Welcome to the Single Guy channel. I'm Lloyd and today we're gonna be talking about a subject that I get asked a lot and it's not necessarily the subject that I want to talk about but I get asked this all the time and there's Lloyd What conversation topics lead to sex? Like what sort of things should I talk about in order to get this girl to want to sleep with me? Okay, so first of all the thing that you should know and this is like the basis of my entire video is that it's not the Conversation that leads to sex.  I'm gonna get laid. Um, well, you're looking in the wrong spot But I can't give you some topics that in general I find that I've talked about them with people and more often than not they'll lead to sex But it's again, it's not the conversation. It's not in the way that you guys think so the topics that I would say that generally the lead to sex are like alcohol recreational drugs Traveling partying hooking up like crazy stories All of these things I would say they're the subjects that I talk about that more often lead to sex than other subjects The reason why they lead to sex is because if a person is really comfortable talking about those sorts of things or she has a lot of stories associated with them or she's really into that sort of stuff Then she's probably open to hooking up with a random guy and that random guy could be you So it's not the conversation topic that led to sex again It was the person having the conversation that led to sex if a girl's really really open to talking about that sort of Stuff she probably does that a lot. She probably parties a lot and she's probably hooked up with guys before She'll hook up with guys again So if you think that oh if I bring up these topics is gonna make her want to sleep with me No, you just found a girl who's more open to doing that sort of stuff And if you're looking to hook up and find a girl who's down to hook up with you as well And that could be a good way to find that girl like if a girl it has all tons of party stories that she loves talking about Yeah, that girl's probably open to hooking up and if you stick around her long enough She might hook up with you so this is what kind of I think people are talking about and so sometimes people say well Okay, well talking about hooking up talking about partying talking about all that stuff that's gonna lead to talking about sex, right? Well, yeah, it could lead to talking about sex You could start talking about sex stories and exchange them and tell them to talk about like what the two of you like and that sort Of thing and I've had those conversations a lot.  You're getting the girl more turned on She's getting more aroused because she's thinking about sex when you're talking about it You start thinking about you're thinking about it too So you're both getting more aroused as you talk about it Which is awesome and it would be great if you had some if you guys were alone And it was just the two of you and she was comfortable with you But a lot of times those things aren't happening at that moment And the biggest thing here is the comfort area because if you don't if you know anything about going out Anyone who's gone out a lot will tell you that comfort is actually a little bit more important than Attraction and how horny the girl is okay If you have a place to just have sex with her right then yes sure it can work But in order for you to have sex with a girl a lot of times you need to get her in a cab You need to have a drive back to your place.  They're not they're not interested in them So when I talk about these subjects as you can see I'm trying to look for the question within the question The reason why I think guys ask me these questions because they feel like the conversations that they're having they need some magic topic to take The conversation to the next level to take it from this like normal boring platonic thing to something That's gonna be sexually arousing that's something that's that's actually gonna turn her on and make her want to sleep with you And I've already done a video about this because that's basically flirting But the thing about flirting guys is that it doesn't need a single subject or it doesn't need a particular Topic for it to lead to sex.  They do not care if it's this topic or this topic They care about the emotion behind the words and if you have strong emotion behind your words That she's gonna feel that emotion as well And if you communicate the right emotions to her then she's gonna feel those emotions Towards you and you know be turned on by you And that's really what you're looking for you're looking for someone who's gonna like you For for who you are not just because you talked about a certain conversation topic But because you're expressing yourself in the right way So if you want to check out that video where I talk about how to go from a normal boring conversation To sexually arousing I have that video just search for it On my channel it should be there I also came up with a video with a list of ways to tease a girl's he teasing is huge being able to tease them in the Right way it makes it should make them feel girly. It should make them feel good. So I Have tons of examples where I talk about that in those videos as well But one thing that you guys can start doing right now is just play playful games, so Todd and a lot of these other guys They do like playful assumptions or they have little lines that you can use which is like oh you and me like we never get Along we're too alike. We'd be at each other each other's throats at all times like it just wouldn't work out or You look like trouble like you're bad news for me.  So you got to put in some time But that's that's enough to get her to like me so a lot of times I see you guys talking about themselves a lot I see a lot of guys like expressing and they just want to communicate all of who they are to a person and they feel like if they Show everything that who they are to the person then they're just gonna like them well women don't really respond to that They maybe just tell her one or two things about yourself. You don't need to reveal everything, but keep a lot of stuff a mystery Okay, she's gonna be more turned on by your confidence by by you expressing yourself Then the actual stuff that they're telling her and on top of that you people usually don't believe what people tell them because a Lot of times we tell people what we want them to hear about it It's not so much who we actually are you are where you're you are with your actions and what you do in life And so it's gonna take her a little bit of time to figure that out And so the way you talk about things is what she's gonna be looking for not so much the content of what you're talking about So again, I don't think this is gonna be the Answer to the question that you guys wanted I gave you a few conversation topics where you can see if the girl is more open to hooking up or having sex But it's not necessarily the conversation topic that leads to sex. It's the person having the conversation Thanks a lot you guys. Good luck out there


Going on everyone Sam here with late sports cards. We're in two boxes sports card almond act multi sport personal box edition volume six For HB. We've got box number 52 and sixty six sorry 52 ice That is the Sterling silver to 100 Jackson holiday Grats on that one there rich. That is nasty 45 of 100 23 Bowman Stern looks clean too, man. Looks super clean Potential grading candidate right there. We'll take that all day. Jackson holiday. Yeah, he'll uh, he'll work for sure and box 66 Stone's Carl Anthony Towns 24 of 25 most points in a game in club history. Don't know what year that's from unfortunately But that is of course from immaculate collection.  Love me some Carl Anthony Towns Love the milestones on card. Congrats again rich get those right out to you, buddy. Very nice


So please give a warm welcome for Jeff Scott. Welcome, Jeff. Thank you. And just so you know, I play bass guitar in a band, so maybe we can get something going here in Austin, make a few dollars on the street where we're going. So good morning, everyone. I know I've already run into a bunch of people I know. It's always fun to come to conferences and kind of get back in touch with people that you haven't seen in a long time or heard from in a long time. So and for those of you I haven't met, I hope to meet you later today. I'm going to start with why I'm here, because I'm not going to talk about models and I'm not going to talk about standards, at least only tangentially. I have been in the architecture space for over 20 years. I spent the first 10 years in what you would think of as traditional enterprise architecture, doing technology things and helping architecture teams start up and all those kind of things. And I've spent the last 10 years in business architecture. And there, I honestly don't do much architecture, which is maybe a bad thing. I don't know. What I do is I help organizations design, implement, manage, grow business architecture practices. That's fundamentally what I do. And every year I speak to hundreds of business architects in one way or another. And when I was an analyst at Forrester, I went to Forrester in 2007 to build their business architecture practice and ran that for four years. There I talked to thousands of people that were either business architects or wanted to be business architects. So the point to all that is, is I may have some radical ideas here, but they're well founded because they're rooted in a perspective that's driven by the marketplace and what's going on out there. So while you may not resonate with some of this, I think it's good to hear and I hope you get something out of it. I totally avoid talking about what business architecture is because we're all going to argue about it if we do that. But I would want to say just the kind of level set you here is this. I think there are a lot of definitions out there. I don't know what your definition is. I think there are a lot of definitions out there that kind of talk about business architecture as a blueprint, as a model of the organization. And I think I'll just be very clear. I think this is exactly the wrong way to think about it. Because when we do that, we narrow what business architecture is and we certainly narrow who we are as business architects. So for me, it's a practice. It's a way to do things. It's an approach. It's a craft. Whatever, however you want to scale that, but the idea to me behind business architecture is how do we get the ideas, the goals, the strategies, the changes we want to make in our company? How do we get those done efficiently and effectively? And how can we help the organization do that? So just kind of a little level set. And what I want to do is talk about, start with the reality today. And I'll warn you, it isn't pretty. But before I go there, I want to give you some insight into what these are for us. Is that me crackling there? Okay. First is, let's make sure I'm all tight here and I think I am. Those are some of our best and brightest folks. We do not take the guys that can't cut it as a business analyst or as a project manager and say, okay, let's put them in architecture. Get them out of the way so they can't do much harm. Yep. Okay. And now we're really going to have a problem because I'm not ambidextrous enough to hold a mic. So the point is we're a bunch of smart people. We also have the latitude to build business architecture in the image we want. Unlike other organizations, when you go to work for somebody, the chances are really high. They know how to do your job better than you do because they were doing it for years and years and years. They got promoted to be manager. You come in, they know how to do what you're doing. Business architecture? Not a chance. You're CIO? For most of you, clueless. Your business guy is clueless. Whoever's running business architecture programs at almost any company is working for somebody that does not know anything about business architecture. They do not know how to do it. They haven't done it for 10 years. There's almost nobody that's done it for 10 years, by the way. So we've got a lot of latitude, a green field, to make it like we want to make it. In addition to that, we've got plenty of time. Now we don't have forever, but we do have a lot of time because it's not a project. People are saying, we know you don't know what it is. Go start it up. Go figure it out. We have some time. Yes, we probably can't take years and years, but we certainly have plenty of time to put this together. And in addition to that, our companies need us. They need business architecture desperately. Over half the world's CIOs believe their business model, their fundamental business model will not sustain them for five years. Think about the level of change we're talking about here that our business executives understand. So we have all these things going for us, all these things. And yet, business architecture teams are struggling for success. So when I looked at this set of facts, and I started thinking about, okay, why is this? It led me to some pretty sobering things. But first let's look at where we really are. 60% of our architecture programs fail. That's not my opinion. That's Forrester Research. A couple of years old, maybe a little bit better than that, but two years ago it was 64% failure rate is what they were saying. And when I was at Forrester and we were looking at failure rates of architecture teams, it was always in the 40% to 60% range when we saw that. So that to me feels about right. So 60% failing, that means they are going away. They're not just sitting there working. 20% are struggling for success. They're working hard. They're trying to get there. The organizations in their first year or two, or in fact, you might call it year zero while they're trying to even get started, are struggling. And then you've got about 15% that I think are good journeyman architects. They're creating models. They're adding value. Somebody's recognizing that value. They are making some difference in their company. They have a possible future. And then 5% are fulfilling what I think of as the architecture promise, what we all think that this should provide for our companies. Now, the 5% is actually being very gracious. I put that as 5 because my peers just beat the hell out of me when I kept saying 1. It's probably closer to 1 or 2% that are really out there doing that. So look at that data and tell me if that doesn't scare you. Because it should. Because you can be sitting there saying, well, I'm smart enough that it's not going to be me. Well, it's very likely going to be you if you do this. Because there's a lot of stuff stacked up. So the question is, what's going on here? How many of you recognize that figure? Boy, OK, a bunch of young guys. That's what I like. That is a figure from late 60s, 70s comic strip character. And his name is Pogo. He is a possum from the Okefenoke swamps, and he's a philosopher. I know it sounds strange, but it's true. And out of his years in the comic strips, he had one indelible quote, which is, we have met the enemy and he is us. And I think that quote fits for the business architecture profession today. So what's going on? One is, what I look out there and talk to business architects, particularly those guys who are struggling, now I have a group of people I work with that are very successful and we're going to talk about how they're different. But when I look at the masses of business architects out there today, what I see are these kind of things. First is we want it to happen our way. We've got models in those models. They are correct, by the way. They are factual. They are truth. They are it. This is the way to do it. And if you want to change that model one out, you're wrong. We want it to happen our way. We ignore culture and context. Do you know what the number one challenge for business architecture success is? Defined by first research, I mean, you know what the number one challenge is? Culture. And yet, we don't pay any attention to that. Even though we have crossed the Rubicon, half of business architects now report outside of IT. They are now reporting to business units, strategy units, operational units, planning groups, all kinds of stuff. But they're reporting, in fact, a number of them are starting to report to the CFO, which I find fascinating, because that's the guy that controls all the money. But they're still overly technology-centric. We're still looking at the world largely through technology, and that's because most of us came from technology. We look at efficiency over effectiveness. Same reason.  Be cheaper, be faster, be more efficient. And so we think they really care about efficiency, and they don't. They want that money for themselves, so they can squander it away, trying to be effective to make their strategies happen. So efficiency is not what drives them. We want control over what's going on instead of collaboration. The way we're going to succeed here is collaborate what most people want to do is control. I want the CEO to tell these guys, they've got to follow my model. They've got to do it my way. Or I want to put in a governance mechanism to make this work. That's not going to cut it. Focus on models rather than results. Tons and tons of modeling going on here. You guys do a lot of modeling. We need good models. We need good standards. But as architects, we've got to focus on results first, models second. And I think the bottom line is we'd rather be right than successful. We know how it should be done if those business guys over there don't understand it, shame on them, because we're right. So I think this is the kind of stuff that I'm seeing all the time here. So I'm giving a note to the guys in the back. I'm not seeing the timer up here, which would be helpful because I didn't look at my watch. And I'm going to run over. Here's where we are on the global landscape. If you can read this, and I was talking to Lynn last night, I always have these, in fact, we talked for what? Three hours in the bar last night? Two drinks, and Lynn and I, man, you just don't know what's going to happen. Here's what I see out there when I work with architects.  And largely, they're focused on IT-ish kinds of issues. That's not a bad thing. That's just where most of us start. But that's where they are. In the middle of the pack is where I see those journeymen, architects that I talked about that are delivering value. And they look different. This is not a maturity curve here. These are just attributes of different groups of people and how they look at the world. And when you look at the guys over on the far right-hand side, those very, very few guys that are really, really excellent at doing this, they're even more different. And so what you see here are things like, over on the left, I talked about culture. We ignore culture in the beginning. Just not my problem, not going to go there. By the time these guys have been successful, what you find is they've figured out we have to align to the culture. We can't fight it. We've got to figure out how to align with it. And then when you look at the really successful guys, they're challenging the culture. They're saying the culture is holding us back from doing what we need to do. We're going to challenge that. And we're going to help the organization change the culture or mitigate it, get around it, or do something. Same way about credibility. When we start off, we have very little credibility. As technology guys, we have huge credibility with other technology guys. But when we start looking at the business, we don't have much credibility because we haven't worked with them. By the time I look at the guys in the middle who are being pretty successful, they've established individual credibility. They don't know much about business architecture, but they know Susie really knows what she's doing. Get her over here to help us. And then when you look over at the right, what's happened is they've transferred that credibility into the practice. So it's now people are saying, I need a business architect. Here's an interesting thing. Because we look at this curve and we say, wow, it must be really hard at the beginning because all these guys struggle, 60%. Fail, all that. No, that's the easy part. What happens is it gets harder and harder as we go. And so that's why when you look back here at this curve, what you see is this pool of people in the middle that are doing really good, but they have an enormous challenge in front of them. And most of the difference there is that, what got you here won't get you there. Doing some good efficiency work will get you started, but you can't hang on to that very long. Being really good at modeling and describing is really good stuff and you can get started that way, but it's not gonna take you to the end. It's a very different set of skills. It's a very different set of activities that move us into that excellence view. And by and large, it has little to do with what architects think about today. We'll talk about that. A lot of it is overcoming politics and culture and organizational context stuff. And what I hear a lot is, well, that's not my job. My job is to lay out the models and to describe how the organization works and do all that, those executive guys need to fix the culture. Well, true, you probably cannot change the culture, but you better figure out how to succeed in it. Because you can do that. And that's a pretty big challenge. Raising executive collaboration. I don't do a ton of work, but I do a moderate amount of work with executives.  And so part of what we've got to do is bring that group together. And I think we have the tools and the techniques to do that by showing them how we can work together to succeed better. But that's a big challenge to get over there to the right. Implementing top-down strategy execution. I'm gonna talk about that much more in a minute because that is the key, I think, for our business architecture success. Broad, senior-level advocacy. I talked to so many guys that are like, yeah, yeah, we're trying to get the CEO support, trying to get the CEO support. I'm telling you right now, you don't even want the CEO's support. It's almost a death nail for you to get that because he or she is not gonna be around as long as you are. And what happens to the guys who do get senior-level support like that is they get lazy. They depend on them to push. What you need is a broad level of support across a wide group of senior managers. That's how you exist for a long time. I mentioned before, shift this individual credibility to a practice credibility so that what happens is the organization is now seen as essential to the company.  And that's a big challenge, by the way. That's one of the biggest challenges I see in business architecture groups because here's what happens. Think about this. You guys all know this. You're all there. I have a ton of personal credibility because I go and I work with you. I solve your problems. You love what I do. It's all great. And when you have a problem, you say, call Jeff. But if I want business architecture as a practice, as a profession to succeed, I've got to give that up. Personally give that up. And say, no, no, I'm a business architect. You don't necessarily need me. You need one of us. And that is a very, very hard thing to do. Which, incidentally, fuels part of the problem out there which is why business architects don't move around much. A huge issue trying to hire experienced business architects and part of the reason is, A, you don't have anything to offer them. There's not a big enough hierarchy here that I can go from, oh, this level to that level by changing jobs. But the second thing is the successful guys know they're successful because they have business relationships and if they go to a new company, they give it up. They don't want to do that. So you have a very hard time sucking successful business architects out of companies because of that. We need a very strong consulting engagement approach. At the end of the day, when you look at those guys on the right, they're consultants. They happen to use business architecture as their major tool, but they're consultants. They may call themselves business architects and they may not. They're largely using architectural techniques, methods, tools, models, standards, all that good stuff, but they're consulting. Competition, another big challenge for business architects, particularly as they become more and more successful. There are other organizations in the company that jump up and say, whoa, whoa, whoa, wait a minute, you're doing my job. Project office, strategy, customer experience, all these guys that we collaborate with or should collaborate with, all of a sudden they pop up and say, wait a minute, you're kind of challenging my role here. And when I talk to people about stakeholder analysis and stuff, I try to get them to understand, yes, we have customers as business architects. We have investors as business architects and we have competitors and we better figure out how to deal with those guys. Hiring and developing the right staff, that's, again, very difficult to do. But I think the bigger thing here is we have to think bigger. We have to see our role beyond good modeling, good description, good recommendation. We've got to see ourselves as big change agents in the world. And when I talk to one of the biggest things that differentiates those struggling guys from the successful guys is they have a leader who is thinking bigger about what business architecture can be. And you might look at it and say, holy crap, that guy's out of his mind, he'll never do that. That's okay. He might or might not. But at least he has a vision that this thing can be bigger than what it is today. And I think if I had to give one piece of advice to business architects, it would be think bigger about who you can be, because you can be a lot bigger than you think. So what opportunities do we have? And I think we have enormous opportunities. So I'm only gonna talk about a couple here, but I think they're big ones. Kind of back to the definition. Well, there's a lot of words here. I'm sure you guys will get these slides so you can read this. Because again, my definition of business architecture changes, oh, I don't know. Not monthly, but twice a year. Because I learned something. I mean, again, I'm talking to all these different architects and I hear what they're saying, I hear what they're doing, I'm like, oh wow, I never thought about business architecture in that light, we're this. But I think the bottom here is the important part. Our ultimate goal is not to model the organization. Our ultimate goal is not to make it efficient and effective, though that helps, all those things help. What we need to do is unlock the organization's capacity to do more, not more work, more change. How do we unlock the capacity in the company so that it can move forward and be successful? And if we can do that, we have done something nobody else can do. One of the other things I tell business architects is this, efficiency work is good work. Don't get me wrong, operational improvement is good work. God bless you, if that's what you wanna do, we need it, good stuff. There's a lot of people in your organization that can do that work. You have to be relatively smart, you have to be pretty analytical, you have to be very methodical. You can get there and do that work. There are not many people in your organization that can drive change, there are not many people in your organization that can enable strategy. So the big opportunity is trying to figure out how we unlock organizational capacity. Nothing's other guys worry about how to be operationally efficient. You can do more. I do think strategy execution is the big opportunity for business architects. There's a bunch, but I think this is the biggest one, and this is why. So an HBR study a few years ago, 37% of executives said they are really good at strategy execution. So for those of you who haven't had your second cup of coffee yet, 63% think they're mediocre or worse. Okay? Now these are the guys who are in charge of strategy execution. And they think they're companies or mediocre or worse. Robert Kaplan from the Balance Scorecard book says 95% of employees in most organizations do not understand the organization strategy. The survey from HBR said 53%. Pick whatever number you want. It ain't good. People do not know what's going on. And more current 70% of organizations don't link their strategic priorities with their budgets. Now, let me see here. How does that work? If I'm not spending money where it matters, how am I gonna get there? And I think, so when you look at this picture, there is a huge opportunity. So again, when I look at those 15% or so of business architects who are succeeding, 95% of them are working on that problem. They may or may not have it solved. Most of them don't have it completely solved. Every one of them is trying to fix this problem because they have figured out that's where the money is. That's where success is. Here's why. And this is kind of my rendition of why we have that problem. And most of us do. An executive has a bright idea. And if you haven't figured it out, all executive ideas are bright ideas. And what he does is he calls his staff around or his planning group or whoever he works with and they discuss this idea for a day or two or however long they discuss it and they kind of walk out of the room with, yeah, let's go. So if there are five, and I'm just making this up to have a nice little modeling example. If there are five people around the table, here's what happens. Every one of them interprets the conversation slightly differently. Let's just say 5%. And originally when I made this model, I thought, no, 5%. Maybe that's too much. Maybe it's two. Then I started talking to people. They were like, no, man, it's more like 10 or 20. The problem is it's not the same 5%. It's not like somebody coughed in the room and we missed some important statement that the CEO made. It's that, well, I interpreted it a little different. You interpret it a little different. You interpret it a little different. And so we all walk out of there with a slightly different view, which means we're about 75% coherent on what the goal is. That's on day one. And it only goes downhill from there, guys. Because what happens is every one of those managers goes to their staff. They translate what they heard. Their staff reinterprets, has the same problem, goes down, translates it to their staff. They reinterpret, have the same problem, and this continues on. You all have experienced this. Or most of you have. In grammar school, you played a game called whispers or telephone, where I whisper in his ear some statement, it passes around the room and it comes that way over here and it's totally garbled and it's hilarious. Except it's not funny when it's your corporate strategy. And that's exactly the way it works. So what we don't have is a structured way to get from strategic intent to strategic execution. When we look at the processes in our company, like order to cash, concept of product, all that stuff, we have very, very well-defined, articulated, executed processes.  And in fact, when we look at what I think of is kind of support processes like order office supplies, reviews, those kind of things, you still have pretty well-defined processes. Strategy, execution, I'm going to bet not 10% of you. Of anything written down. When I talk to executives, here's what I show them. Here's how you order post-it notes in your company. It kind of goes through, you got to check the warehouse to say, do we have post-it notes? Because maybe we don't, we got to go buy some. Oh, and oh, by the way, you might be trying to buy a million dollars worth of post-it notes. So we got to check and make sure your budget's got enough money to pay for these post-it notes. We got to debit your budget, blah, blah, blah. We got to get this into the system so it gets delivered to you and you get a post-it note. And I guarantee you, most of you have something at that level of detail or more about ordering office supplies. And here's how your strategy execution works. The executive management say, go there! And everybody gets together and meets about it, talks about it, argues about it, tries to come up with strategies about it. And they all come up with ideas and they go like this. That's how it gets done.  They're causing it. They're still frustrated, it doesn't matter. So what happens here is all these guys go away and they come up with ideas and they bubble back up through the organization. And then as one leader of the strategic planning function for a Fortune 100 company says, the food fight ensues. Because now all these projects are coming up, they're all fighting for money. Nobody at the top really has any good perspective about which of these are the best projects to run. And it's pretty much chaos until they kind of settle on something and even then, they don't know whether they got the right things. So that's reality. So what we need is a more structured way to do this. This is kind of my way of doing this. That is, you can think of this as a mainstream. We clarify, this is what business architects can do. Put a process in place to clarify strategy. We don't create strategy. Very rarely do you see business architects do that, but we certainly can clarify it, illuminate it, document it, communicate it, identify the capabilities that we have, identify the gaps in those capabilities to execute those strategies. Again, I don't care whether we're operating efficiently somewhere else. I wanna know, do we have what we need to build these strategies and make them successful? Choose the investments based on that. And if you follow this kind of model, what you get is an investment portfolio that is tightly aligned with your strategic goals. You don't get all the projects you need. And a lot of business architects wanna make sure we got every project done. I don't care. The value is separating the noise from the signal and saying these are the projects we need to be doing if that's the goal. Again, all these guys that I think are being successful are working on this model. In fact, I went through a dozen of Fortune 500 business architecture teams and I said, how do you do this? And they all said, well, we do this, this, this. Their models didn't look exactly like that. But I'm telling you, you could line those models up and they're 90% the same around this kind of thing. And that's what they're all trying to do. The other part of this is a little different and this is a very different message for you. But it's about unlocking employee capital here. What I see when I go into companies is I see senior executives who are frustrated because they have great ideas. Remember, all their ideas are great. They have great ideas and they just can't make them happen. They got too much resistance, too much stuff going on in their organization. I see the people in the middle organization and that is where I work the most. I know, by the way, I think middle managers are the people that make stuff happen. Executives talk a lot. Middle managers make it happen. And they're frustrated because they don't understand what they need to do. So because I don't understand what I need to do, I just keep getting better and better and better at what I do. I don't know what that matters. I'm just getting better at it because that's the only thing I know to do. And I say a whole bunch of guys that just say, tell me what to do. I don't care. And in fact, Gallup, who does a lot of political polling and all kinds of polling, has developed this tool to look at employee engagement. And what they say, not me, what they say is 20% of your employees are engaged. That means they really care about your success. They're working towards your success. They're highly motivated. They make things happen. 50% of your employees are disengaged. They just do what you tell them and they don't care. You want the room painted green? I'll paint it green. Tomorrow you want it blue? I'll paint it blue. I don't care. I'm just gonna do what you tell me to do.  How many of you read Dilbert? Wally, that's Wally right there. So in fact, this lines up with my leadership model that I developed when I was leading organizational change things. What I found just kind of walked into it and kind of watched what was going on. And what I found was about 20% of the guys would go with me if I would just point. Cause they wanted an answer. They would go wherever you wanted them to go. And so you could lead that 20% very easily by saying we're gonna go there and they'd all step up. They'd salute and they'd go. About 50%, 60% of the organization for me would go if you convinced them. You had to educate them. You had to show them. You had to give them a reason. But if you did, they would go.  You're too old to know what you're talking about. You're too young to know what you're talking about. You don't have enough hair to know what you're talking about. Whatever it is, they're not going. And you can spend your life trying to get those guys to go there. If you haven't, I'm gonna recommend that you read the book Drive by Dan Pink. This is an excellent book that describes why people are motivated, what causes them to engage. He has three things, purpose, autonomy, mastery. And as business architects, the work we do can increase those things in our organization if we do them right. If we help clarify the vision and the goals of the company and we help clarify them, I call it making strategy consumable. We can get people to feel like they're part of the purpose of the company. If we can get strategies developed correctly, what we're doing is building guardrails. Everybody talks about strategy being what to do. Most of the strategy is what not to do. And if we can draw those guardrails, what people know is I can operate in this space. I can make independent decisions. I can be autonomous and I will be safe. I will be doing good stuff because I understand I gotta be in here. And if we talk to people about what capabilities the organization needs in the future, they know where to develop their skills and can develop the mastery that matters. So the question is, where do we go? Here's what I think we need. One, I think that we have all the operational models we need. They're either great or at least pretty good. We need to start thinking about how do we describe the people side of this thing? How do we describe the organizational elements here because we are ignoring them. You know, I talked about earlier that business architects could not agree on a definition. Let me tell you what business architects agree on. I have asked and I've counted 2,000 architects this one question and to a person, they agree 100%, to a person, which is harder developing business architecture models and frameworks or getting the organization behind your models and accepting what you're doing, adapting what you're doing and using it. Not one person, not one person thinks that building the models is the hard part. And how do we spend our time building models? Gotta put three more colors, that's gonna do it. So I think what we need partly is first to stop and start thinking about modeling a little bit differently or at least how do we do that. What we need are we need models that describe the political environment that we're in. So we understand how to navigate that political environment to be successful. We need models that identify the cultural elements that enable our success and the cultural elements that hinder our success. How do we get our strategies done? What we need are diagrams that illuminate those informal and often hidden structures about how information flows in the company, where the power flows in the company because we think it starts from the top down, that's not the way it works, where pools of resources are that we can tap into. We need those kind of models. But more importantly than models, what we need is to look at our job differently. We need to look at ourselves, we need to look at our role. We need to kind of rethink our role as business architects. What our companies desperately need is what we have to offer. They desperately need the view of the organization that we can create. They desperately need change agents and change leaders. We need to get off the sidelines. We need to move from describing and modeling and recommending to jump in the arena and get in the fight to make change happen. If we become change leaders, business architecture is gonna be wildly, wildly successful. Thank you. Okay, thank you, Jeff. If you take a seat, if you would please, we'll have a few questions. Not sure where the right place for the camera is, but maybe here or maybe here. No, I'll go here and then we'll be here. We'll be good. I won't be hidden by one side. Somebody's going around, there's a question here. I can see that somebody and more, so we need some questions gathered. Had someone to start off with? Why, one of the first things you said was if we talk about what business architecture is, we'll never agree. And we can relate to that in the open group. That was certainly our first attempt resulted in kind of impasse over what it was. Why is it so hard, do you think? Why is it that the folks who think they're doing the same thing or related disciplines just can't agree on a definition? I love this question, by the way, because I'm working, I finally have given up arguing about the definition and why I don't wanna do it. So I'm writing an article about what I think this is architecture is, so. Okay. Part of that, here's the reason I think that's true. One is we define it at a fairly low level about what we do. We look at the activities that we have and we define it there. And so what happens is business architects come from different perspectives. I've got business analysts, and that's actually the biggest pool of people who become business architects. Business analysts come to that perspective around trying to understand requirements and goals. Enterprise architects come to it through technology and modeling. Process guys come through it through a very process-centric view. So they start with a very different view. Then they work in organizations that are very different. So what I've got is I've got big, complex organizations. I've got smaller, more focused organizations. I've got organizational culture. I've got what I think of as the management context, the incentive systems, how the things organized and all that. And what you find is the successful business architects are building a way to work in their environment. And all of those environments are different. Their backgrounds are different. The environments are different. The other thing that drives it is that's really interesting is as architects progress from beginning to successful, their perspective changes. So what you've got is a whole bunch of guys out there who are in fact working at it slightly differently. And so I think to get to that definition we've got to get past, oh, what's driving those activities to be different and get to something more fundamental about what is it we're all trying to accomplish. And I think that's gonna be my attack. We'll see what happens. All right, we'll look for the article too. So question from one of the members of the audience. Are business architects typically asked to clarify strategy execution processes? If not, how can this be addressed? I think what you find today is business architects aren't asked to do anything. Most business architecture teams are started by people like you who look around and say, my God, we need this and try to figure out how do we push that into the organization? And that's the big challenge. So I think you don't see that very often. Interesting enough, you do see that when your organization goes to external consultants. So when I worked for Acceler, we had the model pretty much that I showed you. We had a great model, but Capgemini, Bain, all these guys, they have models for that and your executives are asking them for that help. So I think that does open the door. In terms of how do you get there, again, it's gonna vary by organization, it's gonna vary by the culture and everything you have there. The key is, think big, know what your goal is and start working. So for example, one of the ways that I see these guys getting started is they will do a capability assessment and match where the money is going to the value the capability produces for the company. That's not hard to do. You can do it without senior managers, you can do it by talking with the middle managers in your company. I know of one company that did this, they found out that less than 10% of their IT projects were aligned with their strategic objectives. And that particular thing that was done by some consultants helping but their enterprise architecture team, that resulted in IT being totally reformulated, a business architecture team being started that now works for the CFO of the company to help take that kind of thinking throughout the company. So you can do it, you can get there, it does take some effort. Okay, thank you. The big premise in your storyline is that things happen sequentially in a waterfall type way, waterfall-ish it says. Can you elaborate on how business architecture will survive the Mool 2 type of world or the, you know, I had myself a question about agility versus business architecture and all this kind of. Yeah, I guess I won't agree with the premise there. I don't think it is waterfall. And I'm sorry if that was the impression I gave. I think that again, back when you look at what business architects are doing, they're all being much more entrepreneurial, they're all being much more dynamic. Agile, if you want to use that term, again, they're trying to figure out how, how do I take this theory, this concept, and fit it into this organization? And so what you see, and this is where, I think there's some issues with the rigidity that people define business architecture is, what they're finding is I can't take that theory and, you know, apply it directly. If you remember the famous Yogi Berra quote, in theory there's no difference between theory and practice, but in practice there is. And I think that's part of what you see. The early on guys are trying to apply the theory directly. The guys who have been successful have figured out, no, I have to adapt, I have to shift, I have to change, I have to iterate. And by the way, what you see is those teams don't stay doing the same thing for very long as they progress, as the organization changes, all of a sudden somebody comes back and says, can you do this? So I had one of my business architecture clients call me the other day, they've been doing traditional business architecture work, blah, blah, their chief strategy officer came to him and said, can you develop a plan for me on how we can use our capabilities in totally different ways than we use them today? So in other words, how do we take our capabilities and create new businesses out there in the world? Now, all of a sudden he's like, holy cow, I've never done that, I don't know how to do that, and that's not normally what I do, so it's another spin. So I do think that to be successful, you have to be highly adaptable with the term I typically use. Okay, thank you. I think we're gonna leave it there in view of time, Jeff, but will you be around for people? I'll be around at least through lunch, maybe longer. If you have questions, I certainly encourage you to stop me, I like questions, I like challenges, so. Absolutely. Give me a shout. You love the debate. I love the debate, it's good. Okay, thank you very much, Jeff Scott.


What we gather out of our data is we're able to talk in different terms with our customers and tell them where they are with our business up to the minute and help them improve their business. Welcome to the Smarter Building Materials Marketing Podcast, helping you find better ways to grow leads, sales, and outperform your competition. All right, everybody. Welcome to Smarter Building Materials Marketing, where we believe your online presence should be your best salesperson. I am Zach Williams, alongside my co-host, Beth Pompnyglov. And today, we're talking about data, specifically how you can connect the dots between the data and the different parts of your organization to make better decisions, whether that's product development, marketing, sales, customer service. Data is becoming a bigger and bigger role of a lot of manufacturers. And we want to talk about that today with a really great guest we have lined up for you. We are really excited to welcome Bob Sanders. He is the director of sales at Sholdice Designer Stone and Fusion Stone. His company is spending lots of time in the data and making it work to improve their customer experience, improve their manufacturing. He's got lots to share with us. Bob, thank you so much for joining us. Oh, thank you. It's great to be here. Appreciate it. Before we get started, why don't you take a couple of minutes to introduce yourself to our listeners and tell them a little bit about who you are and what you do? Yeah. Well, my name is Bob Sanders, director of sales at Sholdice Designer Stone and Fusion Stone. I'm about five days away from my 18th year with the company. So I'm very excited for that milestone. One thing in our company is we have a lot of long-tenured employees as well as the new crop that are coming up to teach us new ways and things like that on how to do business and how to talk data and things like that. The industry we're in is a very old traditional industry within the masonry world, within the building supply. And we try to find new ways of doing business and connecting with our customers. Well, who are our customers? Who do you market to? Well, I love that question because we have two segments to our company, Sholdice Designer Stone and Fusion Stone. On the Sholdice side, we are the traditional masonry side that requires a mason. You're installing the brick in the stone, whether it's on a home or a government building, a school, office tower, whatever that is. And you require specialized trades for that. And that industry has been around forever. And the other segment to our company is the one thing we always wanted to do is try to talk to the consumer, try to talk to an end user because our product is typically funneled through the architecture community, through the trade, through a builder, etc. With our Fusion Stone, we created a do-it-yourself product that is masonry, a thin stone that's mechanically fastened or it's screwed to the wall. And we are about 12 or 13 years in on that product line. So what it's enabled us to do is talk to all segments of markets. So we talk everything from the architect to a builder to a designer to the mason to our consumer now and all through then through our dealer networks and our distribution. So what it's really done for our company is we're educated on all aspects of the building industry, whether it's commercial, industrial, institutional, or residential. So we're very fortunate to have our feelers out to all sorts of customer groups and markets out there. Bob, a lot's changed with COVID and I know that's like the topic of everyone's conversation, but I'd love to hear what are you all doing from a marketing and sales standpoint that's helping you to fulfill demand as well as reach new customers? You know, before it's a conversation we've had for some time before COVID hit, is there a better way out there? Is there a more effective way, you know, with markets changing and the consumer changing and the consumer becoming much more educated on your product sometimes before you even have face time with them? What it allowed us to do was to sort of, it pushed us into that corner and realized, you know, with our external sales force, our inside customer support and with our marketing, you know, we had to pivot fairly quickly like most people did on how to keep in contact with that customer because that customer that we were very used to in a traditional way of a, you know, still the phone and email, a Zoom or going into their office, a lot of things changed and we had to utilize different ways to still make contact and a lot of our customers, they went home. They went home and set up that home office and they became a little harder to reach out to and so those challenges it forced us a bit to get in more into social media, more into, you know, direct links with emails and things like that, you know, traditional old school ways of using the phone and, you know, it's once we, you kind of had to reestablish your communication link and then once you reestablished that then you found with each of your customers how they wanted to be, they still wanted to hear from you. They typically don't reach out to you, it's our responsibility to reach out to them and so we found it in a multitude of ways of reaching out to them through that. So if we can, let's talk about the data that you learned from those big pivots. What is the data telling you about your outreach communications, the ways that you had to change to stay in connection with your customers and how are you integrating that as you go into this next year? Well, we've been working through data for several years now and 2020 into 21 has been our deep dive, let's put it that way through our business intelligence and it paints various pictures. You know, it's what you want to extract from that and how you connect that information and what it's told us because we've had to rely on that data in some aspects to help tell the story on what was occurring in the last 18 months and we monitor everything. You know, we monitor whether we're speaking to a customer, the orders that those customers are placing, the orders that maybe they're not placing and why, you know, the competitive nature, we track competition and what they're doing, not doing and we compare ourselves in a lot of different aspects. We're very much an out-of-the-box type of company that likes to do our thing while keeping an eye on others and the one thing that we've really learned is to embrace through the data, is to embrace the different ways of doing business and I think COVID has forced many us into that. When you come from such a traditional industry like ours, it's a relationship-based industry. It's a lot of older generation within the industry, whether it's trades, masons, builders, etc. And it's how to embrace them and with the younger generation that are bringing in wonderful new ideas on how to speak to customers and how to utilize the data in speaking to your customer. You know, the data doesn't take away from that relationship. It doesn't take away from that personal relationship. If we used to see a customer once a month and it's a debate we've often had, do we need to see that customer once a month? Maybe that customer we can speak quarterly and provide better information to help them drive their business and utilize our company to help them within their problem solving, the challenges, products that they're looking for and things like that. The data, at the end of the day, we want to be better today than we were yesterday. We want to grow more today than we did yesterday so the data helps point us in a multitude of directions. Bobby, he mentioned data.  Can you give me an example? Maybe tell us through the lens of a story. Give me an example of, hey, we looked at this particular data on this customer using X, Y, and Z. So our ERP is connected to our CRM. We utilize business intelligence, which we call Stone Man Intelligence. It's a company-wide program that we have. You could look at it and say, oh, my goodness, info overload, but everything that comes into the company is pulled through in those various programs, which ultimately lands in the business intelligence. And it's broken out behind the scenes. Obviously, it's been written to accommodate what we require and from analyzing everything from sales and quotations and product development and marketing and competition. And so we have multiple dashboards that we pull that information. So you're getting information from your CRM, from your ERP, from online, and then you're putting into one centralized dashboard. Are you then viewing that as a team, or is that individually, you've got, hey, you're in sales, so you're really looking at these parts of it, or is it a part of the way that you all are doing business now, where you're actually reviewing those dashboards together? I'm trying to get a picture of how it's like grabbing the data and doing something with it. What does it look like? Great question. It's a great question because sales and marketing has a specific dashboard. Production, in all the elements within production, they have a certain dashboard. So finance, a specific dashboard. Management, we cover all aspects of those dashboards. Our external team, our sales team, they have a dashboard dedicated to what they require through that day. So how we monitor it, we monitor it individually, specific to our dashboards, and we meet every morning to review all aspects of the company. And that is sales, in marketing, production, customer service support. We touch on all of that over kind of a quick 15-minute roundtable with many members within administration and management, and then other times through the week when you deep dive specifically into certain aspects of that information. So I'm imagining that these dashboards are also a big part of your annual strategic planning. Can you give me an example of something that you're going to start doing and something you're going to stop doing in 2022 based on data? Yeah, that's okay. It's an interesting question because we're coming into our 75th year as a company. We're a third generation. We're a family-owned business, and we stretch coast to coast in Canada, and a good chunk of the U.S. Our products are on trucks every day, heading somewhere. In old ways, older traditional ways, you've always used that in some form, but a lot of decisions are made on your gut, emotional feel, what you think, what you hear, and a lot of times that's how companies are built, and you integrate the data. You always want reassurance when you've made a decision, and data helps support that reassurance, but it's also that you want to be cautious because you want to make sure that you don't lose that driver, that entrepreneurial spirit, where a lot of times it does come from your gut or your head, and you still want to run with that idea or that new product idea, but you have a keen eye on data and what it's telling you. I think to your question, Beth, I believe our decisions today, especially in product development, are made more on data support as opposed to just a round table. What does everybody think? You're facing it on actual metrics and actual numbers that have been measured and tested over a period of time. You're moving it from an art to a science. In any company, in ours specifically, you collect so much information. There's so much information that comes in minute by minute into our company, and you have to be able to decipher that information and where it's going to help you be better, essentially, because most employees on this property are contributing to that information. They're collecting all of that, and they're facilitating it and entering from external sales to production. Everybody at every second of the day is putting something into that business intelligence. If you had to distill it down, Bob, in terms of the benefit that this type of process has brought your organization of integrating, and as you said, everyone in the organization is using this data and this business intelligence to make better decisions, if you had to distill down the benefit that this has brought your organization, what would it be? Is it, hey, you make decisions more confidently? Do you make it with better speed? Is there better alignment? What would you say is the single biggest benefit that this has brought you and your organization? I think one of the biggest things it's done is we become more transparent within the company, within ourselves. I like that. You get siloed, and if it's a sales thing, you have the sales group talking about it. If it's marketing, you're talking with the marketing, etc., etc. What the data collection and business intelligence, it's how you embrace it, but it forces you. You need collaboration now from all aspects of the company. When you're developing a new product, in the past, as I said, you might round table it and say, what do you think? Today, you need to have finance. You need to have marketing. You need to have sales. You need to have production. Production might put their hand up and say, we can't do that. I think the biggest thing is we've opened ourselves up more within the management group and within the employees as well as to what we're doing. I also believe it's made us more efficient. It's more effective. Everybody's busy. I know it's a cliche, but everybody's busy. When you speak to your customer or drop by to see them, you don't want to waste your time. You're there for a reason. You're not just dropping by to drop off a coffee for them and say hello. Sometimes that works, but they're busy. What we gather out of our data is we're able to talk in different terms with our customers and tell them where they are with our business up to the minute and help them improve their business. When they improve, we improve. It's a long trickle-down effect. We've definitely seen the benefit from the investment of obviously dollars and time and people into this on how we manage our company today. What advice would you give to a manufacturer who wants to start measuring more, wants to start making more database decisions, but is still in that gut feel round table phase? Where do I start? What do I measure first? What would be the most impactful? Really where we started is through CRM. It's those everyday conversations that you're now logging, tracking with your customers. Those conversations, old school ways, the sales rep would have a notebook and they'd write things down or make a note in their phone, but often that information didn't go anywhere unless you happen to talk to your manager or your fellow employee and it just becomes lost. My advice is I think CRM is a must-have in any company is to collect those conversations, collect that information and build that profile and build that file of your customer. You know your customer very well, but get that file going and understand from that and then from there, then you explore a business intelligence platform that you can now start to pull through all of that information that gets dumped in the business intelligence and it starts to segment things, but I believe the biggest thing we did was when we dipped our toe into CRM, it's like okay, but like anything change and new ways it takes a bit and I can't imagine not having it today. Yeah, that's great. This has been great, man. Thank you so much for coming on the show. If someone wants to get in touch with you, what's the best way for them to do that? Probably just through shouldice.ca. They can find us through that fusionstone.ca. You can find me definitely through any of those aspects. That's great. We'll make sure we link to that on the show notes as well. For our listeners, if you enjoyed this content, make sure you go to venvio.com slash podcast to subscribe. Until next time, I'm Zach Williams, alongside Beth and Papi Glove. Thanks, everybody.


Thank you guys for having me here. I'm really excited. There's my second time in London and So I'll just get excited when you've been to London So hello everyone, my name is Dheeraj and today I'm going to talk about content security policy so we'll be discussing about a lot lot many offensive and defensive strategies to Secure web application and we'll also be talking about Security best practices which you can apply to secure web applications and with the help of Content security policies by adding an additional layer of defense Before we get started. I just a quick raise of hands. How many have heard about content security policy before? all right, almost everyone and How many of you have actually deployed CSP to production? All right, and without breaking the production No, I All right, great a Little introduction about me like who this random guy on stage talking about security. I Work for a company called wingify. That's in India. It's very well known for its AB testing Product that is VW. I take care of application security there and before moving completely into security I was a front-end audition Working with the angle to JS and money large R script And I also do open source stuffs like recently I published CLI that to read awesome medium stories without really letting your boss know about it And also I might maintain a list of comprehensive bug bounty programs on get up And I can also play table tennis with both of my hands switching in between It's kind of fun a Little more When I'm not writing code, I try to find one of the reason web applications And these are the applications where some of the application where I've reported security issues and Most of my attacks have been on the client side where you must have seen this little pop-up from the browser window and and So today's agenda for the talk is to understand what basically security is and why is it necessary and Before getting into content security policy We really need to understand what type of attacks it solves and more over It's like cross-site scripting and other injection tags and how to mitigate those attacks using CSP and how do you how do you deploy CSP without breaking production? And also we'll be talking about crypto jacking. How many of you have not heard about Clip to Jacking for? All right, so In the recent past actually the last week More than 4,000 websites got hit by crypto jacking where You know if you visit the website that's infected website the malicious JavaScript could actually run and mine crypto currencies in your browser and This practice of secretly loading JavaScript in your browser is known as crypto jacking or in drive-in mining Similarly and good some couple of months back wordpays wordpress blogs were known to have recording of user credentials and which is very dangerous because it acts like a Keyloggers and we were sending the credentials to some of their attackers and points security is important in most of the times which I have seen that Security is like an elephant in the room where everyone agrees to it, but only a few way takes it way seriously and Since the first time your app is compromised You lose most of your users. They no longer trust your app or you and security's always takes priority when some bad happens and Before that, it's always takes a backseat and most of the cases and especially when you talk about startups or who wants to you know create some Basics products so and interestingly one of the things where most of us developers think that security is all about back-end but actually with lots of framework coming out in JavaScript and Attacks happening on the browser level like crypto jacking, which I mentioned you cannot neglect front-end security and And you can see that JavaScript frameworks are like every new every day we have seen a new JavaScript frameworks coming out and So let's talk about Scripting so when we when we talk about any client side or browser level attack the XSX is the first one everybody that come to everyone minds and This is this so popular that I have known some person who have been doing PhD in XSX so it's so so so complex and it's and so some years ago where people used to disable JavaScript to mitigate all this browser level risk, but nowadays with With such new browsers we cannot Remove JavaScript to compromise with the user experience and that's the we have to enable all the JavaScript to on a browser and that's that's that's the wonder but he where occurs when basically your data become code or Your code becomes data and when I talk about data, it's mostly the data coming from an attacker who has bad intentions and So for example where you can see this Little script of code, which is loading and trying to load an image which doesn't exist and and using a non error attribute is be able to show a little pop-up and This little pop-up was shown on our website Uber.com and I'm sure everyone heard about that and this dashboard where I had reported this wonderfully a couple of years back where where I just try to set my name was this little piece of code and and when I try to When any other user tried to remove My project or my name or my cringe my user this this little pop-up would occur and similarly I Have reported the one abilities to some other websites like one of the interesting one I remember is a recruiter box which an Indian platform for Hiring hiding platform where I was able to inject in one every Malicious code using which I was able to take a job at any any any of the openings on their website And that's how cool and I would be able to place at some good company and It's not about The just the pop-up. It's more than that. It's basically attack users. It has access to your DOM It can hijack the sessions. It can steal the cookies or steal the informations and it can even record your sessions and Moreover, it can even lead to crypto-jacking and So a Typical reflected access X looks like this where someone send you a malicious code and You click on that and it would try to get all your cookies Which might also have your session cookies and send it over to attacker and this basically Cookie would let anyone if the cookie is having the session cookie and then it would let attackers to have control over your session So we'll be seeing a live demonstration how this one ability occurs so to have a complete understanding about it So I'm running a very basic a Wonderful applications where you have a search features to That's basically very common search features We can have find it on any website or any blogs running on WordPress or any other things And if you just try to say hey, hello, and it will just show you the output. So why don't we try something? else Where I've already POCs and if you try to do something else, it's sure a little pop-up and this is basically due to cross-site scripting and developers Forget to escape the user input and like I was mentioning When your data becomes code it can lead to cross-site scripting and This little piece of code becomes dangerous because when you share this particular URL to someone and They open this URL and This could put it could execute it and this is a typical reflected xsx where a user input is being rendered by the application and This is how xsx attack occurs Getting back to the slides So how do we mitigate such type of attacks so where we can have sttp only cookies which can Which can lead to We can make sure that your browser doesn't get access to those cookies. So it's very useful to put sttp only cookies for your session cookies sttp only flag for your session cookies and then one can do input sanitization at the Back end so that any malicious input doesn't occur but in this demo which we have seen the input was never going to the back end and this is basically a type of xsx that is dome dom xsx and it means that doesn't necessary to It doesn't help to sanitize input on the back end because the input would never reach to that and it occurs when The vulnerability exists because of on the fly creating dome elements and So that's the reason you have to analyze places where dome elements are created on the fly and The correct defense for xsx is to construct stml securely in a framework that automatically escapes untrusted user data and which would be followed by a good Dom sanitizer as a second layer of defense and but that's Really a problem because of Escaping cautious and different browser quirks. It's very difficult to get it right and Xsx is many much solved problem if we do all these right things but then people think that they understand JavaScript and It's kind of funny because it's true, right? I'm sure some of you must be wondering about this particular little piece of code and trying in your developer tools, but I would say it works and Now when we say that this is the problem we have condensic your policy and So let's get started with CSP. It's basically a Standard which allows you to define the sources loaded on your website. It can be set via HTTP response error is something very similar to HSTS and It can also be set via Meta tags, which is very useful in the cases where you do not have access to the servers for example get up pages and you would be able to Specify content security policies just using the meta tags and it should never be a first line of defense and because Xsx can Actually occur if you do not in deploy CSP very correctly. So it should always be a defense in depth strategy and CSP also has to be issued on every page because browser doesn't cash it's like for example in case of HSTS which is used through Deploy complete STTPS application and in CSP like in HSTS a browser would just store this information and The the website will always be loaded on STTPS no matter what user tries to load but in case of CSP it has to be applied every time on every page request and So because browser doesn't catch the policy And so CSP basically helps in mitigating cross-site scripting attacks and Securing form submissions where you know it allow restricting browser to send information to many other locations like Like in case of password managers, let's say if they are stealing your credentials and actually CSP can help in those scenarios where you know data exfiltrations can be really solved and And you can also mitigate click-jacking using CSP and the most interesting part is doing STTPS migration and which is kind of very easy for the application which are very Very old and you do not need to write some code to migrate and it can be really helpful in that So let's get started. How do you how do we add this security header? It's basically it's a response here where you can see the policy goes here and you can define Consent security policies with this particular header and it looks like this where You have set up particular default source as a self It means that it allows loading your four resources from the same origin So what same origin is we really need to understand here Self is same origin and the origin comprises of three components One is the schema. The second is the host name and third is the port and and if when we talk about same origin If any of these components is different, then it would not be on the same origin for example If there's a site called CSP awesome And if we try to compare with another site STTPS ESO origin it will not be on the same origin and when we say it's not on the same origin browser would not be sharing this resources like cookies or local storage and other information Provided by the browser So So there are certain type of CSP Directives which could help you to define CSP policy and the first one is a script source where you can define what? JavaScript elements you need to put inside your application the major risk involved in putting in this directive was to solve XX and the style source could be helpful in loading resources like CSS style sheets and the major risk is website defacement or stealing of information like CSR tokens and Image source can actually be a very risky where you know someone can send information to their own domain by appending the information the query pair arms and Similarly we have other source directive like connect source which is for XML STP request that is ejects and other web socket request to be defined by this and We have some other source directive like frame source which could be used for Loading the iframes in any insider applications and then we have font source to define your Fonts loaded on your website and then there was an interesting thing called default source Which act as a fallback when you do not specify any of the fetch directive when I say fetch directive which is always appended by hyphens src so in his in an example if I Fail to write script source it would it would the browser would look for a default source and that's how it becomes fallback so in this particular example where we have defined image source of the star and this is act as a wild card which allow so so in this particular case it allows any images except the blob data or file system schemas and So it's not advisable to wild card to use wild card unless you are very short about it And then we have other source expression like none so in this example We have said object source as none it prevents loading plugins from any source and when we say about plugins like flash or any other plugins which could lead to vulnerabilities and For example, we have tile source as example.com in this way you can specify certain domains where you Crush those domains and you can easily allow them to load the resources in your website so in this case we have allowed The styles it to be loaded from the specific example.com and if you want to specify more and you can keep them separated with the space and Simple policy looks like this where we have defined script source as self object source is none base you are as none and so This policy actually does allow external scripts which are not hosted on your domain and Also, it doesn't allow inline script elements where or like even handlers like in this case image on error and Also the object source says that It should not be able to host any any interactive content like I said before it's like flash or Then base you are I make sure that it should not break any scripts which are using the relative parts and This is kind of a very Some secure policy which you can start with But there are some bad ideas where people Try to put unsafe inline or unsafe eval and CSP by default doesn't allow any inline JavaScript And that's the basic idea behind preventing cross-site scripting attacks But so in this case where someone tries to Define unsafe inline or eval. They're actually allowing inline source of elements such as style attributes on click Scripts tag bodies or any eval functions, which is kind of dangerous And but there are some cases where you really need to have some kind of inline script for example You have some code like Google analytics code which can have some performant impact and you do not want to Move that file somewhere or do not want to load load it there and it has to be in line There are certain ways you can put those scripts and also the lag is some legacy applications where you want to Allow inline scripting then you can basically do things like putting them in the external files So that you can put as a source expression as self so it will be loaded on your own domain and Also, you can use other strategies like hash nuns or script dynamic and We'll be discussing that as well So when I talk about hash and you have a script called alert and you want to convert into a hash You have basically do a base 64 encoding of this particular hash and using a Shah algorithm Which could be 256 or 384 or 512 and if you give that expression it could Give you next and base 64 encoded value which you can put it in the center in the header And it looks like this and which would allow only this exact script that can be run In your browser and if you allow this and no other scripts would be allowed to execute so These approaches are some sometimes very hard to maintain when they say when you have more than 10 inline scripts and And you frequently change those scripts it's very hard to have back and forth changing the application and talking to your devs and The DevOps guy to update those headers in the server So we have another approach called nuns where you can define a nuns in your content security policy header and this nuns has to be cryptographically securely random generator and And it would allow any script with the nuns attribute Given us the same as the header the browser would be checking and allowing only those scripts which matches the nuns So This is how Twitter CSP looks like and even it could not fit my browser screen, I mean the presentation screen and This is where they are using the nuns approach and they're whitelisting all the Domains it's kind of you know You have it's very hard to make sure that these domains are very secure and no one of the occurs on those domains And it's very hard to do it right and so that we have something called strict dynamic and this source expressions provided in the script source it Basically gives a complete trust in applications where in this particular example where Twitter was Allying different source for font source media source Which were actually required by certain script elements and it could have been easily prevented with a strict dynamic and where you Basically trust a given piece of code and you allow them to do each and everything what they are doing and so that it basically allows you to not have a bunch of domains which could Get compromised and if you do not take care of them in the right way and so basically when you have a strict dynamic Source expression present it the browser would ignore the whitelistic domains and it will only allow the domain Which have having hash and nuns representation? So we have talked about these approaches how how these approaches are actually helping xsx. Let's let's see that so in this example where we have a Script source a cell and we are allowing a domain called api to google.com and When someone tried to inject a script which is coming from an evill.com It says refuse to load the script and this is how you avoided the content security policy So I can give a quick demo where we have a given this one ability and it could be I would just So I would just quickly set the header as csp I'm sorry, but I'm not able to put that in the screen demos are hard anyway, so The screen is flickering I would actually have the header set by myself and If we try to load this expressions It was working five minutes ago, but anyways So going forward we can talk about mitigating xsx and Let's talk about some common mistakes where default source will be used as a fallback and You actually have to you know void using wildcard domains and Default source would be omitted If you do not specify it and it's it's not very advisable to do that and use of dangerous elements like unsafe and line unsafe eval and also wide listing domain with jsonp endpoints user uploads or Open tree directs are dangerous And if you want to break some stuff get a back specifically in wise researcher to break their CSP policy and Hacker one has also paid have some paid bounty CSP bypass and The draw box is also having CSP journey blog where you where they have published some interesting articles about how they have Migrated their journey from having a CSP not having CSP to having CSP Now that we have understood how CSP works and now it's how how should we deploy? CSP to our production and there are two ways where you can actually The first one can be used to block and report attacks There's enforcing it and the second one is the report only where you can allow the report report abuses to a specific reporting server and When we when I say about the reporting you can actually have the policy with the headers and condensic already policy report only and you have to specify a reporting URL where the logs would be sent to and for this you can use report uri.com which could be very easy to maintain and get a get a complete idea about these logs and Now let's move on to Interesting approach where you can use CSP to migrate to STTPS and Life is about to go harder for the website having non STTPS and Chrome is actually going to mark all the web non STTPS website as Non-secure starting July 2018 and CB migration is very hard for legacy applications where you know you have to Do a lot lot of code-based refactoring and and Thus you see you cannot specify a directive Called default source and which is set to STTPS and a form action which says to STTPS Which you're using which you can identify what all assets are loading using STTPS and Also, it helps you in secure identifying where the secure form submission is not happening So when someone try to load an image using STTPS it would also violate the policy and There is something of there's a source. There's a directive called upgrade insure secure request which would basically Upgrade all your STTPS request to STTPS and for example You have an image which is loaded on STTPS Before sending the request to the server the browser would convert that request into STTPS and Thus doing all of your work without specifying these Specifics changing the schemas in your code base and you just need to apply this particular directive in your condensed security policy and this can be combined with our other fetched directives and And so Next one every I would want to talk about click jacking Everyone thinks that it's a solved problem Where you know, it's this one everybody basically is a malicious technique where you can trick a user into clicking Into a something different what user sees that and if user is able to click on that He would be actually compromising some confidential information or even It could lead to account takeover basically it looks like this where you be you're trying to click on a button and It it gives you something different. I have a demo for this See how it works So I have an application so which has a feature called delete sensitive information and with GDPR coming alone Along you must be developing this particular feature for each and every applications and when you have such critical User-actions and I try to so we have an application running on host 3000 and I have another application running on 3002 so The this these two application do not rely on the same origin and user would not be able to Share any of the resources now if you see this particular website where I have set the opacity as very very low and You can basically see the iframe this and when you try to click on this button to see awesome dog lips and you are actually clicking on something different and and Here if you are able to see that there's a pop-up coming on that the data has been deleted and So using this particular approach where people are Hiding some informations on their browsers behind an iframe user are actually making people think that clicking on something else and But we have seen that these vulnerabilities can be Easily solved using header called x-frame options, but with this is with the support like deny which will not There's a parameter where you can define deny which will not allow the website to be iframe and Then you have same origin which could allow only this the same origin website To iframe the website and then you have something called allow from which is not supported by IE and Chrome and Which allows you to define a URI which where you want to allow the iframe to be Loaded and but interestingly we have these two approaches where same origin and allow from works Very differently where the expected behavior would be to check the domains the ancestor domain and Actually, they are checking the top level domain to the current domain. So to have it understanding the better way Where someone is able to inject iframe inside a page we just loaded on victim.com and They have inserted another frame. It's like an inception Where you are loading in tacker.com and inside you are loading in victim.com now The browser would check the top domain and the current domain and instead they should have checked You know very in sister path and which is not being supported by x-frame option, which is kind of wrong So how is it a problem? Where you have the site that frame untrusted pages? That would be wonderful And while I was creating slides for con insecurity policy, I was using slides.com and When I tried to load the response error and I can see X-frame options are same origin policy same origin attribute and if it's there, I am able to add HTML where I was able to add the iframe and And it was wonderful. I reported the wonderfully and I got a free upgrade. Yeah So how do we pretend prevent a clickjacking using CSP? There is a directive called frame and sisters where you can Define as none that it would not allow any website to iframe it and Similarly, we can specify multiple domains along with self. That means same origin and Similarly we have Other approaches using which you can prevent a type of attack where you can combine both x-frame options and CSP where you know the CSP is supported by a maturity of new browsers and old browsers like below Chrome 30 would not basically support some of the directives. So you can apply both the approaches and draws will take care of it So CSP is kind of cool You can do a lot of stuff. Do not break stuff. I have another demo in place where I Would not open my editor again, but no break. I have an exploit which I can copy and Put that inside So there was the xsx which we have seen on this particular page now you can see that There was an exploit which I have copied and I have shared the URL with them, but what actually happening at the back? I opened my developer console. I was actually running a crypto Mining that's crypto checking which I have been talking about at Prince's beginning and I have been running and Generating some good gold crypto mining and the basically Where I was able to collect all these hashes and if you visit this particular and if you try to run this particular applications on your browser You would actually be helping me giving some money That's how you can respond to my talk So yeah, CSP was cool if you want to deploy it do not break the production you can use content security report only header and You can if you want to learn more you can have a reference guide Which is on content security policy comm follow this guy Scott and actually he was the one who was able to identify all this website got infected with triple jacking last week and Helping with the website government website as well and he knows His stuff he knows about CSP and also you have a useful scripts on this particular URL and I'm also going to publish some Handbook which I was actually working on so that's all I got for the today's talk Thank you very much, and you can follow if you have any questions. I'll be right about right here and If you can follow me on kid up or Twitter if you have any questions answers yeah questions My I start one with a question. Yeah PWAs progressive web apps they require their base on HTTPS. How far do I really need then? content security policy So all these applications where you have to define actually Content security policy and going forward these would be mandatory by the browser and it's basically even if you I have Honestly, I've never worked with PWA, but I would actually say that if PWR going moving towards secure context There is a CTPS and they would make sure that CSP is also being followed by them