Hey, this is Christian Buckley, doing another MVP Buzz Chat interview and I'm talking today with Daniel. Hello. Hey, Christian, how are you? I'm doing well. Why don't you introduce yourself and where you are and rub it in about your great weather compared to what we're experiencing here? Well, yes. Well, hello, everybody. First of all, thanks for having me on. I've been consuming your content and looking at what you do for quite some time. So it's I'll say an honour to be talking to you in this capacity. As you said, yes, my name is Daniel. I am coming to you currently from Melbourne, Australia in our summer. Well, we haven't really had much of a summer, but look, it's probably better than where you are at the moment. Currently, what is it? The time of recording 9.30am. It's around sort of 20-25 degrees. So we can't complain. Yeah, that's nice. Yeah, so where do you work? What do you do? Currently, I am working at Valo Solutions as a partner manager and product evangelist there. So I recently joined the Valo team for the APAC region after being involved in a number of Microsoft partners delivering solutions through Office 365, Microsoft 365 in that capacity. But now, yeah, heading up the Valo APAC team. That's very exciting. Well, and congrats again on your brand new Office Apps and Services MVP. Yeah, thanks. Thanks very much. As we were chatting just before we started recording, well, not really something that I set out to achieve. But as you know, it tends to come around if you're, I guess, making an impact and sharing a lot of information and helping people out in the community that does get recognised. And it's it's nice to be nice to be recognised. And yeah, hopefully that's that will continue. I mean, it's it's not something that you you stop doing. I've got a that you've achieved. That's the penultimate order. Just like just stop. Yeah. Yeah, that's right. If anything, it makes you want to want to do more. I mean, it's the feedback you get the comments and the things that you know, the little things that that help people along the way that we tend to and I'm sure you find it in what you do as well. We kind of tend to take things for granted a little bit how easy things for us could potentially be. But for a lot of people, it's, you know, they don't know a lot of things. And there's a lot of things to learn and know and use in in Office or Microsoft 365 that that needs to be put out there to help people. Well, it's one of my favourite things to go and do.  But yeah, I'm staying connected in and in hearing and trying to find answers for customer questions. Because to your point, I mean, we get kind of blind and deaf to certain kinds of issues, because we say, well, hey, we've worked through that. Or that's like a problem that we solved a couple years ago. And yet people that are brand new in the technology are just coming through that learning cycle. And they have those questions again. So what's old for us is new to someone else.  And they find new and interesting way to break things. Yeah, they do indeed. And it's funny.  But, you know, a lot of times, even largest organizations are not even at that point. And they're still, you know, in terms of their adoption of platforms.  But, you know, while there is all the bells and whistles and everything that that is improving, whether it be employee experience or the way we communicate or meet. It's interesting to see where, in reality, where where a lot of individuals and businesses are at as well. Well, one of the things you're probably aware of, and I've been talking with people about it, so back years ago, you had the SharePoint maturity model that was developed by then a consultant, she went on Sadie Van Buren went and joined Microsoft and has since left. But you have an effort, a community effort that driven by Mark Anderson and a few others that that were developing the content around the Microsoft 365 maturity model. But the idea is that, look, everybody is using finding, you know, value and different workloads, different, you know, combinations of the technology, of course, because different businesses, different verticals have different needs. But it's it's great to go in, it's a healthy exercise to go and understand, well, you know, across these various industries, here's kind of where we are, here's a baseline for for our adoption here. And then and to see, well, if we were, you know, in a like a CMM level, like fives levels there, we're at number two in in our information management. What does it mean to move to three and to four? And likewise in our collaboration in our, so if you think of it like workloads like our SharePoint usage, our Teams usage, our OneDrive usage, and there's no right or wrong answers. But what's great to see about that kind of model is just based on, you know, the averages of other users out there, what else could we be doing? And it might be that, hey, level three, we never need to move to four or five, level three is right where we need to be, it's meeting our needs. But I go into that, it's just part of, you know, operational improvement of going through and, you know, continually looking and reviewing and what can we do to get our people collaborating more and in better ways and better leveraging the content we have? Yeah, absolutely, absolutely. And it'll be interesting, yeah, look, interesting to see where, you know, this whole employee experience model or applications or modules or whatever you want to call it, how that's, how that gets taken up as well. Obviously, it's, you know, employee experiences is a big thing in the adoption side of it. But, you know, it'll be interesting to see. Yeah, I'd be interested in your perspective. I don't know if there's an official like company line on that, but given that you have a lot of the, you know, the internet and the box providers, but yet like Valo that have gone and have been focused all about the employee experience. I mean, that's really where that whole category of solutions started was that the out of the box SharePoint experience was not sufficient. Your organizations were not adopting that. And so make it, you know, good looking on the front end and functional for what organizations, collaborative organizations need and are using, and you added on, you did all these things. So something for Microsoft to go and approach with their, you know, experience, employee experience platform approach. I mean, so what kind of what's, what's the official position? Yeah, well, I mean, it's still, still fairly, fairly vague in a lot of the detailed information that what Microsoft is big in a new release. And well, look, it looks, it looks very nice. And all the marketing is, is, is very good.  I mean, obviously, connections is going to be one that is going to be fairly close to that type of thing. So it'll be interesting to see how, you know, what gaps are there and how, you know, companies like Valo can can extend on that type of functionality or, you know, I guess, we saw a fairly similar situation when SharePoint Modern came out as well. I mean, the brand was bang new modern. I mean, there's still, there's still a space for, for extending and improving and adding functionality and that type of thing as well. So I think it's going to open up a lot of opportunities as well by, by being able to, to either extend or combine or, or integrate with. Yeah. It's, well, and not meaning to put you on the spot at you about that, because it's, it's true for every ISV in every category. My, as you know, I mean, Microsoft will go and, and make a big buzz and talk about the broader space where they're, what they're talking about might be limited capability, a subset of that, of what the partner is doing. And then, of course, it causes a lot of, you know, customers or prospects out there to be like, well, wait a second, isn't this the exact same thing of what your, you ISV are doing and, and they're just certain realities is that there's one you have to cut through the marketing. And this is true with every OEM is not just a Microsoft thing. And, and really truly understand what your business requirements are, where you were focused there. The second thing is anything new takes time to be fully realized in the first place. It's not like you're adding a feature to an existing product when you're, you know, launching an entirely new product or product area. And so there's work that needs to be done. And that shouldn't stop your movement forward if you're about to buy a solution.  But, yeah, it's an interesting space. I personally, I just think it's exciting that the maturity of the platform of Microsoft 365 itself is getting to the point where we're no longer talking about turning servers on, you know, back in the on-prem days and just keeping the lights on, on the service where we can now really focus in and we've got a lot, most of the core functionality fairly robust where we can now talk about what are we actually doing with the technology that we've been deploying? How are people using it? How can we use it better? How can we be looking at the data around how we're collaborating and improve the way that we're working together? I mean, that, that's just an entirely new thing. That's very exciting. It is. And I think that's, that's becoming almost the, the first thing that, that organizations start to talk about or want to talk about is, is that, that, well, first of all, that end result, but the data to, to show whether it's the adoption or, or, you know, simple example of how many less all company emails people are sending, and we're now chatting in a, in a, you know, communicating in a different way. And, you know, we're saving X amount of time trying to find stuff for, you know, topics is a, it was an interesting one for me around, you know, most, a lot of organizations have a lot of information and, and seeing how, you know, that type of functionality can potentially save people so much time in finding, finding information, but also skills and that, that side of it as well. I guess fairly, it could be, could be hard to measure, but it's, it's, you know, it's, it's an interesting area for sure. Did you have any clients that were part of the beta? Were you involved? No, no, no, I haven't, no. Neither have I, I've talked to a couple of folks that were in, when the program, yeah, in my, around the topic specifically, like it's exciting to see, you know, there's been different variations that they've just been attempted, you know, again and again over the past 20 years, that I've really been kind of looking at the space. And so I'm interested to see what the, the curation experience is like and what's actually involved to make it work. But yeah, I'm, it's a pretty exciting space. What Microsoft is doing around content services in general, it's very exciting. It is definitely.  So yeah, it'll be, be interesting to see how, how that model works. Yep. Well, what else, what else is kind of, you know, your focus these days, what are you, what are you presenting on? I know that you're, you're active like a lot of MVPs and online events that are happening. Any in-person events that are being scheduled that you're down in your neck of the woods? Not, they are being planned. So in Australia, we're obviously with the current COVID situation, we're starting to open up quite a lot now. We're, we're able to host limited in-person events. So hopefully in the next, in the coming months, there'll be, there'll be some of those, you know, been lucky enough to be able to actually go and see some of our partners in person over the last, last couple of weeks, which has been good. Although we can do all of this virtually, it's still important to see people face to face. But in terms of areas that we're, that I'm focusing on or looking at as well, you know, presenting a lot or talking a lot and whether it's videos or whatever the content is. I'm really big on, on Microsoft lists at the moment. I think they add a lot of value. And I guess making people aware of, of what they can do, what they use for, and that, that side of it. I'm a fan of the adoption guide that was just created. Yeah, that's, that's fantastic. Great resource. Yeah, it is. So those type of, those type of practical areas of 365 that I think that add a lot of value to, to those end users is something that's, that's, that's a big focus of mine. That was very cool. Well, hopefully, yeah, it was, was supposed to be down your way once last year that, that happened. But I'm hoping to, to, to get down there for once the event start back up. So it's, it's been, I was pretty regular for the last 10 years, almost at least one trip a year down that way. Those conferences, there's some of my favorites working with the East Debian team. Yeah, right. Yes. Yeah. Some of the user group activities as well. And yeah, but yeah. Yeah, I think, I think, well, Debbie's still planning on, well, potentially, hopefully, the in-person event this year. So we'll see how that plays out. Yeah, whether, whether you're allowed, whether, whether internationals, I don't know. I'm thinking that part, you know, you guys are too good at the, the contact tracing. You guys have that part down. So it might be a little bit longer before you allow internationals in, but again, we're also just, we're now planning for end of August, our first in-person, what was our SharePoint Saturday event of doing something like a hybrid version of that. So we're hoping that we, you know, things start to get back to normal later this year. So, well, Daniel, really appreciate your time. For people that want to find out more about you, get in contact. What are the best ways they can reach you? Probably LinkedIn is the main place where I'm posting a lot of content in the moment. So just jump on there, search for Daniel Anderson. You'll find me there. And also the blog as well. So SharePointFocus.com and they're two, two main, main places. Excellent. Well, hey, thanks a lot for, for connecting. And we'll, we'll let you get back to your Tuesday and I've got my next meeting rolling up as well, but we'll talk to you soon. Very good. Thanks for having me on the


A clock on a Saturday night so we can get this thing kick started so that we can be done by eight o'clock as scheduled. This is the panel on cyber adversary characterization and just to introduce the panelists. I'm Matt DeVoe with the Terrorism Research Center, Toby Miller, Independent Security Consultant, Tom Parker, Penn Test Limited in the UK and Mark Sacks from the Department of Homeland Security. We're going to speak to you on cyber adversary characterization, why it's important and discuss some models that Toby and Tom have been developing to help them in the characterization process. Just to give you a little background, we all met up for a two-day workshop on this topic in 2002, continued to do some research via email discussions back and forth and then Tom put together the panels to come here to Black Hat and DEF CON to introduce the concept and obtain some feedback. A lot of the models, a lot of the issues that we're looking at are in early development. We think there's a lot of utility for them but we need to get feedback from the community as well. We plan on doing future workshop in October 2003 and just FYI the slides will be on the conference websites for both Black Hat and DEF CON because I know they're not here. FYI characterize, there's a theoretical side to it to gain an understanding and ability to anticipate an adversary in order to build improved threat models and that's a piece I'm going to talk to is the threat model component and then improved profiling of attackers at post-attack and forensic level to guide response and to give you an idea of exactly who you're dealing with. I was asked to come in and speak about threat assessment, put some of the modeling in context and then talk about some of the issues that we look at in looking at cyber terrorism or profiling of cyber terrorism. I'm going to spend 10 minutes on that. Biggest point I want to make with regards to why I think this topic is important is because your adversary is not a one or a zero. A lot of time when doing analysis of attacks or looking at risk management concepts, you're told about the packet that's the attack and very little attention is giving to the intent, motivations, capabilities of the person behind the attack. So it's an effort to try and move it beyond just the technical to start thinking about who you're dealing with to guide your response and also if you have a perspective with regards to what threats you're facing, what your adversary's capabilities are, it can also guide your security posture to a certain extent. I'm involved in the concept of risk management which includes vulnerability assessment, threat assessment, doing some of this modeling and you can't do risk management, you can't incorporate a risk analysis without doing the threat assessment or adversary characterization. We're out especially with private industry. A lot of times they have these risk management models with a threat component but for cyber security issues there's no threat piece injected into it. So a lot of times funding isn't provided or the models aren't accurate for what they're trying to achieve within the organization. The whole point is without the threat analysis you're not performing real risk management and if you're not doing risk management you can't have concept of acceptable risk which means you're either trying to protect against everything or you're not protecting against much and thanks to Jay Healy for that your adversary is not a one or a zero quote. What things do we look at when trying to do risk exposure, what threats adversaries exist, that's this piece here that you're going to hear about, what tools, capabilities can you use, also some of the research that they're doing, how attractive is the target, this is where we have to look at the goal and tent likelihood of a system being targeted, what level of access can be obtained, this is classic vulnerability assessment process, this is something that the industry is really good at actually is going out and doing the assessment piece and looking at vulnerabilities and fixing vulnerabilities but just don't put them into context very often. What impact would the attack have and then also there needs to be a safeguard component here, need to be doing it for a reason in order to guide the security process. Threat agents of interest, it's list the ones that we use just for your information, you'll see when Mark gives his presentation they have a similar list that they use within DHS. This is kind of how we break it down and then needed to categorize techniques as well. We obviously can't look at all of the different ways that systems can be impacted so we had to come up with a high level categorization and this is the list that we use right now that includes everything from penetration to insider placement, malicious code, a whole slew of things and obviously depending on the system you're looking at not all of them are looked at. Cyber terrorism analysis, the piece that I focus a lot of my attention on, the camps on cyber terrorism are divided into two distinct communities right now. You really have those that think that in camp A that bin Laden lurks in every monitor and is prepared to take down the power on the east coast tomorrow and then in camp B that terrorists out there have no technical capability and pose no threat whatsoever and that's kind of the environment that I see whether I'm working with government or industry that typically they're over paranoid about the threat or not concerned at all and the truth kind of lies somewhere in the middle, that's some of the stuff that I wanted to speak to. Characterizing cyber terrorists, it's tough because we don't have any historical analysis at least with some of the stuff that Tom and Toby are doing, they're looking at actual attackers, they're looking at history from past attacks but with cyber terrorists in my opinion we've never had a true incident of cyber terrorism so you can't use that past analysis to try and drive your profile, need to be a little bit more creative, need to imagine the threat. At a conference that we were at about a year ago there is an interview with Alvin Toffler and he described September 11th as a failure of imagination that stuck with me on the cyber terrorism side because it is one of those threats that you need to imagine a little bit in order to give it some reality. You can red team the threat which is something that gets done, characterize capabilities and intent, it's a little tougher but if you're red teaming it you can assume different levels of capabilities, you can put stuff in models like what Tom has done, assess and fix vulnerabilities and then understanding what's happening right now. One of the big issues and I think that Mark will speak to it, when an attack takes place you either have to assume the worst or assume the best and we'd like to put a little bit more granularity on that during the incident response process. Key issues for cyber terrorism and these are things that we discussed at the workshop or that I briefed that I thought were important to looking at the cyber terrorism threat. The first being that there's kind of a nature of terrorism has changed from international versus single issue groups, those that engaged in kind of calculated violence versus those that are interested in mass casualty, mass consequence. And the whole point we're trying to make in looking at that first bullet was to show that some groups are going to be displaced and might use cyber terrorism as a differentiator. So we kind of needed to open the scope and look at it as being attractive by groups that necessarily wouldn't be attracted to it because they want to differentiate themselves from the alkyd of the world. The model, the thing that we actually looked at for one assessment was hijacking. It's 700 plus hijackings prior to September 11th either used to flee a geographic region, attract media attention to a particular cause or to use the plane and the passengers as a bargaining chip in some sort of political negotiation. Of those groups that were engaging in hijacking for those purposes, how many now would engage in hijacking because it would be perceived as an intent to use the plane as a weapon of mass destruction. So we thought that was important. The other thing we wanted that we thought was important was the fact that terrorists go through a lesson-learn process and to look and see what lessons can we draw from cyberspace and critical infrastructure failures or from attacks that we've seen within other threat environments that terrorists might look at and learn from whether they're successful or even if it's a failed attack. Long-term planning cycle we thought was important. When folks speak of cyber terrorism, they like to think of it as a threat that's there tomorrow and when you have an adversary group that will take five years in the planning, you know, development of the capability and execution of an attack, we need to think in a little bit more of an expanded time window. Targets once identified will be continually attacked until destroyed. Thought that was important, especially when you start trying to do adversary characterization in event of a real incident. And then convergence, issues of convergence. Will terrorists converge with hackers a la hacktivism? Can capability be acquired or recruited from outside? We've looked at issues of convergence between terrorists organized crime, terrorist nation-states, so I think it was important to look at issues of convergence elsewhere. The definition that I use is a sustained attack. In other words, it's not something that just happens quickly and goes away, a sustained attack against a critical infrastructure.  It's kind of a fuzzy, somewhat definition, but I try and isolate it or move it away from just a hack attack or just somebody's simple denial of service attack to move it into a scope of conventional terrorism where you have a sustained event that has something with much greater impact than just an isolated attack or a terrorist organization in South America writing a virus and releasing it on the net. We wanted to try and move it outside that realm. Likely aspects of cyber-terrorism, this comes from a paper that we wrote and posted on our website several months ago. We thought this was important as well because it kind of guides when you're doing the system assessment. Whether the system you're looking at falls into one of these categories and where it falls into the category will kind of guide the attractiveness of the target. We thought and still think that the most likely aspect of cyber-terrorism is going to be in parallel with a physical or WMD attack where they're going to try and augment the impact of something that's been done in the physical domain. Maybe it's go after telecommunications, after doing a bombing, going after hospital systems. There are a whole slew of scenarios but we still think that that's probably the most likely aspect in which it'll be used is not as a replacement for physical attack but actually to augment a physical attack. Go ahead. Everybody run on here and it's kind of what we're trying to see in there right now with a rack. And then we're losing one or two soldiers each day on a global scale. That's not paying to lose soldiers. That's what happens in the whole thing of war. But the thing is that it's costing a lot of money. Part of why we're going to have the Iraq War begin with. If I was looking for, what's the mass destruction and all that? Why? I'm going to make you guys pay for it tonight. It's actually kind of covered in bullet number two. And let's re-raise that issue during the Q&A and we'll probably hold all questions. We've got 20 minutes set aside and I don't want to impact on the presentations for the other guys, but we'll address that during the Q&A. And it is addressed a little bit in number two, which is to decrease confidence in critical infrastructures or engage in psychological operations where you go after infrastructures that had nothing to do with a physical attack or associated with a physical attack, but you're going after things that will decrease confidence and cause the public to fear. Living in Washington, DC, we saw the impact, the psychological impact of two guys with a Bushmaster rifle. There is economic impacts, people change their behavior, they zigzag to their cars. There were lots of outlying effects based upon little isolated attacks. And from a cyber-terrorism perspective, if you launched a campaign against critical infrastructures and caused that loss of public confidence, started having the economic impacts, we think that that's also attractive as well. To cause physical damage or loss of human life, this is the most attractive to a terrorist organization because it lets them blend two different types of attacks.  You don't have to put the person on the target to engage in it. That's also, from our perspective, the least probable, just based on experience in assessing infrastructures and the fact that there's still a lot of physical safeguards, humans in the loop, things of that sort. Not impossible, but a higher risk to try and make that happen, where the other two become more attractive. And then the point I wanted to throw in as well is we tend to put the blinders on when looking at issues right now and to not forget the nation state as a sponsor or using as a tool of strategic influence. I think Mark will address that a little bit as well, but we just want to make sure we don't fall into the blame bin Laden game or any attack, whether it's a hacker or a nation state, starts getting characterized as an act of cyber terrorism. With that, I'm going to turn it over to Toby, who's going to talk about his hacker rating model. Do you want the wireless? Hi, my name is Toby Miller. I'm here to speak on the model that I've been working on for the past year, off and on for the past year. It's about the rating your attacker. If you want to get in touch with me or you have any comments about the presentation, my email address is up there. So go ahead and email me your comments. Basically, my model or what I came up with is like a checklist. And it has points associated with different events and different categories as to what the attacker physically did. Why did I do it? One of the reasons that I did it was that because I hadn't seen any tool out there that an analyst, IDS analyst, firewall administrator, security administrator, whatever could use to help rate the skill level, the potential skill level of his or her attacker. I also did it so it would help management, assist management, in determining incident response requirements. And also to help management with threat level management as well. In my system, I have six categories actually. They are passive fingerprinting, the intelligence gathering, the attack, the exploit, back doors and cover up and others. Passive fingerprinting, this covers, when you get a packet in, coming in, or if you have it, I personally think that the operating system could tell a lot about the attacker. Yes, the operating system can be fooled. It can be spoofed just like an IP, but it's still there. You still can use it as part of your analysis. Intelligence gathering, this covers everything from social engineering to sending a single packet to a service to see if you get a response. The attack, it is like the attack was cross site scripting. If it was SQL injection, whatever, I rate that as well. The exploit, it goes along with tools, which Tom will get into a little bit more in depth than I will. And back doors, in my experience, past five, six, seven years, is usually three phases of an attack. You have the intelligence gathering standpoint. Somebody probes your box or whatever. Sometimes they don't.  Once they get your box, there's usually some kind of root kit, whether it's a single file, whether it's a torn based root kit, something like that, or even a LKM or a Windows based root kit. And that will cover that as well. And then you have my last one, which is others. And that basically, that covers everything that the first five doesn't. What I'm doing right now, originally, I posted this thing to Incidence about this time last year, incidence.org. I posted it to the Incidence mailing list along with some other mailing list. I got some comments back. I made some changes right now on my website. I'm up to revision number two. I'm working currently on revision number three. I've made some changes for revision three. Like for instance, for revision number three, a lot of the comments that I've gotten back in the past couple of months, as far as this goes, is destination, the destination server. As far as the destination, the destination server can be critical in evaluating your enemy as far as to what he's going after. For instance, in my new model, I'm gonna have a workstation. It's gonna go down to a class. If you're a government person, you deal with classified information, that's gonna, you're gonna treat that a little bit more seriously than you would. Somebody's just attacking somebody's personal workstation. It's gonna also include a bank-related server. All these different things are gonna be scored and have different point values. Currently, the point values are between one and five. I'm about to change that and make them one to 10. And one of the other comments I had, and I'm gonna incorporate it, is a source IP. Can it be spoofed or is it real? Basically, is it real or is it Memorex? That's been some of the other comments that I've had as far as this model goes. Unfortunately, I didn't have enough time to actually bring the model up and go into depth in it. But if you want to visit the model, make comments or whatever, it's at raidingthehacker.net. And revision three should be up in about a week, week and a half or whatever. So that being said, here's Tom to go into tool care transition. Okay, so Toby touched briefly on the idea of the point scoring system that we've come up with. I'm gonna go into some parts of that system in some more depth. Firstly, one concept which we've come up with is the hacker pie. One of the reasons we think that what we're doing has so much potential is because the IDS guys for some years now have been taking log data and what have you and trying to analyze it to get some kind of idea of the kind of people we're dealing with out there. Although we think that is obviously of great value to us, it's not the be all and end all of the characterization. We have different sides to this. We have the psychological side. We have obviously the technical side. The more we do the research, the more sides we're finding to it. And obviously the research isn't completed yet. So the other advantage of not relying upon one piece of the pie is that obviously when an incident occurs, you're not always gonna have lots of information available to you. Sometimes you'll have technical information available to you. Sometimes you'll have a clue who's involved in the attack. And the idea is that we can build up this characterization with separate parts of the pie without having to have them all to create the final characterization. Okay. The first type, the two models I'm gonna go over today are technique and tool classification. Technique classification looks at the reconnaissance techniques and attack it may use before an attack, the types of exploits they're using. For example, port scanning techniques. Is it stealthy? Or are they just going through your network, scanning everything, not really caring about who's watching them. The exploitation technique, are they using mass routers? Or are they very carefully deciding what operating system you're using and ensuring that the exploit will work the first time around? Tool classification, obviously the tools used are gonna gel with the techniques being used. For example, if you're randomly scanning through the network the chances are you could be using Nmap. We're characterizing the kinds of people that use Nmap and the other scanning tools. Another example would be exploits obviously which fall under tools. Our recent one will be the DECOM mass routing exploit which is being traded in the underground. The original exploit by HDM exploited six different targets. Windows, well vanilla Windows 2000 through to XP service pack one. The mass router which was written went through A-class networks trying each target on the individual IP addresses. If the guy that wrote this had any clue what he was doing he would have realized, I hope he isn't in the room today, he would have realized that this exploit is a one shot. The first time you get it wrong the service dies and that's that. And obviously that says two things. Firstly about the person that wrote it which is the first characterization we can make. And the second the kind of people that are likely to use this exploit are gonna be your low end adversary that don't really understand what's going on. Okay, in the tool classification model the first point we have here is availability of the application. Obviously certain tools are less available to certain individuals. You have obviously zero day exploits which are traded normally between quite close knit groups of people. We look at the origin of the applications that people are using and the ease of use with obviously doing an M-map scan is fairly trivial, it's a few command line switches but in the case of exploits does an attacker need to find a return address? Does the attacker need to know something about that system beforehand? Are there other mitigating factors? If they're trying to perform a man in the middle attack do they already need to have access to a DNS server to poison the network or are poisoned or what have you? This kind of ties in with what we call the vulnerability disclosure food chain. This, we originally developed a metric which was pretty much a pyramid. The top of the pyramid representing where someone discovers a vulnerability and the bottom representing the public dissemination of that vulnerability. The idea is that the bigger the pyramid gets the more people know about the bug. We developed that into more of a web diagram because the pyramid wasn't very detailed which basically describes the attempts to describe the path of the flow of vulnerability through to exploit writing. Maybe it gets traded on IRC, maybe the guy finding it just is responsible about it and tells the vendor. And the characterization part comes in because we try and place the adversary on that food chain. And what we think is depending on how high up they are is a determination of what kind of adversary they are. This also applies to group characterizations because as well as having individual characterizations you can also characterize groups of people. If someone attacks your network with a zero day bind exploit and we know that that bind exploit exists and it's being written by a hacking group that is known of we can perhaps determine the kind of arsenal that the other members of that group have access to just as in real warfare knowing the weapons an enemy has it's also good to know the weapons a cyber adversary possesses. Knowing the group which is a certain individual is a member of also helps to determine the age group. The social demeanor of the individual you know the kind of social group that they're going to be in. A lot of attacks like social engineering we find require fairly mature intelligence. And the kind of people that are likely to go out I'm using social engineering in a commercial environment or government environment are one standard deviation age group higher than your average script kitty. Okay I'm just gonna leave you with this. We move on to Marcus. This is a cut down version of the disclosure food chain which I put together in fact for one of the workshops we did on this topic. At the top there you have the vulnerability discovery information shared with the exploit community with the community directly around him. You know maybe it gets leaked, gets traded on FNAT. There you go. So that's the model that we use for that metric. Okay Marcus. Good evening I'm Mark Sox, Homeland Security. Thanks for coming out and I appreciate you taking your time when you could be off of a drinking beer although I'm sure some of you are. And having a little bit of pizza so if I get thirsty if somebody wants to throw something up here I'll take it. Looking around the audience I see a lot of feds so we won't do a spot the fed maybe a spot the hacker. Maybe we could do that while we're here. But glad to see a lot of friendly faces members of the media and others that are in here. We'll keep this brief because I know everybody does want to move along. What I want to talk about is how we do threat characterization. It's a little bit different from what you were just seeing and that may fill up the slide a little bit there but the cyber threat to United States is unique in the sense of we have what we call critical infrastructure. Most of you probably heard me talk about that before. You've seen the writings that we've had in homeland over the last several years but our information networks that we have coast to coast we recognize that vulnerability. This is well documented. We've looked at it over the years and we're doing quite a bit to protect it. But what we're seeing is that both secure and insecure networks now are starting to converge together. We've got some networks that are doing the right thing.  We have to interconnect those networks in order to make e-commerce work so that raises a level of threat to those protecting networks because they have to interconnect with those who aren't quite as well protected. Plus the complexity of the networks continue to grow. The complexity of the tools, the way we architect them make sure we get new technologies. We've gone from copper to fiber to wireless. We've got new protocols coming down to point. We're gonna move from V4 to V6, IP based. And a key bullet here at the bottom is that cascading failures. We're not really sure if the entire infrastructure of the United States could have a cascading failure or whether it will be resilient like the original ARPANET which was designed to if it took a hit in one location the network just routes around it. Now on September 11th when we had physical damage in downtown Lower Manhattan we did in fact see the data networks route very nicely around the physical damage. But we had catastrophic collapse of the steam networks, the water, the gas, and oil, all the other infrastructures that are in Lower Manhattan because they aren't designed to route around physical damage. Could something like that play over on a national effort if we had a failure of the East Coast Rail network could that catastrophe play over and have cascading effects across the United States? We don't know. We hope we never get to that point to find out. But it is something to think about when you start looking at the different types of threats that come at us. Now as was mentioned earlier the way we like to look at cyber threats and we'll step away from the physical world and just talk cyber. The range is quite vast. I mean I have it at the top but you could think of it at the bottom end. In terms of numbers, the top bullet, hacker, script kiddies, hobbyists, millions. Pretty much anybody who has access to the internet has a little bit of curiosity, wants to kind of play around a little bit. Even a home user that's sitting behind a DSL or a cable connection that's not adequately patched or has not taken any type of precautions with a machine falls into that category. They are a threat to our critical infrastructure because they're not taking the right steps to secure their computer. Somebody would like to come in if you wanna let them join the party. If they have beer they're welcome. If not they have to go around. Discretional employees, insiders, hacktivists, we kinda make our way down the list there. We're at the bottom state sponsored. We're talking nations attacking each other in cyberspace. Very few of those. But if we take these types of threats and we arrange them on a picture we can see that the probability of occurrence of like the hacker, script kiddie world is way off on the high side. There's a lot of that out there. There's a lot of the numbers are large but the potential damage they can do in a relative scale is much lower than the damage that could be caused by terrorist groups or well-funded nation states. However the numbers of well-funded nation states are extremely small compared to the numbers of say criminals or script kiddies. I think everybody can see the relationship there. But a defense science board study done a few years ago showed that that curve that you draw actually is moving outwards in time so that a hacker today might have a certain level of skill but four years from now they have the same level of skill as today's terrorist groups. Of course today's terrorist groups four years from now will have much more increased skill as well. So that whole line continues to advance outward. And we have seen this effect over the years as the level of clue continues to grow on the offensive side as well as on the defensive side. One thing though that about all these threats is the way they manifest themselves is the same. It doesn't matter if you're an individual hacker or script kiddie.  The way you're gonna break into my computer is the same way. You're gonna come through some type of internet connection. You might use social engineering. Some vulnerability, some whole, some place is how you're going to gain access. Why is that happening? Well I've got a few bullet items up here. The internet as we all know was never built to be secure. It was designed to connect people together. It was designed to take academia, governments, researchers, the military, glue them together in a network where everybody could talk. Security wasn't an issue. Security today is an issue so we're going back and we're re-engineering the networks. We had a lot of obscure software. For example the software that runs the telecommunications world, the five ESS switches and the SS7 switching networks. Largely proprietary but now we're starting to move over to voice over IP and we're using commercial protocols that many people have access to. So where we had security through obscurity by very few people who understood how the software worked that's getting changed and replaced by commercial software and securities are being moved in. Software companies themselves have always focused on making something that's sellable. We want it to be slick. We want it to sell. Security is not an issue. And of course we've always had problems with leadership not understanding the problem, system administrators being under financed and such. So that has left us in a very vulnerable state so these threat actors regardless of what they are can come at a vulnerable system and it doesn't matter if it's a hacker or a script kitty or all the way up to the nation state they can still manifest themselves the same way. So this is why we're really concerned about the bottom end where there are so many. And I say the word hacker and we all understand the connotation hacker, cracker, et cetera. I'm just gonna use the term that everybody likes to use. I label myself as a hacker also. I've been doing this stuff for years but not illegally. I've stayed on the right side of the law but the threat of course is the nation state. I mean we would expect to see China or Russia or some large nation want to come at us nation state against nation state. Clearly the largest threat are infrastructures. But what happens if some kid out there playing around on his parents' computer high speed connection all of a sudden it's like a million monkeys typing on a million keyboards. One of them eventually types some Shakespeare. Well what's the number of hackers that are out there? Are we up to a million yet? You know is it a million monkeys typing on a million keyboards? It's the same phenomenon. One of them will get lucky. And that one individual will probably score a hit much larger than some nation state can score. So we're very concerned about that phenomena, that one individual that will get it right. So we take it serious. It doesn't matter where the attack's coming from, it doesn't matter who's breaking into government systems, critical infrastructures, we assume the worst. Assume it's a nation state and then we start backing off from there until we can get clear attribution. This is a very hard lesson because when you have people who are trying to just kind of probe at us and let's see if we can screw with the monkey a little bit. What they don't realize is that on our side of the coin we don't know where it's coming from. We have to take it serious in terms of protecting the critical infrastructures and we may misfire not recognizing that it's just somebody out there pranking about. Couple of things I just want to leave you with. We've got strategies and Homeland Security. You can pull them off the White House website. It's the best place to get it. Be sure it's WhiteHouse.gov not WhiteHouse.com. None of y'all have been there before so you're just laughing with me, right? Not laughing at me. Go ahead and please if you do, download the cybersecurity strategy as well as the physical strategy. If you look in the cyber one, you'll see there's a cup. There are paragraphs in there where we talk about the threats. We characterize what these threats look like but we also make a case that say even though we want to understand the threats, we want to understand the risk equation, system administrators and leaders can really do something about vulnerabilities. If you can cut down on the vulnerabilities, cut down on the exposures, patch systems, turn off processes that aren't in use, have a better password policy, train your users, those types of vulnerabilities, it really then doesn't matter where the threat comes from. It doesn't matter how it manifests itself because you've protected yourself, you've gotten rid of the low hanging fruit and now the threat can go next door and go after somebody else. So that's a key point that we try and drive home. In the strategy we have five priorities. I've just shown number two here because we also address that what we're doing at Homeland Security out of these five priorities, number two and they're all equally important is to address the concept of threat reduction and vulnerability reduction. And we're gonna be putting some serious dollars into this into R&D as well as public awareness and training and getting the government more secure, which of course will then mean the buying and purchasing of products which brings product prices down. So we're doing quite a bit of work here to move this forward and we absolutely appreciate all the input we're getting from the private sector, from industry and from private citizens. So please keep it coming. Tell us how we can do this stuff better. With that, I think we open up to questions and we've got at least 20 minutes or so unless you're thirsty. I mean, and let me sit down and then we'll just take the questions as they come. Or do you want to? All right. Any questions? Got one right here. He's asking in my second slide, I say some should be blocked and some shouldn't. And I don't know, I'll go to my slide and you can point it out to me. One, two. Is that the slide you're speaking to? Yeah, I'm not speaking specifically to terrorists or cyber terrorists and speaking within the context of risk management and taking kind of a private industry perspective. It's not fair to ask a particular private industry to protect against the nation state threat perhaps. There might be risks there or exposure that are only in the context of the capabilities of a nation state and in their risk assessment model, it's not gonna be likely that they're gonna protect against it whereas a government system where they see themselves as a greater threat or a greater risk to facing that adversary, they might hold them to that higher level. It's all about the concept of acceptable risk and doing risk management. You'll never have full protection but if you do the threat characterization then at least you can start to say in the industry that we're in, we think we need to protect against the following threats that have the following types of capabilities and we might leave ourself open to a high-end adversary that has a higher end capability but because we have limited resources, we're gonna acknowledge the fact that we can't protect against everything. Yeah. What about the striking asymmetry of the physical security where the future security, we have limited resources in both of the worlds. Now, physical security, it's not that 100% of the people are going with weapons on the street and try to protect against all possible threats. We have police and we have a big incentive not to do any crimes on the street since it's the punishing of the severe. Now, I didn't see for any of the discussions particularly I remember from the moment security government that security should be international and this can be done in one country but I think that you lose a significant job by trying to achieve perfect security. We don't have enough resources to do that. No, no chance. Mark, did you... So what's your question? My question, I don't see significant efforts. I see that the moment security is still trying to focus on the physical protection of our individual systems. Instead, I think we should try to build a process in an allowance for policing and for enforcement. Yeah, we didn't talk, I mean, there's a lot more I didn't talk about. You got a table mic. You guys can hear me, right? I think they're recording those. Are we recording? Yeah. All right, just one, two. There's a lot more we didn't talk about obviously. Where'd you go? There you are.  I'm sorry. Crime prevention, for example, is one aspect of security. Vulnerability reduction is another aspect of security. Threat characterization is another aspect of it. Those in the law enforcement world, when we ask them what is security, a lot of times crime prevention is the angle they go after. What can we do? Just like in the physical world, to prevent crimes, we put locks on doors, you know, we close windows, you park your car in a well-lit area. All that's oriented on crime prevention, but if somebody breaks into your car, like you say, there are mechanisms for prosecution, for surveillance, for arresting and such. We are making a lot of strides in doing that in the cyber world as well, but naturally it's well behind the physical world. In terms of spending, that becomes a risk assessment for the various companies or individuals or whoever's having to make that assessment. Do you put your dollars into physical or do you put your dollars into cyber? That's a decision you have to make based on your risk assessments. Where is the most likely attack against your resources going to come from? And where will the largest dollar damage or whatever the currency is of your country if somebody attacks? What would one shot do to you? If somebody took one shot at a server and took it out, you can rebuild it. What if they took a second one or a third one or a fourth one? At what point does your company break? Or if somebody physically went in and raided your warehouse and did a physical theft, how many of those instances can you survive before your company fails? That's a risk assessment that companies have to take on to their own. We can't tell you how to do that. So there's one clear thing missing from your model and it's insurance. We don't have insurance in the original world like we did here and there isn't enough insurance about the crime score. Now we're going to get way off subject because we came here to talk about threat characterization and you're right, insurance is mitigating some risk by transferring the cost to somebody else. But let's talk insurance offline if you want to do that, okay? Thanks for the question. Yeah, go ahead. Let me just repeat the question because I know we promised we'd do that. You want to know where the rating the hacker falls into during the incident management process? Tell me. For instance, by the way, just as a general reference, this whole rating the hacker thing, I plan on putting into a script that way people won't have to actually have a long checklist and it takes an hour to do it. But to get to your point, it would help if you run through the whole thing and it comes up with your adversaries, say a script kitty, you might not want to dedicate your whole incident response team to doing the forensics, doing this, doing that, bringing the box down, whatever's part of your incident response. Whereas if you come up and the whole attack it comes up and says it's a professional, then you can dedicate your resources. It's a tool that management can use to gauge not only to threat level, but what kind of resources they're gonna need in order to respond to any kind of an incident. You could use this even on false positives and intrusion detection, you know? So. Let's go right over here. Yeah. The question is, how do you differentiate based on attribution when someone might do parallel paths of attack, one which is really noisy, one which is stealthy that are linked to the same person, or you might have two attacks that you link to the same person that actually aren't? Correct? Go ahead. To be honest with you, there's no way you can tell. If a guy hacks a box in Canada and then goes out and hacks a box and hungry and attacks you at the same time, there's no way you can tell it's the same person. Unless you start looking at statistics, which right now we don't have, but we're gonna start getting that statistics. But then again, profiling a rating is never 100% accurate anyway. So the data that I'm working on is coming off my own honeypots and my own experiences within my organization. But we do have plans and I am talking to other people about getting more data to create sampling, to give more statistics rather than just a model. You got anything? As I said earlier, the technical analysis is not the be-all and end-all of the overall characterization, it's only a part of it. But obviously in the case of, so you're saying if you had two attacks on a single machine from two separate locations, right? Okay, well, I mean obviously there's a question of timeframe, if you have a very quiet network and you have, or if you have a busy network in a machine which maybe people don't know about in the public domain and you suddenly get an attack from two separate locations within the same hour and you haven't had any attacks on that system within the last six months, and obviously that might give you an inkling that someone is, or a group of people are trying to target that system. Then obviously you look at the method of attack they're using, the reconnaissance methods they're using. Do you think that in the second attack they're using information they gathered during the first attack? Are they using information in the second attack that they can possibly have known without carrying it the first attack? So I think there are ways which you can establish whether it's. I had a question over here and then I see you over on that side. Yeah, go ahead. The question is on capabilities of terrorists and disposability and will you get the same impact from a cyber terrorism attack as you would from a physical attack? With regards to capabilities, I agree. Typically when I talk on cyber terrorism it's a two hour presentation and one of the slides that I put up is kind of the state of where we see things at right now and it says those with the intent lack the capability. So yeah, they might intend to try and take the power down on the East Coast but they don't have the capability right now. The caveat there though is that we know that this is something that's on their radar screen. We know that they're trying to acquire the capability so we need to be planning for that out over the long term. The other aspect is we don't know how far in their planning window or capability acquisition process that they are. So just because it's not something that they currently could do or are assessed as being capable of doesn't mean that it's not a threat that we're gonna face and we categorize that it's more in the emerging threat category. Also have to remember the issues of convergence where you might have a threat entity or an individual or group that is capable of launching the attack that either for monetary reasons or ideological or political reasons would converge with the terrorist organization and engage in attack that would fall under a more of a cyber-terrorism profile. With regards to impact, I agree the physically blowing stuff up is much more sensational, has a much higher impact and we've debated on this issue since like 1995 over whether can you even call cyber-terrorism terrorism because you're talking about different aspects. In the definition that I provided, we think we need to look at it from a terrorism perspective where it's a sustained attack, it's causing either political coercion, public panic, what we call disruption of social integrity where it starts to impact the operation of the nation, maybe your foreign policy. So we wanted to, even though it's not as sensational, we wanted to address it within that terrorism context. Right here in the gray shirt. Can you speak up a little bit please?  There's no way you're going to see them. And my point is that whenever your profile comes up, your drug analysis, all this, are going to come up as, okay, we have to start getting down to the worry about it, because you basically have to lose control of yourself, whereas the real attack, you probably won't see some errors in the real value of the drugs that's going to be described here. There's a question with regards to value and utility. I won't repeat the whole thing, but I'll let Tom, Toby, address it. As I said earlier, I'll say it again, the side you're looking at is firstly completely technical. It wouldn't take into account any kind of psychological profiling of, you may consider yourself a high-end adversary and not a script pity, and maybe that is a technique that high-end adversaries would use to maybe flood the IDS, so an administrator spends days looking through his IDS logs, and by the time he finds those ICMP packets that you're talking about, the system is already being compromised. But there are two sides to this. There are the theoretical threat modeling side and an incident response stage. And in the theoretical side, we've discussed this as a group, and there's every chance that someone may do exactly what you're speaking of, and the threat model would take that into account. On a practical side, well, it really wouldn't matter, because the incident is going to happen whether you like it or not. All you can do is look at why that attack was successful against your network and how we can adapt the threat model to... Okay. So what you're saying is you don't think that we can learn from characterizations made after an incident. Okay, well, obviously, you're going to... Once an incident has happened, you're going to change your threat model based on your characterizations. There's going to be the side of, well, in this attack, how much reconnaissance was done? Did the guy use social engineering attacks prior to making the compromise? These things, as I said earlier about the whole social engineering age deviation thing, that tells us some stuff about the attacker. It's all little pieces of the pie that we, in this case, might use to pass onto the FBI to help characterize, to help find who we're looking for that committed the... Furthermore, say if you're running a server on a bank network, let's say, it may help you characterize the kind of people who are likely, who are going to try and get into that machine, the facility that they have available to them in order to do that, the exploits that they have access to, the people that they talk to, the people that they know, how high are they on that vulnerability disclosure food chain? Do you see where we're coming from? Let me just add a couple of points to that. No model is ever going to be perfect, and that's agreed, and there's probably a lot of folks in here that would be sophisticated adversary, and they're going to be able to circumvent or exploit the model in order to launch their attack. I have to remember, though, there's probably 99% of the folks that are out there aren't going to, and you're going to be able to characterize a lot of those and use that to guide resources. From a planning perspective, or at least from my perspective, when I look at being able to characterize and do scorecards, even if it's historical analysis, I can now start applying that to the future. We talked about this at Black Hat as well. One thing that we're lacking is, when the FBI goes out, it does a psychological profile of serial killers. They go out and interview 100 serial killers, and they start to develop the profile. In our industry, we don't do any of that profiling. We have a planning component and look at adversary levels, and I have to do this on a daily basis. Mark has to do it on a daily basis. We've got those threat agent types up there, but we don't have any real historical background to talk about what the capabilities are. Lessons learned, and as you start to have a historical use of the model, you can start applying it to planning in the future. And the real-time driving of resources for those that might not be sophisticated enough to circumvent that particular model you're using. Add one over here, and then I'll get over there. Yep. Let me just step out on a limb a little bit here. It's a hard question to answer, unless you're looking at it forensically in terms of gaining attribution as to who exactly did what we're looking at. Part of this is not just the pattern of behavior in terms of, did they break in first by scanning then by gaining a foothold, etc., but capturing the actual artifacts, building a library of artifacts, being able to compare those against older signatures, for example. Much like profiling in the physical criminal world, if you've got a serial killer, they will leave behind forensic evidence that's collected and compared, and you can compare it against other person X, person Y, person Z. And you can start to build the profile where you can see characteristics of individuals or groups based on the evidence they leave behind. Now that will eventually, if done correctly, lead you to attribution towards the actual person you're looking for, but it does help characterize when you see a new event come up. If you can compare backwards, you can find those signatures or fingerprints so that you can continue the pattern. It helps to understand from a forensic standpoint. The gentleman's earlier question about how does that help me in the future to prevent intrusions. It really doesn't provide you with much there. The way to prevent that is patch yourself and close the vulnerabilities. What we're looking at is how do you then characterize somebody who's already broken in to gain attribution to bring that case to closure. And yes, you can spoof it. Yes, you can introduce noise. That's all part of the signature.  That'll be a characteristic of that individual or of that group. Take two more questions and then we'll have to call it quits, I think, on the room unless I get the nod otherwise, but we'll certainly all be here. Go ahead right here in the back. The question to put it briefly is what role do you see the model playing in doing trend analysis over time to guide response, internal security posture, alerting, things of that sort, Toby? Of course, the data being shared where the community goes, yes. The data will be shared with the community. We plan on doing the trend analysis. We also plan on trying to get more people in here who can, in our little group who can provide more information that we can use in our trend analysis and that can help us, you know, do the profiling that can help us make this a more value-added model than what we currently have. I don't know if I answered the question. We've got one more back here, then we've got to release the room but we'll all be up at the front for questions and answers. You can ask the question if you've got a beer in your hand, Mark will answer. Yeah. The question is does Homeland Security have any plans to incorporate any sort of funding for training folks that operate critical infrastructure? Yes, is the short answer. One of the major things that the department will be doing in terms of outreach training and awareness is exactly that, raising the level of understanding. From a pure cyber perspective, of course, this is a shared responsibility. It's not something that just the government can do. Each of us have to work with it. From a larger, more physical perspective in terms of the critical infrastructures, part of our role in this is determining the interdependencies of those infrastructures. How does the rail network depend on the power grid? Some of it's kind of obvious, but there are other interdependencies that we're trying to uncover through doing simulation modeling, et cetera. But in terms of the education awareness, absolutely. There's a large part of the department that's being focused on that. We're somewhat immature at the moment. We're only about six months old. If you come back here next summer, I can give you a lot better answers to it. I think you'll like what you'll see. Thanks a lot, ladies and gentlemen. I really appreciate your time.


Internal Revenue Service IRS tax news. Employee urged to electronically file payroll tax returns by October 31st.  The last time I resisted one of those, it wasn't pretty. Okay, I'll do it IRS, I'll do it. Honestly, if I don't, in an attempt to find a punishment that fits the crime in their distorted mind, if I don't file electronically, they'll probably electrocute me. You know what I mean? Like the rationale of the IRS going something like this. We'll use this electricity to power the payroll filing or we can use it to power your electrocuted pubic hairs to stay at odd end. That is until they burst into a ball of flames. It's your choice.  Because you know the government's always looking for new, exciting ways to burn it. Just kidding, but here's another joke. President Biden handling the economy is like dealing with a crooked mortgage broker before the Great Recession. You're never going to regret this, Ray. Say, don't worry. The American people will never regret this. My parents left me that house. I was born there. You're not going to lose the house. I mean, honestly, 30 to 40 trillion in debt is like totally normal these days. Everybody has three mortgages nowadays. Read my lips. The interest on the debt is not a problem. But at 19%, you didn't even bargain with the guy. Ray, for your information, the interest rate alone for the first five years comes to $95,000. Will you guys relax? IR 2022-184, October 19, 2022, Washington. The Internal Revenue Service today reminded employers to file the next quarterly payroll tax return by the approaching October 31, 2022 deadline. That's once again October 31, 2022 due date. And urge them to do so electronically while paper filing is available. The IRS strongly encourages e-filing. E-filing is the most secure, accurate method to file returns and saves taxpayers time. So they're trying to kind of market you and sell you on the e-filing. Obviously, I'm not completely sure it's the most secure type of filing method as opposed to, you know, paper filing or something like that. However, it seems that's the direction everything is going, even with banking and other things that require a high level of security and so on and so forth. So it is what it is. So e-filing is easy with auto-populating forms and schedules with a step-by-step process that performs calculations for the employer. So if you file electronically, some of the fields will populate a little bit faster possibly and possibly make it a little bit easier to do some of the calculations. That is helpful because it does have like a double check kind of format similar to using software. If you're to do that, less likely to make a simple math errors within the calculations. The IRS acknowledges receipt of e-file returns within 24 hours giving taxpayers reassurance that their return was not misplaced or lost in the mail. So that can be nice because again, it's nice to be able to see that the return has been processed. So I'm not going to get hit with late penalty and interest types of payments as well. E-file users also receive missing information alerts. So clearly if there's a problem and the IRS has an issue, it's nice if they at least notify you. So you can jump on and fix whatever needs to be fixed so you can move forward with your business. So two options to electronically file payroll tax returns. Employers can choose to self-file by purchasing IRS-approved software. There's a link to that here that meets their specific needs. There may be a fee to electronically filed returns through the software and the software will require a signature to e-file the returns. Clearly the fee is going to be part of the downside of the process. Depending on the software they choose, taxpayers will have one or both of the following options. Apply for an online signature, PIN. So now the problem here is how do I get the authorization signature to the IRS? This is another area where a lot of businesses have this kind of electronic e-signature format. Even the IRS is using their website for some things like power of attorneys, I believe, to be able to do some e-signatures. But there's still kind of an issue with the whole signature processing and how secure they believe the e-signature kind of thing is and so on. So applying for an online signature PIN or you've got the scan and attached form 8453 EMP Employment Tax Declaration for an IRS e-file return. There's a link to that here for the required signature. The second option for employers is to hire a tax professional to prepare and file their employment tax returns. So when you have payroll taxes, you really do want to think out beforehand what the best strategy is to process your payroll returns because it is one of those areas where you're most likely to kind of have problems. In other words, you're most likely to get like sued by the employees for sadly enough. That's just the case of it. So you want to make sure that you have everything documented the way it should be documented. And you would like to do it correct the first time because if you get to the end of the year, for example, and then realize while doing the W2s, W3s, 1099s, W2s, W3s, the 940s and 941s, that there's a problem going back and fixing it is kind of a tedious task within payroll. So payroll is one of those things where I think the adage of measure twice cut once is a better adage than I'm going to tinker with it until I fix it, which is a perfectly good method for many things, but possibly not payroll. So then the question is you could do the payroll yourself or you might hire someone else, like a third-party payroll provider to help you to be processing the payroll and meet some of those HR requirements and so on, like reporting all the pay stubs and that kind of stuff and hopefully helping with the forms that need to be reported, like the 940s to 941s, the W2s, the W3s, and possibly state forms. Okay, so taxpayers can use the authorized IRS e-file provider locator service to find a tax professional who can file on behalf of the business. For more information on electronic filing of payroll tax returns, see the e-file employment tax form page. There's a link to that here. Tax relief in disaster situations. Employers can find information on the most recent tax relief provisions for taxpayers affected by disaster situations on IRS.gov. There's a link to that here. See FAQs for disaster victims. There's a link to that here for information about the definition of an affected taxpayer. IRS news from around the nation. There's a link to that here. Provides IRS news specific to local areas, primarily disaster relief or tax provisions that affect certain states. So there's links to all that stuff here that we said there was a link to and there'll be a link to this in the description.


So several of the poems in Cleave are in conversation with social psychologist Harry Harlow, who was famous for his studies on attachment and relationships between caregivers and infants. He did this work primarily with resource monkeys, most famously taking them away from their mothers and presenting them with two surrogate options, one made of cloth and one made of wire. So I'm going to start by reading a few poems that appear scattered throughout the first section of the book that use this idea of Harlow surrogate mothers in order to imagine different forms of mothers from the perspective of the adoptee. It starts with an epigraph, which is a quote from Harlow's research paper called The Nature of Love. The surrogate was made from a block of wood covered with sponge rubber and sheathed in tanned cotton and terry cloth. A light bulb behind her radiated heat. The result was a mother, soft, warm and tender. A mother with infinite patience.  A mother that never scolded her infant and never struck or bit her baby in anger. Mother of ghost. Whether of wire or terry cloth, there will always be mother. Mine was made of ghost. Every move is one step away from her. I try to backtrack, lose myself in maps. I tell myself, tread nimbly. Every step is a newborn shadow. Bodies fracturing light. Mother without a face. She looks in the mirror. I wonder what creases we share. I wonder how long her hair is. I wonder if she chews on the inside of her mouth until the skin is chafed pulp.  I wonder if she clings to heat like a monkey to cloth. My nose capsizes. An upside down question mark. I pull and pull. I stretch short. Foster mother. The first time I belonged to a woman. My body a fresh bulb broken off at the root. She kept me for six months. Watch spit bubble from my pursed lips. I wonder if she ever claimed me. If she rocked me to sleep on her chest.  There you are. The first time I belonged to a woman. My body a fresh bulb broken off at the root. Dreams of motherhood. Wire barbed with fragments of love or tender cloth that never scolds, never strikes, never bites. The mothers I find like copper coins, heads face up. The ones I collect because of their tenderness. The nature of a light radiating heat. The mother. I'm waiting for someone to claim her. What is the opposite of mother? And throughout the book, I have a series of poems that I call my dictionary poems. That are, that wherein I borrow language from the Oxford English dictionary entries on, on different words. So this poem. Browsing which from the entry on migrant. And I think as an adoptee. As an adoptee of an immigrant for most of my childhood, I think growing up in a predominantly white space. In a white family, you know, I, I tried as best as I could to erase that. That painful challenging aspect of my, of my origin. And it's only within the last few years that I really started to embrace the fact that I, my own immigrant story, even if it is different than other peoples that I originated in another country and traveled here. It's called migrant and it's written in solidarity around the, the diverse experiences of immigrants around the world. Migrant. Of an animal, especially a bird. A wandering species, whom no sees nor places limit. A seed who survives despite the depths of hard winter. A bird who has been living, staring her band from icy seas to warmer strands. To find the usual watering places, despite the gauze of death that shrouds our eyes is a breath taking feet. Do you ever wonder why we felt like happy birds, brushing our feathers on the tips of leaves. How we lifted our toes from one sand bank and landed. Finger tips first on another. And then we saw the sun and tiny creatures of flower and blade and sod between our budding fists. From an origin of buried seeds emerge these many banded dagger wings. We of the sky, the dirt and the sea, we the seven leap booters and the little by littlers, we trans migrated souls will prevail. We will carry ourselves into the realms of light.


Hi, my name is Guy Ducos, I'm part of Philips. We have co-developed together with Technicolor a dynamic HDR solution that is now standardized as part of one of the features, new features for HDMI 2.1. So right here is a demonstration of dynamic HDR. Does that mean every scene has a different setting in the HDR? Exactly. The idea of dynamic HDR is that together with the single video stream, you're also transmitting dynamic metadata that are explaining how to optimize each individual image to any display in the market. You know that for HDR displays in the market, you will have 1,000 nit displays or 700 nit like the OLED behind me, or 300 nit for mainstream TV displays at a lower price. And you need to support these TVs in optimizing each image for their specific capabilities. And that's the goal of this dynamic metadata that are part of the dynamic HDR. So does that mean it can recognize what kind of scene it is and then set the peak luminance differently in each scene? It's not really the peak luminance that is set differently. What is set differently is how you distribute the optimization of the bits across the brightness and the colors depending on the image. So that you really make sure you see for each image, you will see all the details and all the colors as much as you can on the specific display that you have at home. So what are the bits you're talking about that's being spread around? It's like you say it's about the colors. It's about the color, it's about the brightness. Again, the content, for example, will be shot at 4,000 nit, right? And the display will be at 700 nit. In that case, the question is how to map the 4,000 nit content down to the 700 nit display capability. And you want to do this mapping differently for each image, whether the image is only a bright image or a dark image or a mixture of both so that you keep as much details as possible visible on the display. And that's why for each image you have different dynamic metadata that helps the TV to optimize the picture to a specific capability. So when you take a camera and you film an HDR video, you're actually shooting for a peak luminance? Usually, you grade the video on a reference monitor, like a Sony BVM reference monitor or Dolby Pixar reference monitor. And this is giving you the peak luminance to which your content has been graded, indeed. And so you just do a basic calculation, 4,000 divided by 700? It's much more complicated than that. It's a kind of machine learning, artificial intelligence process that is optimizing for each image, understanding what should be kept as the details, where the details that have to be kept and how to optimize the tone mapping of the image to the specific display capability. So starting from the peak luminance of the content, so 4,000 nit, for example, and moving down to 100 nit if you want to go down to SDR or any value in between. For example, here we have an OLED display, so this display is optimizing the picture for its peak luminance, that is 700. And so basically the standard that you're doing is running on this box or is running on the TV or is running on both? So the feature we have developed can run either on the set-top box or on the TV. The interest of HGMI 2.1 is that now the set-top box, instead of doing part of the image calculation and then the TV is doing another one, the set-top box can transmit the dynamic metadata over the HDMI cable so that the TV is doing the complete image optimization. That's the idea. So it's a big deal to do the dynamic HDR. Just when you have the HDR is kind of great, but the dynamic is even better, it's important. For sure, because what's happening is, again, if you consider that moving forward, the movie studios and all the content providers want to shoot as bright content as possible so that it's future-proof, while today the displays are still rather limited in terms of big brightness. So if you want to avoid having completely saturated images or clipped images on the existing displays, you need to support these displays by these dynamic HDR capabilities and tell them how to optimize each image to their display capability. Because there are so many TVs that do HDR and every one of them has different peak luminance, and every one is different. So you're kind of like a backwards-forward, comparatively displaying the content. Exactly. So that's indeed the case. Here, with a single stream, first the dynamic metadata, you can adapt each individual image to any display on the market. And the interest also of Technicor or SLHDR1 technology that is here mentioned and demoed here is that the video stream that is transmitted is the SDR video stream. It's a high-quality SDR backwards-compatible video stream for legacy TVs. So is this the one you're talking about? SLHDR1 standardized. But you said it's a single stream. So how is it different from HLG? So HLG or HDR10 are two static HDR solutions, meaning that they use the same EOTF and a single curve for all the images. And the TVs from there have to try to optimize all the images. And they do a kind of average optimization because they are not analyzing each image individually. Here, the difference with dynamic HDR is that the images have been analyzed individually. Their optimization has been calculated upfront in the head end. This information is sent together with the video stream to the TVs so that they can use this information to re-optimize each image to their display capability. So how much content out there is dynamic HDR so far? Well, you have different versions of dynamic HDR that are also standardized in HDMI 2.1. Technicolor is one of them, but you also have Dolby Vision. You also have HDR10 Plus from Samsung. So dynamic HDR is coming globally as a need to re-optimize the pictures for each TV on the market. And that is now widely available on the market. So just to display HDR content better, you don't need to film the movies again differently, right? Depending on the standard. For Technicolor, indeed, the idea is that we calculate these dynamic metadata just before the distribution encoder. So the production can be done in HLG, can be done in HDR10, can be done in SLOCK 3. This is fully independent. Just calculate and transmit the dynamic metadata just before the head end or at the head end and before the distribution.


Everyone it's your girl Kenzie here from Leighton Sports Cards and I'm ripping 2022 panini legacy football hobby six-box break number 13 random teams Here is a look at the random results. You can always find these the leighton sports cards calm underneath the results tab And the link is also in chat for you All right best of luck here. We go everybody No, you're good. I figured I mean you've been saying you're you're working a lot And you enjoy it, so that's awesome to hear though Glad everything is working out for you Bride chrome under the lights Tom Brady We've got mini orange of Robert Quinn for the Bears Out of 125 for the agents Nick foals Askings you've got yellow 150 Joe mixin Pierce Pierce and Pierce Carl Thornton strong Jamal Lewis Hill Wilson We've got silver rookie Otto Jalen Tolbert for the Cowboys That's one there Cowboys on the Tolbert Frank Gore Rocker Walker third. We've got a green to 100 Devo Samuel Robinson David Bell silver rookie of Jordan Davis Kenny Pickett rookie God Jets silver rookie Otto Jermaine Johnson the second Joe Montana. I know right out of that was saying that to Brennan when I saw that on the schedule Yeah, I bet you would huh Love was rock Bailey Zappie. Oh, yeah, Carol aftus mini on the silver a mile Sanders evils 500-foot home run today or something like that the longest in history Hudson Wow Bluetooth 50 Keenan Allen chargers We saw under the lights Robinson Jr.  No Drake London rookie note McBride chrome rookie Carson strong evils Here Jackson How far was yours talk Strong Haskins for the ages blew out of 100 Cooper Cup or green sorry So, you know, Brennan Token's hit one forty two thousand and sixty nine feet Likely Desmond Ritter. We got silver under the light stack Prescott Period I'm leaps over. Yeah all day Garner Williams took would never lie. No, you've got shrimp McBride silver rookie Otto carnal's First Titan taken of the droughts. I'm on Walker Meet you the third we've got silver under the lights Stingley Jr. The third overall Sam howl rookie Green to 100 Tom Brady nice one there bucks Thibodeaux rookie Lloyd. We've got red to 250 of Nick John John L. Way broncos Brian says from YouTube he has to see a video of it Berks Brian's James cook chrome rookie William Johnson the third We've got silver under the lights auto George Carol Aftis from for these Brendan Tokes says you'll get you the video, but it's on its way to the Guinness Book of World Orange the 199 Jamar chase on the color match Haven't Neil Spiller we got bronze rookie Bailey zappy Got Malik Willis a Tyler baddie Orange many of nice and typhoon Thornton patriots out of 125 Generations for the cowboys Coach Brendan says he's patiently waiting He also, oh, that's right, too. Tocque also threw a football over the Rocky Mountains That video is on its way back from Guinness book as soon as he gets out It's a 50 Russell Wilson Just bear with them please Highly requested video Yeah Malik Willis under the lights chrome rookie Drake London rookie tree McBride generations orange to 125 another cool color match their bangles Generations for the bill Brendan, who's your Super Bowl prediction this upcoming year? So you got Pickin booth a David Bell chrome rookie Browns How about you toke here Jackson driver Here saskins we've got bronze many of James cook for the bills to 75 And we've been talking about tonight been asking different people Bailey zappy Here a lap this we got out of 149 Trayvon Walker on the orange rookie There you go Jags first overall pick there Stephen Kay Very nice orange again. That is 26 out of 149 will mag that one for ya Someone said Broncos earlier. I think you guys will have a decent year. It's just a tough division That's a McDuffie. We've got a mini speaking of the bears. Well, Justin fields many I take bucks over Green Bay Rees Hall brisker Devonte Smith out of 299 Eagles Watson We've got Malik Willis under the lights red that is out of 50 nice when they're Titans Jable got Matt Corral Dan Marino You've got orange to 199 Christian McAfrey Friday We've got the 249 freeze haul on the dual rookie patch there Reese Hall dual patch auto There you go jets overall first running back taken at the drafts Just just just you're absolutely right Costco is there a game tomorrow, too? They're a Friday Clinton Portis Wilson silver under the lights trailing Berks, then it's gone Rocker walk of the third and what's two games tomorrow? What time brandy now Well, the toks is there's two tomorrow Box for Giants Pats Ravens Titans Jackson Pickens that press got silver under the lights cowboys There's 149 Orange Ricci Otto tree McBride Cardinals again Mad Judan Strong Stingley Patriots 299 demon Harris Garrett Wilson rookie Thornton under the lights that's in Chrome Walker the third freeze haul and Mike did come David Bell Rockers He's can't see it as well. It's on so we go on Jones Jr. We've got orange 199 Derek Stingley junior nice one there for the Texans third overall Or you'll be able to grab two spots Ford Williams Chrome Cooper cup rams Costco. Yes, we do We got a big old championship trophy And then we have a sign that you have to wear in your car if you lose cook Robinson Jr. That is not very nice So good Ritter Kyle Hamilton look little minis are slippery slick see they like Cornell Patterson on the orange to 125 Falcons Stefan digs Mm-hmm Williams likely Orange 299 Travis Kelsey Big Ben Me to the third Garner rookie Chrome Hassan Haskins Jalen Tolbert Trayvon Walker rookie Generations Tram McBride Sam Hal rookie. We've got to 35 a under the lights blue silver auto Traylon Burks Like that but we wonder the lights look born moon most of Kalamon Last pack box four Drake London rookie. We've got to 25 legends Phil Sims for the ages Randall Cunningham Box five winner gets a flawless page. We joked with Rich that winner gets a 2017 prism Uh, or was it prism football box or something like that? He's like, uh, I didn't agree to that Shakira we're all like, what do you mean out of two ninety-nine nods de Harris 2017 optic or something like that they were joking Here's strong junior under the lights Justin Herbert Strong Stingley. We've got out of 50 red rookie auto Bailey Zappie Patriots Here at Wilson Thornton. We've got many Uh, Coral and Sutton for the Broncos Let's watch in Orange to 125 Frank Gore Vikings that change Gray Pierce rookie chrome of Bootha jr. Viking J-Bow Matt Corral rookie Reggie Wayne Skymore Aiden Hutchinson rookie We've got many bronze DK Metcalf for the Seahawks, not number I'm telling you I did not pull it there Chris Olave rookie Out of 100 Cameron Jordan Saints, I put you a hundred dollars Your memory way over my any day Walker the third Daxon Hill We've got yellow to 150 CD lamb, Frank or all of them you said earlier that morning Oh, maybe that's what it was Bell, rocker Double shift everything kind of Jones jr. Robinson, we've got Aaron Rodgers orange under the lights for the Packers that's a 149 They are a generation's inserts. Um, can't scare me from Hill So it shows an old school quarterback or wide receiver with the uh current one. Can you pick it rookie? Montana that that is done The video is up on youtube. All right. This is pretty thick. Let's see what we got here. What do you think we'll do? Tremac Bride we've got Sam Howell Oh a Drake London out of 199 futures rpa nice one there Falcons Drake London That was a sick 10 bucks Tuesday Claymore's talent Which I mean all of them were The football. Yeah, so was the basketball too Gold luka auto 10. Yeah true But being the last one was fire. Yeah, Drake London rookie. We've got silver rookie, uh, rocker Yeah, we had the max jones auto out of crown royale from chronicles Gold tray lance rookie out of chronicles. That was a crazy chronicle box Drake, uh, Jackson Pickens and Tony Gonzalez All right last box here What Frank Gore Oh, I don't hear that but again her our uh TV is broken. I haven't been able to watch anything on sports center. Yeah, it was fire over there Yeah, it was gold 10 of 10 out of origins basketball one box of organs. It's crazy Luca, who you got one of the Super Bowl? Yeah, Reese Hall brisker Rams silver rookie Otto Kyren Williams Tony Gonzalez The Watson read the 299 scary Terry commanders Nick Pauls. Dicks has some retail. I'll be there tomorrow. Oh nice I'll be there tomorrow Orange and nobles another good one. Yeah, rocker walker the third Reggie Wayne target drop the same really Target what dropped them this morning Yeah, but if it's optic all those bots are taken that there's no way you're gonna get anything Huh? Oh, yeah We had so much target Yeah, orange rookie mini of brian robinson jr to 125 washington For the ages west welker Kenny picket rookie, I mean, I haven't been to one in a while so Yeah, that's what I use my red card Cameron Jordan. Yeah, I mean to 5% off. Yeah Jackson hill here at wilson and orange jordan davis for the Eagles out of 149 Yeah, I got a ton of sealed retail. I'm getting ready to put up You're rid of it all Bailey zappy carolactus. We've got chrome rookie of trayvon walker Really davis price kneel trailing burks chrome rookie must be nice Nothing here Malik willis Batty see this is a generation scar.  We don't we don't sell too too much here at the shop Got some like 2020 select football hangers and then we got chris alave Like sell a pack so for them sky more we've got many ryan tannin hill titans No, kyle. I was saying i do personally last pack then we'll do a quick recap Spillard davis rookie. We've got orange paint manning the 199 and frank gore Here we go Recap time We have tray mcbride a drake london rpa Bailey zappy trailing burks tray mcbride brice hall Carol aftis tray mcbride germane johnson tulberth and the orange trayvon walker to 149 Jags that'll do it for the first six boxer got another one coming right up