All right today, we're gonna talk about how to end a relationship with grace with love a conscious Uncoupling and I'm really excited to have a very special guest in the house a dear friend of mine Catherine Woodward Thomas she wrote the book conscious uncoupling, which I refer to frequently so welcome in the house Catherine So good to be with you again Yeah You know you've been doing this work for quite some time and and I don't want to go back to how far you've been doing it But you've been helping individuals really not just help them attract love in their life Which was kind of you at the early stage of your journey But more importantly how to end a relationship as I said earlier with grace with dignity and Uncouple in a very conscious way So for some of those that are brand new to this concept of conscious uncoupling Can you give the clip-note version of what that is? Yeah, of course. Well, first of all I always like to say that your next relationship won't begin When you meet your next partner it will begin with how you uncouple Hmm this one You're bringing a lot of that baggage and the unresolved resentment or the defenses or the contraction into the next relationship it's going to really Impact that relationship so one of the benefits of doing this consciously and Doing it in a way that promotes what we call post-traumatic growth as opposed to post-traumatic stress Okay, it's going to be that you really can know and trust yourself that your next relationship Is going to be better than this one because of how you grew and what you learned through this experience You know, it's interesting. Oh, I'm sorry. That's okay. There's there's more I could you know, you could wind me up and I could talk for an Folks for those Catherine I've broken bread many a time before and we go down some nooks and crannies in Conversation to me That's the real juice in life when you can go down these nooks and crannies But you said something a moment ago which and for those that follow me know I've had a significant relationship and and and we are ending with grace with dignity with integrity conscious uncoupling and You said something though what we bring from our past You said resentments and anger, you know could be you didn't say anger, but a few other things, but you said contraction or And and I thought that was kind of interesting Is that exactly the word you used or and if you did can you expand upon that? Yeah, because I think all breakups are a crossroad and you're either going to expand to the next level of love Self-love or your capacity to love another and to receive love from another Okay, you're either going to expand because of this experience or you're going to contract away from life. Ah Gotcha, okay Many people who have spent years never really Letting anyone get that close again because once you've had your heart broken Yeah dreams crushed it it can be hard to get back out there again unless you actually turn that into wisdom depth lessons learned You know, sometimes someone is our dark guru if we went down a real path and they woke us up So let's talk about that for a moment because into some degree I experienced that with my previous partner was I Sense that there was not resentment or anything, but there was a she was deeply hurt from her past relationship I mean deeply hurt and and as much as I think there was this desire to open our heart There was also I think a challenge and even she said in the early stages. I have walls up And I think you know me coming in I'm like, okay. I'm gonna be your savior I'm gonna be the hero, you know I will show you that there are good men out there and you can love and yet and I did all those things and yet There was still a resistance and and she openly admitted she hadn't healed from her past experiences, right? Right and by the way, you know, there's this myth that time heals everything time does not heal Everything we really have to do the work and what we're up against Jonathan is We're up against our Biology first of all, yeah, because you know biologically, you know We're almost still back a thousand years ago or if you wandered away from your tribe You were you were gonna die so we feel like we're gonna die without that person and we go into a real threat state and Some of the threats are very real if you have kids and your custody's at stake or Someone's stealing money from you. They're hiding money from you.  We have a tendency to go to war.   You had a messed up childhood. You're got bad character I mean, look, maybe, you know, all of us are a yes to that in some way. We're all growing together But to actually begin to normalize breakups, which oh by the way is what's normal for all of us Because it's you know, it's significant. So studies indicate that serial monogamy is actually the new norm It's very few of us meet one person Mate with that person and that's our person for the rest of our lives It doesn't really happen that way for most of us But inside of that expectation and inside of them the shame that we feel we don't actually We've never culturally learned how to do this. Well, how do our own biology How to work even with the legal process for those people who have, you know lawyers involved in this Yeah, right. So that's prone towards war also and You remind me of something So I had a dear friend of mine say to me last weekend when and my relationship lasted about 14 months and And I shared with her. I was married for 12 years I was in another relationship for six years and this one was a year basically and she goes Oh, you got your one-year relationship out of the way And and what she met was she was kind of describing her own past experience where she's had several Relationships one that was a year one that was three years one that was longer now She's since met her her her I believe she has met her life mate She's gonna go the distance with and she got married But I thought it was kind of interesting and what we taught what she said to me was You got a lot of growth For yourself out of this experience Jonathan You know, you got and I shared with her how much I got out of this Relationship and the quality of a relationship isn't measured by whether or not it goes the distance or even the time And I can honestly say I had so much individual growth From this experience Yeah, and you know, so we're kind of holding the complexity of We're advocates for lifelong love. We celebrate lifelong love we go into our Relationships very often with the intention of bringing the highest and the best that we have to offer so that we can go the distance But if a relationship needs to end You know and and relationships take two people so if one person wants to end that relationship Then that's the beginning of the end There's a way to do it. That's not going to do damage. That's actually going to foster maturity growth expansion and love so it's really about You know this whole thing about, you know, the the fork in the road and what's the difference between Kind of contracting and getting stuck and then seeing that play out as a limitation in love moving forward Which is you know, maybe part of your experience here the difference between that and actually having a heart that kind of breaks open a Whole new levels of what's possible between yourself and the other person Has to do with really owning your part. So this whole thing if somebody's angry Yeah, he has been very very hurt betrayed Cheated on treated badly That's a violation at the level of your soul Right, so you have to honor that you have just had that experience people do behave badly in love And the wounds of love go right to the core And so I like to say In conscious uncoupling even if it was 97 percent the other person's fault Okay You have to look at your three percent Okay, because that's where the gold is Yeah Times the way that we throw ourselves under the bus and set ourselves up for such bad behavior Is very covert in nature And it usually has to do with something like We don't negotiate our needs well Okay We don't even know what we really need. We certainly have we kind of bargained away our needs We somehow thought that, you know, maybe we'd love enough for both of us Yeah Over the red flags. I mean you're kind of jokingly saying, yeah, I thought I was going to rescue her That would be a red flag to really engage and of course, you know, we're all kind of captivated by the The myth and culture that we we're going to save each other and oh by the way again We do it in some way like love does heal us at the deepest level But there are probably questions to ask like well, what was your part in that?  There's true abuse There's an abandonment all of those things then that relationship should end What's interesting in this midlife demographic that we're in and we'll let's not talk about those who get married for a moment Let's talk about those that do what we did. You know, we started dating We end up moving in together and or for people that have been dating for three or five years You know, and then it doesn't work out for whatever reason Um It's interesting because so few people I think very few people actually identified their own why they're ending it You know, like number one, I don't know if very many people truly identify Really with honesty yet for themselves of why are they ending it? um One of the things we did was we had a very honest conversation about what was coming up And it was a conversation that led to the agreement to separate Versus i'm just breaking up with you and i'm gonna ghost you which sometimes happens frequently today um Can we talk about that maybe that conversation? You know and how that should look and for others that are going through this experience Is this making sense by the way? Well, I'm walking the fine line of just having that generic conversation and then now being really curious Yeah You and your former partner, but there's a tenderness to that because you know No, no, I'm open. I'm open to going down that road and by the way for the folks that are watching this I'm doing this simply. I'm sharing my own experience Hopefully for everyone to gain from this and maybe even kind of look at yourselves and where you're at I'm open to sharing that Catherine great.  So we're kind of you know Well, if if the law if I don't feel like answering I'll say uh taken the fifth So I'm assuming it sounds to me like she's the one who chose to end the relationship Yeah And was there something that she discovered about you or about herself that had her Change her mind about the relationship because I'm assuming she went in with the intent of going the distance Oh, absolutely the fact that she moved from Chicago to Los Angeles. We built a home together She was very much, you know of active participant in building the relationship What happened was um, she went to a funeral several months before Um, she came to this conclusion and and it stirred up a lot of familiar things in her life It was a big funeral. It stirred up a lot of emotions for her And and she was feeling um really disconnected living here in Los Angeles um Whereas she was before in Chicago and interesting enough you mentioned tribe earlier Her she was having a real longing to be with her. She's uh, Colombian So her cousins are called primas and she wanted to be with her primas And she wanted to be with more family that lives in in florida And she really recognized that she wasn't able to give 100 of herself to this relationship She was being torn between wanting to be with her tribe And the fact that she cared for me, but the fact that she recognized She had not really healed from you know from Family trauma and adult trauma that happened in her life as much as she thought she did She really came to this awareness that she couldn't be 100 all in in this relationship Do you know what her life goal is what her calling is in her life? You know, I think that's you know, she has a strong passion for travel I think she has a you know, that's her main she's by the way retired and self-sufficient So not like she has a a purpose or a job like many people have so for her travel is a huge passion for her um And I can openly admit i'm not the best to travel I'm kind of a i'm a nervous nelly when I travel and she's a free spirit when she travels So there was a slight disconnect that I could own in my piece of that And I take ownership for where I was deficient in the relationship I wasn't good for advocating for my needs. I I did it sometimes in a very needy or even whiny way um that probably You know diminished a bit of my You know, I don't want to curl masculinity But certainly there were times when I made requests that came from the little kid inside of me instead of the dolls So, um So from a conscious uncoupling perspective Yeah Um, I think we're gonna we're gonna turn that into an intention for you moving forward. Yes Okay, which is going to probably be something along the lines of I mean you are a man On a mission You really are you have a very strong mission. It's more than a passion Okay, it's more than a passion. It's actually a mission and a calling Okay, be a catalyst for greater levels of self love and love between one another And you are a model of that love and you that's what your life is organized around So I think to you know, you went into a relationship with a woman who's not doesn't share that commitment and devotion Yeah, and that's going to be a problem in terms of you know We're all when you have a mission. There's a certain sacrifice that comes along with that, which is A beautiful sacrifice. We all sacrifice for the things that we really love and we're here for like This is what my life is about Yeah, so there's there was a casualness that I'm hearing where maybe the criteria for going in was more about chemistry or connection or you laugh together Or you know, you had a beautiful heart connection Yeah, it was a misalignment in your calling and at the end of the day You would have had to give up your calling to figure out, you know, how to travel better How to help her heal and go to Florida like it just would have taken you off your mission to stay with her So I think in step one of conscious uncoupling, which is find emotional freedom One of the things that we're doing is first of all, you're pretty contained.  She's right. We're not a good long-term fit And and although I was attached or you know, and to some degree I'm still attached in the sense that I care for this person I could take a step back and say, you know what? We're not we're aligned in a lot of areas, but not aligned enough Yeah Right. So that's so then in step one we look at what's your personal intention For for yourself your growth intention Okay, and what one two things I heard Jonathan one is that I want to invite you to consider taking your mission much more seriously You're actually a man who's impacted thousands of people Okay, you really are and that's what your life is about Okay I've known you long enough now to know that you are significant in that mission The the other thing that I want to say because people trust you and you you know, your heart is right there you do it for love and um And then and then the second thing is this thing about neediness And you know enough to know that neediness first of all neediness is repelling Yeah, all of us, right? It's just kind of yucky Nobody wants to parent everybody wants to partner but not parent. Yeah, I didn't want to have sex with a three-year-old, you know So so you have to so, you know but The other side of that is that the needs that you have to be supported seeing heard valued chosen prioritized matter Yeah, your needs matter and they matter big time So one of the things we want to do is to separate unhealthy needs from healthy needs And have you become much more entitled about your healthy needs because when you're not that We tend to slip into neediness because we're not actually giving ourselves the the credibility And we're really standing so when you're going in and you're assessing Whether someone is a good partner, you know what you need from somebody And you're able to negotiate those needs up front You know, it's interesting, you know, as a self-aware as I think I am I'll be candid I'm still scratching that the belly of the ant so to speak Because I learned something new every day just in a variety of different ways but more importantly about myself The contrast that was happening in this experience really gave me so much more clarity Of how important certain things are for me in the very early stages of relationship To be really solid in that instead of going Oh, I hope that changes. Yeah, exactly. And and there's a Catherine. There's this kind of fine line between you know You care about someone you see potential, but at the same time, you know If it's not there in the early beginning chances are it may not be ever there So holding, you know Hope and and that's not even the right word projecting or whatever it is And I see this happen with my my female clients. They project this, you know, vision of the future in which I did to some degree It's really having that clarity. I I now have that clarity and how to approach it in a much different way going forward Well, and I think that what you're describing is the wrong use of positive thinking Okay elaborate on that because you're probably right Well, and I think it has to do it's connected to the needs conversation that there's some way that you're casual about your own needs If you go in thinking, oh, you know, that'll change what you're basically saying to yourself is Don't really need that too much, you know, don't need what you need You know and and you're kind of you're kind of putting at risk or yourself in that vulnerable position of you may be Creating an agreement with someone and locking your life into not getting your needs met So what that looks like is someone who's, you know, bargaining because they're and this is not your Your your former girlfriend, obviously, but someone who's dating. Let's say someone who's very narcissistic Yes, it's always about them. It's always about them and they're so You know, there's a lot to get when you're with someone like that because they're the life of the party and they're fun and they're charismatic and they're interesting and You know, they're up to really fun things and that confidence I mean for somebody who doesn't have confidence always not great to write the coattails of that confidence So you can very easily just bargain away the need to be seen Yeah, they need to be energetically held They need to be able to count on someone to be there for you when you need them Like it very easy to skip over those needs and I think when your heart is bruised from a breakup It's kind of a wake-up call Like, okay, let me reassess what I actually need You know, when you know what your core need is what you're the deepest need of your soul Which usually has to do with what you didn't get in childhood when you know what is Very often you can then forgive the little stuff, you know, maybe someone isn't as you know You know, they don't they they're a little flabby around the middle or maybe they You know, they you know, they have like you don't exactly have the best Connection when it comes to sense of humor or something is a little bit, you know left of center But when they give you the love that was missing Or when you feel like that person has your back no matter what Yes Your your parents didn't maybe maybe they know how to attend to you in a way that you didn't have when you It's like such soothing joy in your soul that you kind of go. All right. Well, that's them You know, like, okay, they're being quirky that way again. No big deal Reminds me of ariel's book wabi sabi love, you know talking about the she talks about the poppy seed bagel is one of her many stories, but it's just accepting the peculiarities because you're getting so much fulfillment in other areas in the relationship, but that's continue and I love ariel for sure I hadn't actually read her rabbi sabi book. So I'd love to hear more about But I but but this has to do with knowing what your core needs are Yes, well dating is about assessing does someone have the capacity to meet those core needs You know, I really now is I got a chance to reflect back and I think that's another Maybe a different step in in conscious uncoupling, but as I really reflect back on the relationship And again, there were so many good things and really there wasn't I wouldn't even characterize anything as bad Like I may I can honestly say there was nothing bad. It was just a misalignment I Recognize now the importance of what my needs are going forward. Yes, and and and the and you even shared at least with with For me, you know, this is a passion for me, but it is a calling as well And so any future partner that would be important to have that in in in our dynamic Um As well and and I appreciate you pointing that out because I want to really stand in that and and own that piece for myself And that's another piece of awareness like saying, okay, this is important And in any new relationship that this has to be discussed um Because I don't think if someone's on board with what I do and I I think we have a mutual friend Evan Mark Katz and I know his wife is so supportive of his mission in life, which is somewhat similar to mine I've witnessed it. In fact, she could recite his material Like I've been in parties where she's reciting his material Wow, I really admire that, you know, yeah, that's beautiful.  It's the reclamation of your power. Okay, right? Reclaiming your power in your life is all about looking at that three percent. So Look, you're not making her wrong and that's just music to my ears But most of us we make the other person wrong. I mean, that's what's really true. Yeah It's because they are wrong. Okay. So let's just give it to us. I don't live in a night You know my previous partner and that believe me, I threw her under the bus But I've since apologized because I realized it was 50 50. It wasn't 97 three Well, and from a calling from a conscious uncoupling perspective calling in the one too It's really powerful to just say 100 100 percent is mine because really that 100 percent Like if I'm with a narcissistic person just to kind of okay that one The fact that I'm sourcing my value By the quality of my listening By how seamlessly I meet every one of your needs with very low expectations of my own How I disappear my own feelings and needs even to myself.  They were sociopathic blah blah blah And that's might be all true, but what were you doing with that with that person? Out of all the people on the planet, how is it that that's the person that was in your bed? The only place you're going to graduate And know that you can trust yourself now you're talking about your girlfriend. I can't talk to her right now So i'm just going to you know say this as a disclaimer because I might be totally wrong But she's coming into the relationship. She's saying I was hurt before Yeah, and so i'm not going to open my heart up. I've got a wall up So there's a limit now on what is possible. Why because she's not really yet identified her three percent And what she needs to do differently to make sure that that never happens again Her only ability to make sure it never happens again is to not really let love take root I'm just going to go off to another step. I'm going to love somebody else now. Suddenly I love my relatives more than you Like do you know what i'm saying? That's what it looks like to not know your three percent So it's fine. She gets to do that. Nobody has to become you know more conscious She'll probably go and have a great time with her relatives and it will be very healing and You know and then she'll go off to the next adventure. So we all get to choose But if you're really a stand for love You've got to know What your three percent was so I don't know how she was hurt But the three percent is usually pretty so I skipped over the red flags I minimized my own intuitive knowing I didn't ask the right questions because I didn't want to rock the boat I never spoke up for myself because I lacked the courage that I might piss that person off if I did And that would kind of you know remind me of my father when I was a kid But you know and a lot of times we do this from a psychological perspective Oh, I can't speak up for myself because my father would go into rages. No, we're grown up now We weren't responsible for what happened back then But we are responsible for how we're showing up now and the choices that we're making and if we showed up From a lesser version of ourselves From like what I called in a pseudo safety strategy Oh, so I'm going to create false a false sense of safety By you know never speaking up for myself and then I'm not going to risk any kind of you know Breakdown between us, you know, all those are just crashing burns waiting to happen You said I want to identify something that really stands out in the piggyback It's it's really knowing what you stand for in love. I mean at least that's what I heard but more importantly Being really clear as to what do you really want in a partnership? Like and I think I think there's a lot of confusion around just that That what that container looks like because for those of us that were in our 20s and 30s That maybe you know the idea was I know I always grew up with this blueprint because I'm a tail end baby boomer Is go to college get a job meet a girl get married buy a house start a family. That was my blueprint After 40 going to divorce. I don't know what that blueprint looks like. I don't even know what a relationship Container looks like I know I want companionship. I want connection. I want sex But what does that look like and I'm I'm saying this Catherine I think this is the huge confusion That most everybody in midlife is experiencing A lack of understanding of what the container of a relationship looks like if it's not married and even then we go in Cavalier Lee into marriage given that the fact that 75 percent of second and third marriages fail There's obviously lack of awareness there I think most couples don't know what the container of commitment looks like And what they need from that container? Yeah, well, we're in uh, you know consciousness is evolving rapidly Okay, and relationships are evolving rapidly And the hunger that most of us feel in our 40s I think even the young people are feeling this hunger. We want to love this and equal We're both holding power We're we don't really want to be in a role-based relationship where there's no authenticity authenticity is huge hunger We want to know how to Um Be able to cultivate a trust a trusting relationship where we're aligned On our mission where we're in the same universe. This is my best friend my spiritual partner great You know movies, you know coming in from both sides mother and father, you know, you know Both partners bringing in lots of money So we want a lot and that that hunger is driving us to evolve because we don't yet have the skills to create that We don't have the skills to be able to navigate love Such that we would feel satiated and happy. We don't even know what it looks like is what you're talking about Yeah, you know, I I continually say we are we are swimming in an environment and I'm again My demographics is mid-life the after baby making years before retirement We're swimming in a demographics that have weak emotional maturity and weak relationship skills you know and and No disparagement against women, you know oftentimes they think they're good communicators I can be candid with you a lot of women have duct tape over their mouths and they don't communicate their needs They don't can communicate very effectively and then they're with partners who are avoidant personality types that are emotionally Constipated, you know, we have a lot of dysfunctionality trying to figure this out Without any roadmap Well, there are some roadmaps. So there's a lot of emerging teachers and I think you know at some point In order to evolve beyond Unhealthy patterns, we're gonna have to make the decision to become students of healthy love Yes, right. So, I mean that's calling in the one is a journey. It's not just manifesting that person It's knowing what to do with them. You find them, right? Actually where Thomas calling in the one is the new one. This is the new one. Oh, that's a new one. Oh, I need to get Anyone it came out. It's a third of it is now up-leveled Okay, okay. There's I see much clear I actually tell you how we need to grow on an intrapersonal level which is in our relationship with ourselves Which oh by the way is one of those is how do you hold your and contain your own needy child? So that you're not speaking from that self you're speaking about that self but not From that self because if you're speaking about that self as opposed to from that self You're going to create a very different relationship with the person you're with um, and Go ahead. Well, and then Now that we kind of all know and we want to go right too But you've got to actually know your own filters. You have to know what you feel You have to know your needs. You have to differentiate unhealthy needs from healthy needs You need to know what your projections are there's a lot of inner development And that's what's been missing and that's why we're misfiring in our relationships So I want to share two things with you first off I have a dear friend who's in a relationship with a man who's been going to therapy for 20 years and he really did it to learn himself about himself and And there are some prickly parts of his personality But because he's introspective because he seeks help on improvement They they're able to navigate this relationship with a little quite a bit more ease because he's aware of it So this leads me to a quick story. I want to share with you There was a little instagram commercial that went around a few months ago Where three women or young women are sitting at a table and they're talking about this one woman's date And she goes I met this great guy and he's got a great job and he's tall dark and handsome and blah blah blah blah And they're like the women are great like she goes, but I'm not going to see him again And they're like, why wouldn't you want to see this again? And she says he doesn't do therapy You know and as a therapist I'd like your take on that commercial because I think there's a lot that's implied there Um that really has some nuggets in there. I'd like your take on that commercial, you know, I think that The what we're looking for is good character Okay, and what we're looking for is someone who has the capacity to love And also is uh available to commit to love Okay, so it's lovely if you have someone who does therapy. I don't think therapy is the be it and end all I I'm actually truthfully, I'm a little disheartened that in the in the Conversation that we're collectively having that we're so top-heavy with trauma And we're not as interested in what's really true. So for example, right? Right. So so for example, if you're raised in a home where you're neglected There's a lot of heartache to that. You were kind of on your own You made the decision when you were very young that you were all alone No one was ever going to be there for you and inside of that consciousness We tend to show up in very habitual ways that generate more of the same. We isolate when we're sad We cut people out of our hearts the moment that they hurt us and disappoint us rather than Turn towards the relationship. We'll put self-protection first, okay Or maybe we're not really vulnerable. So we create a whole relationship, you know with our, you know friends That's based on us giving to them Without the expectation that they're going to be there for us or we get involved with married people who predictably won't be there for us Okay, that we kind of design our lives inside of that consciousness and in therapy You know as a therapist when I was sitting with people I very often made the mistake of Sitting with them and getting into the trauma. What did that feel like? Like in your home You know, what's the experience? Let me try and have a corrective experience because you're not alone. You're with me You know, there's almost like such tenderness around the trauma But I'm not actually challenging the story as it lodged in my body Really true that you're all alone What's really true that no one will ever be there for you? Well as an adult I can say well, I didn't come here to be alone. I came here to have love That's my mission is to create love with people and I'm an adult and I can learn new skills I can you know learn what it looks like to create Relationships where I get to deepen over time I'm not alone and then I might learn how to mentor that little five-year-old self sweetheart. You're not alone I'm right here with you So I'm very interested in the future that we're committed to creating That kind of pulls us up and out of the muck of that traumatized self And inspires us to begin to identify new ways of relating that are going to generate a different experience So I differentiate between the traumatized self And the true self and I'm actually forming a whole I have a group of therapists who are studying with me And I'm forming something called future focus therapy where we're Mental in our so when you're saying we don't even know what healthy love looks like That's a developmental dilemma. What does it look like? What does it look like in my life? How am I dating inside of knowing exactly what healthy love looks like as opposed to Dark over here. Hope. Yeah, it all works out So what's this new therapy called again future focus future focus I like that. I'd like that and and again, I'm I'm You know, I'm not here to disparage therapy or whatnot But I also see some people just continually reliving their trauma and therapy and they're not really growing past it That's why I'm more into personal growth self personal growth self-help spiritual work Because I at least for myself speaking I want to grow past my negative patterns and my limiting beliefs in my life and just be aware You know be aware like oh my little kid was acting out in that moment, you know and like, okay I'm aware of that And also the capacity to self regulate my emotions Way more so than I ever have before Because I'm choosing to do Forward facing the fact, you know forward thinking, you know, then backward thinking. Um, so So in this conscious uncoupling, we've talked about another, you know, a number of different things What else can we look at in conscious uncoupling when two people separate You know and and begin to have lives in the future. Do you think that they should be friends with one another? What are your thoughts on that for example? So the first self conscious uncoupling, you know contrary to what gwyneth kind of popularized when she kicked it into the lexicon. Yeah. Yeah. Yeah she so So she kind of modeled one aspect like this is what it looks like to be friendly to your person to even be friends with your person But when I originally created it I created it as five steps and the first three are internal So we've been talking about steps one and two Steps three goes even Into a deeper dive like what is that consciousness that you've been generating life from particularly your intimate relationships When you are disappointed when you feel threatened How are you showing up in a way that's generating more of the same? And what's really true about that? So usually the meaning that we're making of the breakup the story as it lives in Are somatic not just in our very you know adult minds because you're being quite a grown-up about it But there's quite but there's probably a part of you It's like you know Inside of it of kind of a really sad story like no one's ever really showing up for me So so we're we're working with that self and we want to know the conversation We want to know the age of that self We want to know You know when you get disappointed You know that's where you go and then that part of you if you just let that part of you run the relationship It will end up creating evidence for that story one of the reasons why it's hard for us to outgrow The patterns and why people stay stuck so long in therapy is we're constantly covertly creating evidence for the story And they say and and they say you know, oh it's we do that because it's a he you know We're healing. I'm like I'm sorry. I never recreated the worst wounding of my childhood and then thought wow I'm getting so healed here. This is amazing. Oh, it's a rewounding experience. It's agony. It solidifies the story So what does it look like to create outside of that story? So I call the story your source fracture the original break in your heart and we look for well What's really true and how do we mentor the self in the body to what's true? And how would you be showing up differently and then we go back and do what I call a soul to soul meditation Or you're literally imagining your former partner and you're saying look I know I showed up in a way. I entered with very low expectations. You'd be there for me I positioned myself like the giver in the relationship and Like more than the receiver and you know, frankly, I was over giving to prove my value or sourcing my value from that The truth is is that um, I'm I'm actually I am a vulnerable person who needs reciprocity I'm so sorry. I never gave you a chance to get inside my inner world But I want to thank you for the growth opportunity and I know that we both came here to love and be love Let it be so let it be blessed and let it you know happen in my life. So it's just you're just correcting Whatever, I can't be the martyr.  What's that called a soul? Soul to soul meditation. Well, is that part of conscious uncoupling? Yes. It's in steps three Okay, got it. Got it. Got it. Yeah, it's in step three So and so the last two steps. Yeah, let's do the last two Okay, so that's how you're now dealing with this other person.  I've actually had four really traumatic breakups in my life So and some of and two of them were professional breakups. They were very difficult So we don't always have this problem with just romantic love, you know break. Oh, yes Yes, yes. Oh, I've had a traumatic professional break I've had two Really three actually if I really own it, I've had three traumatic breakups. I want to hear this now Okay, well, so So with some of the traumatic breakups, they're really traumatic because people actually behaved really badly Like you never want to talk to them again because they revealed that they their character In the way that it ended and breakups are a litmus test for character So, you know you and your former girlfriend are breaking up in a very kind way because you both have good character I mean, you might feel like, you know, f u.  So you're going to create what I call, um, you're going to hold that person as a dark guru You're going to give meaning to the lessons learned.  Maybe all be blessed and the biggest my favorite prayer is may we all get what we're due I'm going to just give it to the universe. Do we all get what we're due? And whatever debt you think is owed to you give it to god You just give it to the universe, you know And and a lot of us do have like if you were stolen from there's money owed you all that just say, okay I'm going to give this debt to the universe. I'm going to take responsibility for being overly trusting turning away from red flags Whatever it is. I'm going to plug up those holes. I will never again I will always from this moment forward But in some way what we're looking for is how can you be at peace with that person? Yeah, that's right So so that so the intention that you're setting in the relationship might be that our children have a wonderful childhood Or the intention might be that we transition into lifelong friends Or the intention might be that this is my dark guru who woke me up. Thank you Leave my life now never need to see you again But thank you so much and then you know, you're you're making amends moving forward step five is uh And also in step four, which is becoming a love alchemist. It's weaving All of the negativity particularly if someone is in your life You're going to co-parent with that person and finding a way to disappear the resentment and begin to weave generosity between you And begin to build the new form of family or invest in a new direction that you're going in Step five is about clarifying your new agreements With that person. Okay leading the agreement, you know when you're lovers with someone you kind of take on The assumption that you're going to be there for one another when you're having a hard time no matter what You know, they're the most important person to you So you want to make that conscious? And you can do it as a soul to so where you bring them in and you say i'm not going to be there for you anymore I'm completing that agreement. You know, I'll be your one of your support people But I won't be your primary support person. Oh, yes because I see a lot of people end relationships and All they do is they transition from a day-to-day physical to They end up having like almost an emotional Affair type of relationship where they're dependent upon each other almost as each other's therapist and And all it does is prolong the actual healing process for one or both of them. I see that Yes, exactly.  No, you're not you're still engaged in a In an affair with another person Um, and I'm using it in that terminology You know, I've been blessed my ex-wife and I You know it took years to heal that relationship and now we have a very cordial relationship And we more so now because of the passing of connor, which you're very familiar with And we have a great relationship with each other and sometimes we lean on each other because we have 30 years of history together You know and and the love, you know to the extent that the relationship didn't work We still could be friendly and then my other significant relationship. She's like my big sister You know like we transition to family and we have all this history together But we don't talk on the phone every day and are dependent upon each other It's just occasional and I suspect in this relationship even though it's much shorter I want the best for her and I want to hear about it on occasion and vice. I hope she feels the same Um, but I don't feel any need to use that person as a support person You know, which I I see so many people do and I don't believe that's healthy Well, so you're conscious of needing to create a new agreement with her, you know And if we look at relationships all relationships are really is a series of agreements That inform the expectations that we can have of one another and a lot of people will break up You know, it's that phenomenon you break up with somebody you think that you know Now the divorce papers all done But now he starts dating someone new and you feel enraged again all over again. Why are you? Right, you're not even married to that person anymore Because on a primal level you didn't actually make it conscious That you're both free To take new lovers to have new experiences moving forward So we just kind of slow that down. We ritualize that we might do a conscious uncoupling ceremony but also for people who have Children or shared community We do look also at like what are the structures you're creating, you know If you go to a divorce attorney when you're all upset They're going to be looking at what your rights are. They're going to be looking for your perspective And you know, you're the client so they're going to get as much as they can and you can get very Influenced by that person and you can really, you know tank Your relationship with the person who you have children with Not this is not going to go well So what you want to be doing ideally is, you know, finding legal professionals who can hold the holistic Goal of we want our family to be happy even after family A happy post divorce family Who's transitioned into a new form of family, but everybody's got to be well So we have a mutual friend, uh, Dennis Cohen who is a master Or I'd leave one of the few people on this planet that truly Holds hands for couples in the most loving way and while I'm sure it doesn't work out all the time I I'm blessed to have this person in my life Very few people know how to help couples the way Dennis does, you know Dennis actually was our mediator for mark and I Okay, and it was in Dennis's office that I think conscious uncoupling was born because in the middle of our um Mark and I separating our assets Mark surprised both Dennis and I by saying He was he was entitled to 10 of the royalties for life for calling in the one because we were married When I wrote the book and he just was such generosity said. Oh, no, no, no I don't want any of those royalties Catherine worked so hard on writing that I don't think to take any of those He just started said it's like okay And then it was my turn a few weeks later when he lost a job and then I called him and I said Don't worry about child support while you're looking for a job And I went out and figured out how to earn more money to cover him. So we just started Being we created a culture of kindness between us. It was in Dennis's office Dennis came and then studied to be a conscious uncoupling coach with me No, I know I You know, it's interesting because and and we only have a few minutes left You know, it saddens me how adversarial divorce is And and here you have children together, you know and and and I look at the early stages of my divorce and it was adversarial to some degree By the time Connor passed away I'll share something with you. You know, I was paying support to her I chose to continue to pay it even months and months later because She did so much. I feel like not that she was earned, you know, she was owed it or anything. I did it because It was because I genuinely care about this person and her well-being And I you know your work the work of Dennis certainly my work is all about raising consciousness How can we do things from a heart center place? How can we do things from love? Instead of this nasty Adversarial way and and even if it's not marriage if it's a breakup of one year or six years or 10 years How can we do things from a heart center place? We're both people You know, you don't have to feel like you win, but you don't want to feel like you lost You know, that's so beautiful and I I didn't know that that you did that And if I had known that I mean, I think Connor passed after conscious uncoupling was written I I would have included that In in consciousness. Oh, yeah You know, it wasn't for a long period of time, but it just I did think It's so kind.   So certainly you losing Connor Was your job journey Like life taking the most precious thing away from you You know, and so we go into these like deep deep sadness And to affirm the goodness of life in the face of that Is what makes us spiritual giants so we study spirituality for years Just so in that moment We can actually show up and generate love into the world So well said I I I actually attribute I I think of what happened while I was going through a divorce and and losing my professional identity some 15 or 17 18 years ago as a catalyst for change for me And and I went through the dark night of the soul during this period of time or as Allison calls it the tunnel Allison Armstrong and and going through all those experiences has Helped me become You know what jack Nicholson said, you know, I better man You know and and I'm really grateful for all the painstaking experiences even Connor Because he birthed, you know, he birthed the book and you were you're at the back of the you know, here's the book and here's your You know right there in the back, you know, he helped birth this and And it's interesting because I'm tested on self-love every day, by the way And even this breakup I think is a reflection of doing the work So I can experience this with you know with grace with dignity and do it in a very conscious uncoupling way Yeah, so well Catherine I'm just so excited to be able to connect with you. I wish you still live down the street. I'm going to Agape on sunday You know, I remember when we you know, which uh, you know now you're up in san francisco's or the bay area So I don't get to break bread with you, but I'm glad we're able to do it this way Folks, um, I invite you to check out both her books. Uh, there's copies below Or in my description in the jonathan recommend books, there's conscious uncoupling, which the new version Calling in the one i'm going to put your url to your website Is there anything else you'd like to share with anyone or direct them any place if there's something new? Please i'll make sure to put a A link below. Thank you. I mean we're doing we do a lot of Skill building workshops actually for free So if you couples or for individuals it's for individuals mostly I am actually just putting the finishing touches on an e-book called conscious recoupling because a lot You know the development that we're teaching and conscious uncoupling sometimes makes it possible for people to get back together So that happens more often than not and um, so we're we're doing that too But i'm really committed to helping all of us to evolve our capacity To uh, really manifest the lives that would light us up the relationships the love and the life That we're longing for so uh, if anyone wants to just sign up for any of the starter kits I have or anything then you get invited to those free community calls Okay, well i'll put the link for your website. By the way, I have one last prediction I have a prediction. Oh good I believe conscious recoupling Is actually going to start I I believe we're going to see more couples Actually go, you know what I really passed up on a good partner Maybe I do need to do some work on myself. Maybe I need to look at that three percent Maybe if I take my part in this and they do the same You know, we've had a lot of years invested with one another, you know I see conscious recoupling I see that more in our future. Yeah, I can see that too. Thank you for that blessing. Thank you All right, kathryn once again. Thank you so much I'm going to reach into the camera and give you a big gigantic jotham bear hug of appreciation For those watching again, check out all the links below to kathryn's work and uh, please connect with her I know you will be blessed if you did so everyone have a great day. Thanks so much Bye


All right. Can everyone hear me in the back? I can't really see you because of these lights. So throw something at me if you can't hear. All right. So my name is Major Hayden. I work for Rackspace. I work on our OpenStack private cloud product. And a lot of the focus for me lately has been around security and around automating security. And so that's what a lot of the presentation is going to be about today. So a little bit about me. I'm a principal architect at Rackspace. I've been there since 2006. I've been working with OpenStack in one way or another since 2012. And I've been a member of the Fedora community since about 2011. And so our agenda today is three parts. So first, we're going to talk about the security tug-of-war that we probably all face within our companies. And then we'll talk about this concept of meeting halfway, finding common middle ground. And then at the end, I have a little bit of a call to action for people to get involved with the project. And so how many people here work on information security inside their companies? OK, good. Awesome. How many of y'all have used Ansible in some way or another at some point? Oh, fantastic. All right, cool. I'll go over a little piece of that. So if you're not familiar with any of those parts, I'll go through it just a little bit. So I think we can all agree on one thing, that it's very hard to do slides and make them go. There we go. Information security is very, very difficult. It's a cultural problem. It's a technology problem. It's a time problem. When you're going to build a product, you don't necessarily sit down and say, hey, let's make this thing secure. That's not the first conversation that people have. They say, hey, let's make a product that solves a problem for a customer. Or let's make a product that brings more value to our suite of products that brings more customers on board or get customers thinking a different way. And the tough thing about security is that we want to create just enough security to create those valuable outcomes for our customers. So we want them to feel comfortable putting their data with us, trusting us that the systems are going to be up all the time. So we want to create that trust. But we only want to create just enough because if you create too much, you end up having this drag and this friction on your business. So I don't know, at different companies, I hear this all the time, you come in on Monday morning and they say, hey, look, this application you used to just walk straight into, now it has two factor. Or now this application is behind VPN. Or maybe you can't use this application. Or the way this thing is done has been changed. And it adds on a couple of minutes to your workflow. It can be a little frustrating. And this is the drag that we fight with. So this is this tug of war between creating value and increasing drag. And there's a third component that all of us in the room that have worked in the information security field at some point is that if the auditors aren't happy, nobody is happy. So when the auditors show up and they say, hey, let me see your controls. And you're like, hey, take a look at my controls. And then they say, hey, show me that you're doing the controls. And you kind of have that moment where you start to get the cold sweat. And you show them the stuff. And you're like, OK, here's what we do. Here's what we do. And they get to that last step and they say, wait a minute. You didn't do that one part right. You're not doing it like you said you were. So when the auditors aren't happy, nobody's happy. Especially not the CSO. They will come and find you. And it's going to be very bad times. And so the big question is, how do we make these valuable security changes without disruption and also keep the auditors happy? And so our answer to that is make security automatic. And I know that makes it sound easy. Everyone's like, oh, let's make security automatic. Let's talk about it. We'll build it into every product. We'll do this. But inevitably, at every company, you have that conversation where, hey, this product is going to launch on the first, right? Yeah, great. Have we made sure it's PCI compliant? Oh, wait a minute. Was that in the scope? Oh, well, let's push it out three weeks or whatever. Well, we can't push three weeks. Marketing's ready to go. And so then you have to figure out what to do. So a lot of what this talk is about is about how to make security automatic and how we do that for our private cloud. And so I created this quote. So when the going gets tough, the tough adopts standards. So, and I'll go through this in a minute. If you're not familiar with where I'm going with standards in the information security world, I'll get there. What we're talking about here is that when things are very tough, when things get very complex, you fall back on to standards that have been set up, that make sense, that create this real value and create minimal disruption. And if they do create disruption, you have this opportunity to say, hey, look, I want to take this entire standard and apply it to my environment. But maybe I'm going to turn off these one or two things. Or maybe if I do this one part of the standard, it's going to take my customers offline. So I can't do that part. And so to explain this a little bit better, I was once Rackspace's chief security architect. And so I led a lot of the security architecture within our company. And I had to learn less in the hard way. Is that, and here's a tip I'll give to anybody in the audience so you don't have to learn it the hard way. People should feel like security is something they're a part of, not something that's being done to them. So I think we've all felt, at some point in our lifetime, when security was done to us. And it's never fun. You feel like you were never involved in the conversation. You felt like you had no say in what that security was. And sometimes nobody explained the why of why it's there. And sometimes you never do find out what the value of that security really is. And so to give you an example, which sounds better? This is option one. As developers, you don't know how to secure systems properly. We will tell you what to do. And you must have it done in three months. And if you don't, we can't take credit cards. How does that sound as a developer? It's pretty demotivating. This is how I talk to my five-year-old to get him into bed at night. I say, hey, look, you've got to get in bed. Because we're not going to be able to read books. But if you, as a corporate security team, go and talk to people in your business like this, it's not collaborative. They feel like security is something that's being done to them. And so as an alternative, think of something like this. Since you use Ansible, we wrote some automation that fits into your existing deployment method and won't disrupt your production environments. Can we work with you to test it this month? The impact of that is much different. Because then when you go into that meeting with the developers, they're like, whoa, when did the info set guys learn how to do configuration management? And they're sitting there, well, how do they know we were doing Ansible? And so then you kind of come to this table and find this middle ground.  So that means the information security team has taken the time to understand how to do a configuration management system that works well for what you have. And they also understood what your production environment looks like. So a production environment that's running a LAMP stack looks very different from a production environment that's running an OpenStack Cloud. There's tons of security changes that you would make on one that you wouldn't make on the other. And finally, the very last part, you go down and say, can we work with you to test it? We would love to go and apply this. Maybe we can do it in your staging environment. If it breaks, hey, we're going to be sitting in the room and you can make fun of us. We can go and file bugs and get it done. But it's much more collaborative. It makes all the developers when the organization feel like they're part of the process. And so with that in mind, when we thought about doing automated security for OpenStack, we said it has to be easy to implement. It has to be simple to maintain. And of course, it has to be nondisruptive to an operating cloud. So if you have 1,000 virtual machines running in a cloud and they all go offline at the same time when the security people show up, that's going to leave a bad taste in everyone's mouth for a good while. It has to be effective against attacks. Otherwise, it creates no value. And it has to be open and transparent. And so I think this is a great opportunity for information security teams to go to people and say, hey, look, we've put the code for this in a source code repository. You can go there. You can propose a change. And so our great friends at the Payment Card Industry have also set up something. Requirement 2.2 requires that you take hardening standards and apply them to your systems. And so they have a laundry list of acceptable industry accepted system hardening standards. And this is really the base level of hardening for any Linux hosts or Windows hosts. And so as we went down this path, we found that selecting the right standard is really, really hard. So some standards are as long as novels. I don't know if anybody's read ISO 27002 cover to cover. Has anybody here done that? All right, that probably didn't go over so well. I mean, that's a book. It is huge. I think War and Peace actually is a little shorter by a few pages. So and also ISO 27002, 27001, they cover things like human resources. Your developers really don't care about HR in most situations. So they're uninterested. If you go and look at a lot of the NIST guidelines, they're just not specific. There's a lot of really great content in there, but again, it's a book. And the actual specific part of it is very small. It's very hard to test. And also very few directly apply to Ubuntu. So we deploy our private cloud on Ubuntu. There is almost no hardening standard content out there for Ubuntu. There is a small amount, but some of it is very brief. It's very incomplete. Trying to find anything that works with tools like OpenScap or anything like that, it's very difficult to find. And then some of them have very restrictive licenses. We were working with a group to try and figure out a way to use their standards with our private cloud and get it into the OpenStack Foundation and the licensing just wouldn't work out. And so after all this deliberation and going back and forth, we decided to settle on the Security Technical Implementation Guide from DISA, which is part of the United States Department of Defense. And so this is the same security changes that the United States Department of Defense makes on their own systems. And the great thing about it is that it's cracked up into multiple levels. There's category one, two, and three, with one being, okay, if you're on a very, very secret, secure system, you must do these things. And then at the bottom level, number three is just good system hygiene all around. So it's things that every system should really have applied. Usually the stuff at the top will be a little bit more impacting than the stuff at the bottom. And I'll go through a couple of examples of that here in a second. And so the other nice thing about the Stig is that it covers the most critical security domains. So all the things you see here on the right are covered within the Stig. So as far as handling your package management and checking, you know, for check sums when the packages come through, auditing SIS calls, which can be amazingly helpful for when an intruder's trying to wander around the system and they're trying to access files that they can't, you'll receive just tons and tons of alerts coming through. And if it's on files that you normally don't see that on, that's a great time to alert. But it also goes through and deals with authentication, file permissions, file integrity management, all this kind of thing. So some of this involves installing extra packages. Some of it is just configuration changes or just changes in individual files. And so what we did with the community was take the DeSys Stig for Rails 6 and ansibleize it. And so apply the entire, all of the controls that could be applied with an automated platform. Took all that together and then we said, hey, wait a minute, which one of these is gonna cause a problem with a running OpenStack Cloud? For example, there was one in there that said, disable IPv6. Well, in my personal OpenStack Cloud, I have IPv6, that would be crazy. And there's some others that if you actually enabled them, it would take VMs offline. So that's a really bad time there. And then finally, what we did was we said, hey look, so now we've automated it, we figured out what's not gonna work well on OpenStack Cloud, we've turned it off. Now what we have to do is make this work really well for Ubuntu. So as some of you may know, Rell and Ubuntu don't really match up so well in a lot of places. So it took a little bit of careful tuning and sometimes some substitutions to get that in there. And so if some of you are not familiar with Ansible, it's a software platform for configuration management, deployment, and many other things. If you've used Puppet or Chef or SaltStack, it's generally the same type of thing. The reason we love it is because there's no agent required, there's nothing actually that you have to install on a server to use Ansible with it. So you can deploy from your laptop, you can deploy from a bashing server, you can deploy from Jenkins, you can deploy from wherever you like. But you don't have to go on the other end and install Ruby and install 56 other things. You just have to make sure the other end has Python, which if you're running OpenStack, I certainly hope you have that installed.  And so what we do with OpenStack Ansible, so OpenStack Ansible is a community project and it's what we use to deploy our Rackspace private cloud. And it's fully available and ready to use. You can go and deploy your own clouds with it. I've used it to deploy my own. And so what we do is we have a ton of Ansible tasks and roles that go and configure all the parts of OpenStack. So we'll have separate roles for Keystone and Nova and Cinder and all this kind of thing. And then OpenStack Ansible is the glue that holds all of those roles together. So it has all the configuration, calls all the roles and that kind of thing. And so what we decided to do was why not create another role for OpenStack Ansible? And so what we did was created two things. One was the actual role itself. And a role for Ansible is a bolt-on list of tasks and configuration, things that you need to go do. Usually with Puppet, this would be, I think, a module or a manifest. But it's basically a group of things that you would want to have done at the same time. So we have that. And then we also have documentation. And the nice thing about the documentation is it's very beneficial for deployers. Because if you're going to go and deploy the security role, it will explain things that you need to turn on and turn off. It'll explain things that we've turned off for you to kind of shave off some of the rough edges and things that would disrupt your cloud. And it'll also go through and say, hey, look, we felt like this one was overly stringent. And here are the reasons. And if you want to turn it on, you can. And it's flipping a Boolean, redeploy. There's a few things as well that give you opportunities to go and configure SSH timeouts and certain things that you would apply an integer to. You can go and do that. The other nice thing about the documentation, I'll go through a couple of examples in a second, is it's valuable for auditors. Because if you use this role to secure your system and your auditors come and say, hey, are you applying hardening standards? And you say, absolutely we are. And they say, well, I need to see evidence of this. I need to see documentation of what standards you're applying. You can actually grab the PDF that sphinx outputs and hand it to the auditor. And everything is documented. I'll show that in just a second. So it'll have the actual control. And then right below it, it'll say exactly what we did to apply the control. And any kind of gotchas or anything like that. If there's any exceptions that we made or any opt-outs, it'll fully explain why there's an exception or an opt-out. Then the individual companies could actually just fork the Docs repo and go through, change the docs, print it out, give it to the auditor, and be done with it. And so getting into the role itself, it applies 200 security configurations in 90 seconds. And as I said before, you can go in and configure all kinds of things. I'll show some examples of the configuration here in a second. And so one nice thing about Ansible is it has a check mode. So it's kind of like a dry run type thing. And the great thing about it is that with this role, you can actually do a compliance check. So when your auditor shows up and they say, hey, I need to make sure you're actually doing all the stuff that you said you were doing, you say, hey, come sit down with me at the terminal, run it in check mode. And if there are any of those situations where perhaps Ansible pops up and says, hey, I would have changed this value to something else. And the auditor's like, hey, what is that? Why is that not set? You could say, hey, guess what? I've got an exception for that. I can show you. And here's the reason why we don't do that setting. And it can also be used in a cron job as well.  If it fails or it says it would have changed something, have it send an alert to someone. And it may just be there may have been a sysadmin that changed the configuration file without knowing that it was being managed. So it's just one thing to consider. And it's carefully written to be non-disruptive to existing OpenStack clouds. So there's certain things like disabling forward on Linux Bridges. That's kind of bad in OpenStack land. We use a lot of Linux Bridges. And that would kind of upset Neutron a little bit. And so getting into the documentation, the value you get from the documentation, I apologize, the text is small. I'll send out the slides. So the very top part is the actual configuration requirement from the Stig. And then right below it is a link to the Stig Viewer. The great thing about the Stig Viewer is it's a very colorful way to review the Stig, compare it to other configuration options and things like that. And at the very bottom, it'll have documentation about exceptions, additional information, warnings, gotchas, like things you need to be careful with in this particular security control. So in this example right here is talking about default operating systems accounts other than root must be locked. And so as it says in the documentation here, you know, if you need to skip it, you can skip it, you can go and audit these accounts. And it'll also let you know that the playbook will actually stop when it finds this type of situation. So some of these things we can't audit. So we certainly don't want to roll through and go and lock system accounts without you having a chance to have a say in that. So actually just lock and tell you, hey, I found these three system accounts that I need to go and take a look at. And so an example of a configuration option, it'll explain in full detail where you can go and find the configuration options for a particular thing. And this example is the SSH server. And then right below it, it'll give you extra advice on particular configuration. So right here is one for the permit root log in for SSH. So in some environments, people log in as root and that's totally fine and we don't want to derail them, although I would tell them to please stop it as soon as possible. So we go ahead and turn that off, we don't force it. But if you wanted to go and force it, that's one where you can kind of ratchet it down just a little bit more. And this is also something you can show to your auditor and say, hey, we diverged and went ahead and locked this down because we felt like it was important. And so configuration is pretty straightforward. So here's an example of the SSH configuration. What you'll see here is a little bit of verbiage. Now mind you, the majority of the verbiage is in the docs. This is just enough to get you through the configuration. So one of the requirements is a set of 15 minute timeout for SSH sessions. If you don't like that and you want it to be something else, change it, redeploy. 90 seconds and you're done. Usually a little bit less if you're redeploying. And then you'll see out to the right, this V number, that's the actual number of the stig. So if you want to go back and review it in detail, you can go straight to the docs and go and review it in more detail. And of course there's some other configs down below. And some of the configurations are actually flipping booleans from yes to no or false to true, that kind of thing. Another example of configuration, so Audit D, love it or hate it, it does system call auditing. So there's a lot of different system calls that you can audit on a system.  So you'll see there's a couple of these that we already have flipped to no. I think like Chimad right there, let's see, deletions and things like that. When you're actually doing the open stack Ansible deployment, there's a lot of that happening. And so it slows down the deployment a great deal. But all those are fully documented. And if after this is deployed, you say, hey, look, I wanna go ahead and turn all of these on. Flip those to yes, redeploy. Hopefully in 60 to 90 seconds, you'll be good to go. And so if you're sitting there saying, okay, how do I get this thing? I want this thing. So if you're already using open stack Ansible from the community version, it's available in Liberty, Metaka and Newton. All you have to do is there's a variable called applied security hardening, flip it from false to true, deploy, done. If you've already deployed, fantastic. Flip it to true and rerun the security hardening playbook and there's documentation on how to do all of that. The great thing is in Newton, we've actually turned it on by default. So every single open stack Ansible deployment, by default, we'll have it enabled. And in Liberty, Metaka and Newton's gate jobs, it's already enabled. And so if you're a Rackspace private cloud customer, this is coming in 12.2, which is coming very soon. I'm told by our product people I'm not allowed to say dates. So I'll just leave that alone. So speak to your account manager. And then if you don't use any of these things, you can use it with your existing Ansible playbooks. So if you right now are deploying on top of Ubuntu 14.04, you can go ahead and rope that into your existing deployment. There's no extra work required. All the configuration and everything in the docs are all inside the role. So it's completely just plug and play wherever you need to put it. And it's compatible with Ansible 19.20 all the way up. So the road ahead for the role is obviously we wanna get support for Ubuntu 16.04 and CentOS 7. Both have system D, which is very entertaining. And so that's gonna take some changes. And also we wanna rebase onto the new stick guidelines for Rails 7. So there's brand new guidelines that include all the new services and features and of course like system D changes in Rails 7. We wanna have a little bit better reporting in metrics. We'd love to be able to have something where maybe you could run the role and get output that you can directly hand to the auditor. Maybe get a CSV file out or something like that that then you could file away. And you could also trend on it over time. So maybe if you had a few of the things turned off and over time you said, hey look I wanna get to the point where I have all these turned on, you could do some trending. And then also we wanna find a way to identify configuration security issues within OpenStack services. So if you're familiar with the OpenStack security notices, the OSSNs, one of the ideas we had was trying to identify if there's a bad configuration in the system somewhere. Be able to identify and alert you to it. Not go and change it, because that'd be kind of drastic, but at least give you some type of a notification. So if you wanna get involved, we'll be here for the Design Summit Thursday and Friday, the OpenStack Ansible Group. On IRC you'll find some pound OpenStack Ansible. And then if you send something to the mailing list, just tag it with OpenStack Ansible and Security. And then links, I'll send out the slides because these are a little bit long, but the project is called OpenStack Ansible Security. So if you go to Google and search for it, those are probably the first two links you'll find.  It's very fun over there. And with that, that's it. And if y'all have any questions, I'll be glad to take them. Thanks. If you do have a question, I think there's a mic there and a mic there. All right, good morning. The conversion from STIG compliance checks into Ansible Format or PCI into the Ansible Format, who does that and how long would it take? So there's a new STIG version and then you have to take it, read it, convert it into the Ansible Playbooks. So this was a manual effort. So this was reading the STIG, understanding it, interpreting it, really trying to think about how it applies to Ubuntu, how it applies to an OpenStack Cloud, and then getting it exactly right. And then getting it to the point to where the user experience is really good. So for example, if you have a kernel tunable, like let's say something in SysCTL or something like that, you have to really figure out, do we wanna apply this now? How will that affect a running system? Or do we wanna just have it come back on reboot and let the user know, hey, you need to reboot to get this setting or manually go set it. So this process took, the review process took a while, but the actual creation of the role was maybe about a month and a half, maybe two months total. And I mean, it wasn't just me working on it, we had some people from some other companies, some other hackers helping out as well. But it doesn't really take that long. So I think that the toughest part is the analysis, like really looking at them and saying, which one of these do we wanna take? And then actually doing the Ansible work to go and change the config file or install a service or change the way a service is running or shut it off or uninstall it, that stuff is pretty quick. But of course, everything goes through OpenStackGarret and so that process can get a little drawn out sometimes. But yeah, not very long at all. I got two questions, if I may. The first one is probably just a yes and no. Can I use it to basically audit existing systems that they haven't configured using Ansible before? Yeah, so that's the beauty of Ansible's check mode. So you can actually just apply the role and do, I think it's dash capital C or dash dash check dash mode or something like that. And what it'll actually do is Ansible print out everything and it'll say, here's what I would have changed or I think it's like a different color or whatever. And then at the very end, you'll have a count of all the things that it would have changed. You could scroll back to the output and get it. You said you had to make some changes because rel and ubuntu are different. Wasn't the whole point of Ansible to kind of shielding that when abstracting that? Yeah, so yeah, I mean there's some nice features in there as far as like, let's say you're gonna go and install a package and maybe there's called something different in each one. There's, you pick up variable files and roll through it and do that. I think the big challenge we had was around, you know there's this thing that says, hey, connect to the Red Hat network and make sure you're connected all the time. And it's like, oh well, I don't really have that. I mean we could do landscape or something but that's a little bit different. But I think mainly it was kind of around those nuances between the systems. Sometimes there's things that were called differently and sometimes it was, we had to say, man, that doesn't exist in ubuntu. We have to go find something equivalent. Like there, one example was Pam fail lock in rel. If you actually try to log in with incorrect creds a certain amount of times, you use Pam fail lock to just lock them out at the Pam level. And we didn't have it. And so we went down the route of doing fail to band and trying to get controls that are almost identical to that. Thanks. No problem. Thanks for the question. Yeah, I have a question. So we have a stack already running and it has a lot of containers. So can we just take your Ansible and run on it? Should we be able to do that? So the containers themselves or the hosts that are underneath the containers? No, the containers themselves. You should be able to. There's probably some kernel tools, tunables in there that wouldn't make sense. Like, and it probably wouldn't have an impact on your deployment at all. It should work, but that's one thing we haven't tested in detail. It's mainly been in virtual machines and on hosts. Do you like host security hardening? But I don't see a reason why it wouldn't work. But there's some things like, I mean, we disable USB storage and things like that, we're in a container. It doesn't really have that big of an impact. Okay, thank you. Since you implemented this at-rex space, which I assume you have. So since that happened, have you actually survived an audit? And if so, can you describe how that process worked? So internally, we haven't deployed this on any clouds yet, other than testing clouds, staging, that kind of thing, because we're still working on the release. But if probably by the next summit, I'll probably be able to have more detail on that, hopefully. So this is a follow-up of one of the questions that was asked. I worry more about the 5,000 apps I've got running in my stack than I do the actual stack itself. The stack itself is important, but I got other people worrying about that. You talked about the hard work of figuring out how to turn the stig into the actual set of Ansible rules that you wanted, and you had a very tight domain. You knew what an open-stack hypervisor should look like and what it should do. How much work was that, kind of if I wanted to think about all these different domains, and how much commonality would there be, like if I started with your work, looked at it, how applicable might it be to other kinds of applications? Okay, so we're just thinking of non-virtualized environments or just other applications? My tenants. What's inside my tenants? Oh, okay. I got you. Those 5,000. The reason that I've got a stack. Right. Exactly. So from understanding you correctly, I think you could use this role easily, and you may have to translate certain things, and that's why we tried to make as many things just toggles or little variables. So that way if you did have a particular application that needed something enabled, like maybe it needed a kernel, tunable enabled. I gave an example about Neutron earlier with bridge forwarding, like that's kind of important. You should be able to adapt this role pretty easily without actually having to change the tasks. If you have to change the tasks, I imagine we probably have a bug that we need to go look at, and that needs to be a configurable instead. But I would say you could take this and go and apply it to an existing system. So for example, I run a few different websites, and I've actually gone and applied this inside the virtual machines as well, and had no issues with them. And some of them have some squirrely port requirements and some strange sockets to connect to and things like that. And it's been pretty good. Yeah, thanks for the question. This is a good talk. One question I have is you mentioned you, but have you run this on a CentOS-based system or at the host level? So our scope for this one has been only Ubuntu, because that's the one that we deploy underneath our clouds for now. Do you happen to know if anybody's tried it, if there's a lot of changes you have to make on the, because as you know, it's likely different, right? You know, where the commands or configs are. There's gonna be quite a few changes. So especially going to CentOS-7 from Ubuntu 14.04, your system D is a big change.  So it's on our roadmap of things we wanna accomplish. And if it's something you're interested in participating in, let me know, because that's definitely gonna be high on my list for the next quarter. Second thing in that regard, let's say my OpenStack services are running in containers. There's one level of indirection that I have to go into the containers to check things around. That's part of this. Already you have that baked in? So we deploy our OpenStack inside of containers as well. That's how OpenStack Ansible works. But so far we've kept the scope just to the host. So a lot of work that we wanna do inside the containers is kind of a subset of this. Like so we talked about some of the kernel tunables earlier. There's some that don't make sense or if you try and tune them in the containers you'll get denied and that kind of thing. But yeah, catch that with me after if you'd like to contribute. We can use the help. Thank you, I appreciate it. Hi, more of a standard build versus buy type question, right? So there's a lot of work to take PCI, SOX, HIPAA, all those standards are wrap them and turn them into Ansible. Where would you see the line where you can go and pull something off the shelf that can scan your whole subnet and rel, sentos, muntos, it's transparent. It's just looking at all vulnerabilities and we're ported on it. I understand open source and we wanna build it ourselves but what's the tipping point where you say, if we did this for STIG and PCI and SOX and we have to do this every quarter every time they release it's gonna take us X amount of time in hours versus pulling something off the shelf to scan subnets and get me the same results. Where do you draw the line on that? So, that's a good question because I've been in that situation before. I think really what it comes down to obviously is time constraints but there's one time constraint you really have to understand is that something like this is open source it's a little bit more fluid you can make adjustments where if someone comes in, thanks, if someone comes in with a closed source tool that maybe runs on a closed source operating system it's a little bit more of a challenge to go in there and tweak it. So a lot of people say, hey, I'm gonna go buy it because it'll be faster. Well, it's not necessarily. So really the goal here wasn't so much to scan for vulnerabilities. Like the audit mode was an afterthought. Like afterwards we said, man, it'd be great if we had an audit mode. I don't know, that's a really tough question. I think it really comes down to the situation and it really comes down to what that vendor's gonna do to partner with you. So if you do choose to go and buy, it's like, hey, what are you gonna do with me to customize this or how much customization do I have? I think that's the big question to ask. I think the open source is very nice because you can kind of stand on the shoulders of other people. So for example, while I was working on a couple of parts of this role, one of the folks in our community works for Comcast and he gave me some feedback and he's like, hey, look, we should do it this way and not this way because we run into this other problem and I was like, wow, okay, I've never run into that problem before. So we've had some other contributors show up and give more input on it and we'd had the security mid-cycle in San Antonio as well and had some people show up and give input. So that's one of the benefits of open source. You can lean on more people than just that one vendor. Hopefully that answers that, that's a tough question. All right, anything else? All right, well, thank you all very much. I appreciate it.


We're also following Friday's job support. What should we expect there? You know, it looked like the numbers today were strong. I mean, one of the things that's been very, I talk about in real money, a bear market in the banks. It makes no sense given how to wear employment is, but we know that the major trading banks didn't do that well. I caution people, there's 4,000 banks out there. Not only a couple do trading, but I do think that we're going to get a strong enough employment to be able to raise rates, which is what I care about. We continue to own city and key. Wells Fargo is a legacy, but Wells Fargo is getting cheap. Remember, Wells Fargo is the chipotle of banks. It's going to take 18 months before people forget what happened, and we're cycling through, but we're not there yet.


Attention Capitol Hill residents. This is a community notification of a new sexually violent predator in your area. Please stay tuned to the following short program for more information. Hi I'm technician Ron Hackett with the Denver Police Department. The sex offender registration and compliance unit at DPD is responsible for the registration monitoring and tracking of all registered sex offenders and sexually violent predators who live in the city and County of Denver. Here's a brief history of sex offender legislation in Colorado. Our state laws trickle down from federal government mandates. In 1994 we had the Jacob Wetterling Act which mandated that states would establish a sex offender list. Magans law of 1996 said that the public would have access to those sex offender registration lists. The Pam Litchner Act of 1996 stated that some offenders might have to have lifetime registrations and the Adam Walsh Act of 2006 unified sex offender laws across a country. In Colorado the legislature has determined that sexually violent predators by definition pose a higher risk to the community at large and therefore mandated that upon their release from the Department of Corrections the community must be notified. Sex offender notification in Colorado happens in two ways. The first is passive and ongoing through the sex offender registration process which is a list maintained by local police departments. The second way is active via community notification for those offenders determined to be sexually violent predators by the courts or by the parole board. Most sex offenders in Colorado are supervised by the criminal justice system in our communities. Most sex offenders engage in crossover behavior which means they may have been arrested for one type of crime but be apt to commit another.  There is no typical sex offender but all tend to be deceptive, manipulative and secretive. 80 to 93% of sex offenses are committed by someone known to the victim. Sexual deviancy begins in mid to late adolescence. Sex offenses are not impulsive.  The community has a vested interest in helping offenders to be successfully managed in the community. Sex offenders have the same need for housing and employment as any other citizen.  There are approximately 16,500 registered sex offenders in the state of Colorado. About 65% of convicted sex offenders are placed in the community on probation. The remainder are in the Department of Corrections or Community Corrections. Offenders may be caught for one type of offense but be at a high risk to commit another type. Crime of conviction is only one indicator of risk.  The offender's residents must be verified quarterly by the Denver Police Department. The full sex offender registration list is available by calling the Denver Police Department Identification Bureau at<PHONE_NUMBER>. Convicted felons and those with multiple convictions are posted online at denvergov.org slash police.   Now, here's a look at the newest sexually violent predator living in Denver. Here's an overview of the registered sex offenders currently living in Denver. There are 2,223 total living within city limits. In Denver Police District 6, there are 350. Precinct 623 has 93 registered sex offenders. Of those, 67 have felony convictions and 26 have misdemeanor convictions. Joseph Tobias Marquez is a sexually violent predator currently living in Denver. He's 54 years old and was born on July 10, 1961. He's a Hispanic male, 5 feet 7 inches tall, 178 pounds with gray hair and hazel eyes. He's currently living at 1317 Pearl Street, Unit 18 in the Capitol Hill neighborhood of Denver. Schools located within one mile of this offender include Dora Moore School at 846 Corona Street, More Middle School at 840 East 14th Avenue, Contemporary Learning Academy at 200 East 9th Avenue. Parks located within one mile of this offender include Civic Center Park at 101 West 14th Avenue. Bus routes located within one mile of this offender include Route 12 Downing in Washington, Route 15 East Colfax, Route 15L East Colfax Limited, Route 20 20th Avenue.  He's currently on Denver probation and registered with the Denver Police Department on July 31, 2015 to 1317 Pearl Street, Unit 18.  Joseph Tobias Marquez has been determined as sexually violent predator after meeting the following criteria. Criteria one, age 18 or older on the date of the offense or under 18 and tried as an adult. The offender was age 49 at the time of the offense. Criteria two, the crime must have been committed honor after July 1, 1997 and convicted honor after July 1, 1999.  The offender was convicted on September 27, 2010 for attempted sex assault on a child. Criteria three, the relationship to the victim was one of the following. Victim was a stranger to the offender or the offender established or promoted a relationship with the victim primarily for the purpose of sexual victimization. The victim was a 10-year-old female. The offender was known to the victim. Criteria four, positive results are the passing of a risk assessment instrument administered by probation parole staff and a qualified treatment evaluator. Positive results include an assessment for the presence of a mental abnormality, a level of denial regarding the offense, treatment appropriateness and motivation, presence of sexual deviant interests. The offender was evaluated by the Denver district courts with positive results determining him to be a sexually violent predator.