Live from Orlando, Florida, it's theCUBE, covering .conf18, brought to you by Splunk. We're back in Orlando, everybody, at splunk.conf18. Hashtag SplunkConf18, I'm Dave Vellante with my co-host Stu Miniman, and you're watching theCUBE, the leader in live tech coverage. We like to go out to the events, we want to extract the signal from the noise, we've been documenting the ascendancy of Splunk for the last seven years, how Splunk really starts in IT operations and security, and now we hear today Splunk has aspirations to go into the line of business, but speaking of security, Gary McCoolis here, he's a senior director of cyber and information security at FINRA, and he's joined by Sid Artha, Sid Dada, who's the director of information security engineering at FINRA. Gentlemen, welcome back to theCUBE. Gary and Sid, first time, welcome on theCUBE. So, I want to start with FINRA, why don't you explain, I think many people know what FINRA is, but explain what you guys do and sort of the importance of your mission. Sure, our main aspiration is to protect investors, and we do that in two ways. We actually monitor the brokers and dealers that do trades for people, but more importantly, and what precipitated our move to the cloud was the enormous amount of data that we have to pull in daily. Every transaction on almost every U.S. stock market has to be surveilled to ensure that people are acting properly, and we do that at the petabyte scale, and doing that with your own hardware became untenable, and so the ability to have elastic processing in the cloud became very attractive. How much data are we talking about here? Is there any way you can sort of quantify that for us or give us a mental picture? Yeah, so the example I use is if you took every transaction that Visa has on a normal day, every Facebook like, every Facebook update, and if you took every Twitter tweet, you added them all together, you multiplied it by 20, you would still not reach our peak on a peak day. Oh yeah, hence, a splunk, and we'll talk about that, but Sid, in what's your role? You got to architect all this stuff, the data pipeline, what do you do? My role is basically to work with DevOps teams, application teams to basically integrate security in the processes, how they roll out applications, how they look at data, how they use the same data that security uses for them to be able to leverage for DevOps and other performance. So your mission is to make sure security is not an afterthought, it's not a bolt-on, it's a fundamental part of the development process, so it's not thrown over the fence, hey, secure this application, it's built in, is that right? Okay, Gary, I wonder if you could talk about how security has changed over the last several years? You hear a lot that, well, all the spending historically has been on keeping the bad guys out, the perimeter, as the perimeter disappears, things change, and the emphasis changes, certainly data is a bigger factor, analytics have come into play, from your perspective, what is the big change, or the big changes in security? So it's an interesting question, so I've been through several paradigm changes, and I don't think anyone has been as big as the move to the cloud, and the cloud offers so much opportunity from a cost perspective, from a processing perspective, but it also brings with it certain security concerns, and we're able to use tools like Splunk to be able to do surveillance on our AWS environments in order to give us the confidence to be able to use those services up there, and so we now are actually looking at how we're going to secure individual AWS services before we use them, rather than looking to bring stovepipe solutions in, we're looking to leverage our AWS relationship to be able to leverage what they've built out of the box. Yeah, people oftentimes do talk about cloud security, like it's some binary thing. Oh, I don't want to go to the cloud, because cloud is dangerous, or cloud security is better. It's not that simple, is it? I mean, maybe the infrastructure, in fact, we heard the CIA, Stu and I were in DC in December, we heard the CIO or the CIA say cloud on its worst day is better than my client server from a security perspective, but he's really talking about the infrastructure. There's so much more to security, right? Absolutely, and so I agree that the cloud gives the opportunity to be better than you are on-prem. I think the way FINRA has rolled out, we've shown that we are more secure in the cloud than we have been on traditional data centers, and it's because of our ability to actually monitor our whole AWS environment. Everything is API-based. We know exactly what everybody's doing. There's no shadow IT anymore, and those are all big positives. Yeah, I'm wondering what KPIs you look at when you look at your Splunk environment. What we hear from Splunk is it's scalability, cost, performance, and that management, the monitoring of the environment. How are they doing? How does that make your job easier? So I think we still look at the same KPIs with Splunk actually advertisers all the time, but some of the reasons, from our perspective, we can look at it in terms of how much value can we give it to not just one part of the company, but how can we make it a much more enhanceable product for everyone in the organization. So the more we do that, I think that makes it a much better ROI for any organization to use a product like this one. You guys talk about this shift-left movement. What is shift-left and what's the relevance to security? Yeah, so shift-left is a concept where instead of looking at security as a bolt-on or an add-on or a separate entity, we're looking to leverage what our traditional DevOps tools, what our traditional SDLC pipeline roles, and we're looking at how we integrate security into that. And we use Splunk to be able to integrate collection of data into our CDCI pipelines and it's all hands-off. So somebody hits a button to deploy a new VPC in AWS automatically things are monitored and into our enterprise search, I'm sorry, enterprise security SIM and automatically being monitored. There's no hands-on that needs to be done. So on a scale of one to five, that's the thinking of a maturity model in terms of in a DevOps context, five being the gold standard and one being you're just getting started. Where would you put FINRA on that spectrum? Let me just subjectively. So I'll never say that we're a five because I think there's always, you're never done and there's always room for improvement, but I think we're at least a strong four. We've embraced those concepts and we've put them into action. And so I thought so and I want to ask you from a skill standpoint how you got there.   And we talk about this a lot Stu. What did you do with the ops guys and the dev guys? Is it ops dev or DevOps? Did you retrain them? Did you fire them all and hire new people? How did you go through that transition? Yeah, that's a fair thing. I went to my CISO John Brady a couple of years ago and I told him that we were going to need to get these new skill sets in and that I thought I had the right person in SID to be able to head that up and we brought in some new talent but we also retrained the existing talent because these were really bright people and they still had the security skills. And what SID's been able to do is to embrace that and create a working relationship with the traditional DevOps teams so that we can integrate into their tools. So it does include a little bit work on even an iron to do where you kind of learn how the DevOps versus work. So you got to do it on your own to first figure out things and then you can actually relate to the problems which they would go through and then you work through problems with them rather than you designing up a solution and then just say, hey, go and implement it out. So I think that kind of relationship has helped us and in the long run, we hope to do a bit more better work. Yes, SID, can you bring us in a little bit when you look at your Splunk deployment? Finner's got a lot of applications. How do you get all those various applications in there? Splunk talks about you can get access to your data, your way, do you find that to be the reality? Yes, to a certain extent, so let's take a step back here. So our design is much more hybrid oriented. So we use Splunk Cloud, but that's primarily for our indexers, whereas we host our own search clusters of them. All the data basically goes in from servers, from AWS components, from on-prem, basically flows into our Splunk Cloud indexers and we use a role-based access management to actually give everyone access to whatever data they need to be looking at. All right, they've made a number of enhancements from 7.2 updates to the cloud. Garry, is there anything that's jumped out that's going to architecturally help your team? So I think one of the interesting things is the new data pipeline, and to be able to actually mangle that data before I get it into my Splunk indexers is going to be really, really life-changing for us. One of the hard parts is that developers write code and they don't necessarily create logs that are event-driven. They don't have daytime stamps, they do dumps, so I'm going to be able to actually massage that before I get it, it hits the indexers and it's going to speed up our ability to be able to provide quick searches because the indexers won't be working on those mangling that data. And how big of a deal is it for you, they announced yesterday, the ability to scale storage and compute separately in a more granular fashion. Is that a big deal for you? So I actually, I remember speaking to Doug Merritt probably three years ago. I just started this. And I said, Doug, what's it called? I said, I really think that that's the direction that you need to go. You're going to have to separate those two eventually because we're doing a petabyte scale. We realized very early that that need to be done. And so it's really, really refreshing to see because it's going to be transformative to be able to do compute on demand after that. Because now we can start looking at API brokers and we can start looking at containers and all those other things can be integrated into Splunk. Love having customers on like you guys are so knowledgeable. I have to ask, switch gears a little bit. I want to ask you about your security regime. We had a customer on yesterday and it was the CISO who reported to him, he was the EVP and he reported to the CIO. A lot of organizations say, you know what? We want the CISO to be separate from the CIO because it's like the Fox in the henhouse kind of thing. And we want that sort of a little bit of tension in there. How do you guys approach it? What's the regime you have for? That is a fair question. And I've heard that and from many other CISOs that have that same sort of complaint. And I think it's really organization based. And I think, do you have the checks and balances in place? First of all, our CIO, Steve Randage, is extremely, he cares a lot about security and he is very good at getting funding for us for initiatives to help secure the environment. But more importantly, our board of directors bring up security at every board event. They care about it, they know about it, and that permeates through the organization. So there's a checks and balances to make sure that we have the right security in place and it's a working relationship, not adversarial at all. So having our CISO John Brady report to Steve Randage, the CIO has not been a hindrance. And I think that's a change in the last several years because that regime that I described, which was, there was a sort of wave there where that became common. And I think you just hit on it. When security became a board level issue and for every Fortune 1000, Global 2000 company, it's a board level issue. They talk about it at every board meeting. When that occurred, I think there was an epiphany of, we need the CIO to actually be on this. And you want the CIO to be responsible for that. And the change was, it used to be, hey, if I fail, I get fired. And I think boards now realize that failure in security doesn't mean you got breached. You know, breaches are going to happen. It's how you respond to them and how you react to them that is becoming more important. So there's much more transparency around security. In our view, I wonder if you agree with that. I think there's transparency. And the other thing is that you have to put the decision making where it makes the most sense. Most of the security breaches that we're talking about are highly technical in nature, where a CIO is better able to evaluate some of those decisions. Not all companies have a CEO that came from a technology train in order to be able to make those decisions. So I think it makes more sense to have the CISO report to somebody in the technology world. That's great, thank you for that. Now the other question I have for you is in terms of FINRA's experience with Splunk, did it start with SecOps in security or was it sort of IT operations? It did, it started with security. We were disenfranchised with traditional Sims that were out there and we decided to go with Splunk and we made the decision that security was going to own it, but we wanted it to be a corporate asset from day one. And we worked our tails off to integrate through brown bags, through training. So we permeated through the organization. And on any given week, we pull about 35 to 40% of all of technology is using Splunk at FINRA. So I'm curious as to, we heard some announcements today, I don't know if you saw them, about Splunknext building on that, Splunk for the line of business, the business flow, they did a nice demo there. Do you see, because security was sort of was the starting point and your mission was always to permeate the organization, do you see that continuing to other parts of the organization more aggressively now given this sort of democratization of data for the business lines and will you guys be a part of that or directly? We hope so, we hope we have part of that change too. I mean, the more we can use the same data for even business users, that would help them. That would relieve a lot of, they've made this point again and again in the keynote too that the IT ops and SecOps are already burdened enough. So how do we make life easy for business users to actually leverage the same data? So we hope to be able to put these tools up and see if we can make any difference to business users. So you guys have put a lot of emphasis on integrating with Splunk and AWS Cloud. You have a presentation later on today at Conf 18 around the AWS Firehose. What's that all about? What's the AWS Firehose? How are you integrating it? Why is it important? So it is streaming and it allows me to get information from AWS that's typically in something called CloudWatch logs that is really difficult to be able to talk to. And I want to get it into Splunk so that I can get more value from it. And what I'm able to do is put something called a subscription filter on it and flow that data directly into Splunk. So Splunk worked with AWS to create this integration between the two tools. And we think we've taken it to a high level. We use it for Lambda to grab those logs. We use it for VPC flow logs. We're using it for as SAS providers provide APIs into their data. We use it for that. And finally we're going to be doing database activity monitoring all leveraging this same technology. Love it. I mean, you guys are on the forefront of cloud and Splunk integration, cloud adoption, DevOps. You guys have always been great about sharing your knowledge with others and really appreciate you guys coming on theCUBE. Thank you. Thanks for having us. You're welcome. All right, keep it right there, everybody. Stu and I are back. You're watching theCUBE from Conf 18 Splunk's big user conference. We'll be right back.


Hi everyone, Joe for jazzy's casebreaks.com coming at you with 2017-18 Panini Prison Basketball 10 box random team break number two blaster edition You can see Nick Jaspy right there. That's the second half of the case that we're popping open We just finished the first one a moment ago big. Thanks all of these folks right here one spot gets you three teams So let's triple you up I feel like no, why are there two different star that's this extra stars are confusing here.  Let's randomize it Hard eight four to four eight times one two three and Eighth and final time after eight. We've got Kevin down to E eight. All right four to four hard eight four teams two Three and eighth and final time after eight Orlando magic All the way down to the Portland trailblazers All right, Kevin with the magic Adam with the spurs Kevin with the clippers Adam with the Pacers Chris with the rockets Francis with the Raptors Chris with the Warriors Francis with my Lakers Brian with the Knicks and the Sixers Russell with the Bucks Adam with the pistons and Mavs EA with the Wizards Adam with the Grizz Kevin with the calves Adam with the Kings and Pelicans EA with the Hornets Adam with the Suns Russ with the Thunder Chris with the nuggets Francis with the T Wolves Adam with the Celtics There you go and the Bulls Russell with the Hawks Brian with the jazz Adam with the Nets and the heat and EA with the Portland trailblazers Blazing them trails Let's sort by column B and are there any trades? Remember, this is the 2017 NBA draft class Markel folds Lonzo ball Jason Tatum Josh Jackson and Deirene Fox were one through five Lori Markin is in here Dennis Smith Jr. Donovan Mitchell Bama to bio so on and so forth Kyle Kuzma Jared Allen Josh Hart So on and so forth Raptors and Wolves up for trades says Francis. Anybody's interested We'll give it a few moments while Nick is ripping open those packs up there Just to get give us a head start and then we'll be able to fly through the break Schedules in the chat. We are booked for the night We might have time for like a quick break at the very end, but for for the most part. We're pretty much booked, but What's not booked yet is the Instagram stream at Jasper's breaks on Instagram live at Jasper's breaks JASP YS breaks B R E a KS Jaspeys at Jasper's breaks on Instagram live. We're live right now, and you have a chance at some hit packs There's a for those of you who are Feeling a little spicy scared money. Don't make money. We've got high end hit packs Available with only I think two or three spots left Only two or three spots left in that you got to be present It's a draft a hit draft on our personal breaks channel at Jasper's breaks All right, so we do have some trade offers here raptors wolves about rockets nuggets up for trade. There you go Okay, that's Chris. Yeah, that's Jay Russell has all There's There you go. You can see green highlighted in green right there. He'll trade all three of his teams for the heat Adam Kelly if you're listening sometimes he's usually listens in the background Otherwise we will roll All right trade window going once trade window going twice TWC in the chat means trade window closed Let's print. Let's rip. Good luck everybody a stack of boxes right here Veteran Commons don't ship veteran parallels do and then LeBron James vet base will ship These calves addition in this Kobe if any There's another veteran common that will ship in Yanis onto the compo as well We would add Luca Donchich, but he doesn't exist in this set When this set came out no one no one had any idea who Luke Donchich was most most people Brian and the jazz unless you were seriously following European basketball in 2017-18 and was following the progress of hot like 15 year old prospect Luca Donchich and his rise to FC Barcelona every play. There's Derek white spurs. It'll be for Adam Kelly Question Patrick I got that for you hang on it was 80 bucks got you three teams. It was a 10-spot break 80 got see a three So whatever the math is on that 80 divided by three So during Finney Smith is a silvers that will ship So will the Al Horford Josh Hart emergent Emmanuel moody. These green ones aren't numbered by the way TJ leaf Yanis Oh Jolaine Kobe Ryan. There he is Kobe Francis with my Lakers Kobe Bryant game-worn material And we've got the Josh Hart silver Chris for you. Yes, if I see a Steph Curry in here, I Will ship one to you Did I pass one now I'm on the hook for that Steph Curry now I got to go through this oh man Boy, all right. There it is Chris takes the One off the list of that common request of the day He has taken it No more after that Good one Chris you've that's part of the the secret Jaspie's menu I get in and out There's only three left for no, I'll do noir tonight That's easy So how about this we are booked for the night unless noir cells and I'll do that there's Jason Tatum Celtics that'll be for Adam Kelly There's on a bogu Pacers That will be for Adam Kelly. I've got to save all these rookie silvers Just in case this JJ watt TJ watt Derek watt commercial Do you think that that's their real mom? Nice Jason Tatum on top No, there's no new player discount. Unfortunately Our prices are good enough That goes to the Lakers never know Francis could be a late bloomer It's a Donovan Mitchell emergent insert a Wesley a woundu relic for the Orlando magic that'll be for Kevin one of his last spot mojo teams Marvin Williams silver that'll ship I've been hearing that those Lonzo rookies Still doing okay on a secondary mark and nice faults. I did Thomas Bryant really get 25 and 3 3 and 25 I didn't realize that it's not bad for Thomas Bryant. It was Dante eggs him What about him? I don't feel about Dante eggs and Brian Magnus with the jazz. I Feel like people were talking about him in the draft and being like oh this guy's gonna be incredible and this and that but I don't think he's really quite hit his stride yet Exams hurt. He always seems like he's hurt to him. Maybe it's unfair to judge eggs him until Until he's put together a relatively healthy season, but It's Cavs LeBron by the way for Kevin. There's Wilson Chandler Denver Nuggets Jersey For Chris Chris Johnston Patrick if you look on the site, it should say how many boxes are in that? In that noir Derek D. We'll just tell you then Gordon Hayward Gordon Hayward Celtics Adam Kelly Patrick Nick's gonna tell him to Just trying to get people to read the site my constant efforts To do that There's the Jason Tatum rookie for Adam Kelly. Oh I see it's not in the random number block thingy. Okay. All right. Hey, that's just a base Jason Tatum Adam, but Still solid. There's John Collins two-color Jersey Atlanta Russell Green with the Hawks Tyler unfortunately we are booked for the night unless that noir fills Then I'll do that noir But we're pretty much at the end of our evening by the time we do all the breaks out in the schedule that I just dropped Silver Kyle Kuzma Francis with my Lakers. Let's go Kuz I'm even gonna top of this Lakers bias, right? This is blatant Lakers bias Look at that Top-loading the Kuzma Nikola Jokic Jersey going to Chris and the Nuggets But they don't do coaches cards anymore. No one wants to collect a coach, right? Anyone collecting Luke Walden who's just like, oh, I gotta get that coach Luke Walden rainbow going Kevin Garnett T Wolves Francis With the KG KG hands off the glass KG And Terrence Ferguson Silver Russell Green with okc and there you have it I'm Joe for jazzy's case breaks calm And that was the second half of that blaster case that we popped open of 1718 Panini prism basketball Thanks for watching. I'll see you next time. Bye. Bye


How are you? How are you? Yeah. Can you go? Oh, nice. Sick. It's the S-Fan TV email. Sick. Oh, nice. You got Aspen too. I got it on. Look, a perfect hairline. Look, Mumblecat made this. The complete and total character merge of the Diablo. This is like 100% perfect. That's so good. Guys, we're here. We're at TwitchCon. We got Armory Creek going on. We got Miz. Got Tocan down there. Bonnie is down there. There's a lot of people. So my voice is already gone a little bit. Let's get to it. Cool. Yo, what's up, man? How's it going? Love your shoes. Thanks, dude. My favorite part is watching E-Rob see that you met Morshan Lovett. He was seething. I couldn't stand it. I wanted to do a tailgate with E-Rob, so A&M was pretty good, but that I was stable. We did it so funny. It was so good. It'll be funny every time, but I can't wait to see it. Yeah, yeah, dude. For sure. So, all right, picture me. Hey, how's it going? I'm good. How are you? I'm great. You're doing great. You're doing great. Nice. Look at the Jay Slap, man, look at that. That's a very real, unedited picture. Yeah. I thought it would really bring the outfit together, so. Of course, of course. Absolutely. This is iPod. Wait, this is like an actual old Squire Pod. I wanted to take a selfie with it. What the heck, OK? I don't remember them being so small. That's crazy. The quality is so bad, too, but it's honestly funny. Yeah. S-Fan, the TV. Hey, how's it going? How you doing? I'm good. I got a question for you. OK. Can you sign my cock? I would love to do that. Actually, I would love to do that. OK, there you go. Thank you. That'll work. Good to meet you, man. Cockay. S-Fan, it's Tidderman. How's it going, dude? Yeah, good to meet you, man. Me, too, you, too. Yeah, this is Tidderman. He's the most wholesome viewer on Twitch.  Yeah, he's honest. Hey, how's it going? Nice, how are you? Yeah, I'm good. I'm good, I'm good. Yeah. You're, like, oh, do you love me? You're sure to say. I literally don't know any of the songs from this band. It's sick, though. Yeah, I like wearing it, though. Nice. From one, welcome to another. Can I ask you to sign my Merlot? Or is that against the OS? I can sign it? You want to sign the Merlot? Please. OK. OK, ready? This is hot. It's pretty awesome. OK, right there. Right here? Yeah, yeah, yeah. It's going to be perfect. You're going to get to Tidderman tonight. All right, there you go. Could I get missed the sign, too, or is that against? Oh. Not allowed. Not allowed. Yeah, you're good. No, I'm not allowed to get one there. All right. Hey, oh, nice. Pizza. Delivery. It's Tidderman. I paid $300 to get in the door. You going to sit? Wait, what? You paid $300 to get here? No. Oh, I was going to say. I actually, oh, why? I actually, I just picked these guys in the backpack. Oh, OK. Would you mind signing? Yeah, yeah, yeah, it's fine. Take your choice. OK. Pizza back in there. They're going to resell that. Oh, Pat, yo, what's up there? How you doing? Good to see you, dude. Yeah, man. Chad is Pat. It's me. It's Pat and Chad. There you go. There you go. I had to see you, man. Tell Pat to unbend me. Where you used to watch back in the day? You won't tell me. Mine? No. Move. Oh. Ludwig? He's turning the camera into somebody.  You should go over there and just say hi to Astro and Ludwig. Well, they're just all state business. Yeah, OK. X-Fan just told me to come over here and say hi. Hi, dude. What's up, man? How's it going? I've been a viewer for a little bit, you know? Oh, yeah, yeah. OTK Stan, you know? Yeah, nice. It's nice to meet you, eh? Yeah, dude, of course. I didn't know I could get privileges like this, but I'm really, really nice to run the show. Well, the thing is, is you can just, that's why they wanted to put us together, because we wanted to, we knew people were going to want to go to both. Yeah, yeah, yeah, yeah, yeah. Hey, how's it going, man? How's it going? I'm getting my files. How you doing? Yeah, yeah.   What do you got? Let's see what you got.  Oh, no, I got my bag. OK, OK, ready? There you go. Nice. Can I have your sign? Yeah, you can just go ahead and sign it. What? What, my sign? Yeah. I have to leave it for now. OK. If you see me walking around with it, maybe you can get it that way. But I have to leave it for now. Yeah, yeah, yeah, yeah, yeah. All right, yo, what's up? Chad's Unis, he gave me a adapter in huge witch con, so I can charge myself. So you hold this up? Yeah. That is sick. Man, I can't wait to be Miss Kipps. He holds a ring. Miss Kipp is a liar, by the way, because I thought he was supposed to be bald, but this is bald, all right? This fucker, he's been lying this whole time. There he is. Hey, how's it going? I think he's since like yesterday. Is it, right? Yeah, well, yeah, they're good. Are you getting that one? See, I got the Otecan merch today. You have the Otecan merch? Hey, otecannetwork.com, new merch, new merch is available now. Also, StarForge systems, scanner, software, all of it. Yeah, everything, mad mushroom, yeah. And then talent, everything. If you buy all of those things, it makes you more successful in life.  You'll be gambling and everything. Yeah, no gambling, though. No gambling. That's good. He's actually a huge fan of yours. I'm doing great. It's good to finally meet you. Yeah, you too. Yeah. Tell them what you all love to stream. Yeah. The fact that I know nothing about you. I knew. Yeah, it's like, hey, what's that? I've never been on TV. I don't even know much about you. Hey, you know what? You want to look crazy for it? I support my son. I don't either, and I've been here for six years. Hey. Yeah. Let's go as a fandom. Yeah. What's up, brother? Oh, man, I'm sorry. I didn't mean to hurt your broken thumb. Take off the hat, take off the hat. Oh, hat? See, this is real long. Yeah, that's actually real long.  Your whole stream is a scam. I know. Yeah, so the only reason I said that is because I remember one time you had a stream sniper who was like, oh, yeah, Esfand, I love you. I watch your streams all the time. Hey, what happened to your hand? And you're like, well, obviously, you don't watch a stream if you don't know what happened to my hand, all right? So I always think it's so funny. All right, hey. Have a cool day, man. Yo, Jeff Bonnie's here. I had the express lane. The express lane. I was a cool kid out. I did a weird one. OK. Leased on my pants. Yes. Thank you. Two KT6 selfies. Yes. Oh my goodness. Thanks. You're sure?  I got people signed in all over. All right, all right. Oh, sorry. Let's go. Yeah, of course. I'm getting married next year to Leonard. I'm Biocock on Miss Court's Discord server. We're getting married next year. I've never met him before. But he sent me pictures. He looks basically like the beautifulness that Miss Kibbe is. Bro. He's gonna be a love base to him. But you know, who can blame him? He's beautiful. He's my husband. This is crazy right now. Bro, she found the person in my Discord and she's getting married to him. Next year. It's real. Wait, so let me get some room. Why are you not in my line? Because your line was reserved. Did you see all the people you had? Yeah, dude. It was reserved in like the first hour. Fuck, my bad. Yeah, it is your fault. It's OK.  Let's go back. Bye. Bye. Yeah, of course.  Oh, yeah. No, that's great, dude. You ever take it? I do. I do, actually. Oh, OK. Somebody told viewers. Look, they are tall. I'm not short. I'll put them in the next layer. I'm six feet tall. OK. You've been looking short. I'm not short, bro. Like what? I'm six feet tall. It was on the line. It would have been coming in a line, but taller to you. I can't go a lot. I'm six feet. Like, I was literally tall. But I'm above average. Yo, how's it going, dude? It's you. You're so much better. Yeah. You and your friends. I'm so nice to see you, good body. She was my first to say, and I'm so sorry. But you're the second. You're the first. You're the first. Sick. Sick. Good choice. How you doing, man? How's it going? Great to see you. Yeah, yeah, yeah. You were tall the last time I saw you, but you were like. I did not. Did you shrink a little bit? No, the floor here is short.   Who's my friend, Vox? Five years, he's going to be on Cameo, so. What if I give you half of what he gives me, a gift of thumbs? No, just give me the 50 bucks. I have two of them. Just do it for thumbs. Wait, what? You're pale. Yeah, no, just give me the cash. I got 20 bucks. I got 20 bucks. Tell these guys, just give me the cash. Don't give stuff. Just give you 20 bucks now, if you want. All right, Vox, here you go, buddy.  You're the frickin' frick yourself. Frick face. Thank you very much. Does it freak yourself? Freak yourself. As long as you shrink. No, for some reason, like half the people who've come to meet you today are taller than I am. I don't know why, but I'm not short. I'm six feet tall. OK, just clarify. All right. I'm a reddit. Nice. I love your stuff. I love your metal palette playlist.  But I need to take a photo with you so that I can convince my guilt to give me a shadow more than the other one. Reddit has a second shadow. There you go. Could you mind if we take a photo? Yeah, of course. All right, so who's getting the other shadow? Fury first. Well, let's record a video. You got to post it in your display. Yeah, OK.  Shadow morn is Rhett Pryo. It's always been Rhett Pryo. Every weapon, every two-hander, every piece of gear is Rhett Pryo, OK?  But what else could you expect from a horde guild giving us preferential treatment to orcs? Just shameless, man. It's disgusting. Thank you. Thank you. Thank you. Of course.  Perversional camera. Do you have to pose? Hey, Chad, look at this. Look, Mumbocat made this. The complete and total character immersion of the Diablo. She drew that. Isn't that crazy? This is like 100% perfect. That's so good. OK.  It's OK. We're getting out. Our line is so good. Why are you so good at talking, man? Do your real one, too. Why are you so good at talking? Why are you so good at talking? How are you? How are you? I'm good. I watch you forever. Yeah. Can I film your reaction? OK. Sure. I got to get this. She's going to film my reaction. Ready? Here you go. OK. Oh, nice. Nice. Sick. It's the S-Fan TV mode. Sick. There you go. Cool. Oh, nice. Like a smith.  You got Aspen, too. Look. Perfect hairline. Sick. Oh, you got Emory? Nice. Look, it's Emmy. Very good. Wait, who's this? Oh, that's Tyler. Oh, yeah. Wait, screw him. We're going to get this Emmy. We're going to get the Emmy. All right. We'll see you later. Bye, Jess. How's it going? I think it's good. Huh? What? What? I saw you. Man. What's up, man? How's it going? Oh, dude. What's up, man?  That's awesome. Yeah. S-Fan. Hello. He wants to say hi to you. Hello. Why do you want to say hi to me? I don't know. She's your biggest fan, bro. I'm your biggest fan, S-Fan. You are not.  I watched, like, two sh- I watched an extreme and a half, man. You did not watch an extreme and a half. You watched, like, 10 minutes. And it was because you follow, and then you went AFK. You forgot. Unbelievable. I'm just like, it's never a meet and greet time. It's a contact.


So I'd like to start with where this book came from and you say in the book that it all started really with the curiosity of a child So Dr. Trisankos, would you tell us a little who Annie Aguiah is and the role that she played in making this book happen. Yes, Annie Pani Agua is the daughter of Dr. And Christina Pani Agua here in Tyler and we Dedicated the book to her it says in the in the beginning to Annie Pani Agua and And her parents gave us permission to share the story, but it did start back in 2018 when she Had been to mass with her parents and she was a little inattentive and after mass her parents asked her to research the Eucharist online to look up something to help her Understand reverence and what it means and she came across the Eucharistic Miracles and And was so fascinated with a YouTube video She saw on the Buenos Aires Miracles that her father sent the YouTube video to Bishop and Bishop Strickland sent it to me and asked me to give talks on the Eucharistic Miracles and the diocese and and As an answer to prayer Because I wanted to see the data for myself before I started talking about it and writing about it the lead investigator of the Buenos Aires Miracles Miraculously walked up to Bishop Strickland outside of the chapel in Sydney, Australia When he was visiting there and handed him the books with the data I had been praying to see in it and Bishop Strickland sent it to me So be careful what you pray for because the thing I prayed for landed on my desk literally So we had to write the book the rest of the story father George can tell because then it was his idea To put together the beautiful scripture and tradition


And I'm proud of our guys and we earned the right to be here. I thought we earned the right to be in this game. And it would have come up a point short. I'm just heartbroken for these guys. They played it all on the line fours all year and did everything we asked. And it's just tough. Christian goes up and makes plays for us. On that third or fourth down there, he went up and made that play at midfield. And then we probably should have thrown it under and tried to kick a field goal to win it. But we had confidence in him and Connor. It's just, it's not one play. It's a time of possession really hurt us, I thought, defensively. And they got a heck of a football team. And I thought we stood right there with him toe to toe and went for four quarters. We've got great kids and they laid it all out there for us. Just proud of them, really am.


Good morning. Good morning, everyone. Welcome to the OpenShift Coffee Break show and I will make sure that I will stop any echo. Good morning. Welcome back to the OpenShift Coffee Break show here at OpenShift TV. Sure. I'm Roberto Caradela. I'm based in Madrid and I'm part of the EMEA Specialist Solution Artist focusing in OpenShift and also in SCS. Yeah, I'm Rodrigo Alvarez. Hello there. I'm based in Dubai and now it's 4 to 1 degrees. So, yes, as you can imagine, it's freaking hot. And I'm part of the same team as Roberto. So, yeah, today I'm here to talk about the SCS and ACS. Yeah, and it's based in Stackbox that we acquired a couple of months ago and we now have the... You know, we're celebrating the GA of the ACS operator. But we would like to celebrate it with a live team. Kind of also as a way, read that way, you know, the old things, always live. That is very cool. So, we have this agenda. I think Roberto and Rodrigo is going to show this demo about that SecOps pipeline. So, would you like Roberto to introduce the concept? I don't know if you have any diagram to share. Yeah, I have a couple of slides talking about the SecOps in Halberd Cloud with Red Hat and also why the SecOps is important and why this ACS and the integrations with all the very nice products like OpenShift ketops, OpenShift pipeline and so on. And we can go through the demo. I will share my screen if everything goes well. I don't know if you can see it, my screen? Yes, I can. Okay, perfect. So, I will present us and we can speak about the SecOps in Halberd Cloud with Red Hat. And my first question is what we need to answer is why the SecOps is important? Why can this affect my business and my applications? So, the SecOps allows IT and security teams to tackle challenges across people, processes and technologies and allows improving, for example, speed and efficiency or just consistency, making things repetitively and improving also collaboration. And the things is that security can no longer be only the concern of the only security teams and needs to be included in earlier conversations, for example, with the development and the DevOps teams among others. So, security team needs to be part of this conversation in our DevOps team earlier and also having the possibility to add security in the different processes of development, deployment and runtime of our workloads and our business. And on the other hand, DevOps necessary needs to have these appropriate tools that help the security management in the task. So, it needs to have a very nice tools in order to improve the different layers of security in our pipelines and our processes as well. The thing is that in most organizations focus only in the application itself, in the application pipeline, but also it's important sometimes to add security process across the entire lifecycle using, for example, the SecOps. So, adding integrity of the libraries used called scanning, we will show in the live demo the whole lifecycle using also security steps in this SecOps pipeline and also other possibilities that we can discuss about. And we need to think that security must be continuous and realistic. SecOps allows you to approach this security continuously and realistically across the application and infrastructure. They've added in different phases like, for example, build, run, manage, adapt, but we need to think that this needs to be a continuous walkthrough. And why Red Hat for DevOps? How can Red Hat help in the DexterCops? Red Hat OpenShift platform have a vision to have a hybrid cloud platform for enterprises to build, deploy and run application in security at a scale. So, for example, Red Hat delivers continuous security for containers and Kubernetes with OpenShift platform. Using, for example, and providing trusted content, having this lifecycle of the platform, using also a strong role-based access control, having a network isolation and container isolation and so on. And ACS, and this is the good part, extends the security also to application layer, for example, as vulnerability analysis or the configuration app analysis. And also, for example, using compliance assessment or risk profiling or even in the runtime checking if there is any threat and making the incident response as well. So, ACS, Red Hat Advanced Cluster Security for Kubernetes, have and focus in three different parts. The secure supply chain, giving tools to the different developers in order to have more integration and have more tools in order to, for example, integrate and scan in the different pipelines. Also, have the possibility to secure the infrastructure, giving the security post management to, for example, identify if there is any threats or just remediate any wrong configuration or something like that. And on the other hand, also in the runtime and it is very, very important to secure the workload, to maintain this thorough trust execution and do this workload protection as well. And we need to remember that Red Hat Advanced Cluster Security for Kubernetes, ACS, is the first Kubernetes-native security platform. So, it's the first and it's built for Kubernetes and running in Kubernetes. And for this reason, have a very nice integrations, for example, using the image scanning that it's in the industry, like Clare, Tinego, their own anchor, also the integrations with different registries. And the registries in SAS or itself with Kuiayou or other registries with Hub or something like that. Also the integration with CACD. In this demo, we will show how well integrates ACS with OpenShift pipelines, but could be also integrated with other CACD tools. And obviously you need to know what's going on in your platform, so you can connect with Devote Notification. And we can see also the Slack connection or the Microsoft Teams from some alerts that you can notify if anything's wrong or something like that. And also the Sion, for example, to bring these different logs or different activities and bring these different log systems and activity threads to an Splank or a Sumo Logic or also interact with another SAS tools like AWS Security Hub. So the first thing is that with all of that, we can secure the containers and shift the security left. Once this shift security left, it's trying to give the different developers and the different teams tools in order to bring the security in the early stages. For example, when the developer is trying to build the code, giving them tools in order to identify with their pipelines if there is any vulnerability or if there is anything that goes wrong with the configuration. And answering also securing the Kubernetes platform, having, for example, a strong admission and checking, for example, that no privileged spots can run. Also, if there is any critical vulnerabilities in the pod, I won't allow to deploy these pods and also having these compliance and risk assessment in the different platforms and the different Kubernetes and open shift clusters that we manage with ACS. And finally, securing the container runtime, because this is very, very important, how we can secure our workloads, how we can try to, when we are running our applications, detect if there is anything wrong, if there is any attack and try to isolate this attack in order to having, for example, micro segmentation with network policies or very strict policies in order to not running some crypto miners or anomalous behavior. And if there is any threat, we can kill and enforce the pod that offends and files the violation itself. And the pipeline, we want to also show in the demo, the integration with ACS and also other open source tools that we bring. And did it's more or less the CHCD pipeline using also and introducing also security steps, not only focusing in build and deploy our source code and building the images and deploying on open shift. Also, having, for example, unit test code analysis security scanning for detecting the vulnerabilities and so on. Did it's very, very important in order to bring and add more steps of security to our DevOps pipeline itself. And our demo of Dexacops pipeline. And it's more or less with that we will bring together the three things that from my perspective are also that are open shift pipelines based in tecton. On the other hand, open shift ketops as well. Based in our city. And ACS as well with advanced cluster security for Kubernetes. Also, we will use another tools like a good server with basic goals. Units sonar cube nexus subproxy and gotten all of them are open source and you can build your DevOps pipeline. Very easily adding more and more to the scenario. So what do you think guys, we can check the pipelines if we wanted to go for it. I think it's a go ahead. And just you. It's nice to say as well basically that today's demo is going to be focused on and to when from the developer point of view to delivering the application itself.   The first thing that we need to know. It's what's what we can do to install our different components. For example, I install I already install open shift key tops that brings our city into our scenario and we can use key tops in a very nice way to the continuous deployment. Also red hat open shift pipelines that it's based in tecton and we will use this tecton pipeline and open shift pipelines itself based in tecton and also this guy that it's the advanced cluster security that this is the operator that when GA on I think in Friday when Saturday. The good thing is that with the operator. It's a very nice way to install it. You have also other possibilities to install ACS that in the past you can have the possibility to install it with the gem itself, or using help charts, but this is a very nice way. And the most impressive thing is that you have also the channels and you have this approval that it's automatic. So when a new ACS release pop up, you can automatically have an upgrade your entire ACS cluster without doing anything. So it's very awesome. We can check for example, if we go to the stock box itself. We can check the central and we deploy it using the create central. So central it's imagine that central is the brain of ACS and it's everything that needs to have and needs to analyze. It's going to the central. So you can install it in a very nice way. Just deploy the central and afterwards the security manage of the different clusters. So first of all, you deploy the central. And afterwards you deploy the manage security and the different components like the central and so on that we can explain now. But this is the first thing that you can do after you install the ACS operator. So for example, you have in here that you can control the admin password, also the exposure and you can expose like an open shift route that I did in this demo. But also you can have the possibility to explore all the possibilities with load balancer or load pause or something like that. Also use your own certificate or for example, if you want to have your scanner or not of basing in the stock box. Imagine that you are using the query or scanner and you don't need it so you can disable as well. And also the good thing is that you can install ACS in a fully disconnected way. So in this case, you can control if your ACS connects to the Internet or not deploying your operator and deploying your cluster fully prepped. So it's very, very easy and we install it like this way. And after that install it, we have and I will go to the developer view. And in the developer view, we have the different pieces. Did it's the central that it's the brain and also the scanner and the scanner DB that is the scanner and the vulnerability scanner, like where you are from stock box from ACS. And also the different pieces that are from specifically managed cluster. So when you want to manage one cluster, automatically you can deploy from the operator and the different pieces that connects to the central. In this case, the mission control the cluster like the Kubernetes and obviously for very in a very easy way using this directly or using also their own operator. So in the own operator, you can see, for example, let me go again to this, you can check also the secure clusters and you can add the secure clusters whatever you want. For example, you need to connect to the central endpoint and so on. And we have also in store OpenShift GitOps, OpenShift pipelines and ACS that are the three building blocks that we have in here. But also we need to check other things that are very good stuff for our developer Dexacops pipeline. In this case, we have different things like Gox servers, the trigger and so on that we can explore when we launch. The first thing that we need to do is simulate that we are a developer. We are a developer that wants to launch our pipeline. So what's the first thing that we need to do? Go to our Git server. This Git server, it's a basic Gox, but you can use whatever you want. So for example, in this case, we have the source code that this is a Sprint Pet Clinic, a very nice Sprint application. Yeah, that is a popular Sprint Moot app. Yeah, that's right. We have in here we have our repo and also we have also the other repo. This repo represents and have the GitOps way. So we will have the deployment use, the customization, the root and the service and everything that we need in order to have it. Nice. Also, there was a story to interrupt. There is a question in the chat because you mentioned it. So, Alos Doug is asking, what's the difference between Kweios scanner and the one included in Stackrocks? Are they complementary in some way? They are based and they are scanning amongst different vulnerabilities and different CPEs. So you will receive the different, for example, approaches, but basically it's more or less the same. It's scanning the image for different vulnerabilities going through different sources. So it could be that have a slightly difference between the scanning one image and another using Stackrocks scanner and Kweios. But basically do the same thing. That is scan your image in order to check for vulnerabilities. And also it's nice to highlight that you can integrate ACS with Clare, for example. So basically you have that Kweios integration. Yeah, so can you show that? Yeah. Exactly. So you can integrate with Clare. You can basically integrate with Red Hat, Kweios. So it's quite simple to integrate. So you don't need to just rely on the Stackrocks scanner. So you can basically integrate with existing ones. Yeah, this is very nice because you can. Awesome. My pleasure. Also, we have in here the different deployment, for example, and we have the deployment and so on that we will use in a very Github's way. So we have our Agosidit in here and our Agosidit. The thing it's doing it. Open it. Yeah. It's having the next Spring Pet Clinic and this is in the environment that having depth and states using the customization to bring the Github's and also syncing the different things. But in this case, it's syncing everything but not the deploy because we are not building our image and the image is not available. So we need to first of all introduce a change where we will introduce a change in the Pet Clinic. So in the Pet Clinic, we will introduce a change. For example, if we look in or if we want to introduce a change in the rhythm, like for example, I will reduce demo time and in this demo time, we will introduce that. And there is a webhook and this webhook triggers our pipeline. This pipeline goes through the different steps. In this case, we will source and clone the different code that is in here for our application. Also, we'll go through the different code analysis, unit testing and dependency report. So we can check that effectively it's cloning our application itself and afterwards in parallel for saving time, we will run first of all the code analysis based in Sonacube. So we have also our Sonacube. Also, our dependency reports for now the different dependencies that have our stream application and also the unit test that is the unit test based in the unit. So in the details, you can see the different things that are going through. And after that, we can check because we have this code analysis and dependencies reports in a very nice way to show the developers. So we are introducing the static analysis of our code, providing tools to our developers. Also, to having for example, before then building the image and building the article, we are giving them the possibility to give us a static analysis of our code. Also, the unit test as well. And seeing the dependencies reports for for example checking if there is anything wrong or not. This can be checked also when it's built the dependency reports in a in an engine server that it's called reports repo that I've used because we rely on the different parallel things and this spins up different parts. And the nice way that it's going with OpenShift pipelines is that you can parallelize and you can bring the different automation and Kubernetes native pipelines to do that. For example, you can have also the exact same pipeline using Jenkins, but you need to rely in a central Jenkins server and in a very nice way. Tech Tony is doing that. So when this is finished, that it's launching the different unit test, we will have our result that it's going through takes like 30 seconds more. But the thing that I want to show is nice. We have the build success and we run a lot of tests for two tests and everything is okay. And afterwards, we are using Nexus for two things. This Nexus will have first of all, for once we built our job, our artifact, we will push directly to the Nexus for what reason, because we want to control where it's located the different jobs. But also we will use Nexus as the main thing. But meanwhile, we can check the different sonar cube results. So if we go to the sonar cube, we can check the different projects and in this case, we have the pet clinic itself. So we can check the code that have and we can check also the vulnerabilities. So this is important also to show and to have the proper tools to the different developers, because in this way, you can give them the possibility to check the different analysis of their own code. Also, in the Nexus that we showed, I will close some tabs, because if not, my computer will go. Okay, in here, after this release of this app, this release of this app, this will push directly to the Nexus. So we will using Nexus for building our proper job. And if we go to the snapshot itself, we can see in here that effectively we have our job in here with our artifact ID and the version that we built. So once we have in here and the developer knows that the code is okay, or at least having static analysis of the different phases and also have the dependency reports and the unit test, we can build the image. We built the image based in Java 11, but we know that this is a trusted source. For what reason, because we know that this went from the registry.drexha.io that it's a secure registry. And also we are using this because we know that these images have specific analysis and more information about that. So if we have this information, we need to use also as a Maven mirror. So we will use the Nexus as our, we will build our image using the dependencies from the Maven public. And why this? Because we want to show also where are the different and where are the three are awesome. These three pieces that runs in parallel are the integrations from our OpenShift pipelines to ACS. So we are and we will integrate and we will run an image scan using ACS registry. And afterwards we will analyze the different vulnerabilities and check if there is okay or not. This stuff here, right back. Okay. Now should be good. I'm sorry about this little issue, technical issue we have. And now it should, everything should be fine. We have some issue on the OBS side that we are using for streaming. And Roberto, yeah, I think we just lost the one step that the image scan. Yeah, the image scan. This is the interesting one because we are using this OpenShift pipeline and using the ROCK CTL. ROCK CTL is a common line tool for integrating in every CI CT tool and going also, for example, in this case, we are scanning the application that we, the image that we built. And also, we after that application build, we can see directly a very nice report of our own image that we already checked. So we have in here a lot of information and a lot of things of the different information that we have of our application. So you can check in here that it's Sprint Pet Clinic with the show. And we have the different CBEs that we can get more information. For example, we have these CBEs and so on. Did it's good stuff. But also, we can check different things among the image that we already built. For example, we don't want to anyone have the package manager in the image. And for this reason, this system policy failed because detect that in one layer of the image that we already built have MPM or YAM. Or on the other hand, for example, have vulnerabilities that could be fixable with modern scoring of seven. So these vulnerabilities are defined in ACS and are fully managed. And on the other hand, we can check this. This is from build and we can stop our build. Imagine that you don't want to in any way to build your image. So you can enforce this guy in order to, if there is any CBE detected in your image build, stop and fail the build. So you can prevent your developers to bring applications or bring or build different images containing CBEs or containing the different things that you don't want to. Imagine that you are detecting a cell shock or a head bleed in your image. You need to prevent to deploy this image. And also, in the deployment check, you can check not only in build. Also, you can check the deployment of your own application. In this case, we are checking the different deployment of Kubernetes. In this case, we are checking amongst the different system policies, the different Kubernetes checks. In this case, for example, we can check what are the system policies. The system policies of ACS divided in three layers in build, in deploy, or in runtime. For example, the thing that we noticed before. I, as a security team, don't want that my developers build any image that have CBEs with scoring more than seven. So we can check and we can enforce that. And we can just, for example, give them a heads up in order to, guys, you are building images that have this type of CBEs. Please solve them, because if not, could be introducing some risks. But on the other way, you can also have the possibility to enforce. Why is it enforced?  So when you are building the pipeline, if you are not complying with my policy, this checks and fails the build and prevents that anyone builds the image or just deploys the image. So in this case, StarCrocks ACS will fail when the image matches the condition. And if we rerun this, we will see, may well I will rerun this. You can see that effectively will fail the pipeline. But if we go to the pipeline, the last pipeline, also we can check other things because the magic of GitOps happened. And why the magic GitOps happened? Because we have in here one step that it's update deployment. We automatically in this pipeline and in the GitOps server, we pushed and we changed the image one specific chart. So now the image is pointing with VDD fork. This is the image built in our process, the image that went through the different stages of security as well. So it's good stuff because automatically you are pushing and you are changing the code without manual intervention. And this will notice and will spin up the different ARGO CD application. And if you go to ARGO, now we have in here of a very nice deployment that is already live. And in this deployment, if you check the port itself, the port have the VDD fork, the VDD five, that it's the exact same application that we already built. But the everything that it's okay. So if we go, for example, in to our application and to our namespace, we will see. Let me handle this in the Dexacops. Yeah. And we have in here our spent the clean application that we built in a very secure way. And also in the topology, and also in the pipeline, we introduce two steps more that it's the performance test. And this performance test, we are using coupling. This coupling, it's using and it's trying to load a lot of requests to our application. It's like a loading test. And it's producing in a very nice way that we can check in the reports. So we have these reports in here. And if we pick the reports, we can check our application here. And if we check this, we can check first of all, the different dependencies, and we can check the dependencies that we built already in the first place. But also, we can check the coupling. That is different requests that we try to reproduce in order to know if our application is okay or not. And afterwards, finally, up and testing up and testing for what, because when we have already built our application, we need to check from outside. We're creating different attacks and trying to pen test our application in order to know for, for example, if the hybrid vulnerability, it's okay or not. Or if we are using any weak authentication method or anything else, retrieving more information. Returning to the pipeline itself, we can see, let me rerun that because sometimes we can see the different system policies and the different topology. I will shut down this. The good thing is that in the system policies, also the system policies, we can integrate information with different notifiers. In this case, I used Slack. So I used and I integrated ACS with Slack in a very easy way. And now that we have in here, we can check, for example, if anything happens during the build. For example, I can check if one application or if one build is against the different system policies. For example, in this case, I'm checking that this specific build of this container have not the specified request or limits. So they would think it's every system policy, every policy that we already deployed, we can integrate into our systems. In this case, for example, it's very easy because we can integrate this policy automatically enabling notification with Slack. But they are already different. Like for example, you can, if the build fails, open Algebra ticket or just integrating with Splank for seeing the different violations. Or just integrated with Microsoft Teams as well, generating that channel. So this is a very nice way to try to get the information that for your team and for you matters in order to not receive 1000 notification at a second. Only the notifications, only the things that for you already matters in a very nice way. For example, you have in here and they are already detected that in the deployment, your application have, for example, the different things that includes and could include the DNF or LPM or YAM. Also give you the remediation and this is very nice because you can give the developer the different tools and the different information in order to, hey, Mr. developer, you are building something that are not okay, but that are not complaining with my different policies that we already defined. It's a compliance system where you can keep everything in base with your definitions, system policies, integration. I imagine one cool integration is going to be the ticketing system for enabling your process. Very cool. To be honest, I think when it comes to educating the developers to think more in a security point of view, they're going to start thinking about the basic image, right? So they need to be aware, they need to start asking questions like, is my base image updated? So what type of tools are existing in that image? So do I have core or do I have WGAP? So you don't need WGAP on those images, right? So how many vulnerabilities exist within that image? So the ACS allows the developers to be aware exactly what type of problems they can have in production, because you don't want to basically ship and you don't want to introduce new problems in your production environment, right? So ACS allows you to educate your developers like even before having problems during the build phase. Yeah, and also preventing, for example, and enforcing. Imagine that you in production don't want anything that can be built with the CVE or with the LPM or just not using request or limits. You can prevent that. You can check that your own deployment, your own name of Dexacops can have also the information about you don't have this request or limit. And also the rationale for what? And the remediation as well. Given this information directly to the developer and shifting left and adding more security layers and more information and more power to developers to solve the problems, not only for the security teams to be sticking around and giving the heads up every time to the different development teams. Did it very, very good. And also you can enforce. So you can prevent that if these checks and into the development team. And if this fails, you can prevent to deploy the different application or to fail the CI itself. So if we see that it's building the image, so in a couple of minutes, we can see that effectively this when reached the image check fails one specific system policy that we define it. Specific with CSS because we define it in here and we enforce. So in this enforcement, if this policy don't pass fail this policy against our image because our image checked, and we noticed that we have any CVE that goes more than seven on in the scope will fail automatically the CI and will prevent anybody This is during the build phase right so if you want to protect like production you should, you know, set on the deploy as well so that's going to basically lock any creation of the deployment with that that like problematic image. We have a question from the chat there's a vast asking, can you create the custom violations is there any integration with open policy agents. This is a very good question. You can define it wherever you want and it's very, very, very easy to define new policies to define the severity and also the life cycle stage. For example, you don't want to prevent you want to prevent to specific CVE to pop up. So you can prevent in the deployment goes to the description, and after that, for example, you can restrict and also enable the notification. You can define whatever you want. In this case, for example, with a lot of things that affects in built in deploy and in runtime. Imagine that you want to, you don't want to have the possibility to developers to deploy one image that have a CVE. So you can define the specific CVE. In this case, for example, whatever you want. In this case, we can use the example CVE that is called one one. Sorry, two eight. Well, the nice thing as you can see here so it's very user friendly so yeah it's basically drag and drop. Yeah, basically you can do your policy criteria based on drag and drop so. Yeah, and you can, for example, and prevent that anyone deploys a previous container, adding certain capabilities. For example, I can define it that no one can deploy one port or one deployment with a certain capabilities. No one wants to allow it, or at least just in forward in format. And when we have in here, we can define it enforcement. So if this, if anyone tries to in production on whatever you want to deploy in specific deployment with a port without certain capability or with a certain CVE, we can prevent and automatically ACS through an admission controller, the policy admission control will fail. That it's more or less the same thing that it's having with OPA, but in a very, very nice way. Because with here, you can drag and drop, as perfectly said, and we can, for example, define a lot of situations like subcom, privileged containers and so on. It's a very nice way to define it and to control your different policies. So you can define your own policies. And at this stage I don't think there is any integration with OPA and ACS. I think it's going to be something similar to ACM, right. This checking with the PMs and in the future we'll have different things. Okay. And finally, we have in here that effectively we define it the image check. So the image check, we have a violated policy. Because this have an enforcement. So if we have it. And if we check the fixable CPSS, we see that we have this policy enforcement that cause the failure of the whole CICD pipeline automatically because doesn't feel and doesn't pass our compliance because I don't want to anyone put any CVE building my image. And also you have more information because in the image check, the developer can have the possibility to check. Okay, this image fails, but for what reason? I need to have more information. I need to check. We can bring this, we can bring this CVE and automatically know to which components are affecting, to which deployments are affecting as well. And also having more information going directly to the information source. And this is a very nice way to do it. So you can control in a very nice way the different things that you have given the possibility and giving to the developers.  And that's all for our site. Wow. Oh, I mean, it was super lots of stuff. I think you know what I think this reserve also a second session where we go into more details. We had some I'm sorry for our attendees we had a little issue on the streaming so the stream gets split into. But we will make sure to come to join the two recording. So sorry about that, but we were able today to see a complete DevSecOps demo. Really congratulations Roberto Rodrigo that is awesome. And actually I know there's a repository if people want to show the repository as well. I think if it's the one that DevSecOps demo one, the one you shared with me. Yeah, that's the same. Time slide. So I was I was expecting to have time to show how to deploy ACS on CRC, for example. There are some tweaks that you can do with the resource that basically you can have ACS running on your laptop using CRC. But maybe next time. Interesting. Let's do this. It was so interesting that I think it deserve a serious DevSecOps series. We can have some kind of we did this introduction for the next time we're going to do a series where we go into CRC or local development with ACS. And I would like to see also that penetration testing the vulnerability assessment we have seen the wall pipeline today. Maybe we can focus more on the vulnerability assessment of live violation. Like I have my application running this application is doing a live violation. So we have seen the CI part. What is and we talked about the CD part with the ARCO. I was wondering if we have something to say also on, you know, running processes. Yes, of course. A lot of things with the running and detecting also the violations, for example, preventing if anything goes or if anybody do a netcard or an Nmap inside of our container, prevent to do that and itself also kill the pod if this will enforce it or not. So we can have this series for sure. Fantastic. I'm looking forward to it because it's so interesting. I think people really enjoyed also in the chat. There was lots of interaction. I just shared the demo. So the demo was made by Roberto Rodrigo that working in this fantastic demo. I really recommend to try it out. But you can try on CRC, for instance, which is the local development for OpenShift, and you can try on any of your OpenShift cluster available that I'm putting in the chat the link to, you know, start trying OpenShift, start trying ACS, which is now GA. And you can deploy the demo that Roberto Rodrigo today made for us. So, you know, I would like to really thank you for this awesome demo. Recording will be available on the OpenShift YouTube channel. And you know what, we will see again here at OpenShift Coffee Break with a new DevSecOps series, because it's so cool, so interesting. I really enjoyed. So thanks, Roberto and Rodrigo for joining us. Welcome. See you next time. See you next time. And for us, folks, you can stay today on OpenShift TV. We have our regular schedule, if you would like to stay. That goes into from, you know, EMEA afternoon time, and then it goes into the normal schedule. If you go to OpenShift TV, you see all the all the schedule that we have. Let me put the link so you can follow with next things today. We have lots of also episodes, our recurring series. And we see each other for our next appointment that will be July the 28th. We will come back with a pipeline as a code topic together with Jafar and some people from the engineering talking about tecton pipelines as a code. So thank you very much for joining today. Thank you for attending. I look forward to see you on the next OpenShift Coffee Break episode. Ciao. Thank you.


what is a vertical tasting learn more about that and how it can make you look smart in this video welcome back to exotic wine travel i am your host Matthew Horkey today we are going to talk about vertical tasting you know in the wine world you'll hear fancy terms like horizontal tasting vertical tasting what does all that stuff mean in the first place well today we're going to talk about it vertical tasting is when you taste the same grape or the same cuvet from the same producer but different vintages different years different harvest so you can see how the weather the climate of each year the winemaking or the winemaker changed the style of wine when you have horizontal tasting you have the same vintage same grape variety but maybe a few different producers to see how that grape variety performs across the specific vintage it's a very useful tool when it comes to wine professionals how they understand wines for a general consumer it's just flat out fun it also can make you look really smart when you do a lot of vertical tasting you can say things like oh wow it seems like 2003 was a fantastic vintage for Cabernet Sauvignon then you sound cool and impress your friends but anyways we are going to do a vertical tasting today of Etna Biancos from this producer Feudo Cavallieri this is the millimetre because it's growing at a thousand meters Etna Bianco I have 2010 all the way to 2015 made from the grape Caricante Caricante is a high acid grape variety some people believe it's been grown on Etna for over a thousand years really high acidity come some people compared to Riesling if you get the chance to go to Mount Etna it's in Sicily humongous mountain sticks up about I think over 3000 meters so 10,000 11,000 feet above sea level towers over the city of Catania when you're there tasting at the wineries it's so awesome you're sitting there tasting wine and you can see the volcano constantly smoking which is really cool so let's taste through these wines this is a grape that this is a great variety that many professionals believe has a bright future in the south of Italy I'm a big fan of it you know Etna is a volcano so you have these smoky mineral notes that you get from grapes grown in volcanic soil so let's taste through these babies okay so we've tasted through these I've actually tasted through these several times even prior to this recording so I get an idea of what's going on here you know the wines you know I think of the 2015 the 2013 2011 or in the 90-point type of range unfortunately the 2010 was corked so it had some kind of offer almost for those of you don't know what corked wine tastes like doesn't mean that there's little pieces of cork in it it means that there it's got this wet cardboard type of basement smell it's very unpleasant it's unfortunate because the 2010 was unctuous in the mouth layered and everything like that the grape caraconte I have experience with it I don't have a vast vast experience from it from what I've seen in this vertical tasting what are some useful things that you can take away you learn that caraconte is a wine that it maybe doesn't unfurl and gain tons of complexity but it it is long live thanks to its high acidity grapes like riesling as they age they they garner complexity Bordeaux as it ages it it just gains all this complexity this kind of stays good it doesn't really age that much it just puts on a little bit weight you know I prefer the 2015 really really nice wine with caraconte you're going to get these lemony flay a lot of lemus lemon citrus peel white peach maybe even some unripe pineapple high mineral notes high acidity I really like the 2015 13 and 11 it seemed like 14 there was something a little bit different and the seller maybe it was a different winemaker I don't know I met this producer at at the Go Volcanic Summit in Hungary but it was really interested to do this tasting I'll actually have a full tasting article coming up about this really cool you know in the past when I when I just started getting into the wine industry I thought oh wow you know scoring wine so easy you swish it around you evaluate it and you just you just say your opinion what I didn't realize is the further you get into it I have more and more respect for critics professional critics guys have been doing it for a long long long time because they're often doing vertical tastings or they've experienced with these wines throughout the years throughout many vintages and well the way the way the prices of wine are going especially for premium wines that's very cost-prohibited to many people here today especially many just wine writers in general so vertical tasting really cool useful tip I learned that I you know I like Caraconte a lot a little bit on the younger side when it's too young sometimes it can be too sharp too acidic and as it as it goes on throughout the years I think people that like age whites like things to put that put on weight want things to go with shellfish crustaceans these wines kind of remind me almost of like how crew muscaday ages from France just with a little bit more Italian flair so tell me do you do vertical tasting do you enjoy it you like it you find it useful do you have fun with it put it in the comments below and guys if you like this video please subscribe to our youtube channel exotic wine travel I will see you in the next episode


Hello everyone this is Amit Don of AmitDon.com. Today I will have another episode of Shaving Accessory review video and I will be reviewing a shaving soap bowl which I have it right here. If this is your first time or if you visit thank you for your support on this channel I am always trying new and different ideas. If you are into thinking outside the box this is a channel to subscribe. If you are looking for more review videos there will be links in the description box below. So I have another shaving bowl right here and this is a shaving soap bowl made of stainless steel and I bought this from Amazon and this is about twenty twenty two dollars Canadian. Now this is not actually a shaving soap bowl so what happened I went to IKEA the other day and this caught my attention and the funny thing is this bowl is only one fifty one dollars and fifty cents and this would work or this should work perfectly as a shaving soap bowl and that's what I'm going to try it today. So twenty dollars and we have one dollar and fifty cents so I'm going to you know take some shave cream and try to leather this up and see if this works. So I'm going to using I'm going to be using the prosso shaving cream and we'll see you know if our 150 shaving soap bowl works perfectly fine. So I took some shaving cream on the bowl and I'll just you know wipe this my Omega which I have it right here this is Omega S synthetic fiber brush. Okay so there should be some water in here and we'll try to work this leather. I might need to mix a little bit of water. Guys you're going to be surprised that I have a thick nice leather here which I have it right here and the funny thing is this twenty dollar shaving soap bowl doesn't produce leather like this so it looks like you know one dollar and fifty cents shaving soap bowl is you know working actually better than twenty dollars or twenty plus dollars shaving soap bowl. So this is actually not a shaving soap bowl I believe this is like in a food bowl but this can be perfectly fine as a shaving soap bowl and I don't have the exact name of this but you know this is going to be in the IKEA shelf where they have a small bowls and there are other bowls I saw so for example I saw like a stainless steel bowl and bowl made of wood but the reason I bought this because it was so cheap that you know and to give you to try and I thought this could be a very interesting cheap shaving product and looks like you know this is just working fine. You can see you can look at the leather and this is like you know really thick nice leather. Buying an expensive product doesn't always mean that you know you're going to get better quality sometimes you can buy a cheap product and you can still get better quality than something more expensive and this is a one dollar and fifty cents food bowl I picked up from IKEA which looks like works perfectly fine as a shaving soap bowl. Thank you for watching this video there will be more videos coming up so see you shortly. Thank you.