oops okay thanks Andrew we're good to see you I hope you can all hear me okay online thanks Andrew once again hi Sanjay hi Daniel hello there yeah good to see you hey coffee hey good morning good evening over where we are from hi Lucy hey Sam hi Shani good good good thanks for joining let's let's pray we'll get started okay father we thank you we honor you today we love you Lord we in everything that is happening around us Lord we want to silence our hearts fix our eyes on you Jesus it is very easy for us to be overwhelmed and get lost with everything that is happening around us with regards to life and studies and careers and fear of tomorrow anxieties and whatnot Lord as your word says and your as your word has commanded us to be still and know that you are God Holy Spirit I pray that this morning even as we prepare our hearts to learn about you to minister healing and deliverance Lord I pray that we will simply be still and know that you are God you are suffering in everything that you do Holy Spirit you are the spirit of wisdom we invite you this morning to pour out your wisdom over us to help us understand your word I pray in Jesus name amen okay great all good fine okay today let's we're going to start with chapter 3 we finished we've completed chapter 2 at chapter 2 in itself is quite an extensive chapter it's a long chapter there's a lot of information in chapter 2 but we've just completed chapter 2 in the last class we will now move into chapter 3 called the father's works what I want to do is I want to combine chapter 3 and chapter 5 if that's possible in the time that we have okay and then we look at chapter 4 separately okay we'll try and combine chapter 3 and chapter 5 alright so but let's look at chapter 3 chapter 3 is really very simple you know it just only talks about Jesus and there's a lot of scriptures from the gospel according to John gospel according to John I it's a very unique gospel right but in the whole gospel of John I mean there's a lot of things that happens but in my opinion it's like one big big love letter between the father and the son you know it's like the father is constantly telling I love you son I love your son I love your son and then son is saying I love your father I love your father I love your father did you get what I'm saying okay it's so the gospel according to John is one big love letter between the father and the son and so that's what this chapter is all about you know where Jesus is testifying about healing and deliverance about everything that he is doing okay so let's look at chapter 3 it the whole chapter it starts off by saying the first line it says the Lord Jesus came to do the works of the Father the Lord Jesus came to do the works of the Father okay now if we were to ask this question to if I were to ask you these question hey why did Jesus come Jesus you would say Jesus came to die on the cross Jesus came to forgive our sins Jesus came to do this Jesus came to do that etc etc but very rarely you will hear a person that will say Jesus came to do the works of the Father okay so can everybody say that why did Jesus come Jesus came to okay not very convincing come on guys okay you're you're saying it like as if you came to do the works of the Father yeah I've sent okay so where did Jesus come Jesus came to do the works of the Father okay if you have a highlighter highlight that line because that's what we're going to be looking at okay let that sink deep in okay let it sink deep and only when we understand that line when we we will understand what he says in John chapter 20 in John chapter 20 Jesus says as the Father has sent me I send you okay can I say that again as the Father has sent me I send you that means as I came to do the works of the Father now I'm sending you to do the works of the Father that means when you and I minister in healing and deliverance we are also doing the works of the Father are you with me yeah it's so basic it is so fundamental to you know our Christian faith but it is so profound and so powerful okay so we are called to do the works of the Father just like Jesus Jesus was asked a lot of questions and which we will look at in just a moment about you know there's this time where some Pharisees ask if you are really the Son of God please tell us plainly that you will understand okay please you know has anybody asked you this question or as a kid you played a game saying it's like please tell me the answer please tell me the answer please you know it's like you ask a puzzle or a tricky question you mess with someone's head and they give up it's like I give up I don't know what the answer is this please please please please please tell me you know I think some people went mad like that it's like okay if you're the Messiah please tell us plainly who you are but you know what Jesus did as a response to prove his divinity or to prove that he is a Son of God he could have said he could have pointed to his virgin birth you know that his conception and how he was born yes or no right he could have pointed to angels that sang when he was born he could have pointed to that star that was shining and how the East wise men traveled so far just to meet with Jesus could have pointed to any of that later on but he did not point to any of those supernatural things it instead Jesus always pointed to the works that he was doing what was the works he was measuring healing and deliverance and the miracles that he was doing he always pointed to the miracles that he was doing to prove that he is the one are you with me okay so let's look at this you know John chapter 5 in your notes John chapter 5 was 31 to 36 talks about John the Baptist a greater witness than John the Baptist now so John chapter 5 was 31 to 36 it says if I bear witness of myself my witness is not true there is another who bears witness of me and I know that the witness which he witnesses of me is true it's like a tongue-twister no Betty butter bitter butter but you know all that so yeah you know you have sent to John and he has born witness to the truth yet I do not receive testimony from man but I say these things that you may be saved he was the burning and shining lamp and you were willing for a time to rejoice in his light but I have a greater witness than John's for the work which the father has given me to finish the very works that I do bear witness of me that the that the father has sent me okay this is the beginning of how Jesus is pointing to the works that he is doing bears greater witness than that of John the Baptist what was the witness what was the testimony of John the Baptist about Jesus what was his testimony about Jesus right we don't the Baptist introduces Jesus to the world two times in a way in a sense so the second time he introduces Jesus to the world by saying I baptize you in water but then he who comes after me will baptize you in spirit and fire right that's the second time what's the first time thank you behold the lamb of God who takes away the sins of the world John the Baptist is literally introducing Jesus to the world hey behold the lamb of God that means he's being a witness to who Jesus is you know the verse 31 it's it starts off by saying if I bear a witness of myself my witness is not true what does that mean you can't testify for your own self okay so let's say I committed murder okay okay or I can't go and stand in front of the judge and say I did not do it I'm innocent I'm lying one but then I'm also trying to bear false witness right but the judge will say okay hey I can't take you for your word is there any someone else who can testify to what you're saying is there any other witness that saw you and that and say that okay no he did not do it are you with me right and so that's that's simply what the first line means in verse 31 if I bear witness of myself my witness is not true so Jesus is saying hey I am not saying I'm the son of God I'm the son of God I'm the son of God all those there are so many times he's done that in the gospel of John but he's saying you know more than the witness or the testimony of John the Baptist more than what he you know that he acknowledged and he recognized he introduced me to the world more than that the works that I do bear greater witness about me because I do the works of the father this is very powerful guys okay and I really hope that it sinks in to us because this that's what this whole chapter is all about and the reason I wanted to combine chapter 3 and chapter 5 is it's because it's linked and how you know how would Jesus ministered and what he did and why he did what he did okay now we know that John the Baptist kind of introduce Jesus to the world but it's the same John the Baptist later on in Matthew 11 seems to have a little bit of a doubt Matthew 11 was 1 to 6 it says I'm again reading all of this from your notes okay it says and now it came to pass when Jesus finished commanding his 12 disciples that he departed from there to teach and preach in their cities and when John had heard in prison about the works of Christ he sent two of his disciples and said to him are you the coming one or do we look for another Jesus answered and said to them go and tell the things which you hear and see the blind see and the lame walk and the lepers are cleansed and the deaf here the dead are raised up and the poor have the gospel preached to them so once again Jesus is referring to what his Jesus is referring to his miracles yeah his miracles thank you to the works that he is doing okay when when John the Baptist is in prison he sends his disciples to find out okay hey what's up what's who who are you really you know but then again Jesus is referring to the works that he is doing okay let's move on to the next section I must do the works the father's works I must do the father's works John chapter 9 was 1 to 7 let's read that now as Jesus passed by he saw a man who was blind from birth and his disciples asked him saying Rabbi who sinned this man or his parents that he was born blind Jesus answered neither this man nor his parents sinned but the works of God should be revealed in him I must work the works of him who sent me highlight that okay verse 4 I must work the works of him who sent me while it is day the night is coming when no one can work as long as I am in the world I am the light of the world when Jesus had said these things he spat on the ground and made clay with saliva and he anointed the eyes of the blind man with the clay and he said to him go wash in the pool of salon so he went and washed and came back seeing so the key verse of that entire chapter or the passage from John chapter 9 was 1 to 7 is verse 4 again he's saying I must work the works of father so Jesus is passing by he sees this blind man and then he's like okay you know he's reminding or he's reminded not reminded that would be wrong it comes to his attention that I have to do the works of the father right and which is minister healing to this person why because the works I do bear witness of me John chapter 10 was 24 25 and 37 and 38 please pay attention to those four verses as I read then Jesus surrounded him and said to him how long do you keep us in doubt if you are the Christ tell us plainly then Jesus answered them I told you and you do not believe the works that I do in my father's name they bear witness of me can you imagine the conversation right now I'm just reading it okay okay Jesus around it and they asked him if you tell us grace plainly you know it's like but imagine that I am having this conversation with like we are having this conversation Nelson is asking me if you are the Christ please tell me and I'm you know I told you well you're not believing what can I do you know it's the real conversation must be must what I've been okay so John chapter 10 was 25 remember okay these verse the works that I do in my father's name they bear witness of me once again what are the works of Jesus ministering healing and deliverance okay cleansing the lepers raising the dead healing the sick etc etc and then he goes on to say in the same chapter in verse 37 if I do not do the works of my father do not believe me just think about the weight of that statement he's not saying okay once again he's Jesus is not pointing to his supernatural birth hey don't you know how I was conceived don't you know who gave birth to me don't you know how I was born don't you know how many choirs you know how many angels sang for my birthday he doesn't say all of that instead he's saying hey believe me because of the works that I am doing so there was really something if Jesus has to say about you know he's constantly pointing to his works which is ministering healing and deliverance we need to understand the importance of ministering healing and deliverance it reveals the father it's simply it's what it is it reveals the father okay you all alive good okay how's everyone online doing okay I'm just gonna have a little bit of coffee the elixir of the gods okay so let's move on so the works I do bear witness of me and he goes on to emphasize it even more he says believe me for the sake of the works believe me for the sake of the works in John chapter 14 verse 1 to 13 again I would love to read the whole past actually let me read it for us John chapter 14 verse 1 to 13 let not your heart be troubled you believe in God believe also in me in my father's house are many mansions if it were not so I would I would have told you I go to prepare a place for you and if I go and prepare a place for you I will come again and receive you to myself that where I am there you may be also and where I go you know and the way you know Thomas said to him Lord had to be Thomas Thomas said to him Lord we do not know where you are going how can we know the way so it is in this context Jesus says I am the way the truth and the life so disciples of Jesus have spent enough time with Jesus and Jesus is saying okay you know I'm you don't know where I'm going and then Thomas says Lord we don't know where you're going how can we know the way and then Jesus answers amazingly that I am the way the truth and the life no one comes to the father except through me if you had known me you would have known my father also and from now on you know him and have seen him Philip said to him Lord show us the father and it is suffering for us Jesus must have gone okay Jesus said to him have I been with you so long and yet you have not known me Philip he who has seen me has seen the father so how can you say show us the father do you not believe that I am in the father and the father in me the words that I speak to you I do not speak on my own authority okay the words that I speak to you I do not speak on my own authority but the father who dwells in me does the works believe me that I am in the father and the father in me or else okay here we go saying believe me that I am in the father and the father is in me or if that is too much for you, believe me for the sake of the works themselves. If it is too much for you to believe that I am in the Father and the Father is in me, and if it's too much for you to believe and understand that if you've seen me, that you've seen the Father, if all of that is too complicated and too theological, just look at the works that I'm doing and believe in that. And that is more than enough. Believe me for the sake of the works themselves. Are you all with me? Yes? Okay. The next section talks about Jesus walked with the Father. How did Jesus walk with the Father? What was his relationship with the Father? We need to press in to walk in similar manner with the Father. So can we just pause here for a minute and Jesus, the Son of God, He's God incarnate in flesh, right? Philippians chapter 2 says Jesus who God himself did not consider to be equal with God but he took on the form of the man in flesh. Jesus co-equal with God, second head of the Trinity. He was always, he has always existed from before time began and in the Gospels time and time and time again Jesus says, I do what the Father tells me to do. I say what the Father tells me to say. What I each is not my own thing. Imagine, let's think about the humility of Jesus and the intimate walk that he had with his Father. In John chapter 1 verse 18 it says, no one has seen God at any time. The only begotten Son who is in the bosom of the Father, he has declared him.  This semester? During this semester. Okay. Yeah, this yeah so that verse is used quite a bit in the topic of Christology and how that he says no one has seen God at any time the only begotten Son. It simply means to say that he existed before. That's simply that's what John chapter 1 and verse 1 and 2 and verse 14 says, isn't it? In the beginning was the word, word was with God and the word was God, right? So he walked with a very close intimate relationship with the Father. John chapter 10 verse 15, as the Father knows me, even so I know the Father. I and the Father are one. That's John chapter 10 verse 30 and the Father loves his Son. John chapter 3 verse 35, the Father loves the Son and has given all things into his hand. Verse 10, 17, therefore my Father loves me because I lay down my life that I may take it again. John 8 54, Jesus answered, if I honor myself, my honor is nothing. It is my Father who honors me of whom you say that he is your God. John 15 10, if you keep my commandments, you will abide in my love just as I have kept my Father's commandments and abide in his love. John 16 32, indeed the hour is coming. Yes, has now come that you will be scattered each to his own and will leave me alone. Yet I am not alone because the Father is with me. Like I said in the beginning of this class, the Gospel of John is like one big love letter between the Father and the Son. I love you. You love me. You know, he loves me more. I love him more. Right. And because I love him, I do his will because I love him. I speak what he says because I love him. You know, I will obey his commandments and and everything I say to you is what he teaches me to say, what I've heard him say. Right. If there was one person who could have walked on this earth and not have to pray, it was Jesus. Can I say that again? If there was one person on this earth who did not have to pray, it was Jesus. Yes or no? He's the Son of God, the God himself. Right. But time and time and time again we see that Jesus went to a quiet place while it was still dark. He went to a secluded place, right, to spend time and pray and and just hearing from God. So how much more should we, how much more should we, do we have the same passion and desire and seal to talk about the works of the Father like Jesus is talking? Are we so much in love with our God that we will talk just the way like Jesus did? Right. There's so many verse after verse after verse after verse and I hope it really inspires us to walk in such intimacy with our Father just like Jesus did. Okay. The remainder of the of the chapter is pretty much similar to everything what we want to cover. Jesus is talking about the works of the Father doing what he says, what the Father tells him to do. Let's move to chapter five. Let's look at chapter five. Chapter five is titled The Secret to Ministry as Demonstrated by Jesus. The Secret to Ministry as Demonstrated by Jesus. So what were the keys or the secrets to Jesus' ministry? Okay. So now we know that everything what he did was what he saw the Father do or what the Father told him to do or what the Father taught him to do. And so let's look at some of the practical aspects of it as well. So there are four keys, four important keys or secrets to ministry as the Lord Jesus demonstrated. First one, ministering out of intimacy and obedience, ministering based on the finished work of the cross, ministering from a place of dominion and authority, and ministering through the presence and the power of the Christ, of the Spirit. Okay. John chapter 15 verse four, five seven, seven. It says, Abide in me and I in you. As the branch cannot bear fruit of itself unless it abides in the vine, neither can you unless you abide in me. I am the wine. You are the branches. He who abides in me and I in him bears much fruit for without me, you can do nothing. If you abide in me and my words abide in you, you will ask what you desire and it shall be done for you. And John chapter 15 verse nine and 10, same chapter. As the Father loved me, I also have loved you. Abide in my love. If you keep my commandments, you will abide in my love just as I have kept my Father's commandments and abide in his love. Okay. So ministering out of intimacy and obedience. You know, I'm sure I've used this statement before, at least in praise and worship, a statement I will never forget what my friend said in 2011. We were having a very casual conversation after coffee and he said, with intimacy, God will use you. Without intimacy, you will be using God. I'll say that again. With intimacy, God will use you. Without intimacy, you will be using God. Have you ever felt being used in your life? Someone is using you just for your skills and your gift? I feel used by this person. All they care about is my talent. They don't really care about the person of who I am. Have you ever felt that? Is it a very nice feeling? It's a very cheap feeling, isn't it? You feel so cheap and it's like, all they want is my talent. They don't really care about the person that I am. No one is felt. Okay. Very good. So what is the point is, let's say I have no intimate walk with Jesus, okay? And let's say I am the worship leader in this context. I am the worship pastor. I serve as a worship pastor of all people's church. From Monday to Saturday, I live in sin. I watch what I'm not supposed to watch. I say things that I'm not supposed to be saying. I do things I'm not supposed to be doing. But Sunday morning, take the guitar. Here I am to worship. Here I am to worship. I never know how much it cost to see myself. Oh, thank you, Lord. And worship service is over. You're wonderful people. You come and tell me. It's like, Roshan, Brother Roshan. The worship was so powerful. I felt his love. You see, I would have not walked in intimate relationship with the Father through the week. But when I pick up the guitar and I just sing song and I lead in worship, God will show up not because of me, because He loves you. Are you with me? Jesus will show up. He will touch you. He will overwhelm you with His love, not because I am singing, here I am to worship, but because He loves you. But what have I done? Did I allow God to use me or did I use His goodness and manipulate His goodness? It's not a trick question, guys. Come on. Yeah. And so remember that. And that statement, that conversation with my friend has ever stayed with me, and I will never forget it, is with intimacy, God will use you. You spend time with Him. You pray and you read His Word, study His Word. You love Him. And then He will begin to pour out His secrets. Some 25 says, those who confide in the Lord, He pours out His secrets to us. And so when we spend time with Him, He will tell you, okay, hey, this is the plan that I have for you. I want to use you mightily in this context, in the area of healing and deliverance, in the area of worship.  That is God wanting to use you, versus you can manipulate God and use His goodness and just to gain popularity or stay in business. So Jesus walked with intimacy, that's the first part, with the Father. And again, I would have done this, I would have broken this word down, intimacy. In the last semester, it simply is what, into me, you see, because I show you. Into me, you see, because I show you. Now we are about, how many, 12? Okay, 12 in this classroom, in the physical classroom and 23 online. So, yeah, they're about, I don't know, 35, close to 40 maybe. How many of you know me personally? Like really well, someone raised their hand. What's my favorite color or what's my favorite food? That shouldn't be hard, but favorite color is red, okay. Someone, yeah, my wallet is red, my car is red, my bag is red. So there are so many things, let's say, as aspects in my life, that you might not necessarily know. That's not, which is fine, but the point is, and you might not know what angers me, you know, what angers me, what disappoints me, things that I don't like, et cetera, and all that. But if we spend time together, we become close friends, we build that intimate relationship, you will know, okay. And if someone comes and asks you, he's like, hey, his birthday is coming, you know, what should I gift him? I say, oh, no, he doesn't like that, he likes this. You with me? You get, understand what I'm saying? Why? Because of our intimate relationship, and I have made myself vulnerable to you. I have allowed you to see into me. Into me, you see, why? Because I show you, I'm willing to show you. It's the same thing with the Father, with our God in heaven, is that if we just spend time to sit with him, to seek him, to seek his face, there are things that he wants to open up, and reveal to you, that he can only do it with you. And that is intimacy, and that's the kind of intimate relationship that Jesus walked with, his Father, right? And he just did not walk with intimate relationship. It says he walked with obedience, right? And I've said, we make this declaration all the time, and the last line of a declaration is absolute surrender. And to you, I am in absolute surrender. And that absolute surrender simply looks like radical obedience.  That means Jesus lived a life of radical obedience. Philippians chapter two, it says, you know, he was obedient to death, a death even on the cross. He was obedient. This is God, guys, we are talking about, right? So Jesus ministered out of intimacy and obedience, and he's calling us to be obedient, because obedience is a language of intimacy, okay? Obedience is the language of intimacy. You can write that down, hashtag it later. John 14, 15 says, if you love me, keep my commandments.  Okay, ministering based on the finished work of the cross. Matthew chapter eight was 16 and 17. That's the second point, how Jesus ministered the second key or a secret, so to say, ministering based on the finished work of the cross. Matthew chapter eight was 16 and 17. It says, when evening had come, they brought to him many who were demon possessed, and he cast out the spirits with a word and healed all who were sick. That it might be fulfilled, which was spoken by Isaiah the prophet saying, he himself took our infirmities and bore our sicknesses. So what is it saying? So it's saying in verse 16 that Jesus ministered healing and deliverance. Why? Because in this next verse it's written based on what is written in Isaiah, that he himself took on infirmities and bore our sicknesses. Okay, look at me. Tell me, has Jesus gone to the cross already? Here? No. No, isn't it? There's still time because Jesus has not yet gone to the cross. He's not tested by trial and whatnot. So what is happening? Why is Jesus, Matthew is quoting a scripture from Isaiah. It's simply saying that in simple words, Jesus was making a down payment or an advance payment that Jesus knew that he was going to go to the cross. Jesus knew that he was going to pay their prices. Yes? Okay, and so he ministered based on the finished work of the cross. So for Jesus it was like he knew, okay, I am going to do the work of the Father. I'm going to endure the cross. I'm going to die on the cross, rise again. And so he ministered healing and deliverance to everybody who was present at that time as an advance payment because he knew that he was going to shed his blood for them. And so now we are on the other side of the cross. Yeah? So payment is completely being made and so we are being encouraged to minister based on the finished work of the cross. Right? By his stripes we are going to be healed. Oh, by his stripes we are going to be healed. We are healed, isn't it? And so, you know, we need to let that scripture sink in really and understand the power of that. And secondly and thirdly, ministering from a place of dominion and authority. Ministering from a place of dominion and authority.   I know who you are, the Holy One of God. So what's the context there? Jesus has crossed the lake and he's gone to the other side. And then there comes a man who is demon possessed, right? Legion. But the demons recognized the power and the authority that Jesus was coming in. And the demons say, it's like leave us alone. What do you want us to do? You know, what do you want with us? Just let it be. I know who you are, the Holy One of God. Verse 36 of the same chapter, Luke chapter 4 verse 36.  For with authority and power he commands the unclean spirits and they came out. Okay. For with authority and power he commands the unclean spirits. Now we can spend an entire semester learning about the words authority and power because they are two different things. They are not the same thing. Okay authority is different, power is different. Okay. And like I said, it's a subject for another day. And then it goes on to saying Luke chapter 10 verse 19. Behold, I give you the authority. I give you the authority. Why is Jesus not saying power? Who gives us the power? Yes. Thank you. Someone is awake. Thanks Nelson. Right. So Jesus has commissioned us. So authority comes with the commission. Hear me out. Authority comes with commission. That means just as the Father sent me, I send you. That's commission. That's authority. I give you the authority. But the power comes with the Holy Spirit. So Jesus says, tarry around Jerusalem. Don't go out until I tell you when. Why? Because you have the authority, but you also need the power to go and be my witnesses. Are you with me? But Holy Spirit has been given to us. Now, so now we have authority and power for us to go out and minister healing and deliverance. So first three points is what? Minister healing and deliverance based on intimacy and obedience, finished work of the cross, dominion authority. And finally minister through the presence and the power of the Spirit, which we've just spoken of. Right. Jesus operated with the power of the Holy Spirit administering healing and deliverance. Okay. So if Jesus did everything what he did with the power of the Holy Spirit, how much more should we walk in? Okay. Jesus is our absolute standard. Okay. If you don't remember anything what you learned from this class, it's okay. I guess we just go back and see how Jesus lived his life. He is the standard.  Right. Which is fine. It's absolutely fine to honor and acknowledge the anointing the another person is carrying. But our standard, our absolute standard must be Jesus, has to be Jesus. Right. We do because he has sent us. He's commanded us to go and do. So let him be the standard for your basis of ministry. Understood. All good. Okay. Cool. So yeah, we'll pause here. We'll take a break and we'll resume the next hour. Thank you.


How important was your change-up for you tonight? How important was your change-up for you tonight? Yeah, very important. They're an aggressive team. They can hit very well. They can recognize fastballs very well.  And what do you think of the job the bullpen did after you? The bullpen was phenomenal, you know.  And after that, you know, they were just phenomenal. I don't think they allowed a hit. So it's what we expect of the bullpen. We have a phenomenal job.


Starring us off this morning is Marie Fromm.  Take it away, Marie. Thank you.  So anyway, a little bit about who I am. I work in InfoSec, cryptography, and I'm trans. I've done a lot of stuff over the years, incident response, security testing, reversing, security architecture. And for the rest of my career, I really want to fix things. I see there's a lot of people that throw bricks through windows and stuff, and I want to work with builders to actually fix stuff. And I think it's really important because right now there's a lot of really negative things happening because we are failing at security so badly.  Now, what kind of got me thinking about this talk was something that affected probably most of the people in this room was the Equifax Neighborage. And they had the CEO up in the stand and they were asking, one of the questions was obvious, it was, well, was your data encrypted? He actually said he didn't know, which was amazing. So I was just stupefied by that first off. And then the thing that really, really, really upset me was after they kind of issued some clarifications that said, well, maybe someone was encrypted, maybe someone wasn't, but encryption doesn't really help. And then you saw the pundits in all the columns and stuff about, well, yeah, encryption doesn't really help prevent. And I just, I know that for the people in this room, I would almost guarantee that most of you would be able to encrypt something that I couldn't read. So I mean, that's kind of a basic thing and it makes statements that, well, encryption doesn't really help prevent data breaches is a really bad message. And it's partly due to the way things are being done, the way cryptography has been used, both on ground and prem and data centers and in the cloud. So I'm gonna talk through a few different areas. I'm actually gonna start on ground and talk about data center encryption that's oftentimes kind of typical. Here's a big storage frame, you'd find in a big IT shop. And the product slick, it's got all these cool things, strong data at rest protection, it talks about. And they go on and they say these are protected by AES which will protect top secret government data. So I mean, they make these claims and the EMC dude makes a huge sale, the execs feel good, our data's encrypted at rest. And, but let's talk a little bit about how these work before we get into the cloud. So system operation, it boots up, big hurricane machine. And actually I should make a, I started out this slide writing data written to Rust and I thought, oh wow, so for younger ones, in the old days we had these spinning rusty things that we wrote data to and now it's all flash, but yeah, you'll have to Google that shit, it's really great, great. But you know, it's, but the main, so these systems boot up, they're written in encryption key that's, you know, they try to protect it. And then all data written is transparently encrypted as it writes in the storage media. And then on reads it's transparently decrypted. And so there actually is no awareness to the server or the application that this encryption's happening.  And it's, we're encrypted at rest, right? You know, that sounds really good. So one of the things about this, if we look at this and say, how well does this kind of encryption protect our data? Let's say, say we had something like this and you know, it does meet compliance requirements, we check that box that, you know, hey, it's AES encrypted at rest. But what happens if we have a data breach? So attacker comes in, we'd actually do a flowchart, a real simple flowchart. Attacker tries to access the data. Was the storage frame on? Ah, bummer. The encryption did not protect our data. Was the storage frame off? Hey, we win. We protected our data.  So, you know, we look back at the storage frame example on the ground, you know, it protects against a pretty narrow model of threats.   They were powered down. They weren't spinning. So this form of encryption, if you think about this, this thing that people say, oh yeah, it's encrypted at rest. You know, it just protects against this very narrow threat. So when somebody says this, hey, my data's encrypted at rest, whether we're talking cloud or ground, you really need to dig a lot, lot deeper. So let's dive into the cloud. Now, first of all, I'll say, you know, not all data should be in the cloud.  And I'm not, I'm not here to bash cloud. You know, I think, you know, AWS, Azure, people are using it successfully in a lot of cases, but a lot of people are not thinking about cloud implementations of cryptography that actually protects data.  It's almost, it's staggeringly complex. There's so many different things you can do with AWS. It's like every week I get an email, the new things they're adding to it, and it's like, wow, wow, wow. And it's like, I don't know how you can stay up on it. But, and actually I'll say AWS does give you some primitives that can apply a certain level of encryption to do things reasonably well for certain use cases. But you really have to do proper systems engineering in this because if you don't, this stuff is not gonna be encrypted against the threats you care about. Like, you know, somebody actually trying to take over your system and steal your data. Now, you know, there is some interesting differences like in AWS, I don't know if you looked at it, but they've got different, they offer different geographies. And I'll just say some of them are kind of interesting like China has stripped out all the encryption, even the encryption built into the platform. It's got no IAM or two factor authentication. And so that might have some security implications in what you're building. So, so as we get into, let's take a really simple example. So a simple building block is S3 encryption. It's used for user for all sorts of stuff. It's a basic fundamental piece of technology for storing a chunk of data. Now, a lot of people don't necessarily realize this, but there's actually quite a few different ways you can encrypt S3 data. So there's a server side encryption options include server side with the key managed by S3, server side with the key managed by KMS or Amazon's key management service. And you can also do server side encryption with customer managed keys that you manage, say in a variety of ways, it could be outside of KMS. And then there's actually client side encryption options, which can make a lot of sense to encrypt data before I ever stuff it up in there. But just this very basic primitive of quote, encrypting data and S3 has got a whole bunch of different ways to do it. So like say I'm a dev and I'm trying to figure this stuff out and I look at S3 and here's this default encryption. It's a checkbox. That looks really good to me. I love doing stuff with checkboxes because I can go on, I can think about the application development, I can think about all this stuff, the wonderful things, the business benefits, my app's gonna do and I can check that box and security folks are gonna be happy. And there are some kind of interesting things about the way Amazon does this with the S3 encryption. They actually encrypt each bucket with a unique key, which is good. You don't have this shared key that unlocks a whole bunch of stuff. They encrypt the key itself with a master key that it rotates regularly. Yeah, that's kind of cool. Key rotation, critical part of controlling your encryption keys. Again, it uses one of the strongest block ciphers available. This is right from the marketing material, AES-256 to encrypt your data. So this looks really easy to me. I can check a box and I'm done. But it's not really that simple. And so for an analogy, I would like to talk about physical system. So taking this context of an S3 bucket where it's doing this automated encryption, if I apply it to a door, a door that I want to secure in a room that's got some stuff in it that I want to protect, I can go out and I can buy a really nice deadbolt. These are really good deadbolts. There's probably somebody in Lockpick Village that knows a way of opening these, but for most of us, I know I can't pick that deadbolt. I probably can't saw it. It's designed to not be beatable open. And imagine this deadbolt in front of this door and it's protecting people from going in, grabbing the stuff I'm trying to protect and walking out. So this is kind of similar to our S3 bucket. We want to make sure the right people are going in and getting our stuff. But I would kind of assert that that last example of saying apply the default encryption to S3 is a little bit like having this massive door, this really nice deadbolt, but leaving the key in the door. Now that doesn't really protect that data, right? Because anybody that can walk up to that door, they see and they can turn the walk.  Maybe to take it back to the controls you might have in a web application. Maybe they tunnel up through the floor, cut through the ceiling or punch in a wall. But if they can get in front of that door, that key's there, they just turn it and walk through. Grab your stuff and walk out. So this is kind of a design pattern that is not so great. Well, we can actually point to it, we can say it's encrypted, we can sign a paper that's encrypted at rest for this code encryption. But it's actually not really very effective in stopping people from walking out with our stuff. So there's a principle, the Kirchhoff's principle, that's kind of famous and says any crypto system should be secure if everything is known about the system except for the key that that can all be public knowledge. Well, if we're not managing our keys correctly or properly or securely or we're leaving them in the door lock, we certainly aren't really controlling this system from a cryptography perspective. We're failing. So just maybe I'm saying that if we check that little checkbox and say using S3 server-side encryption with keys that are managed by S3, which sounds so easy because it's just a checkbox, maybe that isn't the protection that we wanted or needed. So let's go on to the next way of encrypting data in S3. And remember, I'm just talking about one service in all of these different ways of encryption. I can use server-side encryption, but instead of having S3 managed keys, I can put those in AWS KMS, which is their Amazon's key management service. Now that comes with some kind of interesting things that I'm gonna dive into. There's a lot of different ways. You can set up Amazon KMS and I'm gonna get into those. So here's, I just changed the checkbox and I select the key that I provisioned in KMS and I'm off to the races. Sounds pretty good, right? Now, maybe I'm a dev and say, okay, well, now I just got to generate a key thingy and now I just encrypt and now I'm good. Now KMS can be used for a lot of things. They've designed it to integrate with all their services. You've got S3 buckets, EBS, Glacier, do long-term storage. You've got RDS for relational database services. So it is pretty cool. I can build this simplified infrastructure, somebody that's trying to build cloud apps and I'm just trying to get my thing out the door. I can use this KMS thingy to hold the keys and that sounds kind of good because well, because it says it manages keys and it's like, well, it's gotta be better, right? Well, let's dive just a little bit into KMS and see if some of the problems that we had with the key in the lock with the deadbolt if we can see how we can stay away from those. Well, Amazon's key management service is pretty interesting. And actually, as in everything Amazon, there's like five ways to do things. I can, in key management services, I can use AWS managed customer master keys, CM keys. And these are keys that are created, managed and used on my application's behalf by the AWS service that is integrated with AWS KMS. I can also use customer managed keys. So rather than just letting Amazon just kind of do it automatically, I can actually use a customer managed key and I can do some extra things with that. It's kind of cool, some extra controls that I would argue maybe wise on applications with very critical data. So these things, these include things like enabling and disabling the CMK, which actually is an important thing to come to later, is if something's bad's happening and you can detect it later on in the stack, I can disable that CMK and actually prevent it from being used. So I can re-rotate it's cryptographic material. I can also set up IM policies or identity and access management policies that cover access to that specific CMK. I can use that CMK and cryptographic operations and I can do encryption as part of my code, which is kind of cool. And but the important thing is I as a customer maintain control of that CMK. Now there's data keys and those live outside KMS. KMS doesn't manage or control those and there's customer master keys, key encryption keys and data encryption keys. So we've got a little bit more complex in that dev that just wanted to click a box and say, yeah, I want this thing encrypted. Now there's a whole lot of things to talk about or think about or design into. Multiple ways of encrypting with S3 and then if I use KMS, multiple ways of managing KMS. So some things you might be thinking about. It's like, well, what does this give me using doing customer managed keys? Well, I named a few of the benefits. Like I can do my own rotation, I can actually disable and there's some kind of cool things that I can do. It gives me a little more fine tune control and I'm gonna go into the permissions in a bit, which is even maybe better. But some of the things, when I'm generating keys, one of the things that's really critical to me is using a known good source of random. I think I believe KMS has got FIPS 140-2 rating and they're working on certifications, but picking random for a key generation is a really big deal. And in cryptography, we've seen this fail over and over and over and over again. It's like a long list of failures of poor random being used to generate a key and the system gets owned. So this thing about generating a key, you wanna really be careful or understand where your random comes from and that may give you a reason why you should be generating your own keys. There's also kind of another thing that another reason maybe to do this in customer generated keys is if you think about the clouds, sometimes they turn dark and stormy and violent. And if you don't have your cryptographic key material for your applications stored somewhere safe on ground, you could set yourself up for a pretty significant availability issue because now you've got encrypted data and no keys to access the application. But the selection of random and cryptographic key generation as I'm sure everybody knows here is a really, really big deal. So I'm gonna go slide back into the KMS and on that second option, customer mastery, CMKs that are customer managed. Wow, that's a hard one to say. Customer master keys that are customer mastered, managed. So there's, again, it's everything in AWS. There's a variety of ways. So we were talking the multiple ways of encrypting S3 and multiple ways of using KMS. And now we're gonna talk about multiple ways of applying controls to these keys, which is kind of interesting. There's three things that I can use to apply what controls access to these encryption keys. There's a key policy document that describes usage of the key I'll show you in a second. There's IAM policies or identity and access management policies. And these, you can use those in combination with the CMK key policy to allow access to a CMK. This actually gets kind of complicated to simulate. There's an IAM policy simulator tool that Amazon has provided to kind of help figure this out because I've been in the position of trying to review like what has access to this key and it is non-trivial to dig into sometimes. And then the third way of applying controls to this key is grants. And these are kind of cool because you can then specify with a high degree of granularity exactly what service and what thing can use use a key for and how. And that's really important. There's, and I'll show a couple examples of the key operators and how they can be different with grants, which is kind of neat. And they're an alternative to the key policy. So we started the S3 in multiple ways of encrypting, KMS, multiple ways of doing KMS. And now we've picked this one option, customer master keys, we've got multiple ways of doing this. There's a lot of permutations here and a lot of minefields for devs. Here's a simple key access policy and don't believe me, this is not real. So yeah, you own my system. So nothing about this, this is all fiction also. But this would be typical for a key administrator or a custodian. So this in key management, one of your principles is you want to have a separation of duties. You want to have people, maybe DevOps people and developers that are putting applications together and they have a permission to have an application, tie a given key to an application and that application has permission to use a key to do something. But then you typically have another team if you're doing it right, with a separation of duties that has management capability on those keys. And so this has got some things like disable, delete, schedule key deletion, cancel key deletion, revoke. So these are some more administrative level things when you have that separation of duties for key management. So this is, oh yeah, it's also possible to constrain a CMK so it can only be used by a specific AWS service through the use of a KMS via service conditional statement. So I can actually really nail this key down and say, this can be used for this one thing period which is pretty cool. I can kind of limit the usage of that key. Now here's kind of a couple of slides showing some differences of key access grants. Now I may wanna bisect my application and say, I have some internet forward-facing logic where people enter something into a form. And that's what they do. Random people connect to the internet, enter some stuff in a form and it goes in. There's an auth function, some other stuff. And then I got a separate team of people that work for the company that connect to the same system and they need to do some management functions. They need to do some lookups, maybe some edits, check some stuff. So if you bisect your application so you have the internet-facing logic and you have configured it, for instance, to where that internet-facing logic can only have access to the encrypt function of that key. That's all it can do. It can encrypt, period. It can encrypt. So even if that application gets owned, it doesn't have the rights via this grant to decrypt any data. So the attacker that got root on that box, they do not have the ability to decrypt data with this grant. Now maybe you have a separate network, maybe through a direct connect or a VPN where your people doing the management on the system, the maintenance of it or the application owners, they maybe, they quite likely need the decrypt function. So this is an example of using these different grants to give different parts of the application different permissions and help build a little bit more defensive depth into your app and say, the internet-facing stuff, we don't want them to ever be able to decrypt any data. So I've been talking, I was working my way through S3 buckets and encryption. Now there's the last one, server side encryption customer with keys that you manage, maybe outside KMS or with a different system. And then there's also client side encryption options. And I really do like those because you get a fine grain control over your data of what you're encrypting. If you think about it, if I control the encryption, I get data encrypted before it's ever stuck in S3, I don't have to worry about what happens when somebody screws up permissions on that bucket or changes on ACL or something like that. I think that's consistent with ISO 27040 using encryption to actually create these partitions of who can access things. And I think that that client side encryption, if you encrypted before you put in S3, you won't be in the headlines about, and you manage it, you keep those keys secured and that full process that encrypts the data and acts on it, you will not be in the papers, which is really good. So, you know, there's also not just the door. And I think one of the things, you know, to extend this a little bit and kind of the story I'm building, if you know that first story I talked about that door and I've got that awesome deadbolt on, I can point to it, say that's my FIPS 140-2 rated deadbolt and you know what, I can't beat this thing open, I can't pick this lock, but I'm gonna leave the key in the door and people walk in and out of my stuff on screwed. Now, you know, I don't know how many of you have been to a commercial data center, but the process to get in is typically a little more involved. You walk up to a bulletproof window and you provide your identification. They perform visual identification against your ID. They then look in the computer and see if you're authorized to be there and say, yeah, you have a ticket to go in and do X and Y and Z at this time, this all looks right. And then rather than you going and turn the key in the lock, they buzz a door into a man trap and you're going that, and you stand there and to get out of the man trap and to proceed, you need some additional credentials with some badging and some two-factor token and stuff and then that gets you out and then you're in. Now, there's also, there's a human involved in these logging stuff that you went in there, you had a ticket to go in and do X, Y and Z.  Now, if I come in and I've made four trips in and out in a day, that's unusual. And if I try to hold boxes out, that's like double unusual because we're not supposed to be hauling boxes out. So it's like, that's a detective control built around that, you know, the authentication, the authorization check and all that. And so we've built a little bit more controls over whether I can walk out of the stuff. Now, with AWS, those are some of the things we need to be thinking of as we're building applications. It's not like, is, are we using strong encryption? It's not doing bupkis to actually protect the data. We need to build these controls, these additional things, these additional layers around the application to do this properly. So, there are other ways of managing encryption keys in AWS, of course, there are. There's many, many different ways to do these things. So, whoops, I just lost, oh, scared me. I thought, oh no, I went dark. I'm panicking. It's like my laptop's plugged in. It's like I was freaking out for a second.  So, Amazon actually has had a variety of things for doing key storage that aren't KMS. They had Cloud HSM V1 or the Classic HM. And that's just a, just a simple Gemolto hardware security module. A hardware security module, if you don't know, is this specialized box that's designed to have secure random generated encryption keys and protect them in hardware and tamper proof kind of systems to ensure that these keys can't be compromised. So, HSMs are used for serious key management, for keys that have some pretty big implication if they were ever to be compromised. So, if you're not familiar with an HSM, they had Amazon, they still support it in a couple of the regions. Cloud HSM V1, which is the Gemolto Luna. And they also, they produced an HSM V2, which is kind of interesting. They've kind of produced their own. And they submitted it for a FIPS review. And then, you know, there's third party key management solutions. I listed one, there's a bunch of different ways to do this. There's different HSM vendors, there's different key management solutions. And this is, you know, if I had like a data do this, I could talk about a whole bunch of different ones, but I got an hour or so and I kind of focused on one. But that's another thing that can keep keys securely. So, this is kind of interesting.  And it's, they got the stuff on it. It's got some interesting design aspects to it. I really encourage you, if you're storing encryption keys and you're doing it in hardware, should actually read these module verification documents. They're fantastic, they're a wealth of knowledge. And how these things are protecting encryption keys. And what kind of threats? And what was their threat model? What's the security boundary? And how are these tested? And what do they protect against? And if you dive into these NIST documents, it's a really cool way of understanding a lot better. And you can also ask some interesting questions when you're talking to the AWS people, for instance. So, as I talked about that option, you know, there's also HSMs that we use for key management from Jamalto, from Talus. Jamalto is a big player in this stuff. If you've got a cell phone or a US passport with a chip or a credit card, yeah, technology was made by them. I'm not a shill for the company, but they do make a lot of stuff. So, there's, this is an example of a pin entry device that's used with Jamalto equipment. And there's an important principle, it's sort of two-factor, we all gotta use 2FA now, that's kind of common sense. But there's some additional things in here and that we can use K of N or M of N operations. So, we say, we've got these five people on this team and we wanna have at least three of them come together to do this operation. You can specify that and say, we wanna do this operation to transferring these keys to this one to this other thing and we wanna make sure it's done in a very controlled manner, we wanna make sure there can't be collusion or an individual just can't go off the rails and say, I'm gonna steal all the encryption keys and go sell them to the Russian black market or something like that. So, with these kind of systems, you kind of get beyond the Amazon, hey, I have a key, I can do a thing and you say, we not only have a key to do a thing, but it takes multiple of us to come together to do a thing. And then, because we can set it at any ratio we want, say we need three of five or four, seven or whatever it is we want and to solve the, oh my God, Marie got hit by a bus problem.  So, this is kind of cool. Having more than one user request required to do critical encryption operations of such as transfer of keys and backing up of keys. Because remember that this whole confidentiality, availability, integrity, if we lose keys, that data is like gone. So, we've seen that in a few, being weaponized as a service now, but causing encrypting data and hiding your keys for ransom. But, when we're hosting stuff in the cloud, we really have to think about that. It's like, we wanna make sure that we can get this back, assuming an asteroid hits a data center or something like that. We wanna be able to get the data back. So, having a way of replicating keys across geographies in a secure way under a very controlled environment between like three trusted people or something on a team is a good way to do it. This concept of crypto officers versus crypto users. And, just, this is a total I chart, but there's actually some kind of cool things I'll talk about that, as we get into some of these third-party solutions that I think are neat. And actually one you can do is you can actually say, you know, maybe the keys, and you gotta use this, you gotta throw up all of your application, you gotta understand what is your data, what is your trying to protect, what is the blast radius if this is breach? You may actually wanna keep your keys on ground. You may not want them in the cloud.  We wanna have our hot apps call for those keys. That gives us a little bit more control. We can see what's happening. We can rack a little quicker. We know there's, you know, we know we own the keys in there. They were never up there. So, you know, push comes to shove, we can cut off access to it, and that stuff's encrypted. And nobody can get at it. But there are some kind of cool things. You know, if I've got my key management on ground, I can go into the data center and I can love it and touch it and watch it's blinking lights. It's just neat. It's cool. And know that it always right in the universe that my key is protected in a very safe environment. So, you know, that gives us, also gives us a fallback, you know, when the cloud turns stormy and black and parts of it evaporate because of whatever, we actually have our critical encryption keys. We maintain control of them. There's some kind of cool things we can do this as we start applying these third party solutions to encryption problems. So, let's take a database. And everybody's, you know, God, how do we encrypt a database? And, you know, running through a couple examples like, you know, if you use SQL Server Enterprise, last version, you'd use transparent data encryption. Sounds super easy. It is. It's really easy. It's turn it on and just use it. Just works. And your data's encrypted at rest, which is just pretty cool. Now, if you think about that threat model earlier and say, you know, well, what are the implications of this? It starts to analyze it. Well, one thing now that that's given me is by using the prior version of SQL Server data encryption, data encryption, transparent data encryption. So, I make a copy or if I make a backup of that database and throw it somewhere and leave it and don't set access permissions to it, that's actually encrypted. So, it keeps a person from getting at a database backup, which is awesome. Now, cloud introduces an interesting problem because, you know, on the prior version, you know, the transparent data encryptions, they may get the whole VM. You know, the whole running instance in the cloud. If they do that, you're kind of screwed because they got the encrypted data, which is in the database, and they got the key, which is in the registry.   So, one of the things you can do with the new SQL Server Enterprise, you can do key offloading. So, you say, I don't want to store the key in the registry, I want to store it in this strong key management system. Now, this can be actually in the cloud or actually on ground. And then with solutions like, with the gemalta solution, they take it a step further and they can say, they can apply an encryption, for instance, so you can say, these stored and stored procedures get privileged access to be able to utilize this key for a decryption. So, maybe I got a customer by lookup name or something and it has access to be able to get to this decryption key to this key to actually perform this customer lookup. And so, I've got these stored procedures that are defined in this application that can actually utilize this trusted connection to a strong key management and use these keys to perform operations. Now, when somebody does, somebody pops your app and they're doing a SQL injection, select stored users, one equals one. Hopefully, you didn't define that as a valid stored procedure, just saying. If you didn't, that won't be one of the stored procedures that can be used. And instead of vomiting up the unencrypted user table, it will vomit up the encrypted data and the attackers got this. There's some other things too, like with protect file, I can do things like apply some extraordinarily fine-grain permissions on files. So, I can say, I've got these files that have this really important data in them and I don't want to be able to get at them. And I can say, this service account ID running this binary from this IP, this machine, can transparently read and write these files into that application that looks like they're decrypted. But if I pop a root on the box and my shell is bash or whatever, I've got nothing, I just get, I get that data back in an encrypted form. So, I mean, those are some of the extended, more deeper layers of encryption we can apply to stuff. So, why would, why should I manage my own keys? I mean, Amazon's got a thing, they managed keys. There are some standards bodies and some frameworks that say, you know, maybe we should be kind of hanging on to our encryption keys. You know, this is a good one, high trust, you know, it has some verbiage in it. Well, you need to use validated cryptographic modules, that's kind of a no-brainer. You need to store keys separate from the data. And key management and key usage need to be separation of duties and keys shall not be stored in the cloud. There's also the new NIST that's the 853-5, which is in draft and I love the wine, maintain exclusive control of cryptographic keys. And remember, when you're in the cloud, you're running on someone else's computer, your keys are up there and I kind of parse this because there's ways of keeping Amazon from getting at it but there's, you're putting the keys someplace else where people that have access to that application tend to have access to it. So it's kind of a complicated question about, you know, it's not like Amazon gives away your keys, but by provisioning an application to use those keys, you can allow an attacker to utilize them as well. And they're way different than you intended that application to work.  So again, maintain exclusive control of cryptographic keys, I love that line. And so if an application makes sense to use Amazon KMS, again, you've got to look at your threat modeling, your application, what is the risk of the data you're storing up there? There's a lot of cases where it makes sense to use KMS. This extra stuff I'm talking about just, it doesn't fly, it's not worth the expense, the time, the configuration.  But you should use, if you're using KMS, you should only use the FIPS 140-2 certified endpoints. And they've got a table of them. That's one of the things people screw up on is they don't realize that not all endpoints are FIPS 140-2 certified. You have to design your system and architect it. So you've got a separation of duties and hopefully some, using split keys, K of N, Shamir is sharing secret, it's really cool to split up a key into eight parts so any four people can come together and rebuild that key. So no one person has all the information needed to own the thing, and you have Marie got hit by a bus problem. And then employ key usage, monitoring, alerting and responses. So right now AWS has best practices for using KMS. They actually say to do some things, but nowhere does it actually say how to do it. And this is really kind of, this is the hard part. You should be monitoring for data plane operations and control plane operations, but like data plane operations, quantitatively saying, you know, this application normally calls this decryption key 200 times an hour. It just called it 2,000 times in five minutes. Something very different's happening. So if I'm using those grants for instance, I can actually detect that and say, I don't know what's happening, but I think a lot of data is leaving the building and you can actually flip that and revoke access to that key until you investigate, do an incident response, figure out, hey, did somebody just breaching me and at least stop the bleeding. There's also control plane operations.  I would argue you should definitely know if something's happening to your CMKs. You know, delete key, schedule key deletion. It's kind of a big deal. You know, you do want to do that as part of normal key lifecycle maintenance, but that is a big deal. Also, you know, building systems to do this alerting. It's really hard work.  You know, this is kind of a, this is a really kind of a complex problem. I guess, you know, my approach, I have a girlfriend who has a PhD in statistics and she's really awesome at figuring out this kind of stuff. If I can tell her, these are the things I'm kind of looking for that I think represent a problem and she can help me build stuff. You know, this is the math. This is how we'd apply a statistics solution to look for that.  I don't know, just saying. That's, you know, I want to produce some additional stuff and you know, this would be like a full day workshop instead of a one hour talk, but there's kind of some principles on there. But anyway, encryption and key access controls, you really need to design a plan. I'm amazed at the number of devs that, or you know, when I analyze applications, we're made by third parties. It's like, you know, do you have the documentation of how you assign, you know, grants and I am policy and KMS policy? You're going to obfuscate all this stuff, please do. But do you have any documentation? He said, well, no, I guess the dev just did it until it worked.  I've seen that in third party apps, which is suboptimal to say the least. So you really need to build out that, you know, plan this, build out those I am policies, encryption usages and the context. And this really needs to happen in the application design phase. This is not something that I can just swoop in and fix some stuff later on. So in conclusion, encrypting data in the cloud, it's very complex. And I just led you through just something really simple. I want to put a thing in an S-free bucket. You know, there's all these different kinds of choices you have to make. And there's no, it's complex. There's no magic answers. But encrypting data to actually protect it in the cloud is more than just a checkbox. And you know, we tell devs to never write their own crypto, we've taught them that. But now with the complexity of cloud and some of these encryption solutions, a large number of design choices, we need to embed with devs and we need to help them implement cloud cryptography architecture. And that's gonna be really critical. I think that this is, we're not gonna get ahead of this problem unless we sit down with the devs and say, let's talk through some of the aspects, what we're trying to do. And multiple completely different ways of encrypting something, like a simple S-free bucket and a multiple ways of using KMS or external key management. So you need to think about the threat model. That is so, so, so critical. So we wanna make sure that attackers can't decrypt our data by virtue of standing in front of the door and turning the key.  We have to engineer these cloud cryptography solutions properly to protect the data. And just to recap, there is no magic crypto fairy dust that I can parachute in with at the end of a project and somehow sprinkle that stuff on there and secure an app, it can't be done. I wish I could, I'd be a millionaire, but you know, I do have glitter, but that's, I don't know. So anyway, I'm not sure where I'm at on time. It may be getting close. Yeah, we have about 10 minutes left for questions. If you have a question, please come on up to the mic. And if you don't feel comfortable, you know, we're recording this. So if you'd rather not be recorded on the mic, please approach Marie after the talk is over. So we have 10 minutes, come on up.


OK, so the idea for this this conference really came from a lot of discussions we had in each of the different ES hackathons, particularly where we started off in Stockholm. Thinking about how we can get evidence that this workflow is better embedded into INTA. So the first step really was to think about what is there, what's available. This is actually quite a tough thing to be able to do, but luckily for meta analysis at least we can find the CRAN task view and what that does is it points to packages that are being described by the maintenance as meta analysis packages and there's about 150 packages on that CRAN task view. You can see that the number of packages has increased over time from Pioneer here which was meta, meta, so very general package between meta analysis all the way through to the latest package on the list is NMA plateplot that's from very general but also quite specific packages as well that have been developed to help with meta analysis. Obviously the number of downloads, there's lots of biases in these but I wanted to find a way to really look at the other packages that are sort of rising above from what they would expect by the relationship between the number of the ASIMs and the number of downloads. Some of them are, some are quite astounding outliers. So up there in the top left hand corner you've got FXIs, that's a package that has probably the widest range of FXIs calculations I've seen, both Bayesian and Frequentist. Inter remains, it's quite an important one, it's used by, it allows the data format from Revman, so it's obviously quite important for systematic reviews. MetaBMA, another fairly relatively new one but also highly downloaded, looks at Bayesian model averaging for meta analysis, so really some of these things I'm going to be saying in this talk, it's about what is it that for you guys, you think, leads to a package being highly downloaded, how much you use it, so how are they all related? So for this bit I need to just come out of here, and come up here, it's an option mode and then we can have a look here. So I took the CRAN task view and I've looked at the dependencies of the different packages that they do there, so the blue ones are the meta analysis packages and the yellow ones or the gold ones are what I've called sporting packages, so they're packages that are like GGplot for example, which underpins some of the functions that lie within the meta analysis packages. There's about 500 of those sporting packages and you can see that they're by their sizes, the number of links that go to other packages. From the meta analysis packages side, not really surprising but basically all roads lead to Metafor. So a lot of the functions that underpin other packages in meta analysis, meta analysis packages are actually come from these Metafor packages. Metafor itself is linked to MLME. So Metafor is by far the largest contributor to other packages and you can see that even where a package doesn't have a direct connection, it's often connected through other packages as well. So Metafor has really facilitated a lot of the functions that are happening in these new ML packages. Let's go back to that point, let's read that so I can see what I'm saying, okay. So here we've looked at how they're related, so what do these packages do? So as a first point, let's start, we started to look at their package descriptions. What is it they say they do? Most of these packages, so this is a plot of the words in the descriptions and how they're related to each other and the size of the arrow is related to the number of times that information. So a lot of these packages about 40% are dedicated to running Metafor analysis. But these are for sort of different data types, so for survival data, for genetic data, correlations, you name it, there's a different Metafor analysis package for it. 11% of these packages are to do with effect sizes, converting effect sizes, yeah, I'll show you my pointer. And so there's quite a few of those. 7% of packages, sorry, are to do the sensitivity analysis here. And 7% of plotting functions mostly to do the final plots, but so are a few other 10 plots. And 6% to network meta-analysis, so there's quite a few of those that are coming through quite early in the Metafor analysis here. So what's next? These are sort of things really that are more like discussion points and perhaps questions for you, rather than the things that I should be doing. But one thing I'd like to do is update the current tasks for you, but adding these non-crime packages too, but I need to find a way to actually systematically find these specific packages. I would like to provide guidance to users on which package to go for, so if you have a specialist interest in a certain area of meta-analysis or you have a generalist interest in meta-analysis, where should you go? Which package should you go for? Over the next couple of days, I'd really like to start thinking, and for you to start thinking about identifying the gaps in the function. So what are you missing? What's not in these functions? Do we need your packages or can we just sort of incorporate those missing functions into assisting ones? Related to that, we need to identify a functional redundancy. So what do we have that we've got a lot of and don't need any more? I think FXI's conversion function is probably one of those things. There's lots that are really good in other packages, so we don't need to reinvent them.  Is it the documentation? Is it how versatile it is, how general it is, how specific it is? What makes a package useful for you? So if you have some opinion on that, you'd like to stick some information in the Slack for me, or you can send me an email, whatever you like, how are you on today. But I'm really just interested in your views on those things. So thank you very much and enjoy the conference.


Capitalism turns bodies into business, shame into profit, othering into cashing in. We're conditioned to hate our bodies by a world that profits off of the loathing it imposes on us. What devious lies they sell. Our bodies are not for profit. The price has been paid. All bodies are good. All bodies are valid.