of financial management. Yeah, I think, I agree. And then I think about all the businesses, straight up businesses, like seven days who laid off folks. Yeah, I heard. Yeah, and then just businesses in general who are, we're filling in demand for service, but the business community has just been cut off at the knees for the demand for consumer services. Right, right. Well, I guess that's another angle of what makes Vermont different from other places. I think our businesses are smaller, our reserve funds are smaller, our assets are smaller, our communities are smaller. So, the concept of a rainy day fund or reserve fund or cash reserves, that's less common here than maybe in bigger places with bigger businesses. So that is part of the challenge of being in a small place where you know everybody. If you know everybody, then you don't know enough people to sustain a business. Yeah, do you think there's enough philanthropic capacity for us to weather this over the next few years? I think we will weather it. I think the philanthropic capacity is probably not great enough to keep everything exactly the way it was before. Unfortunately, I think some organizations won't make it and some organizations may reinvent them themselves in ways that cost more or cost less. I think we're just gonna see so much change in every sector that some of these things are unpredictable. The only thing we can predict is that it's gonna be different. Absolutely, absolutely. What are some good resources that you advise for nonprofits and change makers to be looking at during this time? Any resources you like a lot? You mean like information? Yeah, just how to manage in these perilous times. I think maybe talking to your peers and colleagues is more useful than going online to some major source. I mean, every day I get 100 emails from things like the Chronicle of Philanthropy and board source and network for good and all of these national firms, consulting firms with lots of advice. And in general, I find I get better advice if I call another organization in Vermont and just ask them, how are you managing with this? Do you have any good ideas? And people are willing to share their good ideas. It's not a, we're not hoarding our ideas.  Yeah, I know Common Good Vermont is actually doing a good job of organizing the resources. So I think Morgan's been on that. So that's a good statewide resource, but you're right. There is no substitute for talking to an ally in the same field or in the same job that you have about what they're doing. Depending on what your service area is, all of the statewide kind of umbrella organizations, the Vermont Community Foundation, the United Ways, the Meals on Wheels organizations, the Vermont Arts Council has a lot of information. So whoever your go-to organization would be really important. The VCRD, the Vermont Council on Rural Development has been accumulating tremendous amount of resources that you can get if you go to their website. So there's, sorry. So VCRD I think is really reaching out to communities which is what they do anyway but doing it for what we need right now. So when I say talk to your colleagues I'm thinking who's your umbrella and see what they're recommending. Do you have any closing comments, ideas, words of inspiration? Well, you know, it's hard to be encouraging and inspiring when I know how much trouble we have but I actually feel optimistic. I feel as though we're going to learn so much through this. I think that the majority of our organizations will survive this and will be strengthened and will learn new things about serving us all better. I think that philanthropists are gonna understand better than they ever did before, that this is a meaningful thing for them to do, to be supportive. And I'm hopeful that maybe we're gonna all learn a few lessons about being less consumerist and less superficial and taking care of the earth. I mean, there could be some really good learning out of this. So that's what I'm hopeful for but of course, first we have to all stay safe and wash our hands and stay home and I think really keep talking to everybody especially you know, people you know who don't have anybody to talk to. Yeah, that human connection abides no matter what's happening and where we are confined. Right, right, yeah. Christine Graham, thank you so much for spending time with us today. We really appreciate it. Thank you, it was really a pleasure to do it. Thanks. Thanks. All right, that was awesome.


you only have to do two things as a PA student. You have to get through school and you have to graduate from an ARC accredited PA program and you have to pass the pants, otherwise you can't practice as a physician assistant in the United States. So I thought it might be valuable to do some pants review. What is the Beck triad of cardiac tamponade? What are some characteristics of an anti-cholinergic overdose? Okay. Elijah, describe gamekeeper's thumb or ski pole thumb injury. Elijah, hello. Hey boys. So what is the purpose of getting through PA school? Like, what is the main thing you have to accomplish by becoming a PA student and by being a PA student? What's like the number one thing you have to do? Pass your classes. No. No. Pass the pants. Pass the pants. Pass your classes so you can take the pants. That's okay. Fine. Two things. So you have to go to school. Fine. Elijah totally just like corrected me. Which is totally true. So two things. You only have to do two things as a PA student. You have to get through school. So you have to pass and get your diploma in physician assistant study. You have to graduate from an ARC accredited PA program and you have to pass the pants, otherwise you can't practice as a physician assistant in the United States. So I thought it might be valuable to do some pants review. And what better way to do that than to pull out my stack of note cards that I personally used to study for the pants, which I passed on the first try. Where's the PA.com? Where's the PA.com? I have the book. Byte, it's good. I swear. Elijah, how big do you think the stack of note cards is? Oh, God, like huge, right? That is, that is a book. It's Lorge. That is a book. It's not smooth. I've never seen a physical set of flashcards in a long time. You must be old school. It's Lorge. I'm definitely going to need something like that. This is going to be the thumbnail. Do it again. Do it again. Okay. You look terrified. Yeah. So we could put this next to like Mount Rushmore or something. But yeah, so I don't know how many are in here. Definitely several hundreds. And this is basically condensing everything I didn't know like off the top of my head from the, from the rush review. Essentially all I used for pants prep was rush review and a few other resources, but that was mainly it, which Elijah will definitely want to know about in like two years when he's, but for those of you that might be taking the pants shortly in the fall because you're graduating, why don't we do three note cards? You know, we'll do three today. So good. I can't guarantee I'll know this yet. I'm barely a month in. I would be very surprised if you knew most of these or any of these because this took literally two years of learning plus review, but why not?  And for those of you taking the pants, this might be helpful. So what is the Beck triad of cardiac tamponade? Oh my gosh, I think I know this. Yeah. Am I allowed, am I allowed to see the multiple choice like or do you just want me to say like off the top of your head? What is the Beck triad of cardiac tamponade? Beck's triad. Is it JVD? And these are just symptoms, right? JVD hypotension and one more, one more. It's something about blood pressure. That's hypotension. Oh, hypotension. Yep. JVD hypotension. I'm missing the third one. It's always the third one. You know what? I promise you can figure it out because you already know the other two. Good job on that, by the way.  So what is cardiac tamponade? Cardiac tamponade is when I think that that sac around the heart is like the pericardial sac is filled, right? And then it causes, it doesn't allow like your heart to contract fully or something like that. Kind of. Yeah. So the pericardium, it surrounds the heart. And I'm doing spitballing this. I totally have not studied this, but in a while, but basically the pericardium, it's this very thick fibrous sac that surrounds the heart protects it. And it fills with blood for whatever reason. It's bleeding for some reason or something's leaking. Either way, it fills with blood and it puts pressure on the heart. So what does that do? It makes it so the heart cannot fully expand and contract. So you get hypotension, your blood pressure drops because the heart's not pumping as strongly as it should. You get JVD, which is a jugular venous distension because your venous system is backed up because the heart is not like, not only is it not able to pump, but it's also not able to clear blood coming into it. So you get a backup of venous blood. And what else would you possibly get if the heart sac is filled with blood and you're trying to auscultate? What might be different there? Would the heart sounds be louder or quieter? It'd be quieter, but full heart sounds? Boom.  Two weeks. He's been in PA school for two weeks and he already knows the first note card that I pulled out at random. That was not from PA school. That's from my PCE. Solid. Solid. Like I promise we didn't stage this.  Like everything I found out, like how to do like ED thoracotomies to like, yeah, to like Bex try out. Like I made sure, like I looked it up afterwards because I wanted to know. Out of this huge stack of note cards, someone who's been in PA school for two weeks knew the answer because of his clinical experience prior to PA school. So awesome. Awesome job. And just one more time, the Beck triad of cardiac tamponade, which is when the pericardium fills with blood, is hypotension, your blood pressure goes down, JVD, jugular venous distention, and muffled heart sounds. So the way that it might present on exam is patient comes in with two hours of chest pain after blunt force trauma to the chest and a motor vehicle accident. Heart rate is slightly elevated at 110. Rhythm is regular. However, provider notes muffled heart sounds on exam or difficulty hearing due to quiet heart sounds. Their blood pressure is 90 over 40. And what other finding might you find on physical exam? And it would be like multiple choice, dilated pupils, testicular, you know, hypertrophy, or like in JVD and you would choose JVD because you would know the Beck's triad of cardiac tamponade. Boom. Boom. Now I'm for sure going to get that one now. I'll remember that. Okay. Oh, this one's funny. Okay. Okay. What are some characteristics of an anticholinergic overdose? Oh, God, anticholinergic. What are some symptoms? Yeah, some findings, some symptoms, some physical findings, some, you know, physical exam findings, whatever, just some characteristics of anticholinergic overdose. I even forgot what anticholinergic means. So anticholinergic, like a straight up anticholinergic might be for like excess, like salivation or whatever. A lot of things have anticholinergic properties such as SSRIs, psych drugs, fricking overactive bladder drugs. A lot of things do have anticholinergic side effects. So I'm not sure if my pharmacology. Yeah, it is pharmacology. So I'm not sure professor made this up, but I thought it was funny. So anticholinergic overdose findings, hot as hell, blind as a bat, dry as a cactus, red as a cherry, mad as a hatter. Oh my gosh, I've heard that. I've heard that in the morning before. Probably in my ED wear work. Yeah. So you get dilated pupils, decreased bowel sounds, urine retention, sinus tachycardia, wide complex tachycardia or ventricular dysrhythmia. The person is hot. They have vision changes. They're very dry. They're not sweating. They get flush. They get red and they have psychiatric overtones. So I don't know, maybe they're a manic, maybe I don't know what mad as a hatter is, but they're just not acting right. And the treatment that's a side effect of SSRIs of anticholinergic. So I know SSRIs have anticholinergic properties, but I'm not going to go further than that just because I'm not certain right now. But anticholinergic overdose, hot as hell, blind as a bat, dry as a red as a cherry, mad as a hatter. And the treatment is benzos for agitation or seizures, lidocaine or amiodarone for dysrhythmias and magnesium for any torsades. I can't say it, torsades. Let's go with that. Oh, and by the way, here's the medications that cause this for anticholinergic overdose, atropine, antidepressants, antihistamines and antipsychotics. So psych drugs, atropine and antihistamines. Oh, wow. That is a lot of info. Yep. All on one little note card. Oh, man, that's something I'm going to need to remember. It's a pretty, it's a pretty common one as far as overdoses go because a lot of people are on antidepressants, antihistamines. So the situation might be like a 68 year old lady who has a history of chronic sinusitis, allergic rhinitis, sinusitis, whatever. And she's depressed and anxious. So she's on an antipsychotic. She's on an antidepressant. She's on an antihistamine. And she's taken all of them chronically. And she took them all without having a lot of water and is very dehydrated. And now she's got this, you know, slew of side effects. So, yeah. Last one, we have four minutes. All right. Okay. Elijah described Gamekeeper's thumb or Ski pole thumb injury. Can you repeat that? Gamekeeper's thumb or Ski pole thumb. It's a thumb injury. Gamekeeper's thumb. I've never heard that term before in my life. It's much simpler than it sounds. It's basically your thumb gets pulled that way. I know because it happened to me twice on both hands. And you tear this ligament, which of course I can't remember, but I bet you the back of the no card has it. So it's forced abduction, abduction of the thumb, which causes injury to the ulnar collateral ligament, the UCL, ulnar collateral ligament, forcible abduction. This is abduction. This is abduction. So forcible abduction to the thumb causing a tear in the ulnar collateral ligament, which is right here. Ulnar collateral ligament. Okay. And you get pain and swelling on the ulnar side of the MCP, metacarpofilangeal joint of the thumb is a thumb spica and or surgery depending on how bad it is. Thumb spica. I know that kind of cast or that kind of split. Yeah. It just kind of keeps your thumb like this. Yeah. So Gamekeeper's thumb or Ski pole thumb. Ski pole because like that's basically injuries are all named after like things that happen frequently.  Gamekeeper's thumb is, this is disgusting, but it's because gamekeepers like Hagrid and Harry Potter, what real people did was they took care of like the lands and the farm animals and stuff. And so what they did a lot, a lot of their job entailed ripping heads off chickens. Oh, a lot. So it would be like constantly putting that same stress on the thumb and they would have this in there. Gamekeeper's thumb or Ski pole thumb, whichever one applies to you more.  Or you could think ski pole thumb because like you're skiing. Yay. This is so fun. Ah, that hurts. Yeah. It's the tearing or injury to the ulnar collateral ligament due to forcible abduction of the thumb. Treatment is thumb spica and or surgery.


Nester do you feel like your confidence continues to increase as you get more opportunities up here at this level? Yeah, definitely. I think you know you're always gonna have the jitters when you come into the game obviously I don't think that ever goes away But yeah, you start feeling more confident when you start getting more outs and once you start getting into situations And you get out of them Imagine getting out of situations you had yourself in a tough one today How did you manage to settle in and get out of that one? Yeah, I mean I made a couple good pitches and got you know good hits off me I think it was the right decisions and to walk solar and And you know face to lefty and you know I attacked them You know I take the strike zone and and I was able to make a pitch and get out of it Do you feel like this is an outing that you can really build off of? Yeah, definitely You know come into a game. We were down. I knew I had to eat up innings because the bullpen was you know was a little Shot and you know, that's exactly what I did got some innings Got myself into a battle in the ninth, but I was able to get out of it If you hear that walk below the base in the night, what does Larry come out and tell you?