Okay, so owning the enterprise with the BlackBerry. I am Xi'an, some of you here know me as Xi'an, I'm also known as Jesse de Guano, I'm a founder and director of professional services and research with Pretorian Global, a consulting company in Northern California and also a core member and current team captain of Digital Revelation, we're a security research group who actually formed here about five, six years ago, kind of centering around the DEF CON capture the flag originally and we've done some things since then but we usually seem to participate in the capture the flag events. So who here's uses BlackBerry? Who has a BlackBerry? Wow, I have a feeling more than that. Lots and lots of people use BlackBerry's. It's according to Gartner, they're the market share lead for handhelds and I thought it was pretty interesting when the when research emotion was going through the whole copyright issue and there was a potential for an injunction that government and emergency workers were gonna be it seemed like exempt from that because it was critical infrastructure so I thought it was it was worth investigating a little bit more as far as the security of it. I'm gonna take some time and go over kind of the background of how the BlackBerry solution works in in case for anybody who's not familiar with how it does the thing it does. Here's a diagram of a typical BlackBerry corporate BlackBerry installation pretty much. You've got your mobile devices here. I apologize for I thought that we could get the slides for part of it on both screens. We're gonna have a couple demos so if you can't see very well out in this side of the crowd I apologize but anyway so you've got your portable your handheld devices which connect to some wireless carrier next to or singular or whatever your carrier of choice is and then you've got this little cloud as if if any of you saw FX's talk he kind of goes into that as well where you've got a bunch of arrows on the you know the diagrams but nobody really knows what the the rim network really does and then that tunnels over the internet to basically your corporate your corporate network. So the bez and also different elements that are associated with the bez lie on your corporate network. Bez is BlackBerry Enterprise Server. There's also the MDS which is a component of that the mobile data service and attachment service and different things like that that can either be on one machine or separated into multiple machines. Then I have just typically the bez talks with the exchange box or Lotus or whatever depending on your installation and then basically just whatever other application services and things like that that you provide access to from your BlackBerry. This also typically users have work state a workstation on the corporate network that as long as it's on the domain and that user has a BlackBerry assigned to them then there's this relationship between when they sync the BlackBerry's and it does magical stuff that will go over later. So to break it down a little bit as far as how that all how it works how you can actually access internal applications and internet sites and things like that as in your mail and your calendaring and all of that from your BlackBerry. First the MDS actually creates an outbound TCP connection from from inside your network out to rim. You actually you have to of course create allow this by creating firewall rules and then negotiation takes place between rim side and your MDS or your bez MDS and that creates kind of a persistent tunnel between the bez and your and rim. That in turn the BlackBerry I'll go back for a second. The BlackBerry is of course connected to the wireless carrier and so with somewhere in that little that rim cloud the mystery network it gets connected and gets end-to-end encryption between the handheld device and your bez and MDS and all that jazz. So you end up with basically something kind of like this it's a persistent tunnel through the internet from from your bez out to the internet through rims network through the carrier network and to your handhelds and so basically your handheld then ends up virtually on your internal network which looks great because you can then access all your internal apps and browse websites that only you could if you're in the office things like that. Anybody see any problems with that though? Typically handhelds the security of handhelds that is usually focused around the data on the handhelds email things like that not what risk it can pose to your internal network. Here we have an always-on always connected code running device that sits on your internal network. So here's a just a you know simple review of that I think I skipped a slide basically. So the big problem and the reason why we figured that this research was a good thing to do and giving a talk this talk was a good thing to do was to increase the awareness with with BlackBerry users and administrators as to what the dangers the potential dangers could be and what an attacker could possibly do with the typical BlackBerry installation. So it's obviously important to remember that they are computers that sit on your your network and in your typical IT infrastructure though they're not thought of that way they're not thought of and controlled in the way that you know a VPN or a dial-up solution or something like that would be. So you obviously end up with with big problems so we can exploit this problem obviously that's why we're all here. So there's this out this little application through together called BB Proxy and what BB Proxy does is first it creates an outbound socket connection from your BlackBerry device out to an arbitrary attack or controlled host on the internet kind of like that. If you can typically at least from you from your BlackBerry you can at least browse websites. So if the if you chose to use port 80 or something like that then obviously most likely your connection is going to be allowed through. Then from the attack or controlled host we have a listening socket that that it's connected to and we create we tell the BlackBerry just to create a subsequent connection to a second host and and the benefit of this is that we can make a subsequent connection now to an internal host kind of like that. So now from our attacker controlled host we can directly talk to a machine on the internal network and and not have to worry about you know silly firewalls on on the perimeter. Okay so I think yeah I have a we'll do a little demo to just show how that works. What I'm going to do is just start up a netcat listener. Hold on one second and this will this will be kind of like our little internal service.  It could be telnet or SSH or an intranet site or whatever and on this host we'll start another listener. This will be our attacker host over here. So we have our attack host here on the internet on this side and our friendly little intranet site here here. So what we'll do is again just netcat listener now from the BlackBerry we'll fire up BB proxy. Do you mind questions during the talk or you want them afterwards. No you can go ahead. So maybe I missed it but this is predicated on being able to actually get code to run on the handheld which requires it to be signed and hashed by RIM which means they know about it right. Sure we'll get to that actually. You will. Okay. Yes. Just wanted to make sure that I can miss something. Thank you. Oh no. It's all right. I think we usually do. Don't we. Okay. So what we get is a helpful little message here that asks to enter the destination host and port in kind of standard fare. So we're actually let me kill this first. Sorry. I need to prove that we can't. I can't just connect to that because we could be cheating. One, two, three, four. So no, sit there. Nothing. Okay. Can we ping it? That's my special ping actually. Okay. Hopefully everybody believes it now. All right. Back to the we'll start up our listener. Firewall punch or BB proxy. I mean now anything typed we can interact just like it was in interactive service because it's being proxied through the conduit of the Blackberry. So it's over there. Okay. Cool. Okay. Back to the presentation. Okay. So now we saw we can interact now with a Talmud service or anything on the internal network without the silly firewall rules getting in our way. But this is Defcon, right? I mean we came here to break stuff, not just to do things that are nice. So we've all heard of Metasploit, I think, probably. The point click root from Spoonom and Hdmore and all those folks. Well, now it has Blackberry flavor. I just basically added a simple function to Metasploit, which will create a listener and wait for an incoming Blackberry connection. Once it gets that connection, it hands it off to, it stores the connection and will hand it off to whatever Xploit calls it. So I'll go over exactly the details of that too, kind of how easy it is to port Xploits over to use it and things like that. So basically, so I'll show a little demo of that. Pretty much the same thing, except now we're actually going to exploit a box. Clear? Okay. Yeah. No problem. Sorry. So start up Metasploit.  I know it's not very realistic that there would be, on the internal network, a vulnerable machine. So you're just going to have to use your imaginations. Listener function. So it sits and waits for an incoming Blackberry connection. So actually, yeah, <IP_ADDRESS> and port 1455. So that goes out and connects. And it got the connect. So now we can go ahead and just set our normal options like we would whenever we're exploiting a box. So hold on. So now we just exploit. And we've got root. All right, so cool. We can now root boxes on the internal network. Okay, so to port an exploit to use the file handle that we, the connection, it's actually pretty easy. I'm just going to walk you through the amount of code that it takes to port your basic kind of vanilla TCP exploit over to it. We use, I used MSASN1, kind of old school exploit, but it's pretty reliable, even though it's one shot. So basically first, we set the target to the, let's see, hardly see. Okay, so we listen for the proxy connection that there's a global variable set if if the Blackberry listener, the listener function has been invoked. And if we've gotten a connection from that that's been handed off, it's set to that global variable proxy con. Then from there, instead of doing the, we remove the standard kind of socket build stuff that that happens right before an exploit is sent. So the stuff that actually goes and makes a connection to a vulnerable service and replace it instead with if the socket that we got from the Blackberry exists, it sends it through that. Otherwise, it sends it, you know, the normal way. So as you can see, it's pretty straightforward and pretty easy to just port most exploits to this to use this conduit. We sleep a little bit just so that it gives the connect the second connection a little bit of time to actually make the connection. And then we send our exploit. The limitations with currently that we have with the Metasploit patches is that it's only it's limited to TCP based exploits, kind of vanilla TCP based. We've run into some problems with with certain RPC protocols and those kind of exploits. And it would be really easy to port it over to UDP and also to make to let it work with some of those as well. But just haven't gotten around to it yet. So look for an update to these patches. We're gonna I'm gonna provide these patches also to Metasploit so that you can play around with it. But check back to so one cool thing to it about this is that we actually have the ability to completely basically evade all perimeter defenses, not only just can we talk to machines behind the firewall, but because of the functionality in the best and MDS, we can we can really evade IDS sensors on the perimeter as well. We don't actually need to make to use the MDS to make the first connection. Most newer devices have a TCP IP stack on them themselves, and can make a connection from the device side via the carriers network. So what it's very easy to specify this in code, it's it's a simple device side equals true or device side equals false in the URL for the connection string. So what we can do is we can make a the first connection from the device directly from the device and then the second connection via the MDS. And you're essentially straddling the border because nothing ever actually travels across the the perimeter other than through the nice and happy encrypted network that goes from your best here handheld a little diagram of how that works. So the black the blackberry itself is is just going through the carrier network and making the connection to the attacker control box without any any interaction with the bez itself or the MDS. This is doing it just on the device side. Then the second connection is then the one that we are exploit is going over is actually going through the whole the what we described earlier, they threw rims rims network through the MDS and interior internal network connections. So it's a lot basic. It's a little bit of a complex diagram, but here you see the first connection out to the attacker control box and then the second connection going all the way through the rims network and the internet and the firewall and through the MDS and then and connecting to an internal host. So just let it basically just like having a machine, a workstation has two ethernet connections, one inside your your internal network and one outside on directly on the internet and straddling your perimeter defenses, kind of like the reason we usually don't allow dual home systems and configurations in VPNs. But again, people don't think of this as a remote access solution. Okay, so the problem with with this as far as a viable attack vector is that it really requires control physical control of a device to put your code on the device and and run it in order to go out to an attacker control host and et cetera. So the solution to that is a Trojan that you can actually download over the air and have the users run without seeing anything, of course, just like we all know what a Trojan is. So hot game 2006 is has the same functionality of BB proxy. The user only sees the game interface, the tic-tac-toe is our hot game. We have the ability to over the air download. And of course, this is just a proof of concept. So it's fairly limited in function, just kind of plugged in the code from black and BB proxy. But obviously, you could use a lot more specialized control channels and things like that like IRC and also functions to identify kind of the the internal network structure and that sort of thing. Right now, we just have a hard coded host inside. So I'm going to demo that again with our imaginary vulnerable system on the internal network. Everybody can see? All right. So hot game 2006. It's actually flipping sweet. You should check it out. Okay, so we got the connect and Temtale is going to play tic-tac-toe for us. Hold on. Well, hold on. Maybe Temtale won't be playing this once. All right, we're back. Our configs are still the same. So the user won. But I actually won. So as you can see, we have a root again. So hold on. So like I think Toby said, RIM actually requires code signatures in order to use any of their proprietary APIs within the J2ME edition that they have. Also, without your code being signed, a third party application requires like verification in order to do network access and things like that. The reason for this is they they take basically a hash of your your code and you send that in and you pay a hundred dollar processing fee to get a private key basically. And so when you have your code, you send that in and they sign it with your private key and you get a signed code back or you can sign your code. So the way they verify this though, you can order a signature online with a hundred dollars via a credit card and they make sure that your name and address, you know, match what's on the credit card so that if somebody were to write some malware for the BlackBerry, no, we would do that or anything. But they can go and look who did it and go and prosecute. Hopefully not. So there are prepaid credit cards. So FX brought up that they have, I mean, there's no such thing as stolen credit cards, but even one better prepaid credit cards are very easy to acquire. Apparently, they don't have them in Canada. But you can go into most supermarkets here in the states and drop some cash and get a nice prepaid American Express or Visa or MasterCard and go and sign your code. Completely anonymously, obviously. So we have so far we can talk to hosts behind the corporate network. We can attack them. We can subvert the IDS and any data logging. Also, thinking about that as far as the whole subverting all perimeter defenses, one aspect of that that I didn't talk about other than IDS is that things like the regulations that are now with due to the SEC and things like that where they actually have to log all data that comes in and out of your network. This would be a way for someone to leak information from the internal corporate network out to the internet without any real traces. Okay, so we can also sign our Trojan anonymously and use all the APIs. But it even gets kind of worse than that or better, depending on your perspective. This is actually kind of funny as far as a story but device provisioning, how they how you can provision a device on the internal network, a new device to a user who has been configured to have a BlackBerry. Obviously in security, ease of use versus security is always a fight and ease of use usually wins because marketing guys have more pull in most companies. With BlackBerry, it's extremely easy to add a new device. Actually, as long as the user is on the domain and they are configured to have a BlackBerry, you plug in the device and it will ask if you want your new device put onto the network and replacing the old device. So, then the new device is on the network. Each BlackBerry is identified by a unique pin. As you can see, the second one from the bottom, that pin actually identifies to rim the device, the handheld itself, so how to route whatever traffic is coming from the device over to the appropriate network. So, when a user plugs in their new device to a PC, the new pin is recognized and encryption keys are basically are generated and then stored on the BlackBerry handheld. The new pin and the newly created keys, encryption keys, are also then pushed to exchange via the MAPI interface. And this information is stored in the BlackBerry handheld info hidden folder on exchange in the user's mailbox. After that, basically, the MDS on a regular interval, depending on what the administrator has said, pulls the exchange mailbox for any new information. And when it does and it sees an updated, updates its database and in turns updates rim and now the new device is on your internal network. So this process can be obviously automated because it's fairly simple, actually, just using MAPI in order to push this stuff as long as the user is on the internal network. I was hoping to have an automated, nice demo to show you of placing a rogue device on the internal network, but was in Europe for the last three weeks and didn't have any time to sit down and pound more code out. So hopefully pretty soon, if you check the website, I'll have a demo up and some code in order to show this process of basically hijacking a user's connection. Shoot, I need to change that.  You can check either Pretorian G presentations, Blackjack, or didrev.org slash Blackjack for the slides for this and also the code. As well as if you go to blackberry.com slash security, they've done a really good job. It looks like of responding quite quickly. And they've updated with good white papers for how to securely deploy the Blackberry solution and segregating your Blackberry, your BEZ, and your MDS from the rest of the internal network in order to protect the internal network. As well as security precautions for general security precautions for malware in the Blackberry solution. Any questions? The question is, what is the latency? It's GPRS. And so what is the latency through the Blackberry? If it's fast enough to drop the VNC, reverse connecting VNC payload? And yes, it is.  So yes, it is and it is successful. The other thing I wanted to point out was that we had to use the emulator because there was no actual feasible way of showing a real Blackberry device up on the screen, other than holding a camera over it. And actually, apparently that's what RIM does too. But this does work actually on real devices. So Eli, scanning the internal network, we actually have a port scanner as well for the Blackberry. They actually, it's interesting because it is a little bit more difficult to scan the internal network than it is to scan the external network because the MDS, just where it should give you certain error conditions, it just craps out. Basically, part of it, I'm told, is because of trying to compensate for latency. And so when you try to make a connection, like a SIN connection to a TCP port, if the port's closed, it won't throw an exception for like two minutes because in case you're going through a bad signal area and things like that. So it makes it kind of hard to write a port scanner and certain, especially a port scanner, in that specific condition. What we're doing actually is having a separate thread that runs beside it in order to basically, if it lasts more than a certain amount of time, kills the first thread and marks it. Any comments about the Blackberry, the IT policy that's in the BEZ server, that they disallow loading third-party applications, disallow external connections, specifying which applications are allowed to use the MDS conduit, basically? I know that the defaults, they allow this, basically. But many comments? The comments from my side are mostly just that it's insecure by default, but it is this particular, the vulnerabilities highlighted here are protectable with the policies. If you use policies to restrict your users from downloading third-party apps and things like that, then you can restrict people from doing this kind of thing. The problem is, in my experience in talking with customers and things like that that have Blackberry installations, a lot of times administrators, by the time they get the Blackberry, their BEZ and everything up and running, they've been quite frustrated and are happy that it's running. And so I would suggest, basically my suggestion to RIM, and I've talked to them about that, is more secure out of the box. But the mechanisms are there to protect most of it. So a Trojan that would be persistent after a power cycle. Well, there are APIs to run things in the background. So actually, especially since our code is signed anonymously, we don't actually have to have a front end for the user, that kind of thing. The user could download over the air. And like many things, it just doesn't work for some reason, and it's running in the background. And I believe there are also APIs for starting something, basically starting something up on startup. So essentially, it would be possible, probably, so. This may be an aside, but did you look into the hashing algorithm they use for the sign code?  I bet Ian does at SHA-1. I knew that, actually. Because if you could defeat that and use a signature for a matching SHA from a valid app, if you could defeat it by using a matching SHA from a valid app, I was hoping you'd say MD5, of course. Johnny's being awfully loud. Got it. Sorry, I can't. I'll ask FX, please. Now, you said that your code that you have downloadable on your website is already pre-signed, then? No. Only for the demo. No, actually, what would be on the website is the BB Proxy, the actual user interface one, and the patches for Metasploit. And also the port scanner will be also available. The Trojan is not going to be available on the website. But for that BB Proxy, is that signed, then? No. So if we actually want to try it, we have to send it ourselves? Yeah. Well, I mean, you can use it. It will ask you, when you try to make a connection on a real device, it'll ask you for confirmation. But you can use it without it being signed. It's not using any of the restricted APIs, actually. And just as a follow-up, does RIM currently have in their infrastructure the ability to revoke signatures of something that's already been signed and automatically push that out to all their devices? Does RIM want to comment on that? I guess that's the answer. Actually, he just asked part one of my question. But the other part was, is there way RIM can filter through their mystery network these attacks? I can't really see a way of filtering these attacks, because it's really, it's legitimate traffic. RIM, as far as, I mean, that's the whole thing with the security of the BlackBerry, is that it's end-to-end security. The bez has a key, and your device has a key. And RIM can't see what's going on in that tunnel. And so as far as, I assume maybe you're talking about IDS or intrusion prevention on their side to block traffic. Is there anything that identifies like the application when it's going through their system, like the packets? No. No, yeah. There's no review of code in any way. It's just, basically, they take a hash of the code file, and that's what the signature is based on. It's not a review of the code in any way. It's really, as far as I know, the only purpose for it is to make sure that if somebody does something bad, they can figure out who it was. If you own the bez, sure. Yeah, that would actually be, that is another potential attack vector that we've played around with, is using FX's exploits for the bez itself. One email, own the bez, kind of thing. Basically, if you own the bez, not only can you push it out to all of the other, all of the blackberries on your network, because you can push applications. You could also provision yourself a new device and place your attacker-controlled device onto the network without even having to have code run on a workstation or anything like that. Can you come over to here? Is that possible? Oh, OK. Well, between a Blackberry handheld and a Pocket PC, I wouldn't want to be the one to have to make a statement about that. There's kind of differences in a lot of ways. The Pocket PC is not persistent on your internal network. If it's on your network, it usually has a Wi-Fi card or an ethernet jack, and it's on your network when you're in the office. It's not like a Blackberry where you're actually really always on, always connected to your internal network. And so it can be, your internal network can be attacked wherever your Blackberry is. I'm going to have to, if there's other questions, I think we'll have to move out of the room, because it looks like they're shooting us out. But thanks to Didrev and Pablo Marx, because I didn't know Java, and FX, and Ian.


Why here? Space Godzilla, Rodan, Mechagodra... Oh, Bialante as well!  Theme Clash! Hello everybody and welcome to Minecraft Consola! And as you can see, I'm dressed for the occasion. This is the new DLC that has came to Minecraft containing Godzilla. If you couldn't have guessed already... And here it is, Godjira! Oh, it looked like a kind of smiley face. Oh my god!  Oh, this looks awesome! Well, I mean he's kind of just in the ocean by himself. Oh, there we go! Yes! Layaways to Tokyo! Now, they don't seem to have any defenses. This is not gonna go very well for them. Oh, we got Omiage! Oh, souvenirs! Also another shop! Oh, we got a theater! You know what? As long as I get to play as a kaiju. That's what I care about! If I get to do that, I'm a happy boy! Let me play the dinosaur!  You know what we did? We used to dress the world when we didn't play as a dinosaur. That kind of sucked. Okay, here we are! Let me in! Woohoo! Like a kid in a candy shop! I thought I was a lava there. So we have, apparently, four movies. We have Godzilla there. We have Godzilla. I'm not sure what movie that one is. Let's see what else we've got. I think, yes! Godzilla vs Kong! Interesting that they're releasing this just before, you know, the next movies to come out. Okay, okay. And then, what's screen three? Oh! Is that Shin Godzilla?  Hell yeah. I actually really like Shin Godzilla. The design of it, it's monstrously beautiful. That's why I'm like, hello! Wait, sorry. Right click. Oh, there we go. Welcome to the theater. Which movie would you like to see? Well, we should really go in order, right? I feel like this is the one where maybe we'll control Godzilla or Kong. I mean, this one looks like we get to control them too. Oh my god! Go away! Dude, this one. Fury of the Colossal Beast Godzilla makes landfill. Dodge Godzilla's attacks and run to safety. Lend a hand to those in need and aim for the top result. You'll buy a ticket. Thank you. One, one ticket please. Did I buy it? Oh, it's telling me. Okay, okay. I've got my one ticket. Thank you, miss. Right, let's go. Let's go to our screening. Oh! Oh, look, we got other movies! Oh, that's awesome. You know what? I'm late to the Godzilla hype train. I really am. But I love it. That's the original one. Oh, wait. This is the second movie, that one. Because it had Angro. Angro? I can't remember what he's called, apparently. Oh, I think we're here. We're in. Shh, shh, shh. I've got to be quiet. People seem to be in trouble in this screen. I wish we could help them. Oh, poor. Or Bar-san, or G-san. I can't remember. Oh, man. I think she's actually... We get to choose VIP seats? Oh, this is brilliant. Well, I'll go here. Oh, god. What's going to happen? Oh, that's never happened when I went to see a movie in Japan. Oh, I spool it up. Two, one. Oh, my god.


really benefit from what my grad students and my knowledge from working with grad students get me anyway so our last CC&E accreditation visit was in April of 08 and somehow I got the job of authoring the self-study which is a terrifying experience I know that you're all sort of in the beginning of this and some of you probably have some experience I was inexperienced at the time but I really left the, of course we were successful so I was happy but I really became a very strong proponent of the process because I learned a lot in it it's really a good thing for your curriculum and I just want to emphasize that they keep telling you how they're there to help you and I really did sense that through the whole process I think we got a lot more out of it and it's not they don't go in there and scrutinize everything you're doing now we were using the old essentials I think we just got in at the last minute for using the old essentials so it was a little easier and now we're doing curriculum change based on the new ones you're all using the new essentials and I have to say that they're extremely detailed they're extremely forward-thinking and fabulous and many of us in here participated in the drafts of those and so don't, I guess my messages don't feel like you have to have everything they want to see that there's a process working toward the baccalaureate essentials and we're all still doing it but to have essentials that were watered down wouldn't mean anything so now we have some really tangible goals to work for so in I came to BC in college in 01 and I was lucky to come to a university where there were people who were already sort of interested in genetics you know Margaret Carney, Sandy Mott, Judy Vessi so I was in good company 01 was a big year you may have heard this morning what happened in 01 but that's when the Human Genome Project finished up which really was the beginning of our work so I was very energized at the time I just finished my dissertation and I decided that I wanted to do some work in finding out about teaching genetics to undergrad students this is what I was doing and I really was curious so along with my colleagues we decided to write this article based on a survey I'm going to talk about in a minute so you have this article in your packet and it does give more details on some of the things that I'm going to talk about in a second and then Kathy and Jeannie have given you the essentials so I just want to say how we've really come a long way since 01 it's amazing to me that this document is out in the shape that it is and it provides us so much guidance you know as you do your yourself studies for the CCNE visit your main thing is to show how you utilize nursing professional guidances and guidelines so this can really provide evidence that you are in fact thinking about these things are you going to have it down by the time you have your visit? No but you're going to be in the process so the first thing we did in 01 was based on some history and I already mentioned my esteemed colleagues at Boston College who had thought about this before in the late 90's as part of a sort of baccalaureate program committee work had used Felicia Lashley's guidelines for recommended genetics content to kind of survey the faculty and find out what was going on there were some recommendations and some follow-up on that and then more formally we formed this genetic interest group in 01 and that's a great thing to do in your school it was just four people the four people who authored the article and some random people who came in and out of the meetings as they wanted to and we had some hard talks about how we can do this how we can make this better and we all had an emerging passion for it so we decided to conduct a survey of our course faculty to look at the integration of genetics and see what we really did and when you do a survey you need some sort of guidance for what it is you're going to survey so at the time the nitchpeg guidelines had just come out and you have a copy of those what it looks like nitchpeg is the national coalition for health professional education and genetics this is a multidisciplinary guidance this is what all health professionals are recommended to know about genetics so they're not nursing specific but at the time we didn't have the nurse based competencies so we used this to set up a very sort of informal paper and pencil survey that we distributed to our faculty and the nitchpeg guidelines look at knowledge skills and attitudes that all health professionals should possess so you can take a look at those they're printed out for you so I'm a proponent of survey research and a survey isn't the only way to figure out what you have in your curriculum you know that you could go and look at all the syllabi but I found from my personal experience that there are things that are being taught in the course that aren't reflected in the syllabi so we decided to actually ask the faculty so we constructed this survey based on the nitchpeg guidelines the faculty from 20 required science and nursing courses and luckily for me in my university the students are admitted as freshmen so they have their science courses in the university and I know those faculty even though they're not in the school of nursing so that's an advantage we have a four year program I get to know them from day one through graduation we got 100% response right that's easy to do if you don't make it anonymous and you can nag people and it was successful and to get an end of 20 isn't really that bad this wasn't a scientific survey at all but it was really I thought it was worth publishing so you know I did it wasn't as daunting a task as I thought so all we did was ask the faculty to indicate whether the competency was met even partially in their course and we took out the nine competencies related to the advanced practice role and we learned that all the competencies were addressed in at least one required course some more than others so this might not surprise you you might think the same thing in your school the competencies most often addressed related to genetics terminology how identification of genetic variation facilitates clinical care the importance of family history and then the need to protect privacy autonomy and cultural identity we did better than average on those what were the least often addressed that were in the niche paid competencies were indications for referral history of misuse of genetic information and ways to access and disseminate current information about genetics and related policy issues so that was 2002-2003 so I haven't repeated that exact survey because it's not exactly the same faculty but I was curious to know last year how faculty felt about about genetics in the infusion in the curriculum and I let me say something else about survey I started to say why I was a proponent of survey research because it's not just the data that you receive it's it's the whole diffusion of innovation where people start it heightened everyone's awareness of genetics that's really all it did every faculty member thought wow you took enough time to survey me on this and here's the points I should be teaching and all of a sudden there was a heightened awareness everywhere it was a very simple thing to implement and I would recommend that you all do it in one way or another now it's so easy with survey monkey we didn't have that at the time we did paper and pencil but even if you don't use the data and don't be afraid to find out that you don't do things very well some of your schools probably teach a lot of genetics I know there's a lot of crowd from many universities who've done a lot on this already so but it's not I guess it's not just the outcome of the survey it's the process of the survey itself so last year I did a follow up again this was not a scientific study at all all I did was ask three questions how important are genetics related concepts in the nursing theory and clinical courses that you teach and more than 90% said somewhat or extremely important I don't think that I would have gotten that result in 2002 now I don't know so like I said it's not scientific but I was pretty happy with that result I think people have really come along I asked which of the following best describes your incorporation of genetics related concepts into nursing theory and clinical courses over the past five years 80% more than 80% said somewhat or a great deal again I was pleased with that there was only 23 responses to this and that was not 100% response rate because I did do this one survey monkey and then what are your usual sources of information about genetics related concepts it was highly variable most people put periodicals and online sources a bit lesser reliance on course textbooks as we know textbooks as wonderful as they are they're a couple of years out of date by the time we actually get them in our students hands the popular press you heard Dr. Guttmacher with his time magazine not to tell you I've used time magazine a few times because they can scoop the news before I get a chance to get to the scientific literature and then some there are some other sources like word of mouth going to conferences etc so people get information in all different ways so when you go to do a survey and you go to or more importantly you go to write yourself study you want to show the professional nursing guidelines and standards that you're going to be looking at so there's a lot of things I'm going to mention a couple of them that are good or not good and you can decide for yourself because like I said if you're going to do a survey you want to go buy something you don't want to make it up in your head so the first thing I we always that's very important to us as baccalaureate nurse educators is the NCLEX RN test plan it was the most recent version is on the web from 2007 and I'm sure you all know how to access that and the other one is what we are immersed in right now and that's the essentials of baccalaureate nursing education so you have that and I'm going to talk for one second about those so you may or may not know this but there's only one time the word genetic is mentioned in the RN detailed test plan for the NCLEX so I think we have a really long way to go because we all know that we say we don't teach to the test but the reality is our students have to pass the licensure exam and if we're not addressing what's in that they've redone the the job study, I forget what it's called that the NCLEX is based on a practice analysis that's what's called, it's on that but it takes a long time for that to get in and Kathy has mentioned how and so Cindy about genetics not being incorporated in the clinical courses as much as they are in the theory courses and I think this is where the big gap is that we're all going to have to address in the many years and of course when it becomes a requirement of their day to day care of the patient it's a little bit easier to incorporate it but we're sort of in that gray area right now where we have to help them pick out the genetics aspects. Now a lot of us in iSong have written NCLEX test questions and many of you probably have too and if you haven't it's a great experience it's really where I learned how to write exam questions and so even though they don't when you go to one of the item writing sessions they divide you up into sort of adult health, PED, psych they don't divide you up according to genetics but I always try to make all my questions about genetics so but of course I have no idea if they ever get in the licensure exam or not I can ask my students and you know when you ask them what they saw on the test you don't necessarily get very valid data they always tell you the things that are probably the test items they always come back and say oh it was all on disaster planning I'm like well if you had 15 questions on disaster planning chances are they were testing out those questions anyway but anyway you all have the same issues that I do with the NCLEX. So I think Kathy and I need to get together because she said there's this appears 16 times but maybe I'm more optimistic than you are when I did my word check of the number of times the word genetics or genomics turns up in the AACN as I came up with 18 but I will go back and check anyway well I use the thing in the PDF where you can search so you know we're all pretty proud of that and a lot of us worked very hard some harder than others going to all those meetings that you had Kathy to around the country to get feedback from people and I think it's pretty amazing how much genetics is in there and I'm actually really proud of that. So I think I'm not sure that using the genetics concepts in the essentials is maybe a good way to format a survey but take a look at it and see if you think that would provide guidance for you on the things you want to survey your faculty about in terms of assessing your utilization or incorporation of genetics. I just put an example of on page 31 and I won't read this to you but it's an example of the genetic and genomic content in the revised Baccalaureate essentials. I never did a count of how many times it appeared in the old essentials. Does anyone know that? Not many. Of course you know they're only done every 10 years or so. Yep. Right so every 10 years and you know but I guarantee 10 years from now we won't be taking out any of the genetics content or words or concepts that are in there. There are also some other professional nursing standards that you could look at and I haven't mentioned those here I probably should have mentioned the ISONG scope and standards of genetics clinical nursing and also the niche paid competencies you could use. I don't know if we're going to talk about the ISONG competencies or not but if it was me I'm going to go with genetic and genomic competencies second edition if I'm going to be evaluating my curriculum again. So well of course we're evaluating our curriculum because we all know it's an ongoing process but every now and then it stimulates you to push it a little more you know not just go to the meetings and make random changes so we're undergoing right now a structured curriculum review and it's timely because the essentials just came out and the CCNE standards changed and we just had a successful visit so we can sort of sit back for a few years before we have to write our five year report and really think about our undergraduate curriculum and the problem that I'm having that I know all have is the multiple competing demands okay because the essentials are really strong in genetics but they are also really strong on other things that we need to beef up in our curriculum cultural competencies gerontology informatics evidence based practice the Q send stuff it's so how do you do that all you're all shaking your heads and I don't have the answer to that but we're trying so what we've done is we started our curriculum revision last January we've been Professor Sandy Mott is spearheading this with me luckily that's great for me she has a lot of experience with this kind of thing and she's also a faculty champion for genetics so that's good but we met monthly January to June and we first thing we did was set our goals identified our strengths and then we looked at we all got binders of all these professional guidelines a lot of guidance from the AACN regarding cultural competency genetics everything I'm almost done revising our program objectives and that's a big place to start and you're doing curriculum revision I don't think that the word genetics appears in our undergraduate program objectives but the concepts that would allow them to fit in under the course objectives or level objectives if you have them really works now we're convening subgroups because we've sort of done the basic work and now we have to say alright so we just sent some people to the AACN gerontology conference so those people are going to look at throughout the curriculum where do we teach care of the older adult we don't have a standalone gerontology course but we have many courses that it fits in same deal with genetics we've never gone down the route of a standalone course it's my personal philosophy and the philosophy of the others at my school that a standalone course would be fabulous granted but something about having a standalone course in a school of nursing makes people the faculty teaching specialties feel like well you got that in your genetics course I don't know if that's really true that's just my impression and rather than really beefing it up everywhere which is what we want to do it's got to be in pediatrics it's got to be in psychiatric nursing and of course has to be in adult health I think a lot of us around the table grew up in the era where we learned genetics anything I ever learned about genetics was in OB or PD and that's not where it needs to go now all cancer is genetic we have to get that message across all cancer is nothing more than a mutated cell it's a genetic mutation Alzheimer's disease there's a lot of genetic implications of that or correlates of that cardiovascular disease age-related macular degeneration diabetes type 1 type 2 all of the really important and prevalent causes of morbidity and mortality in adults in this country and elsewhere have a genetic basis so we have to stop conceptualizing it as a pediatric entity and you know our students are fine with that honestly it's sort of embarrassing what our students come to us knowing if you look through a high school high school biology book lately I know this because of my own kids it's stunning what they learn and so don't let them get away with saying you have to go through teaching them what a punnett square is because they know what it is we're the ones that got to get up to speed on it because we didn't have it in high school or college but that doesn't absolve us from the responsibility of being state of the science so I know the whole afternoon is about ways to achieve integration of genetics and genomics into B.S. curricula but I can't help but use the podium to give a few of my experiences I'll go through this quickly because we have a whole afternoon on it but you know you want to get a key group together if you can it's going to be two people that's more powerful than one you know if you go back and you're a single person with a voice it's going to be a little harder and if you can form a committee because you can always say well the committee decided that's what I do all the time it's me and another person but I do that with students all the time they buy it and then perform a survey if you want to and another thing that helped us a lot was just to you know how you all have faculty development programs even if it's an hour a year and who can do some what we did was we got a genetic counselor from Brand S. University that I happened to know to come in and talk about genetics in the adult and genetic diseases in the common adult onset diseases forget you know cystic fibrosis tickle cell anemia people get that we've known about that for a long time we might not have known the exact gene but we knew about you know the Mendelian genetics so get them to talk about cancer genetics get them to talk about neuro get them to talk about sight those are harder to talk about because we don't have answers I can't tell you oh it's you know it's this valine to glutamate substitution that's causing Alzheimer's disease but you'd be surprised what we really do know and we got to stop being afraid of what we don't know we made a genetics bulletin board I actually just had a work study student update our genetics bulletin board it's easy easy thing to do and the student got a lot out of it and then send key people to meetings and trainings like you're doing now and there's a lot of them available you're going to hear about some of those this afternoon use your professional nursing standards as a guideline and there's so many resources out there that you're going to hear about this afternoon don't think you have to write these resources go steal the slides I do it all the time I teach pathophysiology in our grad program my whole slide presentation on genetics was lifted from somewhere and it's out there they want you to use it also like I mentioned make sure you know what is taught in the basic science and have some expectation build on that not start over you know we start over talking about autosomal dominant in four courses and we found out we were doing that we have to stop doing that we have to it's part of the vernacular so we have to make it there and finally you know get rid of the fear factor any of these experts in the room would tell you that they don't feel like experts because honestly the big thing about education as many of you know from your doctoral programs or masters program is the more you know the more you know you don't know and you know that's one thing I really learned through my education is how much information there is out there and how I really don't know that much of it but that doesn't remove my passion for learning it and you know my reality about what I can achieve and I can't be an expert but you know I know more of my students so thank you from the city of Boston we finally finished our big dig still not any better driving but I'm going to be around all day so I can take questions now or I think we have plenty of time for questions thank you you were talking about the challenges so is there anything that thank you I missed this morning when you were introducing yourself so if you don't have any questions I'd be interested in hearing what your challenges and or solutions have been I actually have a quick question it sounds like we all need to go back and do a survey that would be one of the first things right good is there a pre-made survey that we could steal all I did was take the niche competencies and put them on a page or on SurveyMonkey and said please state which of the following are covered in your curriculum somewhat or not a lot somewhat or not at all it was that simple I don't know of anybody else that's done a survey like that I haven't seen one recently at least with nursing and we did a national survey a couple of national surveys but they're pretty detailed but I'm certainly willing to give those to you and you can take them apart or do what you want but I really like Kathy's idea of just taking the essentials and kind of asking about from that perspective last question about the survey real quick did you have the individual faculty list the courses in which they taught so if they taught several courses they actually listed the number I actually distributed the survey by course so I went through my course list wrote down who teaches it and so there were a couple of faculty that filled out two surveys but I went by course not by faculty name you're all pre-CCNE reporting right now that's why you're here what are the other areas besides genetics that are causing you tension yeah geriatric and there's so much genetics related to that too the national safety goals are part of that and geriatrics but I think faculty are more comfortable in those areas than the genetics content and that's where the problem comes so I teach pathophysiology I don't consider myself even a quarter of an expert but I probably have a better handle on it than a lot of my faculty do and I just think the word genetics just sends a bolt of fear up them I always say that genetics is the new organic chemistry and there are resources out there and we will talk about some of those in the afternoon and so that can help with that it won't solve the problems but there you know can help and of course my area has always been med surge so for me to help the OB or the farm person or you know although the mental health you know I can't specifically do that for them it's always been interesting to me though how the concepts apply everywhere and I like you teach pathophysiology in a grad program and I have one class on genetics but the class has every specialty from nurse anesthesia to master's entry students who aren't nurses it's crazy but you know the basic concepts the Mendelian concepts apply even in the adult onset disorders and in cancer I think there again though the Mendelian there more the students come to then all this multifactorial genomics stuff you know and so that's where their eyes are opened and that's where I think we need to focus even more than the Mendelian is someone in fact going to talk about the Surgeon General's health history I mention it and I do highlight it I don't go through it but you'll see the website and I will talk about how it can be used in the curriculum but it could be a really valuable teaching tool as well not just in your theory classes or didactic classes but in the clinical arena and we ask our students to do a three generation pedigree of their own family using that site and I always say look nurses have been doing genetics doing genetic nursing forever because we've always taken a health history but we have to start thinking more seriously at those adult onset disorders in there instead of just asking you about the things we think of as you know childhood onset because that's where the information comes from and any good clinician will tell you that you start like your compelling story it's all about the family history and you're already teaching your students what to do when there's a family history maybe not doing the pedigrees but Jeanne and I were talking about this last night when I get a family history for a family where there's a child with a cleft lip and palate I might get a very strong family history of diabetes and so what do I start talking about not the cleft lip and palate but you know are you getting glucose testing is your family physician aware of this or your family nurse practitioner aware of this or with cardiovascular disease you know getting blood pressure checks and think about this for your kids and cholesterol checks I mean so it's just really giving you another tool to look at it more comprehensively they don't have to sit down and talk about the inheritance patterns but if you saw a family history like that would you you know first refer back to whoever their pediatrician or family physician or nurse practitioner is but you talk about specialties as well wouldn't necessarily be a genetics referral but who's going to manage that care so that stuff's already being done you know that's kind of disgusting you know I think one of the main things is and you brought this up several times is that fear of the unknown you know I think for myself even teaching med surge that I feel like I don't have enough information to you know follow up on their questions and I think that for other faculty that's kind of the same thing so it's that not being so afraid of not necessarily knowing and helping them to figure out where their resources are and you know I gotta tell you the world has changed in a couple years I can stand in my class with my laptop and a student asks me a question I can just google it right there and get a pretty darn good website with the answer and that's why they see this they see that I don't know anything students are intimidated by a professor that they think knows everything so you can't let them think that's true but if you can help them figure out okay how am I going to find this out and then you can say well what is this google site okay it's NIH yeah I'll look at it you know but it's such a that's why we're all in it's jobs we do because it's nursing and education it's just so stimulating because it's not boring I taught anatomy for a couple years I gave that up that hasn't changed in a hundred thousand years so I just wanted to say that I because I lecture on genetics and I feel like I don't know anything about genetics so I my first lecture I thought let me just you know hey raise your hand if you remember fifth grade genetics and of course everybody did this and then but we started talking about it so it sort of became a discussion lecture as opposed to because they everybody knows a little bit so that was just a thought and the problem that I have and you've probably experienced this too is I just I just taught my genetics lecture in my patho class last week and I had to stay 45 minutes after class because of the line it was all people one woman has five children with severe disabilities do I think they could be related could that be Fregel X could that be mitochondrial disease I'm not a clinician right now I'm going to go see your person but everybody's got a family and everybody's got a family history and you know you see the wheel spinning in the class so that's great the more interactive you can make the class it really works yeah get you in bad situations too questions you don't know the answers so it's like we can't let them sit over there we don't know the answers to the questions but we have students in the classroom with their laptops on and so that's an opportunity for them to Google and get to what are these websites and is the NIH the one you wonder is it the guy with the website out of his grub whether it has a particular issue that is or trying to sell you a test trying to promote them so I think that's what I've been hearing is that yeah a lot of things none of us knows but that's not the point the point is making that link to what does it do what does it matter to people and the way that we take care of people and that that's something that we can all I think identify with pretty clearly Judy can you give me a second sure I just had a thought because Dr. Gutmacher had also mentioned this morning that this is a lifelong process none of us can remain experts right now because it's evolving at such a rapid rate and so if we identify the mechanisms for that to continue learning not only for us but for our students and the clinical practitioners I think we'll be much further headed as the EHRs and the decision making tools become available to our practitioners of the future Judy I'm right here now that sort of builds on exactly what I was going to say I think of some of my faculty colleagues like they have to know this they have to know that they have to know this they have to know that if you come to a realization that everything you teach them is no longer true by the time they graduate which is really true I mean I work in computers and I work in infertility and I work in genetics and those are three fields that you know jeez we're not using DASA anymore and so if you realize that and you realize that the only thing that you teach them of value