In this step, what we'll do now is use another parameter in our material that we can use to change the scaling of the size of the grass. So if we want the grass to be a bit smaller or bigger, we can change that in a parameter like we did in the previous step with the roughness. Okay, so the first thing we need to do is get the material back open and we're opening the master material. We're not opening the instance. So let's get that open. There it is. And because we're dealing with the texture size, we're really talking about the UV coordinates. So we're going to need to create a new node to control that for us that we can then edit with a parameter. So what we're going to do is right-click. I'm going to search for a landscape layer-coords node, that one there. So we'll create that and it looks all multicolored and beautiful when it finishes loading in. There it is. So pretty. Now normally what you can do with this is just plug it straight into the UV's input on your textures like that. And at that stage you might be done with it. And you could control the scaling of your textures here with your mapping scale. And we will be doing that in the next material we create moving forward. But for now, I want to just show you another parameter. So I'm going to get rid of these connections here.  Bye, wires. Okay. And what we're going to create now is a multiply node. So if you just right-click and type multiply, or most of the word, there we go. We've got multiply there. It's a mathematical expression. And what we're going to do is connect the output from the landscape coordinates into A. And then we're going to plug that straight into the UV's input on both of the textures. Now what we can do is plug something into B and we can multiply that by the landscape coordinates. And we can use that to raise or lower the size of the textures. So that's what we'll do. And we're going to use the same node that we have done for the roughness. But this time we'll just create it from scratch. So we're going to create a scalar parameter. There it is. And this little bad boy is going to be plugged into B. There we go. So now that we have this scalar, we're going to give it a name. So I'm going to call this grass size or grass scale. Grass scale's better. There we go. And then we need to set the default, the minimum, and the maximum value. So the default is going to be 1 because we want it to just be default as it already is. The minimum, I'm going to set to 0.1. There's no point in setting this to 0 because if you multiply a number by 0, you get 0, which is not something we want. And the max you can set to anything, but I think anything above 6 in this case is going to be too much. So I'll set it to 6 and I'll be happy with that. OK, now what we're going to do is pop this into a comment because we're pretty much done with it. So let's select those, press C, and I'm going to call this grass scale like that. And then we're going to save the material that's ready to go. Save. OK, so now that that's done, we can just pop this over to the side for a second. We'll pop it up there. And now we can go into our instance of that landscape material. So let's open that up. And of course we don't want that to be taken the whole screen. So we'll just pop it down there. And you can see now we have a grass scale parameter available to us. So for me, it's already turned on by default because I've already been messing about with this. But for you, it should look like this originally and then you'll turn it on. And now you can mess around with the grass scale. So what I like to do to work out what I'm doing with the grass scale is kind of look straight down. Something like that.  What should it look like? And that for me is possibly a little bit too small. So let's try 0.8. That's quite nice. Do I want to make it bigger, smaller? Let's try 2. Oh, no, no, that's the wrong way around 0.6. Let's try that. Yeah, I think I'm fairly happy with that. So now I can save that and I can now easily change the scaling of the grass just by going into this material instance. So now I've got control of the roughness and control of the scale of the textures. Brilliant. So with that, we've sort of come to the end of this sort of practice with material section. So this material now is basically done. So you can save it and just put it to one side. You can if you want either delete it or just leave it in your materials folder. I'm going to leave it there just because I feel a little bit emotionally attached to it now. But what we'll do in the next step moving forward is we'll create a new material and this is going to be the kind of more complex one that we can use to blend different textures together to create a more realistic looking landscape. So there's going to be like dirt textures in there. There's going to be grass. There's going to be two types of grass that we can blend between. There's going to be a rock texture as well that we can blend into the hills. So that's what we'll be doing moving forward in the next few steps getting that landscape material ready to go before we then start importing some assets into this. So I look forward to seeing you in the next step for that. Thanks for watching. If you really want to take your learning further than I can cover in this series, then I highly recommend checking out Plural Sight. They have loads of really detailed video courses covering game art and game development using Unreal Engine 4. When I learned how to use Unreal a couple of years ago, this is where I went and I look in regularly to take a new course and improve my skills. I recommend checking out the introduction to Unreal Engine 4 course by Joshua Kinney. This is really good and offers a good overview of what you can do in Unreal. You can get a free 10 day trial by using my link in the video description and you get full access to all of their courses for that time. At the end of your 10 days you can either subscribe for more or cancel, totally up to you. It's got to be worth a free trial though, right? I'd like to say a massive thank you to my patrons. Your support helps me to keep making videos like this one and I really appreciate each and every one of you. It really blows my mind that people will support my channel and my work by pledging their money through Patreon. So again, thank you all so, so much. If you aren't already a patron and you'd like to offer your support, then please go to patreon.com forward slash Shane Whittington.


this is going to be the format. We are going to talk a little bit about Arnet just so that you know who we are and why the heck we are playing in this space and we're going to remind you about the sensitive data challenge and particularly the specific pieces that Arnet is looking to solve and we'll then move on to give an introduction to our project and there'll be a demo of what we've done so far and we'll finish them up with the roadmap so that you actually know when you might be able to get using this service. So that's moving on to the first bit which is the Arnet background. So the vision that Arnet has is that of a globally networked data sharing ecosystem and that ecosystem should accelerate knowledge creation and innovation and we are actually a not-for-profit and we are owned by all of these good universities in Australia and CSRO. So we are essentially owned by the higher education and research sector and we are most famous I think for our super fast network that actually connects up all the universities with each other and enabling data transfers and so on and internet access and things like that. And that network actually connects Australia up with other national research and education networks around the world and so enables global connectivity. Entities that we provide services to are actually not restricted just to universities though so we connect up schools, TAFE's cultural organization, publicly funded research organization and health bodies and so on. And we also provide services that sit on top of that network and add value to it. Zoom is a very obvious one to highlight in this COVID era. I think we're all very familiar with that as you were saying earlier Nicola. Another service that I do want to focus on for a little bit and there are good reasons why is CloudStore and CloudStore was developed through our collaboration with CERN and CERN is the European Organization for Nuclear Research and it's one of the world's largest and you know it's a pretty respected centre for scientific research. And essentially CloudStore I think a few of you will be quite familiar with it but it enables collaborative file storage and sharing and it's got that sync and share capability so some people tend to use it as a backup for example but it's richer than that. It can actually share files in an encrypted manner so within CloudStore as you can see there there's this file sender capability. You can actually put a time box on access of files shared by a file sender and you can get some stats on the file transfers if that's useful to you. You can also use vouchers over here which actually enables you to give others the ability to share files via the secure mechanism even if they don't have a CloudStore account themselves. You can also do data analysis directly within CloudStore and that's through our Jupyter Labs integration which is delivered by what we call SWAN so our SWAN service which is and luckily it's written down because I always gobble this but service for web based analysis and again that's something that came about through our collaboration with CERN. You can also within your browser window also collaboratively edit files such as Word documents, PowerPoint slides, Excel spreadsheets in much the same way that you can with sort of Google Docs or Office 365. We also have a range of plugins that again enable you to do things with data without the hassle of having to download to view it so this one that I've got up here is actually a DICOM image and we have a DICOM viewer embedded in CloudStore that enables you to view DICOM images. This one is actually a COVID patient, the thorax of a COVID patient and we also have a protein viewer, a PDF viewer, an audio file viewer and so on all directly within CloudStore so you can kind of start to see that it's very much a research focused application. So you kind of might be wondering why I've spent some time talking to you about CloudStore and it is relevant so bear with me but I just want to touch on our strategic direction at RNET and these are strategic priorities but the ones that I want to actually call out are the pillar around investing in health and medical research infrastructure, the one around establishing a national collaborative research platform and the last one is developed cybersecurity capability services and infrastructure and as you can imagine sensitive data sits across all three of these strategic priorities at RNET so when we were approached by an increasing number of current CloudStore users and enterprise university users you know asking us if they could put sensitive data on our CloudStore service you know they were telling us that they couldn't collaborate on and manage their sensitive data so we actually decided to look into this and see if there was anything that you know could be done about it. So I'll now move on to the sensitive data challenge and I appreciate that this forum is certainly not unaware of this but first of all just so we're on the same page the way that we define sensitive data and I actually think that this definition came about from those involved in the formation of this community when it first came up at that E-Research Australasia conference many years ago but sensitive data is data relating to people, animal or plant species, it's data generated or used under restrictive commercial or government research funding agreement and it's any data likely to have any significant negative public or personal impact if it's released, lost or modified so it's a pretty broad definition and as as you all know in this community there's this gradient of sensitivity so it could range from fully open data at one end to fully restrictive data at the other where we've got human identifiable data and you could even add defence research data you know at the far right of that spectrum but one challenge is that there are different perceptions along this gradient so someone may believe that the location of an endangered species the eggs for example is far more sensitive than de-identified human data and some could view that their research data is more sensitive than that of a commercial entity and so on so when you combine this with the aspects around ethics and privacy it's really not a black and white space and it makes for a really challenging space but as I said I think I'm preaching to the choir but I just wanted to highlight the specific problem space that Arna is looking to address because we're an infrastructure company so you know addressing the challenges around ethics is definitely not one for us to start weighing into but we are looking around this this piece here so researchers and their institutions are struggling to find or provide appropriate services that enable the storage management analysis and controlled collaboration of sensitive data so you know it's a broad statement but different institutions are dealing with this differently but in many cases you know universities are struggling to provide a service be it because of cost or you know the requirement to support it or legislative requirements around it and that leaves researchers using insecure methods such as you know maybe email or sharing hard drives and so on and it also leaves institutions pretty blind about where their researchers sensitive data assets lie and and what the risk around those are and so this you know this this problem leaves the potential for massive reputational damage so that should something actually go wrong so for example if you you know leave your laptop on a train and so what is Arnet doing about it well we are using Cloud Store as a base model platform from which to build this given all those popular research focus capabilities that I spoke on at the beginning given that we already have those in existence we are going to be using those and build them out in a sensitive data capability and that capability will be designed to support the sensitive data life cycle for you know member universities health and medical institutions you know other other sensitive data research such as ecology and and so on and how we are doing it is in a phased project approach so phase one actually began last year when we engaged with some external consultants on a review of our current practices particularly in the information management space and we also carried out a massive consultation effort across the sector where we spoke to a huge number of existing Arnet service users and other organizations that deal with with sensitive data and we've also actually subsequently had a separate medical research institute engagement that's also been informative in many areas but during these engagements we gathered understanding about the pain points that people were struggling with and that enabled us to get a really good view as to the requirements for a solution we are now in phase two of the project which is seeing us mature our information and information security management practices in line with ISO 27001 and 2. ISO is a standard under the international organization for standardization which is a lot of standards I know but it's one of the standards that is widely recognized as being helpful when dealing with data of a sensitive nature and so we are working towards that and then the proof of concept is the other piece during phase two and the one that personally I find a lot more interesting and but it's the one that we are going to focus on today and so I will skip some bits there but this is what we're aiming to build in the proof of concept so if you look at step one we have an admin that creates an authorized user in the service and that researcher can then log on to the platform using multi-factor authentication and this gives them access to the platform that provides data analysis tools so things like swan that I mentioned before and access to a storage media option so that's something new that we'd be bringing in here so you could have something on disk for data that you need regular access and performance around and you could shunt it on to tape for cold storage or archive and all of the data on the platform is encrypted and the institution also has visibility of this which which gives them you know that view of their sensitive data holdings and it's important to know that that doesn't necessarily mean they have visibility of sensitive content and but now when a researcher indicates you know a requirement to share or collaborate on the data they can actually use the platform to initiate an approval process that happens at the institution and so that request is assessed by an individual or even a series of individuals if needs be who are appointed to this authorizer role and that authorizer can view audit trails relating to the data and see who the requested collaborators are and then you know make a decision whether to approve or reject that request if it's approved then that new researcher gets given access to the platform which they in turn access via multi-factor authentication and so on so that is what we are aiming to provide the sector with and we are doing this through a proof of concept project as I mentioned and we are blessed by being guided in this endeavor by our POP participants so these participants are incredibly knowledgeable and expert an expert group of people who from from these institutions here and they encompass different roles within the institutions so some are IT managers others are clinical trial coordinators researchers and I think we've got some data curators in there and research data management specialists and so on and all of them have been incredibly generous with their time and helping us actually you know make sure that we have a valuable insight as to what is needed for this service and make sure it's fit for purpose for all of those roles within an organization so I will hand over to Rob now my colleague he is our sensitive data software developer and he is going to take you through a demo of what we've done so far so Rob do you need me to stop sharing now yeah thanks Frank if you could I'll I'll actually share a video that we've been preparing for the e-research conference next week and that explains and runs through a lot of the features of the system so I'll share and play that now Hi my name is Rob and I'm going to show you the sensitive data class Rob I'll just interrupt you because we can't actually see your screen yet we can hear the sound but not your screen I'll reshare it so just while Rob is doing that tech shenanigans and the e-research Australasia conference I'm pretty sure you're all aware but that's next week and in this COVID time we all had to present or provide our presentations pre-recorded so Rob put in some effort doing that and we figure it's useful to be able to share it with you guys now so we still don't have a visual but we are maybe getting there we can see we can see stuff now but yes yes success all right cool here we go Hi my name is Rob and I'm going to show you the sensitive data cloud storage service that we're building at Arnett we are developing this proof of concept in the cloud services team at Arnett using an agile software process we are collaborating with a variety of external stakeholders from different institutions who have been great at giving us feedback to help guide and refine the product so that it will meet their needs security is an important part of managing sensitive data so all data will be stored on dedicated hardware within Australia with all data encrypted and backed up all activities including user logins and all file activity will be logged and able to be exported from the sensitive data service this service is designed to run within a web browser this is a version of chrome running full screen and as you can see there's only one action we can take here so let's log in and i'll show you what happens next so on this screen you have to choose your institution from the list for the purpose of this demo i'll choose the cloud store dev IDP so here i have to type in my account username and password so because this is the first time i've logged in on this account i'll have to set up my account for multi-factor authentication with a device so i'll click on start setup and you can see it's asking me to choose either a mobile phone or a tablet to bind to so i'll choose mobile phone and on this screen you can enter a phone number anywhere in the world and it will do a validation via sms and then that will be configured to either send a push notification or to send an sms pin code that you'll have to validate every time you log into the system so after you've completed the initial setup then you can continue the login and either send a push to your device or send a pin passcode i'll choose to send a push and you should see this message pop up on the device and when you choose approve it will continue so this is the home screen on the sensitive data service as you can see uh there's not much you can do yet you need to be able to create a new project so we'll talk more about roles in the system shortly but only certain people can create new projects in this case the user i'm logged in with can so let's go ahead and make one now so there may be a lot more options you can choose to customize your project in the future but this is all we have at the moment as you can see the project appears as a folder on your screen if we click on the project then we go into that folder and from here we can start uploading and adding files that we want to share with people or collaborate on so there are a few different ways to upload files into the project if you click on the plus new you can choose to upload a file or a folder here create a new folder or edit a new file directly i'm gonna go ahead and drag my files into this area which will upload them automatically so now you can see the files have been uploaded and depending on what type of file they are they'll either be an icon or a preview on the left hand side of the file name and over here on the right you can see some actions on the file you've got rename download or delete to remove the file from the service so now if we go back to the home screen if we want to look at the properties of the example project we've made you click there and we can see we can either add users or view collaboration requests i'll come back to that later for now i just want to add another user to the project so you can type in the user's name or email address and here we've got roles so we can choose a couple of different roles for this person we've got the authorizer who can add users directly or approve or reject collaboration requests i'll talk a bit more about that later then we've got collaborators who can access or change the project files and lastly we've got people that can only view the files and that includes accessing them downloading and previewing the files so i'll make test.net user five a collaborator and add them to the project so jumping ahead and looking at his test user five you can see i've got access to the example project if i click on the project properties you can see i don't have access to add users directly but i can create a collaborator request so i'll go and do that now so let's say i want to add test user four to the project and i can choose what role they can have they can't be an authorizer because i'm not an authorizer myself they can be a collaborator which is the same as me or they can be a viewer so i'll choose that one so optionally you can enter a reason why they should get access and you can specify an authorizer who you want to approve this okay now send the request and i'll go back to the admin five users screen and show you what they see so back at the admin five users screen if i click on the project properties and go to view requests you can see here there's the request that we created for test user four to become the viewer in this project i was requested by test user five and requested to me who is admin five and you can see here there is a reason with little i icon you can click this and then see a pop-up showing the reason that they've requested this for so from here you can do two things you can go across the right hand side and choose approve which will grant them access or reject which will uh get rid of the collaboration request and not approve them i will approve them because i want to demo what that looks like okay that's now being done and then i'll jump across to that new user and show you what they see so i've logged in as test user four who now has access to the project and if i click on the project properties you can see i am a viewer and if i click on the project folder you can see i have access to these files but under the actions i only have the ability to download the file not to rename or delete the file because i'm not a collaborator or an authorizer so i can download the file now in the future we will have plugins to support common files in this ui to allow collaboration and editing in real time and that wraps up the presentation for the sensitive data service at annett thanks for listening all right that's the end of it um i covered a lot of content do i have any questions on anything there there was a heck of a lot of chat actually that i was desperately trying to keep on top of um there might be some that i can call out that i didn't get to um if you want to stop sharing your screen rogue we might have a bit more um uh what do we call it space to see stuff um so phyto two i believe uh that was a question from lance that is uh some kind of encryption i am not the one to ask about that is gavin on the line he is gavin is that a question for you yes he is uh the two of a method so the uh so the question was let me get this right for you is there support for the phyto two industry standard sms two factor is known to have some challenges so actually so i am unfamiliar with what phyto yeah i'm i'm unfamiliar with that one as well so can we note that one and uh respond to it offline yep yep um yep sure we can and what else have i missed uh mike i appreciate the your your comment about how it'd be lovely to be able to you know create a user in your own systems and have that automatically carry through into the sensitive data service we have heard that before and that is something that we have got on our backlog um uh other questions patrick the multifactor you know if we were to rely on multifactor from another uh from a from a user's home institution i guess that that could be desirable from the researcher's perspective but it does add a vulnerability to the system in that it is relying on the approaches on the security of approaches of a another uh institution and so that's yeah we're perhaps not so keen on that one yeah it was considered yeah um does the upload process place them into a holding space that the project owner can approve for them to be available in the project so not at this time so the approval workflows that we have are around individuals so once that principal authorizer or project owner has actually allowed a researcher into that project space they can kind of do whatever they want um at this time so you have had that brought up a few times so it is something we definitely look at i think that's quite possible but we'll have that picture for upload but not for download so you have to consider um being sensitive database you want to be careful about who has access to the system that doesn't go through that 2fa process because that is an audit trail as well but it's less it's considered less significant uploading stuff into it than downloading but you could debate that as well thanks rob um we've got another question from mike here which gavin might be one to um back to you uh mike has asked about cloud stores reporting in that uh can we see versioning information across all storage contents rather than having to click for the properties on every single file so that's current cloud store is the arnett sensitive data service going to improve on that so is that like a summary report on on par versions anything at all really um because when we've got hundreds of thousands of files um and we don't know if we've got if like multiple versions of files right the only way we can find out is to click on every single one of them basically yeah take years um rob have you seen any variation on that in the new version of of own cloud because it's it's an own cloud limitation obviously and helps me working quite closely with the new version no not yet so i'm curious to know what the intent is behind providing that information what are you planning to use it for um this is something um you say um like when we've been working with media flux as well so that we can actually um identify when uploads have been made to the same document or files by different people and to know that we can retrieve older ones we've basically got no um viewing to the system that lets us know if that is uh if the the right stuff is there so that and you know even if we could if we can get a report or if we could you know programmatically retrieve all files before a certain time because we might know that everything after a certain date was corrupt or something like that um so there's a lot of scenarios where this this comes up where in other recovery and repository situations i mean it does have a process for recovering data um in the past if that's what you're talking about no this this is yeah this is more version version level um the closest i'd say that we have is um full audit logging so anytime if i was changed in the system and anytime anyone logs in or logs out there will be an audit trail that if you're an authorizer you'll have access to so you can definitely see that information but if you want to do kind of a bulk restore on files or on the project that's not something that's currently available but but also to note that we're particularly with this service that we're making we're working towards making that activity log um uh more accessible because currently you know you and and the individuals see their activity logs um so we're trying to you know make it that and um authorizer can see the audit log for a project and local admins can can see audit logs um and that they're accessible in a download or api format which they're currently not in cloud storage we know that there's also in terms of access log if you're using the rocket uploader then there's kind of a latency issue in terms of timing which means that the logs that we see already aren't terribly helpful in terms of timing because the upload time and the time that it appears in cloud store can be hours or days apart so like actually having some other tabled information in reports that we can use rather than looking at a single linear activity log would be really helpful. So well let's let's note that one as a as a feature request sure and Mike you had another question on our list uh can we get IP location information to prevent access from outside Australia or known public VPNs is that something that yeah does anybody in the Arnett team have an answer to that one I'm definitely not the tech guru. Yeah that that's for where we have clinical information that is not to be um downloaded or viewed by anyone from outside Australia. Yes I mean I I guess in some ways Mike the way that we're thinking of you know that the users of the system would respond to that is simply not give people access to it but are you thinking of the situation where you've got a you know a Australian researcher that happens to go off on holiday overseas god forbid when that might be but and then tries to you know sort of access their data overseas is that the situation? Well that's that's a very real thing it's like people who go to conferences on sabbaticals we have external collaborators where we don't aren't aware of their movements at all we expect with our governance for these things is that the chief investigator should be on top of this and reporting it back to our governance committee so that we can make appropriate changes but our other systems allow us to do basically IP filtering and so on to to stop that kind of access but again it's cloud story is kind of extra to our organization's ability to to view gate control all of that kind of stuff. Yes no understood and I think that's another one that we will will will add to the you know the backlog and I'll move on to a question from Patrick which has just shifted out of my view Patrick says where where does the source of collaborators come from and I guess the answer to that is anywhere in anything and that links to a question from Martin that says can international investigators be added as collaborators absolutely we need to be able to enable that we are having that feedback from our POP participants quite regularly the way that we're considering that at the moment though is to leave it to the institution to add those individuals to their you know to create an account for those individuals and I guess the risk of us doing it for them which is possible is that we don't necessarily know if that you know collaborator is no longer should no longer be able to access the space whereas the institution will know and there could be you know by being using us as a step removed it increases the chances of you know inappropriate access being available when the university wants to shut it off immediately so that is the answer to that one am I missing anything else so yes Kristen what what are the platforms predefined roles and how are the POP institutions looking to implement them so in terms of the platforms predefined roles we have a tenant admin that will be a sort of IT focused role at the institution that will be able to create the project spaces and we then have a principal authorizer that essentially in many in many instances will be you know the PI or the professor or who who runs a research group we will have collaborators that sit within that or researchers that sit within that project space and then collaborators that will join the project space and then external collaborators that may have access to upload into the project space but maybe not accessing the project space altogether and then there's an ARNET sort of IT role in the mix as well so those are those sorts of roles and I guess the question about how the POP institutions are looking to implement them Kristen is perhaps not best aimed at me we do have a few of them on the line but I certainly do not want to put them in the spotlight about what they're thinking about in this space and and have hrex hrex help me out Kristen I'm my acronym soup is failing me right now higher research ethics committees of course and not directly so via our POP participants would be the answer to that one okay Stephen do you seed the initial service for an institution do you seed this is having one admin that can create projects and assign owners to the project I think I answered that one yes so we have a tenant admin that creates the project space and assigns that principal authorizer or project owner to to it so yes so Patrick the service relies on authentication at a user's home institution so how is that different to relying on 2MFA good point and I will request my far more savvy colleagues to answer that one if possible that's already been answered earlier in the chat I hadn't realised okay good all right good because I was I was floundering on that one and then Mike you've written we're writing governance docs that state the CI must sponsor external collaborators without AAF access to get internal perfect so that is it sorry I'm not finished that sentence sorry I was really thinking ahead of my reading we are writing governance docs that state the CI must sponsor external collaborators without AAF access to get internal institutional logins that is exactly the mechanism we anticipate enabling external collaborators having access Stephen can you have a viewer but with no download capability yes I believe we can so yeah I mean that's that's an interesting one we've brought this up we can earn it and I guess the challenge there is if you're viewing it in a browser essentially the browser is downloading it so you can argue then persist the data we could disable the download option definitely that is something to consider but if if you're allowing someone to read it they could always screenshot it or do things like that so it depends on exactly what you want to prevent it can look at blocking download feature all right and I think we made it to the end of the chat so I will continue in the interest of time am I sharing oh yeah go I'm just in response to Mike's stuff um so you're talking about having to get institutional logins is AAF virtual home still okay so we're we're but yeah so we're basically pushing like our systems that they're going through for say for cloud storm or red cap they're going through AAF and so everyone who has got an institutional account is going through AAF anyway um so if you've got someone at a external institution who is not a subscriber to AAF then we're basically saying that you need to sponsor them for in our case a Macquarie login account um and then we will have a regular kind of audit process where we'll actually check the bona fides of external people on a you know regular basis the same applies if like I could set up an external collaborator you're using say the QCIF AAF virtual home um someone vets that that's a valid person and it's the correct email address and we can create them with an AAF identity it's just they don't have say a uq login or a Griffith login they've just got a an AAF one that we create for them um I'm not familiar with um that capacity but the reality is that for a lot of our external collaborators is that they may need to be accessing multiple systems or storage within the university and that we may as well just bring them in so that they can access everything under one umbrella account because otherwise if we've got to manage one person under multiple external identities it gets a bit tricky yeah just so Stephen Stephen and Micah I might um ask you know to take that one yeah sorry um we've got a few minutes left and there's a still a couple of bits that I was hoping to share so um but yes I appreciate that the um authentication piece is one that is forever interesting and there's lots of permutations that need to be sorted out um but uh just to get us back uh on track and just to summarize the service because the demo showed some aspects but not all but these are the key service features that we anticipate in a final service so um we've got controlled and auditable collaboration so those audit logs we'll see will show what's you know what's been done with what and who's done it and when and who approved it and so on the next four on the list there about collaborative editing data analysis plugins and and secure file transfers I touched on earlier when I talked about our current capability so I won't actually go into those now we do also have data management capabilities which I didn't touch on earlier but our collections plugin enables people to package up data alongside a metadata wrapper if you will and we're looking to strengthen this and and even automate some metadata extraction but the data on the platform will obviously be backed up and I also mentioned that there'd be an ability to shunt the data off onto cold storage when you know when the time is right and we all know on this call that there are often retention requirements around data so for example you know that 25 years for clinical trial data and and that this slower data storage option which comes at a much cheaper cost might be useful to run there and the aim for the service is that it will be available 24 hours a day seven days a week 365 days a year with the exception she adds of maintenance outages but those will be notified through our status dashboard which will tell you about any hazards alerts and maintenance notifications and this being a sensitive data service I also thought to highlight the security features of the service specifically so users will only be able to use the service through multi-factor authentication so that will give confidence that the users are who they say they are and I've already talked about collaboration workflows audit logs and even ISO certification so the next piece that I'll focus on is dedicated hardware and all of the infrastructure will be on its own private network and isolated from the rest of Arnet and the internet and it'll be in high-security tier three data centers that are either ISO 27001 or Ajo T4 certified and please don't ask me what Ajo T4 certification is and but all the data on the infrastructure will be sold on Arnet owned and operated hardware hosted within Australia so we do not host Australian research data or metadata outside of Australia we talked briefly on encryption because I got it confused but all the disk data will be encrypted at rest with each disk encrypted with its own unique key and data is transmitted over secured secured channels so encrypted and unauthenticated connections and the service will be operated across at this stage anyway two geographically distributed sites within Australia but we've had the potential to expand this as the service grows and those sites will be connected to each other by dedicated 100 gigabits per second or faster private network on the Arnet 4 network and so that enables the data to be replicated across those sites so that is the security features on the gosh I'm seeing a lot of chat I cannot keep up sorry I'll just finish and we can touch on it at the end hopefully but this is the sensitive data roadmap where we're at now so we are soon moving into our pilot stage which is going to see a limited number of institutions take on the service and actually adopt it for their sensitive data purposes so if you have any interest in that at all please contact me you can email me at that address and following a successful pilot we'll be moving to make this available as a service to all institutions that have some sensitive data care in Australia sometime in 2021 and I definitely do not want to miss thanking those that are making this possible so on the left we have all alphabetical you'll note we have the list of POP participants the experts from our collaborating institutions and on the right we have our Arnet gurus that are helping to develop this and Rob's been leading that that charge from the development perspective I won't go through the names but without them we wouldn't actually be able to be where we are today so I think yes that's the last one so are there any questions and do I need to go through the chat can somebody help me catch up on the chat perhaps there's a question about the cost model from Mike Williams in development would be the answer to that Mike we're working on it so Arnet but I'll just I will add that Arnet's not for profit so you know essentially whatever it costs us is is pretty much what you guys receive we're not out to rape and pillage the higher education community did I miss anything else Rob yeah Steven bird asked about other data analysis options so plugins for nectar or HPC or connections to a good question and Gavin off mute sorry momentarily distracted what was the question let me answer it then so Steven was asking about other data analysis options such as nectar and HPC and I guess one thing I can mention is that we are looking at well we have a no is that confusing things so we have a cloud store node at NCI but our sensitive data service is going to be quite a separate beast yes currently they would be yes we are also looking about potential linkages to paulsey and that might be an easier easier one to tackle at this time but Gavin I might leave that to you to yeah um and also there's like you know we're looking at what we can do with cloud store first so um uh because then obviously we have to seriously consider the security model for transposing that to sensitive data for cloud store as Frankie said um we're still working on the interconnects for NCI and paulsey um as well as we're very interested in a model of being able to deploy swan itself out into either the nectar cloud or into HPC apart from that yep the um see you can mount a cloud store collection on to an active em I'm presuming that script wouldn't connect to this service at this point not at not at this point no because effectively like you know um I guess it's it's equivalent to being able to download into an unsecured environment so sure um while you're off me Gavin there was a question from Steven bird on limits on data sizes I'm not sure if there's a specific limit we impose there is not a specific limit that we impose it'll come down to the uh pricing model and and what the institutions would be able to purchase sorry do you mean Steven data sizes is in uploading and downloading or just sort of allocations of project spaces actually both uh Frankie in terms of you know if I've got a four gig file am I hitting HDTBS limits in terms of the the upload um or do I need to bring it in in a different mechanisms but also you know if I've got hundreds of terabytes of sensitive data is at an issue if you've purchased hundreds of terabytes of worth having a project space um then then then absolutely um uh Mike Michael what's what's our sort of HDTBS limits for file size at the moment oh you could easily do a gig yeah I'm just thinking some of the you know medical imaging and stuff like that um well that that's that's you know that's browser based um uh drag and drop so obviously um you'll be able to use uh sync clients and um tools like our client for upload as well to overcome those limitations okay thanks and Mike I've spotted your question about voice transcription services the interest that you've got in that no uh that that will not be offered by the Rnet zoom service in um uh and um it's very uh difficult for Rnet to to keep up with with the zoom offering so we uh I guess um encouraging those who want to access those services to to look at moving to the um uh zoom cloud as part of their their Rnet subscription uh so I'd refer you to the the zoom team to discuss that one yeah we can't yeah it's just that all this stuff's overseas so I understand that um it's uh if it's if it's uh yeah maybe maybe we'll add that one to the feature list um but it's sort of opening the gates on on a whole bunch of zoom features that is um very hard for a small team like us to keep up with yes so Gavin you mentioned you know the sort of reliance on zoom for that now Mike you might be somewhat comforted to know that as you've seen we have a strategic priority to support the health and medical sector whether that's through a zoom service on voice transcription or something else is you know open to to consideration I guess you know as we sort of start to strengthen our infrastructure offerings in that health and medical space maybe that is one if it's uh you know one that is bugging and and and challenging and uh inhibitory to everybody maybe that's one that could be one of the things that we pick off the um to-do list so um I will wrap up there I think uh Katie yes I think uh this yes I can make the slides available to Nicola who will share them with the rest of the uh community of practice I think Nicola best hand over to you with just a couple minutes remaining uh awesome thank you um thank you so much that was what you can see from the chat that was very useful so I just have a couple of details to share so um for our next meeting we'll tentatively be on Wednesday the 11th of November it'll be one of our discipline specific topics probably health and medical but as soon as I have more details nailed down I'll both share that in the mailing list and also update the website excitingly we also have a birds of a feather session coming up next week at e-research australia so if you'll be attending then um please join us there on Thursday and if you're not already a member of the mailing list then please do join up there's a form on our google site and apart from that I think we are done so I will be um putting the slides and also documenting the questions and answers into the communal document and apart from that thank you very much everyone very much for your time and I'll see you next time thanks Nicola I'll see you


Hello people. I'm Ginny Metherill and I'm a fourth generation witch. Today we're going to look at something rather exciting. We're going to look at how to celebrate the spring, the season of spring, using nine different methods within your craft. Also, I've got an incredibly exciting giveaway for you, so stick around for that because you're wanted, I promise. But primarily, this is a video on celebrating spring with witchcraft. So this is part of a new series of mine, which is a four-part series looking at each season of the year and how to celebrate it. I know I've got my Almanac series, which I'm sure you're all very aware of because it's very popular, but this is looking at the overview of a sort of three-month cycle that the world does have. And this, of course, is going to start with spring. So spring has really got a new room feel about it, hasn't it? It's one of those things where, you know, we can see the growth, the growth in the earth, the growth on the trees, the flowers are starting to sprout, the birds are calling, the frogs are mating, and maybe that should inspire us to have a go ourselves. A little bit of procreation never hurt at springtime, and it's something I do recommend. And I recommend a little bit of procreation, not necessarily to actually have a baby. I mean, I definitely don't want another baby, but as a friend of mine once said to me, rather than breeding yourself, why don't you just breed your animals? And so that's what I do. So I'm very excited that my little terrier has come into season recently, because I will definitely be breeding from her. That's why I can have puppies. However, with all this new growth energy, my first way to celebrate the new year is to learn a new skill in the craft. Now I'm going to just as a startup one, tarot cards. Tarot cards are incredibly easy to learn. In fact, if you wanted a one-to-one session with me, I can teach you in about half an hour how to read every single tarot card and get it right. You'll do well, and then with a little bit of practice, you'll become more confident and you'll be able to go off and read them for everybody else. Everybody has this ability. They just need to develop it. So if tarot cards don't rock your boat, why not try playing cards or some other such skill along those lines? Because all of them will be adding to that wealth of experience. The second great new skill that I think you should have a go at is the basics of herbalism. Now this is slightly more difficult, but just to help you along the way, what I would suggest you do is to grow your own herbs. You can grow them on a windowsill. You can grow them in your garden. You can grow them in a pot in the kitchen. It doesn't make much of an odd. Just grow some. You know those herbs that you buy, the living herbs in the supermarkets. You can buy those, bring them home and grow them on. It is from these simple herbs such as parsley and coriander that you will be able to learn the basics of herbalism. Herbalism isn't just about knowing what benefits each individual herbs have. It's about keeping them alive, growing them on, and storing them. So turning them into elixirs, farms, drying them, storing them, etc. And this is one of the ways I would suggest that you first start out in herbalism. Learn how to grow and process your herbs for use. You can look up in any book, the attractions of each herb and what they're good for, but there's no good if the herbs you've got have gone mouldy or you can't grow them. So learn the basics of herbalism. And number three on this list is why not study your crystal ball methodology. Crystal balls, I appreciate, are exceptionally expensive. However, I have a beautiful crystal ball to give away sponsored by Original Botanica. Original Botanica offers the ultimate one-stop shop for all your spiritual needs, from spiritual and religious candles to magical oils and incense or sacred spiritual kits. The online Botanica and retail store is ready to help you on your spiritual journey. We will post this prize worth over $70 to the lucky winner. Although you don't need a crystal ball to scry, it does help. So if you would like to win this crystal ball, then all you have to do is leave the name of the shop that is sponsoring the prize in the comments below. I mean, it couldn't be simpler. You can learn to use crystal ball scrying. Crystal balls are also great for converting energies. There is more to a crystal ball than just divining the future. This competition will close on the 29th of February, so you've got simply to write the sponsor's name of this prize and leave it in the comments below. We will draw your names from a hat. I will not draw your names from a hat.  I'm going to use my pendulum and I will dowels for them and that person will receive the crystal ball. We will post it out to you. So good luck. As I have said, Spring has this incredibly new broom energy feel about it. And what does new broom energy think? Spring cleaning. We don't just clean ourselves physically. We clean ourselves psychically. And so it's quite a good idea to clean and cleanse your home. Give it a good old spring cleanse.  And once that's done, and the dust has settled, then go through your home and cleanse it psychically. I would use smoke cleansing. Open all the windows.  Get your bell. Clap into the corners maybe. Whistle through. Play very loud rock music. That's always good. It's the vibrations that force out the negative energies. And go through every single part of your house making sure that the energy in it is clean and fresh and bright. Number five is to clear up your witchy supplies. I have a bureau here where I keep a lot of things. It's got a lot of drawers. And this tends to get a bit cluttered. So I'm going to quickly go through it and give it a spring clean and make a list of all the things that I'm going to need to buy, which I have used over the previous year and forgotten to replace. This is also a really good opportunity to get rid of any old spell bottles or bits of disgustingness that are lying around because they tend to be forgotten in corners, let's say. So restocking your witchcraft supplies and throwing away all the bad stuff is a really good idea. Number six is to recharge your crystals. Now I tend to use my crystals throughout the year. They're scattered over my house, aren't they? I think, oh gosh, this area of my house is not particularly nice. And I'll put a crystal in it in order to help its energy move into the area that I want it to be. And so at the end, I find I've got no crystals. I don't know where they are. They're left under the beds and in corners. And it's a great idea just to go and get them and cleanse the lot of them in one fell sweep. This will make sure that your crystals have a white clean of their negative energy and are ready for the use of your spellcraft. If you use your crystals a lot, you should do this more often. But I tend to use my crystals and then forget about them that I've used them and they're therefore left somewhere. And so once a year, but this kind of cleansing is fine. In the month of February, we are in the northern hemisphere are going to get two extra hours of daylight, which is so exciting for me because I'm not great with the cold and the dark. And so this is my time I start thinking about coming out of my burrow, my witchy burrow and moving back into nature. One of the great ways to do this is to take nature walks. Every week go out, walk through nature and take a note of everything that is happening as plants and trees and flowers and flora and the birds and the animals come back into view. You'll be able to find the spells that you will need to help you through your daily practice. Nature walk once a week really is a must. Spring is the time when our thoughts turn to our romantic partners. Don't know if you haven't got that special someone in your life. Now is the time that you might do a love spell and love spells work very well at this time of year. And so recommended. Now just be aware though that you do a love spell to call general love in because if you're calling for one particular person that might be changing their viewpoint of you using darker forces of magic and your love will not be able to grow properly there. It is also in my opinion not very moral. So if you do a love spell just do a spell to call love to you if that's what you're looking for. If in doubt I've made one for you first you'll need a shell.  Next you'll need some candles. I always use birthday cake candles and you'll have one for yourself and one for a future partner. Simply choose the colours that you like. Next is a key because of course this is the key to your heart. And finally I'm using rosemary flowers and leaves because rosemary is in flower at the moment and it is a spring love spell after all. The spell is very simple. On a Friday as Friday is governed by the love planet Venus light your two candles and place them in the shell. Add to the shell the key and of course the rosemary and flowers. And you simply say let this flame of passion burn for thee I ask that a lover to come to me.  However you can help yourself by looking at beauty spells and actually they're not as difficult as you might think. Beauty spells can be as simple as casting a circle about your makeup so that when you put it on you put on your makeup to the best of your ability and it makes you look as beautiful as it can. And that's a great spell to do so look to beauty spells in this spring. And finally this is the time when traditionally a witch's power or her sprawl is growing at its greatest rate. As we go through the winter season we tend to slumber down and hibernate somewhat but in the spring our energy our ability our sprawl as it's known really is coming to the fore and so this is the time to recharge your talismans amulets and charms. Traditionally the people of old would take their charms back to the witch who cast them for them and ask them to re-energize them and this is what you should be looking to do now. Do you have any other spring rituals that you use? I mean do let me know I'm really interested to hear your viewpoint on this only because we learn from each other's ideas and so I need to learn from you as much as you will be learning from me. Just don't forget to go to patreon.com forward slash a Ginny Metherall there is lots of extra information there. I do post there two or three times a month and it's only a couple of quid so do go and join me there and otherwise don't forget to like and subscribe because this really helps my channel and makes me feel happy. I love you all very dearly so please subscribe to my channel so I can carry on making these videos for you and I will see you in a week or so.


Hello everybody, welcome to this cheeky new talk, it can sound strange but all of this talk is to share with you all the findings of an experiment, finding new ways to bypass a CNCF tool called Falco. Falco is a runtime security project and I should add I'm one of its authors. My name is Leonardo Donato but people usually shorten my name so feel free to just call me Leo. Here's a photo of me moving hands like a real Italian. No promise, Falco swiped to the first one guessing the exact meaning and writing it to my Twitter direct messages. What I do daily? Well, I'm an open source software engineer at CISDIG where my daily job is to guess what write code for Falco and maintain it. Maybe you confused at this point what a maintain on Falco talking on how to bypass it? I know crazy times to be alive. I firmly believe that challenging your software really are the only way to actually improve it. But just give me some minutes and I'll completely explain to you the reasoning behind this approach. In the meantime, you can find me on Twitter where I tweeted these slides with the nickname LeoDido. Feel free to drop me a line, follow me ask questions about Falco ABPF kernel, whatever, no problem at all. First things first, where does Falco come from? Falco is a runtime security project originally created in 2016 by CISDIG, the company that pays me a salary, I don't know why. Then, in 2018, it was donated to the CNCF, a branch of the Linux Foundation, thus becoming the four CNCF sandbox runtime security project. It started to gain some serious traction to the point that the other maintainers and I had to even start weekly community calls, to which, by the way, I invite anyone to participate every Wednesday at 5pm Italian time. This past January, Falco was the first ever runtime security project to be promoted to the CNCF incubation level. The next natural step is to bring Falco to a level of maturity so as to make it possible to graduate it. But in order to do this, it's absolutely essential that we identify and assess its faults. It's also with this in mind that I talked about this experiment in this talk. Stressing our software, challenging its limits, so to be able to improve them is the fourth step. And I invite anyone here to try Falco, challenge it and report back to us and to the Falco community the findings so we can gain more and more awareness. In the end, breaking things is the best way to understand how to fix them, isn't it? Anyways, the plan for the next 20 minutes is to look up photos of my beautiful homeland in southern Italy that I miss so much, remembering the good old times when we were all free to travel around and pandemics were only a movie thing. In the meanwhile, I'll approach the reasons behind the choice to stress Falco, why I think this is the best possible approach to make our runtime security software more and more solid day after day. In order to do so, we also need to briefly get skinny on how Falco solves the runtime security problem, even for the cloud native environments based on Kubernetes. And the way to do this is by looking at how it actually works under the ills. I mean, that's the way to go when you really want to understand things, not to mention when you want to bypass them. We'll also reflect a bit on the security landscape in general. Shortly after this pitch, I'll demo some of the possible ways to bypass Falco, developing them as accounted for the most of the work that went into preparing this talk, so please be kind with me. I'll also present some mitigation and even fixes that we put in place to prevent you from using my ideas to bypass my beloved Falco in the future. Consider it an encouragement to find and develop your own. As soon as this talk got accepted, I told my dad, look pal, I'm gonna teach people how to bypass the software I built. I had a period of details, but what ensued was a fairly predictable and stereotypical Italian family drama. He started yelling at me and shouted that to do such a thing was a grave and unforgivable mistake that since they called the show dev, fired me for even conceiving something as twisted as this. Indeed, according to him, presenting in public the shortcomings of the software I contributed to creating amounted to admit some sort of failure, either mine or of my team or of my company as a whole. In his eyes, it was an admission of defeat, the product of a subversive attitude. I tried in vain, as he was still shouting, to explain that a constructive attitude begins with a quest for our weaknesses. It's the force and necessity stepping in gaining self-awareness. It's only by getting to really know our limits that we can hope to overcome them. It's only after having looked into the ravines long enough that we can imagine ways of feeling them. It's a matter of epistemic hunger, of knowing that a path to real improvement is almost inevitably convoluted, difficult, even painful. Software development can be conceived as a process whose main feature is the continuous strive for the attainment of perfection that is by definition unattainable. The life of software is really over, only when it's no longer fixed or improved. Any software will always present some glitches, but broken does mean unfixable. Software is improved over time and made more robust and reliable by this continuous process of tinkering, playing, fixing, improving. This is the case in every subfield of computer science, but even more so in a real mass dynamic as security, in which every day carries the possibility that our solutions suddenly become obsolete and in a need of a fix, a patch or generally an improvement. When I think about this, often Kitsuji pops to my mind. Kitsuji is an ancient Japanese art consisting of repairing broken pottery by mending the areas with powdered gold, silver or platinum. It threats breakage and repair as part of the history of an object rather than something to disguise. In a very real sense, this Japanese practice that fascinates me captures the core of what I said so far. Indeed, developing software is a therapeutic process that inscribes the way we deal with imperfections, glitches, fisheries, into the essence of our software, making it more precious and more solid as a result. But let's come back to real world now, okay? So what does security mean to me? How to characterize the security problem? I don't know about you, but I personally would want anything to happen to my system without me even noticing it. At least in this context, I want to be able to determine what things can happen and what cannot. Since preemptive control is not always possible, I also want to possess deep visibility so as to be able to know what just happened as soon as possible. Basically, I think of security in terms of two words, prevention and detection. What does these two words have in common? Policies. Both concepts use some kind of policies to describe the allowed or disallowed behavior for a process in terms of system codes, their arguments and those resources assessed. The main differences is this. The first word prevention is connected to the concept of enforcement. In other words, that allows some actions to take place to happen at all because of some policies. Tools in this category such as Seccom, Seccom BPF, Selenius, UP Armor, or even authorization mechanism like Kubernetes Airbag or the Kubernetes policy based as mission plugins, change the behavior of a process by preventing actions, sometimes schools, from succeeding or in some cases also killing the process trying to perform those actions. On the other hand, the second approach to security is to use the policy to monitor the behavior of a process and notify when it steps outside the policy. Falco belongs to this second group, a topic that especially in cloud-native environments has not been solved yet. Maybe you're wondering now, can Falco solve all our security concerns? Honestly, not at all. Software is made of layers, so is security. This is even more true in the current cloud-native environments. As you can see this came on the slide, pod, services, ingress, containers, and so on up and down. These are environments that embrace change as their fundamental component, constantly opening the doors to the unknown. So Falco exists to enable us to detect intrusions, malicious behaviors, security threats in general at runtime. Let me also be clear that since security is made out of layers, my suggestion is to combine Falco with prevention tools, thus applying a defense in-depth strategy. The idea is to defend a system against any particular attack using several independent methods. The first specific example that comes to my mind is using Falco to identify malicious attempts to assess sensitive resources by observing the world behavior of your environments and then write appropriate enforcement policies, for example, up-armor profiles for your containers that will prevent episodes to happen again in the future. Basically implementing a sort of feedback loop, continuously improving the security posture of our environments. So what's runtime security? With this tour, I refer to the practice of using detection tooling to detect unwanted behavior such that it can then be prevented using prevention techniques. So to continuously improve your threat model, it's last line of defense. This means that in case it is not able to promptly detect and alert you of malicious attempts, you will end up like sitting ducks, defenseless. Let's try with a metaphor. She's clearly look how beautiful she was. I have locks on my door and also an alarm, think of them as compliance rules. But she alerts me when things aren't going right, policy violations. When little bro is misbehaving, think of him like a compromised insider, or if there's something suspicious happening outside or nearby, anomaly or zero day, she detects runtime anomalies in my life at home. And she was, may she rest in peace, very, very serious about her job, as you can see the picture. So why prevention is about looking the doors, detection is about continuously monitoring the inside and the perimeter. Still, bad people were able to enter my house and put her to sleep. I think I made myself a bit more clear now, sadly. In case you're still not convinced that there's no such thing as perfectly safe and perfectly secure software, and the layered approach is the best possible strategy for software security, just allow me to emphasize a few points. How to trust cloud providers and their ability to detect malicious or compromised insiders? How to prevent an undisclosed vulnerability or a zero day bug that allows someone to break into your system?  Linux, Kubernetes, name an open source software that has not experienced a CVE and suffered an exploit. Falco had one too. I think it's clear now that prevention tools are not enough alone. Neither are detection tools alone. Good computer security is hard. It requires a lot of technical knowledge and takes a lot of time and effort. And at the end of the day, there will always still be weaknesses in your system. This means that you should never be below the into false sense of security thinking that you're working on a secure system. Your system can be more or less secure, but a perfect one doesn't exist. This does not mean that you should do nothing. It's just about awareness. And surely there are ways to harden your runtime. For example, dropping capabilities, so preventing things to happen when a container starts in a way to harden it. But that's just one side of the coin. When you have a goal of reinforcing the isolation between the container and the host words, using a container more like a sandbox, the main option you have is syscall monitoring, right? Surely somebody could still argue, but why tracing the syscalls? Because in the end, whatever program you run, it will end up making a lot of syscalls. Syscalls are the way programs ask the kernel, where everything really happens, to perform some task, whether the task regards networking, IEO processes and so on. This does matter. Here Falco enters the game. Falco is designed to leverage libsysp events to add a layer of security on top of your containers and your nodes. Its approach for detecting security threats is to go at the lowest possible level and trace all the footprints and the context in which they happened. The libsysp events are a special augmented structure containing info obtained by tracing the syscalls going on in the kernel, plus container runtime and Kubernetes metadata related to those signals. It uses those events to match a rule list that you can define with a simple yet expressive language, as we'll see very soon. At the moment, Falco can receive those events in three alternative ways that we call drivers. Through a kernel module, or with an eBPF probe, or with a Petro's based driver called PDig, that's really helpful in environments where you can't install the other two drivers just mentioned. Anyways, Falco can also use other input sources at the same time. I'm referring to the Kubernetes audit logs in particular that proven to be very useful when leveraged by Falco to improve the visibility into your Kubernetes clusters. So we will ship also an input API that will allow the Falco community to create even more input sources. I mentioned the Falco rules language in the previous slide, right? So maybe you're asking yourself, okay, Leo, but how do we define policies? How do we describe what's a security threat for us? The Falco rules are very simple to write since they are basically YAML, and this makes them very easy to write, to learn, and very, very hard to invent correctly. But that's YAML fold, not ours. Don't blame me. Falco rules proven to be very straightforward to adopt, unlike the policy languages of other tools in the security space we mentioned earlier. I mean, have you ever tried writing Selenic's policies and things like that? In a Falco rules set, you can write conditions, you can group them into macros to reuse later, you can define a list, you can give names to rules, customize their output message, and the details it has to contain, and so on. You can also override and mix things totally or partially. Finally, Falco ships with a default huge rule set. For reasons, we're gonna explore and understand better in a bit. In case you want to jump into reading thousands of lines of YAML, I put a link in the slide footnote. You're welcome. For example, here we have a rule to detect untrusted shell being spawned below a non-shell application. By looking at its condition, we can see that aside from specific applications that are allowed to spawn shell, this rule emits an output taller in case. The macrospawn underscore process evaluates to true, which means an exec VSC school was detected, which in turn means a program has been executed. The name of the current process is one in the shell underscore procs list, so bash, dash, and so on. The current process as a parent one, the name of the ancestor of the current process is one of those listed by protected shell spawning binaries list. The first thing that catches my eye here is the spawn underscore process macro that only checks for exec VA event. This syscall is part of the exec family. It executes a program referred to by the puff name given to it as the first argument, but exec VA has siblings in this family. Let's see if we can circumvent this rule by using a brother or a sister of the exec VA syscall. Are you ready? Demo time! So this is the macro that got our interest. It only checks for exec VA. It s the first operand in the condition of the rule run shell untrusted, so the plan is simple. We suspect that a process spawning a shell through exec VA art remains unnoticed by Falco. Thinking deeply about this rule, I have also other ideas like changing the name of the process spawning a shell to one of the names treated as exception by this rule or simulinking the shell to an unlisted name, but I leave these as exercises at home. In this little demo, we are going to use the current development release of Falco, basically its master branch from VITAB. In particular, we have Falco version 0261-43, 43 commits ahead of the latest release, rather version 2888. Let's check if we already have the kernel module inserted. We have, perfect, Falco can start. Let's start Falco with one of its default rule sets, and Falco is here. Let's verify now the target rule works as intended. To do so, we ll use the event generator project. It s a nice go tool in the Falco security organization that helps you easily generate a variety of suspect actions detected by the default Falco rule sets. I quickly change this command to make the shell it spawns create a chow file inside the temp test directory. Let's check the chow file is here. Let's remove it. To make things more clear, we can easily trigger this Falco rule again. How? This way. Let's create a sim link to the event generator named httpd. Let's create a pizza file which is a simple script that basically calls the event generator run shell command. Let's make it executable. Executing this script, we just created Falco shell detective anyway. In fact, it does. As you can see, there are two alerts, the one that we just triggered by launching the pizza script and the previous one. Now, what if we are going to execute this through execvia at syscon. My kernel is this one. So I have the execvia at syscon on this host because it should be there since version 3.19 of the Linux kernel. It operates in some way as execvia except for some differences in the handling of the path name. Let's see if Falco driver traces it already or not. Oh, as you can see, it doesn't. Hello, we have a very strong candidate for our bypass. I know you all were waiting for this. This is time to write some beautiful C code. I'm joking. I already written it. Let's just take a look at it.  Here I'm basically calling the execvia at syscon telling it to execute temp test HTTPD with these two arguments. Let's compile it. Okay. Let's execute it. Who seems to have executed? As you can see, there is no rule launched by Falco. But do we have the show file? Yes, we have. So it worked but got unnoticed by Falco. So we discover together our syscoles are the joy and torment at the same time for Falco. They are a very powerful mechanism that acts as the kernel API that abstracts all the hardware for us. Falco magic is based upon them and will not be possible otherwise. But aside from the fact that tracing all the syscoles from a user space perspective often is not that comfortable, the real issue is that there are a lot of syscoles. And with every kernel release, they can change, gain a new parameter, new syscoles can be introduced, old ones got deprecated, and things like that. So it can be really, really painful for us as Falco maintainers to keep Falco on track. For example, we still miss the copy file range syscoles. This can be used to bypass Falco rules looking for sensitive file renames. A malicious actor could use it to copy all the bytes of a sensitive file and Falco will not be able to detect it because it only looks for rename at rename to syscoles in the rename macro. Also, rename at true was missing until two months ago. We had the support for it in Falco 025. So we're putting an effort to support more and more syscoles before releasing Falco 1.0, especially the ones that could impact detection abilities of Falco. You can read more about it in the issue I linked in this slide. We definitely need help from the community, from you, to cover as many syscoles as possible. This is a wonderful opportunity to contribute to Falco. Don't miss it. I think it's useful now to quickly show you how to determine which syscoles are not supported yet by Falco drivers. Otherwise, you won't know where to start, right? I provide you this little best script. Don't forget to clone syscoles where the Falco drivers Libsinsp and Libscap still reside, but expect to find them soon in the Falco security organization. As you can see on the right, Falco 026, the one used in the previous demo, doesn't support yet exactly what syscoles have said. Neither it supports copy file range, but it supports rename at true. Then we surely should talk a bit about the idea to extend Falco to something more than syscoles. Yes, there's more. In the Linux kernel, new very cool APIs like IO Ring are landing. The IO Ring is a new asynchronous API with very, very little overhead that aims to overcome the limitations of the current Select, Poll, E-Poll or AIO family of system codes. But I suppose this is a topic for my next talk, right? I imagine it's way more useful now to show you how to add support for a new syscale, When you hit the manual page for rename syscoles, you got no surprises. In fact, as name suggests, they allow us to rename a file moving it between the directories. In this family, we also have the rename at and rename at true syscoles. The rename at syscoles operates in exactly the same way as renamed does, except for some differences in how the file paths the old ones and the new ones are handled. The rename at true syscoles is equivalent to the rename at. It only has an additional flags argument used to specify whether the name should be atomic or not, whether you want to allow the override of a file and so on. Let's briefly take a look at how support for rename at true was added in pull request 1654, so that maybe you can easily contribute your additions to. Let's look at how we added support for the syscale rename at true. The first thing to do is modifying the dryers ppm events public either by adding constants to the ppm event type enum table for the entry and exit fillers of the rename at true syscale and adding an item for the rename at true syscale to the ppm syscale code enum table. Here we also need to define the rename at true flags and the struct for holding them. Now we can populate in the flags table C file this struct. While in the syscale info table C file inside Libscap we need to instruct Libscap about those flags and don't forget to increment the number of supported syscoles at this point in the driver filler stable C file. We need to match the filler constants with their actual implementations so that Falker drivers know which code to execute at the entry and the exit when the target syscale is detected. We also need to represent the rename at true syscale into the driver event table C file by editing the g event info array adding two items one for the entrance of the syscale and one for the exit. Each line should represent the signature of the syscale we are adding so its arguments and its return value. For example here we are telling the Falker driver to look for the rename at true flags struct instance we declared before when it looks for the rename at true flags bitmask argument. Now go into the syscale table C file and edit the reference table for 32 and 64 bits architectures first add the rename at true item to the syscale table populating its value with references to the syscale entry and exit fillers. Then we also need to edit the syscale code routing table adding an item for rename at true syscale and pointing it to the syscale code we are seeing to it. Last but not least we need to define our fillers both for the Falker bpf driver and for the kernel module one. For brevdy we're gonna look only at the filler for the kernel module the one for the bpf driver is very very similar just uses some different APIs for collecting the data and pushing them to the user space in this case we only define the exit filter because we grab the rename at true parameters only when it completes as you can see here we get the value of all the old path new the file descriptor new path and flags and we put them into the ring buffer with val to method so populating a new event that falco will use to detect renames made with rename at true syscale at this point we are done but good luck with the compilation now in the falco default rule set we also ship this rule in the slide to let you detect when someone is using the package manager inside your containerized environments it's very simple it files when a process is spawned inside your container and its name is one in the list you can see on the left so apiti get apiti apiti and so on let's bypass it now this time will not use unsupported syscales rather something way simpler so this is the falco rule that triggers when someone is launching a package manager inside your containers as you can see there's the spawn process macro but this time will target the package management prox macro that monitors if the process name is one of the element in the package management binaries list so start again falco and give some space to the standard output where by default it emits alerts when we run a new boon2 container spawning a shell into it falco detects it but when we run apiti update you can see falco promptly emitting the alert of the rule we're targeting let's exit from this container since we know alpine is the most used basic image in the world let's try with an alpine we know that the package management prox macro checks whether the process name is equal to apk in this case let's simply try to create a sim link named pipo to it if we run pipo update we see that falco do not detect we're launching a package management process in this container just because we called it pipo anyway if we actually install something falco alerts us that someone somehow modified a file below a binary directory but it does not tell us that someone used the package management tool of alpine in my opinion the rule we targeted has flows and it should be more precise as we've just seen maybe we need to make falco rules also monitor the sim links we're thinking to build something inside it that automatically does it this way we don't have to edit all the rules and we don't have to remember to also monitor the sim link every time a rule looks for a binary or a file etc but we need to make a bigger conversation and we'd love your feedback too so please join the falco community codes we proved that falco alone is not enough but this is something we all already knew further more its ruleset or the one you're using can be incomplete or ineffective there's a huge interconnection between different rules maybe you bypassed the one detecting the usage of package managers in containers as i just did but then the one monitoring binaries directories alerts you so think about it when you disable a rule maybe you don't need it directly for your use case but that rule at least notifies you when someone broke the rule monitoring your use case for example a rule that detects the execution of a specific binary is okay alone only if it also monitors the copy the sim link and the rename of that file even the open syscall because someone could think to cut that binary into another file even more a very malicious actor could pipe from the outside a base 64 encoded binary and regulate it line by line inside the container and how to monitor bash scripts with their shop banks better prevent too in that case like removing bash from the container reducing the attacks of face by creating the container image from scratch not from alpine even if we love it then put inside them the read only binary that has to act as the entry point of the container make only one specific path writable and also restrict it to contain non executable files with flag not set finally you can create a falco rule that monitors the only binary executing in that container is the entry point you intended this way you should have reduced a lot the odds of an attacker now another little bypass demo very different from the others we've just seen its last one i promise for this demo we don't mind selecting a particular falco rule since we're ambitious and we intend to be able to bypass all of them anyways for the sake of this demo we're gonna select this rule it detects when something runs with the privileges of the owning user or group which means it has set with your set gd bits set i'm not using falco built from source this time rather i already installed the falco from its depth repositories on bin tray let's now trigger the rule i create a leo file in the temp directory i start falco and then i set the group id on temp leo file as you can see falco alerts us maybe you don't know but when falco get installed it puts the default yaml rule sets in the atc directory but also it puts some very important lua files inside user share falco lua the output dot lua file should catch our attention let's edit it we commend this line which is the gate from which the output methods of falco pass through save the file and exit if falco for some reasons restarts it will not send any more any output to us look no output i know to bring on this attack the malicious user should already have a lot of privileges on the target test it should already be able to manually kill the falco process for example but that's not the point the point is that it's way more likely that malicious attacker will do more selective things in the output lua files that we edited like excluding only some rule alerts or even modifying the output messages this way your own tension will not be drawn because you'll probably continue to think falco is still operating perfectly as intended and anyways falco should at least alert as it has been restarted from who and now don't you think so how to solve the problem of lua outputs we already did it no worries we have wrote the complete outputs module of falco in c++ starting with the next release of falco the gate of the outputs will be built inside the falco binary we plan to also rewrite the parser and the engine completely in c++ this will enable us to reduce the dependencies surface of falco removing lua related dependencies too so stay in touch and in case you want to take a look at how we did it i put a link to the pull request in the slide as usual so thanks anyone for being here this talk was really tough even to prepare and to listen i admit but i hope you enjoyed my approach my findings and my considerations see you soon let's open person in the meantime follow me on twitter join the falco calls and let's keep in touch