Hello, and welcome my name is Shannon Kemp and I'm the Chief Digital Officer of Data Diversity. We would like to thank you for joining the current installment of the monthly Data Diversity Webinar Series, Real World Data Governance with Bob Sinner. Today Bob will be joined by guest speaker Dave Kellogg to discuss data governance to build data intelligence, sponsored today by Irwin by Quest. Just a couple of points to get us started. Due to the large number of people that attend these sessions, you will be muted during the webinar. If you'd like to chat with us or with each other, we certainly encourage you to do so. And to note, Zoom defaults the chat to send to just the panelists, but you may absolutely switch that to network with everyone. For questions, we will be collecting them via the Q&A section, or if you'd like to tweet, we encourage you to share highlights or questions via Twitter using hashtag RWDG. And to find the chat and the Q&A panels, you may click those icons in the bottom middle of your screen to activate those features. And as always, we will send a follow-up email within two business days containing links to the slides, the recording of the session, and any additional information requested throughout the webinar. Now, let me turn it over to Sue for a brief word from our sponsor, Irwin by Quest. Sue, hello and welcome. Hello, Shannon. Can you see the screen OK? Looks great. All right, awesome. And you can hear me, I assume. So today I'm just going to talk really quick about the data journey. What is the outcome and the value that you might be striving for? A couple of use cases, and then I'm just going to show you what data intelligence might look like live. So I'm going to do all that in 10 minutes, I promise. Many of you probably recognize this pyramid of going from data to wisdom. And from our perspective, you use data governance every step of the way to do that background understanding and getting information well-governed across the different business units. But when you start off with just data, if you don't have information about that data, all you have is a bunch of numbers. So when you're looking at information, you're considering things like a metadata of repository or a catalog, which gives you the inventory and the lineage of your systems. In order to really understand and connect the head to the body, you need knowledge about the data as well as the information. And that you can achieve through data intelligence. So data intelligence gives you a lot of the automation behind connecting the head to the body or connecting the business to the technical. So you can start to frame your understanding of the data through the business information and through a business lens. And then finally, to really have data trust and wisdom, it comes with tying it all together. And this is when the folks really start to rely on the data to do your job. They trust the data. They have real insights. And from my perspective, what is an insight? An insight is something that actually alters your perspective of reality. So it's giving you a really good, negative information that changes the way that you've been thinking about things. And if you really want to rely on the data and not go with your gut anymore, you have to let go trust the data and know that everything that you've done up until this point has been to deliver good, clean insights to your user community. And what is the end result? The end result is that information is immediately found so you can go and you can find the data that you need to do your business campaign, to do your business project. And everything is authenticated. You know that you're using your privacy information in the right way. It's encrypted. It's archived what it needs to be archived. It's also described in a manner that you're going to understand it and it's just well protected information. And then finally, the top few use cases or the top four use cases actually that we're seeing right now around data intelligence in particular is delivering those reliable insights in your reports and in your data coming out of your new modern environment. Modernization is the other top use case. So how are we using data intelligence to modernize the new environment? Compliance, so being able to be explainable. So being able to really explain where that data is coming from. And then finally, being able to reuse information and trust and rely on the data because the quality is good. And being able to detect where you might have data quality issues by using the tools that we give you inside of the data intelligence environment. So it's used as a detection to go and do those forensics on your data itself. So what does that all look like? I'm going to show you real quick. This is not meant to be a sales pitch. It's meant to just give you a visual. So when I talk about being able to find the data in your context, you should be able to search and do some sort of global search on the information that you're looking for, whether it's business or technical information, or maybe the system guides you to where you can come and see your policies, your business terms, your processes, your regulations. So if I click on business policies here, I should have a list of policies. And from a user adoption perspective, I should have really good, familiar ways of searching and categorizing and finding information. So over on the left hand side, you see some Amazon-like ways of categorizing your information. You get your list here and you see how good the data actually is behind maybe this data privacy policy. So when I click on the privacy policy, I get all the general information about it. But I also get a mind map. And the mind map is something that's unique to Irwin, where we are looking at connecting the business to the technical information. So if I wanna look at all the regulations, all the processes, all the business terms tied to the privacy policy, I'm looking on the right-hand side here, and I can expand this and see the framework of those regulations. And on the left-hand side, you're looking at all the different applications that produce the data behind your data privacy policy. So I'm in the interest of time, just gonna expand all. And the mind map is showing me where this data exists, the scope of the data that it's in. And it's starting to give me some preliminary data quality metrics around this data. So green means pretty good data over here. Orange and yellow, or yellow means that it's cautionary and red means that you definitely have some problems. And that's where it's detecting that you need to go in and maybe do something about that complexity. And then finally, so this is where we're connecting the head to the body, the business to the technical. What data is supporting this business policy? And if I wanna go in and maybe look at just one of my applications here, I can click on it. And maybe I'm in a modernization program. And I wanna know everything about this data warehouse. Here's the inventory. So all the tables and columns inside of this warehouse, who owns it, what it's about. And if I'm working in a modernization program, I wanna be able to see all the different systems and environments that are feeding it, all the tables and columns that are impacted. And if I click on what are all the tables upstream of my EDW, I can see, there's 32 tables and I can get a quick view and a quick report on those tables. So in a nutshell, that is a view of data intelligence when you have automated streams in the background doing the lineage, doing the impact analysis. And you also have AI working for you connecting your business information to your technical information to give you that full scope and getting everybody on the same page and literate about the data according to the context that they're searching for that information for. So with that, I'm gonna turn it over to Rob Siner who is gonna lead the session today on data governance and data intelligence. So over to you, Rob. So thank you so much for this great presentation. And thank you to Irwin by Crespi for sponsoring today's webinar to help me make these webinars happen. And if you have any questions for Sue or about Irwin, feel free to submit them in the Q&A panel as she will likewise be joining us for the Q&A portion at the end of the webinar today. Now let me introduce to you our speaker for the series Bob Siner. Bob is the president and principal of KIK Consulting and Educational Services and the publisher of the data administration newsletter, tdam.com. Bob specializes in non-invasive data governance, data stewardship and metadata management solutions. And with that, I will give the floor to Bob to introduce his guest speaker and start his presentation. Hello and welcome. Fantastic. Hi Shannon, hi everybody. Thank you everybody. Thank you, Sue. Thank you Irwin by Quest for sponsoring today's webinar. Thank you to my special guest who I will introduce in a second. I just wanna talk for a second about the subject of data governance to build data intelligence. So I think in the session that are in the slides that Sue just shared with you, I mean, helping people to understand and gain trust and to be able to use data intelligently within an organization, the term data intelligence that started to become more used. And you know how it is when you're senior leadership, here's a term like data intelligence. They say, well, I want that. Our data literacy, I want that. So what we're gonna talk about today and I feel like I've got a really good guest on the show on the webinar today to talk about this. We're gonna talk about what exactly is data intelligence and how can we get to a point where we as an organization become data intelligent and where data governance can be used to help to build that. But before I get started, just real quickly, and I know it looks like I won't be real quick on this slide, but just real quickly, some of the things that I'm heavily involved in right now, this webinar series next month, we're gonna be talking about data management, metadata management and data governance and how those things work together. Had a lot of organizations that are looking for overlap and the different types of disciplines that they're data related disciplines in the organization. So we'll talk about those three in the webinar next month. I'll be speaking today in Germany, I'll be speaking at the information governance world, but most importantly, I will be speaking at the DGIQ East, Data Governance and Information Quality East Conference in Washington, DC in December. I talk a lot about non-invasive data governance. If you're looking for more information, you can find it through the book that I wrote of that name several years ago and then the learning plans that are available through Data Diversity. Shannon mentioned the newsletter. I also have a consulting business and one of the things I'm most proud of is I'm presently an adjunct faculty member at Carnegie Mellon University here in my hometown of Pittsburgh. And with that, I'm gonna introduce you to somebody I feel I'm really happy to have this special guest today, Dave Kellogg. Dave, I want you to tell people hi or say hi to people and maybe real quickly go over your background. Sure, thanks Bob. Thanks for having me today. My name is Dave Kellogg, the founder and principal of my own consulting company. In addition, I had a long career as an operating executive in enterprise software and I'm a pretty active angel investor and sit on the board of directors of companies in the space. So I've worked in places like business objects for around marketing for nine years, Mark Logic and XML database company, Salesforce and host analytics, financial apps. I served on the boards of Elation in relative to this space, Elation, AsterData, Prophecy and others I've been advised a whole bunch of software companies as well. So I have both the kind of technical and business perspective on this topic, Bob, which is why I like it so much because I work on really the, almost the investor and business side of the house with these companies. Which is really exactly why I wanted to have you as my guest on this webinar. So I really appreciate your being here. Let's get into the topics that we're gonna talk about. So typically I break things down into a handful of topics that we're gonna walk through and then we'll leave time for Q and A with Sue and Dave and myself at the end of the webinar. First thing we're gonna talk about is just providing a definition as to what data intelligence is. We're all hearing that term so often from vendors from articles that we're reading. We wanna put our arms around what exactly is data intelligence. And then since this is a real world data governance series, we wanna talk about the relationship between data governance and data intelligence. Who has responsibility for data intelligence? How data intelligence relates to other disciplines that you might be focusing on and then talk about finally building data intelligence through data governance. So the first subject is just to put a definition to what data intelligence is. So Dave, I'm gonna ask you with your experience and your thoughts working with all these different organizations, can you in just a few words describe to people what data intelligence is? Sure. And Bob, as you know, I can be contrarian at times. So it's what I think is a fairly unique viewpoint on this. I think data intelligence is an emerging software category like you might say CRM or conversational intelligence or product analytics. So I think it's a category of software. I can keep going if you wanna know what I think it's often conflated with. Well, you know... It's not good. And I would say it's an emerging software category. I think that there's a lot of people that will agree with you about that. But if an organization is wanting to become data intelligent, what does that mean? Yeah, so the thing, and here's the way I think about it. Maybe it's not that contrarian, but I think DI, the real question to me is DI a means or an end, right? Are we trying to become data intelligent or are we trying to have a data culture? I prefer the latter. So I think the business goal is actually let's build a data culture that that's the end. And the means, one of several means is data intelligence software. And to me, data intelligence software is a category of software largely related to metadata for a large number of use cases like search and discovery, privacy, lineage quality, observability, security, data ops, et cetera. So that's kind of my view on the world there, Bob. Well, and I think that they're very much in line with the things that I think. And it's a question that I have about the use of the word data intelligence is, is data intelligence actually a discipline in itself? Is it a software category? Is it a result? We want to become data intelligent. So I guess when organizations start to talk about data intelligence, how do you suggest that they address the stakeholders, address their leadership when there's questions about, do we need data intelligence software? What is data intelligence? How would you address that with your organization? So the way I think of it, and I like definitions, is I'd say, look, are we trying to build a data culture? And the definition, a data culture is a corporate culture of database decision making, right? So we're trying to build, make rational decisions based on data, that's called the data culture. If we want that, how do we do that? We need to use a collection of lots of tools including data intelligence tools to do that. So that's the way I think of it. The business objective is data culture, definition of which is data driven decision making, and then data intelligence is a category of software that covers a large, basically large types of metadata applications. Personally, I think a lot of people use, like you just use data intelligent is what I might call data literate. So some of this in my mind, it's not about right or wrong, but it's just about let's get these terms straight because we confuse people and whether you like my definitions or not, I'm really consistent. Data culture is data driven decision making. Data literacy is properly making decisions based on data, right? Because if we just hand an analyst a bunch of data, the odds of them making a correct business decision are like zero. So that, I would argue, by the way, again, I don't care who's right or wrong Bob, but I think you need to make your definitions for you and stick with them. Otherwise we're going to confuse the heck out of people. And I think if you're waiting for the industry to get their arms around them, you're going to be waiting a long time. It really is to make a decision for your organization, for you and stick to it. I see it as being a means. I see it as being an end. I see it as being both. And so I look at it as being something that it's just another one of those buzzwords. And last month in this webinar, we talked about data literacy. And so I was going to ask you for your definition of data literacy, but you just gave it to us. So I think that's really good. I mean, if your organization is using both of these terms, I'm not sure that they're interchangeable, just like Dave said, be consistent in how you define them and stick to it. And if there's a need to change it, change it, but at least be consistent within your organization. So the next thing that I want to talk to you about, because again, I don't think we are going to define for the industry exactly what data intelligence means in this webinar, but what a lot of people in this webinar might be interested in is, then what's the relationship between data governance and data intelligence? So if it's a tool, that's one relationship. If it's a result that we are trying to achieve, it's another relationship. So what are your thoughts on the relationship between data governance and data intelligence? Yeah, happy to weigh in. But one thing I'll say just to the prior point, Bob, is I have a favorite quote from Edward R. Murrow, which is anyone who's a famous newsman back in the day, and the quote was anyone who's not confused really doesn't understand the situation. And that's the way I feel about it. If you're not confused, you really don't understand the situation because it's plenty intrinsically confusing. And that's why those definitions are so important. And yeah, we're not going to make them for the industry, but we can make them for us and we can be consistent. Now in my part on this, Bob, data governance would be part of data intelligence, right? Because I see data intelligence as a category of software that will help you build data culture. And it solves lots of use cases and it's certainly a very important use case is data governance. So in my world, that's how it fits in. Okay, but you said data intelligence is a software category. So data governance is a part of data intelligence, explain that. Yeah, busted, you busted me correctly. I mean, yes, you can certainly buy data governance software, right? But no, as we both agree, and I'm a huge fan of your book as you know, data governance is more, just like you can't buy data culture, you can't buy data literacy, you can't buy data governance. So I may have some cleanup work to do on my taxonomy, but put it this way, I know there are data governance software packages you can buy and I would classify them as do many analysts as part of data intelligence. Okay, okay, so what value does having a formal data governance program, whether it's, and we hope it's non-invasive, but if it's very invasive and command to control too, what value does having formal data governance add to becoming, you know, having data intelligence? Yeah, I mean, hopefully, I mean, there's two things, right? Whenever we enter these conversations about data, there's always what I call the offensive side and the defensive side. On the defensive side, it's obviously compliance, right? You're sticking to your own rules and passing compliance tests with auditors and certifications, yada, yada, and standards. So to me, that's the defensive side. There's the offensive side, which is if we have proper data governance program, we'll have higher quality data, right? Because we'll have data stewards who are passionate, for example, we'll have data stewards who are passionate about a certain data set and ensure that it's really high quality and teach people how to use it and where it can be used and can't be used. So I see data governance, which hopefully is non-invasive, right? Doesn't have to be command to control, doesn't have to be big bang, doesn't have to be scary, right? Because for a lot of people, it still is. But properly implemented, I think data governance can help you on both the defensive side and the offensive side of using data. So it's interesting, being a big football fan, like I am, well, I'm from Pittsburgh, so what do you expect? So looking at it from a defensive and an offensive, would you also include data literacy or I love the way that Sue laid it out with the knowledge pyramid, I have one of my own, but how you go from data to information and information to knowledge and then to wisdom, where would metadata management fit in? Is that offensive? Offensive in the fact that it can be used to help to improve both compliance and data quality. Where would you fit metadata management into that? Yeah, I think it's both, right? I mean, you can use metadata certainly for, I'll give you some offensive examples, just collaboration and social metadata, right? Like we can get people say, hey, you know, Bob is the steward of this set, Bob knows a ton about this set, ask Bob for questions, and then you will use that data set more intelligently, and therefore hopefully make a better decision based on it. That would be an offensive use case, a defensive use case would just be lineage, right? For compliance reasons to comply with our policies, we need to know where this data came from or it needs to have been pulled within this timeframe, in order to stay compliant with what we do here. So I think proper management of metadata is definitely both offensive and defensive. And for what it's worth, I think it is useful. What I try to do is break things down and some things are both, right? But it's nice to say, hey, are we doing this for defensive reasons or offensive reasons? We're trying to win market share, beat competitors, run the business more efficiently, or are we trying to comply with our policies and comply with standards? And both are necessary, right? I hate when people say they're straight off, because that's the compliance deployment if they view it as a trade off, they usually don't. And basically metadata becomes very foundational, right? So the information about your data, it's very difficult in my mind at least to be able to manage anything unless you have information about it. And so that's what data is. You can't manage your finances without information about your finances or your people or your locations or your products without information about it. Well, you can't manage your data without it as well. So yeah, metadata is pretty foundational. And I love the idea of it applying to both the offense and to the defense. But I guess one more question on this or maybe even a couple, can you get to the point where your data intelligent without having a level of data intelligence within your organization without having formal data governance? Yeah, I don't think so. I don't think so. Because I think both are necessary. Like I just said at the end of the prior comment, when you meet people who primarily pay offense with data, they always talk about trade offs. Like how do we have to trade off compliance versus access? And when you talk to compliance people, they never say that, right? They say we have to be compliant as the kind of Sina qua known, right? And once we are compliant, then we'll talk about access. And they're just different worldviews. Some people grew up on the governance compliance side. Some people grew up on the data science and analytics side. And they have different, those two groups have different worldviews, but for the organization overall, I don't know how you could become data intelligent without good data governance. So then in a chicken and egg scenario, would data governance come first with those organizations, those people that are out there listening to this webinar right now that are doing data governance or putting formal governance programs into place? Is that almost a prerequisite to getting to the point where data intelligence is a thing in their organization? So which comes first basically? Yeah, and two things. One, to quote Bob Siner, you're doing it already, right? I have said that before, yes. You have said that before. So I think most organizations are doing it already and just kind of the continuous improvement approach of getting better at what you're doing and formalizing it, I think is a great approach to data governance because I really don't like the other approach, just having a good a business side person, big bang thing, scaring me, expensive things scare me. People trying to slow down the business scare me, right? So I'd much more do a continuous improvement approach which is how I characterize non-invasive. I believe to answer the question directly, I think organizations, it's already happened, right? So I think, I don't know, we already have both chicken and eggs, right? So I've arrived on a new planet, right? All companies are probably doing some degree of both today already, actually probably everyone's doing some degree of both today already. So I don't know if it's the chicken or the egg, but I know if you're not good at governance, you should try and get a continuous improvement going. And if you're not using data enough for offense, we should talk about the chief data and analytics officer role and what they're doing to drive that and what the business leaders are doing to drive that. So I don't have a good answer for you that one. And the beautiful thing about these webinars and all the webinars are that we're not looking to come to an answer. We're looking to give people food for thought, things to think about as they're defining these things for themselves. I don't think there is a definitive answer. I always get asked the question, is data management part of data governance, or is data governance part of data management? Dana has their views. I'm not thinking more that we're trying to answer that question, but I believe that there is a very close relationship to them, which we will also have a chance to talk about here in a couple of minutes. But, okay, so the whole concept that we've talked about so far of data intelligence, and this is where, again, it's showing what I had said earlier that view is data intelligence really a discipline that you're going to build in addition to data literacy and data governance, or is it actually a result? And is it really possible for somebody to own a result? So is data intelligence a discipline or a result? I think we've heard a little bit about it from you, but can somebody be responsible for that? Who would be responsible for that? So if you define data intelligence as roughly what I call data culture, an organization that makes better decisions based on data, then ultimately it's kind of the C-suite and the CEO, right? If you define data intelligence at the next level down, like it's a set of tools we need to help enable data literacy and data search and discovery and data governance, which in turn will help us build data culture, which is Dave's worldview. It is a means to an end. So it is a discipline, not a result, because results are ends and disciplines are means. Can someone own it as a discipline? I think yes, and the question is who would, to me, typically it's either this, I mean, it's either in the CDO who typically reports to a line of business person or CDAO, Chief Data and Analytics Officer, or it could end up under the CIO who can report directly to the CEO or through a COO or CFO. Those are the common patterns I've seen, but I do think somebody has to own it because I think a lot of this is about standards, frankly, and forcing people, I need to use the word forcing, but getting people or facilitating people to share knowledge across the organization. That's not everything, but it's certainly part of that. So you need a pretty powerful executive sponsor if you want to do this. So, okay, so I understand that. So I like what you just finished with is the executive sponsor. The executive sponsor for data governance is not the one that's rolling up their sleeves and building the data governance program and implementing the data governance program. So it's the same thing holds true for data intelligence that it's being owned at a high level of the organization. Who does the work? Who is going to be the practitioner? Does that fall under the data governance team or data governance office or where would that sit? So I think it's easier to answer the offense side, that's gonna be the data science department, whatever you want to call it, the analytics department, in some cases the ops department, that's easier in my mind to identify people who try and make the business run better using data. On the governance side, I believe the answer is lots of those people need to be involved in the effort because they're the users of the data and they know the data best, but the effort itself is usually, and you know a lot more about this than I do Bob, but it's usually championed out of some office related to data governance and compliance. So that's the way I see it, that really they're kind of the chief privacy officer, chief security officer, chief compliance officer, somebody on that side of the house, usually in my experience owns the kind of defense side of that, let's keep everybody out of trouble. And then usually the CDAO, and by the way, CDO is in my opinion historically started out in that role. I believe historically CDO was first oriented kind of in the way you brought up Bob because the foundational layer, hey, the level of Maslow level zero is let's keep everybody out of trouble and stay compliant, and that's hard by the way, right? So let's get a CDO in charge of that and that person will have some dedicated people on their team, but they will also have power to work across the organization. And I think that role has evolved become CDAO. I don't just think a naming thing, I think it's a mission thing where they said, gosh, this Maslow level zero food and shelter is great, but wouldn't it be better if I was responsible for helping us use data to run a better business? That is a more exciting job, more leverage on the bottom line. So I think a lot of people have gone that direction. And I love the way that you said that it's a mission thing in what we're calling that role because I work with a lot of chief data officers and with the program at CMU, the I'm seeing definitely an evolution actually more from the traditional CDO to the CDAO. So it is, I think if it all becomes about the mission, it's gonna be different for every organization, but you're right that the analytics part of it is such a big part of what's being taught to the up and coming or the future generation of chief data officers in the world. So it sounds as though, I think we're in agreement that it has to be missioned from a very high level of the organization, but I'm still kind of confused as to if it's gonna, so is it gonna be the analytics team or is this something that data governance would wanna take on and say, okay, we're because I'm having conversations with clients about whether or not data literacy fits under data governance and many organizations are doing data literacy programs and then telling their data governance programs that they're doing them.  Who's gonna implement the data intelligence software? Is it gonna be the data analytics teams? Is it gonna be them in conjunction with the data governance function? So I kind of view it as layers, right? There's a software infrastructure level and layer in IT that's gonna run all the software to store this stuff. I personally think compliance and governance should be done as a separate layer on the defense side of the house. And I think the offense side should be done by CDAO, running teams of data scientists and analysts. And so that's where I think that that all happens. So basically, I mean, ultimately Bob, people need to work together, right? We could try and give this all to one person, but I'm okay with it being split. For example, data literacy is a super hard problem. In my mind, it's 90% training, maybe 80% training, right? I don't think data literacy is largely about software, right? I think data literacy is about how do we use software to make good decisions? And in my mind, that needs to be run by the people who are using the software to make the decisions. So I have a clear point of view on data literacy. It should reside close to the offensive side of the house, which in my world is hopefully the CDAO. And when you talk about the most important thing is that these groups work together and I think that becomes the bottom line, is getting groups to actually cooperate together and because you're all kind of pushing in the same direction, it would be better if there was a plan. And again, we could have a full webinar on the need for a data strategy and bringing all of these things into a data strategy, but we'll have to save that for another day because we could certainly go deeply into that subject. I also wanna talk about how data intelligence, so there's so many other buzzwords and I'm not gonna, yeah, heck, I will say. Data intelligence is a buzzword, data mesh, data fabric. Well, first of all, when we're talking about how data intelligence relates to other disciplines, I'm curious as to your take as to what is even meant by trying to relate data intelligence to these things, but how specifically does DI relate to things like data mesh? Sure, so I think, maybe let me tell you first what I like about data mesh and what I think it is and then how they relate. So to me, data mesh is, there's lots and lots written on data mesh, white, hot, buzzword as you say. If you try to boil it down, which I always try to do to things, that the two big things I take from it are decentralization, right? And let's not create, I mean, just to use the always, the example that's always tortured, the data warehouse, the 1990s era data warehouse, build it, they will come, have a bunch of people who don't understand the data, put it in one place and nobody really uses it, right? And it takes 10, five years with $5 million and it's this thing that no one used, right? That we all live through that if we've been doing this long enough. And that was the kind of, the pendulum swing real hard, one direction on centralization. And I think data mesh is the corresponding counter swing to decentralization. And I like it because to me, it's taking kind of two timeless business principles and applying them to manage data. The first is decentralization, right? Push decisions about how to run the lathe to the lathe operator. That's what I got taught in business school. And then data products, let's treat data as a product, maybe even have a product manager for it, have requirements for it and let's have a customer orientation. And those are to me, the two biggest kind of world-changing things about the data mesh and how the data mesh relates to DI. In my mind, I view the data mesh as a driver of the need for DI software. Why? Because we can take apart Humpty Dumpty, but somebody has to put them back together again, right? That the other way I say this is on our, on our search for a single source of truth, for decades we thought that meant a single source of data. And now I think it's turning out to be a single source of metadata because we actually want the data and the infrastructure distributed owned by the experts. But the more you decentralize, the more you need the other side of that coin, which is, wait a minute, do I have some index, some catalog, some way of looking across all these decentralized assets, governing them, securing them, accessing them, finding them, commenting on them. So I see them mesh as a driver for the need for data intelligence. Okay. And I rarely hear the term data mesh used without the term data fabric. And so there is, and so I think to some degree, those two, the decentralization and the data products also relate to data fabric. Can you talk about data fabric real quickly before we jump into just like how DI relates to the modern versus traditional ways of doing things basically in the traditional data stack? So my quick take on data fabric is, it reminds me of the OSI Networking Reference Model, right? It's a seven layer model to help you, and I can't remember if the data fabric has seven layers or not, but the OSI Networking Model had seven layers to kind of break down networking to a bunch of layers to provide you with a reference model for talking about the problem, really, and building solutions, but very few people built to those exact layers. But that's what I think the data fabric is. I think it's a reference model. Okay. And so how about, how does DI relate to, modern versus traditional data stacks? Yeah, I mean, I think this whole thing is fascinating, right? Because for decades, business intelligence was really about either reports or dashboards. And now, data scientists are basically, in my opinion, model builders, like what do they do for a living? They build model, and they test them and they deploy them and they rebuild them, but ultimately they're building models. And to do that required this like, came here an explosion of new tools that came with them. And because this whole area is growing so quickly, venture capitalists, it's a white hot investment area, if nothing else, the modern data stack, but it's ultimately because the scientists need these tools and this infrastructure beneath them to deliver the data they need to build models. And those models, the other interesting thing is in traditional BI, the consumer were people, humans, right? We'd send them reports and show them dashboards, whereas the consumer of the modern data stack output, i.e. a model is either an application, right? So we have an application in real time using a model to sort calls, right? Or approve credit or pick your example. So they can either be humans, in which case we have to wrap the model in some way, allow companies like Hex, or it could be machines. So what does this mean? And to me, it means we have a whole new infrastructure stack kind of in parallel, everyone's trying to kind of put it all back together and say, no, the modern data stack includes the traditional data stack. And it's not as big a one happy family in real world as I think it is in some of the architecture diagrams. So, and the way it relates to data governance and data intelligence is frankly, I think the modern data stack crowd, if you look at most of their architecture pictures, if you're lucky, there'll be one little box at the bottom going metadata or governance, right? If you're lucky, on a good day. On a good day. If it's, you're saying if it's included at all. Yeah, I think there's such a rush to build and deploy models. They're not thinking about what I think they call the control plane, right? And I think they need to think more about the control plane. And I believe they will over the next 12 to 24 months. So is data, and so I love the Humpty Dumpty analogy. I mean, tearing it down and then building it back up is that part of data intelligence?   I've worked with Elation for probably 12 years and data catalogs are certainly part of data intelligence. And I think all these decentralized trends increase the need for that kind of card catalog or that index to say, how do I find stuff? And then how do I collaborate on it, right? How do I work with other people? How do I give it reviews and ratings? How do I find stewards? So I think the more you have a single, you know, 1990s dream of a single enterprise data warehouse that had all the answers, the less you need some of that stuff, but the more you, some you need anyway, right? You need collaboration and filters and stewards, but the more you distribute it, the more you put pressure on DI in general, including catalogs as part of it. Yeah, I view it to be being very difficult to get to the point where you're, or I would view almost data catalog as being a tool of data intelligence. There's no doubt about it.  So, you know, you heard that today. The data catalog becomes really an important part and none of the question becomes, well, who's responsible for the data catalog? If we're going to need to document what we know about our data to become data intelligent, is that going to be built to where does the ownership of the catalog reside? And is that part of governance? So in my experience, it typically comes from one of two people or roles. One is literally just the kind of head data scientist or head analyst who is, you know, the old trope about 80% of their time is spent looking for data and only 20% has spent analyzing, right? That was the original argument for the data catalog. It was like I'm paying these people $200,000 a year and they spent, you know, six of their eight hours a day trying to find data or they find it and then they build a model on it, it's wrong. They have to throw it out and go find new data, right? So I think that was kind of the level zero use case for these things when they started. And therefore the first buyer was the person who was directly affected by that productivity hit. I either had a data science. I think it's since moved up to the CDO, CDAO and they're looking at trying to build data culture and to build a data culture. One of the foundational steps is how do I find what I need to make database decisions? So I need some sort of index of catalog to do that. And while different products come with their own kind of product specific catalog, a lot of people start with those first, but then I think they'll go to a third party catalog at some point because you almost definitely want it to be holistic, right? I'm personally not a big fan of having 10 different data catalogs on the company. It happens sometimes, different divisions, different departments and better to have 10 than zero, I suppose, but one or two is a whole lot better than 10. I guess maybe if you have 10 then you're really going to confuse that out of people as to where do I go to really get my information, unless they're all in sync. And we have heard people talk about catalogs and maybe I'm too idealistic, but like if you need a catalog of your catalogs, I think maybe your deployed catalogs are on, I think. Okay, so let's kind of wrap this up because I know a lot of people in the webinar, people that will be listening to the webinar are most likely data governance practitioners, data quality practitioners and data intelligence may be something they're experiencing now or will be experiencing in the future because I expect that this term will become more and more prevalent. What should people be focusing on? What should the senior leadership that are going to be the champions of data intelligence? What should they be focusing on? What should these folks, the data governance practitioners be thinking of in terms of data intelligence? And then after that, why don't we, we'll turn it back to Shannon and see if there's any questions for today. So I think if you're coming at starting, I always view this as two sides of the telescope and some people are coming from the governance side of the telescope and some people are coming from the, basically the data science side of the telescope or the data consumer side to be more generic. I think first two things, one, realize that while we may have different owners because Bob and I talked a lot about executive sponsorship of different initiatives, I believe there should be common tools and I think that's relatively new for some organizations that the compliance side of the house grew up doing compliance things with compliance tools and the analytics side of the house grew up doing analytics things, the analytics tools and while we still can have different business owners or the priorities, wouldn't it be nice if we had a common set of tools across that whole continuum? So that's the first thing I think about is how can I use the same tooling across all these different metadata related use cases of which we've only touched on a few, right? And the second one would be just reaching out to the other side. I always tell, I do a lot of sales and marketing consulting. First thing is sales, we'd have to marketing, go understand each other because you probably spend a lot of time with people in your camp and not enough with the other camp and you could end up with these basically misbeliefs or be misinformed about what they're trying to do. So I do two things. I'd say common tooling, can we have common tooling and how can I better understand and work with the consumers of this data and help enable consumption in a compliant way? Okay, so you talked about the telescope. I can almost picture it as an image where you could be on both ends of the telescope. You could be on the one end as you're looking at learning more about the enterprise. You can be at the other end and you could be learning more specifically about the things that are necessary around governance and around data intelligence. So I think the whole C-suite is on both ends of it. I think if you get down to your people get pushed and I totally agree with you about it. Okay, really good. So what did we talk about today? We talked about a handful of things we talked about. What is the definition for data intelligence? The relationship between governance and intelligence. We talked about who should own it and who should champion it and those types of things. How data intelligence relates to other disciplines like mesh and fabric and literacy and all of those things. We talked about building intelligence through data governance and some of the methods that you might wanna think about as practitioners of data governance to do that. With that, I am gonna kick it back to Shannon to see if we have any questions today. And Dave, thank you so much for this great conversation. And just to answer the most commonly asked questions, just a reminder, I will send a follow-up email by end of day Monday for this webinar with links to the slides, links to the recording and the answers to any of the questions that we don't have time to get to today. And the first thing that came in here isn't a question but a comment. I just wanna know if you have any thing that you wanna expand on it. Data intelligence is knowing where your data inventory is located and you can build from there. Any comments on that? I'll let Dave take a first stab at it and then Sue, if you wanna answer that. Yeah, at first stab, I would call that data search and discovery. We all have different words but clearly super important to be able to find stuff. And just to split semantic hairs, I don't know if I need to know where it is. I just need to know how to find it and just probably a philosophical conversation but largely agree. I think they may be one in the same. So Sue, what do you think about? Is data intelligence knowing where the data is? Yeah, I think it has a lot to do with knowing where to find that data, especially when you connect that head to the body and you go at it from a business context instead of having to know exactly what systems have what type of data. And I would also think that this is kind of getting at if you just have data governance and you just have the business glossary side of the house, what are you governing? Are you actually governing the data if you don't have transparency into the data itself? And so I think that knowing where the data is and knowing all of that information about the data is a piece of the path to becoming data intelligent because it's gonna be very, and I don't know if that's a new word, data intelligent, but to build data intelligence. I mean, it's gonna be very hard to do that if you don't have information about the data that you're using, being able to discover it, knowing where data is, it's super important. But where are you gonna go to get that information if you don't go to a data catalog tool or something like that or a data intelligence platform? So I think it's a component of data intelligence, but I don't define it just that way. Makes sense. All right, so another comment, data literacy may be launched through various initiative, DGO, CDO, et cetera, in the longterm should be transitioned to your learning and development for ongoing maintenance and delivery included employee onboarding program as well. So the way the word, the question was worded. So are you talking about transitioning data literacy under a learning function or a change management function? Is that what they're asking? Should it be transitioned to your learning and development for ongoing maintenance and delivery? Oh, okay, so once it's been developed, I think it's a partnership from the beginning of time. So what you're working with them, it's not something that's developed by one group and turned over to the other. Sue, any thoughts on, we talked a lot about data literacy before. Is it something that you build somewhere and transition or it's a partnership? Yeah, I definitely agree with you. It's a partnership and I do love the aspect of it being a part of your onboarding with new employees because it has everything to do with getting a new employee up to speed on what type of data you have out there and what type of initiatives that are important. What you should be associating your KPIs to the data itself and you could be doing that through your catalogs and through your data intelligence. Okay, Dave, any thoughts on that? Just briefly, I like the framing data literacy is largely a training slash human problem because I think it mostly is. I think the software can help give you the tools but how to use them properly is up to the user. And I agree with everybody just said, yeah, I think the initial thing is big enough and hard enough that it can't only be done by learning and development, but I do think over time, once you've defined it and standardized it, that the ongoing onboarding and periodic training can be handled by them. And when I typically define roles and responsibilities for data governance, there is a specific role of a data governance partner and that partner can be corporate communications. It can be change management. It can be project management or IT. I just think that it makes sense to not just develop it somewhere. It's like, you're not gonna develop your data governance program and then hand it over to somebody. Typically you might bring in somebody new to run it or somebody to run it, but I think it has to be a partnership from the beginning. Totally. Agreed. And lots of comments this time and versus questions, just some more statements. And in my opinion, we kind of missed the controller, processor, ADR and other sources to be referenced. Anything to mention on them? Say that one more time, I'm sorry. You missed that for mentioning the controller, processor and ADR and other sources in reference to this. Controller, processor. I don't know, I'm gonna defer to either of my guests and now at this point as to, I mean, I think that these are people that have our definers of data or producers of data or users of data and the chances are that they're probably going to be all three of those. They need to be heavily involved. I'm not sure if that's what the question was, but we didn't include them specifically, but if they are owners of data, I hate that term, if they're stewards of the data, somebody who's taking care of the data or even a subject area of data, they should be involved. Any thoughts, Dave on that? I don't in particular, none of this one, Bob. Okay. Sue. Yeah, same here. Unless I'm getting at it from a privacy perspective, but then I would absolutely say yes with you as well. I mean, I think that they play a role and the whole concept of being non-invasive is to recognize people for their relationship to the data and the controller and the processor live in data, I would think. So I think they have a very close relationship to the data. Kind of diving into the chat here a little bit too. Is it data supporting data policy or what data, the data policy applies to? Yes. When I presented the data policy, that's where we're associating what data is applied to this particular data policy. So if you're coming at it from a risk or a compliance perspective, it's helpful to know where is that data pipeline? What systems are feeding that data pipeline or I have to show up for a particular BCBS report or for privacy information? What data is tagged in there that I have to look at on a regular basis? So we're looking at the data around particular policies. That's what I was getting at in the demo. I was just saying that is the use of tools like Erwin by Quest, like other tools that are on the market is to be able to document that information and to make it available. So data supporting data policy is really important. Along that same line, Sue, this question came in the chat during your presentation. Can you see the column level lineage? Yes. Yep, I just don't, we don't start there because it can be pretty ugly sometimes. And that's just the way the reflection of the data as it grows over time and you change your business policies and your rules and things like that, it's gonna get complex. So we like to start at a more broad perspective of what are all the different systems that are involved with this policy and then drill down. And yes, getting down to the column level is very, very important because that's where you have that critical data that you know you have to be mindful of and proactive about as you go through your projects. Perfect, everyone's pretty quiet today. So governments have a long experience in making policies including data policy but how to trust that they have adequate data, intelligence, data governance, data quality, et cetera. Sue, I wanna let you hit this one too first, if you want to. Yeah. Yeah, the government definitely does have, I probably, a large and long experience with the policies themselves and the regulations. And I guess I don't really know how to answer this too much other than we do work with a lot of agencies where, and they're really, they have a lot of efforts on their way from a data governance perspective and a data literacy perspective, especially in the CDO arena in getting them more automated and more systematic in their approach to their regulations and it's really great to see. Okay, yeah, I see a lot of that same thing as well. And I think that data, knowing your data policy relating it to the data is extremely important when it comes to compliance. I mean, it's the reason why we do the things that we do most often. So where to start? We don't have a data policy and wanting to start a formalizing data governance in our organization. We run census and survey. So what's your advice? So we've done webinars on that whether or not a policy for data governance is necessary. And a lot of that, in my opinion, depends on the organization. If your policy driven, you know, I've seen other organizations develop guidelines, standards. There's a couple of great things about having a policy is that number one, you're not gonna get to the point where you have a policy unless your executive management has looked at that and has agreed to it and has put their name on it. So that's an opportunity to get them, they're not gonna assign anything that they don't really understand. And then applying, you know, you may have policies specific to specific types of data that have to do with certain compliance rules, regulatory rules, people need to know those rules because we can't, especially with the way they change, we can't be expecting them to stay on top of these things without any guidance and without any assistance. I think that too has a lot to do with data intelligence and that's where governance can be used to help to build data intelligence. Agreed, and another aspect of that is understanding the business rules versus how they're actually implemented. When you get down to that column level lineage, if you have a great lineage tool, you're gonna be able to see the actual, extract transformation and load rules and see if it's connecting or aligning with that actual business role. Alrighty, well, this does bring us to the top of the hour. Thank you all so much for this great conversation and presentations and thanks for our attendees for being so engaged in everything we do. Again, just a reminder, I will send a follow-up email by end of day Monday for this webinar with links to the slides and the recording along with additional information on the extra questions coming in. So thanks everybody, hope you'll have a great day and thanks to Irwin by Quest for sponsoring today's webinar and helping make it happen. Thanks y'all. Thanks Dave, thanks too. Thanks everybody. Thank you, it was fun. Take care everybody, thank you. Bye bye.


Hi, everyone. Thanks for joining us today. We're talking today with Metal Toad, Nathan Wilkerson, about securing Drupal and the tools to test it. Just a little bit about the Drupal Association. The Drupal Association's mission is to foster and support the Drupal community so we can collaborate together as we innovate the project. There are so many ways to help the community. We host Drupal.org and are building a tech team to improve the site. We provide grants for community members to fund ways to grow their community in the future of the project. Some of these grants are used for camps. Some of them are using the grant for a multi-city roadshow, evangelizing Drupal. We also host DrupalCon. We just had one in Austin, which brings thousands together to work on the project and bond as a community. We also provide scholarships to help community members from around the globe attend the event. And all of this is funded through our membership, our Drupalcons and our partners, just like Metal Toad. Next slide, please. Just some upcoming events. We have our next DrupalCon in Europe coming up at the end of September, beginning of October. We also have Global Training Days, which is a really fantastic program for training companies or community members that are interested in providing training to brand new Drupal students. So an introduction to Drupal, just growing the community globally and locally and providing low-cost or free Drupal training to our community members. You can find more information on the link below. And then our next webinar is July 15th. Magic Logic presents different approaches to developing Drupal websites. You can also see at the bottom for our webinars link that we are always putting on new webinars as well as recording all of our old webinars. So it's a great resource for you or any of your colleagues that are interested in learning more about Drupal from our supporting partners. Next slide. Great, thank you. And of course we have to mention our Supporting Partner Program. Metal Toad is a supporting partner and they help us do things for the community and help foster the project as well. So a big thank you to our supporting partners, especially Metal Toad and for doing our presentation today on Drupal Security. Next slide. Great, without further ado, this is Nathan from Metal Toad. He will be taking over the reins. Like I said, if you have any questions for Nathan, please use the Q&A window and I will interject as I can. Nathan, it's all you now. Thank you very much. Good morning to everyone who's joining us today. I'm Nathan Wilkerson, a little bit of background before we go on to today's presentation. Prior to my tenure here at Metal Toad, I was a network administrator where my tasks included numerous things, including hardware, security, network security, server security, PC and wireless network security. I started here and not long after we moved from web hosting to designing custom cloud environments and we brought up doing a security test package here. And that led me into application security and I just dove into it and it's been a passion of mine ever since. The basic security stack has three different groups. Your physical security is protecting your IT infrastructure locations. This is relatively simple to do. It's as easy as putting a lock on the door, either with a key or biometric or key card. Network security includes everything coming over the network. Most common practices involve firewalls, access control lists, encryption for wireless networks and that type of stuff. Those security threats are pretty straightforward and easy to do because they involve keeping people out of restricted parts of your infrastructure. Application security I find is always a little trickier because you can't just keep people out of the application. They actually have to be able to use it. And this makes finding the specific threats and vulnerabilities in your application much more important. Drupal has a great security team and they work to coordinate security issues and advisories. They produce documents on how to write secure code and documentation. But as you can see on this quote from their website, they generally don't check for security vulnerabilities in code that is contributed. They just coordinate the reports of bugs with the module developers to fix them. Here's a list of some of the common security threats found in Drupal. It's kind of hard to find a list of them because they're not well publicized. There's about two lists you'll find online. The main ones are cross-site scripting attacks, SQL injection and cross-site request forgery. We're not going to go into it too much about them right now. I just want you to see them and know what they are and we'll compare them to another list later. The other security organization I wanted to make sure to introduce is the Open Web Application Security Project or OWASP. It's an organization that is devoted to promoting best practice in web applications. To reach their goal they are promoting several tools, training best practices that go along with their security. One of the great things they do is they publish a top 10 threats facing the internet every year. The list shown now is the 2013 top 10 threats. When we compare them to threats facing Drupal we see overlapping results in red. As you can see these are threats that don't face Drupal but they face a lot of different web applications. And so it's very good to be able to know how to detect them and how to fix them. Luckily Drupal provides some great functions that if we use them correctly with best practice can prevent most of these threats. These functions will take a user's input, sanitize, check it before passing it on to the server to be used. So we all know now Drupal can fix these problems. If we follow the best practice we just need to be able to find the vulnerabilities so that we can get them fixed, patched and out to the user. So there are three tools that I found very helpful while starting to do some research into security. The first one here is Cali Linux Distribution. It's a distribution that comes with dozens of security testing tools. Including the other two I have listed here, OWASP, ZAP and Metasploit. It can come on a boot disk or be installed along the USB. It also has an EC2 AMI so you can spin up test servers quickly if you wanted to test out a bunch of tools. Metasploit is a tool that allows you to test servers for vulnerabilities. Known vulnerabilities are submitted and can be run against a server to see if the server has the vulnerabilities. The application works best for testing server OS patches and applications like Apache and MySQL patches to make sure they're present. The final tool is OWASP ZAP. It's a Zet Attack proxy that can be used to launch attacks, manually check sites, debug applications and used for continuous integration testing. It also has other great features that can be used in this like scripting, automated reports, stuff like that. There are a lot of great videos out there on ZAP. Just search for YouTube or their website. But I wanted to show you some of the basic features you can use now to start testing. Then you can go out and find more information if you need it. One thing that I found hard to find was the settings. By default, the scanner set will only find five requests to a server at a time. This is very slow for most setups and can lead to extended testing times. You would simply click the gear as you see on the toolbar right there. It's the same that's now on most Google applications. Then under the active scan, you can increase the bar to whatever fits your environment. It's not very heavy. I ran 20 connections against a local server with no problems of timed out requests or anything. Take some time to look at the other settings on the left. Spyder and Fuzzer have similar settings. And I believe there might have been others as well, but those are the three main ones you'll want to check. The most basic attack you'll need to do with this is an active scan. It's quick to start, but can take quite a while to finish. When you open the program, you'll see this Welcome Does It Attack Proxy screen. All you need to do is enter the URL you'd like to attack and press attack. You can see some of the results on the bottom of the screen starting to populate because it crawls your site finding all possible URLs before it runs the attack. The other good thing to note about the automated attack is it only stays in the domain you've specified by default. So if you have links to advertisements or your site redirects and it might redirect to production environment, it will recognize the domain change and it will just flag it as an out of scope URL and not check it. Once the spider is done, you can go to the active scan tab and see the request it is using. The table is great. It gives you the URLs. It's checking speed, size, and there'll be a flag on the right-hand side if there's any problems. Not only that, but you can click on a request that's been flagged here. See the HTTP request that was actually sent and the response. Then you can manually inspect it and see what exactly happened. As I first mentioned, performing a full attack can take several hours or days, depending on the size of the environment. In one instance, I ran it on a local dev for over 16 hours and it was still on the first phase of the attack. If you want to run a site, a test on a site or a specific feature, you can simply right-click on any one of the scan sites under the spider and do attack just on that one. It greatly increases it while allowing you to target specific aspects of your site. Active attacks are great, but they don't let you target the specific stuff you want to. To target, for this, you'll need to use a passive scan. It's very simple to set up. All you need to do is set up your browser as a proxy.  As soon as you do that, you'll start seeing other sites appear in a wasp. Because it picks up all web traffic, it's best to turn off all unneeded tabs and web browsers while this is going on. Otherwise, your reports will get very cluttered and it'll be harder to find stuff. One of the best aspects of the passive attack is it allows you to set breakpoints in the proxy. If you simply press the red X, you can enter a string based on URL, headers, or other criteria. And whenever the wasps app sees that, it'll freeze the response or the request before it gets sent to the server. You can then click on it, look at all the content being sent to the server, evaluate it, or change it. Then you can press the next button or play button to step through or submit the request automatically. The other really nice thing this allows you to do is to fuzz a certain field to test for cross-site scripting attacks and SQL injection. The active attack does this automatically as it detects a field as part of its attack. But like I said, that takes a while and fuzzing specific fields that are new to a form is often better to test that function instead of spending days testing everything over again. So to perform a fuzz attack against a specific field, all you need to do is look at any request you've sent, or you can start a new request by clicking on it with a breakpoint. Right-click on any of the fields you saw in the request, select the fuzz option, select the fuzz category or type of attack you want to perform. In here you see I'm doing an SQL injection. And then you pick the fuzzer attack and these are a predefined list of attacks. There's a lot of different options you can find out there for different new ones. Then you click fuzz and your fuzzer tab will automatically start populating with its attacks and the results of the attacks and what it was sent in the string. After you've been doing some passive or active attacks, you will start seeing alerts. A lot of them are header problems that they recommend fixing but are pretty low. But it's always good to be able to see what you're looking at when you see one. So you can click on the alerts tab. There's also flags in the bottom left corner of the screen showing you the rough counts so you know if there's anything critical popping up. This allows you to dig into a request. As you can see here on the screen there's the description solution and reference tabs. That gives you that information but if you actually clicked on it, you could actually see the request that went and the response it got. So once again you can dig into it, see what's causing the problem, know if it's a false positive and then correct the problem if it's not. So scheduling these can be very time consuming and they can fall by the wayside doing them on a tight timeline because of the time they take to do this in part. One of the best ways I found to avoid that is to try to integrate it into a continuous integration plan. The best way to do this is if you already have one, setting Zap up as a proxy while you're testing will allow you to see the results as they come through your test. It'll check for the headers and bad fields and other problems like that. Here at MetalTode we use B-hat test and this works great with it. It just intercepts all the data and checks it. It also allows you then to see what is found important on your site and check those specific URLs for the problems as opposed to scanning the whole site over and over again. With the reporting and saving options, this also allows you to see the changes over time on your site. So you can see the URLs grow or change and the fields grow and change and the security of your site as you make changes to it over time. I started looking at security because it was an important new service we were offering at MetalTode. But the more I looked into it, the more it becomes apparent that everyone on a project should be concerned with security. Developers should not only write secure code, but these tools allow them to debug their code more efficiently by seeing what's being sent and not having to put in code into their code to check for variables and stuff. For QA it allows you to script in many languages on the back side. It even has its own language for writing your own automated test if you don't have a system already set up. These tests are great for being able to reproduce errors and enhance your developer so they can see the problems that are actually happening, see the bad headers, see the cross-site scripting vulnerabilities, that type of stuff. For DevOps, it allows security analysis and testing, finding vulnerabilities before an attacker does so that you can secure your sites for your clients. It also allows us to quickly debug sites when clients are having problems or seeing different headers that we expect to see. It's because of this that we should adopt a more security-oriented culture of what we develop code, either open source or otherwise for your companies. It's a great way to... the open source culture, sorry, the security culture is a great way to promote security on the web as a whole so that we don't have things like Heartbleed coming up all the time. We don't have to worry about the NSA. We're making sure everything's out there secure and other people can't see it. Anyone have any questions that we haven't covered so far? Nathan, how do you feel like the security process works? What kind of timeline are you looking at for a developer to use some of these tools? For the developer, it would be more of a line of not specifically testing your product but if you left it on as a proxy in the background while you're going through and doing your development work, it would pull red flags to the surface and it would also allow you to debug it a little faster. So if there's an obvious problem, it'll detect it and let you know right away as opposed to having to go back and retest it later. And where can you do some further research on how to enable these tools? The OWASP ZAP website is a great source. There's also dozens and dozens of YouTube videos about how to use... their program. Cali's Linux has YouTube videos and so does Metasploit as well. Perfect. I do have a question. When used as a CI function, does ZAP add a significant time lag? No, it does not. We've tested it here on a couple of sites. We haven't integrated it to our process 100% yet. It took a few more seconds to run tests that take a half hour or so so you might look at another minute or so on the testing. Great. Thank you. Any other questions? We have another one. When running ZAP, will it affect the overall performance of the site or server? If you're running it on the same server you're testing, it can cause a significant load on the CPUs. At that point, if you're running on a different server, it depends on how many active connections you're running. Obviously, if you're running 40 or 50 active connections against the server that only has 20 or 30 processes available, it's going to start tying up all your processes and cause a performance problem. But if it's on a server with a lot of available processes, it might slow it down a little as it processes more intensive CPU requests, but nothing significant. Any other questions from our audience? Well, you answered everything, Nathan. We don't even have any questions. That's awesome. Everyone seems to have liked it in our comments, so great. Thank you guys for listening today. Next slide, Nathan, please. Just a reminder of some of our upcoming events. We mentioned at the beginning of the webinar, we have Trupulcon Amsterdam coming up. We have that information listed below on our website, Amsterdam2014.trupul.org, and we look forward to a lot of really great conversations with speakers and information coming your way about the latest Trupul things. We also have Trupul Global Training Days coming up. You can learn more about that. We've had a wonderful, overwhelming group of participants this year, and I know that we'll continue to grow our Trupul community by providing Trupul intro classes for our local communities and global community. Our next webinar, as a reminder, is July 15th. MagicLogic is presenting different approaches to developing Trupul websites, and you can see all of that information on association.trupul.org, and we'll have a list of previously recorded webinars, including this one in a couple days. Next slide, please. Great, and just as a reminder, look at our Trupul Association organization and individual memberships. They really help us as well as supporting partners and technology partners to foster the project, help us fund more scholarship and grants and servers, and, of course, add back to the community and really grow the Trupul project. So take a look at that and see if that's something that you're interested in or your organization is interested in as well. So it looks like we don't have...


My name is Sam Battenin and I am the author of Malignant Self-Love, Narcissism Revisitor. We know what abuse and torture do to the victim's soul, to her spirit, to her psychology. But what are the effects on the victim's body? There is one place in which one's privacy, intimacy, integrity and inviolability are guaranteed, and that is one's body. The body is a unique temple, it's a familiar territory of sense and personal history. The abuser invades, defiles and desecrates this bodily shrine. He does so, usually, publicly, deliberately, repeatedly, and often, sadistically, and sexually, with undisguised pleasure. Hence, the orcavasive, long-lasting, and frequently irreversible effects and outcomes of torture and abuse. In a way, the torture victim's own body is rendered her worst enemy. It is corporeal bodily agony and pain that compels the sufferer to mutate her identity, to fragment her ideas and principles, to crumble. Very few people can withstand pain. The body becomes the accomplice of the abuser, of the tormentor, an uninterruptible channel of communication of pain, a treasonous, poisoned territory of writhing agony. This fosters a humiliating dependency of the abused on the perpetrator. Bodily needs denied, such as sleep, toilet, food and water, are wrongly perceived by the victim as the direct causes of her degradation and dehumanization. As the victim sees it, she is rendered bestial, not by the sadistic bullies around her, but by her own flesh and blood. Beatrice Parcellidis described this transmogrification in her Ethics of the Unspeakable, Torture Survivors in Psychoanalytic Treatment. She says, As the gap between the I and the me deepens, dissociation and alienation increase. The subject that under torture and abuse was forced into the position of pure object has lost her sense of interiority, intimacy and privacy. Time is experienced now in the present only, and perspective that which allows for a sense of relativity is foreclosed. Thoughts and dreams attack the mind and invade the body, as if the protective skin that normally contains our thoughts gives us space to breathe in between the thought and the thing being thought about and separates between inside and outside, past and present, me and you. This skin, as though it were lost. Repeated abuse has long-lasting, pernicious, traumatic effects, such as panic attacks, hypervigilance, sleep disturbances, flashbacks, intrusive memories, and suicidal ideation. Diseases and survivors experience psychosomatic or real bodily symptoms, some of them induced by the secretion of stress hormones, such as cortisol. So there is increased blood pressure, racing pulse, headaches, excessive sweating, myriad, self-imputed or as I said real diseases. The victims endure shame, depression, anxiety, embarrassment, guilt, humiliation, abandonment, and an enhanced sense of vulnerability. See PTSD, complex post-traumatic stress disorder, has been proposed as a new mental health diagnosis by Dr. Judith Herman of Harvard University to account for the impact of extended periods of trauma and abuse. In stalking and overview of the problem offered by Karen Abrams and Gail Early-Crobinson in 1998, the author's right. Initially, there is often much denial by the victim. Over time, however, the stress begins to erode the victim's life and psychological brutalization results. Sometimes the victim develops an almost fatal result that, inevitably, one day, she will be murdered. Victims unable to live a normal life describe feeling stripped of self-worth and dignity. Personal control and resources, psychosocial development, social support, prim morbid personality traits and the severity of the stress may all influence how the victim experiences and responds to it. Victims stalked by ex-lovers may experience additional guilt and lower its self-esteem for perceived poor judgment in their relationship choices. Many victims become isolated and deprived of support when employers or friends withdraw after also being subjected to harassment or when they are cut off by the victim in order to protect them. Other tangible consequences include financial losses from quitting jobs, moving and buying expensive security equipment in an attempt to regain privacy. Losing homes and jobs results in both material losses and loss of self-respect. Surprisingly, verbal, psychological and emotional abuse have the same effects as the physical variety. Abuse of all kinds also interferes with the victim's ability to work. Abrams and Robinson wrote in another article titled Occupational Effects of Stalking in 2002. Victims stalked by a former partner may affect a victim's ability to work in three ways. First, the stalking behaviors often interfere directly with the ability to get to work, for instance, for example, flattening tires or other methods of preventing leaving the home. Second, the workplace may become an unsafe location if the offender decides to appear there. Third, the mental health effects of such trauma may result in forgetfulness, fatigue, hard concentration and disorganization. These factors may lead to the loss of employment, with accompanying loss of income, security and status. Still, it is hard to generalize. Victims are not a uniform lot. In some cultures, abuse is commonplace and accepted as a legitimate mode of communication, the sign of love even, caring, and a boost to the abuser's self-image. In such circumstances, the victim is likely to adopt the norms of society and avoid serious trauma. Deliberate cold-blooded and premeditated torture has worse and low-lasting effects than abuse meted out by the abuser in rage and loss of self-control. The existence of a loving and accepting social support network is another mitigating factor. And finally, the ability to express negative emotions safely and to cope with them constructively is crucial to healing. Typically, by the time the abuse reaches critical and all-pervasive proportions, the abuser had already, spider-like, isolated his victim from family, friends and colleagues. She is catapulted into another land, cult-like setting, where reality itself dissolves into a continuing nightmare.  In an effort to regain perspective and avoid embarrassment, the victim denies the abuse or minimizes it. People wonder that survivors of abuse tend to be clinically depressed, neglect their health and personal appearance, and succumb to boredom, rage, and impatience. Many end up abusing prescription drugs, or drinking, or otherwise behaving recklessly. Some victims even develop full-scale post-traumatic stress disorder. According to popular misconceptions, post-traumatic stress disorder, PTSD, and acute stress disorder, or acute stress reaction, are not typical responses to prolonged abuse. They are the outcomes of sudden exposure to severe and extreme stressful events. Yet some victims, whose life or body have been directly and unequivocally threatened by an abuser, react by developing these symptoms. PTSD is therefore typically associated with the aftermath of physical and sexual abuse in both children and adults. And this is precisely why Dr. Herman suggested the diagnosis of C PTSD, complex PTSD, as we discussed earlier. So to summarize, victims are affected by abuse in a variety of ways. Ones or someone else's looming death, violation, personal injury, or powerful pain are sufficient to provoke the behaviors, cognitions, and emotions that together are known as PTSD. Even learning about such mishaps may be enough to trigger massive anxiety responses. The first phase of PTSD involves incapacitating and overwhelming fear. The victim feels like she has been thrust into a nightmare or a horror movie. We sometimes call it gaslighting. She is rendered helpless by her own terror. She keeps reliving the experience through recurrent and intrusive visual and auditory hallucinations known as flashbacks, or while she sleeps in dreams. In some flashbacks, the victim completely lapses into a dissociative state, and physically reenacts the event while being thoroughly oblivious to her whereabouts and surroundings. In an attempt to suppress this constant playback and the attendant exaggerated startled response jumpiness, the victim tries to avoid all stimuli associated, however indirectly, with the traumatic event. Many develop full-scale phobias, agoraphobia, claustrophobia, fear of heights, aversion to specific animals, objects, modes of transportation, neighborhoods, buildings, occupations, weather, and even people. Most post-traumatic stress disorder victims are especially vulnerable on the anniversaries of their abuse. They try to avoid thoughts, feelings, conversations, activities, situations, locations, or people who remind them of the traumatic occurs, these are known as triggers. And it is this constant hypervigilance and arousal, the sleep disorders, mainly in Sonia.  Most patients manifest protracted periods of numbness, automatism, and in radical cases near-catatonic posture. Response times to verbal cues increase dramatically, awareness of the environment decreases, sometimes dangerously so. The victims are described by their nearest and nearest as zombies, machines, robots, or automata. The victims appear to be sleepwalking, depressed, dysphoric, unhedonic, not interested in anything or they can find pleasure in nothing. The victims' report feeling detached, emotionally absent, estranged, and alienated. Many victims say that their life is over and expect to have no career, family, or otherwise meaningful future. The victims' family and friends complain that she is no longer capable of showing intimacy, tenderness, compassion, empathy, and of having sex due to her post-traumatic fugidity. Many victims become paranoid, impulsive, reckless, and self-destructive. Others somatize their mental problems and complain of numerous physical ailments. All of them feel guilty, shameful, humiliated, desperate, hopeless, helpless, and hostile. PTSD need not appear immediately after the harrowing experience. It can, and often does, delay by days or even months. It lasts more than one month, usually much longer. Sufferers of PTSD report subjective distress. The manifestations of PTSD are ego-dystonic. They don't like it. Their functioning in various settings, job performance, grades at school, sociability, deteriorate marketing. The DSM Diagnostic and Statistical Manual criteria for diagnosing PTSD are far too restrictive. PTSD seems to also develop in the wake of verbal and emotional abuse, in the aftermath of drawn-out traumatic situations such as a nasty divorce. Hopefully, the text will be adopted to reflect this said and ubiquitous reality.