Kia ora, Sarah and Kia ora, Kelly. Thank you for a really excellent talk. Tēnā koutou katoa. Nā mihi kite whare, kite mana fenoa, kia koutou noa ta wehe, noa aotearoa hoki. Tēnā tatoa katoa. For the first six months of this year, I was working alongside to papa archivist Jennifer Twist registering and cataloging the Laurie Foon Starfish fashion archive. In this presentation, I'll give you some background on Laurie and Starfish. I'll take you through the archive collection, highlighting some of the key themes and talk about some of the aspects of processing and surfacing the collection to the public. I'd first like to acknowledge Laurie Foon, who's just a real star to me and to lots of people, to papa for giving me this opportunity of speaking and to fellow thank you. Also acknowledgements to Jennifer Twist, Clearano and Joan Castello for their support. The image credits for these images in the presentation will be at the end of the presentation. Laurie Foon, the founder of the Starfish fashion label, grew up in Waianewa Marta in the 1970s. Her first job was working for a local suit and tailoring business. In the late 1980s, she went overseas with her sister Miriam travelling through Europe and the United Kingdom. While in London, she saw extreme wealth existing side by side with homeless people and that led her to question some of the values at the time in both the fashion and beauty industries. And it's here that she came across the body shop's influential founder Anita Roddick and heard the phrase for the first time, reduce, reuse, recycle. Back in Wellington in 1991, Laurie opened her first clothing business, a stall in Wakefield Market, with $133 of capital. It was called Jive Junkies and it focused on recreating and refashioning vintage clothing. Within two years, the business had blossomed into Starfish Retail. Starfish Willis Street opened on 3 March 1993 and its core market was women aged between 25 and 35. And then in 1997, Starfish produced its first fashion collection. From 1997 until 2013, a total of 45 unique fashion collections were produced. So at its peak, Starfish and the Starfish team were designing and manufacturing four fashion collections per year. And I say team because Starfish was very much a team effort. Laurie collaborated closely with, among others, designers Colleen Shollam, Fran Hornsby and Barry Beatham, textile designers Avis Higgs and Greta Menzies, and artists such as Rebecca DeBorg. Whenever possible, Laurie saw sustainable fabrics and manufactured garments locally. These sustainable and eco-friendly practices, along with community mindedness, were core business values that were visible right from the beginning of the fashion label. Archivist Jennifer Twist and I were very fortunate to have a coffee catch up with Laurie just at the start of this project, at the start of this year. And I asked Laurie about her ideas on garment design. And she responded by describing fashion designers as storytellers. She talked of bringing fashion back home of designs and fabrics that could illustrate who we were while reacting to overseas trends. For Laurie, it was about designing clothing that celebrated what Wellington was about but also could travel the distance of a day. The 2000s were a high point. Starfish stores were established in Christchurch in Auckland and there were showings at Australian Fashion Week. In 2003, Laurie established another fashion label, a luxury brand called Laurie Foon. Both this and the Starfish label were wholesaling to over 30 outlets in both New Zealand and Australia. But in 2007, at the same time that Laurie and Starfish were being widely applauded for sustainable business practices, dramatic changes were taking place around them that would begin to shrink the local clothing industry. Clothing manufacturing was moving offshore, consumers were shopping more online and there was an influx of cheap clothing imports. And then came the Christchurch earthquake in February 2011. Starfish had moved from Manchester Street to Casual Mall in 2009 and at the time of the earthquake, the store amounted to a third of Starfish's income. The Casual Mall store was so badly damaged that it had to close immediately with Starfish being laid off a few weeks later. The emotional and financial toll was enormous. The hardships for Laurie and Starfish culminated in 2013 when the business was placed into liquidation. Hearing that Starfish was in difficulty, clear and no, senior curator in New Zealand history and culture at Te Papa began discussions with Laurie about obtaining garments that were both representative as well as the business archive. The archive that Te Papa received was large and multi-layered. It documented Laurie's progress and success as a fashion designer, as well as giving an insight into the ebb and flow of the local clothing industry. It charted the development of Starfish's business practices, so there were store manuals, lists of suppliers and stockists, production budgets and sales figures. It noted changes in technology and the technology used for the design, the manufacture, the marketing and sale of garments. It showed collaborations, inspirations and activism. And it contextualised and complemented the Laurie-Foon and Starfish garments that Te Papa had in its collections. The earliest item in the archive is this. A scrapbook Laurie compiled as a teenager showing the fashion trends of winter 1978. So the archive arrived at Te Papa in 24 boxes in mid-2013. It had already been sorted into broad categories. So we had workbooks, we had business records, media coverage and magazine publications, photographs and posters, images and video. And a whole lot of printed ephemera, marketing ephemera for the fashion collections. And this is just a very small selection of what was received. The archive was assessed by the team and was drawn up for the registration, rehousing and description of the collection. The proposal worked its way through the approval process and I came on board in January 2017. So I was contracted for six months to focus solely on this collection. My first task being to arrange and register items relating to the 45 individual unique fashion collections. For example, these are items relating to Raffishes Garden of Perfect Happiness fashion collection from summer 2008-2009. On the left we have a workbook with fabric swatches and on the right a marketing image of the finished garment. The workbooks are amazing. They contain a whole variety of materials, fabrics, buttons, threads, photographs, photocopies, sketches in ink and pencil and handwritten notes. Each fashion collection has a unique narrative and in this case, Laurie was inspired by her great-grandfather William Yan Foon. As a young man, William came to New Zealand in the 1890s from China and worked as a market gardener. In 1898 he became a naturalised New Zealander, possibly the first person of Chinese extraction living in Patoni to do this. As an introduction to the fashion collection, Laurie wrote, I often wonder what it would have been like for him in a new country and a new culture, which was so very different, unable to speak the language. My great-auntie tells of seeing him as she used to wheel her pram alongside, sorry, my great-auntie tells of seeing him as she used to wheel her pram always in his vegetable garden in Patoni. I guess that the garden for him would have been his garden of perfect happiness. So this narrative anchors the collection right throughout its 14-month life cycle, so from initial concept through to end of season sale. It informs the fabric choices, the garment design and the marketing. Here's another example of a workbook from the mid-2000s. Laurie drew inspiration from a wide range of subjects, whether it's celebrating individuals such as New Zealander Nancy Wake, who fought with the French resistance in World War II, or responding to the Y2K Millennium Fears with the Activate 99 collection, or taking inspiration from painter Rita Angus, or advocating in the Joyright collection for the greater use of public transport. Here's an example of how the archive complements a garment into Papa's collection, showing aspects of the production and marketing process and helping us understand more about the garment's birth. So on the left, we have an original fabric swatch for a skirt from the Miss Mary Mall collection. The middle image is taken from the promotional lookbook that we're sent out to stockists. And the image on the right is the garment itself, which is in Papa's textile collection. From design to business, and the Starfish archive contains business plans, job descriptions, store manuals. In this example, we can learn about the label's seasonal rhythms. So, for example, in May, the Starfish team is buying for summer, and then the very next month, they're working on the planning and marketing for the upcoming winter sale. So when I see this, it really makes me appreciate the discipline it must have taken to not only keep the business running smoothly, but also to kind of keep that creativity flowing when you consider producing four fashion collections a year, and they're all at various different stages in their life cycle. It's a bit remarkable. There are also early business notebooks. These not only contain business notes, but also have handwritten self-affirmations by Laurie, which suggests the complexities of juggling the personal, the professional, the business, and creative sides of developing a fashion label from scratch. As Laurie puts it, it's my product, it's my vision, it's my dream, it's my life. It's also really fascinating to see Laurie's business aims in these early notebooks. This is from shortly before the first fashion collection was released in the summer of 1997-98, where Laurie is setting out the design rules for Starfish. The top point is New Zealand designed and manufactured. And this commitment of designing and producing locally and of sustainability can be seen throughout Starfish's lifespan. If we jump forward 10 years, and sustainability and eco-friendly practices are at the fore. In 2007, Laurie and Starfish won a Sustainable Business Network Award. It's the first time a fashion designer had won, and Laurie tells the Wellingtonian newspaper, the most important thing is that clothes are made well and made to last. It's the cheap throwaway clothes that are doing the most damage. Starfish was also engaged in recycling practices, with a strong commitment to waste and packaging reduction. It's also really important to note that Laurie's commitment to sustainability continues today through her work at the Sustainable Business Network. An article on the Dominion Post from June this year notes that her four-person household generates just a single shopping bag's worth of rubbish per week. The fashion collections were also inspired by contemporary social and cultural issues. For example, the marketing image for the Urban Progression Collection in 1998 was shot alongside the proposed route of Wellington's inner-city bypass using locals to model the fashion collection. More visible community activism was to follow with the design and production of the Bypass My Ask t-shirt and the Save Our Streets and I Love Tiaro t-shirts. So the image on our right is actually sourced from one of the 102 CD-ROM and DVDs that are in the Starfish archive. The discs contain over 3,100 files. To date, this is the biggest digital collection that Te Papa's archive has acquired. The files are a mixture of documents, spreadsheets, images, videos, sound files and graphics. But the majority of the files are high-resolution images. So shots of garments on mannequins, modelling shoots, runway shows, and formal shots at various events. Because of the large number of files, I used a spreadsheet to record collection information so like maker, date, associations, and then did a bulk import into our KMU collection management system. So to date, we've done basic skeletal records for those files. And we've taken the files off the original media and are queued for ingest into the system. And then from there we'll flesh out the catalogue records more. So the first digital images in the collection come from 2004 and so prior to this, the fashion images are shot on medium format and 35 mil film. So there are hundreds of physical frames of film that haven't yet been digitised. And it will be fascinating in the future to see those frames being digitised and then compare the adjacent frames to see what the selection process Laurie went through in terms of her marketing. On the other hand, the digital images, we've only got the final selection so we miss out on that kind of selection process which is quite interesting. It's also really fascinating to be able to compare the production and the marketing material. So from the first photoshoot in 1993 on our left to the very atmospheric image promoting the Grey Gardens collection in 2007. Well, 2007 was a huge year for Laurie and Starfish. There was the winning of the Sustainable Business Network Award. There were four fashion collections that were produced including the first fully eco-friendly collection in the Northern Valley. But there was also strong indications that the government industry was shrinking in New Zealand. An internal Starfish memo from 2007 notes, many of our factories have lost 45% of their business to China. Some factories have gone from putting through 5,000 units a week to 3,000 units on a good week. Staff are leaving the industry for more reliable jobs where they are guaranteed full-time work. Machining is also becoming a dying art and the number of factories the younger staff member is 45. The memo goes on to note that in 1992 a local manufacturer had 180 staff and by 2007 they had only 30 people employed. A couple of years later in 2009 the Lorry Foon luxury label ends and then in 2011 the Christchurch earthquake forces the closure of Starfish Christchurch. The hardships culminate in 2013 as I briefly mentioned earlier when Starfish is placed into liquidation. A Dominion Post report at the time quotes fellow designer Robin Matheson as saying, it's tougher than it's ever been. The issues that face us when we make locally is that we compete with Asian imports and online selling. But Starfish wasn't the only business casualty. A year earlier designer Alexandra Owen closed her Wellington store and she told the Dominion Post at the time, it's been a challenge to make locally at a price that is competitive by the time it hits retail. There's been a gutting of the independent boutique brands in the middle of the scale. I wrote about these changes in my final blog on Starfish. When I started the project archivist Jennifer Twist and I agreed that it would be good for me to blog as I processed the collection. Generally blogs at Te Papa are around about 500 words and they are there not only to surface collection items but also to give the public an idea behind the scenes activities in the museum. The blogs also opened up conversations. I was able to take user comments from the first blog and then incorporate responses in subsequent blogs. So I would write a draft blog and then send it through to Laurie and I really appreciated that because invariably there were things that needed changing small tweaks here and there and sometimes the focus needed shifting a wee bit. With the demise of Starfish being only four years ago the blogs brought up a whole lot of mixed feelings for Laurie. In some ways, as I took my journey of processing the collection and then blogging about it, I think Laurie took a parallel journey and that was about letting go. As Jennifer explained to me when working with archives it's not just about organising papers and files but also and perhaps more importantly it's about working closely with somebody's thoughts and ideas. Archives are representations of an individual. They tell a story about that person's life and endeavours. The intensity and passion in the Starfish archive is palpable even though Starfish is no longer operational. To me, this is one of the reasons why heritage institutions exist to preserve the endeavours of individuals and organisations like Laurie and Starfish so that the spirit and the energy lives on. Each catalogue record that I created was live onto Papa's website within a couple of weeks and so the discoverability and accessibility of Laurie and Coe's work from the 1990s is now just a few mouse clicks away. In 2007, during a trip to New York City and just prior to Starfish's first fashion collection Laurie wrote a poem in one of her business notebooks. It speaks of the energy of New York but also I think it speaks to me about what I found in Laurie's archive and what I will take away from this. Here I realise that if ever you are stagnating in life here is the place, here is the brain food.


Hey everybody, welcome to Cloud Native Security Day's presentation from Checkpoint. My name is Hillel Solo from Checkpoint Security. And what I want to talk to you today about is what we call Cloud Native DevSecOps, which is a long word, which I'll try to explain in a minute. But first, a little background about myself and about Checkpoint. My name is Hillel Solo. As I said, I'm the cloud innovation architect at Checkpoint's cloud CTO office. I've been in Checkpoint for about a year and a half and it came there by way of an acquisition that Checkpoint made of a company that I was one of the co-founders of called Protego. And we were focused in Protego on cloud workload security. So we looked at things like Lambda functions and Azure functions, trying to understand how cloud native security changed in the new serverless world and the world of functions and cloud native containers and things like that. And so we were purchased by Checkpoint a year and a half ago. And since then we've been part of the Cloud Guard organization at Checkpoint, really trying to drive forward how Checkpoint helps customers solve cloud security challenges. And Cloud Guard is a big suite of products from Checkpoint that deals with everything from cloud posture, workload security, analyzing logs and looking for anomalies and so on and so forth. And our serverless piece is now part of that environment. So I've been in Checkpoint for about 18 months. I've actually been in this room for about 13 months. So I'm really appreciative of the opportunity to find a reason to put a shirt on today. So thank you. And if there are any questions afterwards, if you're looking for me, I'm H.Solo at Checkpoint.com, feel free to reach out. So what I want to cover today in a really short time slot. And so I apologize for how quickly I'll speak. Is first of all, what is DevSecOps? Why DevSecOps? Why is it my problem as developer?  It's not someone else's problem. So why is DevSecOps a thing? What do we mean by that? And then why do I claim the cloud native DevSecOps is a different thing or an evolution of that thing? What's different about it? And then finally try to give you some tools and tips and technologies to how you can try to solve that problem and own it. So focusing on what DevSecOps is to me, DevSecOps is it's the philosophy that as a developer, I own security just like I own any other feature of my product. Security is just another important product feature making sure that my product works securely. It's just as important as making sure my product works at scale or any of the other non-functional requirements we tend to think of when we think of a product. And the idea that till now, security was something else that someone else's problem is kind of a silly thought really. It doesn't really work all that well and particularly as we move into more modern applications it's really challenging to stick with that paradigm. And so DevSecOps, and really I'd like to just call it DevOps to be honest, is just saying security is yet another part of the functional and non-functional requirements for our application. It means that we as developers are responsible for deploying and operating secure applications, right? Once you own that, once you say, okay, it's me. It's not somebody else's problem. I'm not helping them. It's my problem. Maybe they're helping me. Well, that changes a lot about what you feel like you have to solve, right? So security teams are still there. They're still there to help you. They're still there to provide guidance and tools. They're still there to look at the overall security posture of the organization. They're gonna worry about your on-prem and cloud network security posture and things like that. But when it comes to product and application security, that's you. That's part of your product. It's part of your application and your responsible for it. And what that means is things like making sure that you do code scanning to look for mistakes that your developers are making and things like that and make sure your application is being deployed securely. Make sure you've got an operational regime that gives you security and protects you. And so that's really DevSecOps is just saying, hey, security is your problem, Mr. Developer. Now let's see how you address that. But I think that was last year's revolution or two years ago's revolution. The thing I'm really trying to convince you of today is that cloud native DevSecOps is equally your responsibility, if not more, but also it's a slightly different thing. And so why is it a different thing? So first of all, when you move to cloud native, you, the developer, you own controls for security that you perhaps didn't own in the past. You are responsible for things that make a huge impact on security that were somebody else's problem several years ago and are now your problem. Things like network configuration, VPCs, IAM role configuration, RBAC things like that, monitoring, logging, all of those things are things that you are operating and deploying.  And so it's really, really crucial that you're looking at that and saying, okay, if I'm responsible for product security, if I'm responsible for making sure that my thing is gonna work any hour, any scale, no matter what the attackers are doing to it, that means I'm responsible for making sure that IAM roles are configured correctly. That means I'm responsible for making sure workloads are in a VPC if they need to be and that the security groups around those things are correct. That becomes my responsibility. So part of it is that you now own things that you didn't own in the past.  The fact that all the infrastructure in the cloud can be managed as code and as part of your code repository gives you incredible velocity. You love it. I know you, I love it as a developer and I'm sure you love it. Yes, it means you're responsible for more things but it means you can change those things as you need them to be. You don't have to call somebody and ask them to provision a machine, just provision a machine. You don't need to change around network configuration through somebody else. You can just go do that in Terraform script. That's really powerful but it means that all of that configuration is yours. And I've seen studies that claim that up to 90% of cloud risk comes from that misconfiguration. Now that's really scary because it means a mistake that you make can have a huge impact but it also means you have the opportunity to do it right. So if you plug those two things together it's my responsibility and I have the opportunity to do it right. Well, that really gives you a path forward, right? And the second thing is that there are increasingly a large number of tools out there that can help you do that. There are tools to help you scan code, there are tools to help you scan infrastructure as code and Terraform scripts and cloud formation. There are tools to help you scan container images. There are tools to help you with monitoring and logging, et cetera. And so those things are at your disposal to help you solve this problem but step one again is identify that it is your problem to solve and that you're responsible to solve it. And so then what I want to finally take to that is well, what are the pieces of this that we need to do? So the pieces that you want to think of first of all, all the scanning things are really important but now you need to make sure that I'm using tools to scan my infrastructure and scan my code for cloud problems. So for example, if I'm scanning deployment scripts, Terraform, cloud formation, those are cloud constructs that I need to scan. I need to scan those things in the context of a cloud environment. How do I make sure that my cloud formation template is going to deploy something with the least amount of risk? How am I going to make sure that my Terraform plans are all deploying things that minimize my risk, right? And so there are tools out there to do that and those are things you need to be using. The same is true for IAM roles. IAM role lease privilege is super important in the cloud. It's perhaps one of the most important things you can achieve. It might, don't tell me, don't tell anyone to check on this but it might be more important than network security. Getting IAM roles properly configured into cloud at least privilege may make your risk diminish more quickly than getting your network configuration correct because today increasingly we're talking about sort of zero trust interactions between resources and workloads and things in the cloud and then network is important but it's not the most important thing. The cloud fabric is using things like IAM and RBAC to ensure that only the things that should communicate do communicate in a way that they need to and you doing that configuration correctly is going to make a huge impact on security. So getting those things right are really important. And then of course making sure that all of the operational parts of the application are secure as well. So making sure your login is connected to something that can analyze it for anomalies and find problems and you're looking at things in runtime and not just relying on the fact that you rely deployed it securely, it must be okay. It's not dev, it's dev ops and make sure that the operations piece of it is really properly done for security as well. And then finally what I wanna leave you with is a couple of things or a few more, a few things that Checkpoint provides today where we're starting to really try to look at you the developer as one of our customers and figure out how we can help you do your job better. And again, let's agree three slides ago your job includes security. Now how do we help you do your job better?  So for example, Checkpoint source guard product is a new tool that helps you do source code scanning in your repositories and pipelines so that you can look for things like developer error you can look for third party components that provide risk, et cetera.  And then there's a serverless piece as well within the Cloud Guard family that allows you in CI CD again to protect serverless functions and workloads automatically during deployment to aim for least privilege really tightly and automatically so that as a developer I don't have to go try to read through hundreds of pages of documentation to figure out what least privilege is but rather I get to home in automatically on least privilege for my workloads and then also what we call no code runtime security so the ability to deploy without having to modify code add all sorts of hooks inside my code deploy runtime security in a way that as developer I can understand and manage but I can do it automatically in the pipeline so that's again part of the serverless workload and capabilities of Cloud Guard. So these things and others from Cloud Guard and again I know that I'm using Cloud Checkpoint as an example because that's where I come from there are a ton of things out there there's open source and sort of other products these things are all your friends and will help you drive to more secure deployment in the cloud something that is now your responsibility. So thank you very much for the opportunity to present that today. Hopefully I got the message through by saying enough times that cloud security and product security is your problem and hopefully you see that there is a path forward to creating and deploying more secure applications.