Hello and welcome back. Hope you're looking forward to another fantastic talk here at the AppSec Village for DEF CON 29 in safe mode. It's important to remember your three, two, one. Even though we are separate from each other and socially distanced, your cohabitants will really appreciate that one in there. And just take care of yourselves. Get some good sleep, get some good food. Make sure you take a shower. For our next talk, we've got David Waldrop talking about the DevOps and Agile Security Toolkit. After 25 years in the application development, David moved to information security just over seven years ago. His passion is helping developers write secure code. He's currently an information security advisor supporting the application development community at his employer. Let's put our hands together and welcome David Waldrop. Hi and welcome to the AppSec Village. I hope you're having a great DEF CON 2020, albeit in safe mode. My name is Dave and for the next 30 to 45 minutes, we're going to talk about the DevOps and Agile Security Toolkit. Now, before I get started, I have to make the standard disclaimers. First, this presentation and any comments that I make are my own and do not necessarily represent those of my employer. Secondly, I will mention a few example products. Some are commercial, some are open source. These are not necessarily meant as recommendations. They are mentioned to serve as a starting point for your own investigation and review. These are things that I've run across in my journey. So take that as it is. Let's start with the two terms that are on everybody's buzzword bingo sheet these days, DevOps and Agile. We need to get definitions in place for the duration of this talk. So we have an idea that we're all dealing with the same playing field. Agile. Agile focuses on continuous iterative development and testing. Software is developed in smaller increments and then is integrated for final testing and delivery. Scrum, Kanban, and XP Extreme Programming are examples of Agile approaches. On the other hand, DevOps focuses on the collaboration between AppDev and Operations. The focus is on deploying code to production in a fast manner, usually automated. So you can see from the definitions that these are two separate concepts. However, many organizations tend to combine them into one initiative. Very rarely do you find a shop doing DevOps and not doing Agile or vice versa. So no matter whether they start with DevOps or they start with Agile, the one piece that's usually late to the party is security. But no matter how late security is invited to the party or whether we have to crash the party ourselves, we usually can still bring valuable resources without slowing things down or at least without slowing them down a lot. And that's what we're gonna talk about through the rest of this discussion. So for the past few years, I've worked with several different Agile and DevOps teams. My integration with this started as a pilot program where I was the information security representative that was assigned to help introduce Agile to our organization. More recently, I've implemented the information security integration with the Agile and DevOps teams across our organization. During this session, I'm gonna share with you some things that really worked well and some things that just didn't seem to work at all. So hopefully you can take something away from this and apply it to your own organization. This particular slide will give you the map of what we're gonna talk about for the rest of this discussion. We're gonna talk about Agile staffing. We're gonna talk about the eight simple questions. We're gonna talk about the security champions program and then go into developer training, which is my favorite part of my job, security in the software development lifecycle. And then we're gonna hit the hat trick of securing your code, static code analysis, dynamic code analysis, and open source analysis. And then finally, we're gonna wrap things up by automating the heck out of it. So let's start with Agile staffing. Sherman set the way back machine for when I started with Agile. One information security person was assigned to one Agile team. That security person would be integrated into that team and attend every ceremony, every meeting, everything, every day. That didn't work. There are a couple of reasons I think that that didn't work. First of all, Agile teams tend to multiply. You can go from a proof of concept with one team to having close to 30 teams in less than two years. Most organizations do not have the information security bandwidth to support that type of staffing model. In addition, the scrum masters tend to treat every member on the team as though they can perform all tasks. And when you're dealing with a team of all developers, that makes perfect sense. This model tends to fall apart though when you put information security, QA, middleware, any other infrastructure or shared services team as a part of the Agile team. What happens is in the Agile process, their hours count against your available development hours. But the infrastructure people, the information security people do not have the skills or the capabilities to do some of the development. So you kind of see that there's a mismatch. You're given hours, but you're not allowed to use them. So it costs a lot of problems for some of our scrum masters early on. Again, we realized this was not the way to do it. So I ended up coming up with a two-tiered approach for trying to integrate information security into the Agile team. First, at a high level, at the enterprise level, we will have an architect, an information security architect, and they will inject into those high-level projects and basically set up guardrails and guidelines. So as projects are being devised at the visionary level, they can jump in and try to help guide them into making more secure decisions at that high level. Now, when you get down into the weeds though, each Agile team does need to have somebody they can rely upon for information security. And so what we ended up doing is we created named resources within the information security team that are assigned to Agile teams. Now, it's not like the previous model. You're not assigned, you're not sitting with them, you're not assigned to go to every meeting. We're gonna talk about how we scaled that back, but we ended up finding a way where based on where information security can add the most value, we attend those ceremonies and only those ceremonies. So at the end of the day, each information security representative can support between six and eight different Agile teams. That is a model that is certainly sustainable. So what is a little different? Well, first of all, we make sure that every Agile team has a named resource that is responsible for information security for them. So this gives them a named contact. If they ever need something, they know exactly who to call and where to start that quest. Secondly, we attend or the Agile reps attend the backlog refinement sessions. These are meetings that happen once every two weeks before the next sprint and it defines what they're going to work on in that next sprint. It's a perfect opportunity to jump in and say, hey, you're planning this work, we need to think about blah, blah, blah from an information security standpoint. We can get in just ahead of when development starts. It's a perfect time to bring up security issues, make recommendations and answer questions. And then finally, we attend the quarterly planning agreement meetings where the vision is cast for the next quarter and we can make sure that we're on their radar for things that we think we need to be a part of. So this is kind of a high level diagram. The purple arrow at the top is the information security architect. That particular person, as you can see from the diagram sets guardrails for enterprise planning projects. All of the red arrows are the different places where our individual security representatives can or may inject into the Agile teams. We don't inject in all those places but there are places where we can and we give them that option to call us if they're needed. So let's move on to what I like to call the eight simple questions. This particular concept came up as a result of assigning our Agile reps to their teams. We found that the leadership within the Agile teams really wasn't sure when to call us. And since we weren't sitting there in every meeting, there was a possibility that something could come up that might fall off the radar that we might not get contacted for. That they may not even think is important. So we decided that we need to give clear guidelines to the scrum masters and product owners as to when they should include information security. That's how I created the eight simple questions. So basically these eight questions are a guideline for that leadership team. And if they answer yes to any of them, they need to make sure to include their information security representative in those discussions. These are the questions as I currently have them. We're gonna talk about that in just a bit because they change over time. These are not one and done kind of things. Am I dealing with any sensitive information? Now information that is sensitive, it's gonna mean something different for each one of our organizations. If you're working in healthcare, if you're working with banking information, if you're working with retail, with PCI information, you will be able to define what sensitive information means for your organization. Am I sending or receiving data outside of the company? Is there a new vendor involved? Am I going to introduce new software systems or libraries, even open source? And remember open source because we're gonna talk about that. It's a unique challenge. Do I need access to secrets such as passwords, keys or certificates? Will I need the ability to use single sign-on? Am I going to leverage the cloud? Will I need updated access roles? So these eight questions are what we are currently using as a guideline for the interaction between the agile team and their information security representative. As I mentioned, the exact questions are gonna differ on your organization. The questions themselves will actually change over time. I started, I think with seven questions and then we had several issues come up with access roles and who to ask and blah, blah, blah. So we added a question for that too. So don't be afraid to take a stab at it and massage it and change it. That's the thing about agile and DevOps is changing all the time. And we as information security people need to be able to change our stuff as well. So the basic idea is this, create a list of questions usually 10 or less, something that's gonna fit easily on a PowerPoint slide or a single piece of paper so they can take it to meetings with them. Give that to the agile team leadership and they have a guideline. They now have a concrete way of knowing when they need to work with information security. So we found another advantage to this approach as we onboarded additional information security people to become representatives for the agile teams. A lot of these folks were pretty new to the organization and they didn't really know when they needed to inject themselves into their teams. They didn't know what they needed to listen for in the backlog refinement sessions. So we use these a simple questions on our own people. It gave them guidelines and hints of what to listen for when they're working with their agile teams. So this kind of became a win-win on both side of the coin. So I think this was a great tool that we've been able to use. Another tool that I honestly have to thank Jim Manneko for, Jim, if you're out there, thank you for this. This was a recommendation he made to me after one of our training sessions and that is the security champions program. A security champions program is a team of application developers. We get one from each agile team and these developers have expressed an interest in information security or secure coding or just security in general. This is a voluntary program. The members of the team volunteer to come to the security champions program. And we typically meet quarterly. I provide them lunch when we're in the office. Thanks, 2020. I look forward to getting back to the office and having lunch with these guys and gals. They're a great team. So the team has this following charter. We assist the agile teams in terms of application security. We serve as a communication conduit between the agile teams and information security. And then we meet quarterly to share experiences. We ask questions. We share knowledge. It has had some incredible benefits. First of all, security has a relationship with at least one person on every agile team. I'm not saying we have a mole. What I am saying is sometimes we hear about things long before it percolates through the management chain. I might get a phone call about, hey, we're thinking about using this open source library. Is that cool? We take a quick look at it. We approve it. By the time the formal approver gets into my hands, we've already done it in their coding. So it gives us a great communication conduit and that helps me make things faster. I may have not mentioned this before. I hopefully I have. Relationship is key. You're going to hear about relationship throughout this entire discussion. We build relationships with those agile teams. It starts with having an assigned rep. It moves into a different relationship level when we have a security develop, security champions team. Secure coding training takes it to yet another level. And you'll see why in just a few minutes as we talk about the developer training, but it's about building relationships. It's about having fun while we're doing the right thing for our organizations. So, so far the team has done a lot of really cool things. We've reviewed vendors and products both on the development side and on the information security side. We've selected our developer training programs for the last two years based on the input from the security champions team members.  We've cross-consulted it. Now this was kind of an unexpected benefit is where if I had a team that was very well versed in one technology and they mentioned that in a security champions lunch, another team might reach out going, hey, we're about to do that. Can we sit down and talk? So it actually starts to cross-pollinate some security knowledge and some technical knowledge between different application teams. And then finally, it's served as a candidate group for application security openings within the InfoSec team. The software development life cycle. So as we started to roll out security, a lot of people have asked us, how does this fit into our SDLC? So I ended up creating a plan that maps information security phases to the software development life cycle as it currently exists. It is not a perfect fit, but I think it is a good representation of how information security can bring value to each step of the SDLC. So this is what I like to call my dark side of the moon diagram. Those of you old enough to remember, probably recognize the album cover. So if you take a look on the right, we have the software development life cycle from concept into design, up into coding, testing a QA, QA and deployment, and then post deployment at the very top. Now, if you look on the left side, you'll see that it matches up pretty closely with security knowledge, security design, secure coding techniques, security testing and then security response. The each individual layer of the pyramid, I think are deliverables that security can bring that help take that concept on the left and apply it to the SDLC phase on the right. And we're gonna walk through those real quick. Training is the base of the pyramid. I think training is foundational to everything above it. If you don't have a solid foundation of training for your application developers, everything else is at risk. So this particular approach, we're gonna talk about in depth again, because it's my favorite part of what I do. It includes things like lunch and learns, outside speakers, conferences like you're attending right now, video training and things like that. The next level up is threat modeling. Threat modeling, the application team and InfoSec. We sit together, we work together to examine the application design, the system flows, whatever they can bring to us that they have available in that design phase. We look, we try to work together and identify potential vulnerable vectors and try to figure out a way that we can mitigate them. Now, threat modeling, there are books upon books written about threat modeling. And there are people in my organization on my InfoSec team that are much better at it than I am. And they can actually create incredible documents and spend hours and days and days and days doing this. I think you need to start out small. I think it's about baby steps at first. Start with a discussion. This can be a one or two hour discussion where you have those deliverables from the design phase and you whiteboard them and you come out of there with to-dos or questions or things to research. It doesn't have to be this big, heavy weight, overbearing approach to threat modeling at first. It needs to be a conversation that gets back to relationships. You need to have those relationships in place so you can have those conversations. The third level up is static code analysis. We're gonna talk about this in much more detail later. But most tools are designed to identify potential vulnerabilities within the code. Now, static code analysis actually looks at the code and looks for patterns within the code without running it. Now, we're gonna see a little bit later why that's important. Whoop, I think I went the wrong way. There we go. Dynamic code analysis is the next layer up and that is very similar to the previous layer which was static code analysis. But instead of just looking at the code, the code is actually executed and tested for vulnerabilities. So like I said, these two pieces are very, very similar. One is looking at patterns with the code. The other is actually exercising the code and looking for issues. The next is pin testing. Pin testing can be performed by your internal team if you have the skills or resources or you can use an external firm. This is usually a greater scope than dynamic testing. It will actually look at things not just in your application, but system-wide for vulnerabilities and attack vectors. And usually there's a person involved. It's not just an automated exercise. We're gonna see a little bit more when we talk about dynamic testing, the difference between that and pin testing. And then finally, when the code is in deployment, you need to have a vulnerability management process that you can classify, assign and track identified issues. Right now Infosec meets regularly with a representative from each application team to review these and to make sure that they're working and they're on track. Again, those relationships are absolutely key to making this work. So now we are getting to what I consider my absolute favorite part of my job. And that is developer training. If you remember back to that pyramid we just looked at, this is the foundation for everything that Information Security does with AppDev. When I came in to Information Security about seven years ago, I started a developer training program because I realized that the developers really are your last best hope for defense when it comes to application security. If your application is written correctly, then everything you throw in front of it, application firewalls, everything like that, that's gravy, that's nice, but you've got a really tight application and that's where real security takes place. The problem is I was a developer for roughly 25 years before coming to Information Security and nobody taught this stuff. This is stuff you learned on your own if you had an interest in it and it wasn't universally available to all developers. So I started small. I started with Lunch and Learns. It was really something that, hey, I think this is important. Let's try it, let's see if it works. And it really did. We would end up having Lunch and Learns about every other month. I would create a class on a specific topic. My first one was cross-site scripting, a lot of fun. It's neat when you can show people cross-site scripting examples, even if you just run WebGoat or something like that. They get excited, they kind of dig it and they start trying it on their own stuff. The content usually lasts about 40 or 45 minutes, a lot like this session, and then we leave 10 to 15 minutes for open discussion and questions. Now the key here is make it fun.   There's usually some kind of door prize or door prizes and they don't have to be expensive. You can just go down to like five below and get a couple of wireless Bluetooth speakers. And people dig it, it's a lot of fun. Again, making it fun is absolutely key to a successful Lunch and Learn program. So once we got that up and running, I decided we needed to take this up a notch. There is a level of training that I couldn't provide that I think our developers really, really would benefit from. And in order to do that, I knew that I had to reach out to industry experts. And what we ended up doing is we were able to get commitment from management, both on the IT development side and on InfoSex side that we could do one or two days where most, if not all the developers will attend a training event. Now here's a hint. If you are going to try this and you're doing Agile, put it in your innovation sprint. If you put it in the innovation sprint, which is usually the last sprint of the quarter, and the developers have a little more leeway of what they work on during the innovation sprint, you'll very likely get more participation than if you step on a middle of a sprint where there's actual deliverables do. So keep that in mind. I was really, really lucky. My very first interaction with this program, I was able to secure Jim Manneco, and he came in and made an incredible impression on our development teams. Jim's been back, I think three times now. Always a pleasure. Rich Mogul's been by twice. We've had a recent one with Ron Paris. Dr. Phillip de Rique, phenomenal instructor. I just took his OAuth class. So if you're looking for OAuth, wonderful class. But we've got him coming in this fall, and I'm looking forward to that. The reason I actually wanna call these gentlemen out by name is I think it's important to be grateful. I am very grateful for everything they've done for me and my development teams. And it's important to be grateful to those who help you along the way on this journey, because none of us make it alone. So gentlemen, thank you very much. If you see this or hear it later, your training, your mentorship has meant a lot to me and my development teams. So one cool aside is I mentioned this earlier. The security champions team has been involved in the selection of the instructor for the last two years. This gives your application development teams a voice in the training. And we've seen that participation has actually increased. We had great participation before then, but when the developers actually had a voice in picking who's coming in and what they're going to talk about, we're finding that it's much more applicable to what's on their roadmap. It's much more applicable to the skills they're hoping to get. And participation goes beyond what I could have ever hoped for. So again, we're starting to see some of these initiatives are starting to weave together and starting to build kind of a program. It's kind of cool. So this next one, I really wish I was doing this right now. Take a developer to DEF CON. We had management agree to provide scholarships to developers that were selected by the information security team. So we would give them the money to buy their badges. So they wouldn't have to go and get money out of their own bank account. So each year I've been able to bring up to three developers to DEF CON. That's been awesome. It has been just a phenomenal experience. They've gained a ton of knowledge and a ton of awareness by DEF CON. One of the things that I found really interesting was I really advised them not to restrict their sessions to things that they think will apply to their job. I did that my very first DEF CON and I wasn't really sure I was going to come back to be honest with you. The next year, one of my coworkers strongly encouraged me to go. Thank you, Barry. And encouraged me to go and find a few fun things that just had nothing to do with my immediate job. The interesting thing is they ended up having more to do with the things that were coming down the road in my job than I ever could have imagined. So I fully encourage each one of these developers that I bring to DEF CON to experience the full DEF CON experience.  Try some of the capture the flags. Try whatever you want. Have a good time because it's really important for them to be immersed in the DEF CON experience. So like I said before, they come back with a changed perspective. It's a lot like that scene in The Matrix where that thing crawls out of Neo and he goes, my God, that thing is real? They understand now that the security is not just something that we're teaching and preaching about within InfoSec, that this stuff has real world application. And it's that realization that makes them a better developer, a more secure developer going forward. We've seen a trend where a lot of the folks that we've taken actually, I think all but one of the developers that we've taken to DEF CON have eventually become security champions members. And then more recently, just in the last couple of months, one of those developers, I think he was the first one I took to DEF CON with us, ended up joining the information security team on a full-time manner. And Shane, if you're listening, welcome. I'm really glad that you're part of the team. So there's a couple of other fun activities that we do in developer training. Again, gotta keep it fun. Everything has to be fun. You learn better when you're having a good time. I mean, look at DEF CON, we're all having a great time and we're learning stuff. So a couple of DEF CONs ago for reasons of work, I couldn't make it. It was the only DEF CON since coming over to information security that I was not able to go to. And I must admit, I was bummed. So what I decided to do was I was going to have my own little DEF CON. And we decided that, okay, let's just take people along for the ride. So we identified five videos from previous DEF CONs and we had a lunch and learn for five days that week where we watched it and we talked about it. We had drawings for DEF CON related swag or items or giveaways. We just kind of had a good time. It was kind of built up as, hey, take a break, come bring your lunch, let's hang out, watch something from DEF CON, talk about it, you might win a t-shirt, you might win some stickers, whatever. And people really enjoyed it. It was a lot of fun. As a matter of fact, I'm probably gonna do one this fall for the folks that didn't get to enjoy what you're doing right now, what you're enjoying right now. And then finally, I have an annual Thank You Lunch and Learn. This was a tradition I started, the first year we did Lunch and Learns. It's always the last Lunch and Learn of the year and I typically will go out and I'll purchase quite a few giveaways. They don't have to be expensive. We do things like, say, the Bluetooth speakers, boxes of candy, we've done some Christmas mug sets, just weird things, but things that are kind of fun. And we do a shorter Lunch and Learn followed by a session where we just eat some good food and we have some drawings. And I have an opportunity to thank my development community for the support of the Lunch and Learn program and for the support they've given to Information Security. I think it's important to say thank you and this has been just an incredibly popular Lunch and Learn every year. It's a lot of fun and I highly recommend it. So here are the keys to a successful Lunch and Learn, successful training program. Make it applicable and give the developers a voice in the training. And usually if you give them a voice in the training, it will be applicable just because they're gonna tell you what they need. I think I've mentioned this 1427 times, but make it fun. It's gotta be fun. Share how much you care about this stuff. If you're engaged, if you're passionate about it, people are gonna feel that and they're going to gravitate to you and gravitate to that topic. And then finally, build relationships. Listen, reward and always express gratitude along the way in this journey. So we're getting into the next phase of the toolkit. And this is what I like to call the analysis hat trick. Three types of analysis that if we implement all three, we're going to have a much more secure code base in production. And the first is static code analysis. You might remember that from our SDLC pyramid. So static code analysis scans the code without running it. It looks for known patterns of vulnerabilities. You can usually select what you scan for. Some will allow you to scan for PCI, blah, blah, blah. I almost always scan for OWASP top 10. If you're not familiar with OWASP or OWASP top 10, I strongly recommend that you check it out. Some of the deliverables from that organization are absolutely stellar. I've been a member for, I think, seven years now just after joining the InfoSec team. And I've leveraged a ton of their stuff. So great organization hats off to you if you're out there. In an ideal world, the static code analysis tools would only report the confirmed vulnerabilities. But even if you tune the daylights out of this thing, you're still going to get false positives. And that becomes a problem. Because originally when we first set up this process, I was the only one that could review the false positives and whitelist them or wave them as it were. That slowed things down immensely because that was not my full-time job. That was something else on top of my full-time job and possibly another full-time job some days it felt like. So that being said, I decided to leverage the security champions. These were folks that had some basic knowledge of security. They knew their applications better than I ever would and they had a passion for making secure code. Seemed like a perfect fit. So what I ended up doing is I ended up giving several members of the security champions team the ability to review and wave false positives. And that has worked out great. The end result was we've had a lot more throughput. We've been able to address false positives much more quickly and the adoption of the static code analysis tools have actually increased as a result of not having that delay. So I also see static code analysis as an extension of developer training. A lot of these tools have an IDE component. So for example, I used the SpringToolSuite Eclipse and you can use the plugin and execute your scan from within your developer tool. And it will take you straight to the line that's got the problem. And you, in some of these tools, you can even have recommendations pop up in the bottom of one of the windows that says, hey, you might try blank, blank and blank to address this vulnerability. If developers are doing this while they're developing not waiting for the build process, it becomes a teaching tool because as a developer uses this, he or she is going to identify and learn that, oh, I need to check my input fields to make sure they're the right type and right size. Okay, you do that enough times. It becomes second nature. So this becomes not only a way to secure your code, but a teaching opportunity as well. So studies have shown that study code analysis can identify up to 80% of vulnerabilities. That's pretty awesome. If I could tell you that you could do one thing and remove 80% of vulnerabilities, I think that'd be worth doing. So this might be something you might wanna take a look at. Here's some example products. There's three products along the top that are commercial. OWAS has an entire list of code analysis tools at that link right there. Again, not meant as recommendations, but these were tools that I've come across in my journeys and they might be worth at least acting as a starting point for your own investigation. So the second goal in our hat trick, the second piece to the tripod is dynamic code analysis. This was also in this SDLC pyramid. So unlike static code analysis, dynamic code analysis actually executes the code. Now that has a prerequisite that the code has to be compiled and free of errors and can run before you can actually perform the dynamic code analysis. Dynamic code analysis, I mentioned this before, is different than pen testing, whereas dynamic code analysis looks for the flaws in the code that can be exploited. Pen testing looks for ways to exploit the system in general, often at a greater detail and almost always involving a human attacker. So again, two different things, they're kind of similar, but I really think that dynamic code analysis is really at best a subset of a good penetration test. So dynamic code analysis tools can identify up to 85%, but if you combine them with the static code analysis tools on the market, up to 95% of your applications, vulnerabilities can be identified early on. 95%, that's pretty darned impressive.  I've used several of these. Again, not recommendations, but a place for you to start. Give you a word of warning. I think I told you earlier on, I would tell you some things that work and some things that just didn't seem to work quite so well. Some of these tools can be weapons. I'm looking at you, Burp Suite. You need to do things like, make sure you set the scope of your testing tool so it doesn't see that, oh, I've got a link to Facebook here. I will jump and follow that link in my crawl and I will start attacking Facebook. Set your scope absolutely to your application only. Run the stuff and test. Don't run it in production. If you find a SQL injection exploit and you start to execute it, it's very, very likely that you're going to corrupt or lose data on the database on the backside of that injection vulnerability. Also, watch out for forms. So let's say you're doing some dynamic testing and it's automated and you're getting ready to essentially attack a web form. Make sure you find out where that web form is going before you start your test. You can easily overrun a service desk by submitting thousands upon thousands of emails from a web mail form. Not saying that I've ever done that, but I know that it has happened. So the third goal in our hat trick is open source analysis. Open source is awesome. We all use open source. Some estimates put the percentage of open source in internally developed applications at 70%. That's 70%. Now the problem with that is, as a result, about 50% of our applications contain one or more open source pieces that has a high security vulnerability. And keeping that out of production is a huge, huge task. There are two different approaches I've taken when I've tried to address this problem. The first was a firewall slash proxy solution. There are products out there that you can actually set up that will proxy the main repos out in the wild. And they'll check as you pull down code libraries, they'll check them for license compliance. So you can say, hey, I'm okay with this license, this license, but I don't want that license. So you can set that up ahead of time and it will check each time a module is pulled down that it is in compliance with your licensing. But more importantly, you can also set a vulnerability threshold. So you could, for example, say, hey, I don't want any critical or high translation, I don't want any CVE seven or higher coming into my organization's local repository. So the problem with that is, a lot of the tools that developers use, particularly in DevOps for automating building of systems, automating testing, have vulnerabilities because they really weren't meant to go live anywhere. They were basically developer aids, developer tools. And your policy is going to quarantine or prevent them from coming into your local repository. The result is you get a lot of phone calls, hey, this module, I need it, I need it now, and it's quarantined. Well, that requires getting out on the firewall or proxy and looking at what's quarantined, determining how it's going to be used, where it's going to be used, and does that CVE apply in this use case and then deciding whether you can waive it or not. It is a labor-intensive process. I didn't really like doing it this way at first. So I ended up moving to a build-based solution. Build-based solutions are very similar to what we're going to see in just a few minutes where you basically add an open-source view step to your automated build process. If you find that same vulnerability as it's going to production, let's say it's a CVE of eight, and it's going into production, you fail the build. At that point, the developers have the opportunity to go, okay, I need to get a security waiver or I need to find a more recent or more updated library that doesn't have that CVE as an outstanding issue. So this ended up reducing the manual intervention. The only problem is you could end up having something on your internal network with a CVE of seven or higher. That's a developer tool. You've got to be very careful when you're whitelisting or removing items from quarantine to understand how it's going to be used and if the CVE itself can be exploited in that manner. So here's some products once again. OWAS, I've mentioned them several times, great organization. Again, these are not recommendations. These are simply places for you to start if you haven't looked at these already. And finally, let's talk about automation. So those last three steps, they seem like a lot. And originally we were doing them manually and it became unwieldy very quickly. It just took a lot of time. It took a lot of effort. So what we were able to do was automate most of this into the build pipeline. So if you have a continuous integration tool, something like Jenkins, you can add steps that execute static code analysis, dynamic code analysis and open source analysis with every build. So this gives you all of that protection over 95% from the studies with every single build that you do. Now there's some things that are just too stinking big. So if you're still dealing with legacy applications, big old monolithic jars and ears, if you've got something that's somewhere in the line, you know, hundreds of thousands of lines of code, sometimes close to a million line of code, this is not going to go well for you because the dynamic scan, the static scan, those pieces are going to take a long, long time. I tested one application for a friend of mine just to try it. It was a legacy application and the scan for just the static code analysis piece took over 12 hours. You can't stop a build for 12 hours and expect the developers not to be concerned. So I don't recommend this for large applications. If you do, you might do it as an asynchronous build step. So basically it says, hey, I've got to go do static code analysis. I'm going to launch it and then I'm gonna continue with my build. You lose the advantage of being able to block at that point, but you still have an automated scan going along. You'll need to have a process in place to alert the development team as well as information security of the results of that scan and then decide how you want to react, but you lose the ability to block. But fortunately, the industry is really moving towards smaller builds, APIs, microservices, things like that. And inline scans are very, very possible. They're very fast. These tools are tuned for this kind of work and they run incredibly, incredibly fast. Just aside, some of the tools are still working on their automated pipeline plugins. So if you are looking at any of the tools, whether it's the ones I've mentioned or something else, make sure that you ask about the maturity of their continuous integration pipeline plugins. Otherwise, you might find yourself stuck manually doing these for a while until you can find a way to do that. I'm gonna end with a couple of final thoughts. So the keys to success, hopefully you can read this. They are start small, do one thing. For me, it was starting with a training program. That literally led to everything else that you saw in this presentation. And as you saw in the presentation, this stuff tended to feed upon itself. The development led to more developer training which led to a security program which led to, so start small and it will all come together. Get management buy-in by both information security and by app sec management. The centerpiece right there, that has to be the key for me.  When this stuff is no longer fun, I'm not gonna do it anymore. We've got to keep making it fun, particularly for our developers. Developers are doing a lot of stuff.  And for the most part, it's not welcome unless you can make it fun. If you can make it fun, it's gonna happen. So just like we just mentioned, automate everything you possibly can. And remember, it's all about those relationships. The relationships with your scrum teams. It's the relationships with your developers. It's the relationships with your vendors and the trainers that you can get to come in. So building a good relationship is key. Don't try to reinvent the wheel. The best innovation is usually stolen from somewhere or given from somewhere. So if you can take one piece from this discussion and implement it in your organization, I will feel blessed and I'd love to hear about it. Take it slow. This stuff is new for all of us and it's always changing. And finally, learn what works best in your environment. So I wanna wrap up with thank yous. I wanna thank you for spending the last 40, 45 minutes, whatever it ended up being with me and with AppSec Village. I wanna thank AppSec Village. I got to volunteer there last year. I ended up spending the entire DEF CON there. After, I think that was my sixth year in information security, I finally found my home and that is the AppSec Village. So thank you to the leadership of AppSec Village for doing this and for giving me this opportunity. I wanna reiterate my thanks to Jim Manico and he's kind of been my spirit leader on this journey and I appreciate all you've done. My colleagues, Barry and Shane, my partners in crime, you guys are awesome. And finally, my best friend, my wife, who's put up with me, put up with me doing this and several other things in information security. She's absolutely the best and I can't thank her enough. So thank you guys very much. I appreciate you spending this time with me and I hope you have a really, really excellent rest of your DEF CON. Thanks.


The Minister of State for Industry, Trade and Investment, Miriam Katagum, has reportedly collapsed during an official engagement in Balchi State. Media reports say she slummed while delivering a speech at the launching of an empowerment programme. She was immediately taken to the Abu Bakar Tafawa Balewa University teaching hospital. Plus TV cannot independently confirm her state at the moment. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


And welcome again again this video is part of a series. I've been going over using programs for Morse code and other types of communication We've really been looking at mini modem, which is we're going to use in our final project here But I just want to show you a little more how it works again. It's all about the audio tones It's it's it's what the computer hears so you can transmit through radio But you can also record it through a microphone in fact some of the videos I've done if you turned on a receiver you should be able to receive some of the messages depending on the clarity But right here I have I put the font up really large on my machine here So hopefully you can see it and I'm going to run mini modem at a for receiving at a rate of 110 now I've already generated some output of our Example text of some addresses to a wave file on this computer that I'm going to play through my phone here and We should see those addresses start to appear here So I'm going to go ahead and start this up and you can see the light blinking here It's now listening through my microphone. I'm going to go ahead and click on that file And we can see that they start coming up on the screen here so 30 Memorial Drive 250 Hartford Avenue and scan them and of course it's all about 30 so the further away I get Still doing pretty good. It's picking it up. I can even be talking over it Okay I think we have a little bit of a blunder right there looks like there's an extra be there where they're supposed to Be a space but even this far away and not very loud my microphone is picking up again a little little thing So I can set this down here See it lost a little bit there, but it's still going for the most part. It's going through again Even with me talking over it and the microphone not being right there This is a fun way. You can you can put this information in audio files with music and Doing great right there And even if music's playing over it Depending on the the frequency of the tones and stuff you should still be able to decode stuff So you can put this noise in the background of a song which I've done before with psk 31 about 10 years ago That I think that one of my first albums that I wrote was called psk 31 something rather and the first song actually has Something in the background. I think it's just a link to my website This is a fun way you you could put I get just think about how sorry about that my SD card got full But as I was saying you could leave a message on someone's voicemail And then they can decode it later on or you can put a message hidden inside your voicemail message for when people call You just just fun things like that. That's the sort of thing. I love doing what sort of thing But again, we're gonna look at a practical use of transmitting important information for emergency workers in times where Their computer systems might be down and we still want to transmit that information But I just wanted to give a demonstration of this as you can see it's working pretty good Just playing not very loud out of my phone here to a microphone and even with me talking over it losing some characters When it's a far away, but once right there Everything's coming through. I thank you for watching. Please is it films by Chris calm That's Chris the K there's a link in description and if you like this video and want to see more like it Be sure to like share subscribe and comment. I thank you for watching as always I hope that you have a great day


Hi everyone, so this talk is about test-to-test build-in class platform for next class build-in platform for next class. So, this is going to be a bit different from the earlier ones. The dashboard is going to be like the payments have when you send money, when you receive money, send them money all the time, all the time, so this is going to be targeted at the space which basically has J company, multiple apps, we are powering 100 million devices and we have also built deep, so you guys might have used deep, so that it's really hard to start producing all your apps. Then the second requirement, we couldn't use a react net, so these are the two basic challenges we had. We had to create a very small insketch, basically you will use it in multiple places. You just have the component, you guys, you guys already have to start it, multiple places from the top. These basically are really, like, almost in the translation of the tools. There are tools like that, you can translate the, you know, the sexual values or the potential values of this, and second is the pixel representation. So, yes, it's really hard to create a pixel representation because scaling limits are different. Well, if it's scaling it, it's fine based. So, it's really hard to make sense, you know, what to, what to create is the pixel value of a sketch file and what it's a bit of an attack. So, the way it works is basically, so you have a sketch design, which is open here to the sketch file. So, the sketch file basically means generated by the sketch. So, basically, if you see already there's a, which has better information related to each of the, and you say type, let's say this, right, this thing, when this information is attached here, basically this basically reads both this case and combines the code. So, I'll show you the code, how that works. These are all responsive properties, right? These are, these are all designed by the work like experts or as you get to know. This will render. So, if you have a automatically, let's say X20 for the X node, and that way the product may just be looking at 20,000. It doesn't care what screen and what. So, it basically is unaware of the screen stuff.  But basically that's how the fact is how we even complex all this. So, these are the bigger problems we have. And second is the code. Because there's so much coupling of the code. It's impossible to basically figure out, So, if you're a student, basically it tries to, because we just keep adding like this, like this, like this, like this, or just to make it something like constant. Which is like, and it will give you static. So, this is the new code language we have come up with. So, this is a new notation. And this is some kind of a line. So, basically what's happening is it's waiting for some kind of response. So, it basically shows the, then you can see it from it. Then it will output how much. So, that's all the information that should be there, and the company of code. I don't really care about how a man is in the state. But that's some layer that has to be like, you know, distinction. Like, you know, this is the flow code, and it can output any kind of keyword. So, if you see, you basically say, remove not, remove not patch operator. And this is like an endeavour, which we'll keep on waiting until we get the operator. So, this is what I was talking about earlier, saying, you realize you can't really figure out, it's so big, so big. Before one thing, if you say, it will say, remove not patch operator, you will get the operator. This will say, show me the screen. In the slide, you will assume that this operator is coming and I tell the screen. We will also pass this element. Because basically, you know, you will get the operator. The next thing is, it's saying, you will have to pass the mobile number. So basically, like, now you're asking for a mobile number. You get the mobile number. As soon as you get the amount, you make a remote intake. We are even working on, like, a dummy-based device. So, this is a preview of the, if you see, these are all basically generated. So, this is a cloud-based measurement. There's a tie on the medium. That's how the code has to be done. So, these are the scenarios. Let's say, we will change our part, basically, analysis. Interfer to this thing and generate a visualization, which basically will say that this element has this color that we will fit into the meta-resolution point. And also, the same thing will happen in the phone too. So, this is the same code basically running in both the phone and the app app part. So, these are the things that we have basically developed. Let's do UI, let's do Pro, and the part basically, in this next slide, the part will explore everything. It's the static UI. And Pro is the part basically where you write DSL-based code, which is sequential in nature. So, this is not something like a tie code. So, this is basically for writing sequential tools. Third is the cost platform, like a small reactant for, which will aid to solve the SQL environment. Also, we didn't need to add everything because this part is very hard. So, you can think. Thanks. A round of applause for this amazing session.


The screen is divided into three equal sections. On the left, one, a gray background with a white outline of a human figure. Individuals are filmed while wearing an electroencephalogram. Each person's brain waves are recorded during the filming. Number two, on a slightly darker gray background, the subject's brain waves are analyzed by a custom algorithm. The brain wave data is used to affect elements such as color, brightness, transparency, etc. A figure showing brain waves being scanned, with lines pointing to three different colors and three different transparencies. Three, the background is a darker gray. Images are layered together and projected in the gallery to create an evolving singular portrait. The human figure from step one is now repeated multiple times. The sound playing in the gallery is generative data music. The sound is created using brain waves from members of the Brooklyn Youth Chorus and the artist. A computer program showing multiple views of a human figure in different colors, green, reds, pinks, purples, and blues. The algorithmic visualization shows a grid of these figures. Multiple grids are shown.


How does the welfare system fit into this are we planning to eliminate it because I'm pretty sure once again That's another top. That's another Topic I think both left left leaning right leaning doesn't matter where you're in the spectrum. Everyone agrees that model is broken. Yeah Okay, so Where you stand on that also has to do with your where you tend to stand a little politically So in general most people agree that that this should not replace all services because if you have a disability You need some extra money because you're on a disability sure you might need some extra support If you have a mental illness you you need some extra support It's not like you're gonna fire all the social workers like people some people just need some help to get through whether they get through Or something will need to help permanently that's the whole point of disability insurance that we could all get hurt It could happen to any of us, right? This is this is for all of us, right? But what most what everyone agrees on on both sides of spectrum is that This is better than things that that are very similar to just pure welfare Payments because it takes away the bureaucracy it takes away the stigma You don't have to wait in line for someone to to say if you're worthy of help You don't have to prove what you did to be worthy of that help like this is something that we all just get because we're alive It's just like like it's like you have access to roads and drinking water You have access to money for basic needs so there's no more stigma in it No one has to feel like a criminal because they can't work with our modern-day wealth Like for example, the reason why welfare is broken is a sentiment is broken. So let's say you're like a Struggling mother or father and you have one or two kids, right? And so there's kind of the incentive is broken because it's like okay, let's say let's say if that individual makes x amount more Let's say 2k more than the threshold. He or she loses those benefits Right why on earth then would that person work harder just to make the extra 2k when they're getting all these benefits, right? So let's talk about that so So it's a perverse incentive now In fact, I've heard stories of people who just they want to do black market work Under the table because they don't want to lose their benefits Yeah, see so so basic income actually encourages work because you keep the money you have and in the two methods of basic income I mentioned in the negative income tax method You keep you start to lose it slowly as your income grows So you're still better off working like if you're maybe you have a job for like you make 25,000 year Maybe instead of having your full bi of like 18,000 year you only get an extra 10 So but you're still better off with 10 more, right? Or in the dividend approach, they're interesting and Andrew Yang has been Critiqued by people on the far left that hey, why are you saying that? You can choose a thousand bucks a month in If you're better off than your current support systems Well an interesting point is that okay? Well, maybe a thousand bucks a month might be less what some might be getting now But if they work they lose everything they're getting versus if they work and they can keep a thousand bucks a month Encourages you to work. Yes, so the dividend approach fundamentally incentivizes work And that's what people who think that people are lazy will stay at home They're just wrong because like there's no evidence people don't work from again a hundred five thousand people were in clinical trials already And who doesn't want more money? And if someone like absolutely just just doesn't want to work for some reason That's probably like such a small fraction of the population. That's a demonized as policy They'll do so well for so many people just because of that is just that's just like Charlie Munger has a good saying show me the incentive Show the outcome and so like yeah, ideally we would then replace the modern welfare system with like a UBI system slowly Yeah So again both sides agree that replacing a lot of the system at least the parts that are the most similar to what the cash would do It is good, but but then you have the extremes like people extreme right like Charles Murray would do a with absolutely everything And then and then people in stream laughs. I mean there's certain programs that they would they would maintain I mean nobody wants to end again funding for mental health, you know Cam H and Toronto like what is up to the UBI right like probably less people go because you've less stress But you know, we need to maintain support for disability needs to mean support for like certain Interventions that are required by society Now I'm not an expert in these things so I can't tell you which they are but but in general there is agreement on all sides That yes replacing things that are are directly welfare would be done So you'd have a reduction in government reduction headcount in government, you know government's good at writing checks and And you would achieve that streamlining of government services. So it's actually smaller governments You know, so like another analogy like to offer is that yes more money's running through government doesn't mean government's bigger Like was WhatsApp a big company when it sold for like $19 billion dollars. No, it only had 50 people in it So even though half of half of 500 that I'm sorry Even though like almost a billion people were using WhatsApp doesn't mean what's up was a big company It was a streamlined small efficient company same with government. If we have a UBI, it's a smaller government Even though there's more cash running through it, but but government's really good at writing checks Would this be a federally run program this wouldn't go province province Well, I ideally it would be federal but it depends. I mean Canada's health care system Initially was was championed. I think it was in in Manitoba and then eventually other Other provinces wanted to adopt it and then it was adopted federally So, you know, there might be one smart bold province that does it first and then everyone else is gonna see the economic Answer that makes sure we should do this everywhere. We're waiting for I think it Canada's first. I think the world will follow And so what would because I know you're running a bunch of initiatives right now. Yeah to make to push this In your in your mind, what would you say is the next initial steps that you need to take for this to actually become a reality Me personally or like Canadians. Oh you you speak on behalf of you Yeah, so what I'm doing now is I got really grateful like my business is doing quite well It's I have more time now in addition to that to to work on this activism stuff So, I mean the unique the unique take that I'm taking now is Is it anything that pushes the the economic narratives around it because everyone understands the social narratives We understand that that people be healthier We understand that child success rates will improve more better graduation rates less mental health You know mental health improvements. Everyone knows those things the impacts of poverty The fact of solving poverty will actually solve save a lot of money for the government too in terms of reduced crime and in terms of Yeah, there's a lot of things like that. Sorry So my focus is making the case that it's also good for the economy because if people understand that I think it'll it'll face less resistance in the federal 2024 elections and any provincial elections before that so So the group that we're organizing is organizing like funding and organizing marketing and press PR and Social media influencer campaigns around things that will push this economic narrative. So the first example was last week Mention earlier the Canadian Center of Economic Analysis put a paper about the economic impact of Canada's the Canada child benefit So my team went to work with the social media campaign like spreading that idea We had an amazing video that summarized the key points You know, we made we made resources available for for the press to ask questions So we have ideas to do more things like that, you know last year We launched the CEOs for basic income again to provide the people to actually show Canadians that in fact business There is business support for this because if all they hear from a special interest group saying like low tax low tax low tax they think that's what the business community wants No, that's what special interest groups whose mandate is that what we'll say So I want to show that in fact in my own experience like there's overwhelming support in the business community for basic income Like all the private founder people that that we hang out with like four fifths of them Immediately said they sign a letter because that they want to see a Canada thought poverty. They want to see like us have UBI So I just organized a letter to get 120 CEOs to sign it and there it is it's online right now So eos for basic income dossier, so we'll be doing more with that group try and expand it out Maybe get to 300 CEOs maybe get to a thousand So I'm personally focused on again more campaigns that will Will make people understand that basic income is not about welfare. It's not only about ending poverty It's about evolving our economic system to its potential


So, very good afternoon everybody. Hello and welcome to the exchange for media, EconClave 2020. E4M EconClave aims to bring the most enthusiastic minds together from different segments of the industry. Once again, a very warm welcome to all of you. My name is Khyati Kawa and I'm going to be your E-host for this E4M EconClave. Today, when COVID-19 has taken over most of our decision-making power, but still, practitioners don't stop to evolve or innovate. During these sessions, experts won't only share how they are managing their operations, but also share their thoughts on the revival and how they have streamlined the functionalities in the past one month. Also, we are available and live on E4M Portal, Facebook, Twitter, at E4M Tweets, Instagram and YouTube along with Zoom. Official hashtag for this EconClave is the E4M webinar. Hashtag E-Numerical 4M webinar. So, please do follow us and stay connected for our latest updates. Now, before we begin, we have a small audio visual on the journey of Exchange for Media Group. Can we have the AV, please? Exchange for Media. A name synonymous with the latest news about the advertising industry in India. Exchange for Media Group, set up in 2000, has the most credible media platforms covering the entire advertising, media and marketing domain with its highly acclaimed print and on-ground assets. The Group's flagship news portal, ExchangeForMedia.com, reaches over 6 lakh subscribers, who are the first to receive breaking news in the industry. The buzzing website not only covers the news, but goes beyond the obvious to bring in a fresh point of view. Impact, the weekly news magazine from the Group, is the most widely rated business magazine in the advertising trade, with in-depth analysis and news-based features, providing perspective to key happenings in the industry. The monthly pitch magazine provides a ringside view of events unfolding in the marketing landscape, along with media advertising. Another monthly magazine, VRT Plus, is a market leader in the real estate industry. Today, Exchange for Media is not only a leading publisher in the domain, but owns the IP of more than 50 events spread across Mumbai, Delhi and Bangalore, making it powerful for information and sharing. Exchange for Media has curated and launched some of the most successful IPs for marketing, digital, TV, print, radio, mobile, OOH and PR. The impact person of the year, Exchange for Media conclave, Indian Digital Marketing Awards, Tech Munch, Pitch CMO Summit, India Marketing Awards, Primetime Awards, Indian Content Marketing Awards, Golden Mikes and Baah are some of the Group's top-notch events, in addition to niche bespoke events and roundtables curated especially for discerning clients. Exchange for Media events attracts tall Watson speakers, along with the loyal audience, comprising of leaders, trendsetters and opinion makers. They are the perfect networking platform for the entire media and advertising industry. No wonder, Exchange for Media group publications and events have high credibility and reach, another destination of choice for agency and media professionals across the industry. Exchange for Media. Thank you. Now quickly moving on to our very first session for the Econ Clave. The pandemic has created uncertainty amongst all of us, whether individuals, organizations or brands. So our first session is going to talk about or rather try to answer, has this pandemic made brands more agile and created a new playbook for marketeers. And in conversation we have with us, Mr. Rahul Agarwal, managing director and chief executive officer of Lenovo India. Rahul has over 24 years of professional experience and has held multiple leadership positions across Lenovo and IBM. Prior to his current role, he headed the commercial segment for Lenovo India, the largest business for Lenovo India. Before that, he headed marketing communications for Lenovo globally and is credited with setting up Lenovo worldwide marketing hub in Bangalore, supporting 60 plus countries. Rahul will be in conversation with Dr. Anurag Bhattra, chairman and editor-in-chief BW Business World and Exchange for Media Group, who is an enthusiastic entrepreneur and an industry expert. Over to you, Dr. Bhattra. Thank you, Chathi, for that kind introduction. Welcome Mr. Rahul Agarwal to this Exchange for Media webinar, Exchange for Media conclave in a virtual format. As we discussed just before the webinar, we all are doing the best we can in the current circumstances. So how are you doing Mr. Rahul Agarwal? Rahul, how are you dealing with this unprecedented pandemic both on a personal level and a professional level? I think we are all dealing with it every day as it comes. But a few things that I've been telling people around me and my office colleagues, number one is to keep your mind calm because this is a time when a lot of uncertain information is being floated, which tends to stir the mind in the wrong way. So I'm telling people and myself to stay away from a lot of these unconfirmed information. Number two is not to overanalyze the impact of what this might have in the future. Logically speaking, when you don't know what this is really all about, what is the intensity, what is the longevity, what is the reason, what is the cure, then I think it's a little too premature to say that the world will change in a way that we won't be able to identify. And a lot of people are kind of panicking, imagining things. And I tell people that human beings have this amazing tendency to come back to their routine once things tend to roll back to normalcy. So in a few ways things will change like work from home, less travel, more of the meetings, people here who travel a lot know how painful it is. If I had to come to Mumbai, it's a six hour painful process from my house to the door that I want to reach. But in many ways I think things may not change. The other internally what we're doing is a lot of communication. You know, every day I'm doing at least one meeting with the external stakeholder and at least one round table with my employees and at almost a daily meeting with the leadership team. A lot of employee engagement is happening today. And of course as any business would do an URAG, we're doing a lot of plan A, plan B, plan C and cutting down expenses. So it's a lot of future planning. So fundamentally it's the way I'm spending my time that has changed a lot. It's not to review the current business but to review our preparedness for different outcomes of the future. Thank you Rahul for laying out how you're dealing with so beautifully and in a very authentic way, real way. I was in a conversation like this for Business World with Devarthi Singh. She is now the senior VP at 3 a.m. in the headquarters at Minnesota and she was earlier India MD and CEO for 3 a.m. a fellow Ben Gloria like you and someone in the audience asked her a question and I want to give you the question. Everybody is referring to this pandemic as a you know a black swan event and he said it's a gray rhino event. So gray rhinos appear from time to time. They appear more often than a black swan. So if this is a gray rhino event and some experts believe that corona may resurface in the winter and it may be there for the next 18-20 months in some form till the vaccine is discovered at the fear of corona can go away. So tell us your ABC plan. I'm not asking for very specific but if this is true and you yourself said ABC, tell us some scenarios. So see I don't want to talk about the disease because the world has a lot of experts. There are 1500 medical papers which are coming out every week by the experts. 1500 every week and that's that's going up and every organization whether it's McKinsey, BCG, Deloitte, ENY they are rolling out their analysis of what's going to happen. So I think in that context under my view is quite unimportant and I would not I would not take my own view seriously right. So I'm trying to take one step at a time.  So for example we're going out of a way to make sure that we don't have to let people go out of the way I'm saying hey cut everything else but let's not touch let's not go there. Three we are trying to do things you know from a CSR point of view donations we are helping some hospitals procure equipment and you know so and so which I think a lot of good companies are doing but as in my role my professional role I think all that I need to do is look at hey if the category that we deal in it has three scenarios because computer is a very interesting category many people think that it'll grow I'm not sure in the short term I'm not sure so the the thing that we're dealing with is if the market goes down by 20 percent is scenario let's say so A is market remains flat you know that's scenario A. B is if market goes down by 20 percent C is if we are pleasantly surprising the market goes up by 5 or 10 percent which is less likely and how do we run our PNL how do we run our our entire business processes how do we manage our people what our expenses to cut what to do about marketing what messages to give to our customers what messages to give to our employees to our stakeholders so I think it's a lot of that which every week things change because people's opinion about the future changes very fast because there is nobody who can prove you wrong today about what you are saying about tomorrow sure so you know you've been one again again very real saying that you're not sure whether the computer market will grow and you know you're factoring all scenarios and you're still optimistic and you're focusing on the human side of things and doing the best you can in these circumstances well while we talk of business we will talk to you a little bit about marketing you are the now you're in a leadership you know gel management mdco road but you're also the brand owner in some way right being a global CMO setting up the up tell us as a brand owner what are the brand activities continue to do and what are the brand activities you put a stop to so see my a lot of people ask me hey what's how is the brand changing and I tell them a very simple answer that brand cannot change because my definition of a brand is if it has to have a character and character means that it has to have some values and the test of values is that when times are tough then still vouched by the same values so as far as I'm concerned I think the value of the novel brand is not changing and what we are saying however two people might undergo a little bit of evolution so for example I know very well that a lot of parents are keen to get the second PC at home now they have two children education they want to make sure that they have two PCs many people who did not have PCs earlier they're saying okay at least let me have one I can't just depend on my office laptop for the weekend so our messaging that is going to go out is hey how can we give you a full bundle you know how which PC is the best for your family and what are the accessories that you need number two in India there's always an affordability issue so the affordability issue is that hey I don't have the money up front especially now when salaries are getting caught people are losing jobs but in India education gets dropped priority so we are coming out with two year EMI that is that people can pay which is a big deal in a so you're observing the changing consumer behavior right and you're responding to it not only in terms of the product offering but in terms of pricing in terms of financing in terms of making sure that you really become a true partner in the consumer's journey true so we also for example in Raal we did something very novel we said till the time that till the time this goes on our service centers who which are fully operational unlike many other companies my problem but my easy manufacturer for two months is off but we are on um we think that we will support any brand free of cost fantastic that that is kind of thing they're doing we've also launched a campaign called smarter ed which is a portal we've made wherein teacher people who want to teach can register students who want to learn can register smarter ed smarter ed so you can just do a google maybe smarter ed smarter ed so it's a platform we have created we've just launched it uh last week with thousands of people like you and me have registered think that in now I have some time and I want to teach something students all over the country are registering they're saying that he might I may have teachers but the teachers are not really good which is a big problem there's a one million shortage of teachers so we are doing these kind of things which I would say that was always in our agenda and therefore I would say it's not new to the brand but I think the situation demands that that part comes out a little more than the commercial part fantastic I think you know that's where innovation comes in that's where a larger purpose come you know we support any brand any big and you know going back to your purpose of enabling people to what they want to do using a technology brand so I after the webinar I'll check smarter ed.com and if we are somewhere towards the end to show the homepage Brianka we must now let me ask you a direct question because we're talking to a group of CMOs who are logged in or brand managers or marketing professionals advertising professionals media professionals will the marketing budgets come down in the immediate near term tell us what will happen to marketing marketing budgets in the short term needed term long term but for most categories they will unfortunately and by what percentage I think that will vary so FMCG I'm told you know I have a lot of friends who were in that part of the FMCG which is selling sanitizers one organization which sells sanitizers you know what is the explosion in the sanitizer business 500x of the normal FMCG actually may go up because people are going to be more cooking at home and you know spending more time at home but most categories I think the drop could be anywhere from 10 percent to 50 percent thank you Raul for being so specific so Raul if the drop is 50 percent let's say let's take the worst case scenario and 50 percent is left how will your marketing mix change how will your media mix change what are the thoughts in your head that you can share that can help the professionals who are watching you so I think some some of the the headlights are quite quite leading it will definitely be a move to more digital more performance-based marketing also I would say more marketing which is not related to immediate business so I think there's a bit of a dichotomy here and I am seeing it in Lenovo for example we're cutting down on normal tv and print right they're doing more a lot more digital just starting to do digital right more performance-based measurable marketing on the other hand we are also open to spending more money on giving the larger message because the brands don't mean much to an average consumer brands mean a lot to the brand managers unless you're talking about iconic brands which have been there for decades and maybe centuries otherwise you know if you go do a survey brands perception will never match with what the brand manager or the cu thinks right so this is also an opportunity to come up with what we truly believe in like smarter head we're spending money right so I think there are two kind of pathways that I see flowing at least for Lenovo but the traditional marketing budget will definitely go down uh digital uh tv and print print definitely I think should be very worried I'm sorry because right now people are not people are not even getting the newspaper right no we are I read all of this I get it I get it too I get it too so I'm not overreacting just like you but I think human behavior is very panic uh kind of uh pro you know what I love about the conversation is you're very real you're being very specific you're not giving efficient answers you're you're telling us as it is and I think that's the mark of a great leader uh you know that you know yes you got to stay human centric you got to be compassionate but you also got to say what you want to say and do what you want to do so I see that you know so I must compliment you because sometimes conversations are very goody goody and they aren't real okay so I must uh compliment you on for being so specific and giving a specific inputs now uh you know let me make it a little philosophical and I sent you those questions of leadership when the uh lockdown started in the last week of March I was losing those I was lost I had feelings of guilt wish I had much more money right so that I could take care of my employees you know um I was worried about the future but I gathered myself in the first one week but I can say in the last 40 days I have given it my best I worked longer harder I have clarity on the future tell us what went through Raul that was my leader very large organization a very big brand so as a leader as an individual how did you prepare yourself to be able to lead in this hookah world so uh I think a lot is to do with the tenure uh you know I'm almost finishing five years in this role I think first of all if I were in my first or second year I would have panicked a lot but how about I experienced was that uh I think there was I just told myself that I got to accept this because there is nothing I can do number two is I realized everyone in the company is looking at me my tone my body language what I say about the situation and you know I I mean I don't I don't believe in being artificial right I got I I like to call a spade a spade but I still felt positive that people might overplay the in fact and therefore I started communicating a lot I started talking a lot and I told people that yeah you know possibility is endless but you got to look at the probability and therefore keep looking at the facts keep looking at what is within your fear of control um and really not not too much as I said I didn't over analyze you just did the right things we didn't get into a panic mode of cutting things but we said sensible cutting down of expenses great scenarios great situation because human mind the the human mind sees the worst of it when it goes through uncertainty now when you make if you can make your business heads look at scenario see which is the worst I think it calms you down subliminally because then you know that okay things can't go worse than this and and you know I'm prepared to an extent that I can be so there's no playbook I don't think I have done it very handsomely I'm listening a lot to people we have we have created more than 100 ideas in a hundred ideas that I'm tracking personally I think that is new people are feeling very energized by ability to contribute to ideas and they are and we are implementing some of I think these are some of the things that you do between employee activities and you know and then I tell everyone guys if you're working in a company like Lenovo firstly you are privileged number two you're not kids therefore you got to find your own way to motivate yourself good so you know we're getting very interesting questions and I'll start I'll start with the question you know whole idea there is Shalini Shankar asking in the current scenario of reduced demand and customer being selected in the purchase it should branch off for reaching consumers through campaigns and be on top of their mind or should brands look in pricing and become more attractive so is pricing going to play a bigger role that's one question from Shalini Shankar and the other question is from Amit Setia I would like to hear your thoughts on future proofing for the brand future proofing of the business from supply chain and consumption perspectives you also had an add-on question in what all aspects the brand will go for normalization both in the short term and long term yeah a lot there so firstly I don't think I'll have answers for everything on the first one I straight forward we are reaching out to for example the student community through schools now which we never did earlier they're going to be doing specific campaigns to reach out to to students and give them messages as to what is the right thing to buy for them to have continuity in education thriving I don't see thriving as a big lever in the current situation and I think a brand which has a character and values will not try to take advantage of the situation if there's an opportunity and we've seen good brands actually make statements on that but if the demand goes down will there be pressure on pricing I think you have to study your industry and see what is the price elasticity I don't think on computers if I reduce the price by five percent people more people are going to buy but if I can if we can give them financing offers then many people may come provided they have the need second one was about the future proofing I I don't really am a big fan of future proofing you can't do future proofing uh to even fly and I'm into the CMO for I'm gonna sit here as the CMO for brand uh so yeah so see um I always talk about the price of perfection right the price of perfection is too high and therefore if you want to be prepared for a black swan even like this the amount of investment you'll have to make maybe too high it may not be worth it so I think if it's a regular event and people think that it can happen again then yes you should be prepared and you know I think every business will have its own uh playbook on what to do one thing is just to be sensible a lot of messages for startups who who had unlimited money coming in and I'm one of the few people who are vocal about it that every business in the medium term needs to be sensible so I think it's a good reminder that your business model needs to be a sustainable right you can't just keep sustaining on infinite money being infused because it's a game of investors trying to outdo each other which is what happens so part of it is hygiene and the other part I think every organization will have to find its own answer I can't generalize I can just give some general principles which I think for this esteemed group may not be of any value okay Raul I want to ask you will brands collaborate more so for example you talk to an educational segment and hence I'm asking this question yeah you could take it for other segments will say let's go partner with an edu tech brand will it partner with an education website will it you know so will brands collaborate more than they ever did so a very good question I would say brands should collaborate whether they will or not is to be seen it's very difficult to collaborate I've tried this personally brands have egos and you know processes and companies so large two large brands very difficult to collaborate one large brand and one small brand easier to partner very easy to partner with startups because the founders can take decisions like this there's a beauty about the way the start of this but absolutely I think this is a time for a lot of brand partnerships to happen thank you Raul there are more questions coming I'll take them say somebody called Swami Deep Ghosh as an outdoor media agency employee I'm really tensed about the future prospects of out of home if big brands are cutting down marketing budgets how will out of media home media survive there is Ravi Kumar with increase in online education what is the plan for urban and rural markets both in branding and pricing so out of home I mean I look I don't I don't have an answer but I think as I said they'll be my my feeling is that people will start coming out Bangalore by the way I'm not set out because I'm usually in calls but many of my friends are going out they think it's it's like normal other than the IT corridor everyone is out so I feel that human beings will end up being human beings and they will do what they've been doing for centuries they will not suddenly hold up in their houses so overage and my opinion will come back now every organization including marketing media will have to brace for a tough next six months without a doubt and I think the test of an organization is can you survive the six months and if you can't I think there was an inherent problem in your as Anurag said business model what is the second question Anurag can you tell me again you know in terms of education urban markets pricing yeah see as I said pricing I don't think we are looking at pricing at all you know anyway run a tight ship on margins so I don't think I we can reduce the prices and we definitely will not increase the prices so I think it's more about messaging and reaching out to customers in a effective and a endearing way if you appear opportunistic then I think you will do long-term damage to your brand so it's a very careful job of for marketing as right now for companies like Lenovo because there is an opportunity for us for sure we don't know how big but we we have to come across as people who are generally trying to our help so Rohail Abin who's a senior editorial colleague what is your advice to brand managers and brands in these times specific advice I'm a little very to be honest I'm a little very about giving general advice I think it's not just to brand managers but to everyone as I said that I think the this whole situation has given us a lot more thinking time therefore first you should calm your mind down and this is a great time to do two things first is really push yourself to come up with some ideas and implement them and second is to think long term and for brand managers I would say that you watch your companies you will know whether your brand has a character or not now everyone will want to claim but the way you are reacting organizations as well as the brand it will come out whether the value system is authentic or not and it's a good test and write down what is my value what is the behavior my brand should be demonstrating and then honestly ask yourself am I demonstrating that behavior will e-commerce become preferred mode of sales for most brands e-commerce will with physical retail become lesser and lesser important and will e-retailing become bigger and bigger no I would I would not take it to that extent but today for example if I look at our consumer laptop market one out of three laptops are sold online by either Flipkart or Amazon so that 33% may go up to 40 I don't think it's going to change in the next two months I think it may be even more 50% but as I keep saying everyone people will want to come back to their whole habit of wanting to see a laptop compare five laptops and six hours doing comparisons so I think the balance right now will take so this whole whole thing will favor these brands but it's not going to kill the offline retail totally another question from Ravi Kumar going forward how do you see brand approach impact properties like sports or kbc's or movies I think the person is from television so yeah see as I said I think you have to break every all these questions into two parts how is it going to impact impact in the next six months and then how is it going to impact long term and there could be W's there could be we could have more lockdowns and because nobody knows the trajectory that this disease will take in the short term I think everything will get affected I'm personally sometimes I feel that once a brand is established you don't need to spend money on just flashing the logo so Lenovo was the first company by the way to sponsor kbc when I was handling marketing 15 years ago and we spent a lot of money because Lenovo was unknown today we will never do it so I think it's all about your context if you're a new brand you will continue to do that you are a established brand I think some of those film placement may actually get deep prioritized because people will say I want to spend money on what will give me immediate measurable business fantastic thank you for being so real and first we give you know in terms of being just the content and being real it's one of the best conversations I've had so thank you Raul and you know because sometimes as I said it's leader is shy to say I wouldn't say that there's honest but there's just one they want to keep the optimistic message going and you know so I like I to ask last two questions and then maybe bring one or two audience questions one is what is Raul Agrawal's personal leadership mantra sorry personal leadership mantra you know what is your leadership style oh so see I keep three pillars for me which one is strategic pillar second is execution pillar third is people pillar and I think a good leader is somebody who has to keep an eye on all three a leader who's excellent in all three is maybe one in a billion million but as a leader if you can be strong on two then you are a good leader but if you're weak on even one pillar then you will not survive you will not survive you can't say that I'm such a brilliant guy and I execute so well but I'm going to ignore the people anyway so first is I think this tripod balance is very important I think second is leaders and I have learned it over the years on rock that we the tendency to add value is too much so the lesser you speak the more value you add actually it has been a very tough learning for me beautiful the lesser you see the more value you add so you let basically Raul is saying if I give you delegate more you let people take chances make mistakes learn become leaders themselves give them an opportunity to fail and learn and hopefully become better leaders yeah that's right and the third thing that I am I've learned lately I'm still doing it is that I think ideas will not drop like an apple you have to push your system and your processes to come up with new ideas and allow people to actually take the risk and fail I think that only a leader can do that that doesn't happen unless you're a google kind of an organization with the DNA itself is innovation so I can go on and on but these are some of the things that I maybe subconsciously or consciously you know is there a book you want to recommend to people on a blog or a movie that could help them get through these times yeah I think a couple of books that the art of thinking clearly is always a good book but it's a doubly yeah yeah and he's also written a book of the art of living happy or something like that so that I think maybe is more important in in these times and Raul if you had to say make one prediction for the future what would that be future means six to twelve months I'm not thinking beyond that you you know you're putting in an uncomfortable zone because it is so easy to predict the future and yet so dangerous so my feeling is that 90 percent of the world will come back to normalcy in the next six to twelve months that's that's a very optimistic note and you know looking at your answers which were very real I hope and pray what you say is real and I'll take the last audience question and will brands look for innovative localized media given these difficult circumstances Rajesh Radhakrishnan from Burrithi media localized innovative media do you mean the content or what he has not specified but I think that's a fair point to assume so content I think I may see that debate is always on right always open global content or local content and a mnc like Lenovo always deals with it so I'm a I'm a fan of a good hybrid model I think your global brand ethos need to be preserved but you will connect more to the audience if you have a local message which is rooted in our local insight that is always desirable COVID or no COVID although I said last question what are the positives for you as an individual of this COVID you know every cloud is a silver lining for example positive for me that I've lost two cages wait I'm not traveling I'm eating at home I'm mostly sleeping well you know so I've done no socializing so no drinking so you know my health is improved my focus is improved what are your personal gains see I firstly I thought I was at all the MBTI tests have always told me in Iraq that I'm an extreme extoward right it almost suggested that I will go mad if I have to sit alone I usually sit alone for most of the day I've been absolutely fine it's a self-discovery then I'm I'm actually happier calmer when I'm alone number two I realized I'm speaking 30% less everyone is happy about it my team is happy I'm doing less calls so I think there is no end to you being more efficient I'm sleeping more I'm sleeping now at least seven hours seven to seven and a half I'm working out more at least 15 more minutes I've got added I'm just we're all eating healthy so I think personally yeah I've also lost two kilos I never came but I've lost because life is healthy so I think these are some of the benefits I would say thank you again for thank you for being real loud I really enjoyed our conversation and hopefully in the next 30 60 days we can or even earlier we can get on to another conversation when some of the things you said have actually become a reality we wish you luck we wish Lenovo luck we wish our industry luck and we look forward to engaging with you on another issue in happier better times over to Chati. Thank you Anurag I just want to tell you that I think your questions were very real so that helped me answer them really they were not hypothetical questions so thank you for keeping me honest there and it was a pleasure coming here and I wish exchange for media all the best I think the way you guys are dealing with this situation is quite admirable and I think I wish you all the success for this heat on clay. Thank you Rahul you've been a big support to us and part of our big initiatives over the last seven eight years ten years and we hope to continue to engage with you on this thank you thank you thank you so much Rahul thank you so thank you Mr. Agarwal and Dr. Batra for such an insightful session and we thank of course Mr. Agarwal for giving us his valuable time