Working with your colleagues to update assessment strategies across your program as well as updating your own assessments from year to year will help engage students and reduce opportunities for them to breach academic integrity standards. Blindly repeating assessment briefs or tasks each year at both program and module level encourages students to seek out previous year's students for help or collusion. There is no magic tool that will update your assessments for you but prompting yourself to do so is a good place to start. Let's look at how you might do this by taking DCU's virtual learning environment loop as an example. Oftentimes lecturers will bulk import the content from last year's loop course into the course for the new academic year including the module assessment details. By deselecting the module assessment details during the importing process it will help to prompt yourself to revisit the assessment strategy for the module for the upcoming year. Let's look at a sample loop course from a previous academic year. Here we can see an assignment activity was configured and a document detailed what students needed to do for this assessment. Looking at the document itself we can see it has been in use for several years. Even if the year was changed on the document each time students would still know it was being reused by talking to other students from previous years. The best approach to take is always to update your assessment. Perhaps expand a topic by connecting it to a contemporary or recent development. This links to principle 6. Or allow students to decide what topic they wish to tackle for the assessment. This links to principle 10. Now let's look at the importing process on loop. From your new empty loop course for the upcoming academic year click import in the administration block. A list of courses appears. Select last year's course from the list. If it is not there use the search dialog to locate it. Click continue. You need to define your import settings. You should deselect all of the suggested options except for question bank if you use quizzes and activities and resources. Click next. You are now presented with a list of all activities and resources from last year's course. Here I am going to deselect the items in the module assessment area of last year's loop course. I don't want to bring them forward. I want to prompt myself to update my assessment. Click next. A quick scan of the activities and resources that are going to be imported. Everything looks fine so click perform import. You will receive a success message telling you that the import is complete so click continue to return to your course. Here we can see all of the activities have been brought forward. However the module assessment details have not been brought forward. Now I know I need to go and update it before making it available to this year's students.


What's going on guys got Kyle here with laden sports cards. We are ripping 2022 tops five-star and bowman's best baseball four box Mixer number eight random divisions. Did they ran up before this break? Put the screen up here We had Thomas do the AL central down to Peter M with the NL central Can always check these randoms on the random section of our website guys if you ever miss a random Good luck. Let's see what we got here Bowman's best start off got two bowmans and two tops five stars So Timmy That was quick. That was quick. I like it while he's that's a good strategy. I Think it's the Panthers just cuz I don't think they're gonna get sweats. So that's my answer as well I know it's only game three, but they lose this game. It's gonna be It's gonna be real tough for him real tough for him. All right guys if you box good luck on the first bowman's best We've got an atomic Samuel Munoz for the NL NL West and Nato on the refractor for the NL central We've got Oscar Coloss there on AL central And Christian Hernandez refractor for the NL central Vegas Wednesday will bring the Stanley Cup here so I can see it. I like it I like it. I think that I think that Vegas is gonna win probably global impact there Machado NL West Ronald Acunha NL East refractor Vegas Vegas does seem to be the better team. I don't know. I haven't watched too much of the series But there's an Oscar Coloss bowman masterpieces for the AL central Turmar Johnson and a Luis Robert on the refractor AL central Here's our first auto it's gonna go to the AL central it's chase the louder Base auto there for the Guardians. That is a refractor base auto not numbered Nice hit AL central. We've got Colson Montgomery NL central or AL central. Sorry Christian Vecchero NL East This one is gonna be Harry Ford nice one there for the AL West Mariners auto there for the catcher nice base Harry Ford auto Got a Simon Juan UFO and a rookie Brian De La Cruz and I'll East There is Bruce Lee AL central there for the twins and a Joey Vado NL central. It's like flashcards trying to remember all the yeah, the divisions. It's like actually going through flashcards like Gotta be ready when you get there Alan Serta. That is gonna be Cincinnati NL central nice one there on the refractor auto Not numbered and NL West we got Dodgers Fredward Freeman there nice one on the green mini diamonds One of 99 on the Fredward There we go NL West I was doing the Daunress Eight boxers the other day and it was random divisions and I was like I was just running through like trying to remember everything There is NL West there that is going to be Marco Luciano on the They call this the elements of excellence auto nice one there NL West Luciano on the to 99 on the excellence auto Very nice one there for the NL West. We have Ryan Buckley NL West as well to 250 JD Martinez There's a another rookie. This is Reed Detmer's on the elements of excellence You're Don AL West. I don't know who that is to me. Is that a player? I'd assume it was a player, right? There's Gavin Kross and Royce Lewis rookie there AL West or AL central sorry AL central the twins There's a rookie hunter green there for the NL central on the elements of excellence and a Simon Juan refractor NL East Alrighty guys box to hear Bowman's best. We got two five stars after this Next up. We still got 13 to go on 2020 Bowman jumbo and draft super jumbo That has 13 to go. I believe those 99 spot 69 spot on those guys check it out. We got two really good classes there Checking Volpe in the 2020 draft. I think Torcal sends in the super Righty guys keep it going super jumbo just has an increased amount of hits, right? It's not different. Yeah. Yeah, so it's like Super jumbo is five autos I believe and then the regular has three Yeah, and they don't like when you do regular Bowman has one out of three as the option So that yeah, Bowman draft has three and five as the options There's our global impact NL East Ronald Acunia on the die cut got a Ryan Reckley and a Wes refractor Nice auto here. We got Mikey Romero number to 150 for the AL East Nice one there James on the Mikey Romero blue auto to 150 for the Red Sox nice one there Got Vladdy and a rookie Vidal Bruhan for the AL East AL East pack there We have atomic Henry Davis going to the NL Central the Pirates Nice one there and a rookie refractor of Bobby Witt's nice one there for the AL Central There you go all who's ultra mega jumbo. I like it. They only come with edge autos though There's a Ellie Dela Cruz and Vidal Bruhan NL East or AL East are AL East Only edge autos and the the Wahoo's ultra mega jumbo's Luckily you have some now though so can make your make your product got a colos there AL Central on the atomic insert and a J Ram AL Central so auto for the AL West. It's gonna be Dustin Harris for the Rangers AL West Acunia NL East and Colson Montgomery for the AL Central Vakero we have a Jackson holiday there for the AL East on the masterpieces insert Colton Couser AL East and Frankie Lindore refractor for the NL East Again guys still got some work to do on 2020 Bowman jumbo and draft super jumbo two-box mixer breaks next Nice one here. We've got a Luis Gonzalez AL East on the base auto And Joshua Baez that's gonna be a lava there for the NL Central to 199 And we've got another Bobby Whit refractor rookie for the AL Central To Bobby Whit refractors in this but same box that come on rocker. We've got an elements of excellence AL East for Shane Bosz And Reed Detmer's AL West rookie refractor. There's Shohei We've got an auto for the NL West. It's rookie auto Elio Ramos Going to the Giants there in a West base auto not numbered And behind it we have NL West as well. It's gonna be a blue Manny Machado That is numbered to 150 And NL Central is picking up a O'Neill cruise rookie refractor Two packs left out of best guys and we got two five stars here. That is mini diamond rookie Alec Thomas Nice one there for the D-backs NL West Alec Thomas number to 299 and we've got right behind it Alec Thomas elements of excellence rookie Cardo Cabrera Last pack last pack. We have Marcelo Mayer there AL East on the insert and a Jackson Shurio refractor there That is NL Central Alrighty guys now we got two twenty twenty two tops five star. Good luck. Good luck on this one First up we have rookie for the NL East. It's gonna be Josiah Gray on the base auto rookie pitcher there for the Nats Nice one Josiah Gray base auto NL East And NL Central getting O'Neill cruise rookie auto nice one here not numbered That is Pete nice one Pete O'Neill cruise on the rookie five-star auto Very nice one there for you Pete and we got one box left twenty twenty two five star I didn't realize that we're watching the real game because the people that left there throw me off I thought I was like sports center, right? They're just showing highlights, but It's like a lot of party with C. C. Sabafio Here we go. This is gonna be NL East number to 15. It's gonna be Mets rookie Peter Masekha Peter Masekha their number to 15 on the green NL East is Jared number to 15 And on the back we have AL East auto It's gonna be Jim Rice nice throwback there for Boston AL East James getting the last hit of the break there Jim Rice on the base auto all righty guys that will do it for the break do a quick hit recap here I'm just the autos We had rookie auto of Elio Ramos. We had Luis Gonzalez base auto Dustin Harris and Harry Ford base autos We had a elements of excellence auto here for the NL West. It was Marco Luciano We had Alan Serta in our central refractor auto AL central chased a louder refractor auto. We had NL or AL East sorry Mikey Romero blue auto to 150 We had NL East of 15. That is Patrick Masekha on the rookie auto We had an NL central O'Neal Cruz rookie auto We had NL East Josiah Gray on the base rookie auto and we had AL East Jim Rice to close us out on the auto there All righty guys that will do it for 2022 tops five star Bowman's best four box mixer number eight or random divisions We'll get those right out to you. Thank you guys


The eastern Mediterranean region, EMR, is home to many countries that are vulnerable to highly contagious and severe infectious diseases, as well as re-emerging infectious diseases. These include Lychmoniasis, Hepatitis A and E viruses, Chikungunya, Crimean Congo hemorrhagic fever, Dengue fever, H5N1, Middle East respiratory syndrome, MERS, and others. Additionally, there are challenges to control cholera, diphtheria, Lychmoniasis, measles, and polio in certain countries. Furthermore, Alkerma hemorrhagic fever, Rift Valley fever, and Tuileremia are limited to specific countries in the region. The EMR is also at risk for future outbreaks of these diseases due to its lack of capacity to effectively prevent and respond to them. This article was authored by S. Unmostaphati, Abdelmajid Ghazenian, Abubakar Abdinassir, and others.


This lesson is about treaties, that is, international conventions as article 38 of the ICJ Statutes puts it. Treaties have existed for thousands of years in the history of mankind. They are a very old instrument of international law. For the public opinion, treaties are often associated with international politics and diplomacy. When children learn the names and the dates of important peace treaties that have shaped the history of their country. Intuitively, everybody understands what a treaty is. It is an agreement on the international stage. Conceptually, a treaty is very similar to a contract, but at the international level. There are thousands of treaties, of international treaties, currently binding between two or more states, and also between states and international organizations, or between international organizations. And those thousands of treaties are about many different things. They can be about land or maritime borders, about trade, about international aviation, the promotion or protection of investments, the protection of human rights, or the protection of the environment and biodiversity, the rules of war, judicial cooperation between states and extradition, about disarmament and so on. They can also be treaties establishing international organizations, like the United Nations, the African Union, or the European Union, the World Trade Organization or the International Criminal Court, etc. Actually, any topic, any issue, can be the object of a treaty, provided that there is agreement for that purpose. Well, this lesson will not report on the rules and obligations contained in all those different treaties. This would simply be impossible. Rather, this lesson is about making of treaties in general. It is about the rules of international law relating to the making of any treaty. And in that regard, we are very much helped by the fact that there is a treaty on the law of treaties. It is called the Vienna Convention on the Law of Treaties. It was signed in Vienna on the 23rd of May 1969, and it entered into force on 27 January 1980. 114 states are now currently parties to that treaty, and it is applicable to the treaties contracted by those states after they became bound by it. However, because most of its core provisions reflect customer international law, the substantive rules contained in the Vienna Convention also governs treaties contracted by states that are not party to it. Those substantive rules are not applicable to those treaties as rules of the Vienna Convention, but as rules of customer international law. And for the same reason, those substantive rules also govern treaties concluded by states before they became party to the Vienna Convention. For instance, and as the ICJ has decided on several occasions, the rules on treaty interpretation enshrined in the Vienna Convention may serve for the interpretation of treaties concluded back in the 19th century, because those rules are customary rules written down in the Vienna Convention. According to its article 2, the Vienna Convention applies to an international agreement concluded between states. So from a formal point of view, the Vienna Convention of 1969 does not govern treaties when one of the parties to it is an international organization. Another Vienna Convention signed this time in 1986 was negotiated for the purpose of governing treaties concluded between states and one or several international organizations or between international organizations. However, lacking the needed number of ratifications, that latter convention has not yet entered into force. But this does not mean that international organizations may not conclude treaties, nor that those treaties are governed by rules that are very different from the ones applicable to treaties between states. As a matter of fact, the 1986 Vienna Convention is to a large extent a cut and paste of the 1969 Vienna Convention. And because, as I just mentioned, the 1969 Convention very much reflects customary international law, the same core rules apply to any treaty whether or not international organizations are parties to it. From now on, and as a matter of convenience, I shall most of the time simply refer to the Vienna Convention, meaning the 1969 Vienna Convention on the treaties between states. And for the purpose of the Vienna Convention, a treaty is an, I quote, international agreement concluded in written form and governed by international law, whether embodied in a single instrument or in two or more related instrument and whatever its particular designation, end of quote. In other words, treaties can be finalized in one single document, or be the result of the exchange of several diplomatic notes or texts. Moreover, a treaty is a treaty whatever its name. It can be called treaty, convention, pact, charter, covenant, protocol, memorandum of understanding, statute, whatever. International law is not a formalistic legal order. What matters is the wine in the bottle, not the bottle nor its label. What matters is the existence of an agreement between subjects of international law and an agreement which is governed by international law as opposed to a contract, governed by domestic law, or as opposed to a political agreement which is also called a gentleman's agreement and which is on purpose, not binding under international law and therefore not governed by international law. So it is important to keep in mind that not every agreement between states is a treaty. Only those agreements that parties tacitly or expressly agree to submit to international law are treaties. Let me end this introduction to the notion of treaty by mentioning the fundamental rule of treaty law. It is an easy and straightforward rule, so fundamental that it is intrinsic in any legal system. It is considered to be a basic principle of international law and an essential rule of customary international law. In Latin, that rule is called pactasun servanda, which literally means agreements must be kept. Article 26 of the Vienna Convention is entitled pactasun servanda, and it reads as follows. Every treaty in force is binding upon the parties to it and must be performed by them in good faith." In the next sections of this lesson, we'll learn about the four usual successive steps in the making of treaties, negotiations, signature, ratification and registration of treaties.


Russia declares that the Ukrainian war can be repeated in Moldova. Russia warns Moldova not to get too involved in the process of supporting Kiev. As such actions endanger security in the region, Russian Foreign Ministry spokeswoman Maria Zakharova said, I would like to warn official Chizinor against getting too involved in the process of supporting Ukraine, as this will not only jeopardize stability and security in the region, but will actually make Moldova an accomplice to the Kiev regime's war crimes. The diplomat said, Zakharova pointed out that despite the neutral status enshrined in the Moldovan constitution, the West continues to actively drag the country into the Ukrainian conflict. We have repeatedly warned official Chizinor about the disastrous consequences of such steps, the diplomat pointed out. All reasonable Moldovan politicians who care about the future of their state are literally sounding the alarm in this regard. However, the Moldovan authorities continue to pull the country into the abyss, where neighboring Ukraine already finds itself, the spokeswoman said. Zakharova also emphasized that Russia notes Moldova's gradual change into a logistical appendage of the Kiev regime immediately after the start of the special military operation. Chizinor began large-scale deliveries to Ukraine of various goods, fuel and lubricants, medicines, food. At the same time, the information about what is going on with the issue of military cargo being delivered through the territory of Moldova can only cause concern. She added it is no coincidence that today, under the supervision of the US and the EU and at their own expense, active work is being carried out on improving the critical rail and road infrastructure of Moldova, with impressive frequency American inspectors assess the feasibility of receiving large-tonnage aircraft at Chizinor airport. Zakharova pointed out.


Okay. Well, welcome everybody. My name is X-ray. This is the DEF CON 30 alt space VR village for DEF CON groups So welcome and our speaker is Jim Shaver He's going to be talking about AWS metadata privilege escalation Jim is a pentester offensive cloud security researcher and Public speaker with 13 years of IT and security experience. So Jim go ahead and take it away All right I'm going to stand by the podium. So I'm heard today. We're going to be talking about AWS privilege privilege escalation And when I talk about privilege escalation, I'm mostly talking about the API And sort of the back end of AWS. I'm not specifically talking about like necessarily Operating system privilege escalation, although operating systems will be involved. Okay next slide, please All right. So some of the things we're going to be talking about today are how authentication works with any of AWS We're going to be talking about the instant metadata service Brian DS. I will just call it the metadata service I'm going to be talking about various modes of escalation As well as several tools and resources That you can use some of which I have written and some of which other people have written Next slide, please All right, so this is what IMDS looks like if you're on an EC2 virtual machine You can just curl this IP address on six nine two five four one six nine two five four You'll notice. It's kind of an unusual IP address if you've seen Ever been on a network that doesn't have DHCP working properly. You've probably gone the one six nine address and You can think of that IP space as an IP space that is non-routable and In order to avoid collisions with 10 dot and 172 and 192 addresses Amazon chose a one six nine address for these for this non-routable interaction with the IMDS service Just a little bit of background on what I what the metadata service is is it's a little bit of Semi-dynamic data that the operating system uses for For its own purposes for whatever for whatever it needs so things that are included are kind of benign things like the AMI ID and You know Mac addresses network information even the region that the virtual machine is running in So the US East one for example, okay, but also other Interested more interesting things for attackers in here things like user data, which is like the machine startup script or even the machine's own identity credentials and and roll based credentials that the machine may have been granted and So this these credentials you can think of as sort of the machine account quote Next slide, please all right, so this is an example of like a Simple like I guess SSRF Where you have a proxy? Parameter that's injectable with this local IP want this one six nine address and it returns a role, okay, so Latest Metadata, this is the this is actually returning a text response From the Meta's data service within the virtual machine that's running this web application. Okay, and What makes this kind of look the machine account you can think of like in in the windows world you have You can give like an active directory Machine like domain admin for example, nobody does it but it's something technically possible It's much more common in AWS to give you see two instances roles, which means they typically have permissions and policies either attached or assumable or whatever through those roles So if you if you go into Latest metadata I am security credentials, and then there's a whole bunch of stuff in this case. This role name is called easy to default SSM if you Then sort of browse to that role name. What will happen is it will show you A JSON response That is an access key ID Secret access key and then a token that is changes every once in a while This is the authentication for this role for this machine so that when the machine does certain administrative tasks, it can authenticate using these credentials and They kind of work like long lived API keys for AWS, but they're they're used via the short token circuit service instead of Instead of long-lived API keys So the way that you can tell that that is happening is the first four letters of the key ID are as I a Whereas a long-lived keys are a kia. Okay, so we'll see another example of that later As well next slide please Okay ways to get at I'm yes, so Obviously, you know, you can imagine a bad guy wants to get at the IMDS service of an EC2 instance This EC2 instances in a VPC. Maybe it has a public interface where there's like some sort of Vulnerability or some the bad guy has somehow gotten into the virtual machine some of the ways that that can happen is You can be on the box So if you get a shell on the box, you can just use curl like we did in some of the previous examples So in that case, you would just curl, you know, this web address and then you would go from there There's also examples of command injection and SSRF where if you are able to You know rendered the web page or something like that The results of a command then you then you can also display the contents of the metadata service There are also more novel examples that are The vendors and service providers haven't always thought about in terms of Some sort of SSH Key for bastion access or if they give you, you know, there's some sort of reversal they use for for For support or VPN Ease that they use to connect to a box in EC2 Even if they disable like SSH access to the EC2 instance, you can you may simple to tunnel network traffic over SSH via socks Into the EC2 instance and you can reach a local address Even though you're routing across the internet, you can still reach that local address over a socks connection So in that case, you would just you know Have a browser or whatever tool that supported socks and you would Tell it what socks proxy to use and you would just query the 169 address with curl or whatever you you whatever tool you're using Access the metadata service. Next slide, please All right, so using the cred so we've gotten this JSON response basically what we do is this is an example of Long-lived credentials that you see like aka. These are obviously example credentials So that's what normal like API keys that you might find on like your average developers machine Look like and this is an AWS credentials file that might exist on their laptop or on your laptop You can also you so you can also just use The tools that are on the box or actually the AWS CLI or pull your tools onto the box if you if you can do that But if you can get to this you can just copy all the data out of here Copy it to you know a box that you're using that has all your tools on it and then put it in your AWS credentials file and Use this as a profile for authenticating So then when you're using tools like the AWS CLI you just say AWS Profile AWS session zero, which is we have here and then we run whatever commands using the CLI that we Have so in this case, we're just doing a really basic STS get color identity Which is if you're familiar with AWS is a thing that tells you like information About the account that you're running in it's a good way to check to make sure that the credentials are valid. Okay Next slide please Okay, so I'm not going to talk really about I am policies because they are complicated. There's lots of ways that Policies can be associated with the user directly Either through inline policies that are directly attached to the user managed policies that are associated with the user Inline policies that are associated with a group managed policies that are associated with a group Attached or past roles, etc. There's also service control policies and permission boundaries that are more used in more advanced environments and there are some limitations to Privilege escalation that I'm not going to get super deep into today Because it's really complicated and even some of the tools don't even understand a lot of the nuance out that that's out there Next slide please And that's because this is like the decision tree of how like policies and that type of thing Happened according to the AWS and even this doesn't include all of the nuance. So there's a very thorough decision tree around how AWS makes Decisions around whether or not you or a resource in your environment has permissions to do something Next slide please All right, so Some ways that you can use the creds There, you know, most of the examples we're going to be using today are with the AWS CLI But there are also Lots of other ways that you can do it you can use bow to a three which is the Python SDK for AWS it's just Sort of takes you the next step after the AWS CLI Allows you to chain multiple things together and write like a Python script that understands how to talk to the AWS seal the AWS API There's other SDKs as well that you could also use There's a pretty good tool Written by a rhino security labs called the AWS escalate that can just sort of Put a brute force and figure out whether or not you have Up an escalatable, you know a path to escalation Within AWS And we're gonna we're gonna talk through some of those paths manually here in a little bit using the AWS CLI instead There's also a really good framework called paku also by rhino rhino security labs that you can like it's dockerized and all of that and it's basically a Python Application that gives you a menu and you can sort of step it through all of the all of the ways You can escalate in And other another enumeration. It's like a it's a Swiss army knife basically There's a couple of tools that I have written that I've thrown in here as well. I want to call red bowtoe and basically it is a tool a set of tools either do an enumeration or do us, you know think interesting things with operating systems with an AWS or Connect to SSM or which is basically like SCCM for AWS and other interesting things there's also a tool called federate me which is I'm not sure if AWS has actually fixed this as a thing, but basically it uses federation to Go from credentials To an AWS console, which is the web user interface of of AWS and Sometimes it's just easier to work in the web interface and it is to work via CLI or API or with with various tools So that's just easier to just pop up open a browser And so what that would federate me does is it basically you give it your credentials and it creates a signed login federation link that will pop you into the Console even as like a EC2 instance or whatever and you have the ability to do whatever it is that that machine Would be able to do if it could log it as a console There's also another tool Called enumerate IAM which is a good enumeration tool of different IAM permissions I am is the system in which you do all of your Identity access management in AWS. So a lot of tools obviously revolve around that also the best Out there on the internet with offensive security red team AWS another cloud information is hack hack in the cloud. It's maintained by Nick Frischette and it's very high quality and The best resource out there for this type of information. So I have references throughout the rest of the presentation to some articles on that Next slide All right, so a couple of More easy ways to escalate that I'm not going to demonstrate because I think you can kind of imagine They might look like so one of the ways that you can Escalate is you can pillage s3 buckets For other creds you might get onto a virtual machine That has some role role credentials that may have access to some s3 buckets If you do if you are doing sort of a gray box Experiment or sorry a gray box assessment on on the environment and you have like a scout report Or or something like that You can know what the red end what the role credentials have as permissions And what s3 buckets they may have access to With that report it may not be actually obvious to you or even possible for you to know without brute-forcing what Permissions that role that you have access to What it can do So if it's if it's more of a gray box Assessment and you and you've got the capability to Do a scout report with scout suitor, whatever they're calling it this week then This can this can be a good way to find other credentials that Developers or other people have left laying around or that might have higher privilege than what you have It's very common for for EC to instances to be granted roles that are Back to s3 buckets nothing else Because that's one of the ways that they get data in and out of the EC to instance And so it's very common for them to have that access and then it's a common for You know Them not to be locked down to specific s3 buckets and they may have access to like, you know the terraform S3 bucket or you know, what have you there's lots of ways that they can get permissive access to the environments s3 buckets Another area is a user data. I talked about that a little bit earlier, and it's basically a base 64 encoded script that the machine runs at startup and Well Those role credentials that we've been talking about may have the ability to read the user data of other EC to instances and other virtual machines in the environment, okay, and so sometimes people put things in the startup script assuming that They as the administrators are the only people that read that stuff and it actually doesn't take a lot of permission to be able to read any C2 instances startup scripts, so you should really treat that stuff as you know a sensitive thing and use Other other means to get secrets and that type of thing onto the box Next slide, please All right, so we're gonna use we're gonna talk about our first I am policy Our permission that allows you to escalate so If you have I am add user to group this one's like a really basic privilege escalation, okay So obviously you're not administrator if you have the ability to add any user to any group Then, you know, you could just run the aws cli command, you know, I am add user to group username alice Group name administrators, and if you're able to run that command you've just privileged escalated the user alice to To administrator in the aws count, okay so Might seem like a super obvious way to To privilege escalate, but It's it's it's it's an example of the type of thing that i'm talking about Next slide, please One that's pretty straightforward, but also a little bit more nuanced is I am create access key So in this case you are running I You know, I am create access key For the aim admin bob, so basically you're saying I want to create An access key for this very privileged user that I know is privileged and I want to have their access key basically, okay Okay, next slide, please All right Um pass roll and run instances, okay pass roll is more more complicated Uh because basically Um this gets into resource-based uh privileged escalation. So in this case You are not doing the privileged escalation. It's in fact the You are spinning up these two instances or a virtual machine that is doing the actual escalation. Okay So the way that pass roll works is you are Given the ability to pass a roll to a resource that being the virtual machine And then you run that instance with a roll that is is very permission Very well permissioned and then you have That resource the virtual machine run a user data script that Execute some some aws commands that create An administrator user for you for example, okay Uh a lot of people get chirped up on this one. They think that they need to have SSH access to the ec2 instance when they splints they spin it up. In fact, if you specify user data Uh the the code executes and you don't need to be on the box and refer it to happen You don't need to have a vpc that um That you can ssh into as an example, there's there's lots of the things that make this a lot easier Um And so uh, there are some limitations of this one obviously you need to be able to pass a roll that matters Uh and exist you need to be be able to run uh arbitrary instances Uh, and there also needs to be an instance profile that is privileged enough that can do the thing that you want it to do Uh for you to do So there's a lot of moving parts that are involved with this one And um But that is that is how you do that one Uh next slide please Right. There are also many other types of privilege escalation. So um There are other services within aws that are You know very Not even commonly used uh I the majority of it is best customers So like glue and data pipelines and codestar are all uh, you know, sort of dev opsy types type uh things that are that are used by some very advanced environments. They Absolutely have uh methods if configured incorrectly Uh that allow you to privilege escalate another one that I uh Didn't include in the slides because it worked very similarly to the ec2 instant Uh one that we just talked about Is lambda as lambda is like the serverless functionality within aws and essentially um if you have pastoral and Create function invoke function Maybe a couple of other things you can do the same thing with lambda that we did with that uh ec2 instance where you could have the serverless lambda function do all of the um I am functions that create your user or make you an administrator or whatever it is that you use uh to It will just claim um next slide please All right, so another uh tool that I have not really talked about publicly, but I I've released about a month ago is this thing called red amm and basically what it is is I wanted to solve the problem of how do you have a Uh a cloud Section to a ctf. Okay, and uh, there are cloud ctfs out there that are like flaws dot cloud and they're just sort of publicly on the internet and the What happens with those ctfs is that You're very limited in scope in terms of what you can do and there's a lot of risk in setting them up because You're hooking somebody up to a real aws account That could not only get hacked but also cost you a lot of money if it gets hacked and so the people that have It to the center of the people from From uh having cloud ctf type things Um, and so one of the things that I wanted to solve the problem was how do we uh teach people about the metadata service Don't hook them up to a real metadata service in ed2 And so what I came up with was uh aws actually has a project called the Amazon ec2 mock metadata service, it's a fake metadata service that is a go application And a docker container um that emulates A real metadata service and it's used for Evops type testing where you need to test something That needs to interact with the metadata service, but isn't You know for whatever reason you want it to talk to a fake metadata service Just because it's easier for you or you don't it doesn't need to be an aws or whatever the reason is And so I forked that and basically developed a sort of a front end that is Very basic ssrf and sort of you know, this is an example challenge of like hey if you put like oxy and then uh the You know domain name, this is how this proxy works, and it's not really a proxy. It's just Thing that gets you to the metadata service as part of the challenge So the idea here is that this tool can be used in capture the flag uh exercises Uh so that people can Understand a little bit more and interact with something that acts just like a metadata service. Uh It doesn't expose your aws account. So if somebody gets access to a role within here, it doesn't actually do anything Slide please So this is uh what it looks like when you exploit the ssrf that I've built in here. So just like Uh, all what we've been seeing all along, you know, you hit this address. This is not really a fake address This is just part of the application So it just looks like we're exploiting uh an ssrf in an aws, but this is just a docker container And it returns a text response just like Uh A real metadata service, but all of this information is totally bogus if you pull up this ami id it's it's an ami Id that doesn't exist within aws This is the these are not the mac addresses of the machine that this is running on You know, all of this information is bogus and and you can control these through a json configuration file and you can also control through Environment variables as well. So you can imagine hiding, you know a flag in the user data of Of this meta this this mock metadata service essentially on a cpf And uh, so that can be found on my github. It's called red a m And uh, if you have any questions about it, feel free about LinkedIn or wherever on on the internet And uh next slide I think that's it for me. I'm jim shaver. You can hit me up on linkedin. I'm also a hamburger hamburger on github I really want to thank the volunteers for their awesome work on this conference The setup is amazing and you know, it's one of the best speaker setups that I've had as a speaker So it's nice to just be able to come in here and talk from my uh From my house. So thanks everybody and I'm happy to take any of your questions If any so I've worked a fair bit in aws and I've noticed is that routinely organizations will have people who Are new to aws or they've just graduated and they're getting out into their first Java position And they'll just jump straight into building for things, right and iam is sort of this Thing that they get um As a kind of an afterthought um, and they don't truly massive the service until years into their Their effort Have you seen any successful attempts that you know getting people to? Train in iam first rather than jump straight into building things Uh, so I think the if I get to still down the question for those people that are not in the room, uh, essentially you Get people to understand iam and do it securely is that fair uh Fair representation of the question Try to get it right the first time rather than a retrospective look on it Yeah, I think uh, you know, I I absolutely agree with what you're saying.  I think it's the number one Uh problem that aws organizations and uh, I Think, you know, it's a Are you training people and investing in them and are you hiring people that know? What they're doing. I think there's probably uh, a lot of uh opportunity there for Uh, amazon to make it easier Uh, absolutely. It's one of the number one one number one of the number one issues with an aws account is how complicated iam is and it changes so Sorry, I can't really answer that question better No, no, if you did that'd be amazing right I'd take that back immediately Yeah, I would I would be in a venture uh capitalist office right now if I if I had that answer to that so Thank you for the question anyone else All right, well, I'll be hanging out for another 10 or so minutes if people have questions Fair, uh, I really appreciate the opportunity to talk today. Thanks everybody for


Welcome back to my YouTube channel, you guys. We have Robin with us again today, which you're going to love. He is from the New Zealand Pocket Guide and they have everything you could ever need to know about New Zealand on their webpage in detail and it's free for you guys to use. It's amazing. Definitely the travel resource that you should use. Yeah, so we're so excited to have Robin and today we're going to talk about some of the mistakes that you can make when traveling around New Zealand. So you're not going to want to miss this episode. Here we go. This video is sponsored by Squarespace. Squarespace is a great all-in-one platform to get your business online quickly. So 10 mistakes. Let's talk about it. All right. The first mistake, literally the thing we see all the time from pretty much at least three quarters of travelers is that they do not plan a trip long enough in New Zealand. Have you ever made that mistake yourself? Even just small trips in New Zealand. Do you always have enough time? Do you always do anything? No, no, no, no. The way that we travel is my husband's perspective is if we're not exhausted by the end then we didn't have a good trip. The best place to relax and rest is at work. Right? Yeah, hopefully they're not watching. But yeah, definitely when planning a trip to New Zealand. If you're coming from overseas, you want to have at least two weeks. If you want to be able to do both islands, three weeks would be ideal and even more if you can. Yes, more. Literally, we hear that all the time on our channel, on the website. We get a lot of a lot of feedback on NZPocketGuy.com where people literally tell us, I wish I had more time in New Zealand.  I mean it's enough. Yes, yes. Yes. Quit your job. Continue New Zealand. It's great. You can make some copies. There you go. Speaking of, what's the next mistake of? Oh yes, next mistake. I'm doing this next one is relying on Google Maps. So this is a really good one. Now let me just say this. So if you are in a town that has that you have data or you have Wi-Fi, you know, locate your next place you want to go and load the map before you leave that place because you never know if you're somewhere and you forgot, oh, I didn't load where we're going and then you're in the middle of the mountains and you can't get it and it's worth.  So the one thing I would say as well is that a lot of people kind of, they hear that advice and what they do, they decide to rent a GPS little system for their car through the car rental company. Oh, that's true. But damn, they charge like $10 to $15 a day. It's super expensive. You may as well literally buy a brand new one if you come to New Zealand for two weeks. It's absolutely crazy. So my tip is really to just go on the App Store or the Google Play Store or anything and get yourself literally one of those Garmin app or Top Tom app or something like that. Oh, that's a really good tip. Do that. It's like, thing is like five bucks for a map of New Zealand and that will genuinely change the way you travel around. Yeah, that's so true. That'd be my tip. Yeah, that's good. All right. The next tip that I have is not comparing prices. Shop around. For pretty much everything, there's always a way to shave off a few dollars here and there. Also, compare different options that you can have. For example, the cruise to Millford Sound. There is many different companies. There is many different tools over there and you can actually literally have from, you know, $69 to $170. And you know, they will all have very different inclusions. So pick what you want and what you want to pay for as well. There's plenty of different options in there. Even just when filling up the gas tank, there can be like 10 to 20 cents difference per liter on different places. Yeah, that's really good. So basically, when you come to New Zealand, this is my advice to you is just you're not able to get everything. There isn't a cheap option for everything. Okay.  So yes, that flight over Millford Sound might be like the definitely something you want to do and it's expensive and you just do that.  You know, and so you just, you just have to balance what you really value. And that's really what it's like. Even if you move here, if you're living here, it's just about choosing what is, you know, most valuable to you. You just, there isn't a Walmart version of everything here. So they're starting to get a Kmart version of everything. But yeah, but not quite. So that's a really good one. Like definitely compare prices and definitely with different things cost like, yeah, it's amazing how much prices can vary. So definitely do that or, you know, go to your local app shop. I love those. That's a thrift store if you don't know. Okay, so the next one is don't be too negative. So don't do what we're doing right here. Yeah, so yeah, don't be too negative. Now this is really good. And if you haven't watched my video, I will put it above on one of the things about New Zealanders is they can be quite sensitive. Okay.  I don't like this. You just need to honestly have the attitude of I'm coming into a new culture. I want to experience that culture the way that they live and just appreciate the differences. And so if you come in with that attitude, you'll do much better. No, I agree. I mean, it was, it was a very humbling experience for me for my first couple of years in New Zealand. I'm super blunt. I'm super upfront. I say things, how I think, or, you know, like whatever, whatever I think, I just literally just say it. And, you know, I think there's a lot of value in that. But, you know, in the social world that the social situation that we're living in, it's not always the best thing to do. So yeah, learn from my mistake. And that's probably what I will consider having been my biggest mistake for being in New Zealand was just to be way too frank, way too upfront. Yeah. And so if you're talking with a Kiwi and they give you like a space where they just kind of push back and I kind of like, you said something, it becomes real obvious to you. And if you hear yeah now, that means now, that means definitely now, that means stop talking about this. So if you hear yeah now, it's now. And sometimes they will tell you, we don't talk about that. Yes. I've had that multiple times. Okay. A lighter subject. Don't be light on the sunscreen. Oh, see what I mean. Oh my goodness. All right. So there is a hole in the ozone layers. And that means there's no prediction between your skin and, you know, the UV rays, whatever, the science things, insert graph here. Anyway, that's for you. The sun is strong. Yes. Anyway, layer the sunscreen, apply, apply, apply and reapply. And reapply and reapply when you get out of the water. I'm really, really bad at it. The number is seven minutes in the sun in Plains of Main New Zealand. You can get some burn and that's increase your risk of melanoma. And that's not good. Yeah. And like, they take it very seriously here. So I mean, sometimes you'll see people I mean, I feel like we didn't take that seriously. But I've been here for six years. I'm really bad at really bad at wearing hat, really bad with the sunscreen, also really bad at putting on my kids. So it stresses me out constantly. But what's great is like the restaurants and cafes everywhere you go, people are always just have a thing of, if you forget it, a thing of sunscreen, which is really, really nice because you need it here. It's dangerous. It's like actually dangerous. And like, it's so funny, you can go to beaches here that like, there's not a lot of naked people. It's fully covered. What are you pointing at me when you said naked people? The long sleeved swim shirts and like, you know, they're wearing because you need to here. So it's really nice. Next up. Not a lot of skin. Okay. Yeah. So if you are trying to go on public transportation, make sure you let wave down the bus or it just goes right past you. Like, I want to get on your bus. I'm not just standing here for other reasons. Okay. So wave down the bus. It's very important to note. Okay. Because if, you know, it is different parts of the country have really good public transportation. I have been yelled at a lot when I talk about how good it is, because it's really good in Wellington where I'm from, but not so good apparently in other areas. No, it's very, it's very uneven depending on what city is for sure. Another thing I'm going to say with bus is make sure you have the correct amount because quite a lot of bus don't give you change. So you won't get change if you don't have the correct amount for the bus that you need to take. So, you know, it's always wise to have a handful of coins. Not a handful, that's a lot, but you know, a few coins in your purse. Yeah, or you can get a snapper card for $10. Yes. But if you're just passing by traveling to New Zealand, use coins. That's true. That's true. Exact change. Otherwise, you get that look like that. All right. So one of the two of us have very, very strong feelings about this. The next point and it's about not waiting to be served at coffees. So yeah, don't just sit at the chair, you know, at the table and just wait for things to happen to you in coffees or pubs in New Zealand. Don't do that. No, you'll be waiting a long time. Tell us. Tell us. Tell us why I'm so angry about this. Yes. So yeah, it's okay. So because of the note tipping, okay, the service is mediocre at best. I'm just going to call it like it is. I've been here long enough. I can say this. Okay, some places have decent service. Some places are like, Oh my gosh, I need to help you.  Some places are really great. It's just kind of depends where you go. And, and, you know, and then when you get there, you sit down and normally you have to sometimes you have to go to the bar to get your just don't expect service. Okay, that's like really honest. It's service with a lower case cases. Yeah, yeah, there you go. That's a nicer way. And then like I've learned.  So better work it off and by going to pay, right? Yes, and you kind of sometimes have to get your own water out of the fridge.   I'm an independent person. And so I like, prefer to just get my own stuff. I actually prefer it. And so it works for me. She's here in restaurants, you go to the dishwashing and even prep other meals. I don't. But like, I've been here, my friends have come here and they just kind of sit there. They're like, really? Like, we have to go get our own silverware and, you know, our own cups and water. And I'm like, yes, we do. Welcome to a different culture. Yes. Yes. Your local cafe is akin to the cafeteria at your local high school. I don't know about you, but I have been putting off creating my website until I found my solution with Squarespace. You guys are going to love this product. They have so many beautiful templates to choose from.  And literally within one day, I was able to get my website up and running. Another feature that I love on Squarespace is that they have this social sharing where my community can just go right out into my YouTube channel, my TikTok channel, which is where most of my content exists. And so it's really nice that I can connect directly from Squarespace. Other features that Squarespace offers that are really great is their, the fact that you can collect donations. You can do email campaigns from it. It's just overall really great. I personally also love the analytics. I always like to know what's going on behind the scenes. Who's really reaching me on my webpage. And that's just such a nice feature as well. I highly recommend that you check out Squarespace. Take some time today to go to Squarespace.com and check out your free trial. And then when you're ready to purchase your website or your domain, you get 10% off with the link below. All right, moving on. What's the next one? The next one is, okay, man, I could tell you stories of this, but do not make sure you have enough money when you're traveling. Do not come here on the cheap. Do not come here on the cheap. Now there are cheaper ways of doing things. This is not a cheap vacation. It isn't a holiday. We did a video together a little bit earlier on this channel where we talk about 30 tips about traveling in New Zealand or 31 or more. And yeah, we did talk about a lot of different ways in which you can save money and shave off a few dollars on your trip, but it is not cheap to travel to New Zealand with far away. So just the flight alone should kind of give you a good indication that it's not going to be your cheap Las Vegas getaway or your cheap Hawaiian package. It's not all inclusive. It's not going to be your $700 for two people, Hawaiian package getaway. It's not going to be that. I mean, I think this should be obvious, but I've had my experiences with people have a credit card for those expenses that you're not anticipating if you've actually run out of money just so you're not in a bind. Yeah, it's, yeah, you know, estimate high. Yeah, it's just a fun to talk about money, but say you do need to actually think that it's going to be a once in a lifetime all across the other side of the world holiday and you need to actually budget for that level of epicness. Yeah, good. All right. The next thing that I have on the list, it's very simple, but it's checking your change or you will see it when shopping anywhere. I've explained that quite often, you know, at supermarket, it's obviously because I live here, so usually we do a bit larger shopping than what a traveler will do. But, you know, you may have that item entered like three, four, five or seven times in our case, while you only have one of them. Sometimes when you get change, when paying in cash, you know, you may get a little short change sometimes. It does happen quite regularly, so just taking this again to say yes to the receipt, checking it out, you know, just as you walk out. This is good. I didn't even know this. We were talking about this earlier. I did not even know this. I have been scammed, I'm sure. Yeah, it is very regular occurrence to us. Like, and I'll say, you know, I say very regular. It happens maybe three, four times a year at most, but it does happen. And sometimes it is not any significant amount of money. So, you know, it can happen quite quickly. So just make sure you check your change. That's a really good tip. Speaking of tip, I'm expecting an epic one to wrap this up. Oh, yes, yes. Okay, last tip.  Make sure that you are flexible when you're traveling. Okay, I know. Stretch. Seems obvious. Seems like not a big deal. No, no, no.  Be flexible, enjoy, be a little spontaneous, even if it makes you uncomfortable. Okay. Yeah, and I agree. And even with the high level trip planning that you have, making sure that you're flexible enough to realize I don't have enough time to do both that and I'm just going to do the North Island. Being flexible with your method of transport, maybe you'll realize that if you're traveling so long, you're like, you have a certain budget, maybe taking a bus tour, all organized, all inclusive bus tour around the North Island, maybe the best thing for you to actually give you the best experience and not just let it drain the life out of you with all the driving you're going to try to do and all the activities you're going to try to cram around. Just make sure that you're flexible enough and you are well-informed enough, take some time to do some research to find out the information that you can find with traveling in New Zealand, work your way to Nerevi within what you realistically can do rather than what your ideal and your dream is. That would be my opinion. Yeah, no, that's really good. And go to New Zealand pocket guide to get every tip that you need for travel. NZPocketGuides.com. Oh, what am I saying? NZ. New Zealand pocket guide. Oh, it's, that's not the right thing to say. Oh my gosh, NZ. And Z is for Z for anybody. Oh, yeah, NZ. Yeah, well, you can say like that's fine. I thought I was saying NZ. That's okay, NZ. Look at that, NZForZorroPocketGuides.com. Here you go. Yeah, check it out. It has everything that you need. Well, thanks for joining us today. I hope this was helpful. I hope that you don't make these mistakes now, or you'll make them and you'll be like, oh, I forgot they said that. Either way, you're welcome. And if any of you have any opinions on what she's wearing today, what about you comment below and you tell us what you think. Come on, that is looking dashing. I think that this is a great gift. So you should get this. This is customizable. I'll put a link in the description and you can get a 10% discount if you order with my Kiwi code. There you go. And yeah, and it's cool. So is it 10% customizing Tara or customizing the shirt? You can put whatever you want, but you could put this if you want. 21 was my number when I was, you know, in high school. Oh, I thought that was your age. Oh yeah, it's that too. Here you go. It was my age. I love it. I'm going with that. I wish I would have thought of that. Okay. So yeah, so you should check this out. You can get baseball. You can get basketball jerseys. You can get American football jerseys made and you can put names and however you want. Millions and millions of choices. So check it out. Link below. Thank you for Squarespace for sponsoring this video. Click the link below if you want to get 10% off a website or a domain. Anyway, thanks for joining us today and we'll see you next week.


Welcome to All Hands Update. I'm Petty Officer Mara Timberlake with your headlines from around the fleet. Defense Secretary Chuck Hagel released a statement March 19, commemorating the 10th anniversary of the start of the Iraq War, and reminding Americans about the sacrifices made by service members, their families, and the Iraqi people. Nearly 4,500 U.S. service members died in Iraq in the last decade, and more than 32,000 were wounded. Hagel thanked the service members and their families for their sacrifice. In honor of Women's History Month, the Office of Naval Research is introducing girls to science, technology, engineering, and math, or STEM careers, by providing them female mentors and allowing them to design and pitch mobile phone apps to leaders in computer science and business. The challenge ends May 1. You can read more about these stories at navy.mil. From All Hands Update, thanks for watching.


Welcome to the show policy for the people. I'm your host, Minari Mordecai. Today on the show we are discussing a topic that's near and dear to my heart computer science education in Hawaii. I'm joined by a very special guest Dr. Chuck Muen, who is a faculty specialist at the University of Hawaii at Manila in the College of Education. She's an expert on learning technologies and Dr. Muen also writes about and assist schools with creating internet safety policies and teaching students about safe online practices. Last year I had the privilege of working with truck on a statewide landscape report to look at the state of computer science education in Hawaii. So let's begin with the basics. Let's dive in and Chuck, if you could tell us what is computer science and how is it different from digital literacy. Oh, that's a really great question, Minari. Thank you for having me today. Computer science is the study of computers and the principles of how computers function. So that includes algorithmic processes, hardware and software, the application of computers and different systems and and their impacts on society. Digital literacy, on the other hand, is about your knowledge about how to use digital tools effectively, efficiently and responsibly. So I'll use roads as an example.  We know what the signal lights mean, when to go, when to stay, how to stay in lanes as we're moving along. That's our knowledge and our responsibility. So road literacy is like digital literacy. But do we all know how to build a road? Do we know the differences between asphalt and concrete? How to design a bridge that thousands of people walk over, bike over, drive over? We don't know those. We don't know the waterways. We don't know how to make lights turn green, yellow and red. Those is that's the computer science aspect of it. So there's a difference between knowing how it functions and how to make it function and how to use it. That's the difference between computer science and digital literacy. But it's a pretty advanced skill to be able to have computer science literacy. So you and I worked on the landscape report last year to look at computer science education. What we found is that computer science education has become critical to developing strong tech labor, not only in Hawaii, but around the country. So can you tell us more about the connection between computer science education and its impact on workforce? Why is it important? Does it lead to better jobs or wages? Yeah, you know, those are really great questions. Also, understanding computers and how things are interconnected. That's important in this day and age of technology and the Internet of Things. There's communication technology, entertainment, music, fashion, food, and so much more. In the computer science, we look at the production, the analysis, the timing, connecting people. Even President Obama once said that in this new economy, you know, computer science isn't optional. It's a basic skill. And I think he said that because he recognized the interconnectedness in the workforce regardless of what we choose as our careers, as our professions. And computer science is a factor because it gives you a leg up on how things can be done more efficiently and effectively, you know, how things function and how things connect. So you talked about the shift in the labor tech force, and I think that's really an important thing to consider the diverse workforce in the tech labor workforces is critical. Computer science needs to be dominated by men and the growing presence of women, the growing presence of our LGBTQ plus colleagues, people with disabilities. Even some of the underrepresented groups like our Black, Hispanic, Native, Indigenous colleagues here in Hawaii are Native Hawaiian colleagues. All of these voices and perspectives are important in the conversations of progress, and it's actually shifted away from how can we do it faster, to why do we do it, and what benefits can computer science give to society as a whole. And I think that's so exciting and talking about ethics and the benefits to society that computer science offers. I think it's made richer with these diverse voices and perspective. So talking about the how much we make is an important question. They say that the Bureau of Labor Statistics, they say that the average salary here in Hawaii for people is about $53,000 on average, whereas in computer related occupations, it actually goes up to $85,000 for your annual salary. In general, you know, computer science knowledge can be leveraged into better paying jobs. I think at the national level there's going to be about 10.5 million jobs in STEM, and STEM means science, technology, engineering and math. And they're predicting that seven out of 10 of those jobs will be computer related jobs. So overall, it just is, if you have computer science knowledge, and you can leverage that into any of your chosen fields, I think it does lead to better jobs wages and better economy overall. Thank you for that. So can you give an example of how computer science can be helpful in science and physics, for example, or in sciences that are not directly computer related but still we see an impact of computer science and other industry. Right. You know, you're talking about physics, biology, other sciences, and all of these different fields actually use a lot of data. And data science is an outcropping of the computer science field, and there's so much data that is coming at us from different places. Even as we sit here joined online, all of this had to have been developed, managed, actually maintained in some manner, and all of that really starts with computer science and understanding how those things come together and can connect. I would say in, in physics, you have a lot of computations that are needed in physics principles, and so that comes with our computers. And if you have something that's inputted, and you have something that's processed and outputted, that's a computer. So your basic calculator is a computer. And gosh, our phones, all the developments that happen there. So I think data is the part that computer science comes into play with a lot of different professionals. So someone who's managing a bakery actually can use some computer science skills to help manage their bakery and the functioning of that. That's great. Definitely using a lot of data for the show as well as other things in our lives. So it isn't computer science or people with skill or skilled in computer science are in demand now and will be even more so in the future. And I know you had pretty interesting conversations with tech industry leaders, and you learned about the types of qualities and skills that they're looking for when hiring in the tech sectors. What were some of those things that they mentioned, the types of qualities that they look for when hiring? Wow. Our industry partners, we talked about a dozen industry and non-profit technology professionals. I could crystallize it into one thing. I think what they're looking for are people who have strong interpersonal teamwork skills, who can transfer the knowledge that they have into different situations. Not necessarily people with specific computer science knowledge, but generalized computer science knowledge or that thought process, the logical reasoning, the understanding of how things are connected. That's what they're looking for. They said that they weren't looking for specialized knowledge because they can build that specialized knowledge for their companies when a person joins. But it's harder to develop interpersonal skills and the mindset of logic reasoning and interconnectedness. So that's what they're looking for. The other thing that they said that was fascinating for me is the recognition that they want younger children to be exposed to computer science concepts and ideas earlier because they want children to know that what's possible for them. Exposure at an early age instills a really high level of curiosity to reason out how things are connected and what leads to the next thing and what might come back around again. So they really emphasize exposure to computer science at an early age, just as a curiosity, and then when they're hiring someone who has interpersonal transferable skills. Interesting. I imagine also builds sense of confidence to start learning about computers early on. So, there was also conversation about we have a high demand for the workforce. We know what we're looking for, but it's still challenging. You're facing challenges and hiring people to fill these jobs. What were some of the challenges that they mentioned have been in fulfilling tech sector jobs. That was a robust conversation and everyone started jumping in. I think that's about that. You know the main challenge that our industry partners shared with us was that students who are computer science oriented. So they may have taken AP computer science they may have been in clubs. They may have done things on their own. A lot of those students are actually leaving Hawaii. And when we think about leaving, they call that brain drain, it's a terminology that they use and and other people use when they leave it's because they're seeking better jobs elsewhere, or they're seeking higher pay. And so we can't seem to retain them here in Hawaii there's a misperception about the lack of jobs and computer science when actually there are quite a number of jobs here. Our industry partners are sharing with us how they'll bring students in as interns into their companies. They're pour so much energy into training them and welcoming them into their projects and getting them enculturated into their particular settings. And then they graduate and they leave. They leave for elsewhere and we're all happy for our students we always are when they find opportunities when they're accepted into colleges and schools on the mainland and we're very happy for them but at the same time there's a level of sadness because we don't know if they're coming back and trying to pull them back has been a challenge for the tech industry. It's also been a challenge for other industries as well, because we have such a high dependence on tourism here in Hawaii, and the tech sector jobs are seen as elsewhere. This pandemic has changed that perception. We don't know yet, but some companies are changing some of their policies. So perhaps some of that has, it has been dealt with, maybe. Well, thank you. I was wondering if you can briefly I mean no pressure but if you were to solve this problem of brain drain. You have ideas. Quickly, I think that if our programs here, whether an industry or in higher education, if we built into our programs and opportunity for kids to get away, our students to get away our interns to get away, learn and then bring them back, but build that into the program so that you bring them back at the end of the program then they're here again, and then I didn't reconnect it. I think that could be something that provides an opportunity to deal with brain drain. Thank you. I like that idea. Not know we are off on a very brief break and we will be back shortly we're talking about computer science education in Hawaii with Dr. I'm Mitch Ewan, host of Hawaii, the state of clean energy on think tech Hawaii. Hawaii, the state of clean energy is about following the many clean energy initiatives in Hawaii. Hawaii, the state of clean energy appears weekly on think tech Hawaii at 4pm on Wednesdays. Thank you so much for watching our show. We'll see you then. Welcome back today we're talking about computer science education in Hawaii with Dr. Who is a principal researcher for computer science education landscape report last year. So, can you tell us a little bit about what you found terms of the interest of the students public school students and I know your report was focused on public schools. Which is the K through 12 public school students showed and learning about computer science and whether you saw some discrepancies there. You know, there were some discrepancies and so I do need to give a shout out to Menara also who was part of an important writing team for the landscape report. You know, in terms of K 12 students showing interest. I think we didn't get to talk to the students directly. But if you were to look at what types of courses they're signing up for, and what courses they're completing in the high school level, you'll notice that there are students who are interested, but there might be a competing course that prevents them from taking computer science and so that was often happening at the different schools as you're just looking at the scheduling and the course structure. At the middle school levels it was a little hard to tell because at the middle schools most of the computer science courses. When we looked at them were required courses like all students. So we couldn't tell if there was choice or not choice, but the high school levels we started to see choices about differences in interest in computer science versus something like web design, which in some way in some places were listed as computer science but we're starting to get better definitions right now around what is and is not computer science, but what can we do to increase their interest. I think we need to change the messaging around what computer science can lead towards as a career as a as community impact because a lot of students are interested in community impact and want to give back to their neighborhoods to their communities. I think also industry can play a role in that in making more clear or more evident what roles in their particular companies have a computer science aspect to it. So I think maybe those as we could possibly do. Okay. I know so one of the things that prompted this report the landscape report was Governor EGA and the educational leaders in our state they did recognize that they're needed to something to be done to increase participation in computer science that it has become a critical subject area for education so three years ago, there was a law that was passed in Hawaii. Act 51. Can you tell us more about Act 51 and what it intended to do 2000. It was passed in 2018 so we are now three years forward looking back at what what's been accomplished. Right. Act 51. Right it was passed in 2018. It was stated as and this is political language but it was stated as science the matter of statewide concern. And so they started with that. And what they did was, you know, our lawmakers as you said they saw computer science as having a potential to shift and drive growth and in innovation in our economy here to broaden the concepts of tourism to make other industries stronger and Act 51 had two different mandates that made it the final version because there was an early version and a final version. In the early in the final version. The first mandate was to develop a statewide K-12 kindergarten through grade 12 computer science curriculum for our public spaces. So that was the first mandate. The second mandate was to ensure that all public high schools offered at least one computer science course. And in Act 51 they allocated $500,000 to help to develop the curriculum plan. So that was part of Act 51. Now the part that did not make it into the final version was a mandate to make it a graduation requirement. And that graduation requirement I think in my humble opinion we weren't ready for that yet, because one there weren't enough courses. So if there's no course, and a student can't take it how can you make it a graduation requirement. So we need to work a lot with our teachers still in order to have something like that be a graduation. So, where are we now we have all our high schools have your science in them different levels of computer science but they're all present in the school at least. So I think that's a good thing. And a lot of teachers have undergone professional development at this point to learn more about computer science and what it means to have a class that has in it. So you said they're different levels, how do you classify that if you can give us some examples of different types of computer science courses from like the most advanced to the foundational one. Great. You know there's a in the course structure of the public school education system, the most high level of computer science you can take is called advanced placement computer science. These courses lead towards college credit if they're accepted into the different colleges and universities a student submits their score to. So there's AP computer science principles, which is a fairly new course. It's for generalists. So those who might not go into computer science as a field or a major, but want to learn more about what computer science is, and how it's connected to our world and our everyday lives. So computer science, a they call it that one is for those who are interested in becoming computer science majors and going into the discipline of computer science in their future careers. And that was a little more intense it goes more into programming and algorithms and networking, and a little more closely into databases as well. There are other types of computer science courses that might be part of a career technical education pathway. So you have some business technology some engineering technology courses that are considered computer science also. So it really runs the gamut. So I think this year with a new bill that's coming up they're going to start to clarify the definitions of what is computer science and how that's defined and described. Okay, so can you tell us a little bit more and I know it's exciting news that Governor eager just announced that you'll be signing this bill as B to 42. Tell us more about this it's, you know fresh off the presses. It is. Oh my gosh, Menara it's the first thing it does for me is, which is something that I really wanted to do was, it defines computer science that is for me really important. It actually adds the language of what computer science is in in the in the bill and last time when we did the computer science landscape report. There was still confusion over what is and is not so this bill actually defines what computer science is and what the course structure should be in order to earn computer science credit so I think that was important The other thing that the act does or not this act the previous act looked only at high school in terms of mandatory computer science. This new bill is introducing a staggered requirements of computer science and elementary schools in middle schools and and how that's connected to the high schools. So that staggered requirement of middle schools and elementary schools and the connection, what we call the vertical integration of computer science. I think that has so much promise. And it's going to be exciting to see what the school systems do to actuate or implement the private particular bill. So, you know, since 2018 I know the Department of Education has worked pretty hard in increasing number of courses increasing exposure. Where do you see, do you feel like, or did you find when looking back, there's still some equity gaps in participation you know we definitely had an increased in number of students who are participating computer science but is everyone going at the same pace. What do you find in terms of that. Well, definitely everyone is not going at the same pace. What we found was there are definitely gaps in elective participation. So of course with the courses are are set for you and you must take it that's one thing and so that there's no gaps there because everyone's in it. So looking at the advanced courses and you look at the elective option. There is a decrease every single course type and structure had a decrease in the number of girls there are always more boys than there were girls. There's also a reduction in the number of students in the free reduced lunch programs for taking computer science by choice. There's also a reduction in students who are designated ELL or English language learners. And also we took a look also at whether our native Hawaiian Pacific Islander students were enrolled and we found a very low number. It really matters the school and the type of computer science that they're offering, because there is a range and there is a difference from high school to high school of what is offered and so I think overall we need to do a better job of scheduling opportunities so more students can take it if they want to, and a better job of offering the varied courses. And some of the, if they can't take it at their school, is there another way that students who are interested can take it via another means. If it's not offered at their school, because maybe there's only one student who's interested in a in a higher course. And right now there's there is a school there's an online school potential and possibility. It's just the students need to have access and that opportunity to take those. Thank you. So, you know, you mentioned that I really like the reference you made to making a cultural connection and making sure the students know the impact that they're learning would have. Can you think of other examples of policies you've seen coming out of other states to help alleviate some of the equity gaps to make sure that underrepresented students are becoming more interested in computer science. You know, I think the most exciting thing I've learned about has come out of that has come out of other states has to do with connecting it to society. And so when you have something that's more project based learning oriented, and you can pull the ideas of how computer science can make something better. So they identify a problem or, or they're trying to develop a solution for something that really gets the kids thinking about how can I bring myself and my knowledge, and even my culture and my background into these solutions So bringing that in. I think that has been a fascinating aspect of some of the other programs and other states is not just talking about the content of computer knowledge on computer science knowledge but also the what do you bring to the table and can marry that with computer science knowledge. Here we have the hall framework in our public school system, I think that can be a powerful powerful entity in computer science education here. I think, you know, we need to stop thinking about if we build the course the students will come. And we need to think about how the course can be built to engage the students and to tap into some of the skillset that they already have some of the knowledge that they already have and coming to the table. So I think that for me has been the most exciting thing from other states that I've seen. Thank you it's very inspiring and a great way to end our conversation. Again, we're talking with Dr truck new and she was one of the co authors of the landscape computer science education landscape report. Thank you so much for being on the show that when it was pleasure as always to talk to you. And I can't wait to see what's next.