all are and I should also let you know that I've been associated with Vermont Energy Investment Corporation for a long time and presently service chair of the board so let's get going as I said we're here because JFO asked us to take a look at the RFS study and in addition to taking a look at it we have engaged two other expert groups Energy Futures Group from Hinesburg, Vermont and Consulting Fern that specializes in low carbon transportation MJ Bradley Associates so we're giving you the analysis based on all of their work in order and I'm just going to begin with an observation the topic of the day is carbon pricing you were asked to the legislature asked RFS to look at the idea of carbon pricing as a way to drive down global warming emissions and they came in they did a big model and looked at what carbon pricing could do and couldn't do and one of the conclusions I'm just going to lead you one to our main conclusion today is that carbon pricing alone is not going to be sufficient it will cost more and deliver less than a set of Vermont based low carbon programs principally focused on energy efficiency and electrification that will be far more successful and cost less than relying on carbon pricing alone that's our basic conclusion and I should say that's not inconsistent with what they said they acknowledged that as well if the chart on the wall right now is something that you may have seen a few times before but it's an assessment of by the McKinsey firm using a technique they use to look at how much it costs to reduce a ton of carbon and how many times could be reduced by two different techniques and the those beginning on the left hand side are techniques mostly their energy efficiency you don't really need to study the details that actually save money so these are ways that we can reduce carbon emissions and save money at the same time and so the interesting question is if those things already save money we have learned over the years that there are lots of barriers to delivering low cost energy efficiency and that's why we have programs that aim to do that and the reason I'm putting this up here is to sort of make the point that pricing alone is already proven not to be the technique that by itself would deliver their low cost energy efficiency or carbon savings in the next slide I'm showing you the results of a study that we did in this particular study was in the United Kingdom and it was done by one of our colleagues who had run energy efficiency programs in the UK and so it's based on real data and the question there is the question asked is in the UK by itself reduce emissions or should some other programs be used in order to perhaps be more effective and what you see here on the little blue wedge at the bottom of this chart shows the conservation that would result if you raised prices on natural gas in the UK by 3% it doesn't really matter what percent we're talking about these ratios and what you get is you get some price response but you don't get very much conservation because people heat their homes and the 3% price rise doesn't make much difference they don't do much and so we then asked the question well what if you took the revenue associated with that 3% cost and invested it in a well designed efficiency program in the UK they did this they took an amount of money by doing what we do in Vermont actually which is putting an obligation on regulated utilities and they they ran a water heater natural gas oil work replacement program which in the UK is the main way people heat water and heat their homes so they ran a program to help homeowners improve the efficiency of their furnaces and the consequences that the amount of savings in energy savings, dollar savings and carbon savings is shown in the area underneath the red corner so saving nine times more money, carbon and gas through a program than they would have saved just by raising rates and that's a lesson that we know in Vermont we have succeeded over the years with efficiency first thinking in Vermont for quite some time and as you know through section 248 standards that the PUC uses energy efficiency dockets efficiency Vermont Vermont gas programs etc we've been saving energy now for 25 years through programs we spend about 7% of total power system revenues on efficiency compared with over 90% of course on supply and delivery and what's interesting about that is the savings build up over time and efficiency is now supplying or displacing if you want to look at it the other way about 20% of the total electricity that demand in the state demand would have been 20% higher today than it is without those programs so even though it's a relatively small fraction of spending because the savings grow over time it has become a very big part of our power mix and it has generated well over $2 billion in electric energy savings for the Vermont customers we've learned on the electricity side and in natural gas that these programs really work they really save people money they lower our demand and Vermont is known around the world frankly for doing that but I woke up recently realizing oh that's nice we do that but I put this slide together now for the hard part our emissions aren't any longer coming from electricity our emissions are coming from two main sources transportation and home heating and we need to turn our attention from just thinking about the regulated utilities and think now about how are we going to save energy through efficiency in transportation and buildings it's not doing away with what we used to do we need to keep we still need to keep doing that but it's adding a focus on buildings and transportation why should we do this you know maybe you all you know that you're totally aware of this fact but I keep being surprised every time I was looking at it that we are spending $1 a year to import carbon that we don't actually even want to burn we have a state-wide goal to reduce those emissions by 80 or 90% and here we are spending $2 billion a year to buy it and bring it into our state instead of doing things inside our state that would lower that that's equivalent by the way to two times the size of the Vermont agricultural economy altogether and the total income of 35,000 median Vermont households now that's a big bill how can we spend less and save more here I want to get to the question and I'm now going to just get ready to turn this over to my colleague that I in this slide called carbon efficiency and this is because a lot of the discussion around carbon focuses on carbon price economists love to talk about carbon price as a bill payer I like to answer the question how much is it going to cost per ton to avoid a ton of carbon in our economy so the questions that I would urge you to ask about programs to reduce emissions how many tons will it save how fast will it work and how much will it cost per ton of oil alongside that we need to recognize that whatever we do it needs to be fair and inclusive to everyone and look for ways to advance ways to serve the working Vermonters, working families and vulnerable populations alongside the goal of carbon reduction so now I'm going to turn it over to my colleagues as I said in the beginning we commissioned two studies on transportation and one on housing and Dave's going to talk about transportation. Thank you. Folks I'm just going to take the next several slides just to explain to you a little bit about MG Bradley's analysis of the transportation questions we put before them and to explain how they approached the question what I think are important takeaways from this study. First, what they did was look at two scenarios one of the business as usual scenario and the other 80% production by 2050 scenario. The business as usual scenario has no change to US CAFE standards that's fleet efficiency standards, federal fleet efficiency standards no policies to promote renewable fuels transportation fuels and relatively low levels of EV adoption that's the business as usual approach and what they modeled as steps for Vermont to take involved doing something about CAFE standards increasing those standards, increasing the use of renewable fuels and electrifying transportation. Basically what you have up there are these specific strategies broken out. What they originally did for us, we asked them to take a second look at was to take a look at all the transportation sector and what it would cost to decarbonize it by 2030 and 2050. When you look at all of the transportation sector you're looking at a Nissan Centra and you're looking at a semi-truck and you're putting it all together for one sort of analysis under a model and that just, we didn't find that particularly helpful. We asked them to break it out to light duty, medium duty and heavy duty. What we found was very interesting news with respect to light duty vehicles they still had the average so there's an average car they're looking at and that average car looks like an F-150 it looks like a medium-sized SUV it looks like a mid-sized automobile and a small automobile it's all glommed together so that's the way modeling works I can't help you with it much more than that but the good news about light duty vehicles is that with some support Vermont can get on a path to electrifying transportation with respect to that slice of the transportation sector we think that's really important as far as the specific figures go Rich talked about what is the price per ton avoided because we think that's a really good way of measuring what otherwise would be apples and oranges and what you see when you when you look at that with respect to light duty EVs for $16 metric ton avoided Vermont over the next 10 years at least up to 2030 can basically change the market, transform the market and that means Vermont can step in with some supports to make up the difference between the price of a conventional light duty vehicle and an electric one provide supports but after 10 years they can almost completely step away so for about $7 million a year between now and 2030 they could model and demonstrate that change could take place it ends up to be in about 2 cents a gallon when you look at medium duty on the other hand and heavy duty there's a big challenge there the model assumes people drive 12,000 miles a year 1000 miles a month if you have a $10,000 car a $20,000 car you can do the arithmetic but if you have a car that's much bigger or a truck that's much bigger with much greater power needs much bigger batteries then the price goes way up and if you're still driving 12,000 miles a year it's just not going to pencil out so there's some big numbers cause a little backlash when you look at the medium duty and heavy duty but the news about light duty vehicles it's a very positive news and we're really encouraged by it I guess I'll leave you with that and have a break we also looked at the building or heating sector as transportation in the heating sector we identified a number of programmatic actions that we thought would be of high value chances are that they would have significant reductions in carbon but we didn't do a full fledged one of the best programs you could possibly imagine sort of analysis of five programs you see them here low income weatherization residential non-low income weatherization retrofitting boilers and furnaces with cold climate heat pumps and then retrofitting as well water heaters, domestic water heaters and the last program we looked at is replacing school boilers public water boilers and you can see roughly we looked at the object was to get about roughly anywhere from 40 to 50% of the eligible market in the next 10 years so this is a menu of programs the heating programs here you see the costs and benefits these are all in the present value to 2018 dollars and that was true as well of the transportation numbers by way of comparison the RFF report looked at 2015 dollars but they're roughly comparable a couple years of discount and they want to keep in mind we took a look at these programs from two perspectives one is what we call the total cost perspective and that is the cost of the program plus any of the costs that the participants in the program would pay so if I'm getting my house wet our eyes the program pays for part of it and I pay for part of it in the low income program in leatherization it's paid for entirely by the program the other three ones there's a sharing so that's the total cost perspective the program cost perspective is of course the public dollars that we would be talking about that would support the program and what we found again going after 50% of the eligible market in 10 years which is quite aggressive we found that these programs save money straight up, they are economically efficient they're cost effective these are things that you want to do because they save Vermonters money from the get go before you even think about the carbon benefits so these as you can see there are some significant numbers here these are millions of dollars in 2018 dollars and the benefit cost ratios as you can see from the various perspectives are all well over one when you take a look at them from the perspective of the tons of carbon that they avoid this sheet will give you an idea this table will give you an idea on the left are the tons of carbon that these programs would avoid and on the right is the program cost the far right the program cost per ton that you avoid because these are all cost effective programs from an economic perspective you get the carbon savings for free so if your object is to get carbon you want these are lower than low cost carbon savings these are negative cost carbon savings go the slide that Rich showed at the beginning that cost curve from lower left to lower right all those things on the left hand side of that curve were programs that you can do to save carbon that are economically beneficial so you get the carbon for free and that's true of the heating programs that we looked at for this for the purposes of this study now just for sure I just got to say I'm normal with tables like this and if you would just walk me through let's take the biofuels with pellet because those are pretty simple numbers simple as best for me so in the total cost perspective we've got 20 million is that correct in current dollars 20 million of costs of costs and 46 million in benefits that's correct in its total benefits those are the costs that are avoided by doing this thing so what you're doing is you've got a wood pellet boiler instead of an oil fired furnace primarily what you're saving in that 46 million dollars is the cost of wood you are also avoiding some replacement capital costs if you kept your furnace down the road or five years down the road or 15 you'd have to replace it so that's the value of avoiding capital replacement is there too but it's primarily avoided fossil fuel costs and then we have 26 million dollars net of savings zooming all the way over to the far right well I guess the current net benefits not quite far right that's 30 million dollars it costs us 30 million dollars to get the 26 million net is that what that means he's on the bottom he's at the 30 million two perspectives total cost perspective the total cost perspective includes that NPV of costs the 20 million includes the costs that the program pays and the participants pay so there will be some sharing from the school primarily in fuel costs but maybe some casual costs as well on the right side we're only looking at what the program puts into it so that 16 million dollars is the is what the program would pay for which means you subtract one from the other the sharing by the participants is 4 million dollars but the benefits the total benefits are still 46 million dollars from a program from a public dollars perspective we spent 16 million and we get 46 million back and 30 in net and this will get about 90 schools over 10 years out of an eligible market of about 180 from the program okay, thank you very much that was a great question and what just got written they were using 3 real well that's the 3 percent real and of course inflation is not good okay, thank you okay, so just back to this one and finally it's a negative negative cost per ton of carbon now I just wanted to summarize that this is the the chart that you and I just looked at a moment ago I took all five of the programs and added them up and if you were to do all of the programs and of course you can do all, none parts of them or whatever but on our analysis if you were to do them all this is what it would look like 786 excuse me, 524 million dollars of public investment for 954 dollars of gross savings of benefit cost ratio of 1.82 again that's aggregated just to give you an idea of the magnitude of the potential savings so roughly saving $1.80 for every dollar you spend sorry, my fault okay so now just a couple of wrap up conclusions we begin this work with a real sense of urgency about climate and I'm also motivated as a former utility man who really cared about what the mothers have to pay highly motivated by the fact that we are sending so much money out of our state by fuels that we could keep it home by being more efficient and we know how to do this I'm going to start with sometimes legislators ask me alright, I know we can't do everything but what could we do that would really be the best way to start and I would say in addition to the programs that Vermont already has in place which are some strong energy efficiency programs by utilities and efficiency Vermont and Vermont gas we have the weatherization assistance program that is cost effectively assisting low income households to live in healthier and less expensive homes and I would start by encouraging first that we at least double the size of that program there is something like 50,000 eligible housing members that are in need of treatment and are eligible for treatment under this program and we've been serving less than a thousand a year at that rate we'll never get the low income housing start renovated to healthy and efficient standards we could easily do much better we have a question for you how much does the weatherization program rely on federal funding and how much is their state funds currently 80% of our programs state funded we only get 20% and that tells you something about how weak the federal program has gotten in a couple of years if it weren't for the state program our program would be incredible now my second small bullet there has to do with how we pay for programs we should just face the fact that over the years we have been successful in raising money through the regulated utilities to investing energy efficiency and as I said at the very beginning we've saved well over $2 billion by doing that but we have not been successful in attacking the thermal side the liquid fuel side the delivered fuel is however you want to refer to that category we just haven't done it we have a very small contribution to the program we are spending a few we have tried to attack thermal in a couple of other creative ways but for the most part we should just face the facts here that we are under investing in thermal efficiency and thermal fuels contribute far less proportion to energy efficiency than electricity and natural gas they are just not on a level playing field I think the rate for electricity is something like 10 times higher than the rate of revenue we are getting from fossil fuels as I say here thermal efficiency and housing is a priority and we have programs in place that we can build on to continue those programs and to make them stronger advanced wood heat in Vermont schools I personally think this is a terrific idea it's good for Vermont's forestry resource and forestry business and saves money for the schools and keeps the money in Vermont on the transportation side we recommend that the legislature stick to the resolution that you have already enacted encouraging a strong regional transportation climate initiative that program is starting now and deserves your continued support and it would be a good thing to launch a program to improve access to low emitting vehicles for working and low income families that are currently being when they are assisted in the transportation area they're being historically assisted to buy very low efficiency relatively high cost vehicles and I'll close to that one thing that's not here but is in our report is the final table that compares the relative costs of these programs in a way that we thought might be helpful to you Rich has emphasized when you're thinking about carbon efficiency the cost per ton avoided matters and the lower the cost per ton avoided that's why I like doing the buildings part of this because I get to say negative cost per ton and I feel good about that compared to others there's a slide that we don't have here operator malfunction that compares the average cost per ton avoided by the buildings programs or the heating programs that we've described it's about $141 negative on a program cost basis the transportation like duty vehicles as David said about $16 a ton from that program and past 2030 those numbers go negative again because EVs are more than comparable with light duty EVs are more than comparable with traditional cars lastly the RFF report gave you four price paths for carbon on a pricing only basis if you were to price it here's what's going to happen the trajectory that they gave you for the horizon that they were looking at it's something that they called WCI the western climate initiative expected prices to have that would produce savings per ton at a cost of savings at a cost per ton of over $400 you see there's a huge difference and the only other thing I would add to that is some of the programs some of the costs of the programs that we've looked at and again they are illustrative these are not deeply well designed but if you were to do them you'd want to be putting a lot of work into program design and delivery and really sharpening pencils on that but the public dollar costs of the programs are significantly below the total cost of a price path under the lowest cost price path that RFF even began to talk about just to give you an idea of the orders of magnitude and then we show those numbers in order thank you, thanks for your patience we're excited to answer questions representative forgates early on in the presentation there was a figure of cost of $2 per something was right no I'm not remembering $2 per set $2 billion I remember you know I'm thinking that it was $2 per chance oh no $2 per gallon of gasoline $2 but maybe it was $1.2 $2.0 actually anyway two cents a gallon would give you the $70 million between now and 2030 that would support that market transformation for like-duty vehicles that I described as the I think the best take away from the MJ Bradley analysis I've got can I ask one more question and this may not be an area that you're associated with I was at a state budget appropriation hearing in Springfield Monday night and it was all people with asks and one of the asks was for a person who is extracting limestone from the atmosphere to save on carbon is that anything that you would want to comment on well there's a Swedish company excuse me a Swiss company is trying to do this as well I have the question you ask is how much is it going to cost per ton of carbon dioxide that you get out of the atmosphere and they can answer that question and I think you'll find it's pretty expensive I suspect I hadn't heard of that one before the various carbon capture and sequestration technologies so far have all proven to be more expensive than people want to pay and I just go back to I guess almost my very first slide this one I just go back to here and say why are we ourselves up on the right hand side of this slide when we have so much to do on the left hand side that saves money for homeowners while we go about it so the two cents a gallon on gas gives us money for going to electric vehicles I have a question about that and then for efficiency building efficiency where do we get that money so we're in the right building to say it's your choice of course but I'm just trying to be really straight to do about the disproportionate way that we fund efficiency in Vermont today and we have historically avoided raising money for efficiency on delivered fuels and one of the best ways that we could take a step would be to do better on that side and you're thinking that there's an equitable argument there if you're getting if you're using gas or electricity if we have natural gas we're paying if we have propane we're paying it on what so the regulated fuels electricity and natural gas and this is because of initiatives begun by the regulators a long time ago and maintained for 25 years since we knew the regulators and such a person we knew that it was better for ratepayers to spend money on efficiency than it would be to spend money on power plants and transmission lines and buying fuel and all that and because those programs were proven to be cost effective we created energy efficiency programs for the regulated utilities electricity and natural gas the unregulated fuel suppliers have been for the most part not participating in supporting or paying for those products and therefore thermal savings in have been left not entirely fine because we have some thermal programs but they have been under supported so I would recommend that you take a hard look at that and consider a charge on delivered fuels that's somewhat closer to what we're spending on electricity and gas for the purpose of giving it back to customers in the form of energy efficiency and at a minimum you can do this I urge you to think hard about doing it for low income housing but if you do for low income housing does that mean where people are renting? Is it the renting when you're giving it to landlords? How that program works is something you should ask for whether it's an assistance program mostly in those rental units it's the tenants who are paying the bills so you're actually benefiting the tenants when you lower them So as this relates to Act 250 what would your recommendation be that we should go with the enhanced building So I haven't studied the actual legislation that you're considering but I have long supported the energy efficiency standards in Act 250 My first jobs in Vermont government actually was Executive Director of the Environmental Board learned about that program then and I would say for new construction in Vermont we should definitely adhere to high standards I don't know if that needs to be perfectly high standards to encourage efficiency So the two cents a gallon on gas for light duty vehicles where are we going to get these vehicles? I have a Honda theory and I those electric vehicles we're going to get them Are you going to share Chevrolet if you want You can go to the Chevrolet dealership in Barrie and go online and buy a used EV for $7 or $8,000 when this just come off the lease it's got 30,000 miles on it and plenty of life left with the technology going smaller battery vehicles are being put to the side and people are getting newer nicer vehicles but there are a lot of EVs out there that just happen not to see them because there aren't a lot of them in Vermont Where are there a lot? California Massachusetts California actually per capita Vermont is doing pretty well the uptake in EVs is pretty good in Vermont but it's slowly growing last year 200,000 EVs I think were purchased across the US I'm really intrigued by your focus on putting carbon aside that's an extra because the real benefit is to the resident that is living in a drafty house and they're uncomfortable much of their income is going to be more heating and it's expensive so what you're implying is there are strategic ways that we can make policy decisions that can meet result in helping Vermont residents keep money in their pockets that's absolutely essential here we have an affordability issue we hear often that people are struggling whether it's their mortgage or whether it's their rent and so these are real strategies to help us address affordability do you have any information regarding the percentage of households that percentage of their perhaps their income that is goes towards just their basic necessities of keeping the lights on or their houses heated is there anything like that? there must be somewhere because that would be critical we do know on the climate side it's the second largest sector in terms of contributing but this seems to be a win-win strategy if we get to determine how to best finance it in terms of saving Vermonters money and making our places of a bow more affordable yeah absolutely I don't have those figures we can get them certainly other representatives probably better than we certainly the weather station assistance program folks they know those numbers inside out you should have you should certainly talk to them it varies quite a lot housing type I was just going to add that the same observation applies to electric vehicles so many Vermonters are rural they drive a lot to get to work to get to the doctors to get to a restaurant to do anything and they pay more probably more out of their income to fix their trucks fix their cars so to the degree you can get them into EVs that have lower maintenance costs lower the sooner you can do that the more money they're going to keep in their pockets we have another meeting but we can split if you still have questions one of us can stay let's see are there more questions yeah so the delivered fuel packs good benefit would you recommend excise tax for that yes we collect now a gross receipts tax that supports the weather station program at the the wholesale level and I would recommend extending that for the purposes I want to be clear here for the purposes of saving homeowners money on fuel and there must be models that you didn't include public transportation the opportunity to invest those dollars in public transportation and maybe heavy rail we didn't look at those the menu was really big huge so we just picked ones that we thought would be frankly would have a significant bang for the buck in Vermont from the get go we make that judgment call giving the time and resources heavy rail probably coming from everywhere else yeah okay thank you any other questions thank you very much thank you very much we're more than happy to come back answer any of your questions if we get a chance to give you a report and there are I reread it and I'm asking questions so by all means we're more than happy to come back and be on call feel free our contact information I think is in here thank you very much for the time we really appreciate it we will follow you out and ask you a question please


So Jeff says, good evening. Hey, it's morning somewhere. I'm searching for a way to create an alternate site collection, which will eventually replace the current main site collection of my client. So currently, companyname.sharepoint.com is the default SharePoint site. The site is sort of jacked in the way that it was, it's ripped, it's buffed, it's jacked in the way that it was originally created, and rather than reverse fix it, I think creating a new site would be best. Google and BingFu has been exhausted and not finding the best way to execute this operation. I'd like to create companyname. Underscore a.sharepoint.com and an optimized setup and once approved by client, move existing documents over then nuke the original. Appreciate any insights or directions on this. Well, I'll start by saying companya.sharepoint.com is buying a new tenant. Yeah. So I think this is a classic case and the links I dropped in were oriented around site swap, root site swap. That's the way to not incur additional expenses. I also threw a link to the page diagnostics tool in there because any root site swap now requires a clean bill of health from the page diagnostics tool. And I know you were on this one too, Sharon. Super duper easy to do. I think the only caveat I would add on that is that when you do a root site swap, it automatically marks the outgoing site as an archived. It changes the URL to an archive site. So just be forewarned that you really are kind of nuking it. Can you recover from that? I'm asking, because I don't know. Can you recover from that if it's an archive state? Like use a migration tool to move stuff if you had to? You still, if you click on it, it'll still like, you can get to stuff, but the problem is, is that what I have found, and I'm still waiting for this to get fixed, is it doesn't recover. Like, so let's say for example, you have slash site slash site one, and you make that the root site, that slash site slash site one, that name that was there gets taken and never gets given back. So it changes it to an archive state, but you never like reclaim the original site structure name. That's also another thing that I've turned in is kind of a hanging issue for doing it.  So you have to unhub everything. You have to, like Sean said, make sure it passes all the diagnostics that's clean and know that when you swap it out, that it's for all intents and purposes, it's kind of trashed. As of now at least. I think the technology part will be straightforward and doable, but it's the change management piece when people have lost all of their favorites and links to documents or other site assets have gone away. That will be the hard part and the part that you'll need to reconcile before you do anything like this. Good point. Yeah, if you're really smart, you probably do maybe plan ahead, maybe migrate things you need. Communicate, communicate, communicate. Yeah. Details. Yeah. But then they have to pay attention to, that's the other piece of it, right? Cool. Not everybody's good at that paying attention thing. Plan, plan, plan, plan, plan, plan, plan. This is overrated. Yeah. Where's your sense of adventure? Come on. Throw caution to the wind. See what happens. Live a little. That's exactly the attitude I want to hear when I'm moving sites. Especially hiring a third party consultant to come in and do it. Exactly. This guy clearly has my best day, cheers and heart. That's right. It's the spice of life, people. Come on.


Alrighty. Hello, everyone. Thank you, first of all. Thank you, thank you, thank you for coming to listen to this talk. I am very grateful that you were willing to spend some time to tune into this presentation. So this presentation is on attacking ICS devices or industrial control system devices and threat emulation with CONPOD. So admittedly, this talk was intended to be in person, live kind of a real event with a roomful of people. Maybe we could do some cool demonstrations and very fun cyber tricks. But unfortunately, with kind of the state of the world right now, we are doing this remotely and virtually digitally. So unfortunately, I kind of watered down what this talk kind of could have been. With that said, I still wanted to bring it to you and I hope that you do, I don't know, get some good information out of it or find your own good gold nuggets maybe that you could take away. So without further ado, let's dive in. First, I have to go through the obligatory introduction, right? Hello. Hi. My name is John Hammond. As part of my day job, I work with the United States Department of Defense with their cyber training academy. I'm a cyber security instructor and kind of a curriculum developer course architect there. Previously, I was working with the Defense Threat Reduction Agency as a red team cyber operator and a lot of really cool stuff in that regard. But that's just what pays the bills. It's really not what's important and fulfilling in our day to day lives. At night, for fun, the really, really good stuff, what I like to do as part of my passion, some pet projects, I do love to play capture the flag. I think that's really, really important in sharpening your cyber security skills and just learning and continuing to grow and kind of pursue that passion. So not only do I like to play a lot of capture the flag, I do like to host and create and develop my own competitions and events. You might have seen me do some work with maybe verset con, the virtual security conference or noncon or previously some others and hope to do more. I also have a small cheesy growing YouTube channel. I like to showcase a lot of cyber security videos or capture the flag walkthroughs or programming tutorials, etc. So you can find me there if you would like to. Okay, let's talk about the real stuff. Let's talk about this talk. This slide is a kind of a roadmap and outline. This is the agenda for what I would like to bring to you today. So some of the bigger concepts we're going to end up setting up con pot, talking about what con pot actually is, what this kind of tool and utility can do for us. And then we'll go ahead and build out an ICS example or industrial control system example, seeing what we can do with con pot to put together maybe a PLC or an HMI that programmable logic controller or the human machine interface that actually lets us kind of have the bare bone essentials for this ICS example and demonstration. And we're going to generate some OT activity or that operational technology interaction. You know, a lot of times we hear the acronym IT for information technology. And that's really good for software or protocols or things that you might see within a corporate network. But when we get to the conversation of industrial control systems, let's turn that acronym on its head. And let's say OT rather than IT for operational technology. So we're going to be talking a little bit about Modbus, some protocols, etc. And then we'll get into simulating threats, or doing some actual cool attacks and offensive stuff with it. Not only are we talking about the offensive work, I would like to at least start the conversation of defensive procedures as well. At the end of presentation, we'll wrap it up with some links and references if you'd like to get in touch with me. And of course, thank you as always for listening and tuning in. Okay, now let's set the stage. Now that all of that fluff is out of the way, let's talk about doing this thing for real. So I am going to be working on an Ubuntu Linux machine. I include that logo here just so I can say, Hey, I'm going to be working off of a flat vanilla Ubuntu image. And that is kind of my Linux distro of choice. You could probably just as easily spin this up, start this sort of thing in any other Linux distribution that might tickle your fancy, that might be your weapon of choice. That is kind of what I tend to work in. Along with that, a lot of the code, a lot of the stuff, a lot of the programs and software that I end up putting together to work with this sort of thing. Again, I'm typically working in Python. And Python is actually what Kanpot, which we will come to explore and work with is written in. And that makes it very, very handy to kind of extend it, add new things to it, explore it, etc, etc. So that is the trio here. These are the three stages that I'm going to be putting together as kind of the vehicle, the vessel for this talk, Ubuntu Linux, Python as our programming or scripting language, and Kanpot as really the good demonstration of how we're going to be putting together these industrial control systems. Okay, what is Kanpot? You've heard me say this word over and over and over again, but what the heck am I actually talking about when I say that if you aren't familiar with it previously? So this is interesting, right? Kanpot is a server side industrial control systems honeypot. And now you think of honeypot, you oftentimes think of some maybe attractive, deceptive trickery or a trap that attackers might fall into so that you could actually kind of monitor and see, oh, this is the sort of gimmick or gotcha that maybe an adversarial offensive bad guy might go after. And that way you can kind of see what they're doing and how they operate within a network. We're actually going to be using Kanpot, yes, as that ICS or industrial control systems honeypot as a honeypot, right? Because you might want to set this up to see how if it were accessible on the internet, people would try to beat it up or work with it or do things to it, just interacting with that port or working with those protocols. But we're going to be using it just to kind of have mental and abstract playground for working with these industrial control systems and these ICS devices and protocols, et cetera. The wonderful thing about Kanpot is that it is all software based, right? So it's easy to deploy, modify, extend, providing a range of common ICS protocols, and you can build out your own system to emulate complex infrastructure without actually having all of this hardware. So you could pretend to be a power plant without actually having to have to own a power plant, right? Kind of neat. You don't need to have a real water tank or whatever HVAC system or whatever you're trying to put together. You don't need to have that real world physical hardware stuff. We could just kind of emulate all that with just our keyboard and our computer, more of that programming software hacker mindset. So because we're providing complete stacks of the protocols, Kanpot can be accessed with productive HDMI or extended with real hardware. So you don't need to have the giant physical machinery or whatever the case may be. We can work with it on our own. If you want to check it out, you can find it at kanpot.org. But let's dive into it a little bit more. Let's talk about how to install it and get it ready. You can find a GitHub repository, github.com, searching for Kanpot. The work that I had done with Kanpot previously is a little bit before this time in our lives, right? So right now it's 2020. Python 2 is long gone. Python 2 is dead and is meant to be forgotten and abandoned. Admittedly, some of the code and stuff that I've worked with before previously was before that, okay, end of life for Python 2. So some of the stuff that you might see in the slides, forgive me, maybe I don't have my parentheses around my print statements or we're just doing weird things with bytes and strings or I'm decoding things and hacks, whatever the case may be. I don't want to alarm you or make those bells and whistles go off in your heads. That's just, hey, putting that out there. In the installation instructions that you will find for Kanpot now, currently at the time of recording, at the time of this presentation, it's going to be encouraging you to use Python 3, specifically Python 3.6. And they even offer a Docker, if you're into that containerization, kind of like lightweight virtual machine, like containerize everything mentality, you can just pull down Kanpot and work with it as a Docker container, as a Docker image, a Docker instance. But they do recommend and if you take a look at their documentation, check out what they're telling you and advising you to do. They actually do recommend, let's go through this procedure to install the system dependencies. Again, I'm on Ubuntu. So I'm going to be using apt get or aptitude apps to install all the system-wide dependencies. And then with Python, Python 3.6 in this case, I'll go ahead and create a virtual machine that I can kind of keep all the packages necessary for Kanpot in.  Okay, at this point, if you had successfully gotten Kanpot installed with just those simple commands, you should be able to run it from the command line just simply Kanpot. And you'll have this nice little ASCII art displayed showcasing your version. So at the time of recording this, it looks like I'm at version 0.6.0. My previous time doing this work and research and exploring more and more of the depths of Kanpot was a little bit before that. Even then, back then at that point in time and now, taking a look at the documentation that Kanpot will offer for you online as part of the repository when you do your research, unfortunately, it is a little bit lacking, right? I'm showcasing some screenshots and snippets of, oh, these are the protocols that are outlined and defined within the packaging that Kanpot provides for you or the templates you could use to quickly spin up an ICS device. There's nothing there. And that's kind of a big bummer. It's not too bad though, right? Because, hey, it's open source. We've got the repository. We've got the source code. We know Python. We've got our bearings in Linux. Maybe we can figure this out. And that's kind of exactly what we did, right? We started to explore Kanpot. What can we do with it? We mentioned templates. And you saw just maybe a brief second of it in that previous slide. You can provide Kanpot with a given template so it knows how to behave, how to operate, what to really do or what to emulate. We could quickly put together, just have this mental abstraction of maybe a power plant or a gas tank or a water pump or maybe a flat bare-bones, simple Siemens S7 PLC that we could work with, right? If I use that hyphen hyphen template or TAC-TAC template default, you might be able to see that argument shortened, kind of the shorthand case as TAC-T and then default. We could suggest and specify, let's just use the default Siemens S7 and get some access to these protocols, right? HTTP, Modbus, S7 COM, SNMP, et cetera. And it does include some other templates. This is just an excerpt. I did not include all of the ones that you may find with Kanpot currently in this kind of screenshot picture here. But the one that I find most interesting and most useful to us is that default template with the Siemens S7. Taking a look at that Siemens S7, again diving into the source code, operating with the utility, trying to spin it up and see what we can do. Once again, kind of run into some bumps, some speed bumps that are slowing us down. It's not doing everything that maybe we could have expected. As it turns out, Kanpot is a little bit limited into some of the functionality and features that it has. Or maybe it's just expecting us to go ahead and implement them or extend them ourselves, right? So if I'm looking at the source code for that S7 COM protocol for working with the Siemens S7 PLC, these parameter mappings, the bytes that I might send, maybe I'd want to read some data out of the PLC or write some data to it. Unfortunately, you can see here in this image, maybe we don't have the functionality in place yet. That request is not implemented. Bummer, right? Even in the comment just above here, you can see the inline Python comment there with that sort of hashtag or octothorpe. They link us to this web page, but that web page seems to go nowhere or not exist. So, dang. Okay. Whatever, stumbling blocks, maybe we can just roll with the punches, we'll go with the flow. At that point, we can do our own research, kind of learn a little bit more up on what all these protocols actually are. What can we do with them? So in our scenario, we wanted to put together a simple rudimentary tank. We wanted to get our own ICS device up and running, at least in our minds, in software within the computer, because we don't have a giant, however many tons, water tank, however many gallons tank, we don't have that physical hardware or that machinery or everything in the real world to actually do that. So, Compot was going to allow us with a little bit of legwork, with a little bit of our own thought and tinkering, be able to create a PLC. So, you can see I've kind of opened up a little bit of the source code here on the left, and I've needed to create some extra files. Some of that might just be, okay, let's, let's colluge together the functionality that might make these calls between trying to read data out of the PLC or write data into the PLC, etc. And just defining what this object is, thankfully, is just kind of an XML file. We can just configure it in a declarative sense. These are kind of the attributes, the keys and values that we want, maybe this object to particularly have, or the information we can read and write out of it.  If anything, we just have this conceptual abstract mental representation of an ICS device and operational technology. With that, we had the PLC, right, we had the programmable logic controller with some of that code put together. Problem is, that's still just operating, it's still just acting as a thing, right. Maybe it's the brain, and we talk about some of the ICS lingo, the PLC versus the HMI. The PLC is literally the logic controller, it's literally the chip, it's the brain, it's the mind that's making all these decisions and doing things, but it doesn't have a way that we can kind of know what it's thinking. We need to be able to see that, it needs to have its own representation. So, then we bring in the HMI, or the human machine interface, right. If the PLC is kind of the brain, the thing that's thinking, making decisions, we need to be able to see that, actuated in reality, so we have to have a body for it. And that's what our HMI is, so we can actually work with, interact with that, move things with it, do things with it. That's the HMI that we want to put together. So, we actually ended up creating just a small, gooey interface. I actually did this in Glade in Python, kind of the, one of the, I think Glade is a, is a whizzy wig, or what you see is what you get. Editors for designing a simple graphic interface, but we would have kind of, these rows, or these kind of symbols that were indicating how high or how full the tank was. We would have kind of green lights, all in a vertical line there, and a column arose to say, hey, this is the current level of the tank, whether or not it's full, whether or not it's like running low, et cetera, et cetera. And we would include those values between temperature and pressure. And we could simulate this idea. We could emulate this operational technology. We would have some logic in there to be able to pull from that and update the actual gooey or the HMI in our case, but it needs to be able to stitch into the PLC, right? HMI needs to be able to know and hear, kind of understand what is happening on the PLC. So with that, we started to have to put some of these pieces together.  It's not the best way to kind of get information across, right?  That might be silly. I do, however, want to show you how we kind of put this together, right? And again, forgive, please, my old Python two isms. I know the Python Easter's or the Python evangelists that might be listening are yelling at me. This is some time ago. And that is how we would be able to stitch together our HMI and PLC. We interact with just the simple socket for that seven protocol chilling out on port 102, connecting to it as necessary and sending some bites, sending some information in that protocol language to say like, hey, I want to know some information. What can you tell me? Kind of gather that information, send it all, all in that byte format and request some data. So you can see that data rec variable, data request, and then data three is what we receive and return from that, the information that we're gathering. With that, I could continue on in this function. And not all of that is included here in this kind of excerpt or the snippet of code here, but we'll start to kind of massage and pull out the actual information and data that we really wanted to know that we can reflect in the HMI and that GUI output interface. What's really happening here, though? What's really being done? How are we communicating? That's simply the socket, right? So all it takes in our case, thankfully with conpot and what we're working with, we just have a simple network socket that we can send and receive bites or data to. And we can do that with Python. We could do that with probably Netcat, honestly, if we even really wanted to. But having that in the code, I don't know, wrapped in code, wrapped in the mentality that we can do this in Python. We have these bindings. We can automate this. That's a big deal. We can simply automate interacting with the PLC. And with that, we could do a lot of stuff, right? Because now you've got the entire arsenal of Python and the programming mindset, methodology, anything that you want to do, you have superpowers. Now let's hammer this industrial control system device. And it's in the kind of caged and containerized playground and kind of encapsulated into jail because it's a honeypot, right? We're simulating this. We're not actually going to hammer and beat up a little gas tank or power plant or whatever we're thinking of. But we can emulate some threats and maybe tinker with them to see what we can do and how we can do them. That's kind of neat. Okay. While we're doing this, what's to stop us from checking out those packets that we're sending? Because we are going to be sending some communication, right? We are sending traffic back and forth when we're interacting with these protocols, Modbus S7, everything that the Siemens S7 PLC might be doing. So Compot will spin up all these servers and they'll work with them for us. But what we can do, acting as kind of our own adversary or whoever we want to be or whatever hat we want to be wearing, white hat, black hat, gray hat, whatever the case may be, we could listen to our own traffic. Take a look at that protocol, break it down, work with it, with T-Shark, some of the command line sniffing or listening utilities. Pyshark, again, if you want to automate that in Python, kind of wrap that all into our own sword, right? TCP dump again on the command line. Wireshark, super-duper easy. Now we're just operating in the GUI. Wireshark would make that incredibly easy. Just be able to see, examine, drill down in the packets and maybe we could see, hey, sending some requests from this Compot, from this industrial control system Honeypot, what data and bytes and packet headers are going to be necessary to actually communicate with this thing, with this device. That's an option and that's one way to go about it. We ended up doing that so we could put together some potential attacks, right? What could we do now that we've set up this gas tank, this water tank, whatever device that we actually want to beat up as our target or as an OT or ICS device? Some of the things that we came up with were simple network attacks, right? You've heard these before, you've seen these before, these are probably the most common things you can do. A man in the middle attack, why not? Set up a simple proxy, maybe we'll put a bad guy in the middle, right in between someone who is innocently enough actually trying to operate or receive information or do things with the endpoint target, the actual ICS device and we've got ourselves the bad guy just listening in in the middle and seeing all of those protocol statements come through. What do the packets actually look like when you say you want to lower the water level however many gallons or however much level in the tank? What does it actually look like when you are pouring in more water? Can we have that packet and maybe be able to determine what else we can do with it? Is there any sensitive information that might be included in that for some reason? I mean, there may very well be, right? If we're looking at temperature, we're looking at pressure, we're looking at actual real world things, maybe there could be some danger in that. But one of the really cool ones that I was just kind of alluding to was knowing those packets, what might be necessary to raise the water level or lower the water level or turn up the heat, increase the temperature. If we could replay that packet over and over and over again, what could we do? Could we pour all the water out of the water tank, make it just flood out, disappear, break, go away? Could we overflow the water tank? Could we absolutely ruin that entire container, that capsule, that actual real life thing? If it is something that we're controlling temperature or we're controlling heat, can I make this thing catch on fire? Can I burn down whatever power plant or whatever actual maybe technology hardware machinery that's kind of being at play, put at play in the real world, right? Kind of getting in the conversation of real machinery, real stuff. We would do this. We did this. We created this little replay attack where we would just simply take, you can see the bytes there, the actual data, right? Zeros and ones, the binary that we'll actually end up kind of representing as hex, we'll decode them so the raw bytes, they're packed, set up within the packet headers, and we could tell, we could repeatedly tell that PLC, we could repeatedly tell that water tank, keep emptying the water, keep lowering the water level until eventually it's all gone. We did this with a little scheduler. You can see this kind of function here, that full PLC. At the very, very end, we enter into another scheduled so we can repeatedly do this about every two-tenths of a second it looks like. Kind of neat. That's what we did. We can kind of see it reflecting our HMI. Oh boy. Conceptually, now we've lost all the water in the tank. What damage can we do in the real world? Another thing that I kind of consider about this, and we tie in all the concepts and the thought that like, well, now we've wrapped this all in automation, right? We've done this, we can create this in Python, we can automate whatever packets we want to send or do anything with those packets, and that's kind of cool because we could potentially fuzz different parts of the protocol. Maybe some packet headers there or some of the data or some information that we might send in one specific offset or segment within the frame, within the packet. We could do some damage. Maybe. We don't know. That's the whole point of fuzzing, right? We're just kind of throwing stuff to see what odd behavior, what weird unexpected data and input will make this thing fall over or break. How will this device respond when there's just a series of null bytes or random XFF bytes? Who knows? Who knows? Sometimes we don't. And that's kind of fun to tinker with and kind of play with. But that's the benefit. Going back a slide, just seeing, hey, I've just got a simple string and I can do whatever I want with it. I can send it to this PLC and how will this device respond? Kind of neat. Okay. So those were just some simple thoughts, right? That was just our small tests that we could do with this kind of honeypot. We could emulate the attacker. We could see what we could break. We could push the envelope with that. And a lot of times while we were looking through this, while we were kind of operating with this honeypot, this codpot, this industrial control system device, we would be noticing that all the traffic, all the responses, everything that the PLC was actually willing to tell us when we were giving, we were asking for information, that sort of thing is going to be sent out in plain text. I mean, not so much plain text, right? It's obviously going to be wrapped in its own protocol, but it's bare bones out there. It's on the wire. It's in the network. So maybe potentially anyone else in the network could gather that information. So you don't have to be on the specific machine having the conversation with that end target PLC, but just in the vicinity so that you could capture that traffic. So you could do that man in the middle attack. So you could do that repo attack, manipulate packets, whatever you'd like. So just a thought, right? If that's out there in the open, if that's just hanging out to dry, let's try, let's put a little bit of effort into separating, okay, the only things that need to talk to this PLC, the only thing that need to actually have conversations and communicate with this ICS device, those are the only things that should be able to, this computer has to have the need to know, right? Only the things that need to talk to it should be able to everything else. Let's kind of, I don't know, border gate that away, put that behind some doors, put that behind walls. So we could do this, maybe we could separate our network schematic with VLANs or some switches to kind of, hey, let's let's segregate and practice good defense in depth to lock down and kind of protect and mitigate some of these attacks that could be put on our ICS devices. Another thought with this, and I disclaimer, right, truth be told, I don't know how well this thought would work. Because if, again, all of our packets, the conversation, communication going back and forth between that ICS device is out in the open, well, we should encrypt it, right? That's kind of the knee-jerk reaction. Oh, how do you stop plain text credentials going through HTTP? Well, you encrypt it, you have HTTPS, you use SSL. I don't know if this would work all that well for these ICS protocols, right? Because it still kind of needs to have its own encryption there. I don't know if using SSL on top of that or maybe wrapping things with IPsec would work. So I'm admittedly operating at the edge of my understanding, and I'm eager to hear from you what you think if that is a potential option or solution. But maybe the tunnel mode within IPsec, if anything, the switches, the routers, the gateways could still make those proper routing requests and know where to send things, maybe at least at the tail ends of, okay, sending this packet versus receiving this packet to increase the water level or decrease the water level or turn up the heat, maybe those could be encrypted a smidge. I don't know yet, but hey, we're all in it to do a little bit more research, we're all in it to learn a little bit more. Okay, now let's start to wrap it up, right? We've had some conversations, I've kind of dragged you through a lot, and again, I still want to apologize. We, due to kind of the nature of how this unfolded, we wasn't able to put together as much of the real cool code and the demonstrations that we would have liked to see, maybe at a real live con, but hey, I hope you still enjoyed this sort of thing or at least got some ideas or you're interested in con pod and you want to go check it out and play with it yourself, I would really recommend it, you might be able to do a lot of cool stuff with this, recreate some of the same ideas or even do your own thing. So what are we looking at here? We're looking at Modbus, we're looking at S7, Siemens S7, S7 com, some of these ICS protocols, the operational technology, the lingo between HMI and PLCs, some of this stuff is a little old, right? Not always, but a lot of times, in the way that it's kind of being architected together, it could be insecure. Oftentimes, it's just inherently insecure because that information needs to go from whatever parties are asking for it sometimes, hence the PLC and HMI communication conversation. If that can be abused and taken advantage of, like even just again, the classic simplest network attacks we were just discussing, manual middle attack, replay attacks, just simply listening on the wire kind of manipulating those packets, fuzzing that data, that can abuse the device. Let's try and set this up. Can we lock this down with encryption? Can we at least kind of separate and segment our network so that things are compartmentalized, so the different parts of the machine read, the parts of the network that don't need to talk to the ICS device can't? That's just, I think, simple classic defense and depth, or least privilege, need to know. I think we can try to work through that with some of our ICS devices. Okay. Okay, I don't know a good way to kind of wrap this up, right? It's hard to kind of put this out there and say, sure, we've simulated some small things, some interesting techniques, some clever techniques and tricks we can do in an emulated environment, right? We're not working with a real power plant. We're not working with a real gas tank or water tank. Who knows? Maybe you could do some interesting and cool stuff with that. I hope you do. But if anything, I just wanted to show you there are some options. There are some things we can do. And you don't need to have a giant power plant or any of the other crazy mechanical ICS devices stuff. You can all do it with software and explore and poke around. Maybe try some of that adversarial mindset and see what you can do to mitigate it, defend it, protect it, or just learn a little bit more about this sort of thing. Okay, if you have any interest in chatting a little bit more with me, please, please, do not hesitate to reach out. You can find my email address there, johnhammond010 at gmail.com.  We're almost at 100,000 subscribers, which is kind of unreal. If you want to see some of my code, for some reason, I promise it's not all old dirty Python too. There's my GitHub and you can find me on Twitter or join the Discord server and hang out with me and my community. So thank you so, so much. Thank you, thank you, thank you. Cannot say it enough. I really hope you enjoyed this conversation, this talk, this presentation. We can go even deeper in the weeds. We can kind of zoom in on this even more. If you want to, we can take it offline. Feel free to hit me up in an email or Discord. And if you'd like to, we can still keep taking a look at Compot. Maybe turn this thing up to some Python three code for our communication.  Thanks so much for listening, everyone. I hope you enjoy the rest of the conference. I hope you enjoy your time here. And thank you, thank you, thank you. Have a great day.


Thank you. What an honor it is to be introduced by the archivist of the city and county of San Francisco And now that I'm old enough to be an archivist artifact is even more appropriate It's it's a pleasure to be here with because I first of all Jim Hawes and I are longtime friends and In terms of being a tutor to So many of us in terms of civic value generally there should be an office created called civic tutors James should be the first incumbent and he's been wrestling with this Jim is a of course belongs to that genre of scholarly attorney who has accounted for so many so much good writing about the history of California in the West and He's a graduate of Stanford University and a graduate of Columbia Law School and Jim and I have had a number of discussions over time as to a a Challenge posed by Harold Kerker in his history Very pioneering history of California Architecture that is the question. What should California look like? American California and the case of Hispanic, California. It looked like the American Southwest the architecture and It was modified dramatically in the late 1820s when Thomas Oliver Larkin fused the New England frame style New England frame with the Spanish adobe you can see this today at the Larkin house and in Monterey which allowed the Spanish adobe to go up to the second floor create a veranda and Overlying roof on the model of Charleston, South Carolina and low and behold what we think today was the is the iconic architecture of Southern California in general is actually only the last 15 or so years of California history that it has but that look has maintained itself now. I think there's a wonderful phrase by by Wallace Stegner that California is like the rest of America, but only more so And I think I think that only more so is part of what we're going to be seeing tonight because we look at the opening Shot from Chicago is that basically when the when the infant the infant are newly found that American Republic Asked itself. What shall we look like? Of course? It's settled on the class and the classic set on classicism We see this today in buildings like Benjamin Latrobe's great capital But we also saw it very early in San Francisco in South Park The development of classicism there Domestic classicism on the on the at the same time that the same style was were developing in London Which suggests a very interesting ability of the artistic architectural world the world of taste to communicate itself across a continent and the sea and Proceed simultaneously on this idea of the classical ideal now this question of the classics was rooted in Obviously the classical civilization of the Mediterranean and in the 1870s and 80s as California architects searched around for metaphors with which to enliven their architecture Increasingly they turn to the south of France the Romanesque revival for instance, which is so gloriously represented in and Jim's Alma Mater Stanford University quadrangle one of the last great Designs of H.H. Richardson reflected this sense of southern of France for the Mediterranean of course it was a Roman architecture that was recycled with a carol engines and then brought into Normandy and emerging in the 10th and 11th century and Suggested the lands of the south there's a new study of this Tendency that's just come out from a wonderful book from Oxford University Press which I had the privilege of putting a blurb on the on the back call classical, California and When we San Franciscans then determined that we would have this classical look In South Park, which we didn't determine it automatically. We anticipated it because there is no Enforced architecture that there's no director directorate of architecture says you must build this way on the other hand in the case of say the Second Empire France with Baron Hausmann's re creation of Paris reworking of Paris you could say you will build in this style this basically bows our Classicism now the path the paradox that I think Jim is going to suggest to us is how this Fuse with the city beautiful movement that came out of Chicago to Daniel Hudson Hudson Burnham Of course, we did the Burnham plan or laid out the fair did the Burnham plan for Chicago this city beautiful movement, which was organized around the European city as developed by Rome and under Pope six is the fifth as developed by Vienna and as bar and by in Paris by by Hausmann and that movement then became To this country with a major online fonts first designs for Washington DC came into Chicago later to st. Louis to Seattle and even of course those who know Manila the Philippines, which we had briefly an association with the I mean an imperialistic Paralistic association with to Manila itself The very interesting thing about this classicism that it was not Ray Tardare was not Escapist it was not let's go back to the past. It was linked with Progressivism, I know that's a magic word in San Francisco But I'm using it with the capital P not the current Progressivism although it certainly has a lot in common But that great sweep of wanting to upgrade and clarify and reform America that swept through this country in the 80s 80s and 90s that also expressed itself in this bozar Paris-based classical revival and No, I think there is no single legacy no single ensemble of public spaces and No more glorious evocation of those values than we have here in the Civic Center of San Francisco and that's what James Haas has devoted so much time and its Marvelous scholarship drawing upon many cases our magnificent collection here of San Francisco history and which he will Illuminate us regarding this evening So looking forward to a marvelous interplay of interpretation and imagery from a remarkably erudite and dedicated man Who has privileged given me great privilege and allowed me to write the introduction on his forthcoming book on this topic? I'd like to have a warm hand and welcome James Haas. Thank you


Today we're excited to introduce someone who finds joy and inspiration by reimagining the Rice Krispy. Jessica Siskin joins us to talk about switching careers, publishing her book, and how one photo launched her entire business, Mr. Kris. This is School of Hustle, the show where we find advice and inspiration from people who are making their own way. I'm Shannon, the VP of Social here at GoDaddy, and I live and breathe at the Hustle of Business. Today we're filming from the Hustle of the Dahl at the WeWork Times Square in New York City. Everybody, let's please give Jessica the biggest warmest welcome. Thank you so much for having me. I'm so excited to be here. We're excited to have you. I'm especially excited because I remember my first Rice Krispy treat. To you? I do. It was an elementary school at a sleepover and it's such a nostalgic treat.  What was your first experience with the Rice Krispy treat? Where were you? Who made it for you? What was it? It's so hard to really remember your first Rice Krispy treat looking back. I have to say it was probably my dad who made it. I had a stay-at-home dad and a working mom. So all of the things that people usually do with their parents, I was doing that with my dad. He definitely made Rice Krispy treats when I was growing up and then we used to have them in the little blue package in our lunchbox. But my first conscious Rice Krispy treat experience was actually when I was about 26. It was during a snowstorm and I was at my best friend's apartment and she decided to make them and then I realized just how easy it was. Did you ever help your dad in the kitchen make treats? Not really. I can't say I've ever been helpful in the kitchen even to this day. Well fast forward to now. You certainly are in the kitchen. You own Mr. Krisp and you've published a book with 93 ridiculously fun Krispy treat recipes. Tell us about Mr. Krisp and how it came to be. So Mr. Krisp is a one-woman business. It is both a custom bakery where I make custom Rice Krispy treats for customers in New York City and an Instagram account where I showcase that work and work that I also make as content for social media so the whole world can see it. Well every experience goes into shaping who we become and I know that along the way the Rice Krispy treat resonated with you from your dad making it and you having this moment when you were 26 with your friend.  So when I was in college I studied a blend of psychology and art history and I was really focused on the idea of how what we think affects what we see and what we see affects what we think. So these ideas were sort of germinating in my head for a really long time in terms of just what is art? What constitutes art? What amuses us? What feels special? So even though it's a very strange thing to do make Rice Krispy treats as art it actually was part of my natural trajectory. I remember reading that you actually saw a note on the side of the box that talked about adding food coloring. That was actually a recipe that I googled. Okay. So yeah so I used the recipe on the side of the box but yeah so I googled a recipe because my friend had invited me into a potluck dinner. Yeah. And we didn't know what to make and a friend of mine suggested that we make a Rice Krispy treat surfboard. So I googled Rice Krispy treat surfboard because I'm a millennial and the recipe had food coloring online. But you saw something that other people may not have seen. Why do you think that is? So I didn't see anything until I was actually making the recipe. When I put our members the red food coloring. Okay. And when I put the red food coloring in I had this like I call it an Oprah aha moment. I had this immediate impulse to make a Rice Krispy treat cheeseburger and it wasn't my first artistic cheeseburger. Cheeseburgers are so visually dynamic and I had made them in the past out of Play-Doh and I also made one out of colored tauti rolls. So it was just sort of this natural evolution of art for me. Cheeseburgers for some reason were my subject and I felt the need to make a cheeseburger out of Rice Krispy treats at that minute. And was the cheeseburger or the surfboard the one that really set Mr. Krispy. So I consider the cheeseburger to be the first Mr. Krispy. The surfboard I made but that was sort of just you know getting there scaffolding as you might say. So yeah so the cheeseburger is the first Mr. Krispy and I made it on a Sunday night and I posted it on Instagram that night and the rest has been history. And how did you kind of put the name Mr. Krispy? So Mr. Krispy is actually the name of the villain in the movie Sister Act 2 which is one of my favorite movies. It came out in 1993. It has the best musical sequence of all time. It does. I remember that board and hail I think was the best movie. Which she was. Yep. That is so funny but the word Krisp of course resonates with your key ingredients. Exactly.  Everything's challenging until it's not until you practice enough but I have to say the most challenging thing I ever did was I actually worked with Kellogg's Rice Krispies to make entire holiday window out of Rice Krispy's treats and that was wild. It was super challenging, really fun and really, really cool. Can you describe this window to me? First of all where was it? So it was on 57th Street. This was about three years ago.  And what kind of pickup did you see in social? I'm sure people in New York love to take pictures of windows in the holiday time frame. You must have seen a ton of engagement. Yes so that was really cool and it was also something that was press worthy so there was a lot of press around it so I did see a lot of pickup around that time. It was really cool. What is your most proud moment in all that press pickup? Was there any one particular publication that blew you away? In the entire time I've been doing this I think the coolest thing was being on The Today Show when my book came out. That was something that you know I watched my whole life so actually being there was really awesome. That is awesome. Let's talk about your book. 93 ridiculously fun Krispy recipes in there. Exactly so it's one recipe but 93 different projects is how I like to describe it. Oh yeah that makes sense I like that. Do you have a favorite project in the book? I have to say The Cheeseburger. It's the cover of my number one it's my first child. Now what if you were a beginner if I were to get the book I've never made a Rice Krispy treat in my life let alone it's such a beautiful one where would I start? I would start with The Cheeseburger. You would it's like an artist though. No it's not at all I mean it's where I started okay and it's actually just more it's it's building right so you build all the pieces and then you end up with The Cheeseburger which was my experience also the first time I ever made it I actually screamed out loud when I put all the pieces together because I thought it was the coolest thing I'd ever seen. Where do you get your vision for all of these projects? It comes from all different places I like to travel a lot looking for inspiration but I really am inspired by my customers most of the time people have really cool ideas and they'll message me on Instagram and tell me what they think I should make or I'll just see something happening in pop culture I nothing is off limits to inspire me. I love this conversation. I want now to move into our icebreaker and play a little game that we call Hustle Time cool. In the game Hustle Time we set a timer for 60 seconds and we see how many cards you can get through in that time okay can we get a timer for 60 seconds? Tell me when. New York City tourists help with directions or keep on your own way help with directions if you could have a superpower what would it be? Flying. The best chocolate in the world comes from Hershey's. King size or fun size? King size. Would you rather fly or talk to animals? Talk to animals. Favorite holiday? Don't report. Instagram or Twitter? Instagram. Binge watch or watch weekly? Binge watch. Your go-to outfit? Uh pajamas. Vacation lounge on the beach or an active hike? Beach. Who is the most successful person you know? My mom. Fictional place you'd like to visit? Hogwarts. If you had to eat one thing for breakfast every day for the rest of your life what would it be? Pizza. Ski trip or beach vacation? Beach. Describe yourself in three words. Happy, fun and blonde. Surf's up or cocktail's poolside? Cocktail. Least favorite candy? Oh that's a tough one. Airheads. Worst trend you've ever participated in? Oh my gosh, sweatsuits. First record you bought with your own money? Dave Matthews. Favorite Disney movie? A Little Mermaid. You have to lose access forever? Oh! I think I did pretty well. Okay so now let's see the moment of truth okay. 20. I think that's pretty good. That's really great. Fantastic. Yeah I knew it. That was a lot of fun. It really was. Nice job on hustle time. Thanks. Now we want to move into our entrepreneurial discussion where these next set of questions we ask everybody and it's fun to see how different entrepreneurs answer the same questions. So think short concise answers but not quite as fast as hustle time. Okay just concise and we'll keep it moving there's about 10. Okay let's do this. Favorite part of your day? Going to bed. Best piece of advice you've ever gotten? You can't pour from an empty cup so take care of yourself first before you take care of anybody else. Worst piece of advice? Scale. Grow. Without thinking about it. Yeah there's a lot of that like just like grow even though you're not really sure where you're gonna grow to. How do you use your career to inspire others? I really like to do two things. I like to inspire people to do creative work. I like to add some intellectual value to creative work because where I grew up it wasn't really considered that important and I like to be honest about my challenges. Ever felt like walking away? No. One thing you still need to learn. How to delegate? What do you want people to learn from you? I want people to learn that even though things look a certain way on social media running a business is running a business. What's next for you? More of the same to keep doing this. Who inspires you? My mom. Who challenges you? My friends. Yeah. Well we also let everyone in social know that you are coming and I have a question for you from Joala. Joala wants to know what was your favorite sweet treat when you were growing up? That's a great question. I'd have to say so my mom used to travel to Arkansas a lot for work and that's where Walmart was based and she used to bring back on the plane these big coconut cakes and it was always such a treat and I'd eat it just with a fork. You've brought up your mom a few times in the interview and I just find that so fascinating. Is there anything in particular about your mom that you absolutely love and admire? I just have to ask.  She owns her own company and she manages a lot of employees and she keeps putting out amazing creative work and she really inspires me. We have one last question for you and this comes from Noodle our resident pug at GoDaddy. Here he comes. So Noodle. Yes. Hi Noodle. So Noodle. Noodle is coming up on his one year anniversary at GoDaddy and he wants to throw a killer bash.  Could you describe for Noodle what makes the perfect takeaway doggie bag and how would the perfect shape of a Mr. Crisp visit it? Well this is a doggie bag for doggies or for people. I feel like that. He will have you amused at this party. Okay well I think you know the biggest crowd pleaser for me in terms of a giveaway is an emoji. Everyone loves emoji treats. Okay. So I think that yeah I think that would make a really nice doggie bag treat. I was just gonna say looking at Noodle's face right now I think we want like the little tongue emoji for sure. Mr. Crisp in this doggie bag and what other what other things would you put in this bag? Anything that goes well with a Mr. Crisp? Any pairings that we should know about? That's a good question. Any pairings? I think they're great on their own. Okay yeah. Well you hear that Noodle? You're well on your way to hosting the best bash ever with the best swag. Can I come? You're catering. I can't wait. Okay this was great and we're just so happy that you could be here. Me too.  Yes so much fun. I wanted just to let end on a nice inspiring thought for everybody. So what I'm going to do is read three quotes and we need to listen to the quote and tell me which quote resonates most with you. Okay. The first quote is the way to get started is to quit talking and begin doing. Two if you are positive you'll see opportunities instead of obstacles and three failure is not the opposite of success. It's part of success. Those are all really good but I have to say that number one resonates the most with me. I mean that's how my entire business started. I just started doing it and it became a business. Like if you build it they will come. I hope that everybody enjoyed watching Jessica today and learning about Mr. Crisp. How do we follow you on Instagram or place an order in New York? So it's Mr. Crisp that's M-I-S-T-E-R underscore K-R-I-S-P. So follow Mr. Crisp on Instagram. Follow Go Daddy too because every week we have a fabulous entrepreneur to provide advice and inspiration. We're pushing out School of Hustle on Instagram, TV, YouTube, Facebook, Premiere and teasers of course across Twitter and LinkedIn and Instagram. So please follow and stay tuned for more School of Hustle and we will talk to you soon.


welcome to drinks made easy this Halloween Mike's mom that's not funny what are we talking about stay on target is making the green ghoul there you go and she's also really no nope nope that's it to build your green ghoul you're gonna start with two ounces of Midori next you'll add half an ounce of boros intense and half an ounce of green chartreuse now we're just gonna stir this I'm not adding any ice because we are gonna pour this over ice and we're gonna lengthen it with a little bit of ginger beer and sometimes with drinks like this if you stir in ice right now you can kind of water the drink down more than you want because if you want more water in your drink you can always just add more water or a bit of ice pour it into your glass that you've already prepared with your licorice strands and you're gonna pour a little bit of the ginger beer of your choice and if you can't get any ginger beer you can use ginger ale but I tend to find that a good ginger beer with that nice sharp gingery flavor makes us a much better cocktail cheers from drinks made easy you ever been to a flashlight party you mean a rave no I mean a flashlight party in a warehouse right yeah those are called raves shut up and please remember to always drink responsibly because everybody likes to make friends but no one likes to make them in a prison shell we're gonna need to do another one of that that was perfect no wasn't