Welcome to the Dr. Gundry podcast. So here's probably a shocking statistic that doesn't shock me, but I hope it shocks you. One in five children has a mental health disorder. One in five.  To do that, I'm joined by Dr. Kenneth Bach. Kenneth has over 35 years of experience diagnosing the root cause of chronic illnesses and restoring balance to his patient's immune systems. And he's got a brand new book out called Brain Inflamed, uncovering the hidden causes of anxiety, depression, and other mood disorders in teens and adolescents. So in today's episode Kenneth and I are going to discuss why these mental health problems appear to be increasing. Not only appear to be increasing, they are increasing. What it has to do with your children's God health, one of my favorite subjects, and what you can do if you suspect your child is suffering from a mental health issue. Kenneth, it's great to have you on the show today. Well, Dr. Gundry, it's great to be with you. Really great to be with you. Welcome. This is just for people who are listening. I have actually raved about this book and my comment or the book is on the back cover. So listen up, folks, because this is important. All right.  And the first question is, there are theories about the root of mental health problems in children. And maybe we could divide that into two almost conflicting theories. One is diet and then nature theories, nurture or nature in a way. So you contrast a Mediterranean diet, high in fish, olive oil, and vegetables with a high saturated fat, high sugar diet common in the US and elsewhere in Western countries. Is there literally a connection between the food that we eat and what goes on in our brain? Let's start there. That's actually getting down to basics, right? Food. Yeah. And there clearly is. And it always kind of always blows my mind that people seem to almost gloss over it and not really pay it any heat.  And I know how important you know the gut is. And on an everyday basis. And I see it because when you see all these kids, you hear about their diets and you realize by just sometimes changing. And, you know, obviously we love people to be on more like the Mediterranean type diets as much as possible. And there are studies, obviously many studies to show how this can help with depression and anxiety. But it's just sometimes you have to do the simple things. You have to cut out the refined sugars for a step. And also the artificial additives, the preservatives, the flavorings, the colorings. Because I can remember I've been saying this in our field of intuitive medicine. I've been in practice since 83. But I remember a study, I think it was in 90, I think it was in 2008 in the Lancet from Wales. And they actually did a double blind controlled study of food editors, preservatives, colorings and food editors in two cohorts of kids, three year old and eight, nine year olds. And they clearly showed that it contributed to ADHD. And I think from then on, all the naysayers really was in the Lancet, they could no longer be naysayers. And so what we've been saying for all these years, as you know, so many things you probably say, years later, it gets more accepted. It's not called controversial. Well, I think so the very initial things are stop the food additives, the processed foods and the refined carbs. If we can do that, we can really help a lot of kids. And then of course, if you can move more into the Mediterranean type diet and get off all those grains and get more into the healthy proteins and fats and veggies, veggies, veggies, we're even better shape. So, you know, I may have mentioned this on one of my other podcasts, but you're probably aware. And if not, I know you're aware of it. Do you remember the Appleton School, the Appleton, Wisconsin middle school study of changing the food in the school cafeteria and behavior? I can't quote it, but I yeah. Yeah. Well, again, I think because we're talking about this, I've been to Appleton, Wisconsin, it's a cute little Midwest college town. And they were having a lot of behavior issues in their middle school, their junior high. And they had an organic cafe in the town. And the school district says, we're going to contract with this organic cafe to serve breakfast and lunch at the school. And then we're going to, we're going to have all the families come in, all the parents come in, and we're going to teach them what we'd really like you to feed your kids at night, try to keep this going. And lo and behold, their truancy dropped the trips to the vice principal's office plummeted, and their test scores went up. And everybody says, wow, you know, look at that. And they were so impressed that they decided the cafe said, well, this has been great, you know, but you know, we can't keep doing this. It's not our business. And so they said, okay, we're going to institutionalize this, we're going to get a big corporation to come in and keep this going. And I won't mention the name of the corporation. You can find it out. Once the corporation took over, they everything went back to normal. The truancy increased the behavior, the test scores went down. And of course, the big corporation didn't do the, you know, they just went back to, you know, giant food suppliers and it changed behavior. And you're right. It's, it's hard to believe. But in fact, that's what happens. Yeah, well, the problem I think also is it takes effort. And unfortunately, to eat more organic takes a course more. And so I think that's one of the the barriers to more widespread implementation, unfortunately. But and it takes effort to I mean, to cook healthier foods rather than eat all the fast foods.  I mean, what a way to start. I mean, it's just, you know, empty calories and all kinds of processed additives. And it's, it's no wonder that the, the raw materials for the function of the brain, which is responsible for not only cognition, but mood is altered. You know, it doesn't take a right, I'm sure you feel this way. It doesn't take a rocket scientist to, to figure some of these things out.  I have to remind my patients that nobody had a bowl of cold cereal for breakfast until 1906, when you know, Kellogg's invented it. And I did some of my training in England. And no one in England ever had a bowl of cold cereal until 1940, when the Yanks brought it over during World War II.  Not, not, and you're right, they're just a bowl of sugar with, you know, with coloring now that. So how do you, so I see a lot of kids and teenagers in my practice primarily with autoimmune diseases. I have a big Crohn's practice, a lot of juvenile rheumatoid arthritis, and certainly these, these kids and teenagers have some really good motivation to, once we show them that food is the culprit to change their diet, and they can feel it, they can see it. But in the, in the mental health area, how in your practice, how the heck do you motivate a teenager who's, you know, living on Lucky Charms and McDonald's, and can see absolutely no reason that that food that all of his friends or her friends eat, who are, quote, normal, how do you convince somebody to make a change? That's a great question. And that's something I really worked hard at. And I feel like I've gotten good at it over the years. And part of it is to learn how to bond with the kids, you can't in any way be arrogant or condescending, obviously, I mean, you know, and the kids I take care of with autism, that's another part of the population to deal with. I get down on the floor and look them right in the eyes, even though they don't want to look in my eyes. With the teenagers, I'll get to them, I'll try to figure out what it is that they can relate to if it's a kid, let's say a boy or a girl who's interested in athletics and they play basketball, I may be able to make an image because I coach my kids when they were, you know, younger. Hey, can you dribble with your left hand? Can you go to the hole to the left, not just the right, you know, some things that they may be able to make perk up, wow, this guy's not too bad. And also, it's a matter of the pain that they have, and not just physical pain, it's a matter of it. So try to get to them. How are you doing with your friends? How is this affecting you? Even maybe pimples or gas.  So hey, you know, what happens if we can help you with that, or your pimples, and or may and then get to the thing about maybe make you feel better and be better with your friends, that kind of stuff. Gotcha. And do they, we certainly see that behavior changes from food choices. And do do people, obviously, you're successful at this, people actually notice a change in their behavior, or things are doing better when they're eating certain foods? No question. But the interesting thing is, sometimes you ask the question, how you're doing? No, no, no, no, no, no. But then you start asking the specific, well, okay, how you doing in school? Actually, my grades are better. I'm able to attend better and concentrate.  You know, well, maybe I'm not as irritable. I may be, hey, I'm getting along better.  But but when you can make the changes in their life, you definitely see it. There's no question. I see it. Obviously, that's why people come from all over the world to for these kind of treatments. But you see it. But the key is to relate to the kids. I really feel like that's something that and I think it's something that doctors really have learned how to interact and relate to this one thing I learned in University of Rochester, I had this mentor, George Engel, I don't know if you have he was the he was the father of bio so bio medical psychosocial medicine right from the first day we went when we did our cadavers, we did him in the morning and then we met in the afternoon and talked about how we felt, which is pretty profound. So I learned that whole open ended into interview and how to relate. And I think that's really helped me with the kids. So actually take us through that. So how how would number one? Okay, somebody's found you, maybe from not the Hudson River Valley. And we've got a quote problem teenager. Let's let's use that as an example. Do they do they come to your center? Do they spend time at your center? Or is this all remote now? How's it work? Well, it can either be either way. I mean, I love when they're local, because we don't we have a really, we have people come from so far that now a lot of a lot of it's always been, you know, telemedicine video, etc. But they always had to come first. So you have to travel from Thailand, or you know, you have to do an exam, as you know, but now actually freed up, we don't have to do that. So I can treat for a video first. But either they'll come in I like when they come in, because I can actually really interact to have a couch have chairs and a couch and the kid usually sits on the couch. And so I'll talk to them if they're an older kid, I usually let them do the talking if they're certainly over 18, they got to give permission for their parents to be there, which is very interesting. And they have to sign. So I like to try I guess the word I would say that's going to be like to try to empower the kids. So if you can empower the kids and get them on board with you, and not just jump on the quote on the side of their parents, and really get them to be able to somehow acknowledge what's bothering them.  And so if I can somehow get to and I've had a sense of who they are, and I can get to what's really there and say, Hey, listen, if I could help you in this, would that interest you? And I said, because I don't want to waste your parents time and money and my time, because I'm not going to be over you with a stick, I tell them I'm going to. And so you be surprised how you can enlist them with this kind of a thing. And I think for practitioners who hear about this, they they just need to somehow try to be able to relate to the to the kid. I think it's I think it's really key. So let's shift gears. You and I probably and we'll talk some more about food. But the other side of the coin is the the nature theory that, well, children right now and teenagers have far less unstructured time for play and time to be in nature. poverty certainly has a has a big piece to play in this. Show me or tell me what your thought is. Okay, how much of this change is a part of what's going on with kids today? I think that's huge. And it's going to manifest in a second. I'll get to how it manifests physiologically, but psychologically, this whole thing with I'm two hours north of New York in the Hudson Valley, but I got a lot of patients out of New York City. In New York City, even before you have a kid, you're thinking about their preschool. Then once you have a kid, you're getting tutored to interview for preschool. This is true. I don't know if you've heard of this. They're actually getting tutored to and I'm not putting the parents down. This is not a put down, but it's so competitive.  And I'm a big proponent of letting kids be kids. We grew up. We screwed around. We played. I didn't have much money. We played with a any kind of ball and a stick that was a bat. You know, we wrapped tape around that a broomstick. I, you know, skiing and tennis were above, you know, were beyond me at that time. But the point is we had fun and it was unstructured and we were outside. And nowadays, as you know, the pressure any sport is now it's a competitive club sport. You've got to really be the best. You're going to get tutoring quote, you know, or coaching for that.  You have to have the best grades and obviously we all did very well in school. But the point is I think that's a big thing. I want kids to be able to be kids. That's number one. And number two, the social media pressure. This need to be aware of it and know everything and be on display every minute.  And so that couple with FOMO, fear of missing out, the I think these kids have so much pressure on them. And I feel I feel I feel bad about it. I feel and then you couple that with the whole pandemic and the loneliness and isolation. And that's what I say. Look, we end up having this cauldron and they're just boiling bubbling over the cauldron with so much stress. And the thing is stress causes systemic inflammation.  And brain inflammation can manifest not only as cognitive issues, but as neuropsychiatric symptoms. And that's the whole premise of the book. And the interesting thing, Dr. Gundry is when we see all the stress, we we attribute everything to stress. But we forget all the other layers in the cauldron that bring people up in the so that the stress throws them over.  And you say, oh, this is all stress. Well, truthfully, it's not. It's coupled with all the other things which we can talk about. But it's also that stress causes inflammation. And that's the thing I want people to be aware of. So what's what's the difference between this seeming rise in mental health issues and normal teenage behavior? Help us all understand that because all of us were teenagers. And we know what we did, right? We know exactly. So it's a good point. And what I've done in the book is I put together something that I term the mood dysregulation spectrum, which puts together kind of like the autism spectrum. But it's for neuro typical kids and their moods. And it goes it's it goes from left to right in terms of lower intensity symptoms to much more intense. So like irritability and moodiness, that I have this normal curve that allows for some of that that we all can have a little bit of that sometimes and certainly teens can have that.  Those are really intense. So there is an amount of that's quote normal.  And how you differentiate normal from really kind of the more pathological or problematic. You got a teen in your in your home, he or she is a bear. I mean, unbelievable. They go have a sleepover, right?  And you are going, you're talking about my kid? You're talking about my kid? That's what we call teenageitis. That's a behavioral thing. That's not going to be all this inflammation and all the other stuff. That's more behavioral thing. They they're good in school, maybe on the outside with friends and at a friend's house at home. That's unfortunately where it's going to happen. You want it to be there. Obviously, you don't want it to be there. But if it's going to be anywhere, as parents we got to deal with that, you know, they unstress at home, they feel comfortable, they take it out on set. And so that's a teenage thing. When it when it seeps over with friends at school and certainly had a sleepover where you hear back, oh my god, your kid's really a problem. That's much more of a problem. Gotcha.  So let's let's start at the bottom. And the bottom, I think you and I would probably both agree is genetic predisposition. Start there. How how much does genetics factor into this? I mean, I think obviously genetics plays a role because we all get this predisposition the genes from both our mother and father. And so, you know, some of those genes, as we know, genes code for proteins, proteins are either structural or functional like enzymes. So if you have these mutations in a gene, even these tiny, tiny mutations that can affect one nucleotide, one or two of them can affect the function of a gene like the MTHFR that metabolizes folate to methyl folate, which is the active folate that crosses the blood brain barrier into the brain. Then you're going to have, let's say, if you have one mutation, you may be 70% efficient. If you have two mutations, you may be 30% efficient. So how do we remedy that's interesting. And that's just one gene. There are many genes that we get from our parents. And in addition to how we look, the phenotype, obviously we get from our parents. There's also these predispositions. You'll hear, boy, you know, my father was anxious and my uncle had bipolar or OCD. You know, there is that genetic predisposition. What we do in integrative medicine, and I imagine certainly what you do as well, I call it nutritional modulation of genetic expression. It's not a fader complete. So that's the good news. I mean, the bad news is we do get our genes and for better or worse, some people have great gene. I just saw somebody yesterday, you know, one parent died at 98, the other still living, you know, 95 or something. I mean, that's amazing. Those are good genes. We don't all get that. But we can modulate the genetic expression of genes, and which is really comforting in some way. And it should be comforting. It takes effort in terms of diet. It may be taking some supplements, like with the method with a mutation in the MTH. If our gene, you if you're going to get less methylfolate because you have two mutations. So let's say you're, you're, you're only 30% efficient. You can supplement with methylfolate. And in fact, we've been doing that for a long time in our kids, we use a lot of methyl B12 and methyl folate because it can affect cognition, it can affect attention, it can be calming. But, but the point is you have to take it, you know, and now even that that's known as an adjunct of anti depression. So in addition to the SSRIs, we know now that they are, you know, we use the natural forms of methylfolate, but their prescription forms also that you can take at higher doses, 15 milligrams even. And it can and it can have a significant difference because the methylfolate's involved in the production of transmitters, for instance. So you sure it's all about affecting the neurotransmitters. So I think this whole thing, this is this is the genetics, predisposition, but also one of the other levels is metabolic disruptions, metabolic dysfunction, and we can impact on that greatly. So yeah, let me let me just stay with the MTHFR mutations. We we call them the mother effort genes in my practice.  And the kids really like that. Oh, and now. So you mind if I use that? Oh, no, please. I'm telling you, they'll they'll really like it. And one of the one of the reasons that I like to call it that is because there's a lot of awareness of the mother effort genes and a lot of people and you and I both know that these do correlate to increased risk of anxiety and depression and ADHD and and drug abuse, alcohol abuse, suicide tendencies, and they do track in families. And I take a complete, you know, family history and, lo and behold, you can spot this. But a lot of people even and tons of people carry either a half mutation or a full mutation and one of the two. And a lot of people want to blame everything that has ever gone wrong in their lives with. Well, I carry this gene and you know, it's and that's the cause of all my problems. And I bet you've seen this as well. And they put too much. Well, I think it's not just that gene, but it's people put too much attention, even the whole thing with the genetics. It's very important. It's a predisposition. I call it's a roadmap. You know, it's a roadmap, but it's not a fate to complete.  And I say, no, no, no, that's not you. That it is a predisposition. We look at it, we can we can affect it. But but I think there's too much weight in some practitioners put way too much weight on that.  And it's you have to do the clinical. The genetics is good to know. And the mth of ours is very helpful. Because if you see a home, we call it homozygous or double mutation, they're going to need higher doses of methylfoli. But we also have to remember that with the good, and it's very helpful many patients, there's also in the kids, a methylfoli can cause hyperactivity, irritability, I said about 10%, rarely aggression, rarely. So you have to be aware of that. So sometimes you have to go very slowly, I wouldn't just jump and get 15 milligrams, you got to go very slowly and you have to be able to see how they do clinically, definitely. Yeah, and we found and you're right, there are there are not there are more than a handful of people that will have the exact opposite effect to giving methyl groups as replacements. And I use low dose niacinamide as a way of damping down this effect. And actually usually works really well.  So if you're having that, exactly, I'm with you there. Nice and nice and hydroxy B12. All right, so let's go to the next level, which you like to talk about. And that's nutritional deficiencies. And if you and I know perhaps more than most people are the nutritional deficiencies because of the way our soils are depleted, are and the food we eat is striking. So what say you about nutritional deficiencies? I think it's I think it's all of the above. That's one of the multiple choice questions all of the above. It is definitely the soils are depleted. You know, certainly with selenium, we know that and other things. But I think it's the diets.  And the one thing about sugar is it puts an additional demand for nutrients that metabolize carbohydrates and sugar, you know, and so it's a double whammy, you're getting an increased load of junk that you have to metabolize and you and you're not getting the nutrients to metabolize it. And so so many kids, you know, the interesting thing is when we talk about nutrients and, and, and a pediatrician, and again, I'm not downing pediatricians, they do the best they can, they help so many kids. But if you talk about this, the nutrients, how they eat it, well, they eat it, they're fine. The parents give them a good diet, they're fine. Well, the good diet is not always so good. But if you, if you don't look, I said this in my book, The Road to Mutiny in 1997 is my first book. If you don't look, you won't see. And if you don't listen, you won't hear. So if you don't look at nutrients, sure, you're going to say they're fine. But I check vitamin D in every patient. I check multiple nutrients like zinc. And lo and behold, a lot of I mean, vitamin D is deficient in so many, you know that, I'm sure so many. We know we should, but even and the B vitamins, I generally check with the urine organic acid, so I can look at metabolites that are consistent with, you know, functional B vitamin insufficiencies. I like the word insufficiency because sometimes they're not below the quote deficient level. Same thing with vitamin D. But I think insufficiency is a much better word because it's insufficient for their adequate function, as opposed to, you know, you get a vitamin D of 30 and they say, oh, they're fine. Well, they're not really fine. Or even some of them will say 23. That's that's in his own. That's maybe it's not maybe. And so I even even a lot of the B vitamins. I think it's a matter of insufficiency rather than frank deficiency. So next area allergies and sensitivities. Where does that fit in all of this? Well, as I mentioned before about the whole area of inflammation and inflammation affecting the brain and causing symptoms, psych, you know, psychological kinds of symptoms, allergies and sensitivities create inflammation. So this inflammation can come in so many different forms. I mean, infections create inflammation. You deal with the kind of autoimmunity autoimmunity creates inflammation. Allergies and sensitivities create inflammation. Frank food allergies, like, you know, we that you know, sometimes you can see it. If you let's say you take a strawberry allergy, get hives. That's the skin is inflamed. That's very simple. You can see it. It's obvious it's very quick. But there's a lot of allergies that are not as obvious that create inflammation. So there's the classic IGE allergies, which like a strawberry causing a hive or urticaria is, but then there's the sensitivities, the gluten sensitivities, which are not allergies, but are either they're immunologically based like in celiac or non celiac gluten sensitivity, which causes a lot of inflammation, you know, and dairy can cause a lot of inflammation as can any single food, you know, and I know you talk about a lot of foods, the lectins and things. There's a lot of type of foods that can contribute to inflammation. And I think we have to not be rigid about it. We have to be realized that it can differ in various people. And so that that's part of my job is to figure out what foods are. I would say that I put many people on gluten free, dairy free diet. It's going to make sure they obviously take calcium magnesium, the dairy free and things. But and because I find that they are inflammatory in many people, not everybody. And the specific foods, if you're allergic to food, that's going to be inflammatory. So you have to either you have to avoid it for a while, we have to heal the gut, because those things lead to inflammation in the gut, which is the start of things. And then we can desensitize people to it. We have some sublegal immunotherapy you can put on your tongue. There are various things to do. But I think avoidance of the foods that cause inflammation is the first thing. And I think the awareness of that is key. So let me ask you in your practice, you know, I always say it's what I tell people not to eat that's far more important than telling them what to eat. Where in your practice does an elimination diet come in to play? Well, you can. I mean there are various ways to do it. Sometimes clinically, I just say I think in your I just had somebody with Hashimoto's will talk about God in a second. And there are studies to show that there's a certain percentage of Hashimoto's definitely need to be gluten free.  I'll say you can clinically go on a gluten free diet, which I think makes sense. Or, you know, and do it for three months, let's say give it a trial. Or, you know, in other people, if I diagnose certain foods, I might say like, if they're very low grade, I mentioned, listen, I can see a low grade reaction in the blood. But that, you know, or even in the skin, we do some skin testing of foods. But that they that may not be clinically causing this or that. So then we do an elimination challenge where we take those foods, take them off those foods for around 10 days, and then add so that they get they'll actually get more reactive after the 10 days. And every other day we add one back, add it back every meal. For that one day, you watch how they do the next day you take it out. It's like a kind of a washout day in the next day you have another one. And you watch how they do certainly over the 10 days that anything get better. And then as you reintroduce each food. So that's always been the classic the elimination challenge. But a lot of people don't want to do that. So sometimes clinically, we'll just take them off certain foods that they've reacted to. And I think the proof is in the pudding. Dr. Gundry, if they when when patients see they get bad, they come back in a month and they say, you know, my my my headaches are gone. You know, I bowels are much better. The proof is in the pudding really, I would say there.  But if after a while after you heal the gut, you know, I would say that there's only a certain percentage of foods, like the IGF foods are more fixed, maybe 85% of them are fixed and maybe 15% of variable. But any IGG foods or other kinds of non IgE sensitivities, most of them are much more variable. If you heal the gut and keep them away long enough, you can read them, even let's say maybe every fourth day, and you can get by with it. Yeah, I agree. We, we, you know, we used to look at IgE for food sensitivities. And I wasn't very impressed, quite frankly. We've now gone to IgA and IgG. And you're right, I gave a paper in the American Heart Association, Lifestyle and Epidemiology meeting last year, looking at people with really bad leaky gut that, you know, we can measure with blood tests. And after a year and lots of food sensitivities, including gluten, and after a year, nine out of 10 of the people in this study, they not only their food sensitivities went away, but they lost IgG and IgA sensitivity to gluten, which they were profoundly sensitive to. Now I'm not, don't everybody listening saying, Oh, good, if you heal the gut, you can have gluten again. I'm not saying that. But I actually think that I think, well, agree with me, the immune system can be retrained and not react to these things. And it's all because of leaky gut that started all this. And that your book makes a beautiful point about that. Well, and the, and certainly the IgG, when you see a really, really positive IgG of like every food, they're not allergic to every food, they're saying it's a leaky gut. I mean, that correct, you don't need any other tests to show you that that's a leaky gut, allowing these larger proteins to get in and the immune system is reacting. Definitely. No question. All right. So you mentioned hormones and you brought up thyroid. So that's, that's the next hormone imbalances. These are big. Go for it. Well, these are big, you know, I think that they're under recognized. Again, I think one point I would love to make to the people that are listening is that to recognize that blood tests have normal values quote, a lower value and upper value, but they're not concrete.  I feel for it. I palpate it in every patient. And sometimes it's a little large, which is indicative of it probably trying, you know, it's trying to produce more trying too hard. Yeah. Sometimes there are nodules, which you have to get an ultrasound and check out. But the point being the third hormone is involved with the metabolism of every cell. And that's why symptoms of low thyroid could look like so many things because it's involved with your whole body.   So your doctor says, no, your thyroid's fine. No, your thyroid's not fine. You have what I would call them. There's a whole thing of cold subclinical. They call subclinical hypothyroid. I don't agree with because it's not subclinical. I call it sublaboratory because they have the clinical symptoms, but they don't have the laboratory symptoms. Sometimes they have an elevated TSH but normal T3 and T4, you know, and they need thyroid. You give them. I like to give them a natural desiccated thyroid and sometimes some of the supplements like iodine and selenium to help produce the T3 and you'll be amazed at how many of these symptoms can help. And in terms of psychological symptoms, you're looking at depression. So that's if you look at, I have these MDS snapshots, these graphs in the book and there's actually if they go to braininflame.com there's a template that they can actually download is totally free and they they can actually chart their their child on this template, compare it to some of the templates I put together. None is exactly one thing, but it gives an idea. And the thyroid, the low thyroid template, the big spike is in depression. That's what you see alive with low thyroid. This is a sluggishness. It's a physical and a mental sluggishness depression. And you give thyroid, you'll be amazed a lot of papers to support this, especially with T3, of course, as you know, because you may not be producing the active T3 from the teeth. Right. And so thyroid is something I and I have so many patients say, God, I feel so much better. It's amazing. And and and yet their thyroid blood tests never went into the quote, totally abnormal range. Yeah, I see this same thing. And I write about it in my new book, The Energy Paradox. One of the things I've found just as a simple first step is the vast majority of people I see now are using either sea salt or pink salt, Himalayan salt, and they don't have any iodine. They don't have iodine. And the first thing I do is I go, look, just go to the grocery store by iodide sea salt. It's everywhere now, you know, even Morton's makes iodide sea salt. And it's amazing. Just that simple step. You know, the government used to mandate iodine and salt for a really good reason. And just that simple step can make a huge difference. And it's it's easy. And it's basically free. So yeah, I agree with you that the thyroid sub quote, sub sub laboratory hypothyroidism is a very real thing. Well, listen, I we have talked about a lot of things.  Totally. Yes. In fact, you know, what I what I talk about in the book and I talk about with patients all the time is you have examples of patients whose only symptoms, maybe not even in the gut, their their their brain. So they may be fatigued, brain fog, very common. Yeah, they're they're depressed or anxious or what have you. And you you treat the gut.  If there is dysbiotic bacteria, I use herbs for that. Usually if they have the history of lots of antibiotics, which certainly predisposes to either a candidle or quote, yeast overgrowth or anaerobic bacteria, too. And a lot of the kids, especially the kids with autism, there are studies showing vancomycin orally and metronidazole that get the anaerobes, especially when kids are aggression. I just I just had one yesterday. His kid responds so well to a course of metronidazole or vanco because he's had this recurrent dysbiosis. And you give that and even if there's not a lot or any gut symptoms, you can you can take a kid's brain fog, cognitive dysfunction, depression, and lack of motivation and reverse it with an antifungal or with prebiotics and probiotics. And because you're affecting the microbiome and all the messengers that come from the microbiome, the metabolites and the and the effect on inflammatory cytokines immune messenger molecules, all that stuff that that affects the gut lining and contributes to leaky gut. I mean, the microbiome is so important in leaky gut. And so I mean, and interestingly enough, from my work, the microbiome is involved with both the development and maintenance of the microglia, which are the immune cells in the brain. So there's a direct connection there between and it's again because of some of the products like butyrate and some of the short chain acids. And it's very but the microglia are so key and many of these kids, the microglia are up regulated, they are pouring out these inflammatory, what I call their cytokines, but in late terms, they're immune messenger molecules just like neurotransmitters in the in the nervous system, in the immune system, their immune messenger molecules. And they're just so inflammatory, a lot of our job is to down regulate them. That's how we quiet inflammation in the brain, part of it for sure. And part of it is really improving the microbiome. So yes. And then of course, the whole leaky gut thing, you know, when I lecture, I always, I always say leaky gut, leaky brain, right. And what I would generally do, you know, we're lecturing a lot more in the not obviously not in the pandemic, we're not doing webinars now, but not. So I would always have the audience, you know, if I was in an audience of 500, 1000 parents, I say, okay, I want you to say this, leaky gut, leaky brain and the audience that once or twice, I'd have them say that I wanted to get in their brains, leaky gut, leaky brain. And you know what, they used to be the whole thing controversial, and people would say out no way. Now I think the literature is really supporting it. And, you know, I'm lecturing a lot now in the blood brain barrier because I'm fascinated by it. I think it's very, very important. And so I've done a lot of research on it. And there's no question that these inflammatory mediators, and I have a lot of beautiful schematics and illustrations of it, when I lecture, of how these inflammatory mediators get out through a leaky gut, you know, the tight junctions open up, it allows these molecules, inflammatory mediators, the cytokines to get up to the blood brain barrier. And just like that one layer of epithelium in the gut, you have one layer of these endothelial cells there.  You open up those tight junctions, and then you allow these inflammatory immune cells like the TH-17 cells, and also the immune globulins, which are very large molecules. They usually can't get in.  It's fascinating. Yeah, no, absolutely.   It's exciting stuff. And it used to be pseudoscience, as you and I both know. It's not pseudoscience, folks. They call it pseudoscience. I don't actually think it was. I think what happens is, and you're probably, I've been in this field since I got out of residency. So I got a residency in 82. So it's talking 38 years now 30. And I really have found this and my kids will say this in my pet, that pretty much everything that we've done, usually enters the mainstream five, 10, 15 years later, my patients can't wait for that.  It's all based in science. It's like translating that science into the clinical. And it may not have had a robust 5000 patient double blind placebo controlled study, which may never get done for a nutrient. But it's clearly the science makes sense to me. The risk benefit is so much in favor of benefit versus risk that that and like the microbiome, right? I mean, how how long have you and I've been talking about the microbiome, right? And now and now it's like you can't get away from any scientific publication without hearing about it. Yeah. No, you're right. All right. So the book is brain inflamed by Dr. Kenneth Bach. Where do they find you? Where do they find your book? Where do they learn more about you? So our website is Bach integrative B O C K integrative I N T E G R A T I V E Bach integrative.com. And they can find all that information. We're in red up New York. I can give a phone number if anybody wants to call if they have to call and speak to my new patient person. Her name is T. She's one she's only 35 years 35 years. Wow. Yeah, it's great. And then the the the the books website is called brain inflamed brain inflamed.com. There's information on it. And I really think what can really be helpful to track their child's teenage adolescent progress is the MDS mood dysregulation spectrum snapshot where you can actually kind of graph it'll show you how various you can graph your child and as you do the various treatments, you can hopefully watch that graph change, move to the left, get further down in terms of the y axis. So I think it's a very helpful tool. And I'm and I'm happy. Are there any questions? I'm happy if you know where I have a wonderful nurse practitioner Jennifer Jennifer who's just she's a doll. She's terrific. And so you know we my my staff is funny and you probably have the same thing. They're very they're worried about me retiring, right? And I say, Why would I want to retire? I love exactly right. I get to be a medical detective. And we get to help so many kids. And the one thing I would say about this whole thing with brain inflamed one, I want to leave people this is that not every kid has a medical or biological underpinning. Sometimes it's just stress a kid, a girl breaks up with a boy and they're devastated and they're suicidal. That's it's horrible. There's inflammation from that. But that you know, that's a real psychosocial stress on there's maybe some and, you know, parental divorce and heavy. But if you miss, if you have a kid who has all these problems, psychological and is on psychotropic meds and getting therapy, they're not getting better. If you miss the medical biological underpinnings, you miss the chance to change the trajectory of their life. And not only their life, but the family's life, because one of the most gratifying things for me, when I heal these kids or help heal these kids, you heal the parents, the siblings, the grandparents, the aunts and uncles, the close friends, because we all know, I always say to my, my patients and my friends and family, you're only as good as your worst kid.  If you have a really severely ill kid with a lot, a lot of psychological symptoms, then you know how it affects the family. And so that that to me is the most gratifying thing to be able to help them. But I really want to make sure they understand that this when this is there, it needs, if you have Lyme disease, all the psychotrophics and all the therapy in the world is not going to help you if the Lyme disease or infection is causing these symptoms. Yeah, no, you're right. All right, we'll let you go at that. And yeah, look at look at this book, folks, incredibly useful information. So thanks so much to talk to you again. It's a pleasure to be with you. All right, time for our audience question. This week's question comes from Christine, who left us a five star review on iTunes. One. Thank you, Christine. She asked, I only have one quarter of my thyroid left and take centroid on a daily basis in your experience. Will I ever be able to get off this synthetic hormone? If I completely follow your plant paradox plan. Thank you again. And I look forward to hearing your thoughts. Well, first of all, the great news is that centroid, even though it's synthetic levothyroxin, is actually the actual hormone that your thyroid gland would produce. And one of the huge benefits of both levothyroxin and liothyronin, which is T three, is that we can manufacture these compounds. And if they are used by a practitioner who hopefully knows what they're doing, you have nothing to fear about being on those compounds. Now, I will say this, about 30% of women do not convert centroid T four into the active form of thyroid, which is T three, free T three. So make sure, no matter what, that when your thyroid hormone levels are being looked at, you not only get T S H thyroid stimulating hormone, but you also get free T four and free T three. And as I talk about in the energy paradox, for many of my patients, we also get reverse T three, which simplistically is throwing some of T three into a trash can where you can't get to it. But I see so many people who are told just like in this podcast, that you have, well, your T S H is okay, and your T four is okay, and your T three is okay. But you know something is wrong. But when we look at T S H free T four and free T three at the very minimum, that's when we begin to start on cover mischief. And we're having epidemic of Hashimoto's thyroiditis, which is the autoimmune cause of low thyroid. And that I can guarantee you is from leaky gut. And we've had tremendous success in reversing Hashimoto's by repairing leaky gut.  It's one of the medications that is the actual hormone that you make anyhow. So good question. Review of the week, this week's review comes from Cynthia Peterson on iTunes, who gave us a five star review and wrote I listened to Dr. Gundry on a weekly basis. I've changed my diet to keto. I've lost weight. I have good heart health. My skin looks great. I feel energized. He and I are the same age. So I am thankful for his wisdom as I age. I also purchased one of his books. Thank you, Dr. G for everything you do for the health of our generation. Well, that's wonderful to hear, Cynthia. You know, I'm happy to hear you're in such great health. And I'm also grateful for your review because reviews like yours help us reach a bigger audience with our what I think is a powerful health message just like you've mentioned. So if you haven't already, please go to iTunes and leave us a rating and a review. And if you'd like to ask me a question, leave your question in the review. I'll be sure to answer your question on a future episode of this podcast, because as you know, I'm Dr. Gundry and I'm always looking out for you. See you next week. Before you go, I just wanted to remind you that you can find the show on iTunes, Google Play, Stitcher or wherever you get your podcasts because I'm Dr. Gundry and I'm always looking out for you.


The Ondo State Chapter of the People's Democratic Party PDP has expressed dissatisfaction over the recent appointment of Baba Jalee, the son of the state governor Rotimiya Kiridolu, as the Director-General of the State Performance and Project Implementation Monitoring Unit. The appointment of Baba Jalee was announced via a statement issued by the State Commissioner for Information and Orientation Donald Ojovo. The PDP, in a statement signed by the People's Democratic Party's Publicity Secretary, Kennedy Perete, said the action of the governor amounted to the abuse of office. They also went ahead to allege that the appointment was part of a grand design to finally empty the coffers of the state before Governor Kiridolu returns to Ibadan. Joining us to discuss this is Adi Mola Adiwale, he is a political journalist. Thank you very much Mr Adi Mola for joining us. Let's start with the claims of the People's Democratic Party, it's not just a PDP that's on this table, there are several other people, even leaders of thought who have criticised this move by the state government, but then the governor has come out to justify his son's appointment. What are your thoughts on this? Thank you very much. You see, without some new participation here, because I wouldn't want to come in on the platforms of either being an APP person or a PDP person, but this is simple moral dispute.  Now for a sitting governor, in a crime like ours, that you see, to appoint no one other than his own biological son in the same regime he lives as the governor is a moral and normal being. Irrespective of my support for the party, APC, the latest defense by the party for the fact that the guy, the intelligence, has been a supporter, it's been this, it's been that. It is a sham upon the entirety of the understated people. Because if I may say something factually, the concept of accounting teaches independence and independence. How do you think to be accountable as a governor if your own biological son is an appointee in your regime? As an officer in the bank, as an internal controller, or okay, let me go up that, you know, in the bank, our employment above couples working in the same organization because of the shared interest. So for a governor to nominate a son and eventually train him is an abuse of office, is an act of immorality. And it has gone to show to the entire world that the man does not have any control in the human resource component of the entire organization. I was about to ask the question. You just played into my next question because I was going to ask that how does this make the people of Oendo look? Is it the government of Oendo state, including the governor, saying that there are no capable or people who are educated enough to hold that office other than the son of the governor? Let me say something clear. I am from a war. The same constituency of the governor. But I can tell you categorically, the whole of our kingdom will never, by any doubt, of a chance, be in support of this shamp. This is a protest. This is an HL protest on the entirety of Oendo state. How dare you, a speaking governor, get out of this all of the millions of people that make up Oendo state to go again and pick your own son to occupy a position as important as the general. So that means that nobody has to notice it again. It is a sham. It is a charade. It is a strategy. It is a thought to lose the hold of that state. I say it and I am repeating it. And I can call anybody to question. By the time the regime is over, Oendo state will be working on money. But does this not also play down on the credibility of the all-progressive Congress in that state? Because it is just the PDP who is the opposition that is speaking up on this issue. We know that a few leaders have mumbled and grumbled on this particular one. But we have not really seen any person within the APC speak up against this issue. Does this also mean that the all-progressive Congress in Oendo state has no bone of sincerity in them to speak up on this issue of nepotism? Or does it mean that they are okay with it? Hello? Go ahead. You have not said anything outside the book. What we have just advised is the two positions. What you have as the remnant of APC that is dead and gone over this issue in moral sensibility is an affirmation of the fact that the party is dead in Oendo state. Because for a party to come out and tell us that the governor's son was nominated not because he is the son of the governor, but because of his contribution at E that some people else did not make in getting him back to office. Who was E? How many of us knew about this in Oendo state as a contributor to the election or even the initially election of his father? And even if you are doing more than doing more than a movie, the election of his biological father is an over-coefficient compensation for the entire family of the Ake Donu. So now bringing Ake Donu's son back, and you know the white is occupying a very strategic position in the state and now bringing Ake Donu's son in victory on Oendo state. And I can tell you our people are not out of Ake Donu's position. Like I said, as a professional accountant and an internal controller, accountability has been reduced to nothing. Emotional sensibility of the governor is at work and is at play. Because if he is emotional sensible, he will know that this is an act of charm against the will of the people. Finally, before I let you go because our time is almost up, there's something that the government, well, responding or trying to justify this act said, and I'd like to quote him directly. They said, and I quote, this administration has been engaging members of the young generation on whose tender shoulders the future of this great country rests. We will continue to engage worthy youth regardless of the degree of affinity or otherwise only the fit and the proper will join us. So maybe the governor's son does fit into this fit and proper. And I'm wondering what should the young people of Oendo be doing at this moment because as we speak, he's been sworn in alongside other people. But will the people who are young in that state, on whose names or rather on whose behest the government is saying they put this young man into office for, will they sit quietly and let this continue? My dear, what has happened and the position of truth that you have put in is an affirmation of the U.S. health fraud and of the state's recklessness of that state, of that state's government. I'm putting together a case to look at the role of the elected cabinet of the government and then the party's agency. See, I did 15 years in the bank as an internal controller. I can't tell you that there are no more than one million of my size, even in age, that will do better. What has Babaji done? And like I said, if more and more AK Doluru is sensible and sensitive, it would know that austerity will forever be at stake for this recklessness. So they have not done anything and they have nothing whatsoever to project in the case of austerity for this act that they have done. Nobody in the youth carcass of Odukse is in support of this array. It is under the city fraud. And it is a trap again. So look, I said, so look and re-look Odukse, but I clearly don't look. Okay, well, I want to say thank you very much. Adewale Adewale is a political analyst. Thank you so much for speaking on this issue. We appreciate it. Thank you very much. Well, thank you all for staying with us on PLOS Politics tonight. Well, we will leave you with what Nigerians have to say about the president's ability to solve insecurity in the country. I'll see you tomorrow. I am Mary Anacone. Have a good evening. The case of insecurity is not something that can just be undue at once like that. It's a complicated matter. And it's obvious that the president is making some efforts and it is not something that can just be done at once. So let us believe that some of the efforts that have been made will yield fruit. But it's obvious that efforts have been made. So it's just left to different agencies to ensure that they are hard towards what they are doing because it's becoming more complicated almost every day. I don't think so. Why? The reason being is because this is not the beginning and this thing has not started today. It has been starting for a very long time. We've been clamoring on them too. Up to now, they've not been able to do anything. So I don't think it's government issues but it's only got intervention that can really help us out in this case. Well, with the look of things, I'm not sure the government is ready or the president because I expect them to have put a lot of measures in place at the moment to solve insecurity and possibly to put people's mind at rest because people are agitated, you know? We want to do Christmas and New Year with peace of mind with our family, you understand? But many people don't want to travel. Like me, for example, I just want to stay in one place. Of course, I think he's doing his best and I mean, what can one do? You have your security operatives. They are the people that will have to go and confront whoever is creating problems. The president needs to give his support, provide whatever they need. I think it's trying his best. It's like the president is just ignoring the insecurity in Nigeria because every day you hear new news, in different states of something, something happening. I don't think the president is ready to really tackle the issue yet as of now. So it's more like something that the government is just ignoring. And we, itself, in this place, we are kind of in like legos.  We don't even know much of what is going on. But when you really take a look at other people that are in other states, like fasted, like she could just say no, that you get to see the reality of things that are going on in Nigeria and it's not a good thing.


All right, so it's almost 3.05, so we'll just get started a little early, I guess. I'm Katie Bratman, and this is Adam Kojak, and today we're going to be talking about S-bomb ingestion and analysis at New York Presbyterian Hospital. So today we're going to go over S-bombs. They probably address some technical details about them. And then we'll talk about Daggerboard, which is an app we built to analyze S-bombs. And then I'll pass it over to Adam so he can talk the technical details on Daggerboard. So this is our Daggerboard development team at New York Presbyterian Hospital. We're all part of the information security team, and we're really excited to be here with you today and be presenting Daggerboard. We're announcing that in partnership with the Linux Foundation, we've open sourced it and put it on GitHub, and we're really excited. We encourage anyone that wants to contribute or wants to use it to join us on this S-bomb journey. But before we start talking about Daggerboard, let's start talking about the problem. Why are we actually here today? And I like to think about the problem from my perspective on a hospital network. So on our network at the hospital, we have a lot of unmanaged devices. Usually they're in the form of medical devices, and those are notorious for having some pretty bad vulnerabilities. So we can think of these medical devices as closed boxes, basically. We don't know what they do. We know they're sitting on our network. We don't know what is in the box or what they're built out of. So even if we wanted to know what these were built out of, if we asked the vendor, up until recently, there wasn't a great way or a standard way to provide that information. And this leads us to a bigger problem. There's no software transparency. And when there's no software transparency, we can't tell confidently what vulnerabilities are present on our network. We also can't tell what needs to be licensed. For example, we could probably scan these closed boxes with a vulnerability scanner, but that's only going to give a partial picture. To get the full picture, we'd have to open up the box and inventory all of the items inside or decompile the software. I know not everybody has time to do that in their daily jobs. So what we have is a lot of complexity and a lot of unknowns. And in the security world, if you don't know what's on your network and don't know what to protect, things get complicated and hard really fast. So to address some of these problems, the software bill of material or the S-bomb was released. And an S-bomb, it's just a machine readable XML file that for a given software component tells us what the dependencies are and then what licensing data is there. When S-bomb first came out, it was met with some questions. People weren't really sure, how can we implement this? But then there were a few industries that took the challenge and hit the ground running and have adapted the S-bomb standard. So this is why we're here today, actually. The first group to use the S-bomb standard was the healthcare S-bomb proof of concept group. And we're a member of that. And tomorrow, our CISO Jennings Aske will be talking at 945. He'll give a keynote on that for more information. And I would say definitely go check it out. But basically our proof of concept in healthcare was so successful that a few other industries followed us with a similar practice. And then to show that S-bombs have become more popular, an executive order was announced last year that said if you do any business with the government, you have to provide an S-bomb for your product. So what this means for you is if you haven't seen S-bombs already, you'll probably see them in the future because they're not going anywhere. And so we know that S-bombs were intended to be used for vulnerability analysis, but within an actual S-bomb file, there's no vulnerability data. And they're also in XML format. So they're machine readable, not really human readable, which means I'm not gonna sit there and read through an S-bomb myself and try to find what vulnerabilities are here. So this means we need something like dagger board to automate and do that analysis for us. Now, when we think of a nutrition facts label, it's actually pretty similar to an S-bomb. Because an S-bomb, it just lists the ingredients that were used to build a software component. But what the S-bomb doesn't give us is the rest of the nutrition facts. So the other big part of nutrition facts are the consumption details. Let's say I'm eating food. I wanna know how much fat this is gonna introduce into my diet for the day and do I really wanna do that? So we knew that that was a gap in S-bombs and we decided, let's make something that finds this information and gives us the full picture. So we started by trying to add this information into our sims, Blunk, but things got complicated pretty quickly. And we knew from there, let's make it easy. We wanna be able to just upload an S-bomb and our ingredients into an app. Have it do the analysis and just spit out the results. So this is where we get dagger board. So dagger board takes the S-bomb, it parses the results, and then it gives us basically a risk. It tells, we can use the results from dagger board to determine, do I really wanna put this on my network? Do I wanna consume this risk? So more on the S-bomb here. We have an example of an S-bomb file in black and white on the slide. Again, it's XML base. There are two supported formats, Cyclone DX and SPDX. And you might be wondering now, how do I get my hands on an S-bomb file? There are a few common scenarios. The first one is, if it's a commercially available product, you'll probably have to ask the vendor or the manufacturer for that. But the second case is, if you're working with an open source product, you can use tools like SIFT. We actually have SIFT in action on the slide, or some other tools to generate S-bomb files. So let's dive into the S-bomb now. Just like any XML document, the S-bomb, it has a bunch of tags and metadata, and there are four tags that we use from a vulnerability analysis perspective. Well, okay, the first tag we have here is the document name. And that's gonna tell us the name of the software component we're analyzing. The second tag we have is the creator organization, and this is just the manufacturer of that software component. And so with Daggerboard, we use these tags together for identification. Our third tag is the package name. And our fourth tag is the package version. So keep in mind, an S-bomb file has a lot of different packages listed. So we're gonna see a bunch of package names in there. Now, here's what we can do with those tags. So we take the package name and the package version and put them together, and try to get a CPE string. And if you're not familiar with the CPE string, it's just a standardized way to identify software. It's this long string you see on the slides in orange, and it's really commonly used for vulnerability identification and analysis. So what's really cool about the CPE string is, it's maintained by NIST in the National Vulnerability Database. And this means they basically attach it to a vulnerability. So once we have a CPE string, we can then say, hey, and we can query the National Vulnerability Database and say, hey, tell us what vulnerabilities are relevant here. So now that we know at a high level what we're doing with Daggerboard, we're gonna start to get into some of the actual problems we ran into along the way in the development process. And keep in mind, when we were building this app, we were actually using proof of concept S-bombs from the healthcare working group. So those were also in development, and it was a really collaborative process. We got to work with the people from the group and get feedback. So the first issue that we ran into was, how do we map an S-bomb file to an actual product? Because sometimes we saw some random software components and as from the perspective of a user just using this app, it was a little confusing. What we found initially was, it really depends on who's providing and creating the S-bomb. But since then, something called the VEX document has been introduced. And the VEX document, for a given product, will have a list of relevant S-bombs in the metadata. But right now, the VEX document's not totally complete. Once it is, we do plan to integrate it into Daggerboard. So the next problem we ran into was around package names. And this was around the package name tag, but we'll touch on that more in a moment. And finally, we knew that we wanted to map a package to a CPE and then a CPE to a vulnerability. But when we started to put this into practice, we noticed some inconsistencies. Basically, what we did was implemented a two step approach to fix this. So now what we do is on a daily basis, Daggerboard will take a cache version of the National Vulnerability Database and store it locally. So when an S-bomb is uploaded in real time, it's checked against our local database and then against NVD in real time. So onto our package and consistencies. We can see in this notepad here, there are three different examples of .NET framework and these came from three real S-bombs. But what we can see is the package name technically never matches, it's always different, and the package version is kind of crazy too. There's a verbose version number, then there's some just 3.5, a lot of craziness. And what we decided from this was we can't really trust what we're given. We need to clean this data and then take a tiered approach to match and find CPE strings. So what we'll do is we take the package name and then take pieces of the package version and first we'll clean them and then try to match them and piece them together and look for CPE string matches. And with some analysis, we found that this was a much more accurate approach than just taking what we're given. So the problems we'll cover now are some of the things we ran into along the development process with the code. So the first thing was when we loaded vulnerability data into our app, we started getting errors and this one was really simple. It was just because older vulnerabilities only had a CVSS2 score in some cases. Easy fix, just add a calculation for CVSS3. Now our next problem is related to one of our goals of Daggerboard. It was we want this to be simple. What can we do to help the analysts prioritize the problems that they find with the S-bombs? Now when it comes to vulnerabilities, we know that criticality is one way to do that but it's pretty vague and maybe it doesn't always get the full picture. So we added an additional check that for a given vulnerability, we'll see if exploit is publicly available. The next one, this came from lessons learned from the healthcare working group. We found that some vendors felt that S-bombs files were private. They didn't want them to be public. So this means we need to treat them as sensitive data and this means our app needs to be protected by authentication. So what we did, we wanted to leave this flexible and we give the user the option between using LDAP and local authentication. Easy enough, of course, we were using Django. They have an LDAP app that we can just take. But it didn't turn out to be that easy and we ran into some issues where it didn't really like that we didn't provide the LDAP information by default. So we had to extend the app to get it to work the way we wanted. And finally, this one was probably the biggest problem for us that stuck for a little bit. It was do we add the calculation of letter grades and if so, how? The reason why we had some questions about this was we know that grading can be kind of questionable, sometimes it could be tricks even. But at the same time, not everybody in our organization that's looking through these results is deep in the weeds and technical. They need a high-level overview and this is where grade can really come in handy. So we decided let's go with it and did some research on how other vulnerability scanners do their risk scoring and grading. And then came up with a method to do that on our own. So I'm gonna turn this over to Adam now to get into the more technical components of Daggerboard. Good afternoon, everyone. My name is Adam Kojak. I'm one of the developers for Daggerboard at New York Presbyterian Hospital. Very happy to be standing here today and not being impaled by that thing, whatever that was that fell. So really glad to be here and present more on Daggerboard to you all. So it's been a long time in the making. We've been working on this application for about a year and a half. It started off as a side project, but over the course of a few months, we turned it into a real thing. So we're very happy to be presenting this to you all. So this slide here, this represents the concept when we first started building the application. So what pieces did we need that were the components of the application, starting at the web framework? We built the application using a Django web framework, mainly because we're a Python job. And out the box, the admin configurations are pretty easy to implement. So that's where we settled with the Django framework. Scanning and parsing the S-bombs, this is the nature of our application. We need to be able to effectively scan every S-bomb, no matter what format it is in Cyclone DX or SPDX, and be able to parse that information necessary so we could pull it from the NVD database. We also need to be able to evaluate and assess the infrastructure risk. So what kind of letter scoring are we going to be grading these S-bombs based on their severity scores? Are they going to be in A, B, C? Or they could be ultimately up based on the significance of the criticals or severities that each one scores. We'll go more into the grades in depth later. LDAP and local authentication. Local authentication comes out of the box already. But we need to implement LDAP into this application, mainly because there is sensitive information in there. So using local LDAP integration, you're able to add that to your organization. Our back-end administrative controls, and if anybody that needs to upload the S-bomb, they'll have to read or read write access or anybody who's able to just read or analyze the data, they'll have access to read. Fancy charts and graphs, what is an application without a fancy chart or graph? We have all the fancy charts that we could add to it. We're talking bar charts, line charts, spider charts, name any graph, we added it to the application and it's useful for the analyst at the end of the day. And most importantly, we developed this application to be open source. So we're announcing it now and we released this on GitHub a few days ago. So being at the open source, so I'm very happy and pleased to be announcing that. It's been released and it's able to be used for anyone and everyone, no matter what the organization is. We are coming from healthcare, but we're open to any organization to contribute. So everyone and everyone is welcome to use it. All right, so how does the process work if you have DAG board? So coming from a supply chain's perspective, it mainly is based on the vendor or the manufacturer to provide the S-Bomb. It's everything else from there on. It's basically we select the product, we get provided the S-Bomb, upload a DAG board and we assess the risk from there on. It makes it really easy. I don't really need to go into the slide in that detail. I'm sure I'm very aware that everyone's aware of all these frameworks and packages and modules, but this is just a slide just to comprise of what we built the application on. So think of it as the picture logo of an S-Bomb. You see our basic front ends, we have bootstrap, all that. And in the back end, we're using a Docker container to unpack and install, as well as in the Stolar script and we're using MariaDB as a database in the back end. All right, so we didn't really talk about how does the process work under the hood. So Katie mentioned that you get a CPE that matches to the S-Bomb that's uploaded. But what happens from there on? So you can see here, there are two events that are triggered. We have a scheduled job in the back end that reaches out to national vulnerability database to pull the necessary information from there. And then an event is triggered when a user uploads the S-Bomb. From there, we match that data. We match it against the CPE and get the CVSS scores from there. And from there, we enrich the data even further because we were able to match it. So we reach out again and we enrich the data. And if we are not able to match or enrich data, we generate a common outfound. But if we are, guess what else we do? We enrich the data even more. And from there, we enrich it more. And this is coming from exploitDB based on the CVE. So that way we're able to produce the vulnerability results. And from there, we store into our database. All right, let's talk about grades. So I did mention this before. And grades are subjective based on your organization or grading scheme or your policy. So based on how many criticals, how many vulnerabilities you have, it could be biased or significant to one side or the other. In this case, it's this basic math. We did weight, multiplier, we did weight severity, weight scores. So based on those counts, how many criticals we're retrieving from national vulnerability database, highs, lows, mediums, and then we just divide it by that total and we've retrieved the grade threshold. And within that grade threshold, that's where you have your A, B, C, D, F. And that's where you're able to. But this is not a default. You're able to customize this on your own. So we added that feature just recently. But let's go over a little example. It goes like, we can see that we got a SBOM with 15 critical vulnerabilities. That's pretty high.  I mean, just based off of that, we got two highs, two mediums, two lows. I mean, this is obvious that this would result on a grade letter F, right? So the significance is there. But let's say that you had five mediums, five highs. I mean, it could get a little subjective on that front. So based on that, you're able to customize your gradient scheme within the application. All right, let's talk about the roadmap ahead. So we built the application. It's released on GitHub. But what else do we want to do? We want to enhance the reporting analytics for an executive summary to be scheduled on an ongoing basis. We don't want to have the analyst that has to report every single time. We're in an automation business. Let's automate that. API integrations. We want to release an API that can integrate with any product, any of your products. We want to enhance the search functionality. So at the moment, we're not able to search by CVEs. So we want to add that feature where you're able to search by CVEs. And like I mentioned, we released this on GitHub. So please, you're all welcome to contribute. All right, so that concludes the slides. We're going to go over a demo. So let's turn on the application and show you guys. All right. All right, great. So welcome to the login screen of Daggerboard. As you can see, I don't know if you're familiar with what a Daggerboard is, but it's part of the sale boat. And like the sale boat, it symbolizes to keep your company afloat. You don't want any holes in there that will sink your ship. And let's log in. All right, welcome to the dashboard. All right, so starting at the dashboard. So starting at the dashboard, you can see the last two S-bombs that were uploaded. On the dashboard is pretty much a front page that presents all the data up front. And just to mention, the data here is just for demo purposes only. I don't want anyone from Apache saying, hey, why did you grade my S-bomb in F or anything like that? So no scrutiny there. So you can see the last two S-bombs that were uploaded, what their severity, how many counts of severity they had that were uploaded. In this case, three criticals highs. What the overall grade was, you see in the second to last one. Down here, there's a highlight of all the S-bombs, of overview of all the S-bombs that were uploaded. Total vulnerabilities, 479 in our demo environment. And not sure why the presentation's small, but we're just gonna enhance it, because yeah, let me just try that. Entering my super secret password. All right. That's better. Thank you. All right, and at the table at the bottom, you can see that those are all the, that's a historical table of all the S-bombs that were uploaded to date. Let's move over to the S-bomb. Page. So this page is a detail on all the S-bombs that were, on specific S-bombs that were uploaded. And let's look at one, for instance. Let's pick elastic search. All right, so let's analyze the elastic search, and this is not real. Just for demo purposes, again. All right, so the grade letter is F. How many vulnerabilities were found? The total severity distribution amongst that S-bomb that was uploaded. Spider chart to show the vulnerability impacts. This is a package analysis of all the packages that were in that S-bomb. You can see which ones we found, which ones we're able to find. So those are all the packages. And then if we get into the vulnerability details, and this is where we're pulling from exploit DB, you could see the severities, as well as the exploit that's available. And there's a link there that you can go to, to see that. Last page, the vendor page, overview of all the vendors that uploaded S-bombs on a vendor level. Let's pick our friend Apache. Oh, Apache's already there. The grade. Line chart that represents how many, a line graph that represents how often S-bomb is uploaded from this vendor. Total severity distribution by vendor. What the last analyze S-bomb was, as well as a history of all the S-bombs that were provided from that application. I went from that software S-bomb, all right? In this section here, when an S-bomb is uploaded, we are uploading it here, in this section here. And just for timing, it does take a while. So if you're parsed, it does take time to parse. But to view the progress of the S-bomb, you could see that in this area, as well as the recent ones that were uploaded, all right? So that goes over to the pages. Let's move on to the administration section. So in here, this is what makes Django great. Out the box, you're able to configure as many administrative configurations as you want. And starting with authentication and authorization, you could modify your groups, who to add to read only, write, upload. LDAP, you could configure your LDAP environment to your organization. Users, you could configure your user base. In this section here, you're able to modify the database if you have to. So we leave that there. And the grading schemes and the grading weights thresholds could be defined in this section here. So depending on how significant you're weighing towards critical high severity, that could be configured there. That concludes the demo, that concludes our presentation. We are very thankful everyone attended this presentation. Do we have any questions? Yes, sir. So the vulnerability data from exploit DB, is it being filtered on the particular platform and other variables such as this? Because I've seen stuff on exploit DB that's very specific to an individual platform having that software. Does it take that into account? At this point, it's only focused on the CVE. Right, but within that CVE, there's nothing, it doesn't do any filtering. So if that CVE is linked to the CPE, so the software CPE, then we take that CVE and see if it's an exploit CVE. Okay, cool. Sir. Okay. Imagine, I would imagine that there would be like a lot of devices, right? And that you would first have to inventory the devices and then probably in the future have some sort of automation to actually find the S-bombs. Otherwise this would be very cumbersome to find the S-bombs and then reach out to whoever owns the device to ask them for an S-bomb. And I don't know if you do that via email or if you could share in terms of the processes involved of actually getting the list of devices and then getting the S-bombs for each of you. Because this is starting from a point where you've actually uploaded an S-bomb, right? Right, yeah. And so internally for us, we're going through that process now where with some of our vendors, we're starting to make agreements in our contracts that when they buy a new or when they provide a new device, it has to come with an S-bomb. And then with our internal process, that would probably go to our risk team who would then have dagger board and upload it to dagger board. Hey, I'm sorry, I'm Jen Exoske, I'm the CISO for NYP and I've been one of the folks working with the Linux Foundation on this whole concept of S-bombs for a couple of years and tomorrow I'm giving a keynote and I'll talk more about the question you raised. We need to get to a point where S-bombs are just something that happens and it's not this unusual thing. And we have the first example of that with the Biden administration's executive order saying you gotta give an S-bomb if you sell to the federal government. But how do you do that? How do you make it electronic, end to end and it's not like you're uploading a file. So dagger board is like us like contributing to the community, starting this effort but we have a project and I'm looking at my friend Kate back in the five or six rows back, she's part of it. We're actually right now getting ready to like make this electronic end to end and something that doesn't depend on a person doing something, right? So there's a web service, there's something that's coming and this is an evolving thing. We mentioned VEX is part of this presentation. It's coming to where we want this companion document that explains like, all right, S-bomb says these software components and then the manufacturer has the ability to say like these are the vulnerabilities that you should be concerned about or not concerned about. So a lot of thoughts going into this very evolving thing and I like to make the analogy to HTML 1.0. If you're old like me, you remember like going to websites and people like, there's a guy like a digging construction digger and like there's those bad gift images. That's where we are with S-bomb and the reality is that this is meant to start a community project where we just start this and we make it as simple and usable as possible but we're not there yet but we're working on that actively. Like how do we make this where there's no one like Katie uploading a PDF file from some vendor because that's not sustainable, we all know that. We have I think 1400 different medical device manufacturers at NYP. Like how would we keep up with that? So that's where like this is a start and that's our goals to start a community project and then like build APIs we showed and all those things. So question and they should answer. I shouldn't talk. I'm not supposed to talk. Thanks James. Does the S-bomb provide an opportunity to verify what software is actually running? So if someone either leaves something out on accident or maliciously on the S-bomb to actually confirm that the software is running what it should be. So at this point, no, it's all do you trust, you should, well, do you trust the S-bomb you're getting yet? But again, it's a work in progress. Is there a roadmap for that or an opportunity within the XML or the documentation to provide something like that? We're welcome to add it to our features list on GitHub at this point. Hey, so I think this is a good example of what Eric was talking about in terms of curation this morning, right? So a curation of this stuff is pretty valuable. Do you currently have any vendors that are producing VEX, the vulnerability exploitability exchange documents for you? I'm curious. So that is currently like ongoing work with the healthcare S-bomb proof of concept. So they do, but I don't think they're final at this point. They're still going through rounds of is this good? What else do we need to add to it? What changes should we make? And would you say that it's a necessary supplement to S-bombs? There's not some suggestion you would make to add that data to the common S-bomb formats, like to an S-bidex file or? Yeah, I mean, I think it could help, but as an idea, VEX does seem to be pretty helpful. We just need more information to supplement that, yeah. Because the VEX document, again, it includes relevant S-bombs for a product, but it includes other things, like whether or not a vulnerability is relevant and whether or not it's been validated. So it puts it all in one spot at least. So at Anaconda currently, we're producing that kind of data in our own sort of format. So it'll be interesting to look and see if that's something we can use additionally or instead. Yeah, yeah, that is interesting. So you've gone through that before then. Have you found a need to diff S-bombs when you're working with vendors, like verifying, for example, something was taken out or something was added? So I saw where you could upload the S-bombs and see the evolution of grades, but I'm just curious if you ever have the need to look at component differences between the S-bombs. Yeah, so at this point, we don't have a feature that does that, but it would be some, it's worth adding. That would definitely be worth exploring, yeah. That's very helpful. Okay, cool. Thanks for sharing this, really cool. Thank you. Hi, thanks for sharing. I saw that S-bombs has a large focus on vulnerabilities. I was just curious what the thought process was behind leaving off licensing for open source components. And if maybe it's something that might be added in the future, because obviously open source has a lot of licenses that don't play nice. So I was just curious about that. Yeah, and so actually S-bombs does focus on licensing as well. We're just taking the perspective of vulnerability analysis. Maybe that's biased because I'm on the vulnerability management team, but it is definitely, I think, the licensing aspect could help an app like this too. Okay, thank you. Thank you. Hi. What is the story? So you get things ingested into Daggerboard. What is the story after from the analyst's point of view? Because for instance, at our organization, there's lots of tools that our analysts have to go through, Splunk searches and other dashboard custom stuff that we have. What does it look like for your organization or in your experience at least? Yeah, so I think it's pretty comparable to scanning a device with a vulnerability scanner. So you scan the device, you wait to get the actual list of vulnerabilities, and then you look at the solutions for those and kind of determine where to go from there. So for us, it's similar. You'd upload the S-bomb, get your vulnerability output and the solutions, and kind of determine what to prioritize, what to follow up on. I'm kind of losing my voice, but... So Daggerboard connects, put a report on that too, and thank you. So we can use it from a vulnerability perspective. If the device is already on our network to find, is it vulnerable to this? Do we need to implement any other safeguards? But also from a risk analysis perspective, I think, where when you're getting a device in, you don't really know what you're getting, and so it kind of gives us a full picture. And I mean, even before you purchase a product, you could probably get an S-bomb and analyze it that way. Okay, yeah, I was like from, I guess from the new product coming in, but also are you guys doing this retroactively on things that you have already running there and kind of how your analysts are, like for instance, investigating based off of like, okay, we now know we have a log for J device on the network. Now we have to go through six months of logs to make sure like, did anyone tamper with something or whatnot? Is that something that y'all are doing just out of curiosity? We are not currently, but that would be the idea yet, because like right now I would go into like my vulnerability scanner and see historically like, go log for J's here, and this would just be another repository to go through. But I mean, hopefully that's why adding an API would be really helpful because then we could have like all of that information in some central location if we needed to. Cool, thank you. Great, any other questions?  Coming from the developer side, building the app, I mean, generally, we're more focused on getting the application up and running. Leadership is more focused on that. I think like also if anything, maybe this has made them more proactive and willing to provide that information. And we've seen in general over the past few years, vendors have been much better with disclosing like, hey, we're vulnerable to the log for J vulnerability, for example. Has there been any need to add any sort of exceptions for any of the CVE data that comes through for the different packages in NASBOM? Yeah, I think that's a really good question. There has not been yet. Right now, I mean, if you wanted to, you could go in and remove it. We don't have like a formal, you can add an exclusion that expires after this point though. Okay, great, if there's no other questions, thank you very much.


Zelensky, Mariupol will live in Ukraine, Militopol will be liberated. Ukraine's president, Volodymyr Zelensky, promises that the temporarily occupied cities of Mariupol in Donetsk Oblast and Militopol in Zaporizia Oblast will be liberated. Zelensky noted that last weekend, 17 Ukrainian cities both free and temporarily occupied celebrate city day. Osta is one of the oldest Ukrainian cities, Kramatosk, Nemiriv, Berislav, Zolotanosha, Mikolayevka, Porodnya, Haivaron, Vashkivtsi, Sosnivka, Novomoskovsk, Pidorodny, Nivan, Bobrinets, Baterin, whose history remembers both the glory of Ukraine and the tragedy of destruction by the occupiers, and Mariupol, Militopol. Every person matters to us, and every city matters to us. The border between Ukraine and Russia is not only the clearly seen state border on the political map, but also the border in the people's souls. Citizens do not destroy, but rebuild. They do not invade, but liberate. They do not take over what does not belong to them, but take back what is theirs. Mariupol will live in Ukraine. We will liberate Militopol. I wish each of our cities a quick victory. We are doing everything for it, Zelensky said.