Good morning. Good afternoon. Good evening wherever you're healing from. Welcome to the series premiere of DevSecOps is the way This is going to be an awesome show the one that I will Thoroughly enjoy producing and hosting on a monthly basis Dave Do you want to take it over and maybe explain the whole program how you've got everything set up right now? Yeah. Yeah, thanks Chris. Um So DevSecOps is the way It's I'm used to I'm used to hearing that every Friday night in the fall But it we're really excited to bring security to OpenShift TV every month every monthly cadence. We've actually organized a bit of activities Around a monthly cadence of security information from Red Hat and and our ecosystem partners I'm a global solution architect focused on our security ICDs So I get the pleasure of working with a lot of great partners and understanding the security landscape and being able to Build out a point of view with with some of my colleagues at Red Hat around DevSecOps So we decided to have this monthly new series DevSecOps is the way To showcase a certain security topic every month So let and and I'll talk about that a little bit and then we'll talk about this month's Security topic and then we'll introduce our esteemed guests here who are next to me but let me just share my screen here and Show you all what we're planning So you can see here we have a monthly cadence starting this month in March all the way till December With different topics and oh by the way those different topics are specific categories that we have worked with the industry and with our partners to form a taxonomy around DevSecOps and the security methods and functions That you would need to think about when you're implementing DevSecOps So every month you can see that topic if you want more information You can see on the left hand side there. There's a URL a shortened red hat URL red dot ht DevSecOps and by the way The D and the S and the O do need to be capitalized Don't ask me why but if they're not capitalized you'll get a 404 Or you can email us and that doesn't need to be capitalized at DevSecOps help at redhat.com So this month is vulnerability month and We've although vulnerability is not a specific category That we defined in our taxonomy It does belong in what we call application analysis, which we'll be talking about in a handful months Upcoming but vulnerability analysis and scanning has been such a big topic over the last couple years especially around container scanning With our partners with our customers and so we wanted to dedicate the entire first month to vulnerability vulnerability scanning and it sort of duck tails nicely Into a certification program that we'll talk about a little bit later in this program called the red hat vulnerability scanner certification Which we just launched late in February So at a high level I should say we're gonna we're also going to be appearing in another open shift TV Show that we hijacked That's usually going to be in the third week as well this this month. It's in the fifth week of March We also have a set of three podcasts that we're planning to push out Every month and then blogs and white papers along to go with it So a lot of good stuff in 2021 around DevSecOps and security with red hat nice Yes, so I guess with that. I'll I'll let our guests here introduce themselves Jeremy here is from our products at your security team. So why don't you go ahead and introduce yourself Jeremy? Sure? I work with our product security team here at Red Hat. I'm part of our product security incident response team specifically my team Works primarily with our container portfolio Hence why I got pulled in to talk in this particular segment Yeah, glad to have you and of course one of the main things we're doing is bringing in experts to talk about these categories On a monthly basis Jeremy's one of those experts as well as Steve here on the IBM side. So Steve, please introduce yourself Absolutely. Hi, I'm Steve Wozepic I am the CTO for IBM's X-Force Red team and our our job We're the offensive security team within within IBM and we work with our clients to figure out how attackers get in So have a lot of good perspective from the field in terms of these container vulnerabilities. We'll be talking about Awesome. Well, I guess Chris if you didn't have anything else, I'll hand it over to that Jeremy to start What we wanted to do was just give you all an introduction into how Red Hat handles security and And I'll let Jeremy do that and then we'll talk about our new certification program and Steve will provide a lot of great insights around real-world, you know customer Situations around vulnerability scanning and his security practices Great. Thanks, Dave. Well, I guess the first place to start is talking a little bit about how Red Hat handles vulnerabilities How we how we analyze them and what we do with them. So Can you see the screen I'm sharing Dave? Yeah, yeah, so this is a nice little graphic We just recently put together to better describe how we do vulnerability assessment internally here at Red Hat We have a process fairly complex process of identifying vulnerabilities out in the market we watch Nailing lists upstream channels various feeds we pull that in we create tasks to take a look at those We do some initial triage on those on those initial tasks to determine You know if the vulnerability actually aligns to our portfolio based on our manifests, right? For products that we ship and build Our analysts then do some some verification along with engineering and kind of move into this triage and coordination phase I'm going to pause here for a second and highlight like one of the differences between how Red Hat operates and how Maybe some other companies operate product security for us is a kind of a hybrid process It's not a we're not a standalone product security team here at Red Hat that does everything from start to finish It's a company-wide effort within our research and development department, right? So When we're doing this triage, we we work very closely with the engineering team Who work very closely with upstream as well? So this is part of what you see here in that red section on that coordination We want to validate and verify what we're seeing with our engineering peers After that verification is done. We we work to remediate these vulnerabilities. So this includes filing bugs and trackers for For every product that is potentially affected So like we have a huge portfolio and and it's Important for us to To track, you know, these vulnerabilities across the entire portfolio and not just look at just a single product So when we get a request that comes in that says, hey, we think this particular component is affected or this particular product is affected You have to drill back down to the to the low level component and figure out which products consume that particular component I mean which version of that component was it was shipped with that I think a big selling point behind the the the methodology the way that red hat does analysis is Because we build our products and this is a key point, right? Because we build our products a certain way and we configure them a certain way And we ship them a certain way It's not always black and white from a from a vulnerability standpoint to say Yeah, you're definitely affected, you know The same way that a researcher may have discovered it right in the way that it was reported up through our national vulnerability database Are we may actually compile out? So the the the questionable code and if that's the case then you know that that particular product isn't isn't affected by that vulnerability Because the code isn't present So it's very important for us to staff analyst and work with engineering so that we could actually do that type of analysis We feel like that's that's a more accurate Process and that it's helping our customers better Determine their risk and whether they're affected The last thing that you'll see here in the green section We we do a lot from a recovery standpoint communicating this this back out We've recently launched security bulletins To improve the level of communication regarding major major incidents We we have a lot of tracking, you know to make sure that we Any of these trackers any of these products that are effective that it gets all rolled up and under our cvpages I think a lot of people out there are probably familiar with the the red hat cvpages It's a a lot of Companies similar to red hat do the same thing and we roll that data up into that cvp page based on All of this tracking and communication efforts. So that's really how we do the vulnerability analysis And how we how we handle these incidents Dave any questions before I go on to something else Uh, I do have a question. So, um How much of this do you think is done by the And I don't want to sound like I'm being mean to to them, but the national vulnerability database Right, uh, because I know that nvd and cdss Are sometimes seen as a standard, but for my for my understanding they just don't have the resources To test vulnerabilities and they don't have the products Obviously that we own to know if they're really affected or not. Is that accurate? statement Yeah, actually a couple of things on that You you mentioned quite a bit there. So I'm going to unpack all of that. First of all, uh in the the nvd Don't actually do the vulnerability assessment themselves, right? They're they're a storage database The communications a coordination kind of company or whatever you want to call it, right? um So it's actually independent researchers companies like red hat Across the world that that submit their information up to nvd And the problem with this is that you take a piece of code like open ssl for instance And it's used by almost every software vendor out there But there are different ways to exploit that code based off of how that software vendor shipping the code or configured the code, right? So the problem the fundamental problem with a single score a single rating out there in nvd is that It it's it's not inclusive of of those many temporal characteristics, right? So I think that's where we where we run into some challenges Sometimes we try to be much more accurate here at red hat with doing our analysis And you know, we may rate something as like a moderate issue because we've not compiled in that that bit of code Whereas if you go look at the nvd score, it may be rated much higher And you know from the flaw perspective itself, that might be true But you always have to take in those character, you know, those temporal characteristics as well The other thing that you said in your statement, and then I promise I'll I'll turn it back over to you You mentioned standards, right? So, uh, this is this is a very important thing for us I probably same thing for it's true for steve at out of idm, right? We leverage ovale cvss Cwe cpe. These are all done by mitre first.org. We work heavily with nist on their nist 800 dash 160 policies, right policies and standards owasp These are all like industry-wide kind of standards that We we adhere to and and we have made part of our part of our process in the terms of how we do analysis And how we just close back to customers No, absolutely. I mean you're bringing up a really good point about how do you figure out the attack surface the actual um You know the way that the packages I think to what you were talking about are by default configured Is that even really attack surface that is going to be focused on you know by the attacker? What have you so uh 100 percent? I think you know on the on the attack side what we're always trying to do Um, and what we what we use intelligence that we gather to do and x-force red is we also look at how much In the same lines of what you're talking about cwe into these others capec You know another mitre standard and mitre attack and we're trying to you know, we We have into intelligence that shows us how much uh attackers are weaponizing those exploits and and Those exploits is so exactly to your point When you have a whole bunch of things that are that are critical or coming out the same score in cvss What do you focus on? Things that have the most attack surface right it's just all of us are trying to get to that same place of measure Yeah, I can imagine steve you you've probably heard more than once a customer say i've got all these critical vulnerabilities You know and then you have to be like well We got it. We got to do a little bit of you know triage or manually really find out if you're affected Absolutely right. I mean that's what we've really built a lot of our services around is is helping clients to do that And what we always advised regardless of if we're working with them in this capacity is is to be is to take into account that context That jeremy was talking about there's what they call the temporal factors that feed into cvss, but also just Are these vulnerabilities really being targeted? Are you hearing about them? Are they kind of like these more wildfire based attacks? Tempering that with the ones that you know are have been bad from years past There's one that's really common. You've heard of you know the shadow brokers ms 17 010 Clients still have that that's that's from several years ago It is absolutely the thing that will get targeted by attackers if it's there And so ensuring that you're not just always chasing the the newest shiny one But focusing on vulnerabilities that you that we know are being heavily targeted by attackers in the past and really You know honing in on those cool Can I can I say one other thing? Yeah, absolutely Um on the on the severity ratings themselves And I'm curious to kind of get Steve's thought on this as well. One of the things we've noticed Was that the industry seems to have kind of over the years kind of incorrectly started using those those severity ratings to kind of gauge risk Right when really like our position on it is that it's supposed to prescribe some kind of order for remediation Right. Absolutely prioritization It's it's a great point and cvss Honestly is a good metric if it's used, right? It's it's it is it is lingua franca of of of our space However, to your point it's being used to measure risk when really as Had a number of cvs that i've written myself and vulnerabilities i've discovered and when You you go out and you use that cvss calculator Everything that you're doing when you create that cvss score is the worst case scenario You're not measuring how much time it takes to make a To make an exploit and frankly You can kind of shoot yourself in the foot as a researcher The calculator because when it gets to that point it says attack complexity It's very easy to sort of pop your collar and say oh, it was very very complex It was very very hard for me to break into this, you know, no mortal could just do this like i'm i'm the one I'm the only person that can do this so you're going to set the attack complexity really high Which is going to bring that value down But think about this if i create a metasploit module for that if i go to exploit db And i show how to do it attack complexity goes out the window, right? You're not talking about that anymore I've just given you the ability to do it by running a script That's the piece that is one of the biggest troubles we have is if you're just using cvss Imagine you're taking cvss 10s that were privately reported that don't have any public exploit code And saying that those are more important than something like ms 17 o and o which is You know, it has has a very high complexity of attack Not that hard if you're downloading the the scripts to to break in right which of course all attackers are doing Yeah, I would say i'm glad you mentioned the calculator. I was going to mention that as well It's right there on the on the nvd site. So they know Um that their scoring is not really You know, it's not potentially risk for you. It's it's a guideline, right? It's a it's a recommendation to prioritize and then You know add in your own environmental and temporal metrics to to figure out if you're really um exposed And frankly, I think it was created originally to Take from the researcher and give to the vendor. I think that's what is primary purposes And then as you know, there's that little bit of negotiation that happens in terms of how how high is this really, you know How high a score is it and of course the researcher is always going to think it's a 10 and the vendor's always going to think it's a three That's somewhere somewhere in the middle. You figure figure it out, right? Yeah Yeah, and so jeremy a lot of times um your red hat Has a different score and they have different severity Categories can you just talk a little bit about? that in terms of how we how we score and Categorize these cds Well, I think you know first thing I'd say there is we don't have a different scoring system. So to speak, right? We we use the same low moderate high critical that the industry uses But we do score things based on the temporal characteristics. We talked about just which is previously We do score things differently than what a researcher might have scored it Um now some of the things that we recognize that you know your customer you're looking at this information It gets very confusing, right? So um, if you look at our cbe pages, we've we're we're trying to to help Kind of pull the curtain off of that that mystery so to speak, right? So we do a comparison of the nvd score versus the red hat score Our team works very closely whatever we feel like, you know, we if we've we've scored something differently I'm talking about scores for a second not the rating, right? But if we've scored something differently Then we have a whole process where we reach back out the nvd and we submit our proposals, right? And and are just our reasons why? Um, not based on just on the red hat specific, you know portfolio But just from a flaw perspective standpoint, we try to do those re-scores to help those the nvd scores become a little bit more accurate as well Um, but you know rating wise that that that's a very uh Score, yeah, sometimes they're going to be a little bit low and so we We uh have statement text in our cbe pages where we try to to Clarify that why I just looked at one the other day. It was like, oh, well, you know, this is why right? We don't include that bit of code. Um, and we felt like that's useful and helpful Did that answer your question Dave? Yeah, absolutely. Yeah, of course all this stuff is pretty publicly accessible um, even sometimes bugzilla cases, right? You could log in and see see what the developers are talking about or how it's being affected So yeah, I usually find those pretty helpful and understanding, you know, the root cause Or why why red hat determined, you know, this category or this score Awesome, how about we jump to uh containers a little bit jeremy? So your perspective if you can give us some insight on what we do with containers The container health index how we grade those how does that all work? Okay, so there's You ask these these questions that are kind of, you know, big big overarching questions So I think the first thing to say with containers is It was a different shift in them in the the industry, right?  I know my uh manager here at red hat has written several blogs out there for the red hat blog Blog space that to kind of explain this a little bit But we took a different approach with our container registry and how we Were scoring, right? So we instead of looking at it from a vulnerability standpoint, we look at it from a time standpoint because containers consume that content from something else that and that those Where where the source on where it pulls that content? That's where that vulnerability technically lives, right? And it's patched there So for instance, if we take a look at our universal base image, right? So our ubi image the pulls heavily from rel, right? The the vulnerability is patched in rel the the rel content then is then pulled into A spin right a rebuild of that ubi image So what we're trying to display with our container health index is we're trying to tell customers How what's the risk from a standpoint of are there unpatched vulnerabilities, right? So if there's a vulnerability that we know is fixed in rel, but it wasn't applied to that container yet Then that's the concern and specifically how long has it gone, right? Because again, it's it's and I think my manager and his blog used this quote. I really liked it. It's like You know, it ages like milk and not wine, right? Wine ages really well milk Turtles sours, right? So the idea with containers is the longer they sit out there the more sour they become The more vulnerable they become and so we're trying to to represent that in the container health index So for example a container. I'm sorry a grade a there is no known Critical or important vulnerabilities that have been Unpatched in that container something that's grade b. You're looking at like a 37 to 30 day time span and We've got these published, right? So I won't repeat all of them, right? But we've got grade b c d e and the whole idea is you can look in a container That's like a grade e or a grade d. There's a significant amount of risk there That container has a lot of unpatched vulnerabilities that are known, right? There's actually a known fix for them Yeah, I think I think that's a great point and something I learned a while ago As well as that the container health index is not You have a container that has these known vulnerabilities, but You have a container that has these known vulnerabilities with known fixes and aren't applied yet, correct? That's correct. Yeah, and so as we'll talk about a little bit later We've got our great partners in scanning and and they see reports They try to compare that to the container health index and it's kind of an apples to oranges report Because you know because the container health index is not showing all the vulnerabilities all the cvs That might be still yet to be patched that affect that container Um Good point. I guess I guess Steve do you see a lot of containers scanning containers? Um dealing with security around containers. Absolutely. You know this topic today is very important because this is the primary issue um, you know before we've had You have that that situation with containers, right? They're sort of the new almost vm images in a way Not really because they're limited, but it's the same concept where you get something that works You know as the developer will all been there. You have this base image. You really like We're gonna, you know, it's got everything you need it has read this or what have you on it and you Is that to run your application in it and you're just you get very Attached to that image because you know it works You know the version that it's at all the underlying pieces are together And it's using all these different libraries that you know are sort of working together and uh, that's static It's a terrible thing that we're like that because It causes us to reuse the base image over and over and over and over again And any time you're doing we do work with clients who are doing container scanning Uh tools, you know like claire that are that are checking um, um, how you know what vulnerabilities lurk in some of these um Uh containers and it's it's always those base images It's always those old versions of libraries that if you were running A rel server and you were just keeping it up to date as you would they would get fixed But the container image the base image it's all sort of married together. It's all kind of dependent on each other And so it's not Something that you think about a lot in a developer context something of course on the security side We always point out and try to push but sometimes there's a fair amount of detangling Underneath let's say in what you said of one of those d or e grade containers You might be responsible for doing all that detangling if you want to keep using it And you fix one thing that's in the base image and then all of a sudden your your redis server doesn't work anymore And you have to figure that out And that's what's great about having the scoring system because you're you're really The the how well maintained it is because it's an ongoing containers are a moving target. They have to be They have to be kept up and and you're in you're being able to grade Is a great thing because then from the day one you can say I'm choosing this because they're going to keep up to date and avoiding that whole problem that's gonna that's going to rear its head pretty quick Yeah, I think it's a it's a good segue into our next topic. I guess before I go into there I haven't been monitoring the chat feed chris. Has there been some questions or uh, no not yet Okay, but it I'll let you know Sounds good. Sounds good. Um, so yeah, I guess What I wanted to go to next is talk about container vulnerability scanning Um, and so let me uh, let me share my slide again here. See where is it? And I guess, um I don't know steve how many of your customers look like that little girl No Well in terms of in terms of when they start or the problems they're inheriting Um, especially when you start getting a scope of it. Yeah, I think that's that's fair So by the way, this is a legal photo that I'm using. It's actually of my one of my daughters And her mom was actually pulling her hair out which by the way is what our customers feel like when they um scan Containers and they see a huge list of vulnerabilities And then they might compare that to red hat and red hat says no no no the container is good And this this is actually it's not tied to one scanner Um, it's not tied to red hat. It's it's sort of an industry issue just because of the challenges of being able to You know identify The the right components inside of a container Being accurate with that understanding if it's something's back ported or not making that match To cvv cve and all the stuff that we've talked about like even though CVSS says it's critical. Is it really critical in your environment? so red hat About six months ago formally started an effort to help resolve this help to provide What we call minimal discrepancies between our partner scan results and And what you see at red hat And i'm happy to say that we have You know, there is a happy ending same same daughter but much happier And there's a happy ending that we now have a certified Vulnerability scanner certification that we launched on february 23rd Um, which was about a six-month effort with our partners to get set up We took a good number of them through a pilot phase In order to understand what they needed and what we needed But there are a set of requirements and you can go out and find all this information online Where our partners needed to meet In order to achieve certification And you know, some of the requirements are that you have to pull from the right feeds That you are showing red hat data in in your ui um, and so we feel like this will really help to Minimize, you know the amount of discrepancies When our partners are scanning red hat supported data and you can see the We announced the certified partners there in the 23rd aqua new vector cystic And you can see the other partners right now that we're working with anchor j frog parallel to sneak And synopsis that are working towards certification. We've got about 20 other partners that we know of that are out there But if you are a partner and you're interested, please feel free to contact us And we can help you through this certification So we really think that you know, this will lessen a lot of customer frustration In in the market and um, and yeah, we're pretty excited about it Um, I guess steve, what do you think about that certification? Do you think that'll help your efforts? You know what I what I see with that is In terms of the the and we work with a lot of those technologies as well from the other side So imagine that we're taking in data and our clients are taking in data from sneak and taking in data from prisma aqua you know these technologies and What causes a lot of the work in terms in the field is When those scanners will maybe look at a container registry Without the maybe because they're just not armed with the context. I think you're providing in some cases to Have um, maybe we'll spot something that is a maybe a problem But it's not as much of a problem because of the specific red hat release train So for some of the you know the context that uh, jeremy was providing earlier Sometimes these vulnerabilities are patched in a way where you're keeping the same version for example of the of the system or of the package That is listed as vulnerable in nvd, but because of certain considerations in the way that configuration, you know configurations done Um, doesn't have the same attack profile. It's not the same thing, right? It's been either It's been either patched by red hat or it's been changed in some way Everything with vulnerability management is about getting rid of those false positives and focusing in on the things that are actually the most important from a risk perspective So the more Context that those that those scanners can have going in the better. They're going to Build that contrast and the the easier it's going to be for the for the consumer for the client Working with those result sets and in turn for us helping them to remediate those vulnerabilities Yeah, Dave. Can I can I say one thing on that like and uh, I suspect steve will completely agree. I hope Containers are are complicated From the standpoint of understanding the software bill of manifest, right the the um, what's in it I think part of the challenge for our scanning vendors over the years has been to identify What's vulnerable and what's not and and we you know back and if you look back at the the early days of rail It was really much easier to kind of scan that and look at a name version release Stream right on a package and say, okay Well, it's newer or it's older right simple math with a with a container these days, especially in The context of you know red hat tries to Provide maintenance for for product versions for as you know as long as you can for for a customer, right? Which means that we end up back porting a lot of patches back to uh, A particular mainline branch of code, right?  How are you supposed to properly identify? Whether that particular branch had the patch or whether it didn't have the branch You can't just simply rely on that name version release string anymore, right? So part of what we did with this uh scanning certification It was like empowering the scanning vendors with more of that context to say, okay We've done a lot of the heavy work for you. We're gonna we're gonna help you figure out how to identify What's actually in in that container and then we're going to give you that context in the in the form of like ovale files, right? So that ovale file has tests. It has information On the rhsa's that fix it what the status is for you know each cde It's about using that context properly, right? So um, I don't feel like we're You know putting all of the vendors on the same playing field so to speak I feel like we're we're giving them all the same information Um, and then letting them run with it No, I Yeah, 100 percent agree and especially about the complexity because you have those, you know you Containers as being just uh a singular thing you have to realize, you know when you're building one There's a big interplay between the base images what you're starting with and then then adding things on to it It's like a lot of for building block Your point if it's not aligned with the rsa rhsa's and that's what a lot of the certification is about obviously It's it's they say it's just not going to have the right context and And you'll spend a lot of time will spend a lot of time working with our clients But our clients we see them spending a lot of time chasing things to ground Only to find let's say after three four hours of research. Oh this version like you said I might have lost Steve there a bit One of our clients having spent that much time, you know chasing those kinds of things so absolutely right Sorry, Steve you you kind of froze up there for uh, oh really? I'm sorry I was just in a long-winded way agreeing with uh with jeremy around um Preventing our clients from having to run around and look to prove out that this this version of something was backported and I think that uh, this this really helps to save us time on that Yeah, I like one of the things you said there is that you have your base image, but then you've got stuff That our customers add into it their own applications, right? Which by the way, this certification doesn't cover because red hat doesn't Care typically or know about the packages you use in those applications That's why we value these scanning partners, right because they have the Intelligence and that's their value to help you understand risk vulnerabilities in your applications outside of red hat scope, right? um The certification though will definitely help to minimize a lot of frustrations just on the base image. I mean you could have Hundreds of cds in the base image And wouldn't it be great not to have to go through all the ones that are critical and high To ensure that, you know, they're you're not vulnerable. So Well, cool. So jeremy you mentioned oval um red hat I don't I don't know if we could still say recently, but um, we moved to a second version of our oval feed This was a couple years ago, right? Would would you mind talking about some of the Enhancements sure. Yeah, I think really enhancements is a better way of describing, right? It's the standard itself doesn't didn't really change. It's not like there's a version one or version two of the oval standard we we Made improvements in terms of how we classify how we structure the oval feed Um, I think originally we were just kind of dumping it all into like single single files And that didn't really work for from a portfolio like organization standpoint. So we actually break up our oval files now based off of The the base images so to speak so rel 8 rel 7 And like if you went into our oval feed right now our v2 oval feed and went into the rel 8 folder You'd see all the products that that are built consume content from rel 8 like open shift, right? We have several files there in that in that oval directory. We have An oval file for uh, that that includes unfixed CVEs We have an oval file that that includes us content and some of the old some of the streams that we maintain for long periods of time And the trick really with these oval files is to figure out which ones like I mentioned previously Which ones to use right depending on what you're scanning If you're scanning a Open shift, you know, you have to use a rel file plus an open shift file, right? Because there's a lot of content from rel that's also consumed Um, and that, you know, otherwise you're you'll end up with not necessarily false positive or false negatives Um, so you want to make sure you're you're looking at the right The right files any specific questions beyond that Dave? No, I think I think that's good. Yeah, um, that was the basis of our certification the main the the main requirement is to consume that um those files and then we actually Uh, you know used Claire and the Claire team was very helpful and um helping us formulate sort of the details on Recommendations we didn't we're not the experts the scanner experts as our partners are but Um, we use the the Claire code as a reference to say, hey How can you parse oval? You know to show red hat data to show the appropriate red hat data We were requesting so of course Claire is open source and you can find all that information You know in github. Um, so no that was good. Um I guess anything else in the certification I showed um a couple slides about the problem and uh and some of the partners Um, anything else Jeremy or steve you want to chat about that? If not, I've got a couple other items to talk about Um, I'll just I'll also mention as well like it's important for us to make sure that we continually evolve All right, so we're we've we consider all of these scanning vendors partners with us And we meet regularly with them to talk through Challenges that are still ongoing in terms of how to better identify the content right or If there are new You know standards so to speak that we should be taking a look at so Yeah, we continue to meet with all these vendors on a regular basis Yeah And I and I'm in a partner team here at red hat. So I talked to them on a weekly basis But yeah, you have that working group, which is really great as well Well, cool. Yeah, so I mentioned, you know, this month is vulnerability analysis. Um, There'll be another open shift tv session in a couple weeks Um, and then we'll be dropping three podcasts as well Now I wanted to share sort of the A byproduct of our efforts around dev sec ops Let me share this screen present it um, so I mentioned the categorization we came up with Uh, nine categories. You can see those categories here on the left hand side And we have 10 months as I mentioned vulnerability sort of bubbles into application analysis Underneath uh, those categories You can see all the different items there. There's 34 different security methods And so we were able to take those methods And work with the industry work with our partners to plot those against a dev ops pipeline like you see here life cycle and um, which serves as a basis To understand and to start communicating and help our customers consume this information a little bit better You know, for example, if if you're starting dev sec ops, or if you have it We can come in with A solution joint solution with red hat or one of our partners and say hey Have you thought about secrets vaults across the entire Life cycle or what about get ops and config management? Um, or are you checking your network policies during build automation? So what we've been able to do in certain situations is work with our partners to map Where they excel at and enhance and extend red hat capability and of course where red hat Has capability as well and red hat as you would imagine has capabilities all throughout the Life cycle here very strong in the platform security side of the house so Things like a secure host rel and And cryo the container platform Isolation and cluster hardening with compliance, which will be one of our monthly topics as well And then december will get into a lot of rel a red hat type information around platform security but I just wanted to Throw this up here to give everybody a basis Of why we're talking about dev sec ops and and sort of how we're bringing this to the market as well awesome Yeah, I guess i'll just leave this up as an ending slide here This month again vulnerability next month compliance So if you're interested, maybe you're in the federal space or Um, you know, you have to worry about c i s benchmarks or pc i We're going to have some experts Join us to talk through compliance as well And then you know, we'll go through the year with these different different categories Fantastic, this is a wonderful lineup of content you have lined up for us here. I really appreciate it yeah We're very excited Yeah, so when is the next show a month from now? Right? No, the next dev sec ops is the way show. Yes is yes usually the third Thursday thursday. Yeah of the month Yeah We're going to have another open shift tv show in two weeks And that's going to be around vulnerability scanning as well right awesome And that's going to be with one of our partners Fantastic All right Well folks Let us know if you have any feedback about the show what you think you can always reach me C short at redhat.com and I can ferry the The information back down and if You Want to follow or ping me on twitter just at chris short on twitter That's for anybody, you know out there that has any questions and wants me to you know Get some information for you always available for that purpose. So thank you everyone for watching. We really appreciate you Yeah


Here we go, semi-final one. That's a great start from a man in white, Martin Vashulik, never in doubt. That's why he picked Gate 3 in white. I understand it totally, never in doubt. Smart-slick charging on the inside run. Okay, mate, whatever you believe me. Vashulik, the leader, then in front of you, let's check it. Frick's coming on strong as well. He's going to go into the dirt on the back kick. Rabbi outside, Max Frick. Here he comes, charges hard around the outside. Frick really pining it on. Vashulik, the leader, and here comes... Vashulik, the Vashulik, Vashulik is bursting to life. Max Frick set for the final. Yeah, Frick looking brilliant. Knows this track inside out. Of course, Vashulik has won, let's go. Close! Slinger of Vashulik's got there. And it's Max Frick who has got into the final. Unbelievable stuff here. Well, fans of Bellevue in Manchester will be not surprised with that. They see that week in and week out from Max Frick. Brilliant ride. 10-dollar, and what can Everson do as he tries the outside run? And some charges on the inside, Leon Madsen comes into second place. Everson has the advantage right now. It's on to second as Smarsling threw everything out in there. Smarsling tries the inside run to turn to the Grand Prix. For this fella, Niels Christian. Everson makes the final. As does Leon Madsen. And Nielssen is here, the national team manager tonight. Wow, didn't see that. Smarsling threw it away, and a clash here. Yep, he number seven it is. Madsen hasn't made the best of starts. Liguta has got there. Watch out for Ligra in yellow. Ligra comes high and wide around the outside. Has he got the drive? Liguta just holding on to Ligra. Superb stuff. And now Madsen taking up the challenge. Chasing hard after Liguta. Asked himself in the second place. Stational speed limit.


Hi everyone, welcome to today's webinar for the Cincinnati Gives Challenge. We are going to wait a couple minutes as we still have people joining. In the meantime, if you could use your GoToWebinar chat module and let me know that you can hear me, that would be great. Maybe let me know the name of your pet or your favorite place to eat in Cincinnati. I would appreciate it. We've still got a lot of people joining so we're just going to wait one more minute and I appreciate everyone who chimed in to let me know that they could hear me. Okay, I think we're going to go ahead and get started here. Welcome again to the 2019 Cincinnati Gives Training webinar. My name is Dawn and I'll be leading you through today's presentation. I have a couple of housekeeping items to note before introducing Ivy and jumping into the webinar. Just so everyone knows, the webinar will be recorded. It'll be posted in the toolkit on the Cincinnati Gives Challenge website under the Resources tab and you can use the GoToWebinar chat module to send across any questions that you have during the webinar and then we'll get to those after the webinar's over. We'll have a Q&A session and if we aren't able to get to everyone, I'll be sure to email you back afterwards so that we can make sure to get your questions answered. So I've got Ivy here from Cincinnati Magazine. She and her team have been working really, really hard to make this year's challenge an awesome one. So hello Ivy. Hello, can everyone hear me? Can you hear me, Dawn? Yes, I can hear you. Okay, great. Welcome everyone. I just want to take a few minutes to say hello. We are so delighted that all of you are participating in the Cincinnati Gives Challenge this year and taking part in the webinar and really taking advantage of this opportunity to learn some great strategy and a good roadmap for success. I think that the Cincinnati Gives Challenge is a wonderful opportunity for all of you to raise your end dollars as well as gain access to new donors and share your missions so we want to do everything we can on behalf of Cincinnati Magazine and Mighty Cause to make sure you're successful. So I think this webinar is great and Dawn and I, the Mighty Cause team and the Cincinnati Magazine team have worked very hard on the toolkit at CincinnatiGives.org to hopefully equip all of you with the tools you need to succeed in the challenge and raise the most money possible and hopefully win some prizes. As all of you hopefully know, we have raised over $750,000 since the Gives Challenge started in 2016 and our goal this year is to top the million dollar mark. So your success is most definitely, hopefully you know, I think everyone has seen that new this year, the challenge timeline has been accelerated from five weeks to ten days which I think is really going to allow us to sustain momentum and build urgency for your causes and just create a lot of excitement and buzz. But that also means that there's not much time to really start planning once the challenge kicks off. So I think taking this time now, taking advantage of the resources we're providing in the toolkit and building out a plan and working that plan is really going to help you be successful and I know Dawn will definitely jump into all those details shortly. My little plug is to make sure that you're consistent in utilizing all the tagging options on social media for Cincinnati Magazine so we can share what you're posting. So be sure to tag us at CincinnatiMag and use hashtag CincinnatiGives and all of your social posts so we know about it and can share all of your great content and be sure to mark your calendars for our kickoff party on December 2nd. You will be receiving an official invitation but we would love to invite you as well as members of your team and new this year we would love for all of you to invite your board members to join the party. It will be from 4 p.m. to 6 p.m. at the Metropolitan Club on Monday, December 2nd. So mark your calendars now and we will be sending out the official invitation shortly. And lastly, we've been busy securing a ton of TV interviews and PR opportunities around town to promote the challenge. So I just ask all of you prior to December 2nd, if you could not be on air or talk about it with any media, we would like to be the ones to kind of announce the challenge but once it kicks off on December 2nd, obviously, scream it from the rooftops. So I think that's all I have. I'm always available. My email address is right there as part of the presentation so please don't hesitate to reach out. I would love to help any way I can. Thanks. Thanks, Ivy. Okay, let's just jump in. So here's a look at today's agenda. We're going to be going over some of the basics. We're going to touch on getting started on the platform and all the prizes that are available. Then we're going to move into a deep dive on strategy and utilizing the tools that come with your Mighty Cause account. And then lastly, if we have time, we're going to have a Q&A session. And again, if you have a question while I'm presenting, please type it into the questions box of your GoToWebinar panel and we'll cover it at the end. And if we do run out of time, again, I'll be sure to email everyone so we can get all the questions answered. And if there's a running theme with any questions, then I'm going to make sure I add them to the FAQ on the challenge page so that you all have access to the answers. Okay, so the 2019 Cincinnati Gives Challenge is, as Ivy mentioned, a 10-day long event that runs from December 2 at 5 p.m. to December 12 at 5 p.m. Eastern. It's an online component to Cincinnati Magazine's Guide to Giving. The registration for the Cincinnati Gives Challenge closes on November 25. So if you haven't registered yet, be sure to do so as soon as you can so you have as much time as possible to prepare. The really awesome thing about this giving event is that there's going to be $35,000 in prize money and lots of opportunities to win. So we'll go into the prizes available a little bit later on. So this is the home page for the Cincinnati Gives Challenge this year. You'll see the URL here on the left. I would definitely bookmark it. Once the challenge starts, this is where you'll see the leaderboards that will indicate what place you're in as well as your bonus challenge standings. So make sure to bookmark it now so that you can easily reference it once the challenge starts and you have it when you need it. This home page has all the tools that you'll need to. You'll see the register button is right there at the top. Again if you haven't registered yet, this is where you can go to do so. The challenge home page also has these tabs that you can see in the visual that include the rules and prizes, resources, including the FAQ and toolkit, and information about Cincinnati Magazine's Guide to Giving. And Ivy talked about the toolkit briefly. We're going to go into more detail about it, but I would very highly recommend checking out that resources tab and accessing that toolkit so that you can really take advantage of all the awesome guides and resources, planning checklists, and things that are on there.  This is a, the to-do list is a great place for you to get started if you're not sure what to do first when you access your account for the first time. This list is located on the home screen on your non-profit profile right under your metrics. There's five basic items to complete. You'll need to add a background image to your page or use one from our gallery of stock background images. You'll need to upload a logo. That's going to represent you throughout the Cincinnati Gifts Challenge. You'll want to add a story, also called a description, that tells visitors to your profile about what your non-profit organization does. You'll want to build a thank you page to thank donors, and you'll want to make sure to set up electronic fund transfer so you can get your disbursements through direct deposit. If you click the links in your to-do list, you'll be taken right to the spots on your profile where you can complete that task, so it's really easy for you to complete the list. And the to-do list isn't required, but it's a, again, it's a really great place to get started in terms of customizing your page, and you'll want to do that before you really get into the weeds of planning your campaign. And if you do need help or you're unsure how to complete any of the items, then just let us know. Our email is support at mightycause.com. We also have a support library that you can access where we have walkthroughs and videos that can help you complete the list as well. And then we also recommend taking some time to get to know your dashboard. Your dashboard, which we like to call your mightycause manager, is the admin bar that appears on the left side of the screen when you're logged in and on your nonprofit's profile. So you can see in the visual here, it's that black bar on the left-hand side that kind of opens up when you hover over it. You'll automatically land on your welcome screen or home screen when you log in, which is where you'll find your to-do list, as well as metrics for your nonprofit. Then under profile, you can edit your page in the page editor. You can adjust your page settings. The page settings under profile is where you can set your goal for the challenge and enable a progress bar on your page. You can also go to live view from this profile section of your dashboard to see how your page will look to visitors without having to log out of your own account. And then next in line on that dashboard is reports section.  You're able to preview and export your donation reports and can view and manage your disbursements. Part of that to-do list is setting up EFT. You can do that right here under reports in the disbursement section. Just so everyone knows, signing up for EFT allows you to receive your funds faster. We distribute EFT disbursements twice a month. Funds can be dispersed by check. Those are dispersed once a month. And there is a $5 administration fee for check disbursements. If you do have any questions about fund disbursement, you can email supportatmightycause.com. And our support team will be happy to help you. And then next on that list is the fundraising section. Your donor experience section, which we're going to talk about briefly here in a second, as well as matching grants, are both in that fundraising section view. Two very important pieces that you'll want to remember. And then lastly is settings. In the settings, you can customize your organization's URL if you want, and you can add or remove admins from that settings tab, as well. So your profile is the face of your nonprofit for the Cincinnati Gifts Challenge. So you're going to want to make sure that it looks good and it represents your organization. And just so you know, your profile link is the link that you'll share with your supporters to ask them to donate to your Challenge page. So to share your page, just copy and paste the URL into an email or social post or wherever you're advertising the campaign. So as you're going through your to-do list, you'll want to customize your profile to match your brand. There's two ways to start customizing your profile. You can click Profile in your Mighty Cause Manager and choose Page Editor from the submenu.  The other way to customize, as you can see in the visual right here, is to click Profile, and then the little pencil icons will appear everywhere that a section can be edited.  If you're using a DBA, you can change your logo, you can edit your theme, et cetera. OK, so one of the really awesome things about Mighty Cause is just the amount of control that your organization has over the donation process and the donor experience. This is definitely unique among fundraising platforms. And from our donor experience tool, which again you can find in the fundraising section on your Mighty Cause Manager dashboard, so from this donor experience tool, you can opt into collecting the information you want from donors, like addresses and phone numbers. You can also set up custom suggested donation amounts, and you can add descriptions to help tie those amounts to items or services your nonprofit provides to help strengthen your appeal. The donor experience also allows you to preview the whole checkout process without actually making a test donation, so you can see what your final process looks like and use that to edit yourself if needed. Donor experience is also where you'll go to set up your thank you page. This uses the same text editor as your story in your profile, so you can add text, you can add links, a video or images, you can add a custom call to action button that tells donors where you'd like them to go next. A cool idea would be, for instance, asking them to sign up for your email list. There's a lot you can do in the donor experience tool to optimize your campaign and customize that checkout process for donors. So definitely this is part of the setup process, but it's really a strategic piece as well, so you want that donor experience to be really awesome for them, so make sure that you check out this donor experience section and customize it if you haven't already done so. And then because it's so important, we're going to hit on the toolkit resources again. There's just tons of tips and tricks and FAQs in this toolkit section, so whenever you get a chance, go ahead and just, you can bookmark the direct link to this toolkit so you can access it at any time. There's templates you can use for your email and social media. You can either use them directly or you can help them inspire you to write your own. The toolkit is also where you're going to be able to find today's training recording. There's logos and graphics for the Cincinnati Gives Challenge that you can download and start tying those into your messaging and posts that you're going to be putting out there. So definitely check out the toolkit if you haven't already and refer back to it as you're planning your campaign. And then, of course, if there's something that you know that you could use or would want to see, let us know because we're happy to continue making this toolkit better for you. We want you to be as helpful as possible. So if there's something in there that you think should be in there or you'd like to see more of, then definitely let us know. Okay, so now I want to move into talking about all the awesome prizes and then we're going to talk about strategy and how to win those prizes. Okay, so the Cincinnati Gives Challenge is offering grand prize grants to the top five organizations on the leaderboard. The leaderboards will be on the live event site. So as soon as the challenge begins, participating organizations will start getting tracked by the dollars they have raised. Now it's important to mention that only online donations made through the Mighty Cause platform count for leaderboard totals. So this is a big reason why you want to push your donors to give online. You can definitely record a check that's given to you and there's no cost to recording a check. It's just not going to be reflected in your leaderboard totals. It will be reflected on your organization's page total, but it won't be reflected on the leaderboard. And basically, this is because we don't and can't verify offline donations. So we just don't include them. And the leaderboard is going to reflect your cumulative total from the time the challenge begins at 5 p.m. on December 2nd. So it's going to be a running total of everything you've raised online. And here you're engaging in some of that friendly competition for those top prizes.  There's also bonus challenges available, which is awesome. And there's essentially a new bonus challenge just about every day. Since this year's Cincinnati Gives Challenge is 10 days long, we basically it's going to be like a boom, boom, boom type event. There's going to be bonus challenges almost every day. There's going to be lots of prizes given away. It's going to be super exciting and fun. So my suggestion is to go to that CincinnatiGives.org site. All of the bonuses are going to be listed there. As you can see, there's going to be a Giving Tuesday Specific Bonus Challenge. Yeah, you can see all the different amounts here. There's going to be tickets given away, digital ad spend. It's going to be awesome. So there's lots of stuff happening, lots of stuff going on. So definitely check out the prizes on the CincinnatiGives.org page. So you can see everything and start planning your strategy. And a couple points, the Meet Your Match Challenge, that runs through the whole campaign. And let's see, oh yeah, and all of the method of entries and the dates associated with each bonus are also on the challenge site, CincinnatiGives.org, under the Rules and Prizes tab. So again, make sure you go there so you can see all the information associated with each bonus so that you know which ones you're going after and which ones you want to try and win. And then one important thing to note, this year there are limits on how many of those bonus challenges you can win. Each organization is eligible to win two bonuses plus one grand prize. So once you win two bonuses, then you're no longer eligible to win another bonus. So because of this, I highly encourage you to go to that prizes tab on the challenge site to see which bonuses you really want to go after so that you can start preparing for them now. And that information is on the challenge site, the limits for the prizes, but definitely let us know if you have any questions. Bonus challenges will also have live leaderboards. So you can see where you stand at any time. And then, of course, the key to winning those bonuses is getting your donors invested and helping you climb the leaderboard. So keep tabs on your position on those bonus leaderboards, as well as the big leaderboard, and keep your donors and supporters updated on where you are. Continually emphasize to them how much is at stake, how much, you know, how much could this extra prize money do for your charity. What could that help you do? Tie that back into your overall messaging about what you do and why you do it to really get people excited about helping you win that money. And then another trick is just concentrate on sustaining momentum, keeping the fundraising going, and of course, starting and finishing strong. And we'll go into, you know, these different strategic methods later on in the presentation as well. And then you'll want to be sure to review all the rules on the challenge site as well. Again, Cincinnati gives.org. Here's a few of the really important ones. You need to be a 501c3 non-profit in order to participate. And there's the bonus rule again. You can win one grand prize and two bonuses. If you win two bonuses, you still are eligible to win a grand prize. You just won't be eligible for any of the remaining bonuses if you've already won two. Organizations can't donate to themselves. And you have to have at least 10 unique donors to be eligible for a grand prize. There is no unique donor minimum for bonuses just for the grand prize. And then offline donations are not going to count towards the grand prizes or the bonus challenges. OK. So the leaderboards provide some of the biggest prizes available. And the Cincinnati gives challenge. And as I mentioned before, the key to winning these leaderboards, whether it's the overall leaderboard or it's the bonus leaderboards, is getting your donors invested in helping you climb that leaderboard. So keep tabs on your position and keep your donors and supporters updated on where you are. Continually emphasize how much is at stake. Make sure, again, that you tie that into your overall messaging about what you want to do with the money and why your organization needs that money. Just really help people get excited about helping you win that money. One trick that I've seen people do before and it seems to have good effect is take screenshots of the leaderboard and your position and share those on social media. So those are some great, easy ways for you to have visuals to go along with your social media. Let them know really easily, like, look, you can see here, we're in third place.  So, yeah, make sure that you keep track of where you are on the leaderboard so that you always know where you are, your donors always know where you are and that way you can try and pivot if you need to, depending on what's happening with those leaderboards. So since the Cincinnati GIFS Challenge is a 10-day event, the trick to making the most of the event is to sustain your fundraising momentum. One really great way to do that and to make sure your campaign is on track is to set many goals for your nonprofit to help generate buzz and build excitement. The great thing about the Cincinnati GIFS Challenge is that they have almost daily bonuses that you can win. So you can utilize those to help sustain your fundraising momentum and really get people excited about helping you win those prizes. So basically you'll want to think of your overall fundraising goal and what you'll need to raise each day to get you there. And typically the first and last days are going to be your strongest in terms of dollars raised. So you might want to boost your middle day of the campaign by utilizing a matching grant or, you know, some other, maybe that's the day that you post more online. But whatever you think is going to encourage your donors the most on those days that might be slower than the other days, set those many goals accordingly so that you can kind of set yourself up to succeed. Something else you can do to get your campaign rolling is ask for seed donations. These are donations from people in your nonprofit's inner circle that essentially break the ice with donors. Because, you know, most people don't want to be the first donor. So if they come to a page where they see people have already been giving, then they'll be encouraged to give as well. Those seed donors will help get the ball rolling. And, you know, they're called seed donations because they make the number of donations grow. People ask people, you know, people you can ask for a seed donation would be maybe your board, maybe they put in a group seed donation or you get a donation from each board member. You can ask your staff. You can ask, you know, director or C-suite level leaders at your organization. If, you know, if you don't have those, you can ask volunteers. Really, anyone else at your nonprofit who's highly engaged at your work, you could even make the first donation. If it's just you doing this, then, you know, maybe maybe that's when you get like your family members to make those first donations if you don't have really anyone else helping you. The seed donations do not have to be huge donations, but just getting a little bit on there, getting people excited about the fact that people are donating. You know, that's what's really going to help move your campaign forward. And that's one of the reasons why we're starting the Cincinnati Gives Challenge on December 2nd, so that we can kind of, you know, you guys can help kick off your giving the day before Giving Tuesday. That way, when you really get your campaign out of the gates, like you're already going to have donations because the challenge has already started. Another great strategy for driving donations on a giving day is securing a matching grant. A matching grant is essentially a large donation that your nonprofit leverages to bring in other smaller donations by offering it up as a match. So, for instance, if you had someone willing to give you a thousand dollars, instead of just putting that money in the bank and calling it a day, you could use it as a matching grant. So the terms of the grant are totally up to you and the person who's giving the money. But let's say that there's a bonus prize available and you want to do whatever you can to drive donations during that bonus timeframe so that you can win that prize. You can take that thousand dollars or whatever they're willing to put up as a match and say to your supporters, you know, hey, between this hour and this hour, this day and this day, donations are going to be matched up to a thousand dollars, which basically allows your supporters to double their donation. You can do a lot within the Mighty Cause matching grant tool. You can set a cap for a donation matching. So say, you know, let's say the cap is two hundred dollars.   It allows you to do a lot with your matching grant.  And then since the matching grant is ultimately just a large donation, you'll want to follow the same process as you would when you secure major gifts, basically prospect, cultivate and ask. People you can consider as prospects for a matching grant are, again, board members. You could do a whole board match. First and foremost, you know, if you have any partners in the community, those are people that you could ask for for matches. And then, oh, and one other idea, if like, let's say if you your board was willing to do a match, if you have your board provide dues, then maybe their dues could be the match for the grant. So then they, you know, might not necessarily have to put up their own personal funds as like an extra donation, but you could offer the dues at the matching grant as well. And then, of course, you can ask other major gift donors who've given large donations to your nonprofit in the past. Those are always really good prospects to provide a matching grant.  So instead of just writing a check, they can, you know, put that donation down as a matching grant. And just so everyone knows matching grants, you don't have to pay the match online. They it can totally just be a check. But it's it's a great way to kind of incentivize your donors and maybe make your major donor feel like they're making an even bigger impact as well. Basically, at this stage in the game, with just a couple of weeks left to go before giving Tuesday, you're you're going to want to start making phone calls, sending emails, really start cultivating those prospects to let them know what you're doing and just kind of warm them up to the idea of getting involved. And, you know, in the coming weeks, go ahead and make your asks for those matching grants. Work out the details of the match. Check out the tool on your account. Again, it's under the fundraising section. See everything that you can do with it. It's not you don't have to do just a one to one match. You can do a two to one. You can do a three to one. You can match percentages. There's a lot of stuff that you can do. And so you'll you'll just really want to take advantage of that so that you can kind of plan out, OK, I want to go after this bonus challenge. I want to go after bonus one and bonus three. And so during the other days where I'm not going after those bonuses, I want to provide a matching grant so that I keep my fundraising momentum up since I have a goal of, you know, five hundred dollars each day that I want to raise. And then at the end of the day, you know, a matching grant is just a really great marketing tool, so you're definitely going to want to promote it. The first step, go to the matching grant tool on your organization page and add your matching grant to your page. There's marketing tools built into the platform for your matching grant. Once you make a matching grant live, it puts a little sticker on your donate button that indicates that a grant is active. If people click on it, it'll be brought. They'll bring it'll bring them right to your terms for the match so they can see what, you know, is going on, how much is left to be matched, etc. And then the there's a couple changes in your checkout process to that reflect the match that's going on. And then, of course, the match gets listed on your nonprofit profile. But you'll also want to add some information to your story section, especially if it's a big match. And then, of course, promote it on your social media channels, send out an email, let everyone know about the match and, of course, countdowns at urgency. So counting down and sharing your progress toward the match can be a really great way to get people excited and urge them, you know, to stop what they're doing and make a donation. And one other thing I want to mention before I move on, if you do find a corporate partner to put up a match for you, the matching tool allows you to add logos and name the match certain things. So if you wanted to kind of show that corporate partner a little bit of love, you could add their logo to that match that they're sponsoring. And then, of course, you can add their logo to any emails you send out about the match just to really, you know, kind of spread the word about their generosity. And that might be a really good selling point when you're trying to, you know, kind of get them to do the match, just letting them know I'm going to be sending out an email to all of, you know, my supporters. Here's how many I have. And I'm going to include your email or your logo on all my emails. Your logo will be on the website so like everyone will see it. So that's a really good selling point when you're trying to get corporate partners to provide a match for you. So moving on from matching grants, I want to talk a little bit about ambassadors. Ambassadors are people who usually are in your nonprofit's inner circle, who can help boost your campaign. So that includes board members, volunteers, especially the ones who are highly engaged, staff members, et cetera. Utilizing ambassadors can help you break out of the list of your existing supporters and really engage new people, people that you wouldn't otherwise have access to. And then ambassador can help you in a few different ways. They can simply share the link to your page within their social circle to ask their friends and family to donate and help, you know, kind of boost your campaign. If you have a board member, for instance, who's really well connected, this could be a huge boost, or your ambassadors could help by getting involved in peer-to-peer fundraising. So there's really different levels that, you know, if they don't feel comfortable starting a fundraiser, then have them be an ambassador by just sharing the link to your organization profile page for the Cincinnati Gifts Challenge. But if they're willing to take the next step, have them, you know, create that peer-to-peer fundraiser for your organization. Peer-to-peer fundraising is a fundraising technique where basically you deputize your supporters to fundraise on your behalf. And the Mighty Cost platform is actually set up for really easy peer-to-peer fundraising. This is, again, just a really great way to acquire new donors. If you wanted to try peer-to-peer fundraising, you could ask your ambassadors to set up a fundraising page for your nonprofit on Mighty Cost for the Cincinnati Gifts Challenge.  And having peer-to-peer fundraisers doesn't distract or draw attention away from your campaign because they're operating alongside your campaign. And they're reaching out to people they know personally for donations, which in most cases, their friends and family and colleagues are not people your nonprofit would, you know, usually have access to solicit for donations. So by asking your ambassadors to become peer-to-peer fundraisers, you're actually potentially picking up new donors most of the time. So for people like your board, volunteers, staff, program alumni, this is a really great way for them to get even more involved without, you know, just being asked to give money. And, you know, being a peer-to-peer fundraiser could make it even more meaningful for them than, you know, just making that donation or sharing the link. So it can actually be a part of your stewarding process, you know, building and sustaining a relationship with that supporter, just asking them to kind of take that next step to get even more involved with your nonprofit. We have seen nonprofits get some really great peer-to-peer action going by just inviting people on social media or, you know, sending them an email, asking them for their help, asking them to set up a peer-to-peer page. And then this, you know, is especially a great route to go for younger people who have bigger social networks and are just really comfortable online. You know, maybe they don't have a lot of cash to give, but this, you know, they're involved with your organization and this can be a really great way for them to help out and make that meaningful contribution. And then to help make things easier for your peer-to-peer fundraisers, you can share images, talking points, you know, logos with them and even offer to help set up their page for them since the platform's relatively, well, it's easy to use. So, you know, it's definitely worth talking about how you can incorporate peer-to-peer fundraising into your campaign strategy. And, you know, there's plenty of time for you to get started on that. You know, so come late November, you can start asking people to start fundraisers so then they can start raising money on December 2nd with you. So if you managed to generate a lot of interest in peer-to-peer, or you've done that for the Cincinnati Gives Challenge in the past and you wanna try something new, you can consider trying out team or event fundraising. Teams and events can be a really great way for groups of people who wanna fundraise together, like a board or companies. So that could be another ask for a corporate partner if, you know, maybe a matching grant is in for them, but if they wanted to get their employees involved, you could ask them to set up a team benefiting your organization and then they could have their own corporate team that, you know, all the funds go up into your organization's total raised, which then goes up into Cincinnati Gives Challenge total raised and, you know, contributes to your leaderboard standing. Teams and events, you know, are just a really great way to get people working together and it inspires friendly competition. So on those team pages, they have their own, the team and event pages have their own little leaderboards. So, you know, if you did have a corporate partner who wanted to engage their employees in some philanthropic effort during, you know, the Giving Tuesday season, then this would be an awesome way because they could have their employees kind of compete against each other. And then again, all the funds raised go into your total raised for the event. So one of the really cool things about using a team or event product for Giving Tuesday is the tools that are built in to make managing it a lot easier. So for teams and events, you can create a template fundraiser that way people can get set up really quickly. Just you can pre-fill some sections of their page and then you can email the team and event members through the platform to keep them motivated. So, you know, the teams and events are essentially just more complex peer-to-peer campaigns, but they can be a really great option if you have a lot of people willing to fundraise for you or you've done peer-to-peer fundraising in the past and you just, you know, want to try and get a hand at a new type of campaign. So, your email list is going to be one of your most important tools during the Cincinnati GIFs challenge because, you know, emails are a direct line to your supporters. So unlike social media, you don't have to worry about an algorithm getting in your way or preventing people from seeing what you send them because unless they've unsubscribed from your emails, it'll end up right in their inbox and probably send them a notification on their phone. So I want to talk a little bit about email strategy because it's going to be really important for the Cincinnati GIFs challenge. In general, you'll want to keep emails relatively short and simple and skimmable. Most people read their email on their phone these days so they're not going to read a novel. They want to just be able to skim it and get to the point. People are much more likely to read emails that pertain directly to them. So we highly recommend segmenting your email list by sorting donors into a few key groups. You know, donors who have given a lot or donors who have given on a regular basis. Your one-time donors could be a group, people who have utilized your services but never donated, your board, volunteers, et cetera. You don't need to craft entirely new emails to reach each of these groups, but you can tweak small things about the emails for each group to make it more personal. So example, in an email to volunteers, if you want to acknowledge how they already help your nonprofit and you wouldn't, then that could be one thing that you could do to make their email different. You don't want to send an email to a major GIF donor asking for a $25 donation. So for your one-time donors, that might be a good call to action to donate $25, but for major GIF donors, you obviously want them to donate more since that's what they've done in the past. So make sure you identify your key segments and then figure out how to tailor your message to them. And then when an email is tailored to who the recipient is and the relationship they have with your organization, they're much more likely to read it and take action on it. And then, you know, how you segment depends on the program you're using, but most services like Constant Contact and MailChimp use tags to segment groups of people on your email list. So it just makes it a lot easier for you. And then quick deviation, speaking of Constant Contact and MailChimp, I just want to pause for a second and make sure you're all aware that as participants in the Cincinnati GIFs Challenge, you get access to a free extended trial of the Mighty Cause advanced tools. No credit card is required. We're giving you access to these tools through December 18th. So you have plenty of time throughout the campaign period to utilize them. One of the great features and, you know, one of the reasons why you should definitely sign up for that extended free trial of those advanced tools is the data integration. The data integration allows you to connect your Constant Contact or MailChimp accounts right to Mighty Cause. So, you know, to help make your life easier during the campaign, sign up for those advanced tools, connect your Constant Contact or MailChimp accounts to Mighty Cause. Just, you know, set yourself up for success. And then the advanced tools also give you deeper analytics. They give you text to give and more. So we also have a supporter CRM. So if you don't have a current CRM system, you get your own built-in CRM with your Mighty Cause account with those advanced tools. So again, it's free for you guys since you're participating in the Cincinnati GIFs Challenge. It's free through December 18th and no credit card is required to sign up. So, you know, if you don't want to use it, then it just ends and nothing more is required of you. Okay, so jumping back in, one thing you'll need to pay close attention to is the timing of your emails, especially if you're aiming to win a bonus prize. So I would recommend taking the time to schedule as much as you can beforehand and have a template email ready for things you need to send out on the day of, like a blast email asking people to help you get to your campaign goal or an announcement that you want a prize. Like I mentioned before, most people read their email on their phones. So make sure that you choose a mobile-friendly email template and test it out beforehand. You know, make sure you look at it on an iPhone, Andrew, and so on, or Andrew, Android, and make sure it looks the way that you want it to look. You know, make sure that you're, you know, if you have the time or capacity to test out emails, you know, A, B testing, test subject lines, et cetera, then that's a great way to kind of make sure your emails are as strong as they possibly can be. Lastly, your call to actions in your emails should be clear and action-oriented. Give now, donate now, help us today. More passive call to actions like thanks for donating or please contribute aren't as effective. So you'll definitely want to be crystal clear and urgent. For a high-stakes event like the Cincinnati GIFs Challenge, we really recommend staying in your comfort zone when, you know, we're talking about social media. So basically what I mean by that is if you've never logged into TikTok before, then don't use that for the Cincinnati GIFs Challenge. If you have, you know, 1,000 followers on your Facebook page, but only a handful on Instagram, then you should spend way more time and effort on promoting your campaign on Facebook than Instagram. You know, put your efforts into the platform where you're most likely to reach people and have an impact. And then I definitely recommend scheduling any posts that you can ahead of time just to save yourself a lot of trouble during the challenge and leading up to it. You know, get your key content scheduled with Facebook's publishing tools, go into Tweetdeck and schedule your tweets, save any live posting for stuff that needs to be done the same day, like thinking a donor, updates on your progress or prize announcements. And then to that end, if you're able to, you'll want to assign a point person to monitor social media during the Cincinnati GIFs Challenge that way you can quickly respond to comments and interact with your followers since that's important on social media. And interaction can also help you in terms of the algorithm since most platforms do show priority to posts with lots of engagement. And then if you're able, we also recommend budgeting a little money to boost some posts or promote some tweets. And you know, on social media, $20 for an ad can really go a long way. So you'll want to make sure your ad is targeted properly if you do go that route. And then if you're not sure how to target an ad, you can always default to targeting the people who like your page or already follow you. And then in terms of the type of content that we'll do well on social media, depends a little bit on the platform, but in general, photos and videos do really well. And you may want to consider doing something out of the box like a Facebook live video or watch party for a campaign video to kind of generate some buzz while delivering algorithm-friendly content. And then I do want to plug the social media guide in the nonprofit toolkit. It's very comprehensive. If you're not social media savvy, this is a great place to start. So definitely go to the nonprofit toolkit on the Cincinnati GIFs.org page and check out that social media guide. And then finally, when you're planning your campaign, follow-up is definitely important to consider. When you're planning your content, you'll also want to plan your thank you to donors. Things like making a video or a photo of your staff can be really great for follow-up. And then be sure to talk about the impact of the funds you've raised and close the loop on your campaign. If you are fundraising for something specific, like a new piece of equipment or improvements to your building or something like that, you'll want to send out emails periodically on your progress, let people know where you stand with that. And then you'll want to make sure you've got an onboarding plan in place for new donors so that they come back to donate again. So if you collect addresses during your donation checkout process, mailing them a welcome packet could be a great way to get them onboarded. And you can also create an automated email journey where they can get more information about what you do and why it's important to support your work. So just make sure that you're really thinking through on your follow-up because not only are you participating in the Cincinnati GIFs challenge, but then you've also got end of year giving to think about near December 31st. So anyone who donates to your Cincinnati GIFs campaign are potential donors for end of year giving as well. So they'll definitely, you want to make sure that they feel thanked and appreciated so that they're more willing to donate to you end of year if you do send out an ask. So as we wrap this up, I want to make sure our support team's contact information is here for you to reference. They're a great resource before and during the challenge for really anything campaign related. If you need help setting up your EFT, if you need help figuring out how to strategize around one of the bonuses, or if your donor just needs their receipt reset, you can reach out to them at any time. Typically responses will happen between Monday and Friday, 9 a.m. to 5 a.m. Eastern. I would write down the phone number.  And so if you know that you're a phone person, then make sure you write down that number because we don't have it super prominent on the site because there are only four of us. So yeah, make sure you write that down if you know you're a phone person. But we do try to get to emails within 24 hours. So we're definitely happy to help. Okay, so that's it for me. I'm gonna see if we have any questions. Ivy, do you have any last thoughts? No, I'm good. Just want to make sure if anyone has questions, we can get a few of those answered. Okay, so I have just one question in which I feel very accomplished. I must have done a very good job. It's wonderful. I have one question in. And basically they are asking, they're a smaller nonprofit and they're asking, they don't feel like they can compete with any of the larger organizations that might be participating. So they're wondering how they can make the most of the campaign as a smaller nonprofit. And I think that is an excellent question. So that is one of the big reasons why Cincinnati Magazine has the bonuses. So, and it's also one of the reasons why they put the limits in place this year. So if you're a smaller nonprofit, then going after those bonuses is a very tangible way that you can take advantage of the campaign. Because even if you don't win a bonus that you're going after, it's an easy messaging opportunity to send to your supporter. So you have something to say to them every day. And it's really a win-win. Because if you do win the prize money, that's awesome. And you can let them know that you won and it's very exciting. But even if you don't, people still engaged with your organization. They still are trying to help you and you still receive the money that they donate to you. So it's a really great way to engage and involve your donors by using that messaging of those bonuses. So I would, if you're a smaller nonprofit and you're not really sure if you can win a grand prize or not, I totally understand. I would definitely look at those bonuses to see which ones seem most feasible for you to win. Because again, you can only win two bonuses. So organizations who might be really, really good at fundraising, they'll be out after their second win. So then you have more of an opportunity to win one of those bonuses. So I would just really be strategic about which ones you wanna go after. And if you don't win one, then it's just another additional messaging opportunity to your supporters by letting them know, hey, we didn't win this one, but there's another one happening today that we think we can win and we really need your help.  But I will say, I have been very impressed by some of the smaller organizations that I've seen in other challenges that have really, their supporters have risen to the occasion and just gone all in. And they have been able to compete with some of the larger ones because they just really tried to spread that excitement and their donors got on board, their board was on board. So sometimes you can really surprise yourself, but if you're not sure, use those bonuses as sort of that incentive to get the ball rolling. Let's see, I have another question. When will the supplements be available and how do we get them? If by supplements you mean resources in the toolkit, they're available now. All you have to do is go to CincinnatiGives.org and click on resources and the nonprofit toolkit will be right there. If by supplements, Ivy are you calling the guide to giving a supplement to your regular issue of since, because isn't gonna be polybagged? I'm wondering if that's maybe what they mean. Yeah, that might be what they're referring to. So that will shift directly from our printer, I believe in two weeks, trying to find my schedule here. And it will go out with the December issue of Cincinnati Magazine. So for those that bought a profile in the guide to giving, we will be sending you, if we didn't hear back from you, we're sending each nonprofit five copies. If we did hear back from you in terms of you wanted additional copies, maybe you wanted 100 or 50, those will be sent directly to you. And it looks like it is leaving our printer yesterday, actually. So we should expect them really, I would say, within the next 10 days, you can expect to see them. We also have the digital edition that we will be hosting on the Cincinnati Give website. So we will change that link that's currently on there from last year's publication to the current one. And we can get that done this week. So you'll also be able to share the digital edition. Great, thank you. And then I got one more question in. How many nonprofits participated last year? I believe it was a little over 100, is that correct, Ivy? Last year was 97. We have averaged a little over 100 every year. This year, so far, we have 66 total registered. And then when we look at pacing in terms of when nonprofits register and get their pages going, when we were looking at this time last year, we had 67 registered. So we're kind of right on pace with where we were last year. So my goal, I would like to see 100 participating nonprofits. I think that's a good average and a good amount to really kind of showcase our nonprofit community. Let's see, will this deck be sent out? Yes, so the webinar deck and recording will be on, I will be adding that to the toolkit. It'll basically replace the register link for this webinar. So that'll be in the toolkit and then you'll also be getting an email with a link to access the recording as well. So you can review it at any time or you can have other people on your team watch it or if it was just really compelling and you love the sound of my voice, then you can listen to it maybe on your drive into work. Okay, but yeah, I think that's it. So one minute to spare. Just thanks again, everyone for attending and hopefully you got some good stuff out of that. Ivy, thank you so much and everyone good luck on your Cincinnati GIFs planning and strategy and fundraising. Thank you, thanks everyone.