Okay, I guess I'm good to go. Good afternoon, everyone. Welcome to my session. We're going to talk a lot of ESPAM, and I'm Hasan Yassar. I'm a technical director and also faculty member at the Carnegie Mellon University. I have two jobs. One job is being a faculty member at the Carnegie Mellon University, is teaching a course in a graduate level on DevOps course since 2013. Also, I'm a technical director on the Software Engineering Institute. If anybody knows the CMMI all days, probably some of you, yeah. It was created from SCI, but we are not supporting anymore, so we are kind of drop the ball. We said, let's get better out of it. Now, when I really started my journey at the Carnegie Mellon about 15 years ago, almost, and I really tried to bring about the engineering practices. I know SCI is known as Engineering Practices as FFRDC, which is a federal fund research lab under OST, Secretary of Defense under DOD, but we have under CMU as focusing more engineering practices. So I manage the group, does DevOps and DevSecOps agile practices in supporting many DOD programs, as well as in supporting industry, which this morning with the DevSecOps days, and Kate was one of my speaker, we have been supporting community on DevSecOps perspective as well. So let's talk about what it is, SBOM, and I really would like to get you guys think about what is the actionable stuff that we can do for SBOM. I know we heard a lot of SBOM, be no problem, be no SBOM, right? I think everybody saw the SBOM file. Anybody have not seen SBOM file yet? Not yet? Okay, not shame, I'll show you a couple of examples, don't worry. All right, so I really would like to talk about what is the actionable stuff on SBOM, what we can do. This is my kind of a legal SBOM what you see here, what the legal says, put something as a legal disclaimer who we are, what things we do, which is one, two, three, that's it, we are done. We verify it. All right, next step. I know, anybody knows what this picture about it? Any ideas? Which is yesterday's enterprise? I'll give a sticker, but I can give some bonus later on maybe. Anybody knows which city it is? It's Pittsburgh, yes, it's a Pittsburgh. It's about a hundred years ago. Why I brought that topic is it really thinks it's evolving. In yesterday's enterprise, Pittsburgh is known about the steel industry. It's not the steelers, anybody in fan of steelers? Probably yes, but it is known about the steel manufacturing. Now it got changed. So it's more about building supply chain with respect to the steelers and everything else still and all this technology and stuff, but it got evolved. Now where we are today, we are more about the complex. Now comparing with the shiny Pittsburgh right here, got evolved, it's keep changing. And also as a parallel, we see a lot of complexity on the aircraft, anywhere else. It's becoming a very, very, very complex problem, which we all don't know about it. Either in industry or using any type of technology. I would like you guys to remember these pieces a lot because I'm going to reference more into the, how the industry with respect to the manufacturing and into like a construction business or electric business is changing, why the software is not as evolving as manufacturing and the certain components, right? And other things I would like to brought up this one. I know you all know about the software, is it in the world? But the one thing is really, I would like to highlight here, this sentence is really interesting because this actually came from an FAA as an autumn. It says like, you really think about a software now it is becoming a safety problem. Because if you don't really update your libraries, if you don't maintain your software, if you don't really follow what the software is designed, it's affecting our human life now, which is very, very important. I thought we talk about like kind of what about the daily life? It's not a daily life anymore as we are using an application, it's affecting our life, which is one example. There are a lot of examples we can give how the software is affecting our human.   Now a lot of things is basically in the healthcare industry, we are depend on it using a lot of softwares and some of the doctors are doing remote operations.  I don't know. I don't wanna be that proud and it's scary. So let's move on. Actually, I prepped this slide about why is important to us, why matter to us. That number's got outdated already within a week. Within a week literally, now we have more percentage on the per commercial code and other things is keep increasing. So now the numbers keep increasing. These numbers I use based on the software supply chain report everything as it's keeping increasing. Which is we heard like yesterday, the number got bigger and I'm sure next couple months it's gonna get even bigger. So now it's growing, right? It's really growing. We cannot really stop that things anymore. But why is important to me? I would like to get you guys in the next one is why does that matter? It's about the dollar associated, okay? So one is about the growing but what is impacting to us? We know the safety is one problem. The second important one is about the business aspect of it. What does business means like? What is the dollar we are spending at time? This is one of the example actually true example I supported when the look for J happened. I was supporting one of the organizations to tell and find out are we really affected for look for J? And I will spend like a quick, this is not a big enterprise organization I'm talking about a small organization somewhere in Pittsburgh literally spent almost 900K to find out do we really have a look for J or not? This is really interesting like there's a money associated now. Finding out do we really have a look for J which is one element. Second one is yes we have a look for J but are we really compromised? Which is the impact out of it? Which is the typical financial risk can be a 5.7 million.  That's another elements of the security with S-Bombative Business Association. Like there's a safety and at the same time there's a business dollar we have to spend we have to be aware of it. Which is your return of investment? Such as one, libraries. Think about the scale that we had here about the percentage code base and the commercial percentage. Think about the one look for J. Now calculate your dependencies how much money you are dealing about it. Either finding the problems. Now I'm not talking about the solution yet just finding the problem are we affected or not? Do we have the right libraries or not? Second is fixing which is the risk. That's reason our finance people are managers they don't pay enough attention. Who are the managers in this group? Who are the finance person? Anybody has the director or VP? Who are responsible for the finance? Right? That's kind of a mindset our business they're looking for about the business and money perspective. That's your return of investments. Tell the people this is a true story how much money we are saving by spending time. They may say to you why are we gonna buy the tools? Why are we gonna spend the time? Yeah, because you're saving the time at the end of the day about finding the problems. That's one element, that's more, right? Another interesting things I would like to highlight here not adversaries are really attacking our software development and wire elements. This is not the new honestly. The paper was written as a story I really like to just take a look later on. Trusting the trust is really interesting like yes, I'm a developer's. How much I can trust on somebody else's code? Ask yourself, even though you're in the same organization you are writing a code, if you don't know enough about somebody else's code, you don't wanna trust. How are you gonna trust the code? Can somebody tell them how are you gonna trust the code? Even though your friend is writing the code how are you gonna trust the code? Anybody has an idea? Yeah. Sacred analysis, one elements, what else? Requirements, open up a little bit more. Architecture, look, when you look at somebody else's code even though sometimes I'm music with music maybe I'm kind of failing, look at my code if I wrote a six months ago. How can I trust my own code when I wrote a six month ago? I need to know about some information about the code. I have to have some notes in my code because how I write the code six months ago have a different mindset, different context now I have different context. So really trust is becoming a very, very important factor. Now taking that concept put into the adversaries now they are using a lot of trust relation the code at the writing, it's affecting our life. It's becoming an impossible to deck any micro bug in the code. What the micro bug means like the code does it's supposed to do but at the same time malicious people are inserting something into the code. Your code is really working what it's supposed to be but there is some behind the scene it's happening we don't know. Hard to check those configurations, it's very hard. So what are you gonna do now, right? That's the thing we are talking about the software of materials. Let's go on the next one. And other things I would like to highlight one important factor is we typically know our endpoint let's say we are looking for some of the components but how much do we know other people are dependent on other libraries? Like we are acquiring a software maybe we are using a software, we are using a binaries maybe libraries but the library is built on somebody else's code. We are getting a compiler version of it let's say if you get in a C++ you're getting a compiler version there's a DLL in it, you see the binaries. You see the first hand but you don't know what is really behind it, which is another complexity. Dependence is playing a key role for us we know what we know based on what we compile but we don't know what is really behind it. What is really telling me as a story this is basically a college part is becoming right? Now this portion is getting very less the code that we write that we wrote it's getting lesser and lesser and lesser. Because when I look at myself, my journey when I start to write the code about 20 years ago we were about to write a whole stack from up level. Now with the frameworks, with the new technologies with the new concept we are writing very, very small code pieces. Statistically when we look at the new way of writing the code almost 15, 20% is actually the developer writing the code. More than 80% really comes from the framework. And I actually experiment with my students I said can somebody write me a Hello World in the web page? They said okay, five minutes, here's a Hello World of the web page. What they did, they used the multiple stack behind the scene using operating system using the web server using the framework very easy to write the Hello World but dependencies are so deep operating system level web services framework. Like the code is very one line of the code but the dependency is really huge. That's becoming a college party, right? So how can we really fix that problem as it being not a college party means that we invite the one person suddenly 100 people are showing your house. We have a capacity to analyze everybody who is in our art, we don't, right? That's the problem that we are dealing. Let's move on. And other things that I would like to get into the more actionable, more reality pieces. Is S-Bomb is all about creating the file with the tools? Who says yes, no? No, we're just creating a file, that's okay, we're gonna create it. But what is important pieces that makes actionable S-Bomb file? That's really a key point. That's reality, it's making action because how are we gonna deal the problem at college party situation or dealing with other dependencies or our connectivity, it's really requiring to think about beyond the creating of S-Bomb files. So what are we going to do now? Let's spend a little bit about the goal. What is our goal? And I would like to really think about for you guys for OSP top 10, which is NIV 2021. When you look at OSP top 10, here's our goal. It doesn't matter which organization you are in. Our goal is to really build up a secure design, develop and deploy into the secure infrastructure. That's what we are trying to do. With that perspective, I'm glad that final OSP is listing insecure design as the one of the top 10 vulnerability this year. What that's really telling us, we have to think about security as part of our designing. We don't wanna be as reactive based on what we are finding. We have to be more proactive. How can we be proactive? We're gonna think about the design element at the beginning. And other things that are interesting about the software data integrity. How are we gonna keep the integrity of the file that we are using? It's the same file that we are using in our build, deploy and delivery. So think about that perspective. Here's the relationship of your goals. And other things then we can talk about how pieces. Anybody heard about DevOps and DevSecOps? Some of you probably. So now here's my solution, which I have been teaching at the class and I have been supporting many of the other programs. This is kind of how you start thinking about DevOps and DevSecOps perspective. Honestly, DevSecOps is more about people start to ignore the sec pieces. So we start to call up about the DevSecOps. If we are doing the right DevOps, we don't need DevSecOps. We don't do the right DevOps. Now we are saying DevSecOps because we ignore the security. Why ignore the security? Because we never address the design properly at the beginning. We never think about the early stage of security and now DevOps is creating so much buggy code, so much problem. We said, hey, this is not going to work out. Let's build up the security as part of our practices. So let's move on to a little bit on the DevSecOps spaces so we can connect the dot with the S-bomb relationship with the DevSecOps because always we're asking what is actionable and how can I solve this problem? This is the question that we are trying to find the solution. And other things I would like to highlight here is the DevSecOps goal. There's three main goals DevSecOps would like to achieve. One is the business mission. So that goes back to our analysis. How much money we would like to spend to fix any issues? How much value we are bringing to the user? So it's more about the business driven. If you really separate the S-bomb or a secured outside your business, you're not able to achieve the goal of DevSecOps. It's based on the business, based on the value, based on the impact, which is the first elements. Because if we don't want to be creating a software has no value. Think about your organization. The value is really how you're using an infrastructure that you may have in internally or how you're supporting your clients. If there is no income, who is going to support you? Reality, right? Which is the business mission. Second one is goes back to the deliver of capable and delivering a value, which is really for your business mission and related to your value. So now think about S-bomb perspective every time when I say any word, think about what is it here for me as an S-bomb thinking, right? Now we can put into the reasoning your product then you can deliver as end of the product. So what the product means basically we are creating an infrastructure, that infrastructure that makes you go from beginning to end adding all the capable and as you can deliver the business value, business mission based on your CI-CD pipelines. That's connected up. What is the sec and DevSecOps with S-bomb together? Let me finish up everything here, we can talk about it now. So if you look at that perspective, this is a typical DevSecOps life cycle. As you can see, there are many places that we can create other dependencies, our S-bomb files like starting from test, build, code. Every phase technically generating some sort of an S-bomb or a related dependencies, we can capture it. Here's your bumper sticker. S-bomb should be integrated into the SDLC which is software development life cycle should be your integration. If you look at the fact as creating the end to end it's too late. What we should do really think about from planning perspective. So I'm gonna show you an example of Kate and she's talking a lot of the SPDX, how to cycle index, we're gonna connect the dots. But really think about SDLC perspective that's your actionable stuff. You may say, I'm not really building a software. Maybe I'm a consumer. Still you are practicing some of the deployments. Like think about enterprise organization you are in. You may not be delivering or building a software but using a lot of CM practices. CM is configuration management. Maybe using some other Chef Puppet for your deployments. Are you looking for dependencies of Chef Puppet how they are creating the provisioning script? How you're getting dependencies and stuff? That goes back to your planning phases again. So you're kind of practicing all the in your enterprise organization even though you're not building a software you are practicing, you're not aware of it. But you are practicing already.  Just like we can go over all of them but every base is creating some sort of infrastructure pieces for us. That's your go to place. What is our purpose again? Our purpose is really use those file how we create it. Let's try to verify and validate and test it. How we creating the file. How we start at the beginning as creating one of the dependencies here in the code. We have to make sure that we are validating which goes back to the we're gonna trust the developer. We're gonna make sure that people aren't inserting any new files into the process which happen a lot. As a developer if I am stuck in one of the code that is not working what I'm going to do grab a new version of it. I'm gonna get a new version or maybe change something without alerting anybody. How are we gonna catch those alert? We have to really verify through the life cycle to make sure that you are getting right libraries, light files and you're verifying those components. All right, let's think about how can I start? Anybody in the question so far? Good. Okay, you can challenge me. If I'm wrong, tell me. If we are, tell me again. Let's have more of a conversation. I really like that conversational stuff. If you want to ask me a question, I will ask a question to you. Right? Okay, let's move on. I know everybody heard about S1. I'm just gonna go quickly. There are multiple ver like the format types that exist all the cycle index, SPDX. I'm assuming that you all know about it. If you haven't seen that, I'm gonna show an example what the file looks like. There's all that available. But the one thing is important. There are common software below elements that exist already. And other things is important. MyTang language is machine readable format. Doesn't matter which one you're picking it. I favored SPDX, which new version is much better. But it's end of this machine readable. Don't really stuck on the one file. Make sure that put something into your infrastructure. Make sure that you're able to follow it based on DevSecOps practice. And let's look at closer what those files looks like, what the minimum elements looks like, okay? I added another column here, which came from the actual, I use the NTIA. These are the data field and description as minimum elements of SPA. How are we gonna create those? How can I maintain those? You will see a lot of relationship in your software development lifecycle, DevSecOps, the creating those data elements. If you're talking about the supplier name, there you can really get issue tracking or version control systems or IAC, which is infrastructure as a code, you really keep track those data elements, all that exists. If anybody's practicing DevOps, if anybody practicing modern deployment, they all are to have IAC script. They all are to have the deployment scripts. If you look at the deployment scripts, if you look at infrastructure as a code, either Terraform or Vagrants or Enosable or Chef, there is already name in it. The file name is all that exists. So don't really challenge yourself. It is very difficult to create it. It's there already. It's all that the part of the script. We never able to think, what is the SPAM creations? When we look at the component name, we can use issue tracking. When we look at the version, which is build and packaging we can do. When we get into the more about the dependency relationship, we have a project. Every repository management, it's based on the project. If you go to the GitHub or GitLab, whatever repository management you're using it, you're creating a project. Each of the project should have a bill of materials as part of the project file together. Now we can see the dependencies each other. You download it, but keeping the SPAM is separate in your repository, we're gonna solve the problem. So as you can see all of the data elements has a representation in your software life cycle. Again, you may, I'm not using a software life cycle, still you have a CM practice you follow in your organizations. You have repository management for your admissible, for your chef, for your puppet. It is already using some sort of a version controlling an environment, keep track all the dependencies for you. Let's look at a different perspective, which is another one I like it that came from NTA again. What are the minimum practices? So you finish up the data fields, which we discussed shortly. We're gonna talk about the different type of SPAM shortly like that design, source build, analyze the deploy in a runtime, which I'm assuming that you build up your deployment. Now, how can I do and creating automation which is a key point? Now go back to the practice. How can I create those SPAM files using automation? How are we gonna use automation? You have to use the continuous integration, continuous delivery, continuous deployment IAC. That's your solution. And I'm gonna make a demo by David. I will show you how it's easy to use as pipeline, create those files. Because one of the question I have been asked many times, even though when I teach the class from developer perspective, they're saying, do I have to create all these files manually? Do I have to build up all the field manually? Oh my God, I have to learn all these things? No, you don't need to. This is the format to communicate each other's. That's how we are communicating. That's how we are sharing information between suppliers, vendors, developers and tools. But the key point is that we use those automation to create that concept. Every tool, either SBDX or Cyclone or SWID, it is already available that you can use. You can generate those. Even though if there is no tools available for you as a developers, you can write it. This is not a kind of typical things that it's gonna be difficult to do that.  Format is exist. But we are making so scary to people not to use it. Don't do that. It's easy. I'm honest, I'm telling you it's easy, okay? So put your perception down. Say, how can I do that? What can I do my job to make it easier? Let's move on. When we look at the practices here, that's really a tough part honestly. Which we're gonna follow the policy governance education. Now that's a difficult part. Why is difficult? You know what's an idea? People are really hard. Why? They don't wanna change themself. There's another reason it's actually culture. Because why they don't wanna change themself? Because they don't wanna be showing some power loss or maybe sampling a power game or they don't wanna show some other things how they do. If it says the developers, hey, can you show me how you do? Most of the developers they don't wanna share how they do. Why? Because they are kind of scaring to lose their job. That's the reality. They don't wanna share it. It's about the culture. Why? Because the managers are evaluating or incentivize the person different perspective. So what we can do now? Really build up a policy. We build up a governance. We have to promote engineering. We have to promote engineer, developer, or architects to follow the organizational pastures and policy guidance. That's your difficult part. Let me give an example. I may know every dependency in my code if somebody is using a code snippet from Stack Overflow. Is the policy problem in education or as found creations? What is that? It's a policy problem. Because developer wants to solve a solution, right? Right away. Go to Stack Overflow copy and paste, they use it in libraries. So we don't wanna really block the developer but somehow we have to make them enable let them do their job. Now as a manager we have to find a way to solve that problem. That goes back to the really building up of some governance pieces, building up some policy pieces. Educate your developers. It is, it's a balance honestly Camden. I don't wanna enforce basically everybody who has to follow but we have to get some freedom. People can follow based on certain guidelines and guard rails. So we can enforce in a policy, not penalizing the people, we can enforce the policy, improve our practices. That should be our perspective. So maybe we can say, hey developers, like I heard some example, like we will lack the luck on everything. It's a bad policy. Because if you luck on everything, developer has no right to do anything else.  Because there is a pressure from our finance people, they will like to get job done as quick as possible. Here's another note for all of you. I have been running DevSecOps survey for a couple of years. I asked the question for developers, what the security matter to you? Why you're not addressing the security? 99% of the developers are believing the security, but they didn't have enough time to address the security. Why didn't have enough time? Because the bosses or managers or the customer asking, get me that feature for me in a short time from I need yesterday. So now if you put the policy to block the developers, there's another pressure. On the other hand, developers are gonna find a way to break the policies. So we have to find a balance. Another one is about education is really a key point. All right, let's move on. This is another example to tell, show you here is the comparison between SBDX cycle and SWDC, it's kind of similar it is. And as I said, like version of the relationship is a key point to connect the dots in between. Again, this is one example to see as how what SBAN looks like, right? All right, so what we're gonna do as the continuation of the journey, we're gonna start from infrastructure perspective. Now, forget everything else in a moment. When you are building your infrastructure, we have to make sure that the infrastructure is secure enough. One of the big problem I have been hearing as a vendor, they don't wanna share the SBAN files. Why? Because they don't trust you as an organization. How are we gonna protect their files? Because you technically, they are sharing with you as their secret in terms of their dependency looks like. So why is it important to protect the SBAN file that vendor is sharing with you? Why matters? There's an idea? For what purpose I can use? I said that information is useful for attackers because if they know what you're depending on, they know all the different avenues to exploit you. Great, thank you. If you look at like a pentester, what is the first step of pentester? There's some reconnaissance, right? Which they're gonna look at what the dependencies are. They're gonna find out how you build it. If they know your ingredients, they're gonna look at the CV's website. They're gonna get the vulnerability that is attack your system.  You have to protect it. How are we gonna protect?  So when you build up a second infrastructure, you're gonna build up everything in a single source code repository, which is important. I see so many people are creating multiple, multiple repositories. Do I need it? I should have a single repository so I can control it. Again, I'm a fan of us having a single repo, but creating a multiple repositories, creating another attack vector for you. How you're creating the pipeline to build it, it depends on your language, but end of the day code is a code. Doesn't matter where it is. If it's a single code repository, it's a source of truth, you have a full control of what's going on in this example, right? But you can add other components like a build, documentation, integration. You can insert other type of practices as we discussed so far, right?  In your code developments you can do, you can do the build process, you can do the deployment process. Now you can use continuous integration, you can build up infrastructure as a code, easily can build up the three steps to achieve your minimum requirements. What was the minimum requirements? Get the minimum fields. Where you can do minimum fields, you can from get code developments, build and run time. Like easily when you put the code commit into the GitHub repositories or any repositories, you can really, the composition analysis at the moment, you can create a first as from right away in the code commit. When you try to build it, which is interesting, every automation build has the build manifestos. Either using a make files as the C++ or maybe creating a Gradle script, maybe you're creating a package in your MPM, maybe you're creating a jar file, all of them has build manifestos in it. What the build manifesto means, which is automations. If you look at automation script, then you can capture your build dependencies. When you try to deploy it, now you can capture your runtime dependencies. What is runtime dependencies, which is your infrastructure script that you're deploying? Your Ansible has the runtime dependencies. Your Chef has the runtime dependencies. You all have the habit. So how are you gonna generate those files from your script that you can generate it? Let's put all together in a policy with the deployment perspective. One, you have to put a policy into your acceptance, like acceptance means we're gonna put some policy to mandate engineer or developers. Make sure that they're alerting the people or asking the permissions or following the policies, getting libraries. There's a legal element of applying the policies at the same time for a security perspective. We're gonna think about both. Now SBDX3 has a legal profile so we can keep track. Do we have a right to use those libraries? Can we make sure that we have a right? Are we paying enough licensing? Which is a very, very big problem that we have to keep track of licensing perspective. Of course, back to the policy, you should follow it. Now we can do basically some dependency analysis based on what you would like to do for completion analysis. Now jump into the CICD practices. You can integrate into your continuous integration. You can do the compliance artifact. You can do the deployment artifact, which is the operational pieces of creating an Aspire. Are we good so far? Are you guys convinced it's easy or difficult? Looks like easy, maybe. But what I'm saying is all that exists are available, all right? So what we can do overall as the quick summary, we can integrate our artifact catalog into our lifecycle and we can automate the script. We can generate a spam file every steps. Then we can monitor it. So everything what we can do, which basically creates some vetting process into our infrastructure, we can monitor it, we can verify it, we can validate it. It's simple, it's doable. If you really think about how I'm gonna create an Aspire, you're not following the right things. You're gonna think about how can I spread it throughout the lifecycle. Another thing that's important with the secretive perspective, we always thinking as reactive, we're gonna change that. Why? Either you're gonna pay tax at the end of your delivery, which is kind of a month, a year later, or you're gonna pay the tax as you are building. Paying a tax or doing some of your duties as you are building is much easier, versus doing it at the end is much difficult because it's gonna cost you more money. That's what we would like to do as early integrations. So now I'm gonna show some quick actions in Aspire, which is a demo pieces. This is the example for you to see how it is easy to create it. And this is a basically one project and based on the rest, I'm gonna show an example short, I'm gonna go a little bit background. The Rust code contains some vulnerability in it that what we're going to do, we're gonna process a build project, we're gonna execute the check of the code, we're gonna do some external libraries, this is the basic applications. And we have a pipeline, that pipeline does the static analysis, build the code, package it, generate Aspire, upload artifacts, scan Aspire to verify, and then make sure that we are following the writings in Aspire perspective. And let me go to demo and then we're gonna come back to shortly again. Let's go to demo first. Let's go right here. All right, this is the one exemplar project. Oops. And using a GitLab runner, I'm gonna show you one example. Again, this is just basically do some lin check. And I'm gonna start the build right here. Go to pipelines. And it's using a GitLab, GitLab runner behind the scene. GitLab runners created, was failed, but we can start again, run pipeline. While it is working, I'm gonna show example as the done. Let's go back here. So does the lin check, do some static analysis code pieces based on the code perspective. And creating a package, this is building, let's go open up each of them components. It's already done, but we show you how it is going behind the scene. Again, the Rust application. So to really build up the Rust, you need some packaging. So packaging tools comes from the cargo, which is I'm using a packaging tools. What it will tell me every application that language that you may have, language you have to package it, or you have to compile. That's what the CI practice looks like. If you have an AngularJS, you have the package difference of the libraries, either NPM package, other package, you are creating other dependencies, which is your build dependencies. That's what it does here about the build process and checking the code. Now let's look at other ones. What is working? Now building, which is creating a cargo package, it's compiling the code, looking all the dependencies, bringing it together. And when we create that, we are removing any BOM file exists before because we are creating every time, which is kind of, we are creating as BOM file as every time as we build. Now we're not creating a BOM file as one time only. That means you have to create it every build steps. If you're creating an S-BOM file, putting repositories, it's a one time job, you're losing the point of the S-BOM. That means you have to create dynamically. When you initiate any build process, you have to create the BOM files based on your build, based on your deployment. That you have kind of a dynamic creations. Otherwise it's going to become a static. If you become a static S-BOM file, you're creating one time storing a repository. It's all that absolute because next time something may change. You're losing that ability. Let's go back to the couple other examples. Let's go back one more time here. And building. And now it's the packaging pieces. That's how we are creating a package, which is now right now I have the packages created and give you an example as output as the rest. That's the basic hello world type of applications and creating a package is deployable, which is creating a container version of it. Every time you can create a artifacts as well as the result of the artifacts. Let's go to the next one, which is about the S-BOM generators. Now, as I said, the package is really generating S-BOM file to you. It's the BOM file. And then when we create a download the BOM file, you will see the generation of the BOM file as part of your libraries. Now it's basically specific language that I created as the rust and using a cargo app as behind the scene. So what you should really ask yourself, what is my language package I'm using it? What are the containers? What are the package mechanism looks like? And try to integrate S-BOM file generation as part of your build packages. So it's not done yet because we said we would like to verify it. We would like to validate it. For the another thing, once we validate verified, we have to look at any vulnerabilities in S-BOM files. Because we know the version, we know the files, we have to check about any vulnerabilities in the file perspective, which goes back to the BOMR scan. BOMR scan is gonna look at the any type of bill of method you created, you can look at any vulnerabilities in that files. Here's the vulnerabilities, I may see that. There you go. Based on the version that you may have, you can look at the vulnerabilities. Now it's becoming more actionable. That will tell you here's my library that I'm using it, it is known CVs in that files. So till it's all available, what we did, we basically integrate the tool into our pipeline. Generate it, look at the content, look at the file, look at the CVs. There you go. Now we can fix the vulnerabilities that you know. And other things like fixing vulnerabilities, it's also requiring all this process again. You think that I'm gonna update every file quickly, everything's gonna work out? It depends, it depends on your testing, it depends on architecture, it depends on how things you are building. So now I know it, now I can go fix it, I'm gonna run the same pipeline again to make sure that I'm able to test the functionalities, I'm able to deliver the value for my business. Let's look at another one. So I'm storing everything into the artifacts that I created into the artifact repository has to stay in the location that I created as a binaries or the artifact that I created has to store in the same repositories. Now looking for dependency analysis, if you like some dependency analysis, I can store those files and look for any dependency each other's based on the projects. And other things, otherwise you have to keep those artifacts with your code together. Because your code is your project has dependencies as project together because you may not have different files in somewhere else in sitting that you don't have version conflict because you may have different versions, different project, you have to keep them in a single repository so you can really maintain those files which are project specific. And last one is about the verification phases. Now I'm basically verifying with my BOM files which is in total, which is a kind of open source tools for attestation and creating the content of the file you're gonna make sure that you're using the files as the right component you're pulling out of it which is verification pieces. Okay, and this is the basic example to show you how it is easy time for the CI to the perspective. Questions? All right. So basically in total is running behind this and as a get the runner job getting the BOM file and sending to the in total containers and comparing the content of the BOM file based on the libraries and versions. It's basic running the containers. I can show you the kind of a configurations shortly here. Let's go back to our pipelines and look at the job. Actually I may go to the project information, there you go about the files. Here's our GitLab runner. I can share the content basic running a container version of in total and comparing the files easily which is a kind of a GitLab runner part of it and running a container each of the components. All right, so as you can see we can really create all those dependencies and compare it and make sure that we are able to succeed it. This is specifically for one example of creating a BOM file, analyzing kind of look at the vulnerability part of this. Let's look at back to our slides. In our slide what we did it basically there are multiple stage in the pipeline using a cargo clip. You can take the picture or I can share the slide later on with the cargo build with the cargo publish and create a container version of it. Now once we have created now we can really the S-BOM generation pieces using as the package content itself creating a CyclingDX as an example. Gonna show the output of the BOM files. It's an XML but you can use SPDX or you can use any type of tools converting each others. Then we pushed artifact into the catalog so we can look at later on. We verified it in total and then we did the scanning of the libraries. Now it's became more actionable for us. Couple things is dynamic creations. Look in the content. We are creating every time when we change. Now if any developer is putting a new version of the components or changing the package we'll crap right away the changes. Now it's becoming more actionable, right? So in overall, this is the link check I'm gonna go quickly because you have time. Here's the example of the BOM XML file and the cargo references, descriptions and stuff. Here's the bumper scanning tools output because we don't have enough time but quickly what is next? This is important pieces that I would like to talk about it. It's how we can really get together. How we can solve this problem. Think about what you're eating it as the kind of a little burger. Think about everything as document ingredients. So now typically when we build it we have to think about the planning perspective go-spective design. Now we kind of didn't show anything about the how the design is done but we have to think about in design perspective. Map all apps to code bases. Think about what you have in your organization.  You can put your build process as your gatekeeper. You can put your deploying process as capturing the runtime files that you can think about what you're eating is in between. As a takeaway what you should do there are type of the S-Pen file that we discussed so far. You can create the design phases of S-Pen. You can really source it in development phases. You can create S-Pen in the build phase but all of this file doesn't mean they're not talking to each others.  It's really important you have to connect the dot which is automation is key point. Integration is another point you have to integrate it because otherwise you cannot have trace abilities.  I'll tell you it's useless. It's good to have it but if you don't use it for your monitoring, for your building, for your deploying there is no benefits. Why? Because go spec logforge analysis. How much time I'm spending to know is one elements. Second element is how much able to, I'm able to go fix quickly and timely to eliminate an zero day vulnerability of this. It is requiring automations. It is requiring integration. It is requiring a building at the beginning. Another thing which is my dream really I would like to put into the sacred stories. Anybody know what the sacred stories means? If anybody is writing a story for a functionalities for a planning perspective we have to write the sacred stories. There's a functional like an edge out of the turn we write the stories about the case and epics and stories. We have to think about the sacred stories. We have to think about what are the sacred requirements is required for functionalities. We can integrate S-bomb right into our sacred stories as soon as if anybody is writing some SQL statements or using some other dependencies maybe libraries that we can really track at the beginning of the planning perspective. Like one example, if anybody is gonna tell me we're gonna build up an application using it basically kind of like an AngularJS we can generate dependencies right away based on AngularJS. That's what I'm talking about the sacred stories. So overall really use the automation pieces integrate as much as you can. That's your job. Just running quickly, there's our website you can get a lot of information about DevOps and DevSecOps. I have been writing a lot of blog posts and webinars and supporting many organizations. Feel free, you can download, you can take a look, you can use any times. End of the day, it's about the code, okay. Don't forget that. Everything is code, we are going that direction. To deal about the complexity, it's about the code, whatever you do. It's a code, end of the day. S-bomb is a code. We're gonna use the code and analyze the code again. What are you gonna do? Automation and coding perspective. That's all what I have and I think we discuss a lot but if you have any questions, please reach out to me anytime. I'm happy to really share your stories or hear about your problems as maybe you have any use cases. I'm happy to talk to my students in my class every time, right. Thanks for joining and I'm here for any question that you may have it. I hope it was actionable to you. Ask yourself, what does it for me here? How can I use in my actions? When you go to the office on Monday, please remember, what is it for me? What I'm going to use it? If you're struggling, send me emails. I'm happy to answer your questions. All right, thank you again. Thanks for joining my session. Good.


The remains of Mrs. Iku Hensher, Earth Aware, have been committed to Mother Earth on Tuesday at the Ikoi Vault Cemetery Lagos. A brief funeral service was held at the redeemed Christian Church of God, the Temple of God parish Ikoi. Pastor Christian Ike represented Pastor Tunde Bakari of the Citadel Community Church at the service. He admonished everyone that death was an inevitable end and a death that must be paid by all. Plus, TV Africa's correspondent love Iku Koyedeku was there and brought back the support. The funeral services were attended with family, friends and well-wishers that came to be their final farewell to Mrs. Iku Hensher, Earth Aware, as she journeyed home to the great beyond. It was also a moment of tributes from the children, colleagues, close associates and acquaintances.  She was a goddess and now she's going to be with God. It just makes sense. So there's nothing to be sad about, to be honest. This is a glorious occasion. Her unrivaled commitment, doggedness and ever-redistance to assist and mentor upcoming officers like us. She was an example of professional decency with integrity. Pastor Christian Ike, in his exhortation, admonished the congregation to leave a life of service to God and humanity. He described late Mrs. Iku Hensher, Earth Aware, as a committed Christian whose legacies remain indelible in the sands of time. Ike with Ike. She has such a resounding testimony. She's somebody who not just embraced Christ, but she's so devoted in everything that has to do with the kingdom. The remains were finally committed to Mother Earth at the Ikoi Cemetery. Mr. Fola Arthur Warrer is the bereaved houseband. With emotions, he spoke to Plus TV News on what his late wife represented. I had hoped that when she retired next year we would have more time to spend together because before that, you know, being a federal worker she was always on posting and so on and so forth. One didn't expect a new son, but I will hold on to the memories. Just have to find the grace to persevere and just keep pushing through because she'd want nothing short. She'd want nothing less. Out of each and every one of her loved ones, really, she would want nothing less. Her spirit lives on. I know that. I can feel her presence very strongly right now. She's at peace, which is very important. She was her authentic self. She was unapologetic about who she was, and that is what I take away from her life.  That goes to show and I believe that her children are going to run with that legacy.  One thing that's evident in everything said about late Mrs. Iqo, Henshaw Arthur Warrer, is that she lived an impact to life. I'm Lagos. Love Ikuku Uyiduku for Plus TV, Africa.


I'd like to thank you all for joining us here tonight.  Thirty years, yes. I've been here since 1982, not in this building, but give you some history. TVA, WSES, began in 1982 at the cable office on Broadway Avenue, and we had several cable operators changed over the years from Lakeside to Star Cable Vision to Marcus Cable, more recently Charter Cable Vision, or Communications, and they've been here since, how long, Matt? About 88 months, and they built the system. Okay, but Charter, we'll give them six or seven years. So things have been great, and we moved out here in 1997, and became a city of Sheboygan Department, and six mayors later, here we are. You know, I was telling Karen that back in 1986, I think it was, I was here as a president of the council, and they had the mayors for them. It wasn't here, it was at the cable, and it was with Dick Schneider, it was the mayor at that time, and I was here, we were talking about city business, and in the last few minutes, we brought up my young son. He was maybe five, six years old, and he ran up on the set, then we introduced him, and that introduced him to politics and the TV8. Now, about 15 minutes ago, you would have seen my young son sitting on the council floor, as Alderman Van Ackeren is the same little guy that was here back 25 years ago. So as this goes on, and I hopefully another 30 years, maybe not for you and I, but 30 years for this TV station, this is the type of programming that we should look forward to, and it's great for our community. And I want to give a proclamation to Carrie that says, Office of the City of the Mayor, and I'm going to put on my glasses so I can read the little print. Whereas, since 1982, WSCS has provided public access to television to the city of Sheboygan, and whereas WSCS, as a department of the city of Sheboygan, represents a city to its viewers, whereas WSCS is a member of WCM, Wisconsin Community Media, and whereas for 30 years, we've had coverage in several areas, including over 1,200 sporting events, 108 council meetings, 108, 1,080 council meetings. I've been at more than an honor name. County Board meetings, 420 county boards, meetings plus over 7,000 community programs, whereas WSCS continues to receive statewide recognition every year for their programs, and whereas WSCS continues to be a great resource for local government meetings, service organizations, and local sporting events, and whereas in 2012, WSCS is proud to celebrate its 30 years of communication in the Sheboygan media outlet. Therefore, I, Terry Van Ackeren, in virtue of the authority vested in me as mayor of the city of Sheboygan, do hereby congratulate WSCS on their occasion of the 30th anniversary. Congratulations. See you next time. This type of program and this type of station is very helpful to local government in keeping our people informed. So thank you. Some other things I'd like to thank. Prior staff members, a particular really good friend, Rob Soxie from Buffalo, New York, who just happened to blow in from the wind. Thank you. No, he's here for other reason. Paul Mix, he was also another staff member. Fritz Zink, who was here, but he left, got dark so I guess he has to go home. Grace Zengara, Linda Schimann, some of the cable partners and helpful people that have been here for over many years, Matt Friggs, Jeff Thorne, and let's see, who else am I missing? Seaman, Kathy Anderson, there are a few other people. Oh, that's the music to get off the stage. And the current staff is Dave Augustine, IT director and manager. And we report to this department in City Hall and Scott Milo, and Eric Weisman, Rob Miller, Steve Reiner, and there are a few other guys, Mike Martin and Chris Wright, who are not here. And Brian Andrews, and I'd like to thank the Academy. Well, let's thank you for your leadership, too. Thank you. Thank you.


Hey, good morning everyone. Welcome to a new day. Let's begin this session with a word of prayer. Can any one of us please lead us in prayer? Simran, can you lead us in prayer? I pray then. Yes, go ahead. Go ahead, Kennedy. I have any Father Jehovah. Thank you for this day that you've given unto us as a class Father Jehovah. I commit our titha. First time I'm going to fall into your hands. Jehovah says to be asked to lead us in the learning of Father Jehovah. Father, I pray for the spirit of revelation to come in us. Father, of course we are learning deeper truth about your work. I commit all the students, Father Jehovah, I pray for the spirit of revelation to come in us. Father, the only God is what we worship and do. I commit everything that we are going to learn into our hands. Amen. Amen. Thank you, Kennedy. All right. Let's just do a quick review of what we did yesterday. We went into chapter three. We looked at points from chapter three, right workplace attitudes. So we saw that attitude is a choice and in most cases our attitude will determine our attitude in life, meaning how high we reach. Kennedy, I'll just mute you and then do all for the glory of God, keep our ambition kingdom focused, which means we looked at that verse, Matthew 6, 33, seek first the kingdom of God and His righteousness and all the other things shall be added unto us. And so even in workplace in the corporate sector, our ambition, our focus is not only to go up the ladder but it's also to reveal God's glory wherever we are, to build God's kingdom even in the workplace. A very important point we looked at was, you know, money is not everything in life. Money is a resource that God has given us and so God is our master, money is our slave and we have to serve God and the Lord will provide for us. And we also look at how money can be a factor to, you know, to fail in the plan that God has for us. Right. Sometimes we may put money and forget what God has called us to do. So we should be careful. How do we do that? Always walk in the fear of the Lord. We talked about how the fear of the Lord is reverence and honour to God to do even the smallest thing that has been assigned to us to do it with integrity, to do it with honour, knowing that God is watching us. And then finally we looked at the fruit of the Spirit, how God has given us the Holy Spirit and the fruit of the Holy Spirit is available, which is love, joy, peace, patience, kindness, gentleness, faithfulness, humility and self-control. So God has given us the fruit through the Holy Spirit. And so even in the workplace, even in ministry, we are to exhibit these attributes in our work. And when we do that, you know, we will be pleasing, not only in the side of our team and our managers, our leaders, but we will also be pleasing in the sight of God. Right. So we'll go to the next point. I'm on page 36. Do your work obediently, sincerely, willingly and cheerfully. Let's read Ephesians chapter 6, 5 to 8. As any one of us can read Ephesians 6, 5 to 8. I'll read. Go ahead. Slaves, obey your human master with fear and trembling and do it with his sincere heart as though you were serving Christ. Do this not only when they are watching you, because you want to gain their approval, but with all your heart to what God wants and as a slave of Christ. Do your work as a slave cheerfully as though you saved the Lord and not merely human being. Remember that the Lord will reward each of us with a slave of free for the good work they do. Amen. Thank you, Mangi. So Paul is writing here in terms of the slaves and masters that whole aspect was there in the olden times. But now when you look at it, you've got managers, you've got employees, you've got the whole hierarchy, presidents, CEOs and all of that. But important thing to remember is there are some key instructions that God is giving us. We know the following. Obey, be sincere, wholeheartedly or willingly and cheerfully. So God is instructing us in the workplace to be obedient, to be sincere, to work wholeheartedly and to be cheerful. Stay aligned to what God has been asked of us. Be sincere. The word sincere means to be genuine. Sometimes we can do a lot of work, but we may not be genuine in what we are doing. So for example, in the ministry, let me, here I use examples of the workplace and examples of ministry, but they're applicable for both. The reason I'm applying examples in the workplace also is because I don't want us to think that, okay, this is only for ministry. It is also for us in the corporate sector. Being sincere, even when nobody is watching, to have a genuine interest in things that you're doing in the work that we are doing. So there will be times in ministry, maybe, for example, the church is doing a conference. The pastor says, okay, you have to make sure that the chairs are arranged and the administration, you have to look after administration. So the food has been, you know, contact the vendors and also make sure that everything is clean in the church, that people are following timing, it's a three-day conference. So the pastors are busy, the leaders are busy. So the work has been entrusted to you. Now, if we work only for people to see us and appreciate us, there's no honor in that. When we work, we are to work with sincerity and genuine interest. Whether it be cleaning the chairs, whether it be, you know, setting up the church, setting up the speakers, whether it would be a menial task of, you know, just serving food, we have to do it with genuine interest and sincerity. I love what in the book of Acts, you know, that problem happened where they were, you know, the widows felt neglected. And the Bible says that they search for people who are full of wisdom. What is the work to serve food to widows? If we think to ourselves, you know, why do you need wisdom? You don't need wisdom, full of grace and wisdom to serve food.  No, but they chose seven men full of wisdom, which means what? It was even though a menial task, but they wanted to make sure that there were sincere, genuine people serving with all their heart. And so Philippians 2.14 says, do everything without complaining or arguing so that you may be as innocent and pure as God's children. So this is something that, this is a character that we develop over time to be obedient, to be sincere, to be genuine. Here's what I've noticed, you know, many times we join an office or join a company or join a ministry. Initially, we are very sincere, very genuine. We want to do everything, we go beyond, you know, what was asked for. But the real test is, as time passes by, after two years, after three years of working in the same company, what is our attitude? Are we still alive? Are we still sincere? Are we still genuine? Are we still giving our best for what God has called us for? That is the real test. So this is a very important, you know, aspect that God is teaching us here, be sincere, even when nobody is watching. And there are plenty of examples that I'll give, maybe I'll go on and later on we'll give some examples. Next point, loyalty is essential, be faithful. Let's read Proverbs chapter 3 verse 3 and 4. Anyone can please read Proverbs 3, 3 and 4. Okay, let's read Proverbs 3, 3 to 4.  If you do this, both God and people will be pleased with you. Amen. Amen. Thank you, Abhinav. So loyalty is very important. Faithful is being faithful, being committed to the company or the organization that you're working for is very important. Now, there will be times, you know, for example, you're working, you join a new company, right? Be faithful to your work that is given to you. Be faithful to be loyal to your team leaders, your managers, but there will come a time, right?  Not saying that, you know, you have to stay, be loyal to your company means you have to be in that same company until retirement. No, for different reasons. We will change companies. We will change, move out for different higher positions or higher roles and different reasons. But as long as you are in the company that you're working with, be loyal to that company. Now, one of the things that I hear from a lot of young people is, you know, for example, they're working for a company. And after three years of working in the company, they begin to mock the company. No, the company is like this, like that. What is that? That's being, that's not being loyal to the company. Yes, there are teams, maybe there are people around who are jealous, angry and the work environment may not be good. But God is teaching us and saying, you be loyal to what, you know, to where I have placed you at. Perfect example would be that of, you know, Nehemiah, Daniel. They are Jews. They are sitting in Babylon. They didn't, you know, make plans to make Jerusalem a better city. They were working in Babylon and Daniel was in charge of making things in Babylon better. So he was loyal to that nation. Was that nation a good nation towards Israel? No. But since God placed him there, he was loyal. He was faithful to the work that he had, that was given to him. Never do we see that Daniel said, okay, you know what, now I am here, but I will put all my efforts in, you know, blessing the people of Israel than here. No. God had placed him there. He was doing good for the benefit of that nation. Same thing with Joseph. Joseph gave us, you know, the story, he came. And what did he do? He made the nation such a powerful nation. He blessed, because he was the leader, the nation was blessed. He was faithful. He was diligent in everything he was doing there. Loyalty is something that is not found easy in these days. But God is calling us, he's saying, be loyal to the company or to the ministry that you are in. Be faithful, right? Well, the Lord Jesus narrated the story of the irresponsible manager, you know, who ran his owner's business into a loss because of misleading people. Whoever is faithful and small, they will be faithful in bigger things. And this is the verse that we always use. Be faithful in small things. God will give you bigger things. And this is one sentence that I always keep telling myself from the time, from 2010, 2011, I always tell myself, be faithful and small, then the bigger doors will come.  But a few of us in Bible calls, we would do it with all faithfulness, with all joy in knowing that, you know, we're doing it for God. We're doing it for God's kingdom and God will bless the work of our hands. You know, there would be so menial to the point of, you know, carrying water to the restrooms or cleaning up and mopping the floors. Now, nobody's going to come take pictures of us, you know, sweeping and mopping the floors and say, okay, this is Paul and the Bible college team who is, you know, sweeping and mopping. Nobody's going to do that. It's done in secret.  And so let's look at a few key principles in relation to faithfulness and loyalty. Faithfulness in small matters demonstrates your ability to be faithful in bigger matters. It is very unlikely that, you know, it does happen, but it's very unlikely that God gives us something big immediately. It does happen, but usually God takes us through smaller openings. He takes us through that season of training. So for example, you know, if you want to worship leader, it's very unlikely God will take us and put us in front of 10,000 people immediately. Very unlikely. If you get opportunities like that, wonderful. But he will look at how faithful we are in the small. And there are 10 people. What is your attitude towards the worship? Is it like, oh, only 10 people? Let me just choose five songs. You know, just sing something. Finish it off. Half an hour or 40 minutes. Okay, just choose something, sing it. Is that the attitude? And if there are 500 people, I have to do this. You know, this is a good song. These are the things that we need to include in the song. Is that how we look at things? You know, even if it's a supernatural hour that we have online, what I do is, if I know I'm dating on Friday, three days before I come up with the songs, I prepare myself and say, okay, five songs, four or five songs, or three days before we sit, think about the songs. Think about what God is placing in my heart. What kind of songs is it? Is the songs more about grace, about God's goodness, about God's power? And then we begin to, you know, make the set list. And we think about the songs. So there's a lot of preparation. Just those songs and just come and sing. No, there's a lot of preparation. There's a lot of preparation involved. Now, we may think, why, you know, we've done it for about 10, 15 years now. Why do you want to prepare so much? Because we are being faithful in small. But the small, whether big, be faithful. Faithfulness in handling money and positions that have been entrusted to you. Now, we know of many, many, many people who were not faithful in handling money and positions given to them. And they have fallen. I've heard of many senior managers who were, you know, because of mishandling of money. Many ministries who went through turmoil and they were dragged to court. Not in our nation, but across nations. And they were dragged to court. Why? Because of misleading people. Because of the finances were not kept in place. So being faithful in money, being faithful in the positions that God has given us, is very important. So if any one of us are planning to start your own ministry, oh, we need to be extra, extra careful in terms of money and in terms of people, how we handle situations. We need to be very faithful in all of that. Three, faithfulness in what belongs to someone else will position you to have what is your own. You know, maybe some of us in our heart feel that I want to start my own business or I want to start my own ministry. But now you're working under somebody.  And if we are faithful in that, what we are doing is we're aligning ourselves and saying, God, if you give me whether it's ministry or a business, just like how I'm faithful working under somebody, I will continue to be faithful, even in my own business or ministry that you give to me. So we are aligning ourselves to what God has for us. Here's the point. We are to be faithful to our organization, to the people, to our leaders and to the ministry, to the pastors, to people that we are working for. Be faithful, be loyal. Next. I think this is a very, again, very important point. Be accountable at all times. Sometimes, you know, our bosses or our leaders will be busy. So they may not ask us for the reports and all of it. Be accountable at all times. Even when not asked for. Send reports. Now, one of the things that we do in APC is all of us as staff, we send reports. We send weekly reports, we send monthly reports. And not every time it's asked for, but we just send it. Okay. So these are the events that we did from January 2021 to July, June 2021. That's a six-month report. Or there are times we can, you know, we send a three-month report or a monthly report. Now these reports vary. Some talk about finances. Some talk about events. Some talk about, you know, spiritual progress of how the church is going and functioning. And some talk about our personal progress in the ministry. So be accountable at all times. Let's read this big passage here from Luke chapter 12, 42 to 48. Yes, could any one of us? Sorry, Luke 12, 42 to 48. I can read it. The Lord answered, Who then is the faithful and wise servant? He is the one that his master will put in charge to run the household and give the other servants their share of food at the proper time. How happy that servant is if his master finds him doing this when he comes home. Indeed, I tell you, the master will put that servant in charge of all his property. But if that servant says to himself that his master is taking a long time to come back and if he begins to beat the other servants, both the men and the women, and eats and drinks and gets drunk, then the master will come back one day when the servant does not expect him and at a time he does not know. The master will cut him in pieces and make him share the fate of the disobedient. The servant who knows what his master wants him to do but does not get himself ready and do it will be punished with a heavy whipping. But the servant who does not know what his master wants and yet does something for which he deserves a whipping will be punished with a light whipping. Much is required from the person to whom much is given. Much more is required from the person to whom much more is given. Amen. I like that verse. Much is required from the person to whom much is given. Much more is required to the person whom much more is given. An organization or a ministry that we work for provides us with time, with tools, with training equipment, with money, infrastructure and it is our responsibility to take and use these facilities that the organization is providing and do the work that God, that has been assigned to us. Now there are many companies that have one week timelines. Some have two weeks, some have monthly reports meaning in a month they need to have targets or some have weekly targets and so accountability is using the resources that the organization and the company is giving us to accomplish whatever they have been asking us to do the goal that has been assigned to us. Now when we use that in an effective manner that is when we are saying being accountable. Being accountable is firstly to your, you know, to your leaders, to your superiors, but then most importantly being accountable to God. And I believe that when we are accountable to God all that depends upon this. Because we are saying God, if this something is wrong, we are saying God, you know, this is wrong, I should not do this. You know that you are accountable to God. And so when we are accountable to God, whatever we do, you know, will be in line and we will not fall into any problem. I am reminded of this thing that happened when at a young age I joined a call center and you know, so we were working in the call center and call centers are really, I think some of us may know, it's like in 9-hour shift, 8 hours of talking, continuously 8 hours. So you have a 15-minute break, 15-minute break and a half-hour lunch break, right? So 9-hour shift, 8 hours of talking to customers and it's not easy. You got calls after calls, some customers are angry, some customers are sad and sometimes they are upset that we have called them, they may be at work in meetings and then we ask them for their personal information, they get even more upset. And so there are different kinds of, you know, days that we face. And call centers can be very, very serious. And I remember, me and my friend, a friend of mine in the workplace, he was an excellent communicator, right? He would really communicate with the Savile AOL call center, not so good old, good of days, yes, yes. And so he would really communicate very well, right? He had the knack of speaking to people. But here's the thing, he was not diligent, right? I used to keep telling him, you know, you're very good at your calls, why don't you teach me? And he said, hey, just talk freely, don't worry about it being recorded. So he used to give me some tips. And then he would, you know, he would do very well, but he was not diligent, right?  So I would tell him, hey, don't do that, because, you know, you're being monitored, you can't put a customer on hold for 10 minutes, go have juice, and it's not right. And he said, no, nothing happened, don't worry. I'm a performer here and all of that. And he kept doing it month after month and to many customers. And so, since he was a good performer, nobody really, you know, looked at what he's doing. But eventually, about four months down the line, there was some kind of discrepancies. They checked the overall hold time for the team. It was way above what it should be. And so the team leader went into details. He saw, okay, in our team, how many people are placing their customers on hold? And so he pulled up our list. And when he pulled up the list, he saw that the best performer in the team who got the team, who gets the team to a good place, who gets the sales done, he is the one who's been placing customers on hold for 15 minutes, 20 minutes, and eventually he was called and eventually he was terminated for this act because he was not faithful. Being accountable is to use what God has given us in a right way that is pleasing to God. And so being accountable to God will make put everything in place. Now it looks like a small thing.  Always, every month, he's a performer of the team. Even though he places people on call for 15, 20 minutes, he would get the most number of sales. He was so, you know, talented. I believe that if he had just continued on, he would have got promotions and, you know, gone up the ladder very fast. But he was so disappointed and he looked back and he said, I wish I didn't do that. I wish I didn't take advantage of my skills and abilities. So it's good that skills, talents, but it is also right usage of that. Being accountable of those gifts and talents, right? Next point, be passionate. If your heart is not in it, get in or get out. Let's read Proverbs 11-8. Proverbs 11-8, yes. Yes, anyone can read Proverbs 11-8? Proverbs 11-8, yes. But no. Proverbs 11-8. Okay, I don't have it. I don't have it, sorry. Proverbs 11-8, bad work gets paid with a bad check. Good work gets solid pay, right? Now, when we look at a job as a job and if there is lack of passion in it, it's very easy to find that out. It's not very difficult, right? When we're passionate about something, we are willing to go the extra mile. But when we're not passionate about it, it just becomes, okay, a routine that we have to do. Then we have to get in or get out. In the sense, we either have to be passionate about it or move on. Move on and do something that you're passionate about because if we are half-hearted about doing something, whether ministry or in the workplace, we will not be fruitful. I remember when I was working in the IT company, I so much wanted to join the Bible College and do something in ministry. I would go with a half-hearted heart to office. The office was just a few minutes away. It was probably about five minutes away and not really had to travel a lot. But I would go with a half-hearted heart. It was a day job. It was not even a night job. Everything was convenient. But I would go with a half-hearted heart. I wish I didn't have to go. I wish I could do something in the ministry. Later on, I realized that, hey, this is wrong because what I'm doing is I'm just trying to I'm just waiting for the day to get done and just go back home. Days are going, months are going. I remember talking to my parents and saying, I don't want to do this. I'm not very passionate about this. I don't want to enjoy this. I want to join the ministry. I want to do something. I want to study the word. My parents were gracious enough to say, okay, leave the job, join the Bible College. But I had to make that decision because my heart was not in it. But the moment I joined the Bible College, I put 110% to Bible College. I did everything, whatever was given, whatever task, whatever responsibility, whatever subject, just sit, study, learn, did my best, gave my 100%. And that's what we all should do. If you feel that this is something that is not interesting, your heart is not in it, plan and move. I want to be careful because there are times when we say, okay, I'm not interested in this, quit a job and go on. I remember the point we said that birds, sometimes if you don't settle down, they keep flying all over the place. So it's also important to plan now. So when I spoke to my parents, they said, okay, you can quit and go. I didn't quit immediately. I knew that I need to... The Bible College is not... I need to pay a fees. I need to get books. I need to get material. And I'm not going to be working for about two years. So I want to be self-sufficient. I want to have some funds with me to help me. And so I saved up. I didn't quit immediately. I worked for about a month or so. And then planned accordingly. So even if you feel that you want to make a transition, plan accordingly. Don't be in a hurry to make decisions. Next point. Maintain integrity and truthfulness always in all things. I'll just go a little quick. I want to finish up these points. Maintain integrity. Proverbs 10-9. He who walks with integrity walks securely. But he who perverts his ways will become known. The word integrity means to stand right. Stand with your head held high. Where you know that, hey, I've not done anything this easy or evil in the eyes of God or evil in the eyes of people. I've done my work. I've done my ministry. I've done everything that I have with integrity. The wonderful most wonderful example would be of Apostle Paul. He's writing his last letter to Timothy. In 2 Timothy he says, Paul, Timothy, I have fought the good fight. I have finished the race with integrity. He's saying, I fought the good fight. I didn't just fight a fight. I fought the good fight in integrity. Every area of my life in the ministry I've done it with integrity. And here, what is integrity? He's writing more ethically and legally. I'm sure you've heard about this ministry, Mars Hill Church. Mark Driscoll, he's a wonderful, wonderful man of God. Many years ago, the early 90s, he's still around, but in the early 90s, God really used him powerfully. And after he started his ministry, thousands of people started coming in, and then new locations were planted. His ministry began to grow really, really big. At one point, he had about 15,000 feet in the church. Here's what happened. Mark Driscoll, Pastor Mark Driscoll, he was known for his way of, you know, angrily speaking. He would mock other people.  And, you know, it was not going too well. That was not the way to handle yourself. But then the integrity issues came up. Issues with, you know, marriage and then all kinds of things. The entire ministry collapsed. 15,000 odd people. It's nothing. So, I would always say this. Our skills and talents take us up the ladder. But it is character and integrity that keeps us there. We can rise up the ladder with our skills, talents. Oh, I know how to use this. I know how to do that. We go up the ladder. But once you're up the ladder to stay there, we need integrity and good character. If not, we couldn't just fall off that ladder. What is, what is it being right morally? Are we doing the right things? And legally do the right things. Put away, I just read a few verses here from problems. It's got plenty of verses on maintaining integrity and truthfulness. 424, Proverbs 424.   But those who deal truthfully are his delight. Proverbs 11, 5, the righteousness of the blameless direct his right, but the wicked will fall by his own wickedness. So in our workplace, maintain integrity, maintain truthfulness. Where we can say, God, I've done this with integrity, done this assignment given to me with integrity with truthfulness. And I know that when we do it that way, you will bless the work of our hands. You lift us. Next point. Work hard because there is no place for laziness. Work hard. Now the Bible has plenty of verses that talks about work and how we are called to work hard. Look at the ant you sluggered. How they work hard. That was in Proverbs 12, 27. If you are lazy, you will never get what you are after. But if you work hard, you will get a fortune. Now diligence is thoroughness, working carefully and attentiveness. When we work hard, when we are not lazy, that is when we will achieve what God wants us to achieve. Laziness procrastinates. When we are lazy, we will say, OK, I'll do this tomorrow. No, I'll do this day after tomorrow. Let me do it next week. Let me do it next month. Why is that? It can be done today itself. But sometimes you say, OK, let me do it tomorrow. Procrastination is laziness. Laziness is also doing a job incomplete or half done. On Sundays, after church, we clean up the whole church and sweep and mop the whole place. We have a team and I always tell them, let's do it neatly. If we're doing it, we'll do it neatly because it's church. So they all give their best. I'll give you this other example. There's this elderly woman. She's got a daughter and the daughter is an MBA. She's done her master's and she completed a couple of years ago. But from then on, she's been applying for job after job after job, but she's not getting any job. And then she would always tell me, her mother also would say, she's been applying for jobs. She's not getting jobs. Then one day, I really asked her, what happened? Why is it that you're not getting jobs? I'm sure there are jobs. And then I got to know, then the mother told that she applies for jobs and they give her the interview dates. She'll say, I'm not comfortable on this date. I can't go so far. This company is too far or the salary is too little. They don't have benefits. They don't have this. So the whole thing was for two years, she was getting many offers. But she kept procrastinating and procrastinating saying, okay, I don't want this. I don't want this. I don't want this. And now it's very difficult for her to get a job because there's almost a three or a four year break between her studies and for about four years now, she's at home still applying for job, still applying even for marriage proposals, laziness, procrastinates. We will end up, you know, if we are lazy, we will end up with nothing. So as we apply, as we do things, let us avoid laziness. Don't just be busy. Be productive. Don't just do many things, but be productive in what you're doing. Right. What we do at work is important to God as much as what we do in the church. Right. It's not like, okay, we're working in the church. God will bless us more. And because I'm walking in the corporate sector, God will look at us secondary. No, no, no. God is with us both in the church and in the workplace. He's interested in the ministry. He's interested even at your work. Right. So just because, you know, we are busy does not mean we are productive. So we need to see, are we setting goals? Are we achieving those goals? You know, are we giving results?  It is the results that matter. Right. You can't sell your boss, you know, what I did my best and then, you know, you know me, I'm a good person. I, you know, I follow all the rules. I never cheated and can explain all of that. But at the end, numbers or results is what people will look at. Right. So Psalms one, three, they are like trees that grow beside a stream and bear fruit at the right time. Next point. What you do with your time is very important. Learn how to manage time. All of us have 24 hours. All of us have to use that 24 hours to do what we are doing, whether in the corporate, whether in ministry, learn how to use time effectively. There will be projects that can be put, you know, done secondly, see what is important, do what is important first. Right. And as you're doing that, have a passion for excellence. Keep, you know, striving for excellence. Now, excellence does not just come. Excellence is hard to have the endurance to push for it. Right. Don't have that, you know, it's this much is enough attitude. Right.  Right. You learn the instrument, you learn how to sing and then you practice, practice and then eventually you audition. You get into the worship team. Now it's not like, okay, target achieved. I got into the worship team. No. It should be in a sense that we are to grow more and more and more. It's not like, okay, I'll study the word. Once I become a pastor, target achieved. No. To become a pastor, we need to grow even more. We need to spend more time in the word. Keep learning. Keep on knowledge. Keep studying. Right. A good student is a continual learner. Right. Keep learning. We are all students just because we are teaching does not mean that, you know, we are not learning. We are all learning. So never stop learning. Proverbs 15. Sorry. Proverbs one fight. A wise man will hear an increased learning and a man of understanding will attain wise counsel. Right. How do we learn? Can we, you know, nowadays we have Google, you have YouTube, you have apps, you have, you know, different ways of acquiring new skills, listen to people, talk to people who are growing in that grow your knowledge, watch people, ask a lot of questions, ask genuine questions, experiment, learn from people's success, learn from people's failures. And the more we do all this, right, watching others observing, we will learn. We will never stop learning. And learning is something that will happen till the end of our life. Whether it is ministry, whether it is, you know, anything in life, we will learn. Right. The other couple of months back, we have an older couple who are 90 years old. She is 90 and she and his wife is 85. The other couple of months back when I went, I was teaching them how to use, you know, zoom because they wanted to join the zoom press that we have in the church. So they were so interested to learn that. He's 90 years old. I was teaching them how you can log in on your phone. Then I was also teaching them what Google classroom because, you know, they were interested in the Bible college to join a few courses. 90 years old. Never stop learning. And it keeps growing. It keeps growing. And so stay focused, stay calm. Even when unexpected thing happens, you know, in the workplace, ministry, when everything's going smooth, it's all right.  We have to stay focused. We have to stay calm, maintain the ability of calm spirit, calm mind and continue to focus on what God has, you know, set for you. And so with this, we complete the chapter, right workplace attitudes. And we will stop here. And then from next week, we will pick up from section two, chapter four, talking about vision and corporate vision and how to work towards that. Right. Any questions, any thoughts? Thought we can close in prayer. Everybody okay? No questions? All right. Okay. Could one of us please close us in prayer? Okay. Shrikumar raised your hand. It's already 950. Okay. Can we, can we do this next, next? Yes. Yes. Yeah. Okay. Thank you Shrikumar. All right. Thank you. Yeah. Okay. Thank you for that. Let's pray. Although we thank you. We thank you for learning with just heart, Lord. We pray for that. Moving forward, Lord, we'll be diligent and we'll be helpful in whatever you have given us, Lord. Maybe our families, maybe our health, maybe our workplace, Lord. We pray for that. We will do everything, Lord, with the heart of glorifying you. We'll bear in mind that everything we do, Jesus, we give glory to you. We pray, Jesus, that your Holy Spirit will empower us and he will treat us even further so that everything we do, Jesus, according to your will, and gives glory to you. We pray all this, Father, in the name of our Lord Jesus Christ. Amen. Amen. Amen. Thank you, Mangi. Thank you, everyone, for joining. Have a great week ahead. I'll see you next Monday. God bless. Thank you, Pastor. Thank you. God bless. Thank you, Pastor.