o some extent So they certainly are out there in that respect I know if if there are other actors then they're purely more of the traditional state to state Or they're getting in and getting out without anybody seeing them. I think that's a that's a real possibility Education awareness, absolutely in this scenario as well Whether it's mandated however it comes it needs to happen People need to understand that they have an impact on other people's lives that if they leave their system Unprotected then that system is going to be co-opted and used to get around as a hot point to get around other systems And and we see that all the time. So any way we can make that happen any way we can Create a culture of security here in the u.s. I think that would definitely benefit our national security and our economic security Um, the russians are a puzzle We know more about the chinese because their tradecraft generally is so noisy And the sad thing about that is I always have to remind people it's not that they're that good Although there are some very really good intrusion sets that are trying to get into my corporate networks as we speak But they're most of them are quite noisy and it's because we are so bad They they've literally they don't have to leap over the bar. They just have to step over it And so they found exactly the amount of energy they need to expend to get into the networks and nothing more. It's very efficient The russians are much stealthier. They use a lot more crypto It's much harder to do adversary intelligence because they actually Don't regard their language as their first line of national defense. They actually use aggressive levels of encryption They coordinate in silk channels They do all kinds of things that the chinese don't do that make it so easy for us to enumerate them And to identify their building in shanghai and in everywhere else Although I will say that the chinese in my view have always been terrible strategic communicators But they reached a new low recently when their response to the mandiant report was and this is an official spokesman at the ministry of national defense said There is no unit 61398 You know, I mean talk about kafka esk Ignore the man behind the green curtain. I mean we have hundreds of pieces of open source data Identifying that unit. It's a public knowledge, but the chinese response is not We can either confirm or deny those allegations. But as a rule, we don't discuss intelligence operations from this podium They're they're literally the response at the official level is to deny reality just to deny the existence of reality Um, which to me is just a new low from actually on the bill Kind of it's on the paitza on the front of the gate Kind of like nsa, right? It used to be no such agency to I think you were a question about Denying the benefits of all of this stolen intellectual property On a tactical level, some companies are starting to do deception by planting fake but Juicy is looking information in sort of honeypot sites on their websites that they know or they think the The adversary will be interested in stealing but which would then end up being a completely, you know bogus Plan for for something and I think James also mentioned doing this on a more strategic level There are also I guess, uh, you know problems with Making sure that if if you do put some deceptive product information out there You don't have any liability for some, um, you know formula a baby formula that ends up killing thousands of babies but um Anyway, that just came to mind as one area that has not received as much discussion as I think it should or could um, and then we're generally speaking with respect to just educating people about better hygiene and security, um, you know, I I think it's Definitely something that The the administration talks about and we'll see whether or not there can they can turn it into a You know see something say something kind of campaign that actually makes sense Some companies are doing things like Turning this into a service where if they notice that your computer is infected part of a botnet They'll alert you and and and tell you you can go to a certain site for remediation But at least to let you know that there's there, you know, you are potentially part of a larger cybersecurity threat On the far end some countries actually are much more into Creating secure nets where you need strong user identification in order to gain access to Sites that might where you might want to do banking or voting or filling You know prescriptions or getting government services Some some government officials. I know think that's something like that is is a good way to go, but I think there would be a pretty rigorous public debate about about whether that's creating You know too much of a almost a national Identification system that we don't want to go down the road of so That's my thoughts Yeah, not much more to add except um, I think the education piece is critical Unfortunately, I don't think it's going to happen until we see real world physical Implications of an attack the digital equivalent of planes flying into buildings until we actually take this seriously that we see A lot of movement related to Legislation, etc And if you can imagine in august of 2001 if some government official stood up and said, you know, we're going to ask everybody because we're concerned about this Terrorist threat. I know it's hard to go back in time and remember before 9 11, but imagine august of 2001 We've got this terrorist threat. We're going to ask everybody to take their shoes off We're going to take your jackets off take your your shampoo and put it in a plastic bag. That's the one that always gets me And and people people would have been up in arms. This is outrageous. This is an invasion of our privacy We're absolutely not going to do it and then a month later We have this devastating terrorist attack and all of a sudden people are stripping down at the at the At the line at the airport because they recognize what the threat is they recognize the impact And they're absolutely willing to to take extra steps and measures to make sure they're more secure I think it's unfortunate that it may be something certainly not as significant as that although perhaps But but some physical impact where before people it really grabs their attention and they recognize we need to do something differently Well Let me do the following Which is the drill given the amount of expertise we have on this panel on the next panel Is we're going to go directly into the next panel and so we'll switch the name cards If you could keep your seats that would be very helpful But also join me now in thanking this group. They were incredible All right, let's get started everybody if we could I know it's tough and when you have a small opportunity to Take a break Well, as Jim Lewis said, we've we've uh, been very fortunate to have a number of uh excellent uh panelists and of course speakers kicking off the event uh today And um, and I think we'll find that This panel Will duplicate a little bit the previous panel. So they stole a little bit of our thunder, I guess group, right? But i'm sure we'll uh exceed expectations or at least we'll try to in this regard It seems like in uh In my previous life in the government where I worked in the department of defense for 31 years and and it seems like i'm always asked to To answer the more difficult question which is How do you stop something? Versus just describing the threat sort of like when I worked in NSA for For many many years, uh, and I was on the defensive side most of the time and Seemed like our job was a lot harder than the offensive guys. So, uh, so I think I find myself in the same situation But luckily we've got a great panel and this panel will try to take the momentum from the previous one uh to try to I think get to uh some interesting thoughts on uh on stopping This threat that you heard earlier talked about by the by the previous speakers and we as you heard in the previous uh Group, uh, it is certainly a daunting problem that we face uh these days And uh, and so I'm gonna just open it up for the for the panel to to each one of them give a few minutes Of their of their thoughts As as leaders in this field and we're very fortunate to have as I said this group. We've had a few people Uh, who had some unfortunate family emergencies at the last moment who had to drop out But we've got this group together. I think will be as equal if not superior Than our original, uh group And so with that, let me just kind of start and work our way down Left to right to keep it easy if that's okay with you Stuart and Stuart I think many of you may know but Stuart, uh Was at the department of homeland security. He was the first Uh, uh, a senior in charge of policy assistant secretary for policy for DHS and and as we all know when we created dhs after 9 11 That was a very very tough job and he's learned a lot of lessons from that. I'm sure And uh, so let's have steward give us some of his thoughts on stopping the threat, sir Yeah, the lesson is don't do it. Uh You know doing a startup in government, which I've now done a couple of is just deeply painful, but um a So, um, I would like to you can't hear you. Okay. Uh, I'd like to popularize and This with what I call baker's law, uh, which is our security sucks, but so does theirs We can you know the fact is The the real enemy of security is operation on necessity. There's things you have to do You've got to accomplish the mission you take a little bit of a shortcut And that's the end of your cyber security. Yeah I and that you know that that that operational necessity Works on the other side too. They've stolen stuff and they've got to get it Down to the their state owned oil company in time for them to get their bid in as well I and they're going to take Shortcuts and we're going to be able to figure out who's doing this and this is the critical point Uh, I sometimes liken this to uh, pig pen He's got this just ball of dust surrounding him. Uh, this is what we're like in cyberspace. There is just Bits of digital dna flying off us at all times as we take one shortcut or another and find ourselves losing control Of our identifying information. We're doing that happening all the time We all know that and so are the people who are attacking us The the important thing about that is this means that we can attribute these attacks We can actually identify the guys who are doing it. Sometimes I put up that photo of the anonymous attackers Who were busted because they put up a very low cut picture of one of their girlfriends I And to mock law enforcement and didn't realize that the picture had been taken with an iphone Which very helpfully provided the geographical coordinates Of the girlfriend She was they didn't show her head just the rest of her I I've often thought that You know the secret service and the fbi must have arm wrestled for who was going to do the id in that case um So we can we can begin to identify people Who are attacking us? That's the attribution stage. We really can do a much better job than we have In attribution and then we have to bring like i'm a scott's irish kind of guy. Yeah We need to bring the pain We need to show the folks who are attacking us that it's a painful thing to do and they'd be better off Choosing a different career And for that I think we are going to have to get much more creative But I testified last week to judiciary committee and suggested a number of things that we could be doing All you have to do is read the mandient report read the trend micro report Read some of the or the the report that citizen lab did There is there are lots of clues to the identities of the attackers We know where they went to school. In one case, uh, they they went to Sichuan University and the kid Who was engaged in those hacking attacks later went to work for 10 cent, which is the enormous Chinese internet company with a big subsidiary located in the united states Sichuan university needs visas to send their people to the united states. So does 10 cent Why aren't we saying hey, we got an investigation going We'd like you to cooperate if you don't cooperate. No visas you can go home and and and train There's no reason why we shouldn't be doing that today. Yeah Especially designated nationals we have systems for saying These are people who are engaged in trade in conflict diamonds And we want to take the people who are engaged in that Designate them as folks who the us government says no one Uh can do business with those Conflict diamond nationals They do the same thing for bellow russian oligarchs The magnitsky act does this for people who are interfering with human rights in china Well, for god's sake, you know, we have people who are interfering with our human rights right here in the united states We ought to start designating those nationals And causing some pain for people who are engaged in these attacks. We know enough to designate them Let's start doing it. Uh, and then finally and and i'll close with this We need to uh to take the information that we're getting and follow it through not just to the attackers Not just to six one three nine eight, but to the guys they're feeding with our stuff and um We need to find ways to tag that quote information as it goes back to china and then on to a state-owned oil company so that we can say we know where that Uh information went we've tagged it and followed it all the way And now we are going to take every nickel you have in the western world for engaging in economic espionage with Criminal prosecution civil lawsuits and the like we can do all of that if we set our minds to it We're going to have to change some laws, but not very seriously. We just have to take it seriously. Thanks Oh, we got pressed a button. I wondered how that worked. Okay. Thank you Yeah, uh, just just uh, I thought I was going to be the oldest person on the panel till stew walked up So now I feel like I've been vindicated But just just to give you some context when you know and chris english was talking He was talking about the code making and code breaking roles at nsa and I was a code maker For for the early part of my career probably I had been there about 20 years when chris actually arrived on the scene And he was working in something called the computer security center Which was relatively new at that time in the in the 80s because we were we were starting to you know think about Yeah, we've been building encryption. That's what I did. I built encryption boxes. I was not a crypto mathematician per se I never really understood the difference between a fibonacci sequence and a fibonacci coca sequence It was always there was somewhat mysterious, but I could make the boxes work. So that's what that's what I did But we started thinking about okay beyond encryption as you know in the 80s The internet was just starting the early 80s. The internet was just starting to take shape So we started to think about this question called computer security at the time And you know there was the orange book and the red book and the yellow book and I think chris was involved in that He was trying to think of the colors. So I said what next what color is where we're going to publish next? I think that was his job. But anyway, uh, we went on from there And we you know we evolved into information assurance and I think it's still officially called information assurance But it's really focused on cyber security now And I'll say the lot's been covered already. I don't want to repeat what the previous panel has said But you know a couple a couple of observations out of out of the discussion Uh education, uh, particularly, uh, you know, it's a good thing But it's never going to solve the problem. I mean if you're expecting consumers to change their behavior That's really a fool's mission. They're going to behave the way consumers behave and if they get an email So some people will always respond that an email saying you've won the ugandan lottery Just send us your bank information and we'll send the money to you. Okay, we're never going to stop that behavior Uh, you know educating them and you know, I think we're going to have to do more In the consumer space about automating the security processes there You know, we shouldn't have to have the consumer check the box and say I want the automatic updates I mean that's dumb. I mean that ought to be a part. You want to use the system You want to use the the operating system? You want to use the applications? You got to have the updating process in effect so we can go so that the Providers the technology providers can fix the problem for you You know, we we participate in something called the ncsa the national cybersecurity alliance, which is dhs You know industry sponsored thing if you go to the ncsa website It's got 10 10 guidelines for how do you how do you secure yourself? Okay, and this says, you know change your password regularly The one I like is configure your your computer In a secure fashion Okay, so how is the consumer going to do that? I have trouble. I've been in this business a long time and I'm not a computer geek I was studying vacuum tubes when I was back in college So I'm not a computer geek computer science hadn't even invented yet And uh, you know, how do you expect the consumer to quote configure their machine securely? I mean, that's just not going to happen So we have to we have to start to deal with that from uh, if you want to use the technology You gotta you're going to have to accept the fact that your your security has to be managed by the technology providers It's never going to be configure it yourself. You figure that out Okay, the step to the larger question. How do we protect critical infrastructure? Let me say a couple of things. Uh, number one, I think defense in depth has been very successful But it was it's it's the the security model has always been evolving when the internet started There was no security. Everybody trusted each other was a set of uh, You know host machines at academic institutions that were networked together when everybody trusted each other And if somebody got out of line, they were quickly, you know, put back in line by the rest of the of the peers That obviously has changed. I think the firewall was first invented probably late 80s early 90s They still have the bill of incest mcbook on my my desk called falling foiling the wily hacker And it was the the internet firewall was invented And it basically said, you know, we've got to close some of the ports and protocols that you're not using And you'll keep those guys out. Well, that worked for a while But then the hacker said, well, you know, I now I'm going to figure out how to tunnel through that firewall and Tunnel through the protocols you have opened So it's always been and you know defense in depth came along as a evolution of that thinking Clearly we're now at the stage where we've got to move away from, you know, the early discussions about the static defense And go to a much more dynamic adaptive environment And that's going to take some some things that we're going to have to do collaboratively Uh information sharing if I can use that word is is an essential part of that But I I think of it in really in terms of a higher level I mean sharing signatures sharing threat warnings That's all great and it needs to be, you know, we need to do more of that and make it more Operationally focused that's I think somebody already pointed out, you know Sharing for the sake purpose of sharing is a waste of time sharing so I can block a new threat that that's much more useful to me But if I start to think about how do I get ahead of the power curve? I've probably got to do my analytics if I'm looking at my internet portal and I'm analyzing the traffic flows That's good. Okay. But what I really want to be able to do is analyze it at the next larger scale up to You know, in fact ultimately take it to the global network level because that's the way I can actually understand What's really happening in the network and as new threats emerge I can be on top of those and that's going to take some doing to move from where we are today And localized analytics to global base. We do it at AT&T We do it on our global network infrastructure. So we have a pretty good view, but it's only our view I don't share the view with Verizon at the native level We're now doing more collaboration with Verizon and the other tier one carriers As we're dealing with DDoS attacks against the financial institutions, which I think Ellen mentioned earlier We're actually changing our business model in effect to help deal with that But the driver ultimately is be how do I really understand what's happening out in that global infrastructure And be able to deal with threats as they're emerging those zero days start out, you know Somewhere and we want to be able to find them where they're starting as opposed to gee I just got compromised now. I got a clean up the mess So that's kind of I'll stop here because we are kind of you know constrained on time But you know, we got to change our thinking in our approach to security And and a point solution here a point solution there We've got to move to a much more global view of what's happening and that's going to take Global collaboration international collaboration as a part of that We're going to we're starting to try to do that at the internet service provider level And and opening up dialogues with with international partners We peer with you know, a large number of the global carriers And so why aren't we doing more in terms of just developing a common Understanding of what's happening in the network and I can go down to the packet and you know protocol level And and be able to identify those zero days before they become successful That's what you're really trying to do is get ahead of the threat. We also have to work towards Driving the technology base to be naturally more resilient and more secure. We're just starting to understand how to do that But in the commercial world, that's a big challenge simply because they're you know, the technology is always moving And you know, Microsoft's been been trying to deal with security at the native level in their development process But you know, they brought out windows 8. Okay, and windows 8 brings a whole new flavor to things in the operating system realm And so we're going to learn things as we go I see we learn something every day about cyber security because we usually learn several things Just because we're we're there and we're doing it So you never stop and say I I understand the problem In fact, I'll close with my favorite saying in the cyber security business If you think you understand your problem, you're badly diluting yourself. Thank you Thanks, John Okay. Now next is John Gilligan. John Was during the dod days Probably one of the most innovative cio's that we had he was a cio for the air force And now he runs his own company and uh, john, could you give us your thoughts? Thanks, Bob. And thanks to csis and fire for putting on this session You know, i'm thinking back and it's been Almost 40 years since I first got involved in cyber security computer security back then I went to a seminar In a graduate school and ended up getting a graduate at the end of it They said we have graduate assistantships available and that was caught my attention and so I raised my hand and Spent the next couple years designing trying to design secure systems trying to mathematically prove systems I spent most of my subsequent career not doing computer security But designing and building it systems And now more recently, you know and helping manage companies and The the the topic of stopping the threat to me has to be looked at in terms of a business perspective And I come to these sessions and candidly my head hurts And it reminds me of a Of a story that I tell often when I was cio of the air force We spent about seven billion dollars on it a lot of money on Computer security. I had a pretty good background in computer security And what I would find is each year as nsa came in to do their penetration analysis of the services Then they would call us all together said they'd line us up like a panel here army navy air force and they would debrief us on what they found and The first time they did that I was terribly embarrassed because it wasn't Did nsa succeed in breaking in it was how long it took and that how long was in minutes and seconds And and the types of attacks every one of them was successful And I'm thinking my goodness if somebody from the media had been sitting in this audience. I would be Pillared in the in the media for for spending seven billion dollars and not being able to protect even And and so the second time this happened. I was very frustrated. So second year same briefing Very frustrating and I went to nsa and I said I need to know where to start It's not like we're not spending money. I need to know where to start and that ensued a discussion That I'll shorten but at at the end of that discussion nsa came back and said well, we've now analyzed the threat And based on the threat here's where you ought to start That was enormously enlightening And so I want to fast forward that same discussion today So Verizon just produced their latest Verizon data breach investigative report very enlightening. There are a number of other reports that are similar out there But to me what catches my attention is that really things haven't changed dramatically from my air force days The majority of threats In terms of number are unsophisticated And they're attacking very straightforward weaknesses That's really important to second and and some of these statistics were mentioned earlier today in the presentations The the breaches are not discovered until weeks and months after they occur unsophisticated and discovered weeks and months later And most often discovered by people external to the organization And yet we're spending 30 billion was the number that they've dwelt used others have used a lot more We're spending all of this money.  Well, um, I've spent some time trying to analyze that You know being on the board of several companies. This becomes quite important as gosh if we're going to spend all this money We would hope we would get some return And and what I've discovered through that analysis and and looking at the reports is In fact the most prominent threats are unsophisticated attacks And it turns out they're relatively easy defeated We have now demonstrated through, um, you know, the research and applying Different names but a set of a minimal baseline set of controls That you can be effective in protecting against most of those attacks One set was developed in the united states that's called the critical security controls sans institute nsa a number of other organizations did it The australians have done have come up with their similar top 35 Interestingly enough their research shows that only four of those four four controls Are effective against 85 percent of the threat So the conclusion is what we know how to deal with we know what we need to do We just don't do a very good job of then implementing these threats now I'll tell you a little secret As cio what I learned is It doesn't cost a lot of money to implement these baseline controls. Why? Because most of them are essential to operating and managing the network It's just doing them in a disciplined manner And in fact most organizations are already spending the money in fact many are spending more than they need to because It's not that they don't have the controls is to have multiple sets of overlapping controls Inconsistently applied and so they leave gaps, etc So step one is implement this Baseline of critical security controls now that does not address the sophisticated Threats and I acknowledge that But if you don't do that you're wasting your money Trying to address sophisticated threats. You're kidding yourself So all of the discussions about the sort of the why I recall my kids used to play soccer You know everybody'd huddle around the ball And that's what I see often organizations saying we're going to go after these sophisticated threats. They're shiny We're either exciting But unless you have done that foundation work, you're wasting your energy Now what I have found is organizations that beyond the critical controls what they're doing and what's most economical is not To continue to layer control upon control upon control And I think that's the big flaw in what nist has been Providing in their risk management framework. It's well done But it really just continues to drive cost upon cost upon cost what we're seeing and we heard this well today is that the Very sophisticated advanced persistent threats in the nation state attacks They're agile. They're intelligent. They're dynamic and In order to respond to that you have to be likewise And I think there's been great discussion about that so I won't repeat But you have to implement that time that same type of capability. It cannot be done strictly with tools It has there has to be a human element The sharing of actionable intelligence is critically important the ability to look at patterns of attacks And eventually those that are most sophisticated are actually able to predict What's going to happen? What's the next step of the attack? Why because they're they see the patterns They're they're studying it and so I think all of those Then are the next step and sharing becomes absolutely critical because organizations in general can't afford to do that on their own so Anyway, let me stop there, but I think I think we sort of know some steps It's not to say that other comments. I mean obviously diplomatic and other other avenues. We ought to pursue as well But but I think from a technical perspective There is a better roadmap than perhaps we've been able to implement so I'll stop there And I think john points out An important topic that he's working on with apsia which is focusing on The theme of cyber economics, and I think that's one of the Key elements of cyber where we are today Which is I think if we can Get our resources Proportional to the threat so that we can Take care of the ankle biting problems with the least amount of resources but do it smartly But then focus The other part of our resources on the stuff that will kill you That's what we got to focus on And unfortunately we're spending I think we're finding a disproportionate of our resources on the ankle biting problems Because we're not doing the basic stuff And as a result, we don't have enough resources to focus on that 15 percent That will be the stuff that will give you the the heavy injuries or the fatalities Like like in a case of an automobile analogy So I think that's the situation we're in today Relative to moving from static to dynamic defenses that we talked about This morning so so how do we get at this situation in cyber economics of moving In this new paradigm of security that where we are facing ourselves Right now, and so we've asked her of let's go To talk about an area that he's focused a lot of his attention on He's a csis senior fellow which is called active defense and we've talked a little bit about that So I'd like to you know with that setup or if I'd like you to talk a little bit building upon what john mentioned Okay, thanks bob Right, so I'm going to talk about this thing called active cyber defense and of course the minute I say that We're I guarantee that we're all in this room on a completely different page in terms of what that means because there is no a widely accepted definition So the defense strategy for operations in cyberspace defines it as basically real-time technical protection of the dot mill network But in in the popular parlance and the articles that are showing up in the media. It's often interpreted as meaning hacking back and so There's a lack of understanding of what the term means and often what happens in discussions about active cyber defense is People end up in one of two extreme areas Either looking at this sort of hacking back area, which gets legally very dicey very quickly as any lawyer will tell you Or just saying well, we're just going to look at activities that we can do within our network, which are perfectly legal And have been going on in some cases for decades. So honey nets and gathering threat intelligence in a variety of ways And that's that's perfectly safe legally But there's an interesting gray area that's that's developing and people are starting to pay a lot more attention to this For a couple of reasons The first is that The government simply cannot respond to the magnitude of the threat facing the private sector If you read all these reports, you just see it's a huge problem And a lot of companies and organizations are on their own Now hopefully with some of the some of the initiatives that the government has announced with with information sharing Things might help but unless it's a major breach The fbi just doesn't have the resources to to come and help you in a lot of cases The other thing is the private sector is growing incredibly sophisticated in many ways In terms of its ability to Analyze the threat and potentially even respond to the threat So there's an increase in motivation and capability on the private sector side And so then there's this interesting question that's starting to come up Which is how far can the private sector go to protect its intellectual property and its assets that may be leaving the organization So a lot of folks are starting to look at this and again in particular. There's this interesting sort of gray zone Um where one can start to look at things like Beacons in information that leave your network So can you you can you put a passive watermark on your document? For example and have it leave your network and then you can search for it to see if anyone's stolen Stolen the information. That's one thing with what if you put an active beacon? So it's actually you know signalling home from wherever to so you can track it. Is is that legal? Well, it starts to get more tricky What about information that might leave your network and Self-destruct or something like that that gets really tricky And then there's all kinds of questions one can get into in terms of if someone is accessing Your network and they're connected to your network Do you have any rights at all to Leverage that connection to gather intelligence that you might be able to use Again, you know it gets into really tricky legal questions. So Um There's there's not a lot of clarity right now and in fact what's interesting is There's a lot of debate on the computer fraud and abuse act right now on the hill because some people believe the act is Either too strong or being applied too strongly So the erin schwarz case is one example of that but there's some others where people feel that the It's it's a bit too strong and and that the language is a bit too loose And there's other people who feel that it actually needs to be strengthened So that you can deter this activity more effectively So there's debates there Harvey Rishikoff is here and he's leading a task force At the american bar association that's looking at this issue. There's a lot of interest in this in this issue and one of the things That comes up is this question of First of all roles and responsibilities. So What can the private sector do on its own? What can the government do? How can they work together? And so there's a number of questions that come up there and I hope this tees up Jenny a little bit with things like the ecs program that dhs has developed where there is a partnership between the government and the private sector To share information and provide some protections And one could think about whether that kind of activity should should continue That's also a question of should there be clear lines in the sand in other words Should the laws be very clear about what companies can do to protect themselves? Or is it better to have some legal ambiguity And let either case law sort of work itself out through the system or provide some ambiguity for the attackers So they're not exactly sure what the lines are and they're not sure what steps companies can take to protect themselves So there's debate there So, uh, I'll just uh, stop right there and then uh, happy to discuss it further if there's any questions Thanks, sir Director of us a long title stakeholder engagement and cyber infrastructure resilience Leader, I guess it's here is your title But as herb said, uh, she's got the hard job of we talked a little bit about information sharing and collaboration and jenny has the job of Promoting that at dhs. So if we could ready could you give us some updates and perspectives? Sure. Thanks, bob And um, is this catching my voice on the microphone? Yes Yes, okay. Good. Um, so one of the the things that government can do recognizing that there's a huge scale of critical infrastructure partners that we need to work with And a relatively limited size of government resources. Um, one thing we can do is share information That we have we do have some unique sources of information whether it's from our partners in the intelligence community Whether it's what dhs sees from across the the dot gov What it's our friends at do dc protect at do dc on their networks law enforcement, etc So we have a broad set of information that we can share and and shawn henry is right right that term does get over Overused a lot. It's a big blanket Term so when we work with critical infrastructure sharing information, we need to recognize who we're sharing with what so that they can take action Sometimes that's actionable indicators. It's md5 hash values. Sometimes it's sitting down with ceos or cio So we found to be a very productive group to work with to make sure that they understand the threat What really is the threat landscape? What are those most important things where they want to allocate their scarce resources? Um, what decisions are they making in configuring their networks that may introduce significant risk? Um, and what about some of the new technologies out there? You know, I've had a number of cios come to us and say, you know, should we be implementing application whitelisting? Is it worth the effort questions like that where there are a lot of vendors out there that are proposing different solutions? And they are looking for kind of some objective lessons learned that they can find out from government So how do we work with people that are making strategic investment decisions ceos cios, etc And then how do we work with folks within the critical infrastructure companies that are doing that real hands-on protection? Those are those actionable indicators And actually right now today we're having a quarterly meeting of our advanced threat technical exchange, which is part of our When we have awful names for things I think secret service always has great really cool names for their programs And we always have awful acronyms that don't even spell anything Our cyber security information sharing and collaboration program I know it's awful an awful acronym. I'll take suggestions But that's where we share a sensitive but unclassified information with critical infrastructure companies So that they can protect their own and their customers networks and they provide information back to us about what they're seeing on their networks We do that through a legal agreement called a cooperative research and development agreement that really Lays out how they can use our information and how we can use their information so that everybody is on the same page And it's a program that grew out of lessons learned from the dib csa program A pilot that we did jointly with dod in the financial services sector And now is something where we've learned a lot of lessons and is available to all of the critical infrastructure sectors So far we have 14 sectors not in totality But members of 14 different sectors that participate Both through information sharing and analysis centers or individual companies where companies choose to do that or where there is no Information sharing and analysis center And so what we do through that program is we share those machine readable indicators And we are working toward increased machine readability You know started at very basic csv But we're now working in in a format referred to as sticks and taxi Which some of our partners are actually piloting true machine to machine communications with no human in the loop What we're putting out in those formats is still pulled down off of a secure website But we share information with them they share information with us on a regular basis We've shared almost 20,000 indicators through the program When we started about 18 months ago about 80 of the indicators were coming from government and 20 percent We're coming from the industry partners now it's 60 40 Which I think it really shows that the industry partners are starting to see value and putting more in And we're really seeing unique things about what our threat actors are doing In different sectors that we would not see in government So there may be one threat actor that deals very differently when they're working against a A manufacturing company than they would if they're trying to get into the department of defense So very different TTPs from those groups So we have the the flow of the actionable indicators We have mitigation strategies that go out But then we've also found great value in these analyst to analyst exchanges like we're having today where people come in And talk to their peers and say this is what happened to us and this is how I dealt with it And then people can ask questions and there have been many many examples of where somebody has heard a company from another sector brief And they've been ready for what happens to them in the future Or they've been able to go back and immediately apply something that's already happening to them It's interesting because some people come into the room and will go and throw out their name company and sector And then other people will just say, you know, my name is bob and that's all that they're willing to share We do allow that anonymity for those who want it And we have government partners and industry partners that participate there. So I think that's an important part Of the information exchanges. It's not just all about the ones and zeros going back and forth But it's getting the smart people from industry and government having those technical discussions about what's working and what isn't With the actors So that's our sys b program As are mentioned our enhanced cyber security service is a new effort that dhs has launched It's something that started with the defense industrial base dib opt-in activity And back in the spring dhs took over the relationship with the commercial service providers Who provide those dib opt-in services now with the executive order that came out dhs is able to work with those providers so that the services can be provided to all 16 critical infrastructure sectors So for those of you who are not intimately familiar with what I mean when I say dib opt-in or enhance cyber security services Basically, you know, we talk about tear-lining information and what we share through sys b is unclassified We use a traffic light protocol that governs whether it's proprietary data or whether it's information that came from the government Not everything can be tear-lined. So when we do enhanced cyber security services This is where we provide those classified indicators up to the most sensitive levels of classification To information and communication technology providers So that they can protect their customers networks if their customers choose to buy those services Right now it is Email filtering and dns sync holding those are the two counter measures that are available In addition to increasing the sectors who can buy the services and the pilot that do d did was only isps participating We've expanded the kinds of ict providers who can participate manage security services providers AV companies companies like that have expressed an interest in coming in through the program So it is very new in offering these services to other sectors There are Anytime you do something that's new and different You don't realize all of the little details that you need to sort out until you do it So how do you validate who can buy the services? How do you figure out a process for adding new counter measures? What are all those details that have to be sorted out? How do you get a memorandum of agreement signed and then get the systems accredited at the sci level? But this gives us an opportunity to take that information that can't be quickly Tearline down to an unclassified level get it to those ict providers that a large percentage of our critical infrastructure Community uses and if those critical infrastructure companies are interested allowing them to buy the services Where they receive that protection with the classified information? So it's a very quick overview. Happy to answer more questions and go in different directions Great. Thanks. Good Okay, so we've got about 10 minutes before we have to move on to the the next session and so what i'd like to do is Is either open this up for some questions from the from the group here since we have limited time I've got one right here from this gentleman Yes, uh, Mike. Yeah My name is alex lawson. I'm from inside us china trade Miss menna. Uh, mr. Baker raised the specter of some different sort of enforcement Tactics that the government can take he mentioned the visa issue. He hinted at some financial sanctions This kind of sent seems to center around business strategies for preventing attacks, which is valuable But I was sort of hoping to maybe get some information from you on Tax that the government thinks are worthwhile for enforcement the visa thing the sanctions or are there some other Options that the government can consider there's been a lot of sort of public naming and shaming going on more They were meant, you know china was mentioned in the dod report But I don't know if there's anything with a little more teeth that the government can consider as a next step I can only speak on behalf of dhs and so dhs's role in cyber In our office of cyber security communications is very much focused on Prevent protect building resilience and then responding When there is an incident so I can't speak on behalf of my interagency partners But obviously this is an issue that is discussed as a whole of government discussion Each with our respective roles I think I only understand Another question from the uh from the group Yes, sir Stand up and give us your name, please Here's your mic here so we can hear. Thank you My name is alexander soley. I'm a delta risk and I was considering the idea something That david da wa mentioned earlier about how most of our cyber security is based off of Sorry, most of the antivirus is based off of blacklisting and such and I was wondering if anyone has been considering more sort of alternative to that or any sort of Legality issues involved with creating some sort of autonomous Way of finding critical vulnerabilities and such Is what baby They want to try that or I can I you know, I give you a lawyer's view of Cyber security, which is not necessarily something you should take to the bank or at least I wouldn't code it directly, but Yeah, I think one of our biggest strategic problems I'll tell you a story from the border When I went down to the border when I just started at dhs and I was dealing with the border patrol Routinely they'd say well, we sent out two border agents and they brought back 30 people who were trying to cross the border And I finally said how do how do two agents bring back? 30 people and he said oh well we surround them. I But the real answer was They surrendered because the worst thing that would happen is they would be taken back across the border and let go to try again Um, this is where we are with keeping people out of our networks I After we've spent a boatload of money Stopping up all the rat holes. They spearfishes again and 90 percent of the time somebody's going to open the the email and The reason is it's getting past all of our signature based Solutions and we do need automated mechanisms for dealing with that It seems you know Fire I know has sponsored this but the fact is they've got an interesting Approach to this which is to say let's put this in a virtual machine and just watch what it does And if it doesn't do what pds usually do then we're not delivering it Uh, and you don't actually have to know In advance that this is bad. You don't even have to know what bad things It's trying to do if it's doing something that adobe didn't tell you what was supposed to do You just don't deliver it. It seems to me that that has some real potential to make it much harder for people to get back in And to go back to the border, you know now when they stop people crossing the border There's a distinct chance that there will be a struggle Even gunplay and that is a reflection oddly of how much better border security is because They don't expect to be able to get in if they can't you know break past this if they're coming from Latin america, they're gonna have a long flight. They're not just gonna be let go across the border And I think we will know we're doing a better job when it is harder to get people out of the network than it is today Thanks, jim Any other questions from we got a little bit more time. Yeah Hi, i'm uh dj bailo from robert moore's university talk a little bit louder, please Or get closer the mic. Hi, i'm uh dj bailo and i'm from robert moore's university I know uh hacking back is a big gray area, but how do how is that area How's the us area and viewpoint on that like compared to other countries and how does that affect our defense modeling? Well, let me let me take a quick shot at that that's that's an interesting and complex question First of all, uh, you know, I like to say, you know for every cyber warrior There's a cyber lawyer looking over their shoulder and the at&t is is no different than that And the government, you know my government experience was the same way The problem today is for example the computer fraud and abuse act basically says what you cannot do in Cyber secure in uh, you know in attacking somebody else's system. It says if you do this It's illegal. You can get arrested for doing that. It doesn't define What you can do going back in the other direction. It doesn't define any particular Framework for what you can do in response to a penetration So there's a lot of discussion going on right now including on the hill as we're looking at the cyber legislation Uh, the syspa act, uh, of course has been passed by the house That's gonna, you know, that's the same topic as being taken up in the senate and one of the discussions that's taking place is What counter measures are or defensive measures or active defense measures or whatever you want to call it Are allowable under the law I think irv might have mentioned this that okay if I set up a honeypot and I put dummy data in there That's relatively, you know, accepted today from a legal perspective. There are some liability issues, okay But it's relatively benign. Okay, suppose I set up a honeypot and in that in that dummy file I place malware that's going to destroy the file structure of the machine that it gets downloaded to okay That's probably not legal under today's uh laws And probably never should be uh, and one of the biggest issues there which we wrestle with every day And it's you know part of this whitelist blacklist question is Most of the hosts that are compromised and these are websites and hosting cloud hosting services that are compromised Are compromised not by the owners of the site but by somebody who's a bot master going or controller or coder Whatever you want to call it going around looking for machines to compromise that I can then use to distribute malware So they may be innocent typically the the first thing you see where you think this attack is coming from is an innocent bystander So from a legal perspective, what do you want to do to an innocent bystander? We're having discussions right now with dhs and with fbi about okay, we we see these sites We see a bad site. We can tell right away. It's it's downloading malware to our customers And number one. Can I share that legally with you? Um, you know the identifier information, which is typically ip addresses and urls and and max and things like that that We can see out of the network traffic, but then what can you do with that? Can you go in and knock on the door and of the of the hosting service and say hey guys You got a problem and let's work together to get that fixed That's still a very gray area in in the law right now and people of course and particularly with syspa As soon as the idea of sharing and liability coming along with that Gets the privacy people very upset because their interpretation of the of syspa is You can break the law and get away with it because you got immunity in the process You can do anything you want whatever whatever you violate anybody's privacy And you've been immune immunized by this legislation. You can get a what you get out of jail free So that's kind of where we are in wrestling with that whole topic is and we're hoping that out of this Senate and house legislative process We're going to get some clearer guidance from a legal perspective about what can be shared What purposes for which that can be shared and then you know How do you protect privacy in within that context is sharing an ip address a violation of somebody's privacy? Not clear today what if that is or not so so I I've blogged about this and uh one of the things that I pointed out in a recent blog post is that Uh luxembourg has turned out to have more cajones than the entire united states cyber security establishment They got a guy there who just said he read the mandate report He said well, why do you kind of go from the command and control server back to the unit? Why don't I just go looking for all the poison ivy all the guys running poison ivy and break into their network And he did that uh found all kinds of of interesting stuff The response from the u.s. Government has been to say well, you know, that's could be could be illegal You know, that's a bad idea. Uh, well what they're really saying is we don't know how to protect you But we do know how to prevent you from protecting yourself. Uh, it's absolutely nuts. This is an old Computer crime section view of the world kind of leave it to the professionals You know when you say leave it to the professionals when you're dealing with crime You got to actually be able to do something if you're a professional our professionals are completely unable to protect us In the end people will find ways to protect themselves Currently the the law is written so vaguely that almost everything is illegal many things that we do today As a matter of routine or arguably illegal under the computer crime and abuse act And um until we find a way to embarrass The justice department into starting to say yeah, we didn't mean that you couldn't protect yourself in some way Uh, we are going to have a uniquely Disabled cyber security infrastructure in this country Oh, so just one minute uh on this so so there's a really really interesting legal uh issue Which which has been discussed here, which is absolutely fascinating. There's also a policy question So, you know, let's assume the law gets clarified and there's clarity on what companies can do and and uh not do But then there's a There's going to be an equities Uh discussion here. So for example, let's say that that companies are given more leeway to take certain action That might undermine, uh, us diplomatic efforts to establish certain norms In cyberspace, um, or it might not but or it might be worth Having that or it might not so so there's there's going to be a really interesting policy discussion in terms of What the u.s. Is trying to accomplish internationally in terms of norms of behavior even discussions on the internet governance fora Uh, which you know, jim can tell you all about what's going on there But it might have an impact on that as well So, uh, it's a very interesting issue from policy perspective as well as a legal one So we're at a time, um, I get the hook from jim back here, but I would like to I would like to, um Summarize, you know one thing from my perspective having been in this business a long time Which is that, um We've heard some great discussion today some very difficult legal issues and policy issues that we have to To address but from the standpoint of where we are today versus where we were just looking back five to 10 years ago Um, I think we've accomplished a lot of things now have we accomplished it at the pace we should absolutely not Is the threat having you know a field day? Absolutely But I can remember and and uh back having to go to the hill Uh with shawn and a lot of the other uh folks that were part of the cyber group The hill didn't even understand any of this stuff five to 10 years ago all this discussion we're having right now They didn't have the foggiest notion About this topic and we'd have to bring props into the hill To get them to understand just the basics of what this topic of cyber security was all about At the same time 10 years ago, nsa Thought they could build pretty much anything That was needed in the most critical areas In this space it was all about you know government built or government enhanced Solutions nsa doesn't believe that anymore. They realize the private sector in large measure Has the capability to build the right solutions in this space You look at what ashar was talking about earlier with fire. I fire. I was built By an idea that was germinated By darpa. We need a problem solved in zero days Fire. I was born uh incutel invested in it the cias You know arm for investment and innovation And it was born and that's happening all over the place with silicon valley and things like that So the good news is you know, we have lots of solutions coming into play lots of solutions even in the active defense area You know, so there's a lot of room for optimism But there's no doubt That I think we've heard you know today that there's a tremendous amount of frustration We've got to speed up get the get the car shifted from first gear And get it shifted up to third or fourth gear and what's the best way to go about doing that? We did not get into the issue of you know, how much regulation how much strong policies that we have to put in place to deal with this But the reality is I think every one of us should be a little bit more optimistic But clearly we still have a long way to go in this space. So hopefully The the discussions this morning have been enlightening. It brought up some interesting issues. I know today And I know some of us are going to be around For the next session for further dialogue with each one of you jim. Did you have some closing comments? Okay, and thank you csis for helping to host this


Welcome back, we are looking at solutions of linear congruence equations, modulo sum natural number n. We saw that if you take this linear congruence which is say A x congruent to B mod n, then the solution exists exactly when you have that this GCD of A and n divides B. So, this holds that the condition really is on A and n. The condition on B is a very mild condition that you should have that this GCD D divides B that is a very mild condition which is there on B. So, for instance if D is 1 or equivalently A and A is co-prime to n then the above congruence solutions for B. So, the only important thing here is to note that A is the only important thing. You should look at the GCD of A and n and the mild condition on B is that D should divide B. So, I told you in the last lecture that when you are looking at solutions to linear congruences then there are two problems which is that there may not be a solution, but now we have gone modulo this problem so to say by putting a condition on the GCD of A and n. So, now we know when there may when exactly when there can be solution, but sometimes there are not unique solutions as we have seen in the clock arithmetic already. So, when there are not unique solutions can we get the exact number of all solutions that is the question. If there are no unique solutions how many different solutions can there be? That is the question that we want to answer and this question is related very nicely with the quotient of n and D. So, this is what we have in the next slide. If you have a solution x naught to the above linear congruence. So, remember the above linear congruence was our x congruent to be modulo n. If you have a solution then all solutions are of the form x naught which is one solution that you had plus n upon D into t where t varies over all integers. So, the statement is quite simple if you have one solution all other solutions are obtained by adding multiples of n by D to that solution and you get all other solutions. So, to show to prove this lemma what we will have to do is to show that whenever you have x naught to be a solution then x naught plus n by D into t is also a solution for every t. This would be one statement one direction of proving this lemma. Second direction would be to show that any other solution is also of this form. These are the two directions that we will have to prove. So, this is a very important corollary that whenever you are looking at it modulo n then you will have exactly D solutions modulo n. So, these will be given by x naught plus n by D and before that you will have x naught x naught plus 2 n by D. So, on all the way up to x naught plus n minus 1 into n by D these are n different solutions. These are all different first of all note that this n by D is a natural number because you have D to be the GCD of a and n. So, in particular D should divide n therefore, n by D is a natural number and so, but it is a smaller number than n and when you add that number to x naught you do not get same elements modulo n. In fact, you do not get the same elements modulo n until you add n times this number. So, these are precisely the D solutions I should have said instead of D minus 1 I should put instead of n minus 1 I should put D minus 1 because when you take the next one it would be x naught plus D n by D which would be x naught plus n and then you would get the same number. So, let us go about proving this. So, first of all we assume that the x naught is a solution x naught is congruent to b mod n. So, x naught is assumed to be a solution to this linear congruence and take x 1 to be x naught plus n by D into t for some t in integers you can take it to be any t. Now it is very simple what we just want to prove is that a x 1 is congruent to b mod n this is the only thing to prove. So, we need to prove that a x 1 is congruent to b mod n this is all. So, let us go about proving it. So, a x 1 is a x naught plus n by D into t which gives you a x naught plus a n by D into t, but note that D being the GCD of a and n D divides a as well and therefore this is congruent to a x naught mod n because now we have that all these elements are integers. So, we have written a x 1 to be equal to a x naught plus n times an integer and therefore we get that a x naught is congruent to a x 1 mod n and thus we get it to be congruent to b mod n. So, one side was quite easy we assumed that x naught is a solution and then we proved that any x 1 which is given by x naught plus n by D t is also a solution. Now we have to prove the other direction which is that we will start by assuming that there are two solutions and we will prove that the other solution is equal to the first solution plus an integer multiple of n by D this is what we need to prove. Two solutions x naught x 1 to a x congruent to b mod n are related by x 1 equal to x naught plus n by D t for some integer t this is what we want to prove. So, let us begin. So, we have that a x naught is congruent to a x 1 modulo n because both are congruent to b mod n. So, we get that a x naught is congruent to a x 1 mod n and which further implies that n divides a x naught minus a x 1 which we can write as a into x naught minus x 1. Now, we have that D the GCD divides both n and a. So, we can cancel out GCD from this equation or alternately we have that a into x naught minus x 1 is say n into t because n divides this difference a into x naught minus x 1 we have that a x naught minus x 1 is n into t which further gives us. So, we have that a x naught minus x 1 is n into t and this gives us that D into a by D x naught minus x 1 is D into n by D t. So, these D's can be cancelled to get that n by D divides a by D into x naught minus x 1. So, here we have two integers one is this a by D and the other is n by D and we have that n by D divides a by D into x naught minus x 1. The GCD that was there for both a and n has now been cancelled on both sides. Therefore, the GCD of a by D and n by D is equal to 1. There is no common prime factor between n by D and a by D. So, all the prime factors of n by D would go and divide the difference x naught minus x 1 with all the powers that it would divide n by D it would divide the difference x naught minus x 1. So, what we therefore get is so since this GCD is 1 we get n by D divides x naught minus x 1 or x 1 is x naught plus n by D into some s. So, what we have proved here is that any two solutions to the congruence A x congruent to B mod n differ by a multiple of n by D. And therefore, when we saw the example in earlier about clock arithmetic where we had 2 x congruent to 8 modulo 12 the GCD of 2 and 12 was 2 and so we got exactly 2 solutions there 4 into 2 is 8 similarly 10 into 2 is also 8 and n by D remember n is 12 D is 2. So, n by D is 6 and indeed 4 and 10 differ by 6 that was the only difference between 4 and 10. So, any two solutions differ by a multiple of n by D and if you have got one solution any other solution is obtained by adding a multiple of n by D. So, this way we get a complete description to the solutions to the linear congruence A x congruent to B mod n with this let us go and do some simple examples to get hang of this correctly. So, suppose we are asked to solve the linear congruence 7 x congruent to 3 modulo 12. So, first of all what we do is to find the GCD in this case this GCD is 1. So, we always have solutions. So, there are solutions congruence it is unique modulo 12. So, to find the solution we invert 7 it is like 7 x is 3 in some space of numbers and to compute x we need to multiply by the inverse of 7 this is what we want to do. So, what is the inverse of 7 modulo 12. So, we go about multiplying by all numbers modulo 12 to 7 and see when we get 1. So, 7 into 1 is 7 7 into 2 is 14 that gives us 2 modulo 12 7 into 3 is 21 7 into 4 is 28 7 into 5 is 35 35 is minus 1 modulo 12 and therefore, so we have 7 into 5 equal to minus 1 modulo 12. So, if I multiply both sides by minus 1 I will get 7 into minus 5 equal to 1 modulo 12. So, minus 5 is the multiplicative inverse of 7 modulo 12 what is minus 5 in 12 minus 5 is same as 12 minus 5 which is again 7. So, 7 chi inverse is 7 therefore, to find the solution for 7 x congruent to 3 we simply multiply both sides by 7 7 x congruent to 3 mod 12 7 into 7 x is congruent to 7 into 3 this side is 21 or 9 modulo 12 and this side we simply get 49 which is simply x. So, thus x congruent to 9 mod 12 is the unique solution the above congruence. You can simply check this by putting the value x equal to 9 in the equation. So, you have 9 into 7 which gives you 63 and 63 is indeed 63 plus 3 60 0 modulo 12. So, you get 3 modulo 12. So, this is how one would solve linear congruences. Let us also see one more problem where we have multiple solutions when we do not have a unique solution. So, the question now is to find all solutions to 10 x congruent to 6 modulo 14. We are doing some other number than the 12 which has been our favorite number so far. So, first of all we check whether there is a solution at all. We first check there is a solution and we know how to do this D which is the GCD of 10 and 14. Now, it should be a simple matter to compute GCDs. This GCD is 2 and 2 divides 6. So, we do have a solution at least one solution. So, since D is not 1 we do not have a unique solution but D is 2. So, we are going to get 2 distinct solutions. So, we are going to get 2 solutions modulo 14. Now, there should be a nice algorithm to solve such equations such congruence relations. We will see whether there is such an algorithm but let us just try our hand and solve this problem. So, what we want to do first of all is to solve for 10 x congruent to 6 modulo 14 and we observe it is enough to solve 5 x congruent to 3 mod 7. Why is this enough to solve? This is because if you had an x naught such that so if 7 divided 5 x naught minus 3 then 14 we divide 10 x naught minus 6. We are just multiplying by 2 to both the sides. So, that would tell us that whenever you have the GCD you can simply cancel out by the GCD throughout the equation including the natural number by which you are going modulo including the n such that you are working in Zn you can cancel D throughout the linear congruence. So, we want to now solve this here the GCD of 5 and 7 is 1. So, indeed we should have a solution that was no surprise because we already know that there is a solution but what we do is so we need to find a number alpha in Z7 such that 5 into alpha is 1. This is what we need to do we need to be able to invert 5 and this is possible because we have that the GCD is 1. So, 5 into 1 is 5, 5 into 2 is 10 which is not 1 modulo 7, 5 into 3 is 15 which is 1 mod 7. So, alpha is 3. So, we need to multiply by 3 to both the sides. So, we are solving 5x congruent to 3 mod 7 and 5x into 3 is congruent to 3 into 3 mod 7, 3 into 3 is 9 which is 2 modulo 7, 5 into 3 is 15, 15x is x modulo 7. So, we get that x is 2 mod 7. So, x not equal to 2 is indeed a solution the congruence given in the question because if you put 2 in 10x you get 10 into 2 which is 20 and 20 is indeed congruent to 6 modulo 14. So, 2 is a solution what can be the other solution. So, remember n is 14, d is 2. So, n by d is 7 and therefore 2 plus 7 which is 9 that is one more solution because 10 into 9 is 90 and 90 is 84 plus 6, 84 is a multiple of 14 and therefore 90 is also 6 modulo 14. So, thus 2 plus 7 which is 9 are all these solutions were congruence. So, we have solved the problem we found all possible solutions there are only 2 because the GCD is equal to 2 and whenever the GCD is 1 we convert from the GCD 2 case to the GCD 1 case and then we try to invert the coefficient of x this is what we do and I told you that it would be nice to have an algorithm to solve these linear congruences. So, indeed there is an algorithm which we have been following up to now the algorithm is as follows what we do first of all is to check whether the GCD d of a and n divides b this is the most important case. So, if this does not happen if the GCD does not divide b there are no solutions and then we are done we will just say that there is no solution. However, if the GCD does divide n then what we do as we have done in the previous case we solve for this a by d x congruent to b by d modulo n by d and so we need to prove a small lemma that whenever there is a solution for this there is a solution for the a x congruent to b and whenever there is a solution for that we get a solution for this we will need to prove equivalence of existence of solutions for these both congruences and the final thing which we wanted to do was to try and invert the coefficient of x which is a by d. Now what happens is that a by d is co-prime to n by d and therefore we know that a by d into x congruent to 1 modulo n by d should have a solution because the GCD is 1 which divides 1 which means that we should be able to invert a by d but to invert a by d is in some sense equivalent to getting solutions indeed inverse of a by d modulo n by d is nothing but the solution to a by d into x congruent to 1 mod n by d. So, there should be a better way to do it and what we then want to do is to reduce the magnitude of this a by d we will try to make it smaller and smaller by using some other tricks and then ultimately we will solve the congruence relation. So, we will see some more of these methods in the next lecture and then we will go to what is called the simultaneous congruence which is about the Chinese remainder theorem. See you until then. Thank you.


So, Mariella, what is your tip for people that want to become a better service designer? Become a better storyteller. And you probably thought I'd say that, but here's how I think people should look at it is, first of all, what is your story about why you're a service designer? And if you think about that old adage, in order to do your how really well, you need to know what your why is. So why do you love doing this? What is your story about why you became a service designer and why you love doing it and maybe an example of where you really felt like you were at your best? Because if you can tell that kind of story well, it tells people a lot about you. It tells them about why you're good at what you do, why you love what you do and therefore you're going to love working for them, and why they should pick you. It's an important way to start. And then it's about what are the parts of your story field are interesting? What's a job where you can say, here's an example of where I really was at my best. That's what I never want to do again. Here's how a team worked really well together in order to demonstrate to your client how collaboration really works. So what are the stories that you need to put together to be a good storyteller around who you are?


Hello everyone! Today we're unboxing an audio setup from the XPG Data Series. What we have here is a pair of headphones, an amplifier and a stand for both devices.  When we remove this we can see the amplifier really lightweight and then there is the small microphone which is screwed into the headphones. Next we remove some foam and we can take the stand out. It is really robust premium quality and you can also fit the amplifier on it as you can see now and once we get this out of the way it's time to have a look at some product instructions that are found in the small black box in the bottom and once we get this out of the way there is also a small pouch which carries cables for the interface and for the headphones. They will be necessary of course and once we get this out of the way we can see the headphones in all of their glory with these red and black elements really aggressive. Okay and that's been all for today, thanks for watching, be sure to subscribe, give us a like and comment.


Today, we are opening one of Yu-Gi-Oh's rarest first edition boxes, Light of Destruction. What's up, guys? We're back with another epic video, and this is not just any epic video. This is day 365 or one year straight of YouTube daily uploads. We have had some sort of content on this channel for an entire year, so we are going to be celebrating, as you guys saw with a first edition Light of Destruction booster box. It is open to box, so that saved us quite a bit of money. Hopefully, we will still pull some amazing pulls in here. This is one of the rarest boxes you can find. I've never opened this one. This is the second to last first edition box that I needed to open from GX and the original series. The last one we need is Invasion of Chaos first edition. But before we dive into that, we have a huge giveaway for one year. I'll be giving away this dualist pack special edition, and that's not all, so this is pretty cool. There's also 10 Ghost from the Past first edition packs. If you want to get ready for Ghost from the Past two, try and win this giveaway. And finally, we have a dark magician that was pulled from Battles of Chaos. We gave away one on Twitter. Now we're giving away another one on YouTube. All you have to do to enter that giveaway is like this video, be subscribed, let me know your favorite moment from the past year on my channel. This video is sponsored by Magic Spoo. Do you remember those mornings as a kid where you could just sit back, relax, grab a bowl of cereal, and watch some Yu-Gi-Oh? Those were good times, but things changed. I realized that cereal is sugary and unhealthy. I moved on from Yu-Gi-Oh. Years later, I wanted to recapture that childhood nostalgia by making a Yu-Gi-Oh YouTube channel. Guess what else I decided to bring back? Cereal. This time, I decided to go with a delicious, yet healthy brand, Magic Spoon. Magic Spoon has zero grams of sugar, 13 to 14 grams of protein, and only four net grams of carbs in each serving. Only 140 calories per serving. They're also keto-friendly, gluten-free, grain-free, soy-free, and low carb. Magic Spoon allows me to revisit that childhood nostalgia every time I eat my favorite flavor of their cereal, peanut butter. That's good. Click the link below to grab a variety pack and try it today. Be sure to use promo code RUXEN5 at checkout to get $5 off any order. Or go to magicspoon.com slash ruxen5. And Magic Spoon is so confident in their product, it's back with a 100% money-back guarantee. So if you don't like it for any reason, they'll refund your money, no questions asked. So click the link below and use code RUXEN5 for $5 off any order, or use magicspoon.com slash ruxen5. Thanks again to Magic Spoon for sponsoring my one-year celebration video. All right, let's get into the opening, guys. We have 24 first-edition packs. Inside, we would like to pull Honest Ghost Rare. That would be one of the coolest things. Judgment Dragon, there's a lot of lightsworn cards, a lot of crazy potential in this box. So let's see what we can pull. This is a very expensive box, even if it's not sealed. But if it's sealed, the lowest on eBay was like 25K. I think that's probably a little high, but it is a very, very rare set. So we're not gonna get to open it very often. Let's see what we can pull. We have a Cloudian Storm Dragon. Hero Mask. Arcana Force, the Emperor. We're not, yeah, it's four, I guess. Limber Reverse, very cool. Destruction Jammer. We're starting it off with a rare. Battery Man, Charger, Short Circuit, Volcanic Queen, and Summon Limit. This is a very good, regular, common card. Let's say rare, it's not a rare. Summon Limit is definitely gonna be worth a few dollars because it's still good in today's meta. And this came out in like 2007, eight? I think eight maybe? Seven or eight. I'll have the release date pop up, but this is a very old set at this point. This is one of the hardest sets to find because it was such a popular set at the time in the meta that it just, yeah, they sold a lot of the boxes. And then you just can't really find them anymore. Battery Man, Micro Set, we got Wetlands. Summon Limit again. This is a good start getting a double Summon Limit. We've got Tour of Doom, very cool. Demise of the Land is another good common. This got a reprint, but before it was like a $9 common, which is insane. Arcana Force for the Emperor. We've got a Quick Charger. Anna S'more, Bird of Ancestry. I think this is actually worth something too. All those smart cards are always worth something for some reason. Next up, in this set, you can get Secret Rares, Ultimate Rares, Ghost Rares, Ultra Rares, Super Rares. You can get almost every rarity in here, so it's a pretty fun set. Hopefully we can get at least an Ulti and a Secret in here. I mean, Ghost Rares is probably not to be expected, one out of 12 boxes, but if we get that box, we will see. We have a Cross Porter. Sanguine Swamp. Short Circuit. Defortion. Cloudian Storm Dragon. Hero Mask. Arcana Force IV. We pull that like every time. Limmer Reverse, okay. Anna Substitute. Here's another one. I think this guy's like $9 or something as a Rare, so we're pulling a lot of good Rares in commas, but we need to pull some Fools. I would personally love to see Honest, even if it only comes in the Secret Rare version, because I need that for my binder. If you guys remember the binder opening, or not the opening, but the binder I'm putting together for Ghost Rares and Secret Rares and stuff like that. So hopefully we can do that. We have a Miracle Flipper. Arcana Force VI. The Lovers. Very nice. Light Spirals. Wait, okay. Let me look at this. The Lovers. That's interesting. Light Spiral. Couple of A's classic card. Spell Gear. Interplanetary Invader A. Very nice. Arcana Force 18. The Moon, okay. Gladiator Lash. And maniacal servant. What a creepy looking card. Okay, maniacal servant. Onto the next one. I hope you guys have enjoyed the last year of uploads. If you do want to support this opening and the channel, make sure to check out my TCG player and eBay affiliate links down below. If you guys buy anything using my link, you don't have to spend any extra. It just supports the channel. So I really appreciate when you guys do that. Okay. We're also probably having a sponsor on this video, assuming it gets approved or whatever. So if you do, I appreciate you guys supporting that. We've got another Summon Limit. Very nice. Space Gift. Very cool. Arcana Force I. The Magician. Very nice. Rainbow Gravity. I got to stop saying that, guys. Interplanetary Invader A. Quick Charger. And Flame Spirit Ignis. We have another rare. It's a slow start. I'm hoping that we will pull something out of here eventually. So there's a cost benefit to opening an open box. So we saved a lot of cost because it's not sealed. Secondly, we risk something having been tampered with or something like that. Volcanic Queen. So we just wrecked a special. So hopefully the risk pays off. D-Fortune. Battery Man Charger. Mystical Cards of Light. Limit Reverse. Giraffe. Lightsworn Word. There are those lightsworns. Very cool. Reversal of Fate. And a Ribbon of Rebirth. Another rare. This is a slow start, guys. I'm getting a little nervous. But all we need is one big pack. Judgement Dragon. Honest. Anything crazy like that could change the tide of the opening. Here we go. We have a Cross Porter. Sanguine Swamp. Lady in White. Arcana Force III. The Empress. Portable Battery Pack. Realm of Light. Goblin or Recon Swad. Mystical Cards of Light. And a Glorious Illusion. We are what? How many packs into this? Okay, we're only like six packs in. So it's not really that crazy yet. Do you guys remember that? What was the livestream we did? Was it Soul of the Duelist? First, like 11 packs had nothing. It was insane. It was really insane. Okay. Hopefully that doesn't happen because that just... That made me unnecessarily nervous. All right. We have Cup of Ace. Arraging Cloudion. Arcana Force VI. The Lovers. Short Circuit. Demise of the Land. Very nice. There's not a lot of Lightsworn so far. I guess a lot of them are Hallows. Golden Bamboo Swords. Another decent one. Arcana Call. Arcana Force XVIII. The Moot. Froggy Force Field. Froggy Croak. Okay. Next pack. Can we get a foil? That would be... That would be nice, for sure. That would be nice. All right. One, two, three, four. Give us something good. Lady in white. All right. Another decent one. Arcana Force zero. The Fool. That might be us when we open all these waypacks. Level tuning. Hopefully not. Arcana Call. A Unifrog. Cool card. Jane Lightsworn Paladin. There's another Lightsworn. Rainbow Gravity. And Glorious Illusion. Okay. Time is now to start freaking out. We have a... What? Three more packs to get. It's been nine. It's been nine. So, can we get something good? We have one, two, three, four. Battery Man Charger. Light Spiral. Arcana Force VI. The Lovers. Cup of Ace. Interplanetary Invader A. Realm of Light. Destiny Hero Dread Servant. Arcana Force I. The Magician. Anna Dark Valkyria. Where are the foils? This would be a classic way for us to have a special opening. If you guys remember when we had that, we got scammed out of a... What was it? Like Taxical Evolution or something? It was like resealed. Yeah, that was painful. Hopefully that is not this painful this time. All we need is a Ghost Shred. That's all we need to turn it around. Two, three, four. Here we go. Level tuning. Arcana Force VII. The Chariot. Cup of Ace. Raging Cloudy. Garoth. Lightsworn Warrior. Arcana Call. Unifrog again. Jane Lightsword Paladin. And... Battery Man Industrial Strength. Okay, it's another regular rare. Oh, remember when I said 11 packs. Here's number 12. Let's see if number 12 can turn this around. Okay, all right. Let's go. Come on. Volcanic Queen, please. Summon Limit. Nice card. Lady in White. Arcana Force X, the Fool. Gladiator Lash. Reversal of Fate. Quick Charger. Portal of Battery Pack. Ribbon of Rebirth. 12 packs. Nothing. All right, on to the second half. Technically, they could all be on the other side. We'll, I guess we'll find out. I mean, will we pull something? They could have been in just a weird order. You never know. But right now, I'm not feeling too confident. We have Garoth. Lightsworn Dragon. Very cool. Space Gift. Miracle Flipper. Arcana Force VI, the Lovers. Arcana Force XVIII, the Moon. Cloudy and Storm Dragon. Lucky Chance. Hero Mask. Celestial Lightsworn Angel. We pulled a foil. That's an ultimate rare too. That is awesome. There's the lightsworns that we're looking for. Ultimate Rare. Celestia Lightsworn Angel. Wow.  All right. That's a good sign. So maybe they're all on the left. It's also kind of hard to weigh out foils. So these were potentially like weight or something. We only get that. Maybe that's why. But maybe they were just all on the left. So we're going to find out. That's at least a relief to pull something. Okay. We will take that. Now let's see if we can get like a Secret Rare, Ghost Rare, or anything else. Get a Volcanic Queen. This card. I did not know this card came in here. It's kind of like a weird kaiju that they, uh, Cimo used on me. Defortune. Giraffe. Reversal of Fate. Hero Mask. Jane Lightsworn Paladin. Ant. Lumina Lightsworn Summoner. Very cool card. The original Rare version. I think it comes in Ulti, does it? I didn't think they did Rares as Ultis in this set. But maybe they did. I don't know. I'll pop it up on the screen if there is an Ultimate Rare printing. If not, then there's not. Okay. One, two, three, four. There's a Super Rare in Champion Pack. So it's probably not an Ulti because that was probably the high rarity. Battery Man Charger. Arcane of Force 7. Dice Dry. Deformation. All right. Gladiator Lash. Spell Gear. Yeah, there is Gladiators in here. The guy's Aeris is in here. I think the Magician. Rainbow Gravity. And a Nimble. Musa Sabi. We've got another Rare. Okay, back-to-back Rares. So far, we've opened 15 packs and gotten one foil. So it's not looking too great so far, okay? Not looking too great. If it's just an Ulti, then that's sort of a red flag. But we're gonna keep opening and find out. We've got a Miracle Flipper. Deformation. Cross Porter. Sanguine Swamp. Arcane of Force IV of the Emperor. Rainbow Gravity. Planetary Invader A. Portal of the Battery Pack. Destruction Jammer. It's looking a little sketch right now, okay? So, this is how many packs we have left. We have three, four, five, six, seven, eight. We have eight packs. Can we actually pull- There's still enough packs to pull like a normal ratio. But we kind of gotta go on a huge streak here. And let's see if we can do that. Right now, we have one foil. Which is not great. We have our Arcane of Force VI of the Lovers. Short Circuit. Light Spiral. Space Gift. A Rainbow Gravity. Demise of the Land. Very nice. Golden Bamboo Sword. Also nice. Arcane of Call. And Arcane of Force XIV Temperance. That card was used in some Duel Links decks. Okay, another rare. 365 Day Celebration, baby. Man, what a way to celebrate. Opening some Wade packs. Pretty exciting. Let's see. We have a Light Spiral. Cup of Ace. Battery Man Charger. Short Circuit. Destiny Hero Dread Servant. Spell Gear. Interplanet Potato. Invader A. Arcane of Force XIII, the Moon.  We got an Ultra Rare. Okay, we got some pulls. We've got an Ultra Rare. Our second foil of the box. Okay, does this mean we're about to go on a streak or not? Two foils. Okay, two foils, total. Better than zero for sure. And at least it's the Ulti and an Ultra. And not like just a couple supers or something. That would be pretty rough. Phantom Dragon. Okay, that's pretty cool. Four. Let's go. Light Spiral. Space Gift. Battery Man Micro Cell. Dice Dry. Lug of Chance. Unifrog. Very cool. Jane, Light Sworn. Light Sworn, Paladin. Okay, Nicole. And Arcus, Light Sworn Druid. Okay, another foil. Is it starting to pull some stuff? Very nice. All right. Does this mean we're about to pull something else? Is it all going to wait for the end? Is this crazy? This is kind of crazy actually. Like, wow. All right, I'm ready. I'm hyped. This is the weirdest box I've ever opened. This order is crazy. We've got a Wetlands. Summon Limit again. Very good pull. We've got a Gar- Garganith. I read that as Garoth again. That's Garganith. Okay, Garganith, Light Sworn Dragon. Space Gift. Cloudy and Storm Cloud. Look like a chance. Man, the Cloudyans are just... They're bad. Hero Mask. Destiny Hero Dread Servant. And Gladiator Beast. Gizeris. And there it is. The Gizeris Super Rare. Very nice. Look at that, guys. That's the one I just called earlier. Very good. It looks like it's in nice condition as well. This is the crazy card for Gladiator Beast that made them really good for a while. Okay, we're up to four foils. We're literally pulling everything at the end. On to the next pack. Let's go. We have one, two, three, four. Arcana Force. Seven the Chariot. Dice try. Deformation. Arraging Cloudy. Hero Mask. Jane Light Sworn Paladin. Gladiator Lash. Spell Gear. And Celestia Light Sworn Angel Ultra Rare. What the heck? Whoa, we got the Ultra and the Ulti. That's so weird. Okay, so that's another foil. What in the world? This is the weirdest opening I've ever done. This is a pretty classic way to end the year. Just with a really strange opening. Okay, let's look at these. All right, let's go like this. I mean, these packs seem legit. I mean, it doesn't seem like there's anything going on with them from what I can tell. Okay. I mean, who knows? Maybe there is, but you never know. We might've just got him shuffled to the end for the most part. We got a Microcell. Dice try. We got a Miracle Flipper. Deformation. Arcana Force, 18 the Moon. A Lucky Chance. A Unifrog. Jane Light Sworn Paladin again. And a Vanquishing Light Super Rare. All in a row. Like we've pulled how many a row now? Like five or something? This is just weird. Two more packs. Let's see if we get more pulls or not. I don't know. We're going to find out, I guess. Let's go. Okay, let's go like this. I mean, these are opening like normal for the most part. It feels like... I don't know. I don't know. It just seems so odd that they're all at the end. You know what I mean? Let's just keep going. Lady and White. Nice. Arcana Force 3. Raging Cloudion. Gargonith, Light Sworn Dragon. Realm of Light. Goblin Recon Swad. Mystical Cards of Light. Let me reverse. And a Magical Exemplar. Like literally how many a row is this? One, two, three, four, five. I think six in a row. And on to the final pack. We have no Secret Rare. So will we get one or will we not? I guess we're going to find out right here. Hopefully we can because that's kind of a big deal on these. Okay. We have one, two, three, four. We have a Battery Man Charger. Short Circuit. Volcanic Queen. Summon Limit. Very nice. We've got a Reversal Fate. Quick Charger. Portable Battery Pack. And Giroth, Light Sworn War... Oh, it's after this. I was like, what? And a Light of Redemption. Another Super Rare. So no Secret Rare in this box. That was such a weird opening. Hope you guys enjoyed it for the one-year special. I appreciate all you guys watching all the videos over the last year and hopefully we will be able to continue to streak.  Go check out the Shorts and the Live Channel that I just added. You guys can check those out in the description. I'll pop them up on the screen. If you enjoyed the video, make sure to subscribe for more epic content. Shout out to CCJuts, Scard, Stonefo, Show, Tomato Juice, Stanley, Stanley, Mike, Nance, Mimic, Echo, Spankipet, Fallen, G-Raider, Daxter, Ian, Musa, and Junior Barting. Thank you guys for supporting the channel. I'll see you guys next time. Peace.