Okay, so we are really excited. So this is our second, this is our, well, we've been doing speeches in SE Village for like four years, but this is our second year as the official DEF contract for the human tracks. So it's really exciting. We've got some really great stuff planned for you. Our first speaker is Tomo Ishikawa. He's from Japan and I know Tomo personally because he actually came and took our course and it was really interesting to see the cultural difference in social engineering. That's the very topic of his speech is this cultural differences become a barrier for social engineering. Tomo has got over seven years of experience in penetration testing and IR and secure programming over in Japan. And he's currently studying for his PhD. So if you would join me in welcoming Tomo Ishikawa. Hi everyone. Thank you for coming today. My name is Tomo Ishikawa. I'd like to introduce that the cultural difference became a barrier for the social engineering. So first of all today, I'd like to talk about a little bit the culture stuff. Also at the same time, we'd like to talk about the social engineering stuff. First of all, let me introduce myself. As I said, Chris introduced me. I came from Japan and I'm also, as you know, the ESL guy. English as a second language. Also, I'm also studying in the PhD. Currently, I'm working for the insurance company now in the security team in the Philadelphia. I have a bunch of the certification now in the specialized area is penetration testing, instant response or boundary management. That's kind of the stuff. So let me first of all make sure what the situation is. The currently, the social engineering now is a remarkable attack vector now. For example, H.G. Galey, Hucked, or CIA director is also the Hucked. But if you think about the situation in Japan, I think I have a question that it's popular in Japan. Maybe true. It's simply because the spearfishing email attack is now popular in Japan. For example, Japanese pension system is hacked by the spearfishing email actually, but it's not so actively compared with the United States. So that is why my research question is, does the cultural difference became the barrier for the social engineering? If the culture works as the barrier, the cultural difference we'd like to say, I'd like to say cultural difference will be one of the solution. Also, the design of the, it's applied to the many ways. For example, the design of the organization, design of the corporate culture or design of the business process will be one of the effective way against the social engineering. So that is why I would like to discuss about it today. But additional note, the wide idea of the cultural difference is so important, simply because the CV is there. Have you ever heard of this idea? Anyone? Do you know about it? No? Okay. Basically, if you're familiar with it, it's fine, but if you're not familiar with the idea of a CV E0, please check the sound contents. Actually, it says that the human is vulnerable for the social engineering attack. It means that there is no particular day for the human being. So it means that there is a vulnerable for the social engineering. So that is why we say that it is a very important staff. So I'd like to start the discussion about it, but there is some sort of a disclaimer about that. First of all, I am not culture anthropologist, sociologist, this kind of a staff. Also, my opinion here, it's not my personal opinion. Also, it's not of my employer as a first of all. And also, we focus on the today about the difference between the United States and Japan, because actually I grew up in Japan and currently I work for the United States. So that is why today I focus on this issue. Also, maybe bias because I'm 20 years of experience in Japanese cultures, maybe professional about it, but only eight experience in the United States culture is a beginner or intermediate. So that is why maybe I'm biased. Also, it's not conclusion. Rather, we'd like to start the discussion about the cultural difference and the social engineering relationship. So I welcome the constructive criticism, also opinion, comment, any staff I welcome about it. Also, I do not want to discuss about the advantage or disadvantage staff of each culture. I would like to respect both cultures. First of all, I love the United States culture, but I don't want to discuss about the advantage or disadvantage, which is good or it is not. But we only discuss a defensive workability of the social engineering. Also, I welcome any question, any comment. I welcome that, but please, please speak slowly and simply because I'm not native speakers. Sometimes I cannot understand that. So please, simply. So let's start the discussion about first of all, what the culture or cultural differences is. Maybe one of the cultures shock for me is the size. If we came to here, everything is big, actually. I feel like kind of the Alice in Wonderland, everything is big. Cup is big. Food is big. Everything is big. That's one of the cultural difference. Actually, I go to the B-style Las Vegas. It's awesome, awesome contents. I actually got the T-shirt, a lot of that. Usually I wear the L-size T-shirt now in Japan, but here I wear this S-size now. It's maybe the cultural difference, but also maybe the cultural difference in the punctuality. If you look at here, in the Japanese country, actually in the country, if we delay the three minutes, they notified about it. If it was a 10-minute delay, the people, a train company, give a certificate about the delay. Maybe the punctuality is different. On the contrary, in Pennsylvania or Philadelphia, the bus delay every day, every minute. If it came the way, maybe the 20-minute delay, it's fine. Maybe one hour delay, it's usual sometimes. So there is a difference of the punctuality, maybe. Or some Pokemon Go index. Actually, when I go to the New York City Central Park, many people walking around watching the smartphone and see the Pokemon Go, it's the same as in Japan. Actually, maybe they're the same in the culture. But also, if you want to curious about the Japanese culture and the United States culture difference, I definitely recommend this YouTube. And this guy explains how the culture is different. It's a little bit over-exaggerated, but I love that one. If you're curious about the pre-check that the contents. But again, what the culture or culture difference is, let's ask the Wikipedia. The Wikipedia basically said there's a lot of the definition is available. But Wikipedia points out one definition, which is called by the E.B. Taylor. That complex whole which includes knowledge, belief, arts, morale, blah, blah, blah, something. But it means that everything created by human being. But anyway, we'd like to focus on some sort of custom and also habit in the business scene. We'd like to focus on this issue. Also, I'd like to a little bit introduce about some cultural difference study. A lot of the sociologists or a lot of the anthropologists have a research about the cultural differences. I don't want to mention all stuff, but I'd like to pick up one of the famous study, which is the whole cultural dimension theory. He had a comprehensive analysis for the IBM employee because IBM is a very giant company and also everywhere. So that is why also IBM shared IBM value. But still there is a difference between the IBM employee in Japan and IBM employee in the United States. So that is why Hoss paid the focus on the study about it. And they find out six dimensions, six dimensions to characterize the culture, actually. Actually, he had a lot of comprehensive analysis about the questionary. Also at the same time, they have a statistical analysis. Today I'd like to focus on the United States and Japan, but if you're curious about the data set, please access to the URL. You can see any data or any country data, if you like. But today I'd like to focus on some sort of data in the Hoss field between the United States and Japan. If you look at the here, there is a sixth dimension it's defined by Hoss field theory. Basically it says it sets a power distance index or individualism or masculinity or uncertainty avoidant index or long-term orientation or endurance versus restraint, for example. If the value is so different, it means that there is a lot of difference between the culture. If the value is same, it means that culturally it's close to find out. There is the data here and there is the Japan value of the United States value. If you see some sort of difference here, there is three main differences here. We'd like to be focused on this stuff. First of all, major difference here between the United States and Japan is the Japan country as a long-term oriented. On the contrary, United States is focused on short-time oriented. I think it is true. Actually one of the good culture for me in the United States, in the United States, the decision-making process is very, very quick compared with Japan. The reason why that situation happened is because the United States focused on the short-term benefit and then they decided. That is why I think the United States culture decision-making is very quick now. On the contrary, Japanese people consider a long-term effect. That is why if you decide something, consider of course the short-term but at the same time consider of the long-term impact. So that is why they have a lot of the consideration or a lot of the discussion here and then maybe the discussion is maybe delayed. Also another index about the differences is that Japanese people don't like the uncertainty. They hate uncertainty. So this is a wonderful reason why the Japanese people don't like the investment because there is an uncertainty here. But I think United States people accept the risk. I think it's a good culture. Japanese people don't like it. So if I say my boss, for example, if my boss said, can you do that? I will say yes when I'm sure, more than 90% sure. It's my culture. But maybe I think United States people say, yes, I can do that. Maybe sure 60% or 70%. I think it's a cultural differences. Also another difference is here. It's Japanese, United States people focus on individualism, which means that focus on the families or their own benefit. On the contrary, Japanese people of course consider the personal benefit but at the same time community benefit, for example. Many Japanese people are actually very alcoholic. They sometimes contribute a company, even though they sacrifice their personal life. Maybe that kind of a difference there. But anyway, that is a difference between Japan and Japan culture and the United States culture here. Now we have some big, great background here. And then we'd like to focus on some sort of short engineering stuff. But before that, if you do not know about the social engineering stuff, I definitely recommend the Christ class. It's very awesome. I am actually an ESL guy, but they are very informative for me. Also, there is a couple of the connections within the class, and I definitely recommend this class. If you want to curious about it, please check this website. Also today I will be discussing about the four stuff. First of all, Olsen, and second one, tailgating, also the bishing. We will talk a little bit about the Lebanon scan in Japan. A little bit there is a social engineering technique there. First of all, first we discuss about Olsen. So what does Olsen mean? I think you have an idea of what is the Olsen? Which stands for open source intelligence, and they collect the necessary information by using a public resource for social engineering. I think the cultural difference workability of Japanese culture is maybe good simply because Japanese preferred anonymity and the internet. It means that it's a little bit difficult to do the Olsen. If the user, if the Japanese, if the people use a false name or some sort of fake name, it is very hard to find out the data itself. Also, it's maybe, it is hard to connect the separated data into one. So that is why if the people use a false name, maybe a little bit difficult. So we don't have any evidence or any clue about it. So that is why we first of all start some sort of data analysis here. We first of all, today I'd like to use some sort of the data, which is MIC 2004 research. MIC stands for the Ministry of International Affairs and the Communications. The reason why I picked up the 2014 data is simply because there is a 6th country comparison about the usage of the social media or the usage of the internet. So that is why very informative data is in this here. So that is why I'd like to pick up this one. Sorry, I was going to be small for you guys, but first data from this report, it says whether or not people use the false name or are people prepared to use a real name. There is a bunch of the comparison here, but we focus on the Japan and the United States. If you look at the here, actually Blue Line is a used false name. Red Line is the kind of people who use the real name. So if you look at the here, for example, Facebook, more than 67% of the people use the real name is absolutely good because Facebook recommended about that. But on the contrary, in Japan, only 30% of people use the real name. Now that if you think about the Twitter data, actually in Japan, if you compare about the United States and Japan, actually more Japanese people prepare to use the false name, actually. Also, chat SNS, which is a Skype or WhatsApp, also use the false name. Also in the blog, it's the same situation as it happened. So it means that this data is very shown to you. Japanese people at culture prefer to use a false name, actually. On the contrary, the United States people prefer to use the real name from the data. Also MIC in 2004 research data show another example. As a conclusion, 66% of Japanese people have the antipathy against disclosing the real name. If you look at the here, Blue Line is a strong antipathy against disclosing the real name. And red is the moderate antipathy against the real name. If you look at the here, if you added the two birds here, 66% of the people have the strong antipathy against disclosing the real name. On the contrary, if you look at the United States people, 35% people only have the antipathy. It's a very unique culture in Japan, simply because if you look at the here, it's a total. A total means is the average of the six countries in these researches. There is Japan, United States, United Kingdom, France and South Korea and Singapore as included. If you look at the average here, actually in the average, maybe 38%, but if you compare with them, the Japanese people don't like to open the real name. So that is why a little bit Japanese culture, a little bit don't like to disclose the data and then it's mean that a little bit difficult for the authentic. Also, this data shown to you that approximately 60% of Japanese people and United States people feel the risk to be identified even though they use the real false name. So risk recognition is the same, but still there is some sort of differences. So that is why maybe the authentic, in terms of the authentic, a little bit hard to do it. Of course, even though you use the real name, it is possible to find some sort of data or link the data by using some sort of technique, but a little bit hard. Let's go to the next issue, which is the tailgating issue. So what the tailgating is, basically tailgating means that breaking the physical access control by using some pretexting. For example, pretend to be a FedEx guy or a pest control guy or pretending to be a freshman or a work from home guy or employee in a different location. I think also the culture difference is applicable in the Japanese culture simply because the Japanese culture is a detective environment. I'd like to show a couple of examples here, but basically office layout and the working style of the culture maybe will be the detective environment. So if you look at the here, if you look at the office layout here in the United States, it is a cubicle. Usually a cubicle is a very popular environment here, but on the contrary, if you look at Japan, there is a flat desk that we recognize what the colleague do it, what the colleague do it. We see every colleague. So this is kind of an office kind of environment. So the reason why does it work for the defense is simply because we easy to identify the stranger or attackers. Because this is a flat desk and we see what's going on in that environment, so we can easily identify the stranger or attacker compared with a cubicle, I think. Also, we can know the usual behavior or baseline of the colleagues or other vendors. So if the post office guy walking around in the office, it's not usual. It's maybe it's detectable. Also, if you look at the post office guy walking around in the office and if you see some sort of document, it's absolutely strange in this environment. So that is why I think that it will be this kind of environment or some sort of office design will be workable for the social engineering detection. As I would like to a little bit mention about the working style culture, but before that, a little bit look at what the working style difference between the United States and Japan. First of all, in the working style in the United States, work from home is I think very popular, but also on the contrary, Japan is not. Also in second perspective, employment mobility, I think United States is a high mobility in here. Many people joined the company frequently, many people leave the frequently, especially in the security field, since I think now there is a negative unemployment now, I think. So that is why I think there is a high mobility in the company. On the contrary, in Japan, Japanese companies do not, like the first of all, middle-carrier recruiting at the first level. Also instead, one company more than 10 years. It's this kind of a tense industry there. Also, if you look at the kind of the stuff about the new graduate job hunting, of course in the United States, people apply to the job, right? Actually if you see the job description and then examine the contents and then they apply it. But it's not usual in Japan. Actually, especially for the new graduate person, it's not job hunting. Well, it's not applied to the job, it's applied to the company actually. Actually the company usually don't open the job description, what new graduate cannot apply to that specific position, usually apply to the general position, that's all. So that is why not apply to the job, apply to the company actually. Also in the usually new graduate, graduate university, end of the March, and then they join the company in the April 1st, and then there are many people coming to the office. As I said, since in Japan we apply to the company, usually, of course, many varieties of people apply to the job. For example, I am working in the IT security consulting firm or IT consulting firm now, but I have a background of the computer science major. But at the same time, for example, if you see my colleagues, actually their background is economics or management, philosophy or English literature or linguistic guy, apply the IT consulting firm and it's my colleague. So that is why usually Japanese company doesn't care about what is wrong in the university, just apply the company. And then in the April 1st, they come to the office and we start having the kind of ceremony here. This is a very typical ceremony in Japan. In April 1st, company work on the ceremony. This data is the Toyota's one. This is all Japan Airways. It's a very famous airline company in Japan. But in April, we have kind of the ceremony. Philosophy guy have no idea of the computer science is or what the algorithm is or what the bubble sort is. No idea. So that is why Japanese company basically creates two months, three months, four months training, like the kind of the boot camp. We learn a lot of the stuff. We have a lot of the project work after joining the company. We have a lot of the boot camp there. Actually, in Japan, there is many procedures. For example, in order to exchange the business card, we have some sort of procedure. If you like, if you take the phone call, we also have some sort of procedure. We learn our G-stuff. And then in my company case, we learn many, every freshman learn about what the programming is, what the security is, what the network is. This kind of the boot camp will be done within the two months, three months, four months. Of course, it depends on the company. And then company assigned to the division. Basically, people or freshmen cannot choose a specific job. Of course, it is possible to say, I want to go to this division. I want to go to this division. It's possible, but company finally decide which division they go. So that is why. So. And then it's very famous there. In Japanese company, and there is a job rotation system that is very popular here. I think you are not familiar with about this one. And basically, for example, my career is a penetration testing. Seven years experience is very lucky guy because I want to do the penetration testing in my job. But usually, if we get some certain experiences, usually company offer me to move another division to expand some of the experiences or expand some of the knowledge. Maybe next year or next year, company may be offered to move to another division. For example, development in the security products or security operation team. Maybe, I don't know, but there is a job existing system there. So why I am talking about that one is I don't want to discuss about that kind of culture difference. Maybe you think it's good. Maybe you think it's bad. But I think this kind of the culture is create a stronger informal connection between the colleagues. What they mean is people join at the same time, more than 300 people join the company at the same time and then we have a boot camp in the two months, three months, four months. And then we do a lot of the project works, a lot of the communication. And then people don't have, people usually stay in more than 10 years. So that is why this kind of Japanese culture has created some informal connection between the colleagues. I think it's one of the cultures here. So why does it work as a difference? Because if you come to new guys or strangers, it is very easy to identify it. Usually it is very easy to identify it. Also informal connection will work as a validation method. If the stranger is walking around in the office, maybe if you say, hey, what's going on? What are you doing? Maybe we can ask the question, when did you join the company? Maybe social engineer said in 2009. So it means that we can maybe ask the colleague who joined the 2009. And then do you know this guy? Maybe it's possible to identify this guy. So that is why I think it's worked for the cultural difference. Let's go to the next issue, which is the phishing. The phishing is the kind of phishing attack by using the phone call. For example, pretend to be a computer support guy or pretend to be in the walk from home or under the branches. Actually, currently I'm working for the insurance company now. We have some sort of an incident, like the computer support guy. Actually, the target is the women. She is the under-lighter and she works from the home usually. And then she got a phone call from some computer support guy calling to him. Actually, since she is under-lighter and she got a phone call, the computer is infected by the malware and under-lighting information is now bleached. The reason why the social engineer understands that she is under-lighter is because LinkedIn tells about that. Then she's very upset, of course, because the malware is infected and also the under-lighting information is leaked now. The desktop support guy said, please install Microsoft Defender in order to stop the leakage. Of course, she's very upset and also she has only joined to the three months before. So, that is why she installed the product. But it's not free version. It's the professional version. She has to pay for it. But the desktop guy said, usually company provides the license but since it's the emergency, please enter your credit card and apply the expense later. And then she actually do it. And then after that, she is very comfortable and then she gives the expense application to her manager. Actually, we can stop. That manager is very clever. I see that it is a kind of a social engineer attack. They report me and we stop about it. But that kind of situation is currently happening. Bishing is very popular in the center now. So, in terms of the cultural defense workability in the Japanese culture, I think a little bit works from the work style and decision making process. So, let me look at one by one. They are working style. As I said before, the work from home is not popular in Japan in terms of that it's a little bit difficult to make the pretexting. Also, outsourcing is not popular also in Japan. Also, employees have a strong relationship and an informal connection. Why does it work as a defense? First of all, a little bit pretexting and a little bit hard. Also, if the phone call is suspicious, it is possible to ask the question by using informal network. Actually, in Japanese companies, sometimes it works simply because someone got a phone call and then if you look at suspicious, just texting, I got some sort of suspicious phone call. Is it an authorized one or is it a phishing one? Is it possible to do that? So, that is why informal connection maybe works as a validation function about it. Also, Japan has a very unique phone call handling. I have a quick question for you guys and when your colleague gets a phone call but your colleague is not your cubicle, do you take his or her phone? Usually, no, right? Usually, ignore it. It's his business, not mine, right? Usually, ignore it. But in Japan, not sure. Usually, people have to take out if the colleague is not there. If you recognize a body, Japanese people have to take it and then listen to how can I help you and what the issue is. If possible to handle it, I have to handle it. If we cannot handle it, it's not out of my business. It's maybe just asking the question about what the issue is, who he is or who she is and also company name and then make a memo and leave the memo for the colleague. That kind of Japanese phone call handling culture there. Also, in Japan, freshmen with a new graduate or other ministry staff take the phone within the street ringing is a usual rule. Usually, if you go to the freshmen, the first task is taking the phone call within the street ringing. It's serious. Actually, it's a freshman task in Japan. So that is why I was a freshman. Since I don't want to take your phone call, I'm a little bit nervous. I'm a little bit nervous to talk about the phone call. Actually, my boss has always... What are you doing? Take your phone. People actually say that. But actually, in Japanese culture, freshmen or other ministry staff take your phone call and then, of course, the freshman has no idea to handle the issue. So usually, take your phone call, make sure what the issue is, who he is or who she is and then transfer the call to the particular person. For example, it's a ministry call to my company and then if I'm with a freshman, I do a phone call and how can I help you? I ask the question and then if Mission wanted to talk about some specific issue, for example, Chris, I just recognize about it and then we say, Chris, there's a phone call from Mission about some sort of project. We say about it and then we transfer the phone call to the Chris. It's a usual process in Japan. Why does he work at the difference? It's simply, first of all, it's not intentionally, but we share the content of the phone call contents by just in the process. It's maybe we say, we share the contents through this process. Maybe practice is very helpful. We can say, if just loud, just shout out this one. Maybe intentionally, we shared some sort of contents about this one. Also, since freshmen or administrative staff take the phone call, by doing that, these guys can create some sort of baseline. For example, Tomo gets a phone, usually financial sector or insurance company call to the Tomo or government agency call to some sort of Chris. Maybe since Tomo is very lazy, accounting division call every time, the kind of the baseline will be created by this process. Maybe it's workable because if the suspicious phone call is coming, she or he, freshman guys can recognize that kind of a staff. So that is why, in terms of creating a baseline, it's maybe workable. Also, in terms of business email compromise issue, actually the decision-making process will be helpful to stop the social engine staff. I think in the United States, if the boss say yes, it's done, right? But in Japan, Japan prefer to create some sort of consensus. We sometimes talk about the other guy or many division. A little bit, sometimes I don't want to do that, but it's kind of a Japanese culture. Why that is so helpful in terms of the social engine staff is simply, since in the Japanese culture, if we do some sort of settlement, we have to talk about a lot of the people. For example, in my case, if we approve of something, first of all, I talk with a leader, and then I talk to the manager, and then sometimes we talk about some sort of accounting division, maybe. So we have to share that kind of idea in the various stakeholders.  So that is why we say it will be helpful. Lastly, a little bit talked about a limited scam issue. I give a couple of examples of Japanese business cultures and the workability against the social engineer. It's maybe, maybe you have the objection, it's fine, but however, but just, I think a little bit Japanese culture maybe helpful stop the social engineering or detection. However, it does not necessarily mean that Japanese culture and the people are torrent for the social engineering. Actually, a scam for the everyday people are very serious problem in Japan actually now. We see a lot, a bunch of the social engineering technique now. We have to share some sort of scenario in the Japan scam. Actually, it is one of the example. Actually it's the real one is a more complicated but a little bit simple quite about it. If you try to the target everyday people here, the recent technique is like this. First of all, attack is there. It's pretend as a police officer A. She give the phone call to victims. Recently, we arrested a scam to loops. They have the list of the future attacks and the name list include your name. They also committed the cloning of the credit card and your credit card had the possibility of abusing. We invested in this case with the FSA Financial Service Agency and the FSA staff will contact you just calling, just calling that. This is the first step. And then maybe a couple of hours later or next day, FSA guy called these victims. She said she got the phone. I think you got the phone call from the police officer A. We investigate the malicious usage of your credit card. Please tell me last four-digit and experienced expired date of your credit card. Also, in that time, she strongly said, don't tell about the whole credit card number because it's very important information. Don't mention about that. Just mention about the last four-digit. Kind of the care about the security. So that is why it is kind of the... It looks like a very good guy. And then please tell me about the last four-digit expired code. We will match with our database whether or not it is abused for now. Then maybe some type typing noises or some sort of take your time. And then FSA guy said it is abused. So we started some sort of process to the issue, the new card and FSA staff go to your home and pick up it. People say that. Social engineers say that. Maybe it's a very strange process, of course. FSA doesn't care about the card for the ease, but for elder people, they're very upset. Maybe they're accepted. Maybe some clever elderly people say, why do you take about my credit card? In that time, FSA guy said, usually it is taken by the card company. But since it is a criminal case, first of all, we make... FSA makes sure about the credit card. The FSA guy said that. People believe that, actually. In that term, we have some sort of the technique about authority. Maybe you are familiar with Robert Chaudhigny. He's an awesome guy. He's a psychological guy, a psychological professor. They actually define the sixth principle to persuade the people. If you're very curious about that, please check the book called Influence, I think, in English. He said about that authority is a wonderful way to persuade the person. Actually, this guy said the police are treating the police officer, or FSA staff, and they try to persuade it. And the final step, the FSA guy, some FSA guy go to the home and pick up the credit card. It looks like a very professional guy is coming to the very gentle guy is coming and pick up the credit card and then it's done. This kind of discovery recently happened in now. Actually, we call it a it is called limited scam, but recently scam scam is logged by a bank or some sort of some sort of the bank or some sort of the agency. So that is what recently scam try to pick up the money or pick the credit card on the they go to the office and pick up the card or pick up the money actually. Actually, one of the bad stuff in Japan that we don't have any check system, the usually if there is a check system people can stop it. It is possible to stop it, but in Japan, we don't have any check. So that is what if you want to give the money, usually cash. So that is what if the L.A. people it's if the L.A. people have some try to give them the money, the usually it's cash. It is it is impossible to stop it in Japan situation. So that is what even the Japanese culture I never say Japanese card is very strong for the social engineering. It still needs kind of a problem there. So, I would like to quickly wrap up my presentation. My question is that a cultural difference became a barrier for the social engineering. I think it's yes, but maybe you have the objection is fine if you have any comments please, I work on about it. But I think the beginning of my thought maybe I misunderstood my United States culture is maybe but I'd like to start some sort of further discussion about it. Also from the attacker's perspective, adjustment of the protecting to specific culture is very important. For example, if you want to if you plan to start a business with Japan, with Japan, don't slow away your business card. Usually, in Japanese culture, when we exchange business card, usually very don't slow away that kind of thing. Actually, my manager is very United, of course, it's United citizen. When I first meet, hey, it's my business card. Like, kind of a staff. But it's not popular in the Japanese culture. I kind of try to exchange some sort of procedure there. Maybe the adjustment or practicing in the specific culture is very important from the attacker's perspective. Also, I think if the culture difference is worth, the design constellation of the culture or business process will be helpful to stop or detect or avoid social engineering. I think that kind of the design is absolutely important for that kind of staff. Thank you for my presentation. It's the end of my presentation. If you have any questions, please feel free to contact me. There's a contact information there. If you have any question, any objection, any comment, question, please let me know about it. Thank you for the listening. Sorry, you guys, please speak slowly and simply. I can talk with the elementary guys. Cool. Great presentation. I have a change happening in the Japanese culture as the world becomes more globalized. For example, if you look at the U.S. 50 years ago, people expected to stay at the same company for their entire life. Yes, I think absolutely I agree with your opinion. Actually, for example, the SNL cases now Facebook dominates and they don't use the real name. That is why I think the culture is different day by day. Of course, a lot of people import a lot of culture from the United States or other countries. That is why culture is slightly different. Maybe 10 years later, maybe you are definitely true that. Thank you Thank you So, based on a social engineering concept among foreigners, they called it Gaijin Smash. You have some problems with Japanese government or Japanese police or something like that. You just pretend, I don't understand Japanese language, I don't understand Japanese culture if you're a foreigner living in America, you just ignore the police, walk right through, that goes very badly. So I was wondering if this could be sort of a flip side, you have cultural defense, maybe also cultural vulnerability, especially cross-cultural.  I absolutely agree that. Maybe culture will be vulnerable for that kind of stuff. Yes, Gajin Smash is absolutely workable in Japan. Japanese people is very kind to the United States people or Fondant people, unfortunately. Even if they ask a question, maybe ignore it, but if the Fondant go there, they give a lot of questions, a lot of information, Gajin Smash is absolutely workable. I definitely agree about that, definitely agree. But actually, yes, absolutely true that, yes. Gajin Smash will be vulnerable, but also maybe it sometimes works, sometimes it doesn't work. When they take the course of the course, in the course course, we have a lot of the homework. We go to the bar, we go to the bookstore, we have something, doing some social engineering stuff. In that time, sometimes my guidance states, it's workable to put out information, sometimes people are scared to be about it. Yes, it absolutely works, it sometimes works, sometimes vulnerable, yes, thank you. I was, thank you very much for your talk. I wanted to ask, do you have any empirical data where you've experimented with this in a Japanese setting or is this more of a hypothesis? Because I think that there are a lot of scenarios where we think that we have a defense against social engineering and we really don't. I think that probably a lot of the people in this room think I'm really good in defending against social engineering and in fact that's not the case in a lot of scenarios. So have you done any experiments with this? I actually only for only a few experiments about it. Actually, I'm a little bit of a hypothesis now, but a little bit only a few cases I know about about the social engineering stuff now. I'm a little bit much more hypothesis, but in terms of the, how can you say? And in terms of the feeling about it is not my case or it is not, maybe I am not become the social engineer target, but for example, that kind of a scam is very popular now as the many people are get the attack by the scam. Maybe in terms of, if you analyze that kind of the case, maybe much more improve my theory or improve my hypothesis, maybe, yeah. But I would be hypothesis level, yeah. Thank you.


Meanwhile, as part of efforts to bring a drastic check on financial laundering offenders, the EFCC is said to partner with the media like never before. At a media workshop, the representative of the active EFCC chairman insists it has become necessary for the public to be aware of the crime so as not to be victims. Plus, TV News correspondent Destiny Momo reports that the commission deems it fit to train the media on financial crime reputage in order to fight the crime to the barest minimum as the commission is shifting focus from enforcement to crime prevention. The commission to sponsor this workshop underscores the importance which it attaches to the role of the media in the fight against economic and financial crimes including corruption. Without doubt, the media's ability to inform and sensitize the people on the use of corruption and economic crimes is crucial to us. All over the world, the watchdog role of the media promotes transparent and accountable leadership. In the particular instance of the EFCC, the media has proven to be a critical stakeholder and ally in the difficult task of synthesizing our environment. This partnership is functional and rewarding. We can only wish that the senator get stronger and stronger. The focus of the EFCC correctly is shifting the will from enforcement to prevention and preventing financial and economic crime including that the media represents a very critical ally and that is why we are here today to share knowledge and see how the media can help us in preventing special economic organ. I will be surprised or I will not be surprised at who some of us here do not, people who have been aware of the activities of school. All the non-barrel, as they say, non-barrel socials have important obligations to that and it almost is not a loss at your notice to inform the people that people can be aware of the duty of these parties. Speakers at the watchdog gave an expose on financial crimes, investigative reporting and cybercrime. They informed that transactions from five million Naira Enable should be reported to the commission. The law requires that within seven days of bringing any transaction, completion of any transaction with anybody that falls between these categories. That is to say maybe the transaction that come with the commission is over five million. Yes. It's over 10 million. You are required to report it to Naira Enable. That's why you need to get the particulars of those people who present to their name, their address, possibly to their phone number, so that you feel it is wrong and you send it to Naira, to Naira, to their head. Because when you send it to us, our school department will be analysing it and begin to follow up on that specific.  Another thing that I have been alarmed was that the court is expecting journalists to update them about. In the labor's environment, we just said it when our Zuna commander talked about the investment scam running to more than three billion Naira in the labor's environment. Now, if so-called investment scam that is taking the money of everybody, why is it that we are not taking time to investigate some of this investment? Now, we talk about wonderbanks, we talk about wonder investment, we talk about people that would just come to the public podium and send two weeks to the public. And people will invest it, they will invest it, they will invest it, only for them to find out that they have been sold a lot. And there are journalists in town. And there are media professionals in town. Some of them are even investing in the same scam. So, why do you look at this thing? You find out that we are not operating in the very, very, we are not operating in the same times. We are not going into the core. We are not going into the nitty-gritty of the profession. It's never a crime and how much we have been taken. It's never a crime against, like I would like to say something that regards what the previous speakers had said. They keep talking about money laundering, money laundering. And my previous book had said something about real estate. Where do they get the money from? Somebody will just come up overnight and just say, oh, I'm into real estate. People will come and say, I have a car stand, I need to come up, I sell my three brands. We need to see that the money coming from. You'll be surprised to know that most of the money is made from net from cybercrack. The purity of the money that is being used in these businesses are made from net from cybercrack. So that's why it's very, very important for business owners to register with school and also report suspicious transactions. Fresh news updates.


Okay so here we are at the front of Ashford cattle market.  So we're out here, set up a table, we're going to see if the bidders think the same way. Wait what does it say? It says live auctions are the slave trade proved me wrong. Do you think you're going to get something good with that? We'll get some conversations for sure. Just something I haven't ever done before in a live auction so I don't know what to expect but I'd like to see what argument they could come up with to defend that statement. They could say animals can't be kept classed as slaves. I would just say why because humans can be enslaved because we're sentient and you know we desire freedom but animals desire those same things. It's all right yeah. How's that look? Funny. Does it look like an M? It does look like an M yeah. Okay yeah we don't want to park at the back in that man. Park around away from the front here. Park at the back over there near the trucks over there dude. Turn right into these parks on your right there.  This is getting ridiculous let's just drive up there yeah this is getting ridiculous we're getting a little drive up there dude yeah drive up there okay it's not much of an open day though yeah that's fine man thank you very much all right we'll talk see you man good luck yeah so they're selling pigs and lambs and um carves oh sort of standing up there yeah only people with cattle um trailers are here probably about 500 of horse a thousand animals and they're just all different types probably not that many though just looks like it under that big shed i think they're going to be able to see that right yeah and once it's up and running i'll stop stressing you think they're the slave trade too yeah interesting do you reckon you uh seen the sign but we might be here for a few days do we get kicked out we changed in the car we changed my uh vegan tattoo to megan or megan but till the megan's out there i was just trying to be undercover that's it just so people didn't know in there that i was a vegan the little carves are so terrified in there man their infant carves being bitted off like horrific there's no other word to describe it than slavery it's an injustice to call it anything less no they're terrified they don't have any choice they don't know what life of freedom is supposed to feel like so imagine having a bunch of aliens around you different species bidding on you and taking you away from your parents and bidding you off separating you i think he read that sign loud and clear she agrees and that's two agrees out of you know two of the people that have walked past it's so obvious when you point it out you know that one statement just points it out so easily i don't know like i'm hoping someone can try to sit here and argue it i don't know where that would start the older guy looks over like he had to double look he's just so indoctrinated in condition to this like they don't see what we see dropping her animal off to be slaughtered dropping her animal off to be sold and slaughtered she just wipes hands clean there we go done got a couple a hundred pound for it a little calf in the back there i wonder how much you paid for that little calf i wonder how much that life is worth to humans 50 quid 20 bucks you hear those cows bellowing out terrified gonna get sunburned but it's worth it here he's walking look how many slaves he's got in the back yeah here we go here we go is this this is public land isn't it where does the public land begin let's just shuffle right there look at that truck look at them terrified i don't have a chat mate you agree you don't want to get involved they work with the council here so they wouldn't want to publicly agree this is just farming this is general farming practices like i was a little bit stressed out setting this table up before just hoping that it all went right and and then i realized that we're not actually doing anything wrong here them in there are doing something wrong so why should we feel uncomfortable about pointing that out you know i should be more relaxed about this because you know what's going on in there is wrong this sign is just objectively true holy shit oh my god even if um no one comes and talks to us because i guess that had to be quite confident to come and sit down right here i guess the sign is doing a lot of activism in in and of itself isn't it but i believe in all forms of activism generally but i just feel like having this style and then having a conversation with someone about it is it for me the better way a lot of people have never been to a a live auction you said yeah when i first went it was full on yeah seeing the terrified animals being bid on like that and no one blinks an eye in there like no one sees it as wrong like but general public definitely would see something wrong with it but conditioned farmers not at all just business another day of business we're going to find a nice busy spot at the market we might run into some farmers anyway you know all right so what we're doing doesn't look like people are going to come out and talk to us here pretty understandable don't know how that could defend that anyway but we're going to take this out to somewhere more public like a market and see if we can get in a conversation let's do it megan the vegan megan the vegan there's a load of foot traffic here definitely going to get some conversations rolling around here this is just normal joey carp strong stuff all right really yeah check check check all good all right we're rolling what's your name bro eliot mate eliot good to me eliot hey boy how you doing it went really well um i thought like that conversation was one of the longest i've ever had no one really uh proved me wrong there i mean the sign said proved me wrong i don't think anyone proved me wrong no one gave me a valid argument as to why animals can't be considered slaves yes sir that was epic activism man amazing what you can do with a poster and a table it's a bit amazing and some logic we're so fat right now all right so because our filming went so well today we thought we'd treat ourselves and i've got a temple of satan burgers what's this oh popcorn satan that looks good oh a little dessert but a little um tart here i'm gonna place this because i want us to share the burgers


Tom here for more systems. We're going to talk about using custom DNS settings with PFSense and making sure that you have TLS enabled with those custom DNS settings. Now the reason for doing this, the use case for doing this, is because you want your PFSense to send traffic not over port 53 but over an encrypted port or TLS DNS. So transports in between can't see it as in your ISP. So you don't want your ISP to be able to look at port 53, which is the default for DNS traffic, which passes over UDP and clear text. Now, this gives you added privacy from the ISP. They still are going to be able to see whichever IP addresses you're going to, but losing that information about what DNS queries went over there gives them a little bit less insight into your particular data streams. And maybe that's a concern. This is not a replacement, but it is a further somewhat of a mitigation for the amount of data that they can get. Obviously, if you did something like a whole home VPN because you wanted to pay another company, so you can hide your data from the ISP, which you can tell by my inflection of voice, maybe I'm not the biggest fan of. There's use cases for it, but everyone seems to think they need one. And because they're easy to sell, every YouTuber seems to have an offer code. But by the way, if you do insist on it, I do have an offer code down below. I'm just not paid by them. I'm paid if you click on the link to PIA. If you want to do a whole home VPN, I have a video on that as well. If that's what keeps you happy. But then again, you can encrypt your DNS over that as well. If that's what also makes you happy. But before we go any further, let's get into the details. And first, if you'd like to learn more about me or my company, head over to LawrenceSystems.com. If you'd like to hire short projectors, a hires button right at the top. If you want to support this channel in other ways, there's affiliate links down below to get you deals and discounts on products and services we talk about on this channel, including a link to our Patreon if you'd like to become a Patreon supporter. We also have a swag store where you can get shirts and other items that are for sale and that changes from time to time, what's available and what's not. So go ahead and check that out frequently. And finally, our forums. If you'd like to have a more in-depth discussion about this video, suggestions for new videos or just reach out and say hi and talk tech. Our forums are a great place for that. All right, now back to the content. And the first thing I want to start with is set up DNS over TLS on PF Sense 244 and the long discussion underneath that ensues. I'm just going to cover the basics, but I want to leave this with you so you can see lots of discussion by the devs over at PF Sense, lots of back and forth and banter about different scenarios and things like that. It goes out of scope to cover every potential thing that needs to be set in here, but you can kind of get the idea from this forum post and maybe read further into why some things are like they are. I'm not going to read it to you, you can just read it, but it would make the video a lot longer if I went and dove into that. Love them or hate them. There seems to be lots of opinions. I like Cloudflare. You may not like Cloudflare. I'm choosing them as the option because they have a nice system for their new Cloudflare for families, they call it. And it's their 1112 and 1002 options. Now, these are the ones that fight malware. If you also want to block content, it's 1003 and 1113 for primary and secondary DNS. By the way, this is for setting up PF Sense in terms of all DNS and PF Sense, not for individual systems. I've commented before, you could always do like a DHCP reservation and have certain computers. You want to block certain things on and push those settings. And as long as you don't have someone using that particular host that's clever enough to override DNS settings, well, it works. It will filter the extra things, but not to get too far off topic. Now, what we're going to go over here is start with the manual and talk about what we got to do. So this is right from the PF Sense documentation and unbound is the default since version 2.2 of PF Sense default DNS resolver. And we want to enable forwarding mode. And what forwarding mode does is we're going to go over here. Forwarding mode means don't just pull from root servers, which is the default action. Take the DNS servers that are set here and pull from these. So we've got 112 and 1002. These are the ones that fight malware and have some extra entries to essentially sinkhole that information. Then we're going to go over here. DNS resolver enabled by default.  That's part of the discussion of as to why you don't need the DNS support here. Enable forwarding mode. Use SSL TLS for outgoing DNS servers queries. Now, what this is going to do is push things out over SSL TLS port 853 to be encrypted. Pretty simple. Other note, down here, PF Blocker. A lot of you run it. I run it too. You want to not change this into custom options. Now, when I covered DNS over TLS in 2018 in April, you had to put those custom options here. Now, what's really simple is to do this here, you know, version changes. They've made it a little bit more streamlined. But don't mess with those custom options down here if this is what you have for PF Blocker. Now, PF Blocker is still going to sync all DNS. So first, the servers from Cloudflare are going to have their own sync holes for malware in them. And then on top of that, after that parsing is done, we also have the parsing we're going to get from the DNS cell blacklist from PF Blocker. So what does that look like in action? Well, first thing we want to start with is this is already enabled obviously. So we can go over here. And we said this is PF Top. I've covered this before and like how to filter out connections with PF Top. Let's look at what connections I have to Cloudflare servers. So I say host 111.2 or host 1002. And what this does is say, look at all the connections and filter for this specific two hosts. Now, we can see, and I've got my public IP address blurred out, but you can see all these connections to a combination of 112 and 1002 going to 853. All the traffic has been encrypted and ported over that port. So it's kind of a verification that it's working, which of course is important. We want to make sure that it works and this is a simple way to do this. Now, I know if I were to filter for port 53, there are still some things going out port 53 on my network. And the reason why is because I do not have a firewall rule that forces the use of PF Sense as my DNS server. You can do this. It goes out of scope of the project, but you can force any traffic coming through on any interface that tries to go out port 53 to be redirected and go out of PF Sense, the good and bad. If you do that, you may find some IoT devices or some things you're testing break. Also, we frequently do queries to different servers when we're testing things and I don't want those queries being redirected because sometimes we have to see how DNS responds at different clients when we're doing moves or MX records. I need to see a series of different queries to see where things have been propagated. So we don't take the time to actually block them internally for us, but if for some reason you're worried about other devices on your network, DNS callouts, you can put rules into block that. Maybe I'll do a separate video on that topic and talk about redirecting type things, but out of scope for that, just something to keep of note when you're looking at connections and queries. And as I said before, I chose Cloudflare who does support DNS over TLS. You could have also chose someone like Quad9 or Google. Pick the company that you want to use. There's probably a handful out there. I have no exhaustive list of them. Last thing I want to show is what does it look like with PF Blocker running and how does those queries look? Well, let's go real quick. So we're going to go over here to PF Blocker and it's all set up configured. I went through videos on this too and this is the ones we're using. So we get the malicious and the easy list set up and we're going to go here and edit this list. And then once we edit it, we have this one here. I'm just grabbing one out of the middle. So mailwaredomainlist.com. Host list slash host.txt. So we're going to go ahead and copy that and we're going to go over here and just W get and drop that in. So let's grab that file. All right. Cat. Host. There. And now let's do a quick dig on any of these. So we'll grab this one. It looks like a really ugly domain. Whoops. We go dig. And it's sinkhole to <IP_ADDRESS>, which is what I have the sinkhole set up to be. Now, what does it look like from the web interface right here? So it says unknown. It shows my IP address and says, yep, you're trying to get to this particular server. Now, of note. And I'm not going to go too deep into this, but I know more people have been asking and I've done videos about this where we talk about DOH. So DNS over HTTPS. Now that's a great service and it's becoming more and more popular. It's being embedded in more browsers, Firefox, most notably leading that. Now, if you're using that, it bypasses the DNS of PF Sense. And it's tricky to block because unless you know, because it's going over standard port 443, the DNS queries are, unless you know where those DNS queries are going, it can be a little bit tricky to block. So for those of you wondering about that, but I've had people who say PF Blocker doesn't work or they're not using a DNS or having a DNS problem with PF Sense. And we're finding some people because DOH is popular and they're stringing it on a Firefox. You're now bypassing using your local PF Sense system for your DNS. Therefore, it will not work in that scenario. So I just want to bring it up in case you're trying to test this inside of Firefox. Yeah, if you go around PF Sense as DNS, all these steps we just put in place completely are moot point because you're not using them for DNS. Secondary, if you're running a Windows network and a domain network specifically, you want to look at having Windows point at PF Sense, not the Windows workstations, but maybe the main Windows server to pull this to add the extra filtering because ideally each host on a Windows domain network should have the Windows server be the primary DNS. If you want Active Directory not to have a bunch of headaches and problems. Yes, I know there's probably someone going to mash the keyboard and tell me all the workarounds they did. But the default answer is if I have a Windows domain server, Server 2019 for example, and I have Active Directory configured and each one of those local workstations should be using the DNS of that server. Now you can then further take that server and redirect it over to PF Sense and then provide all the filtering to it as opposed to letting it choose some other upstream DNS provider. Not a scope of this talk, but that question seems to come up anytime I talk about DNS because people want to implement this in their office, but their default DNS is the Windows server. And obviously that is something that comes up. And that's how you work around that right there is just well, if that's what the DNS server is Windows or some other box for whatever reasons, then that box can upstream to the PF Sense and still benefit from all the other features that we talked about here. So if you have any questions, comments, concerns, leave them below or head over to the forums and thanks. And thank you for making it to the end of the video. If you like this video, please give it a thumbs up. If you'd like to see more content from the channel, hit the subscribe button and hit the bell icon. If you'd like YouTube to notify you when new videos come out. If you'd like to hire us, head over to laurancesystems.com, fill out our contact page and let us know what we can help you with and what projects you'd like us to work together on. If you want to carry on the discussion, head over to forums.laurancesystems.com where we can carry on the discussion about this video, other videos, or other tech topics in general. Even suggestions for new videos, they're accepted right there on our forums, which are free. Also, if you'd like to help the channel in other ways, head over to our affiliate page. We have a lot of great tech offers for you. And once again, thanks for watching and see you next time.


Welcome back we are now going to look at the equation of state of an ideal gas. The phrase equation of state will occur so often in thermodynamics that we will frequently use the short form EOS for it. We have defined the Kelvin scale of temperature as T by T at the triple point of water Pv divided by Pv at the triple point. Now for this scheme to work as a ideal gas Kelvin thermometer we have to use an ideal gas as a working fluid. Now let us say that we are looking at this behavior as specified by the ideal gas and that itself gives us the equation of state of an ideal gas. Let me put Pv on the left hand side and push everything on the right hand side and you will get this simple relation where all terms containing Tp as the subscript I have combined together. Actually this is the basic equation of state of an ideal gas. Now you will notice that there is one parameter here and P and T are intensive properties but the volume is an extensive property. So this parameter will depend on the mass of the system or the actual volume of the system. So what we do is we write this in terms of specific mass, mass per unit volume. So we write this as m into Pv by T at the triple point of water of that ideal gas multiplied by T. Now this term which is the ratio of the product of Pv to T at the triple point of water of that ideal gas which we are looking at is given the symbol R and this R is known as the gas constant for that particular gas. If we approximate oxygen as an ideal gas we will have one value of the gas constant that could be the gas constant for oxygen. If we use nitrogen and consider it to be an ideal gas we will have a different gas constant for nitrogen. Similarly any gas when approximated as an ideal gas will have a value of R which is specific to that gas. So we should remember that the equation of state of an ideal gas can be written down either as Pv equals mRT or if we divide throughout by m then on the left hand side we will get V by m and that can be written as the specific volume. So you will end up with Pv equals RT where R is the gas constant for that particular gas and let us look at the units of R. Notice that units of R will be units of ratio of product of pressure and specific volume to temperature. Since Pv the product has units of work done say joule T will have to have units of Kelvin ideal gas temperature so unit is Kelvin. So the unit of this will be joule T per kilogram Kelvin. Kilogram comes in because this is specific volume or it could be kilo joule per kilogram Kelvin. Now let us visit physical chemistry. We know that the amount of matter can either be represented by mass say m in kilograms or it can also be represented in terms of moles say m1 kilo mole of any given substance contains exactly the same number of atoms or molecules as appropriate the Avogadro number and the conversion factor between this is n in kilo mole is mass in kilogram divided by the molecular weight which is kg per kilo mole m here is what is generally known as the molecular weight or molecular mass the unit kg per kilo mole. The advantage of this is in our equation of state for an ideal gas we may wish to use moles instead of mass and if you do that you will get a modified form of the ideal gas equation of state where R u is the universal gas constant. So remember that in the first right hand side of the equation m is mass R is the gas constant for that given gas and T is temperature mass as the unit kg the gas constant as the units say kilo joule per kilo gram Kelvin or joule per kilo gram Kelvin and temperature as the unit on the second right hand side n is the number of moles unit will be kilo mole universal gas constant will have units of joule per kilo mole Kelvin or kilo joule per kilo mole Kelvin and of course T will have the units of Kelvin being temperature. The advantage of this is this number the universal gas constant is independent of the identity of the gas and the value is 8.314 kilo joule per kilo mole Kelvin thank you.


Hey, welcome back everyone to theCUBE's coverage of AWS ReInvent 2021. I'm John Furrier, your host of theCUBE, wall-to-wall coverage in-person and hybrid. We have two great guests here. Manu Parbeckar, worldwide leader, Linux and IBM software partnership at AWS and Mike Evans, vice president of technical business development at Red Hat. Gentlemen, thanks for coming on theCUBE. Love this conversation bringing Red Hat and AWS together. Two great companies, great technologies. It really is about software and the cloud, cloud scale. Thanks for coming on. Thanks John. Our super... So let's get into the partnership. Okay, this is super important. Red Hat, well known open source as cloud needed to become clear, doing amazing work, Amazon cloud scale. Data is a big part of it, modern software. Tell us about the partnership. Thanks John, super excited to share about our partnership. As we've been partnering for almost 14 years together. We started in the very early days of AWS. And now we have tens of thousands of customers that are running RHEL on EC2. If you look at over the last three years, the pace of innovation for a joint partnership has only increased. It has manifested in three key formats. The first one is the pace at which RHEL supports new EC2 instances like ARM, Graviton, you know, think about features like Nitro. The second is just the portfolio of new RHEL offerings that we have launched over the last three years. We started with RHEL for SQL, RHEL High Availability, RHEL for SAP. And then only last month, we've launched a support for knowledge base for RHEL customers. Mike, you want to talk about what we're doing with OpenShift and then Ansible as well. Sure, yeah, it's good to be here. It's fascinating to me because I've been at Red Hat for 21 years now. And vividly remember the start of working with AWS back in 2008 when the cloud was kind of a wild idea with a whole bunch of doubters. And it's been an interesting time, but I feel the next 14 years are going to be exciting in a different way. We now have a very large customer base from almost every industry in the world built on RHEL on running on AWS. And our goal now is to continue to add additional elements to our offerings to build upon that and extend it. The largest addition, which we're going to be talking a lot about here at the reinvent show was the partnership in April this year when we launched the Red Hat OpenShift service on AWS as a managed version of OpenShift for container-based workloads. And we're seeing a lot of the customers that have standardized on RHEL on EC2, or ones that are using OpenShift on premise deployments as the early adopters of Rosa. But we're also seeing a huge number of new customers who never purchased anything from Red Hat. So in addition to the customers, we're getting great feedback from systems integrators and ISV partners who are looking to have a software application run both on premise and in AWS. And with OpenShift being one of the pioneers in enabling both container and harnessing Kubernetes where Rosa is just a really exciting area for us to track and continue to advance together with AWS. It's very interesting. Before I get the rose, I want to just real get the update on Red Hat and IBM obviously the acquisition part of IBM. How is that impacting the partnership? Can you just quickly touch on that? Sure, I'll start off. And I mean, Red Hat went from a company that was about 15,000 employees competing with a lot of really large technology companies. And we added more than 100,000 field oriented people when IBM acquired Red Hat to help magnify the Red Hat solutions. And the global scale and coverage of IBM is incredible. I'd like to give two simple examples of people. One is, I remember our sales force in EMEA telling me they got a $4 million order from a country in Africa they didn't even know existed. And IBM had a hundred people in it. Or AT&T is one of Red Hat's largest accounts. And I think at one point we had seven full time people on it and AT&T is one of IBM's largest accounts. And they had two seven story buildings full of people working with AT&T. So relative to AWS, we now also see IBM embracing AWS more with both software and services. And the magnification of Red Hat based solutions combined with that embrace should be, create some great growth. And I think IBM's pretty excited about being able to sell Red Hat software. So. Yeah. Go ahead. Manu, I think you have, yeah. Yeah, I think there's also, it is definitely a net positive job. You know, just the joint work that Red Hat and AWS have done for the last 14 years working in the trenches, supporting other end customers is now also providing a lot of tailwinds for the IBM software partnership. We have done some incredible work over the last 12 months around three broad categories. The first one is around product, what we're doing around customer success and then what we're doing around sales and marketing. So on the product side, we have listed about 15 products on marketplace over the course of the last 20 to 15 months. And our goal is to launch all of the IBM cloud packs. These are containerized versions of IBM software on marketplace by the first half of next year. The other feedback that we are getting from our customers is that, hey, we love IBM software running on Amazon, but we like to have a cloud native SaaS version of the software. So there's a lot of work that's going on right now to make sure that many of these offerings are available in a cloud native manner. And you're not talking about DB2, Cognos, Maximo, Curadal on EC2. The second thing that we're doing is making sure that many of these large enterprise customers that are running IBM software are successful. So our technical teams are attached to the hip working on the ground floor in making customers like Delta successful in running IBM software on them. I think the third piece around sales and marketing just firing up our vibrant ecosystem on how do we modernize and migrate this IBM software on cloud packs on AWS. So there's a huge push going on here. So NetNet, the Red Hat partnership is providing a lot of tailwinds to accelerate our partnership with IBM software. You know, I've been saying all this year in Red Hat Summit as well as Ansible Fest that distributed computing is coming to a large scale. And that's really what's happening. I mean, you're looking at what you guys are doing. It's amazing. Rosa Red Hat OpenShift on AWS, very notable use to use the term on AWS, which actually means something in the partnership as we learned over the years. How's that going, Mike? Because you launched on theCUBE in April, Rosa. It had great traction going in. It's in the marketplace. You got some integration. It's really a hand in glove situation with cloud scale. Take us through what's the update. Yeah, let me let him a new speak first with his AWS view and then I'll add the Red Hat picture. Thanks, Mike. John, Rosa is part of an entire container portfolio. So if you look at it, so we have ECS, EKS, the managed Kubernetes service. We have the serverless containers with Fargate. We launched ECS, EKS anywhere. And then Rosa is part of our entire portfolio of container services. As you know, two thirds of all container workloads run on AWS. And a big function of that is because we work back from a customer and then serve them what the requirements are. There are two sets of key customers that are driving the demand and the early adoption of Rosa. The first set of customers that have standardized on OpenShift on premises. They love the fact that everything that comes out of the box and they would love to use it on Amazon. So that's the first put. The second set of customers are, you know, the large real users on EC2, the tens of thousands of customers that we talked about that want to move from VM to containers and want to do DevOps. So it's this set of two customers that are informing our roadmap as well as our investments around Rosa. We are seeing solid adoption. Both in terms of adoption by a customer as well as the partners and helping and how our partners are helping our customers in modernizing from VMs to containers. So it's a huge priority for our container service. And over the next few years, we continue to see to increase our investment on the product roadmap here. Yeah, from my perspective, first off at the high level in my mind, one of the most interesting parts of Rosa is being integrated in the AWS console and not just for the, you know, where it shows up on the screen, but also all the work behind what that took to get there and why we did it. And we did it because customers were asking both of us, we're saying, look, OpenShift is a platform. We're going to be building and deploying serious applications at incredible scale on it. And it's really got to have joint high quality support, joint high quality engineering. It's got to be rock solid. And so we came to agreement with AWS. That was the best way to do that was to build it in the console, you know, integrated in into the core of an AWS engineering team with Red Hat engineers, Arm and Arm. So that's a very unique service. And it's not like a high level SAS application that runs above everything. It's down in the bowels and really needs to be rock solid. So we're seeing, you know, we're seeing great interest both from end users, as I mentioned, existing customers, new customers, the partner base, you know, all the systems integrators are coming on board. There's lots of business and money to be made in modernizing applications as well as building new cloud native applications. People can, you know, between Red Hat and AWS, we've got some models around supporting POCs and customer migrations. We've got some joint investments. It's a really ripe area. Yeah. That's good stuff. Real quick, what do you think of Rosa versus EKS and ECS? What's, how should people think about that, Mike? Yeah. You go for it, Manio. Yeah. Your job is to position all these, all these offerings. Yeah. Take us through them. Yeah. John Rosa is part of our container ports with the services, along with EKS, ECS, Fargate, and the anywhere services that we just launched earlier this year. There are, you know, a set of customers, both that are running OpenShift on premises that are standardized on Rosa. And then the large set of rail customers that are running rail on EC2 that want to use the Rosa service. So, you know, both AWS and Red Hat are now continuing to invest in accelerating the roadmap of the service on our platform. You know, we are working on improving the console experience. Also one of the things we just launched recently is the Amazon controller for Kubernetes or, you know, service operators for S3. So over the next few years, you'll see, you know, significant investment from both Red Hat and AWS in this joint service. And this is an integral part of our overall container ports. Yeah. And great stuff to get in the console. That's great, great integration. That's the future. I want to ask about the Graviton instances. This has been one of the most biggest success stories I think we believe in Amazon history in the acquisition of Annapurna has really created great differentiation. And anyone who's in the software knows if you have good chips, powering apps, they go faster. And if the chips are good, they're less expensive. And that's the innovation. We saw that rail now supports Graviton instances. Tell us more about the Red Hat strategy with Graviton and ARM specifically. Has it impact your development and what does it mean for customers? Sure. Yeah, it's a pretty fascinating area for me. As I said, I've been at Red Hat 21 years and my job is to actually look at new markets and new technologies now for Red Hat and work with our largest partners. So I've been tracking the ARM dynamics for a while and we've been working with AWS for over two years supporting Graviton. And I'm seeing more enthusiasm now in terms of developers and especially for very horizontal large scale applications. And we're excited to be working with AWS directly on it. And I think it's going to be a fascinating next two years on ARM personally. My name is specialized processors for training and instances, all this stuff can be applied to web services and automation like cloud native services, right? Is that, it sounds like a good direction. Take us through that. John, on our partnership with Red Hat we are continuing to iterate as Mike mentioned the stuff that we've done around Graviton both the last two years is pretty incredible. And the pace at which we are innovating is improving. Around the premium and the inferential instances we are continuing to work with Red Hat and the support for Red Hat should come shortly very soon. Well, my prediction is that the Graviton success formula is going to be applied to every single category. You can get that kind of innovation on the software side just really kind of just, that's the magical, that's the proven form of software, right? We've been there. Good software powering with some great performance. Menu, Mike, thank you for coming on and sharing the news and the partnership update. Congratulations on the partnership, really good. Thank you. Thanks a lot John, incredible time there for us. Yeah, this is the future software as we see. Good beyond. It's all coming together here on theCUBE. We're bringing all the action. Software being powered by chips. Just a cube coverage of eight of us re-invent 2021. I'm John Furrier, your host. Thanks for watching.