Abertaf, yn fwy ffwrdd, mae'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio'n gwybod. Mae'n gweithio gyd, mae'n golygu ac yn gyfarwch yn iawn, ac mae'n cael ei fod yn gweithio gyda'i mwyaf. Mae'n gweithio chi'n gweithio'n gweithio'n gweithio. A'r gwahanol a'r gwahanol, mae'n gwahanol yna, mae'n gweithio'r gwahanol, ond mae'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio. I can't remember him, I might be wrong, I can't remember having too many big saves to make other than stuff that you'd expect him to do well. The defensive unit is strong again, clean sheet of course but also the hard mmmfaffs infront of them. Weeks pressing, the wide players we've asked a lot of them the mid field too I thought were terrific today, Jimmy Garner and Ghana I thought them too, were terrific today. Doedd y gallwn cyfnodnol i'r gweithio i'r gweithio o'r lluniau yn eistedd yma? Yn yn anodd, mae'n gweithio'r roi arfer. Felly byddai'n gweithio'n gweithio mas o gyllideb mwyaf. Rwy'n defnyddio'r gweithio'r gweithio, ond rwy'n gweithio'n gweithio'n gweithio'n gweithio'n gweithio. Roedd o'r cyfrwyng iawn – rwy'n cyfrwyng iawn hwnnw – ond byddai'n gweithio'n gweithio'n gweithio'n gweithio. Mae'n amgarwch i'r marwm oedd yn y ddweud o'r gyfferraeth bydd ymweld yn y gofyn, mae'r eu hwn wedi'u cael fwyf i'r arbennig oedd. Wrth gwrs lawr, yr ymdwyllgr yn gallu ddweud, a dal i'r gŵr. Mae'r gwyf yn hytrwm iawn ar halu wrth gwrs. Mae'r gwrs yn fwy'n i gŵr ar y mynd, a dyna'r hyn ymdwyllgr yn ymdwyllgr. Mae'n ymddwy'n yn cael ei ddweud o'r llwyth i'r fan, i gweithio'r gwrs, because they still have to look at the league table at some point and still have to wait and see what an appeal we'll bring, so in the meantime we've got to get on with business like we are doing. T浅ys 190k ów fuel came around Slith's a wee Go. Yeah, well Don was touching Go, it's a tight one with him, you know because obviously he's passed, so I think as long very he's come through this weekend he's got a good chance floating away. Am flaps do you maybe can not have to wait and sell his week successes but he's certainly making good progress. Gwyddo. Any further questions, guys? Cool, that was good. Tell us a bit more about Neon. He has a fantastic view. I think he is early part of his everton career. There was a few question marks. Since I've been here, I think he's been terrific. He's worked ethic. We do ask a lot of all of our players, particularly our wide players, his work ethic for the team. I know he's got ability. I've known him a long time and I think he showed that today. Not just with his goal, which was a fine strike. At the parts of his game, his control and his understanding is improving all the time. His positional sense. Built on the fact that he will do the hard yards for himself and for the team. They're good qualities to have. Is your bird consecutive away with... What is it that you believe that makes you so strong away from home? There's a lot of noise amongst lots of different noises I've been at the club, but one of the many was about the away from home. We wanted to correct it. I think we started that process last season. Certainly with draws. Not so many wins, but with draws and the mentality was improving all the time. I think this season it's been on show. The belief in how we're playing, the belief in the players as a unit, they're willing to work hard for each other and you can never underestimate that. People think it's a given. It's not. A group with all noises pointing in the right direction willing to do all the work and play, of course. That's a powerful thing. I've spoken to the players about how important it is and I think they're showing that they believe it more and more. Even if, regardless of the appeal, you're at a 2.17th place with the momentum you've got. Do you think you can stay up anywhere? People are suggesting that it's a good time to have 10 points taken. If they are, I'll do a deal of their 10 points. They can have the ones that we've got taken. Let's see where we all end up. I know that it's quite simple as that, but I think the key for us is to not really worry about all the different conjecture, all the different noise, all the different stories. It's to stay focused on what we're doing and the bit that we can control. We feel we control as our performances are working the week on the training ground and I believe in each other to go and win football matches. So that's the bit that we're focusing on. Thanks everyone.


Limiting the global temperature rise below 1.5 degree Celsius is essential to avoid the worst impacts of climate change. Reducing greenhouse gases like carbon dioxide is important to achieve these aims. It is not possible to electrify everything and alternate fuel options based on renewable energy are required. Hydrogen is an attractive candidate for carbon-free fuel as it can be produced in a variety of ways and has a lot of energy and industrial applications. Hydrogen combines with oxygen to produce water or water vapor as a by-product when used, meaning that there are no greenhouse gas emissions as long as it is produced using renewable energy. Unfortunately, hydrogen is currently produced using fossil fuel technologies which release a lot of greenhouse gas emissions. Renewable methods like electrolysis split water into hydrogen and oxygen using renewable electricity options such as wind and solar. At the moment, this is still too expensive and researchers are looking for ways to make it cheaper. Given the vast pool of applications of hydrogen, it is important to focus on techniques to produce low-cost, large-scale renewable hydrogen generation. This is the solar simulator and is an important part of this research. It has a lamp inside which is calibrated to provide a slide similar to what we received from the sun. And this is the lab where I work with Dr. Fiona Beck on direct solar hydrogen generation. Our research at the Australian National University focuses on direct solar hydrogen generation systems using low-cost materials and existing solar cell technologies combined into one system to produce hydrogen cheaply and efficiently. Our system combines the current silicon solar cell technologies used to produce electrical energy from sunlight directly with catalyst-coated electrodes where the water-splitting reaction happens. Our system achieved a direct solar-to-hydrogen conversion efficiency of 20% meaning one-fifth of the sun's total energy is converted and stored as chemical energy in the form of hydrogen. This system also achieved the US Department of Energy Solar-to-Hydrogen Efficiency Target for direct solar hydrogen generation systems to make them economically viable for large-scale hydrogen generation. For the widespread applications of hydrogen to flourish and drive down the greenhouse gas emissions, we need cheap and renewable hydrogen. Direct solar hydrogen generation could potentially provide a low-cost pathway towards hydrogen generation if we can continue to improve the efficiency and lower down the system cost. And it is a goal worth pursuing. If we can quickly scale up renewable hydrogen generation, it can provide one-fifth of the reduction needed to reach the net zero emissions by 2050 and keep the global temperature rise to below 1.5 degree Celsius.


Good morning, everyone. Thank you very much for joining me today. My name is Joy Doraraj, and I'm a security product manager for Hewlett Packard Enterprise. I've been with Hewlett Packard for more than three years, with OpenStack for almost two years now. But I've been in security for many years, and I joined Hewlett Packard from Symantec. So I've been doing product management and development for many years in the field of security. How's everyone doing today? Great, great, great. So raise your hand if your organization is bound by any type of compliance. Like raise your hand if you're bound by PCI or FedRAMP or OK, great, HIPAA. Is it FedRAMP, HIPAA, or what type of compliance? HIPAA? Excellent, great. So what I'll be talking today, thank you again for joining me over the next 35 to 40 minutes. What I'd like to make sure that you all walk away from this discussion, from this session, is knowing what is compliance, why it matters. Perhaps some of you might be already knowing this, but I just want to make sure that we have a common ground before we start. And then what are the challenges with cloud security compliance? I mean, people have talked about compliance all the time. It's a big checkbox. So really, what is it that about cloud security, particularly something like OpenStack that actually makes it more challenging? And then we want to talk about the types of compliance. And when I talk to customers a lot, there's always some sort of confusion about product compliance versus service delivery base. So they ask questions like, hey, is Healing OpenStack PCI compliant? And then I stop them at their tracks and say, no, no, no. Healing OpenStack is a software distribution when it goes out to customers. So that means some of the controls that physical administrative was still falling under customer responsibility. So I kind of want to set the stage on, what are the different types of compliance? And then I want to walk you through an example of PCI DSS 3.1. And I want to give you an example of the different sections and how OpenStack or particularly HP Healing OpenStack can be configured to meet those requirements. And PCI DSS is a huge discussion in and of itself. So I probably won't do too much justification given the short amount of time, but I do want to highlight the different areas and say, hey, what are some of the key OpenStack features that help fulfill this requirement? So without further ado, it's no secret that security continues to be the single biggest barrier to adoption. And this is so because a lot of it is probably lack of knowledge and people don't have this visibility and control over where their data is being stored, who's handling the data and what kind of controls are in place, that visibility, lack of visibility, lack of monitoring. A lot of these puts suspicion and fear in the minds of C-level execs and other organizations that are trying to make the journey to cloud. And then when we take a look at compliance, but really in reality, compliance is more of a checkbox. Just being compliant doesn't mean that organizations can feel very secure. What is more important is they have to have a risk mitigation strategy in place to stay ahead of threats. The biggest fear for a lot of organizations is not really, you know, the compliance is a headache. Yes, you can somehow meet these, but the bigger fear is, hey, what do I do with perceived threats, right? Well, what happens if there's an attacker sitting in my network and I don't even know that he or she is there for days together. And then something happens. By that time it's too late to respond. So that type of being able to be staying ahead of threats, being more proactive is really very critical. So that's why I'm in the common example is we've got Home Depot, Target, I'm pretty sure they're all PCI compliant. But just because they were PCI compliant didn't mean that they could not get hacked. So it's very important to understand that compliance is an important milestone, but you have to go beyond that to have a proper risk mitigation strategy in place. So let me take a look at cloud security. So particularly let's say OpenStack. So what is it about cloud security that makes this compliance more and even security concerns more difficult?  You've got REST APIs, you've got DevOps, you've got continuous integration, CICD. So then the important thing here is in an open source software, how, it's important to understand if your vendor is using secure coding practices, are they doing things like, are they doing source code analysis? Are they doing, you know, are they following threat architectures? So it's very important so when you, you know, make a decision to go with a vendor, whether it's HP or any of our other vendors in this space, it's important for you to understand that, you know, secure coding practices, you need to make sure that they're hardening your distro with every release. And then when we talk about rapid scales, rapid provisioning and scalability, so that's a huge, you know, cloud benefit. But then the reality is how do you monitor for drifts and how do you ensure continuous compliance? That continuous compliance is a huge challenge for a lot of organizations. And the reason for that is, you know, when you're in a cloud environment, you've got P, you've got your users bursting clouds left, right and center. You've got your guest operating systems sitting there. You've not rebooted your servers in many months. How do you ensure that they're patched properly? That is important. And how do you ensure that your guest operating systems are up to date from a compliance standpoint? How do you monitor for any kind of drifts? I mean, how do you make sure that, you know, when from a coding, even from a coding practice perspective that developers are not doing things like, you know, security bad practices, like storing passwords in clear text or storing passwords in configuration files. So these are all a lot of security best practices that needs to be followed and needs to be, you know, taken into consideration when you do, when you think about compliance. So we talked about virtualization. Virtualization is a huge benefit.  So the recent survey has shown that, you know, majority of the threats are actually coming from insiders, more customers move, I mean, organizations are more worried about insider threats than anything else. So in that case then, how do you secure your data center traffic? And that's an important aspect from a security standpoint. How do you isolate? How do you isolate your environments? How do you patch them? How do you harden them? And then now the other, the benefit of cloud is that it brings about multi-tenancy. So when you think about multi-tenancy, now you've all got, you know, how do you achieve proper rollback, rollback, roll-based access control? How do you audit all user activity, particularly admin activity? And so this is a huge pain point for a lot of customers that we talked to.  You talk about stack user, privileged access. Hey, I wanna know who are these users that are actually gonna be, you know, installing my bootstrapping, my environment, and installing it. So it's very important to understand that you've got to have auditing all the way through. I mean, not just the open-stack services, but also your physical layer, your hypervisor, your host operating system. And of course, application workloads, you know, typically customers have that type of auditing already there. I mean, it's kind of out of scope from a, you know, infrastructure as a service perspective, but from a compliance standpoint, very important to understand, you know, what the different layers are. Then we talk about compliance due diligence. Now, this is an important aspect.  The first question they ask is, oh, AWS is, you know, PCI, FedRAMP, and all of this compliant. What about open-stack? Then the response to that is, you know, open-stack is a software distribution. Ultimately, you know, when a customer deploys it in their environment or they engage a service provider to do it on their behalf, they need to understand what the different responsibilities are. And then we'll talk about it in just a second. So then the concept of shared responsibility comes into picture. There are things that, you know, the vendor is responsible for. They need to make sure you've got the right feature set to comply with standards. And then there are, you know, I would say service provider responsibilities. So they are managing their data center. How do they do the physical, you know, aspect, the physical controls, like biometrics and security guards and cameras, closed circuit cameras, et cetera. And then you've got customer, like for example, you, like you as a customer, ultimately responsible for getting the certification. So it's very important to understand these concepts. And then, of course, this is just saying, you know, what is compliance? Of course, compliance is, you know, set of regulations, standards and laws. And then the assessment and audit is very important.  And the assessment needs to be done first. So you have to make sure, you know, what are the different systems and, you know, how many of these are in scope, how many are out of scope. And that assessment is important before you perform an audit. Probably, I'm sure, you know, many of you have already gone through this process before. And then the third aspect is certification. So once you go through the audit, then the auditor comes back and says, yes, check box, you know, all these rules have been satisfied. And great, here is a certificate that says that your PCI compliant or HIPAA compliant or whatever. But then the important aspect to this is, a lot of these is not a one-time activity.  Why compliance is important? Of course, these are barrier to entry. You've got fines that are levied. You've got penalties. In some cases, you've got even jail time. Classic example would be, you know, there were some companies which, which inadvertently sent out personally identifiable data that ended up paying a huge fine. And then there are different, you know, this is probably something that most of you are already familiar with, but I wanted to put a, you know, common ground here saying, there are various different, depending on what type of industry you fall under, there are different types of certifications and the evaluators are all different. And then the regulation standards are all could be very different. Could be things like, you know, financial and legal services. You could go into SOC, SOC compliance or PCI, healthcare, life sciences, HIPAA. If you're a cloud service provider, you would want to, you know, CSA start as a commonly known standard that cloud service providers go through. If your technology, media, telecom, ISOs and other great example. So these are all just examples of how this thing works. I'm so sorry, I just don't seem to be getting this right. And then we already covered this in terms of service delivery based versus product. And as I said, you know, when you take about public cloud providers, they're all service delivery based. And then so they always, you know, will go through the full audit compliance. Whereas product, if you take a product or a distribution, they, you know, we can do certifications like common criteria, FIPS 140, et cetera. And the reason for that is every compliance standard has three types of controls. You've got administrative controls which are typically very, you know, awareness, training, documentation, disaster recovery plans, and your risk mitigation strategy, your data classification. How do you classify the data, right? I mean, not everything needs to be super secret. I mean, the different levels of classification based on that, you know, that dictates the amount of spending you would do to become certified. And then there are technical features. So this is the important aspect of which I will be covering, which is really saying what are the product features that help customers become compliant? And then there are physical controls that we talked, I alluded earlier, which is, you know, all the things that you would do in a physical environment like closed circuits, TVs, security guards, biometrics. Now, and maybe some of you have already gone through this process. So it's not, you know, surprising. But for those of us who are new to this, you know, we would be surprised that, hey, even you have to literally like walk your auditors through how secure an environment is, literally go through all these different, you know, physical controls, your administrative controls. And of course, technical controls is something that, you know, people like me, I'm a product manager, I understand it very easily because to me it's like, oh, great, I've got this product feature, you know, you've got this reporting that you can show, you can take a screenshot, you can do all kinds of, you know, things to prove, demonstrate to your auditors that you're compliant. But all these other aspects are also important from a compliance standpoint.  How do you automate compliance? This automation is also an important, is a key concern for many customers. And the reason for this is gets to be a very huge pain point because literally I've heard from customers, they're saying that, you know, I have to literally take log files and take, you know, sift through the log files and show it to my auditors. It's very painful. If I had, you know, ready-made reporting that would help me, you know, with a good formatting, I could show it to my auditors. And then in some cases, they say, I literally have to call my auditor right next to me, show them on the screen that, hey, this is how we are, you know, satisfying these controls. So when we look at it, we say, hey, how do you help customers automate the process? And I think that's an important aspect of it. Compliance, checking for compliance drifts is important in a cloud environment because you've got VM sprawls all the time.  You're, you know, cloud bursting. How do you keep them patched? How do you keep them isolated? Very important. And also, how do you measure integrity against a known good state? So this is, again, looking at, you know, hardware-based root of trust. And we're having a panel discussion later this afternoon with Intel and Visa. So I'm going to be part of that. So we're going to show you how, you know, HP, the hardware has these modules, TXT, TPM modules, which when you integrate with, say, Intel, you know, cloud integration technology or open attestation server, how do you get that root of trust and how do you use that root of trust to enforce security policies? So that is an interesting and an important one, especially in data sovereignty compliance standards because customers are asking, like, hey, how do I make sure that only users who have, you know, only users who are located out of France, for example, can run workloads on my service? And I have a global, you know, large enterprise. I've got globally distributed users. The other pain point is, how do I control the workload access? I only want users to be running workloads on servers which are trusted. So these type of policies can or also play a big role from a compliance standpoint. So in summary, you also have to start off with an enterprise cloud strategy. You need to understand, you know, what cloud services you will be using, who is responsible for what, that separation of duties is critical. You have to be able to map out and say, hey, these are my users that are going to be using OpenStack or these are my dedicated users that are going to be installing OpenStack. So that way you have good visibility and control over who is, you know, audit or who is doing what. And then the, and the other part is also, how much risk are you willing to accept? So it also depends on your risk, you know, mitigation strategy and, you know, based on your workloads. If they're DevTest workloads, you know, you don't care, not, you don't need to go into heavy duty security.  There's some, definitely, you know, good amount of security. Compliant workloads, great amount of security. So it's kind of like your Goldilocks story, you know, what is the right fit? Like this is too big, too small, but this is the right thing that feels good. So what is right? No, there's no one size fits all. What is right for one organization is obviously, you know, is different from different organizations. So I want to take the next, you know, 15 minutes talking about PCI DSS. Most of you are already familiar with PCI DSS. I won't go into too much detail about it. And so we recently did, you know, PCI DSS assessment. We did external assessment using an auditor. And we are going to be, you know, HP Helion OpenStack 3.0 onwards as PCI ready. And we'll have literature coming up shortly. And we'll show you different controls, how we need different controls. And what is important to understand here is, you know, the classification of different sections. So in PCI DSS is basically, in summary, applies to cardholder data. So anybody that's storing, transmitting, or handling credit card data, there's different levels of PCI compliance. There's a huge website and standards body devoted to this completely. So more information can be found there.  So it's important to understand the difference between, you know, certification and compliance. So even in the world of PCI, there's a self-certification and then there is the proper, you know, going through the proper audit and engaging an auditor and getting certified. Now the latter obviously takes more time and obviously, you know, more expensive. But the self-certification is more of a, say, oh yeah, great, you know, I'm PCI compliant. But in certain cases, you know, takes the certification is obviously more, carries more value and carries is more, you know, a lot of weight. And then what is important, we talked about this earlier, is understanding the scope. And the scope is critical because you need to understand how many servers are, you know, actually storing or they're handling or transmitting. In some scenarios, you may not be storing any credit card, you just be handling or transmitting. So you need to understand the difference. You need to get an inventory of all the different systems that touch PCI, that or rather that touch the credit cardholder data.  You may have probably been following voltage which was bought out by HP Enterprise almost a year ago. So now they're part of our data security business unit. So they have great solution. They have format preserving encryption and tokenization, stateless tokenization technologies. They have very proven products. They've been in the market for many years. They're the market leaders. So if you're interested in those, I would absolutely encourage you. And you know, I know this is a bit of a marketing pitch but this is our session. So I have full, I'm fully okay to talk about it. So you should absolutely check it out if you're interested in that type of solution. So what I'm gonna do is I'm gonna give highlights of different sections and then say, you know, what is, how are we gonna be meeting these type of requirements? So sections one and two, they talk about building and maintaining a secure network and systems. So when we talk, when we look at this particular section there are controls which are administrative controls and then there are controls which are physical controls. So those are completely, you know, outside the scope of any product-based control. So if you look at the features of OpenStack which will help you address this. So we've got network segmentation. You've got, you know, neutron-based capabilities. You've got IP groups, security groups, IP tables, all your, you know, quotas for managing your resources. So all the networking features, security features, absolutely help meet these particular section of requirements. And then this talks mainly about making sure you've got firewalls in place, making sure you've got, you know, the network security aspect in place. So that's an, that's one of the key features that'll help meet this requirement. So when we take a look at sections three and four. So there are 12 sections in total and then there is an appendix that talks about shared, that talks about service provider requirements. So sections three and four talks about protecting the cardholder data. So the moment we think about protection, we're always thinking, hey, you know, data address protection and transmission of data and, you know, encrypting data and transit. So very straightforward. Basically there are 26 total controls of which seven are administrative, procedural, 19 or fall under customer responsibility. So the key features that of OpenStack or even, you know, let's say even HP, Helene OpenStack that help meet this requirement is we've got encryption of stored cardholder data. So typically in majority of the cases, you know, customers already have their own PCI compliant workloads more than, you know, most often they're not, they're probably not using, you know, OpenStack, Cinder or whatever it is for storing that data. They're probably having, you know, their own, say, storage systems. But if they choose to, you know, use OpenStack, we've got data address encryption, Cinder block storage, you've got the Barbicon, you've got the key management using Barbicon. You've also got the ability for Barbicon to talk to an external key management device. And I would say that Barbicon is probably, you know, still evolving. It's still, you know, they're still trying to get some key management capabilities in place. But in reality, there are other choices that are more, you know, more interesting. More interesting choices like using an external key management device. An example would be HPE ESKM, which is our enterprise security key manager. It used to be called a TALA key manager, but now it's called ESKM. Now that particular, it's a hardware based of lines, very expensive, but it is completely, you know, tamper evident. You've got HA built in. You've got high availability built in. You've got FIPS compliance. It's all been completely, you know, certified for FIPS. It's PCI compliant. So those key management devices really help, you know, meet this particular requirement when you talk about encryption of data. And then there is also, I talked, I talked about data centric encryption and tokenization from HPE data security, the voltage solution. And then the encryption of data on transit. So this is pretty straightforward.  We've got TLS. And pretty soon, you know, we also are working, we have beyond encrypting, some amount of traffic within the internal, you know, but between in the internal cloud traffic between API to API, between, say, RabbitMQ to, you know, other APIs and so on. So, but it's important that, you know, these two are the key requirements when you take a look at sections three and four. So five and six talk about maintaining a vulnerability management program. So if you take, this has about 24 of them or administrative procedural. And so this is, talks about malware maintaining proper patching. So this brings us back to, you know, patch management. And patch management is very, it's very painful, but it's an unnecessary thing to meet this particular section. And again, when you look at OpenStack and when you talk to different vendors or even when you talk to us, the way that we approach this is we deliver a single set of, you know, patches and then we have this critical security patches. We've got turnaround time for delivering critical security patches. And those patches not only include OpenStack but the entire distribution. So our host operating system, which is the HPE Linux. And so what we do is we make sure that, you know, normal releases contain all the bug fixes and everything which is typical of any vendor. I mean, you talk to anybody, they'll say the same thing and we are no different either. So, but what is important is for you to understand, you know, what is the critical security fixes and need to understand what the process is, how often do your vendors, you know, give you those patches? What is the turnaround time? Where do you go get the advisories? All of that is critical. And then the other customer best practices, you have to deploy antivirus, anti-malware. And there are a few things that are available for, you know, I would say in a virtualized environment but still this is, I think, I haven't really found anything that's more open source but there are a lot of choices available for customers. So, 7, 8, and 9 talk about implementing strong access control procedures. So this is again restricting access control access to cardholder data, identifying and authenticating. So this is pretty straightforward. You've got the Keystone authentication service which has, you know, which meets all these different features. You've got all the built-in capabilities, directory-based authentication, role-based access control. So all of that covers the open stack layer. Now when you really look at it, you know, additionally what we do is we do security during bootstrapping. So that's important.  This is before all the open stack services are even installed. How do you access different keys? What are the config file settings? What are the service passwords? How are they doing the encryption of data in rest and transit?  So you've got to make sure that they're following all these, you know, security best practices. And then the SSH keys, so this is very important. So when you bootstrap, open stack, any distribution, you've got the stack stack user. How do you, you know, access all the controller and compute nodes? You've got SSH keys. How is your vendor protecting those SSH keys? Are they using a passphrase to encrypt it? Where is the passphrase being stored? You know, how can, you've got to think about in our tax scenarios, right? Can an attacker, if they gain access to it, can they gain access to that encryption keys and what's the damage being done? So very important to pay attention to that bootstrapping security beyond just the open stack security. So 10 and 11 talk about regularly monitoring and testing networks. So you've got, you know, the logging is important. So how are we meeting it? We've got audit logs, which are CADF compliant. CADF stands for Cloud Audit Data Federation. And it's an interesting one from an, from a compliance standpoint, because it meets a lot of the seven Ws that you need from an auditing perspective. You've got to be able to back up your audit logs frequently, regularly, you know, in a proper cadence. You've got centralized logging that will help achieve this. And again, additional best practices, you've got to do things like file integrity monitoring, penetration testing, vulnerability scanning, wireless IDS IPS. So these are all things that are not out, these are all outside of open stack, but these are all things that customers have to think about when they want to meet DSS, PCI DSS requirements. So 12 talks about maintaining a policy. This is again, you know, there's only one open stack control, which is automatically disconnecting idle sessions. And this is met by Keystone TTL tokens. And the rest of it is all procedural. Appendix A talks about shared hosting provider's requirement. So this is in a multi-tenant model. You've got to make sure that it's fully segmented from each other if necessary. And how do you achieve tenant isolation, right? So you want to keep them in a separate project-based and the audit logs have to be segmented by tenants so that in a service provider model, you can, you know, each customer can access their own data.  So in summary, we talked about a lot of things. You have to have the right mitigation strategy, visibility control. You've got to harden, you've got to isolate. So we do a lot of things from a hardening perspective. So we do app armor for compute nodes, controller nodes, and also, you know, we are introducing Red Hat KBM for a compute node. So we will be introducing AC Linux as well. So then, you know, with every release of Healing OpenStack, we follow the security best practices. We do threat reviews. We do penetration testing, vulnerability scanning, all critical threats, or immediate prior to, you know, giving a, releasing it to customers. Then, so this isolation hardening, very key. You've got to have proper auditing and then proper patching. So I kind of want to, you know, wrap up with this. Again, keep in mind, the key takeaway is compliance alone is not enough. You have to have a risk mitigation strategy which is equally important. I want to throw it open to questions and answers. Any questions from the audience? Sure. Sure. So first of all, you need to understand, you know, who your public cloud provider is. And typically, you know, common ones, or AWS, Azure, and so on. You need to find out if they are already PCI compliant because it's important. In order for you to achieve the PCI compliance, your service provider must have, must already be, you know, PCI compliant and they will give you a package. They will say, hey, here is a report from an external auditor that goes through all these different controls. And AWS actually does that, but you have to be a customer to get that report. And Azure has a report that's available publicly on their website. But once you get that report, you have to go through those different controls and then it'll tell you, you know, these are all customer responsibility. So then when they go through each of these, and then when you look at the ones that you are responsible for, then what you need to do is you need to take that report, you need to work with your own auditor. You need to work with an external audit firm. There is so many available today. You know, if you go to the PCI DSS website, you will see a list of all the approved auditors. You can engage with any of them and then say, hey, this is the report I got from my provider. And how do I go about doing this? And then they will say, okay, you know, you got to provide documentation that you're supporting all these data. So that's the process you would take. You talked about encrypting config files and are you encrypting the whole file or just the passwords in the number? The passwords in the file. And where are you storing the encryption key that's used to encrypt this? So encryption keys can be stored in different places. So you can configure them to say, you know, store depending on where they are. It could be an ansible vault or you could store them in ansible vault and you know, down the road, you can look at ways of integrating with outside key, external key providers and configuring it to store it externally. But today, the Cinder encryption keys and then the Nova ephemeral encryption keys, they're all, you can take them from Barbican and you can configure Barbican to say, hey, store these keys in a NES game device or a KMAP compliant device. Is the purpose of that to keep someone with root access to the box from being able to? Yeah, the biggest, you know, the biggest reason why you want to do that is you want to keep your encryption keys separate from the data. You don't want to co-mingle them. And the reason for that is, let's say, in the event of an attack in your OpenStack cloud, you know, the attacker will not be able to gain access to your keys because they're stored in a totally, you know, different appliance. That's not really what I mean. What's the point of encrypting the passwords in the first place? Because the config files themselves are only accessible. So let's say it's a Nova config file. It's only going to be accessible to Nova and to root. Unless you've found a way to keep root from being able to get access to that key somehow, but through whatever you're doing, Nova's going to have to be able to access the key in order to decrypt it, in order to use it in the service anyway. And so have you really added any true security or is it just basically security theater makes people feel better that it's encrypted, but it was actually no safer than it was to begin with? I'm not sure I completely understand your question, but let me make sure I replay this. So what you're saying is, you know, when you look at, and I think you brought up a good point, which is you've got all these config files from OpenStack like NovaConf, right? Which is storing the Nova passwords. And then the only people that can have access to it is your root or your, you know, Nova admin, right? And typically even inside the config file, when you take the open, a DevStack version, the DevStack, you know, doesn't encrypt it.  So then what we do is we take those, we make sure that those passwords when they stored inside the config files are actually encrypted. And your question is what is the purpose behind that, right? And then the reality is, you know, it's just being security best practices throughout, you know, and also understanding what is at risk involved, right? So if someone gets access to it, it could probably be only a root that gets access to it and what is it that they're gonna steal away, right? So it comes back to, you know, security best practices and risk mitigation. I don't know if I answered your question, but we'll take it offline. Are you finding a way to prevent root from, someone with root access from being able to? That is, that's gonna be really hard, right? I mean, if somebody has root access, they have access to everything. You can't, you can't prevent that, yeah. Yeah, you can't prevent that. Sure. I have a different kind of question. I'm due to open stack it. So in your presentation, I think there was one slide that mentioned that, you know, given that you know what to do to be compliant. I think there is actually, it will be great if there is a framework or tools that, so users can quickly verify that, you know, things are actually configured correctly for open stack. It would be great to have a tool or framework to easily tell that you have actually configured the system correctly. Exactly. So that, you know, you can show auditors, things are actually, you know, compliant, and you can frequently do that. So that, you know, it's always compliant or most time compliant. So I wonder whether, you know, I mean, this question is maybe for the community as well. Is there something in open stack already that, you know, can do that? Or is that something that's desirable and it's not there? And it should be kind of created as maybe a project or something.  But for open stack, you have different nodes, you have nodes. Correct, correct. Now actually you brought up an excellent point, which is really saying, you know, how do you have a baseline of configuration and how do you kind of monitor for drifts? And then so there are a couple of ways to address this. So one is, you know, you have file monitoring, file integrity monitoring tools available. So they do that sort of thing where they have a baseline config and then they check for drifts. For open stack in particular, there are, you know, few startups that are actually doing this type of thing. I don't think there's any open source community initiative as far as I know, but there are a few startups that I mentioned. So one is called Cloud Rakshak. It's a cloud CLOED, Rakshak is spelled R-A-X-A-K. And then so those guys are actually having what are you known as the continuous compliance monitoring for open stack and they can do that for AWS and Azure. So, and they can also do it for a VMware environment. So you can say that they do it for all types of clouds. So we will have actually a demo from them later today. So what they can do is, so basically the way that they do is they have this baseline of compliance template or standard that they input into their system. And then it basically says, hey, you know, this is the template, these are the 10 rules that you need to follow. And then it can actually look at end-to-end compliance. It can go all the way from hardware root of trust all the way up to your open stack services. So, but it's not, but obviously it's not open sourced. It's proprietary, but this is definitely one area that I think the community needs to start thinking about and addressing it. I agree. I think it's a great question. Thank you. So when and where is the demo? The, that panel session is actually going to be here. It's at 5.40. I think it's in, I forget, it's probably room 14 or 15. So somewhere here, yeah, yeah. Thank you very much. Yeah. We have time for one last question. Yeah. So certification and compliance are starting to manifest an open stack in many different ways. If you look at, you know, from the exams that are being put out for administrators to configuration, open stack configurations, that should be considered secure to, you know, talks like this and others who are trying to put a holistic picture together. When I did, I did an informal survey of open stack of various vendors out there asking them that, you know, do you have an open stack solution that you can give me and is HIPAA compliant from, and it's turnkey. So the answer I was getting was that it's, you know, if I use this widget or that widget, you know, then you could do, but not the whole solution. So in your opinion, I guess, long story short, in your opinion, where is open stack heading? Where is open stack currently in terms of security and compliance from PCI and ESS? I've got beginners, intermediate advanced level. And two, what should the community do as a whole to address this? Is there need to publish some kind of open stack, compliance guides as a similar to open stack security guides? Some products or configurations have to be considered that way. So where should the community- Where do you say? That is a great question. So from the, from a PCI perspective, I certainly see open stack more in the intermediate. It's definitely not a beginner. We have crossed that stage. It's the intermediate and then we want to get to the advanced stage. I think there are definitely opportunities where the community can contribute. There's certain areas that I think would be things like, you know, file integrity monitoring. I think the gentleman brought a great example. I think we want to do documentation. We want to be able to publish this to our community users and say, hey, how can you actually, you know, configure your open stack cloud in a compliant manner? Documentation, I would say, exploring areas such as file integrity monitoring and also tightening each layer of your, you know, all the layers of the stack.  We have to take a look at auditing from, you know, host operating system to guest OS, open stack services. We really have to look at, you know, centralized logging. How can we implement that? I would say three different areas. So one is obviously, you know, a documentation, file integrity monitoring, monitoring drifts, continuous monitoring, and then the other one would be auditing and logging. Would be those areas. Thank you very much.  He was a PPL, but he's moved on to another vendor. So, thank you. Thank you, everyone.


Have you got that man here? You'll have to tell us, Mrs. Cedar. If he's here, I'll take you, all right. Now we can sit right here. There ought to be laws against a man like that. Marrying woman after woman, stealing their money. There are, Mrs. Cedar. He must be found and punished, Lieutenant.  We'll do our best, Mrs. Cedar. You people out there on the other side of the wire in the audience room. May I have your attention, please? Thank you. My name is Cogger, Sergeant Pete Cogger. I'll explain the line of people. Each of the suspects you will see will be numbered. I'll call off the number, their name and charge. If you have any questions or identifications, please remember the number assigned to the prisoner as I call his name. At the end of each line, when I ask for questions or identifications, call off the number. If you're sure or not too sure of the suspect, have him held. The questions I ask these suspects immediately get a natural tone of voice, so they're not paid too much attention to their answers as they often lie. All right, bring on the line. Keep it moving, boys, over here at the end of the stage. That's right, right over here. Step it up.  That's right, stand still, keep your hands at your sides. And you answer my questions, sing out, the people on the other side of the screen want to hear you. All right, number one, James Franklin, the salt with a deadly weapon. Step right up there, Jim. That's it. Where do you live, Jim? Bremerton. Talk up, Jim. Where do you live? I said Bremerton. Where'd you sleep last? Somewhere's on a road. Keep your head up, Jim, look at the screen. How long have you been in town? Just got in. Didn't waste any time getting picked up?  How many weapons? Yeah. What kind? Gun. What kind of gun? Pistol. 32 Colts. Blue steel or nickel plate? Steel. Where'd you get it? Round. Where? Somewhere's around. Do you use it? The guy's in a hospital, innit? A critical list. Oh, I used it. Why? You shouldn't have held out on me. You got all the money, Ed. One lousy buck. That's all he had. I thought he was holding out on me. One lousy buck. Not even enough for a good hotel room.  All right, slide down. Number two, Charles the Professor Grumpton. Drunk in disorderly. Step right up, Charlie. I'd leave you lighted. I just... Sound happy tonight, Charlie? Why not, sir? I'd back among friends again. This is the 39th time you've been up here, Charlie. You promised to stay out of trouble the last time. That's indeed I have, sir. That's not what it says here. Those charges, sir, are the base canards. Professor Charles Grumpton may have on occasion imbibed you freely of the grape, but disorderly. Never.  Well, there are gentlemen's disagreements concerning the amount of the tap. Joe says you tossed an empty beer bottle through his plate glass window. Grotesque activation. I was merely the victim of superstition. How did that make it? Well, while endeavoring to enhance the flavor of the beer, I spilled some salt. Actually, I talked the picture on my shoulder. I realized too late that the window was dry. The salt smacked at the bits. How could a pinch of salt break a big window like that, Charlie? Well, obviously, sir, the glass was of inferior quality. Okay, Charlie, move down. Number three, Harvey Davenport, Grand Theft Auto. Step right up there, Harvey. Face the screen. Where do you live, Harvey? I ain't talking, Papa. Where do you live?  You talk pretty fast at the car, dealers. Yeah, what a sucker he was. He was the sucker? Yeah. How come you wound up here? I ain't talking, Papa. How's he, mate? Yeah. I wonder if it'll ever stop snowing. Fresh air. Better stop. Oh, you said... What's your time, bed? There you are. It's, uh, the last two words. Well, I get home. It's late shifts killing me. A two-eleven at House and Bain Street. A two-eleven at House and Bain Street. I haven't said ten words. Not on your mind? Yeah. Charlotte Evans. What made you think I heard? Weather, I guess. Same kind of night. Over a year ago, wasn't it? January 3rd, 1952. Oh, fill me in, will you? I wasn't working homicide, man. There's nothing much to it. He was a young kid, stormy night like this, deserted streets. She was coming home alone. Found her the next morning, buried in a drift, throat cut. Never got anywhere with it? No, no witnesses, no motives, nothing. Just a young kid buried in a smoker, with a throat cut. Period. Card 23A, call your station. That's what Dr. Gorson said. Call your station.  Yeah, I know. That's what you like to. Call 32B, investigate missing persons report. 6720 Hartford, Dorothy Shelton. What time would you pick me up? Card 32B, investigate a missing persons report. It's 6720 Hartford, Dorothy Shelton. This is 13K Guthrie. What's the dope on the missing persons assignment to 32B? Hold on 13K, we'll check. It's got your steam, Ben. That address on Hartford. What about it? Well, it's just... Card 13K, on that missing persons report. Closed in at 2.17 AM this date. Name Dorothy Shelton. 21, single, Caucasian. Recorded missing since 7.45 PM by Father Thomas. Want the description? That'll hold me thanks. Wanna take a ride, Peter? 6720 Hartford? Yeah. Why? It's a block and a half from where Charlotte Evans was killed. There's 32B, Ben. Just pulled up. Yeah. Lieutenant Guthrie? That's right. Officer Randall, car 32B. We've got an amended flash on that missing persons investigation. Said you'd take over. Yeah, crew's the neighborhood, Randall. All night restaurants, drugstores. Find out if anyone's seen the Shelton girl. I'll check with you when we get through here. Right, Lieutenant. Come on, Peter. Here is a lousy night. Yeah. Uh, yes? Uh, Mr. Shelton? Yes. I'm Lieutenant Guthrie. This is Sergeant Carger with police officers. Oh, please? We found her in Dorothy, and she's all right. Uh, no. We haven't found her yet, Mr. Shelton. Oh. Well, I thought perhaps you... We'd like to get some details from you, please. Oh, yes, of course. Come in. Thanks. Thank you. In here, please. I'm sorry I was so insistent about this, Lieutenant. I know you don't usually do anything for at least 24 hours, but... But I know that something's happened to Dorothy. What makes you think so, Mr. Shelton? Well, I know my daughter. She'd never do anything like this. She'd be so late and not call or anything. She knows how I worry about her. There's just the two of us here, you see. And she's been missing since 7.45 last night? That's right. At least that's the time she left school. Now, what school is that, Mr. Shelton? The Gruyer Art School on Madison Avenue. She goes there on Tuesday and Friday nights. Anyone leave with her? Well, I asked the school that, and they said no. Oh, oh. Is that her picture over there on the desk? Yes. Yes, that's she. Beautiful girl. She is. She's a wonderful girl, too. What's going to happen to her? Could we borrow that photograph, please? Well, it could cause anything. This is the only one I have, like it. So, you'd be careful. Oh, certainly. We'll return it tomorrow. Just want to have some copies run off. Dorothy, could you be... I'll be right back. What do you think, man? Hard to tell. It'd be routine. Love affair, running away from responsibility, happens every day. Yeah. Well, you don't think so, huh? Well... So rare, Dorothy. Who wants to talk to you, Lieutenant? Oh, thanks, Mr. Shulman. What's up, Randall? Well, I'd better tell you first, Lieutenant. We've got a flash in Dorothy Shelton. Dead? Yeah. Where? Two blocks over on Paulson Avenue. She was in a snowdrift, throat cut. Oh, come in, Pete. Anything new, Ben? Ah, stop snowing. Huh? That's all, huh? Just about. Dorothy Shelton left the Gruyer Art School around 745, all right? Got on a street cart Madison Fulton at 803. Got off at Paulson and Hark for two blocks from home, buddy. 57. Those times exact? Motormen says they are. Snowplows had been through a couple of minutes before. Car was traveling on schedule. Mm-hmm. Did the motorman know her? He remembered her by that bright plaid scarf she was wearing. Oh. She started up the street alone. That's the last anyone saw her until 2.43 a.m. Except the guy'll kill her. Yeah. How about that woman who found her? Nothing there. She's driving home with her husband and a couple of friends. Headlights picked up the body when they turned into drive lights. Want some coffee? No, no, no. There's something to keep me awake. Mind if I come in, gentlemen? No, make yourself at home, Doc. Looks like you're holding awake. We are. Want some coffee? No, thanks. Dorothy Shelton? Mm-hmm. That's right. Mm-hmm. Can I include Doc Gorson among the mourners? Who are you? I knew it was going to happen. That's an interesting statement. What do you mean, Doc? Remember Charlotte Evans? Yeah. Same man killed both girls. Well, how do you know? Look, it's a classic example of compulsive homicidal mania. It's all right here. No. This is practically a book, Doc. What a time for me. Okay. Two crimes virtually identical. The victim's a young, slight girl cause of death or slashed throat. Circumstances are snowstorm. Girl walking home alone at night from a speed car. Same time, same neighborhood. Same lack of obvious motive. All adds up to one thing. You're after a repetitive, psychopathic job. Well, there have been a lot of snowstorms the past. You're plenty of young girls out on the streets alone. How come he hasn't hit again before this? Hmm, must have been something special about those two storms. I don't know what it is, your job to find out. You'd better get that guy. Given the same conditions, a similar circumstance, he's going to kill again. Hi, Brad. Pete, hi. How you doing, Coyne? Yeah, two squads busy making a house to house. Come up with anything? Yeah, frostbite. Man, that's cold. Nothing on Dorothy Shelfman? And if they hadn't found her in that drift, I'd swear she'd never get off that streetcar. Well, somebody must have seen her. Keep checking. Sure. Going inside those houses, I get a chance to get warm. I'll see you later, Coyne. Right, Coyne. Well, that's a big help. Yeah. Think you'd come up with anything? Somebody had to see her. Or the guy who killed her. Maybe not. Well, somebody had to. Oh, letting this thing ride you pretty hard, Ben. Remember what Dr. Garson said? Sure. How much sleep you had the last four days? How much have you had? Okay. What do I do now? Let's stop at this restaurant. Great, great. I can use some coffee. That's a little help. Feels good in here. Yeah, but it gives you a chill. Hi, Dallas. What'll it be? See, what kind of pie you got? Better take the apple. Okay. Yeah, me too. Coffee all the way around? Yep. Guess I didn't have to ask, not in weather like this. We sure been doing the land office business in Cough. Making up for the storm? You ain't kidding. Here's a pie. Oh, thanks. This was the loneliest place this side of Siberia during that visit. I'll get the coffee. Nobody came in, huh? Brother, it wasn't for the snow plowman coming in. I could have froze to death in here and nobody'd found me for days. They're like that shelter girl. Hey, how else had done a thing like that? Brother. Yeah. Too bad nobody saw him. Who could have seen him? Nobody was out in him's streets. It didn't have to be. Well, you'd still think somebody would have seen him. Not a chance. I was talking to Joe Travers about it. He said there was nobody on them streets. Now who's Joe Travers? Guy lives around here. He was driving one of the snow plows that night. They put him on his extra help, you know. Uh, lives around here, does he? Yeah, over at the Clary's Hotel. He says he didn't see nobody out on them streets and he ought to know. Yeah, I guess. That's true, Pete. Huh? You through? Oh, sure. Hey, you didn't finish your pie. Something wrong? No, just in the hurry. Mr. Travers? Well, that's me. We're police officers. Could we talk to you for a minute, please? Sure, come on in. Thanks. Need a workout. Knock them sniffles. Yeah. Now, excuse how the joint looks. I've been working out with the weights. Yeah, I can see. Keeping shape that way two hours a day really builds the guy up. Yeah, I'll bet. Say, I still got ten minutes to go. You mind if I work out while we're talking? No, no. Go right ahead. All right. What'd I do, officer? Forget to pay a parking ticket to Slutton? Oh, nothing like that. We're investigating the murder of Dorothy Shelton. Yeah, I read about that. Real tough. Ah, pretty good, huh? Lace 200 pounds. Stakes muscle, boy. Oh, bad. You were driving a snow plow the night she was killed, weren't you, Travers? Yeah, that's right. I'm on the extra list. Ah, you, uh... You covered this neighborhood? Yeah. Do you happen to see Dorothy Shelton? No. See anybody at all on the streets? Not a couple of people, not her, though. How do you know? No, all of them in. Watch her. Get down on one knee now. Do you notice anything peculiar about anything? Not too busy driving. Do you notice anything peculiar about any of them? No. Now watch. I straighten that press over here. That's really doing it, huh? We're trying to get some information, Travers. Not sure. Told you everything I knew. Guy could have committed murder a foot away in that storm. You wouldn't know the difference. I don't think you guys got a chance. I'm sure you're right. I'm sure you're right. I'm sure you're right. I'm sure you're right. I'm sure you're right. I'm sure you're right. I'm sure you're right. I don't think you guys got a chance. We're gonna try. Well, jump around again sometime. Watch me work out. I'm in the Mr. America contest next summer. How do you think I'd be, Mr. America, huh? Yes, great. Check on those number two flowers, boys. Give me a report by five.  Forget the extra list. That'll hold for 24 hours. Pardon me. You still contending Saunders? That's me. I'm Lieutenant Guthrie. Oh, yeah. Glad to know you, Guthrie. Let's go to the office. Can't hear yourself thinking out there. Sure. That's better. Thanks. Sit down. Thanks. That's better. Sit down. Thanks.  Your snow plow operation is the one I'm interested in. A couple more hours, you can see it working. It's a dilly of a storm heading our way. Uh, what do you do about the side streets when they're heads? Nothing. Well, you clear them, don't you? Not usually. You only have a limited amount of equipment and personnel. Main traffic arteries have to be cleared first. You don't clear the side streets at all? Oh, that's in a while. Depends on how long the storm lasts, how quick we can clean up the main streets. What about the last one? Yeah, we had some details on side streets toward the tail end. What about the neighborhood around Paulson and Hartford? Hard to remember. I don't think so, but let's take a look. Okay. And let's see. Paulson and Hartford. Yeah, we did send one unit in there on the last night. Did you ever send any in there before? Yeah, January 3rd last year. Medium rotary plow, same type of use this year. Well, tell me, uh, any idea who drove it? Same man who was on it this year. An extra, name of Joe Travis. Communications all set, men? Yeah, Captain Waldo's holding an emergency. Communications all set, men? Yeah, Captain Waldo's holding frequency four open for us. There'll be a straight two-way radio between the cars. How many cars do we use? Two, ours and Klein's. Three square blocks to cover, two cars? Yeah, can't be helped. Even two's pretty risky. Yeah, I guess. Klein? Yeah, but... A policewoman get here yet? Sergeant Barnes, yeah, she's here. Send her in. And, uh, see if we can get Superintendent Saunders at Street Maintenance. Right then. Wonder how she's been doing? Yeah, we'll find out. Think it's gonna work? Got Gorsund, does. Take his word for it. We have to. Hello, Lieutenant. Well, come in, Sergeant. Hello, Pete Carger. How are you, Sergeant? Fine, thanks. Let's sit down. Well, how's it been going? Pretty well, I think. You've met Travis? It wasn't too difficult. I've had the apartment next to his for four days now. How's he been reacting? Pretty queer duck. Doesn't seem to have much interest in women. And at times I've seen a look in his eye that... Well, I know how Dorothy Shelton and... Charlotte Evans must have felt. Now, you've been taking the same streetcar home every night? Yeah, that's right. I get off at Paulson Street exactly 8.57. Travis, no? I've invited him to meet me there. He hasn't taken me up yet. But he knows the time. He's gonna take you up, Sergeant. Oh, when? Tonight. Anything special you want me to do? Just get off the car at the regular time. Make sure the street's deserted.  Then start walking up Paulson toward the Claridge Hotel. We'll handle the rest. Okay. Anything else? That's it. All right. See you later tonight. She'll do. Yeah. Now, here's the diagram of the location. Client's car will be here on Paulson. Halfway between the car line and the hotels. Stick out like I saw a thumb, won't it? Oh, it's buried in a drift and looks like a park job caught by the storm. What about mobility? We handle that. We park here. The alley on the next block. Client keeps us posted. When Travis makes his move, we make ours. Sounds okay. It better be. Guthrie. Saunders, Lieutenant. I've assigned the medium roadway to the Paulson Hartford area. Travis driving. How'd you take the assignment? Jumped at it. That suspicious? No reason to be. Fifth night of the storm, main artery's cleared. Same conditions as last time. Yeah. Well, thanks for the assist, Saunders. Forget it. Just let me know how you make out. All set? Yep. What time we get there? 8.30. Only five now. Yeah. Gonna be a long three and a half hours. Really getting cold. Yeah. Storm's not letting up any. Almost time, isn't it? Yeah. 8.55. A couple more minutes. The streetcar's on time. The car will be there. You're wondering about Travis? No. Thought he'd be around by now. Might be a couple blocks over. Storm like this, even a cloud hasn't moved too fast. I guess not. Tough having to do it this way. No other way. No evidence. Glein. Yeah, man. Any sign of that snow, Pal? Nothing. You? Not yet. How's the street? Empty. Has been for a half hour. Getting pretty close now. It's 8.56. Think Travis is doping off? I doubt it. He's probably... Ben, pal's coming down the street. He's coming down the street now, Glein. Away he's heading. Probably go around the block to Paulson, come up behind him. Give us the working time. I'll have to. I'm snowed in tight. Couldn't get out of here with a blowtorch. You'll have to handle it. We will. Here he comes. Yeah. Hit the spotters. The only chance is when he passes them off at this alley. He's starting to pass it. What do you think? Hard to tell. Probably not. He's got things on his mind. Yeah. Do you recognize him? No, Storm's too heavy. It's him, though. It has to be. What's the time? It's... 20 seconds past 8.57. Where's that street car? It'll get there. Hey, Ben. Yeah, Glein? The street car's stopping at the corner. Doesn't look like anyone's getting off, though. What's that mean? Just stopping there, Ben. Can't see what's going on from here. Oh, wait. Somebody's getting off now. Can you tell if it's Barnes? Not from here. Looks like a woman, though. Walking this way alone. Yeah. Yeah, it's a woman. Must be Barnes. Hit the starter, Pete. Yeah, sure. What about the snow plow? No sign of it yet. She's walking pretty slow, giving him plenty of time to make it. What's the matter with that thing? I don't know. She won't catch. Well, keep it going. She's almost at the first corner, Ben. Still no sign. Oh, yeah. Yeah, there's a plow. Coming off the car tracks and turning up Paul's snap. You better get going. Come on, Pete. I'm trying. She's crossed the street. It won't be long now. Looks from here. We'll catch up to her in the middle of the block. Well, what's wrong with it? Can't tell. The motor's warm enough. I hope you're moving, Ben. Travis is only a couple of yards behind it now. I like to have my hands on Craig with that garage. He stopped the plow starting to get up. Where are you, Ben? I'm getting out, Pete. I'll try to... Hang on, Ben. Come on, Ben. He's moving up towards starting to run. Come on, give it a go. There he is. Got a knife, Ben. Hold it, Travis! What the... By the devil did you go for it? Cut it pretty thin, didn't you, Lieutenant? Yeah. Looks like it, Barnes. You okay? Sure, but let's get out of this storm. Not helping you cold, Annie. Your attention, please. You people out there on the other side of the wire in the audience room. May I have your attention, please? Thank you. My name is Cogger, Sergeant Pete Cogger. I'll explain the lineup to you. Each of the suspects you will see will be numbered. I'll call off a number of the name in charge. If you have any questions or identifications, please remember the number assigned to the prisoner as I call his name. At the end of each line, when I ask for questions or identifications, call out the number. If you're sure or not too sure of the suspect, have him held. The officers who took your name will assist you, they're seated among you. Please be prompt with your questions or identifications. When the prisoners leave here, they're sent to the washroom and dressed back into the jail clothes. It makes it quite difficult to bring them back after they leave here. Other questions I ask these suspects are merely to get a natural sonar voice, so they're not to pay too much attention to their actual voice.


Within the annals of human history, there dwell discoveries that, by any moral or ethical standard, should remain there, buried by the past so that they cannot hurt us further. Humanity's curiosity in this fell universe of ours was once our greatest boon and yet turned to becoming our greatest threat. The inquisitive mind sought answers to the greatest questions of both science and existence, and in their quest for knowledge there occurred discoveries damnable beyond words. The conflagration of the Age of Strife, in part caused by these self-same discoveries, buried many on now nameless worlds under uncaring skies, lost to the memory of our species and perhaps for the better because of it. Self-aware of thinking machines, mechanivores, ontological weaponry, entropic engines, omni-phase swarms, sun-snuffers, chrono-gravitic inverters, blasphemous creations that endangered so much more than simple human lives, threatening in their power the fabric of reality itself. As a great crusade slipped beyond the bounds of the homeworld of Terra during the fateful years of its beginnings, it was diving headlong into a galaxy polluted by sins of those who had come before. In this nightmare playground of devastated worlds and systems, it was perhaps inevitable that hateful technologies thought lost were rediscovered. This chronicle is a record of one such example, and of the situation that drives the employment of science that, to put it mildly, is of questionable morality. Oh then, that this is a record of what men do in times that try their very being, of trans-humans pushed beyond the bounds of what they had ever considered possible, and of the terrible choices made in that impossible void, a record of the iron hands and the keys of hell. The belief system of the 10th Legion Astartes, the iron hands, though they themselves would likely bulk at the assertion that it is thus, was highly idiosyncratic. A hybrid mix of the tribal culture of their homeworld, Medusa, fused with the Makina worship of the early Mechanicom of Mars, it yawed in actuality far closer to the former than the latter. Medusa was, and yet remains, a harsh world, cold to the point of near uninhabitability, orbiting a dying super-giant star in the depths of segmentum obscurus. Mind during the dark age of technology for its mineral bounty, its climatic hostility was mitigated by the hungry, delving machines of humanity, managed from a massive orbital ring known as the Telsterax. The Age of Strife had severed it from the galaxy at large, as that benighted epoch had done to so many industrial centres. But what miners had been stranded planet-side when the void went dark, yet managed to survive, overcoming the ice-clad world through canny employment of what technology they could maintain and, laterally, sheer dogged perseverance. In a sadly not common enough tale of the times, the will of humanity to survive the depths of old night was redolent in the peoples of Medusa. Despite what efforts were made to retain some form of civil society, the long millennia, the impossible planet, and the passage of time caused social and cultural regression typical on worlds suffering this same separation from the human whole. It's been hypothesized that the origins of Medusa's clans lay in pre-strife work-shift gang groupings, or even private corporate alignment. Only for the millennia to grind away these known origins, and render what remained a tribe formed by an association now long forgotten. Medical examination undertaken by Mechanicum Biologis teams and early Imperial Sensucrats found no coherent point of origin for the world's genetic base. Indeed, noting that it is likely that the world's population was fascinatingly further supplemented by off-world arrivals during the Age of Strife. Medusa was not forgotten during these dreadful millennia, merely lost, and the Mechanicum itself had launched sleeper barks into the void, hoping that these flotillas would arrive at the now near fabled destination. Besides this, its fame would have attracted refugee fleets and other warp-tossed starships, fleeing wherever they could during old night, and the survivor invaders inevitably came into conflict with the native Medusa's. What emerged prior to Imperial contact was a society that, on the surface, resembled the techno-barbarians of Terra, especially those concentrated around industrial centres like the Uralic Heights. The world they inhabited sought to end their short lives at every turn, developing them into semi-nomadic people ever on the move to new hunting grounds, or to avoid the glacier quakes and tectonic movements of massive permafrost plates. What set Medusa aside from other primitivistic societies was the sheer abundance of technology the world possessed. Left over remnants from its pre-stripe mining days, massive troves of industrial equipment, big devices, and macro-engineering machina were dotted around the planet, or would routinely fall from orbit as either the Telsterax ring or the hundreds of shipwrecks clogging planetary nearspace degraded and plummeted to the world. Hidden amongst these caches could sometimes lurk partially functioning STC systems, or at the very least, production engines modeled off said. All the knowledge to maintain such technology degraded with the planet's stranded society. The clans yet retained their most robust capabilities, and the lore to keep them functioning passed from generation to generation by a shamanic leadership cast that became known as the Iron Fathers. Persisting in folk memory, precious understanding of machines, cybernetics, and weaponry were kept alive by this patriarchal wing and allowed the clans to continue surviving against all the world and indeed other belligerent clans could throw at them. Naturally, such practices developed a quasi-religious aspect, likely merging with the machine-cult beliefs that the survivors of the crashed Martian generation ships had brought to Medusa. While never organized in any sense, the degenerate superstitions served to further bind the clan groups together, and indeed further render interloper clans as other. Warfare was a way of life. Resources were scarce, as was the technology and the means to maintain it, and all were fought over in the bitterest of struggles. The clan wars were as unrelenting as the climate, and all of these aforementioned factors had, by the time of imperial contact, developed the Medusans into a people forged strong beyond human expectation by their endless toil. Strength, endurance, and resilience were the only qualities that mattered on this world. Weakness was abhorrent, and any who displayed it were rendered as outcast from their clans, both for the liability they represented, and the sheer disgust their familial structure would view them with. This was the crucible, that the 10th Primarch, Ferris Manus, was raised with him. This was a culture from whence all laterally recruited iron hands were born of following his return to the imperial fold. Indeed the reclamation of Medusa, albeit now under the rule of the emperor, had done effectively nothing to halt the warfare of the tribes. Despite the promulgations of the iterators and the coming of the imperial truth, despite the leadership of Manus, or rather because of it, internecine conflict remained a facet of Medusa's life. He did so, honestly, at the express desire of the iron primarch, with Ferris reasoning that without such trials and hardship, he would not be able to retain the recruits for the iron hands that he expressly desired. Counteract such attrition on such a small population base, the primarch levied in perpetuity all suitable adolescent males for the 10th legion. The primarch ultimately had his faith in his people rewarded. The stock of Medusa proved incredibly suitable to Astartes accrutement, at rates far beyond other populations. Through this, the Medusan culture and creed entered the legion itself. As the Terran Astartes either died out, or readily converted to the primarch's ways of life, the primarch was able to return to Medusa. He was a figure utterly abhorring of failure, an embodiment of the world and people he had come to maturity within, vocal in his disdain and infrequent in his praise. The standards he placed upon his sons were those of he himself. Regarding acts of duty, others, even his brothers, may have considered beyond Astartes capabilities as mere base competence. Utterly, without compromise, he was not a figure to be adored, and indeed was not by any save for his Astartes sons, who bore for him the love a child would for the sternest but fairest of parents. To Ferris's credit, he held himself to his own standards, bearing a fierce hatred for hypocrisy, and this fairness his sons were able to find the fierce adoration that drove them to compete for his admiration, rarer than anything, priceless to them beyond words. A character of Ferris Manus shaped his legion utterly, his self-same hatred for weakness becoming the credo of his Astartes. As on Medusa the weak were hindrance and threat to clan and hold, so too in the iron hands were the incomprehensible a stain upon the legion and the imperium. The great crusade they were undertaking was the greatest human endeavor imaginable, and it would not be risked by the fragility of any if the iron hands had anything to say about it. This abhorrence of weakness is central to one of the key aspects of the psychology of the legion, and laterally the chapter, namely, their extensive employment of the cybernetic augmentation. Contrary to popular imagination, the Astartes of the Tenth did not and do not believe that all human flesh represents a critical weakness to themselves or their purpose, or at least this belief was not as widespread throughout the legion as was commonly repeated. Rather, the Astartes of the Tenth did not believe that all human flesh represents a critical weakness to themselves or their purpose, but rather they saw within technology the ability to rid themselves of specific weaknesses, often deemed so by the Astartes themselves or perhaps their comrades. This could represent anything from an imbalance of humours, a quirk in a particular aspect of physiology of the individual themselves, or most commonly a battlefield injury. More so than any legion, the iron hands utilized bionic enhancements to replace those organs or whole segments of their bodies that they deemed insufficient to their own standards. Their close relationship with the Mechanicum of Mars, born of the latter's interest in the technology and resources of Medusa, as well as shared roots of social creeds, was a natural vector for the ideology of self-cyberization to enter into the legion. And while the Astartes would rarely undertake modification to the same degree the tech priests had, they were nevertheless far more sweeping and extreme than their cousins in other legions. Full development to cybernetic transhumans, as some of the most prestigious and ancient of Mechanicum Magi were want to do, was held back by the Primarch himself, who in his own words believed, the machine is strong, and logic can lay open any realm of understanding, but without the hands and minds of the living they are nothing. We live and bend iron to our will, but iron can break, machines fail, and logic can become corrupted. Life is the only true machine. Cut away too much, and we lose ourselves. It must be understood that, while the iron hands were quite literally quick to cut off and replace a limb if it was deemed an issue to the comportment of their duty, they would retain a quintessentially human fundamentality about themselves, issuing those amongst the Mechanicum who desired to achieve some form of technologically delivered post-humanism. Indeed such reliance upon the machine alone was ironically a weakness in the eyes of the Primarch. Ferris believed in reliance upon the human self, however augmented, and that was paramount. But that same humanity must be owned by oneself, and retained at all costs, for was it not the ultimate goal of the great Crusade, and his father, the Emperor of Mankind, to deliver a wholly human future. This was the creed with which the iron hands prosecuted the two centuries of their war against the galaxy, a legion of utterly ruthless and uncompromising standards and expectations becoming as akin to the metal they were named after. Strong, yes, but as it would turn out brittle. The death of Ferris Manus, at the hands of his brother Fulgrim, Primarch, of the third legion Emperor's children, during the terrible events of the Dropside Massacre, sundered the iron hands in mind and soul as much as the massacre itself did in body. The first of the Emperor's sons to be by historical record confirmed killed in action, the first of the Primarchs to perish in the opening conflicts of the Horus Heresy. The wound caused by his passing was as unprecedented as it was catastrophic. What happens to a legion when its Primarch dies? What happens to his sons without his hand to guide them? The iron hands was not merely the loss of their gene progenitor, their commander, their father, something no legion had up until that point been forced to face, but a fundamental usurpation of their entire creed. They had failed to save their gene sire, and he had failed to live. Not only that, but he had failed his sons at least in the eyes of some. Had he not lived up to his own standards, he had lost, and it had cost him everything, leaving what surviving iron hands yet lived to continue existing without him. Reality would not align with the sheer emotions that such a loss revealed amongst the Iron Tenth. A fundamental aspect of a Starty's development is their psychoconditioning and hypno-indoctrination. As the old adage goes, they know no fear. The capability of it has literally been excised from their mental capacities. The process is far from exact, and as a standardized industrial process designed to produce super soldiers readily and generally predictably. This could never account for all the possible interactions between either an individual's mind or a legion's gene seed, or culture. Suffice it to say, however, a Starty's do not possess wholly human emotions in the strictest sense. In order to achieve the mental state required to make them the emperor's angels of death, a lot is simply removed, and bluntly too. A hatchet approach to psychological manipulation. This causes traumas, conditions that ideally the individual space marine will never have to actually address. The iron hands, not only was the trauma inflicted upon them literally unprecedented, they had absolutely no means to cope with it, either provided from outside the legion or inside their own heads. Their mutilated transhuman minds were unable to process the sheer sorrow of this grief and its horror. Accounts from survivors of Istvan 5, amongst the so-called shattered legions, are a far flung iron hands detachments receiving the news in its aftermath show a legion bereft of leadership and utterly without the means to understand what they were simply feeling. Where, in the calculations of purpose, in the cant of iron where pithy maxims to simply assuage such pain. These astartes were dealing with tumultuous emotional storms within their own heads, and the cold press of logic what they relied upon, the bedrock upon which the legion had built itself, could not help. What they needed to survive this trauma had been deliberately removed from them. Human beings are fundamentally emotional creatures. In their trans humanism, the astartes were caught in a horrific prison of the emperor's own creation, trapped between the emotional heart of a human being and the disfigured indoctrinated, genhanced brain of their augmented selves. The legion, en masse, went insane. It is little wonder, perhaps, that in their grief, their thoughts turned dark, and in their desperation their means turned darker. Medusa was a planet, as mentioned, wholly blessed and cursed in equal measure, by archaeotech of the dark age of technology. While the techno-barbarian clans were only able to maintain either the simplest or most robust of the downfallen civilizations the ruins of which they squatted in, Ferris Manus in his life, had broken open many of the world's hidden places and in doing so unearthed dark things, the existence of which only history may judge. In partnership with a highly interested mecanicum, the iron hands upon their takeover of Medusa following imperial contact surrendered some of this recovered archaeotech to Red Mars for study and possible development, yet also ensured that either copies were retained or that some technology never left the legions of his life. The tenth had its own plans, and the backing of one of the emperor's few at the time recovered sons. Politics swayed in their favour in this retention, but the mecanicum resorting to simply have to make petitions to Manus waiting upon his notoriously hard to obtain favour. It has been stipulated that, given his experiences in the depths of the planet's hidden catacombs, the Primarch witnessed horrors of mythology run amok, breeding within him a loathing for the willful excesses of science that the humans of millennia past seem to revel in. It is equally likely that this distrust extended to the mecanicum itself, at this point in history a far more diffuse and decentralised body than the adeptus mecanicus it would become. Although not merely in possession of the substantial and indeed emperor bequeathed arsenal, a forbidden and described an outright techno heretical devices held by the first legion Dark Angels, the Ironhands possessed one of the most formidable arrays of arms, armaments, and technology of the entirety of the legion as a startes, including vehicles, weaponry, and armor of rare and hard to maintain patterns, far in excess of similarly sized legions. Additionally, they were often involved in the spearheading of new military technology applications, such as the case of the Gorgon pattern tactical dreadnought armor. A significant quantity of the Medusin caches, however, were placed off limits to the legion by order of Ferris Manus himself, marking as proscribed technology to never be unsealed unless by his express order.  To even render acknowledgement of their existence, an official record is tantamount to Heratechnica under the doctrines of the Adeptus Mechanicus. They are fowl beyond imagining a product of such demented science that one cannot even fathom either their means or the will that drove their development in the first place. The name is itself deliberately laden with portents of doom, idolent of the cathonic underworld goddess of Medusin mythic tracts and is in effect misleading. The Keys are not in actuality a single device or even necessarily a series of devices, but an umbrella term for a set of technologies that all contributed to or were part of the same end goal. Names whispered across time they are The Eight Sleepers, The Age of Sign Protocol The Aggression of the Seventh Gate, The Ophidian Scale The Terrible Sacrosan Formulae All were the Keys and when the Keys turned the result was cybernetic resurrection The powers of cybermancy, nano-mechanical augmentation, manipulation of the motive force itself the dead were returned to life in the state of their existences. That this process is ill understood is almost certain. Even if the master of the iron hands had discerned its secrets, what he found was apparent enough that should any technology encountered by the Primarch or the clan Iron Fathers of the 10th Legion would deemed be Keys adjacent, they were immediately seized and sequestered either in the vaults of Medusa or upon hidden legion armories and archives even cold lost dead rocks throughout the span of the galaxy if records are to be believed even the Mechanicum was not aware of the Legion's possession of the Keys and should they have been, one can only imagine, the crisis between Mars and Terra that we have emerged because of it representing, as they did, of course, heretical technology that was utterly abhorrent to the writ of the machine god that the Keys function in precisely similar fashions but all work towards and deliver upon the same effect, life after death resurrection of body but not of soul a sacrosan wave generator, for example, channels a form of exotic energy of unknown origin to reanimate dead flesh other elements of the Keys integrate animating technologies at a cellular level and, when combined, can stimulate and perpetrate the motor functions of, say, an Astartes, especially one with heavy cybernetic augmentation, perhaps in perpetuity as for what happens to the soul several now quite dead Mechanicus magi have attempted to postulate upon the fate of it once a human is returned to life by the Keys yet no conclusion has ever been reached most additionally do not even remember their former lives or, if they do, typically only fragments of who they were remain from what records exist it appears only the strongest and bluntest emotions remain especially those most present at the time of death serving post resurrection as a semblance of personality a Gola thing rather than the person who was at least some amongst the broken remnants of the iron hands turned to using in the aftermath of Istvan 5 having lost two thirds of their legion, their primarch, and effectively their sanity with their fleets fleeing from the combined arms of nine traitor legions the desperate survivors, led by what iron fathers remained turned to literally forbidden measures to enact their vengeance on those who had wronged them the bloodied and burning with a fury that was born of betrayal and deep psychological damage they turned the keys and utilized recovered hell technica to resurrect the dead of Istvan to continue the legions war according to surviving records obtained from the ships of the shattered legions certain iron hands managed to retain some notable semblance of their original selves as reported to have stated, most only remembered how to hate whatever facet of the technology that powered them into this wretched unlife, it is unclear if the negative emotions retained so strongly were the result of the keys themselves or simply indicative of a wider and incredibly deeply ingrained trauma present in the iron hands that witnessed the death of Ferris as this same Gola Astartes noted the logic fails after a while have you noticed that? the pure flow of data and reason after a while it just runs out you are trying to understand, to bargain with the reality of what has happened but there is no understanding to be had, no bargain to be made the way of iron, the logic of the machine is us above flesh but it was a lie iron can shatter, logic can be flawed and ideas can fail and fail they and their primarch had but they were not creatures for whom such an outcome could enmesh with their conceptual reality they were sundered things adrift in a universe overhand, driven only by hatred and madness as that quote has shown, the pillars of logic of the machine of their strength were broken what more did they have? what sporadic reports remain of encounters between these shattered legion Gola and the traitors of Horus Lupacal are few and far between but, and Astartes is a phenomenally effective soldier even more of the mystery was the ultimate faith of those iron fathers who willingly used the keys on their departed brethren to continue their own personal wars against the war master aspects of keys technology continue to exist if reports of a sacrosan generator in the calyxus sector are to be believed but of the secrets of the rest, none can say during the age of darkness, Gola, Astartes prowled the stars, enacting vengeance wherever they sought to it is quite likely that the technology that made them perished with the same iron hands that wielded them howling their rage into the dark as their ships were torn apart by traitor macro cannon fire ultimately what are we left with? judgment judgment of those who were betrayed do their actions deserve it? or perhaps our pity? both? that is a personal question only you may decide war as is so terribly often the case makes devils of us all of a imperator gloria this video and this channel were made possible thanks to the very kind donations and support from my patreon subscribers if you'd like to help support the channel head on over to patreon.com slash oculus imperia if you'd like to receive more updates about the channel and any future videos you can contact me or follow me on twitter at oculus imperia otherwise please like subscribe comment let me know your feedback and as ever thank you very much for watching


The slave bought specifically for the role of a breeder.  And the worst part was that he could never say no. Known as Padaseka, he was the slave bought specifically for the role of a breeder. Because he stood at two meters and 18 centimeters tall, they believed his children would be strong. He was highly intelligent and obedient. As a result, while the other slaves worked in the fields and performed heavy labor, Padaseka had the role of engaging in relations with hundreds of different women every day. As Padaseka's children were consistently born strong and healthy, he began to receive increasing privileges. He passed away in 1958, leaving behind over 200 children.