Awesome. Thank you. It is, I'm going to just stop screen sharing for a second and say it's great to be here at the Linux Foundation. I am a Linux user going back to the early 90s when you would, I'm dating myself here, but when you would download a giant pile of floppy disks to install Slackware 0.8 on your machine. And I think one of the awesome things about, you know, the last 20 years in computing has been the rise of open source operating systems, open source languages, the ability to build things without being captured by some commercial entity who, you know, who wants to just kind of maximize revenue from you, but instead it's a collaborative effort. And that has really defined, in my view, the last couple of decades of computing. A little on me. I am now the chief architect at Sneak. Sneak SNYK stands for so now you know. We are a security company started out as an application security company. But with the acquisition of Fugue, which is the company I founded along with my co-founder who's here today, Andrew Wright, we're extending into the cloud as well. So our perspective is to have a single view of security from the application all the way through the deployment, etc. I'm not trying to give you a sales pitch, just trying to tell you a little bit about where we're coming from. Prior to founding Fugue, I'm a long time programmer and software architect. I was the CEO and CTO at Fugue in various phases of its development. But mostly I'm interested in building secure systems from a developer perspective, not as much from the kind of after-the-fact security perspective. We believe that most breaches, and we're going to get into in great detail some real breaches today. We're going to, as it says on the tin, we're going to deconstruct them. Those breaches are very much concerned with the cloud control plane API. And so that'll be the focus today. As Linux Foundation mentioned, we love it when there are questions along the way. So we will have some time at the end. This session will be about 50 minutes, give or take. But if there's something you want to explore or challenge or, you know, all I've been doing for about a decade is cloud security, something you want to dig into that I'm not digging into, go ahead and throw it up there. And Drew is going to help me keep track of what you guys or what you folks are looking for as well. So, all right, I'm going to go ahead and share my deck. I promise there aren't too, too many slides. We're going to spend a lot of time at the whiteboard and looking at things like DOJ filings and such for these breaches. But we do have a few slides. Okay. So the way hackers act and what hackers do is what security needs to be about in a practical world, right? We often in security think in terms of like, you know, risk management and so on and those things are good. You know, we need to do that. But what we're really concerned with is what hackers are actually doing. And so this session that's very much our philosophy at Sneak is we look at, you know, real breaches, real hacks and devised ways to protect against them, which is I think the only practical way to go about this. So there have been some huge changes due to cloud computing technologies versus the data center that have obsoleted most data center forms of security and protection. So if you look back at the old school data center, you know, it says hardware here. Obviously, there's hardware in the cloud, but you're not touching it. So in the data center, you're procuring hardware, you're going through some, you know, change control board process or some other process where you're deciding which hardware to run for performance, for cost and for security. You're doing that manually, you know, someone needs to go and slide something into a rack, plug it in, configure it. And that means the environment is relatively static. Because there's a ton of friction in that process of buying stuff, racking and stacking it.  So, you know, your server named Frodo is going to be sitting out there for three years. And you're going to be trying to maintain it. And when I say you, it's typically some kind of dedicated, you know, operations department more than the developers in the data center. The developers might give requirements to them, but they are not procuring things and bringing them online in the data center. There's this high friction manual process that goes on. All right. And the scale, even in really, so a little on my background, again, I've kind of split my career between national security kinds of environments and high tech companies. So I was at AWS before founding Fugue with Drew. And there I was the principal solutions architect for Department of Defense and some intelligence kind of world stuff. So I've seen some very highly secure and very large environments. And they tend to be only in the scale of thousands of components, which is small in the cloud world. That's very small. And they tend to be of a small number of like types of services. And by a service here, I mean a server or a router or a network attached storage device or a security appliance. You can typically count them, you know, they're in the few to low dozens, right? Well, when you go to cloud, things really change. They almost invert. In cloud, the hardware configurations are driven by software. Instead of it being a scenario where you get some hardware and then deploy software, you write software that deploys hardware. And it's all API driven. It's all programmable and done well. It is highly dynamic, meaning your footprint is going to change a lot as the system runs and evolves. You're not on a three year recap cycle. You're on a 22nd API provisioning cycle. And what that means is that developers and DevOps are creating the actual infrastructure. And by the way, this is how most cloud breaches happen is not through operating system exploitation, although there's often a component of that. It's mostly through the configuration of these cloud resources. So scale hundreds of thousands of components. So Fugue is now part of Sneak. Sneak acquired us in February to create this whole security vision of the entire system, this ability to see the entire system. But Fugue on its own was already managing millions of cloud resources for our customers in financial services, a whole lot of high growth, high tech companies, but millions of resources. And of hundreds of types. So when you think about any given resource in the cloud like a container or a managed relational database or a managed video transcoding service endpoint, all of those things have their own APIs. And that means all of them have their own types of exploits. And you cannot base your defense strategy, your security strategy on TCP IP network defense, because it's mostly useless in the cloud. There's a little to gain there, but almost nothing. Okay. And hackers have changed how they operate. We have this labeled as pre-cloud and cloud, kind of hard to know if coincidence or causality, but it is largely coincident in time. The pre-cloud version, kind of the Hollywood hack version, is the hackers pick a target. And this still happens. Some famous examples are the Sony motion pictures hacks by the North Koreans. Sony made a movie they didn't like. And so they went and what hit the press is all of the executive emails they had breached, but they had gotten into just about everything in that network. So you pick a target, search for vulnerabilities, often those are executives. Often those vulnerabilities are humans who are overpermissioned and that you're fishing them or doing some other kind of social engineering. And then your exfil tends to be relatively low and slow. You're trying to go unnoticed, you're trying to remain resident in the environment. And so you might do things like exfiltrate records from a database in outbound DNS requests or similar. That is not what we see anymore for the big high-profile CEO gets fired kind of breaches in the cloud. That's just not how they're happening. It's radically different. So what the hackers are doing is first and foremost, they're searching for vulnerabilities on any public-facing endpoint, IP address, DNS record, et cetera. And they're doing this almost instantaneously. So by the time you put something on the internet, you've probably got just a few minutes before one or another groups of hackers have noticed if you have any vulnerabilities. So the preferred methodology now is to run automation on these endpoints. And this really is enabled by the cloud because the cloud providers, the hyperscalers, Amazon, Microsoft, Google, their networks within their clouds are so fast and so high efficiency that this is an inexpensive thing to do in time. So the hackers are searching for vulnerabilities. And we know, for example, the Capital One breach happened this way. And I'll go into a fair amount of detail on Capital One in this session. And then the hacker gets kind of a menu of stuff that's vulnerable that they can then go try to see who it is, right? Like stuff that they know they can exploit because their automation is told them there's something exploitable. And so from that menu, they'll pick a target. This is vastly more efficient than trying to do some kind of like social engineering stuff, right? There's no humans in the loop here. This is full automated hacking. And then the exfiltration is just smash and grab. There is no need or want to stay resident and do slow exfiltration because you can't tell that it's happening. And what that means is detection is almost useless in the cloud world. It has to be prevention. All right. We're actually going to go through all the named breaches here today. So Twitch suffers massive 125 gigabyte data and source code leak due to server misconfiguration. Boy, is that a misleading headline. And if you pay too much attention to these headlines, you will not be aware of where your real vulnerabilities lie, where the real risk is. Yeah, misconfigured servers contributed to more than 200 cloud breaches. Misconfiguration can mean a lot of things. Very often in the press, the journalists like something pithy and short that lots of folks can understand. And that's, you know, understandable. That's kind of their job is to disseminate what's happening in the world in a way that people can grok. But very often it hides the complexity of what's really going on and therefore how you need to defend against it. But misconfiguration can mean everything from leaving like a port open that is a dangerous port. You know, that's a very simple misconfiguration to fundamental design and architecture flaws in the system that allow massive blast radius effects in attacks. Okay. And the industry and the press tend to focus on the former, the simple stuff, where the latter, the bad design, bad architecture from a security perspective is actually how people really get harmed in these things. That next headline, the Capital One breach is more complicated than it looks. Yes. Yes, it was. We'll go through this in some detail. Twitch breach highlights dangers of choosing ease of access over security. It's a reasonable headline. But, you know, the specificity of what is being spoken about there is where it gets interesting and we'll get into that. Okay. How far are we in? We're like 18 minutes in. Okay. I'm going to speed up a little bit. So control plane compromise, almost all cloud breaches, I said almost all because there are probably some I'm unaware of. Every cloud breach I'm aware of at scale follows the same pattern, which is there's some form of initial penetration. It might be something like a dangerously open port or a very often an orphaned piece of infrastructure, a virtual machine or container that people have forgotten about and therefore has developed a CVE. API keys are the king of cloud packs. And sometimes people put those in source code in places that they should not, I would argue, never have them. If you get repo has API keys, you're inviting disaster. But that initial penetration is really just to get a foot in the door. Like nobody cares anymore if they can flip your operating system. Nobody cares anymore if they can route a virtual machine. That doesn't really matter. What matters is getting access to those control plane APIs. The ability to do things like list S3 buckets, like issue get commands against S3 buckets in a privileged way. And so to get from point A to point B from, okay, I got in to some compromise server. In the case of Capital One, it was probably a self-managed web application firewall that had slight misconfiguration to it. And that's all the press focused on. But the real hack happens after that, which is from there, I need to go discover what you have that's valuable to me. And this is going to be a theme. 90% of hacking is learning. It is not attacking. It's learning. It's understanding the environment. And so your goal as anyone building a system, I think this is at least as much on the developers as on the security team is to prevent knowledge from the hackers. But once they do that discovery and movement, they'll find something valuable. In the case of Capital One, it was like 700 S3 buckets. We'll look at the DAJ filing in a second here. And then typically smash and grab exfiltration, like sudden exfiltration. All right. Let's talk a little bit about what we think of at Sneak as the five fundamentals of cloud security. The first one is you have to know your environment. Okay. Just as the hackers are trying to learn what you are doing, you must know what you are doing. And this is a non-trivial problem. It is going back to where we, yeah, hundreds of thousands of components. So knowing what that environment is doesn't just mean knowing a list of them. It means knowing how hackers might approach them and whether or not those things are kind of configured in a way that is vulnerable to those kinds of breaches. And particularly around limiting blast radius. I'm going to keep coming back to this. You cannot prevent initial penetration across the board. You can't. It is not possible. It is a fool's gold. It will happen eventually. But what you can do is design your systems in such a way that the discovery and movement is highly limited. And that the data extraction or other kinds of exploitation are limited as well. And by the way, we have a whole series of classes we are teaching now on doing this through things like controlling for time, for what actions are available, for what resources can be for each. But this talk is a little narrower on just deconstructing some cloud breaches. So let's go ahead and deconstruct some cloud breaches. I'm going to stop sharing while I get my screens sorted here. And have we had any questions? None yet. When you have them. Yeah, go ahead and fire away if you have any questions. Let's see here. I'm trying to find the right screen. Here we go. We're going to switch from the deck over to my browser. Are you seeing a DOJ filing group? Yep, I can see it. Cool, cool. So this is the actual United States District Court for the Western District of Washington at Seattle complaint against Page Thompson, who was the Capital One hacker. So this goes back to 2019. It's still highly relevant. There have been no huge changes to cloud platforms that can prevent this kind of thing. The beauty of this one, and by the way, I'm going to use real breaches. I'm going to name names and use their actual content. These are some of the best companies at doing cloud security in the world. I'm going to do Capital One, Twitch, Imperva. And if we have time, I'll get to Uber. But certainly the first three are among the best companies at doing cloud security. So this is not an attempt to say, you know, paha kind of thing at all. These folks are brilliant at what they do. But it's super interesting to look at real world cases versus abstractions because the abstractions are always overly simplified and therefore nearly useless. So we have to look at the real things. All right. So I'm skipping ahead a bit here. Kind of what it's said to date is the Capital One got this email telling them, hey, somebody's on social media bragging that they hacked you. And this is an interesting first point. That's how they found out. And it was weeks or even a couple of months after it happened, I believe, when they actually learned of this. And that includes, in this case, AWS, their cloud service provider. No one noticed it when it was happening. And there's a very good reason for that that we'll get into.  So there were four commands according to this DOJ complaint. The first command when executed obtains security credentials for an account known as something dash WAF dash role. Okay. So the press picked up on this as meaning that a WAF, a web application firewall was exploited particularly and that that was the cause of the breach.  But the important point here is what matters is security credentials, not residency on the server. I mean, you need that maybe depending on how things are configured. But once you have the credentials for this WAF role, it says then in turn that in turn enabled access to certain of Capital One's folders. They mean buckets at the cloud computing company, they mean AWS. All right, the second command list buckets. So the WAF role is an IAM set of credentials. If you're new to cloud, IAM identity and access management is the principal network that you're going to care about regarding access to cloud services APIs and data. It's not the TCP IP network that that is almost never I've never seen that be the mechanism of exploitation in the cloud. Ultimately, it's always through identity or similar like security group access, things like that. So those credentials are the goal, not server, who cares about server, the credentials are the goal. And those credentials had the ability to do a list buckets command. Now, a lot of times, in Feud, we have like a special rule that tells you if you're running things, compute resources in the cloud that have the ability to list storage locations because that is incredibly dangerous. Going back to the slide on discovery and movement. Well, if you can just do a list buckets, and in this case, get 700 bucket names, imagine if you had to guess those or window them out of some other resource. It's just a really convenient way for hackers to understand the topology of your system. And you really want to prevent them doing that. So this comes back to app dev. This comes back to the system design. You should not have in your system design the need for components of the system to list storage locations. They should know them in some other way. Okay. And then the third command here was the sync command. And when executed, it used that WAF role to extract or copy data. Okay. Well, sync is part of the AWS CLI. It's not actually an API endpoint for S3, but it is part of the CLI. And what it does is it first lists and then calls gets on objects. Okay. S3 is the world's largest web server in the sky. It is probably a third of the internet. Something like that. At least a fourth. Trillions of objects hosted in S3. And S3's job is to extremely efficiently store data and allow access through gets of that data. You're going to do puts and things like that too, but mostly activity on S3 are gets. And this explains, I think, why this was very hard to detect. Because S3's job is to host a bazillion gets a day, however many you have coming in. And therefore, reading each object once out of S3 with get commands is not going to stand out in a signal to noise kind of way. All right. We're at the bottom of the hour. I'm going to switch to this Twitch hack. All right. So if you're not familiar, the Twitch breach was last year. Yeah. Last year. And what happened is a hacker got in through what was likely a orphan piece of infrastructure. And with Impervo, we'll see it was definitely an orphan piece of infrastructure. But when that hacker got in, what they did is get 125 gigs out of GitHub source code repos, including source code for literally everything Twitch makes and source code for Twitch is part of Amazon. Right. If anyone should be able to do AWS security, right, it should be Twitch. Right. So and that is not, I'm not saying that to disparage Twitch. I'm saying that to let you know that you are probably more vulnerable than they were. Okay. These are deep, deep experts on this stuff. And the flaw here was really a combination of a minor misconfiguration and a design flaw, just like in Capital One, that the design flaw in Capital One was the ability to list buckets. Doing the get commands was actually the actual like data X fill was trivial. Right. Just a pile of gets. The important part of that breach was the ability to get the list of things to get. And similarly in the Twitch breach, the problem here is blast radius, not initial penetration. If you think you can prevent initial penetration, you are wrong. There are people who can get into your system somewhere. And so your job is really to limit the damage to minimize the blast radius. All right. So this quote in particular that I've highlighted is one that kind of drives me nuts. This is as bad as it could possibly be. How on earth that someone X fill 125 gig of the most sensitive data imaginable without tripping a single alarm, you cannot have good enough alarms. That is the wrong idea. If you're trying to do that, you will fail. The hackers will win. What you have to do is have a system design and architecture where you're not providing them the ability to do things like this. And what that means is really limiting access to sets of data. So I'm going to switch to a whiteboard here for a sec. I think I've got time for that. Feels like I have time for that. It's not what I want. This is what I want. Okay. Drew, are you seeing a whiteboard? I am. Yep. Okay. Cool. Cool. So over here on the left, we've got a hacker. And let's just think through what little we know about Twitch. We know a whole lot more about Capital One because there's DOJ filing and there's a script and commands. But you've got some server, let's assume for a moment that it's an old school virtual machine. And some vulnerability has been found on this, allowing the hacker to gain access to that compute instance, to that compute instance.  So we don't have all the details on this, but how I imagine this probably happened is that somewhere there was a database that this server connected to that might have had things like user data. Famously, the press focused on like, oh, my God, super popular Twitch channels make millions of dollars a year. I mean, we all knew that. The nasty stuff was what they breached from the GitHub repos. So you're going to have SCM repositories get repos with all that source code. And I'm highly suspicious that I don't believe that the same GitHub repo that held some AWS native service source code, which we know from the reporting on this. And I mean, you could just go download this 125 gigabyte archive off of 4chan where the hacker posted it. This has got to be numerous get repos. So what I'm interested in is not really, where am I? Is not really this. That could be anything. That could be some kind of CVE, Unpatch operating system, a log for shell. It could be all kinds of things. And again, you have to assume that every compute instance that has seen air, no matter its composition, although VMs and containers are more vulnerable than serverless functions for sure. But anything that has seen air, you have to assume is compromised if you want to prevent these kinds of breaches. What I'm interested in is how in the world were all of these different get repos, as well as likely databases, then accessed. In the worst case scenario, from a, you know, the Twitch decision making process, there was an IAM role attached to this that actually had access to do all of those things. I cannot think of any reason why the same identity would have access to source code repos and to production databases. It just does not make sense to me. So I'm skeptical. We don't know. But I'm skeptical that the breach was, you know, that simple. I think what we probably had here, and again, it would be nice if people would publish. And I'm going to show you Impurva, who got hacked a few years ago, they published all the details. And God bless him. That's what you should do, right, to help the rest of us not get breached the same way. But my guess is that the, oops, I'm drawing the wrong service, that the ability to switch IAM roles was probably part of this. And it was definitely part of the Capital One breach too. So you might have, for example, this server right here, not having access to these Git repos. But if it has the ability to remap its identity to something that does have access to those Git repos, it effectively does, right? And we see this a fair amount. So what you really want to focus on is having the right kind of segmentation in the system. And folks are used to doing that with TCP IP networks, which again, are really just not even going to help you in this. That's not how this stuff is done. All right, we got 10 minutes left. Let's do Impurva. So Impurva is a very good cloud security company who got breached and whose CEO was replaced as a result. So there, but for luck, can go any of us. So we're trying to learn from these things. Again, good company, solid security practitioners, yet breached. So what happened? Our investigation identified an unauthorized use of an administrative API key in one of our production AWS accounts. Okay, yet again, it's API keys. You're not going to catch these things in flight. I know I keep saying that, but I can't enforce it enough. And you'll see in Impurva's case, they understand that. They're not making the goofy mistake of thinking we should have been able to detect this while it was happening. Instead, they understand that the right way to prevent this is building systems that don't allow for these behaviors. Okay. So how it happened? So this is the CTO, by the way, of Impurva. And I think this is my case study for like how to do this right if you get breached, like really share information, explain things, and explain what you're doing. And that's exactly what they did. So kudos to Impurva. Essentially, they were migrating databases from managed databases to RDS, which is a AWS managed relational database, extremely secure service. If you do it right, doing it right looks like nothing you've thought about in the data center. And they got burned by that. So some key decisions made during the AWS evaluation process taken together allowed information to be exfiltrated from a database snapshot. That's honest. We did wrong things. We made bad decisions on design. And that led to database exfiltration, not from a running database, but from a snapshot of database. Okay. So the errors, according to them, were one, we created a database snapshot for testing. Now, we know from this breach that it was production customer data that was in this. So I've worked in national security environments where you are literally not allowed any production data outside of the production enclave where your test data is all manufactured data. That is an unpopular thing to do because it's very expensive from both a time and cost perspective. A lot of folks, according to one survey that Drew found, I don't remember exactly which one, something like 84% of organizations do have production data in test. And it's not because they're lazy, it's because they're trying to catch bugs before they hit production. But they did that. They created that. Okay. Mistake number two, an internal compute instance highlighted here that we created was accessible from the outside world and it contained an AWS API key. Okay. Done properly, any compute instance through the metadata service or through a secrets manager will have temporal access to, will have access to API keys that for some period of time, based on the rotation of those things, will be valid. So that's not one you can fully solve. You can try to prevent the initial penetration, but you should architect assuming that you can't. All right. Three, this compute instance was compromised and the AWS API key was stolen. Yeah. The hacker didn't care about the compute instance. They cared about the API key. Nobody cares about your operating system anymore. Nobody cares about your local disks, not in cloud. They're going after your cloud storage accounts, which you don't even have access to operating systems on that. So yet again, in this case, and for the AWS API key was used to access the snapshot, not the database, the snapshot. All right. I've got five minutes. So this will probably be the last one we do. Let's switch to whiteboard real quick. Then we'll just erase all this stuff except for the hacker. We still have a hacker. And in this case, our hacker has gotten into, right, we said a, we'll call it EC2 again. It could have been a container. They got into a server that was, in this case, we know from what I'll show you in a minute, that it was an orphaned piece of infrastructure and therefore probably hadn't been patched in a while. This is an extremely common problem in the cloud. And from there, did they access the database? The RDS database? We don't have the chattiest crowd today. No, they didn't. They did not do this. They didn't maybe even try that because who cares. What they did do is go for the snapshots that were being accumulated behind that database. So in the cloud world, in the data center world, it would be really weird for hackers to go hard at backup systems because everyone has different backup systems and so on. In the cloud world, these are very consistent APIs for things like database snapshots. And database snapshots are actually stored in S3. And so you can do out of band, you know, AWS back channel duplication of these snapshots into things like, you know, other AWS accounts. So again, the problem really isn't over here. Like this, this can happen. The problem is in the permissions allowing access to these snapshots. So let's look at what Twitch did to not have this happen again. And their corrective actions are excellent too. So I just can't praise them enough in this. All right, the steps we've taken since this incident to improve our security protocols include protocols meaning stuff you have to do all the time. One, applying tighter security access controls. That can mean anything. Sounds good. Probably good. All right. Two, increasing audit of snapshot access. This is a form of misconfiguration scanning. Looking for access to snapshots that is unneeded in the test environment here. So those of you who are thinking, well, if I run a lot of controls in production, I'll be safe. Hackers actually tend to prefer dev and test if you have real data there because you probably have less controls on it. So don't think that is going to help you too much. All right. But good on them for increasing that. This should be happening 24-7. This should be happening all the time that you are aware of potential misconfigurations. All right. Three, decommissioning inactive compute instances. This goes back to orphaned infrastructure. Hundreds of thousands of resources. Fugue manages like millions and millions of resources for our customers. It's pretty easy to forget things. When you can create a global network in a minute by executing a cloud formation template or a Terraform template, it's easy to do that. And therefore, it's easy for those things to accumulate and compute instances and databases and whatnot. And hackers love those things because you've forgotten about them. And remember, again, you can't fully prevent the initial penetration. And this is part of why. You won't be able to. But what you can do is make it not that important if they do get in. Okay. So good for them. They were looking for their orphaned infrastructure. We've been doing that for our customers for many years. Okay. Rotating credentials and strengthening our credential management process. Your number one friend in preventing hacks using API keys is frequent key rotation. It won't prevent everything. But time is on their side. Not yours. You want the shortest lived stuff in the cloud, whether that's compute instances or containers or API keys that you can come up with. All right. So good for them. Credential rotation is probably the right place to start in terms of like really scrutinizing your patterns, your design patterns. We won't get to it today, but the Uber breach, that stuff was like three-year-old API keys that still had root on production. Like, don't do that stuff. Okay. All right. They put stuff behind a VPN. All right. That's cool. And then increasing the frequency of infrastructure scanning. That should be, again, 24-7. So we're up on time now. I'm going to really quickly flip through a few more slides, and then we'll get to questions if we have any. Okay. Do you made all these nice slides? I should use them. So we think that the five fundamentals are to focus on prevention and secure design. That's a theme I've been kind of hammering on through this whole thing. All of these breaches were due to flaws in design, in development, not to lack of security monitoring. Okay. And to do that, you've got to empower ... Oh, sorry. I started on the wrong one. First is know your environment. I already covered that, so I kind of jumped to the next one. So focus on prevention and secure design. This stuff has to be baked in through the entire SDLC. So the ability to do the... And this is what we do for a living and have for years that few now sneak is tell you where you are making these kinds of design errors so that you can fix them. But it has to be all the way through the SDLC. The way you do that is by empowering developers with tooling, not with meetings, not with education. You cannot train people out of this problem. You have to provide them automation and tooling that tells them where things have gotten into any kind of trouble. And this is all glued together with policies code. I mentioned earlier the hackers are going after things in a completely automated way. There is no security and obscurity anymore. If you have an internet-facing endpoint, it's being scrutinized. And therefore, your security policies, which are where you embed the knowledge of these dangerous design patterns, right? That has to be fully automated too.  So education, it's kind of like... I'm a big gearhead. I love cars. Cars have gotten much, much safer, not because we've told people drive better. That's like a pretty weak sauce, right? Like drive better. No, we've made cars safer through the design of the cars. And that is how this stuff needs to work. And policy as code is really your tool for that. And then you do want measurement. You do want some kind of quantifiable, objective measurement of what matters to your organization so that you can keep yourself honest and so that you can also explain why the investment in doing these things is worthwhile. So I'm going to throw this screen up. We have some resources Drew. Any questions, comments? No questions yet. By all means, do pop any questions into the chat. I wanted to see if you might take a few minutes to talk about the role of a security architect in the cloud. Because what we see a lot of times are security professionals coming over to the cloud and kind of wearing similar hats that they might have had in the data center, whereas really in the cloud, it's kind of an architect role when it comes to security and being able to prevent this. Can you shed some light on that role? Yeah, I mean, the role of security has to change because developers are controlling what is out there in the infrastructure. So what that means is the security team has to become more design and architecture focus. What is a dangerous application design matters most now in security. And what that means is the security practitioner needs to be able to speak that language and that language is best expressed as code, as policy as code. Because policy as code can run on anything from a terraform or cloud formation template, pre-deployment to the running infrastructure. If you're a security practitioner, this is a huge opportunity to move out of largely monitoring and trying to create defense in depth and having a real voice in the creation of systems that add value to the organization. And that's the future of successful security practitioners in cloud. Awesome. Yeah, so we have an interesting question here. What are your top five secured design in cloud recommendations in order of difficulty to implement? So let's maybe start with the easiest. You know, rotating keys might be that like easy low hanging fruit. Yeah, exactly. So we're actually in the midst of what we just did the first of a series of three or four, I think four classes on a taxonomy that breaks this down. Instead of five, there are three kind of layers to this taxonomy. The first one is time. That limiting time. So I had the privilege to write one of the earlier, I think the first O'Reilly book, little small book on immutable infrastructure. Time is the hacker's friend. And so anywhere you can make things really temporary, that's good. But the other two dimensions you really need to care about. And I know this isn't a direct response to that question. I'll try to put in a couple at the end. But this is how I think you should really try to think about it. The other two big areas to think about are the resources you have and the constraints on those resources and understanding the graph of identities and actions and resources. It's non-trivial. I can't break it down to like, here's a list of five things everybody does wrong. If you look at the hacks I just described, all of them did something subtly differently wrong. And that's the challenge, right? It is a very complex topic. So sorry, I couldn't boil it down to five. We've got one comment here. The way I see it, security should be the responsibility of all teams in their own context and that the security team's role is doing research and supplying information to others for them to implement. I agree with that, but I would add to it that I think the security team should be supplying code. That we now have the ability with policy as code and we at Sneak use open policy agent for this to take that knowledge and rather than putting it into English or whatever your local language is, putting it into something that's executable because now that can be fully automated all the way through the software development lifecycle. But I agree. Security needs to be kind of a center of knowledge the way that knowledge gets disseminated is what's fundamentally changing right now because of all of the automation and the complexity in the cloud. So Simon here with in terms of monitoring abuse of API calls, do you have any use cases that enterprises should be thinking about? I have yet to see a scenario when I was at AWS or since founding few where it was possible to prevent damage by noticing abusive API calls. That's kind of the fundamental hard thing in cloud computing from a security perspective is once they're hitting the API, it's over, right? It's already done. It's in the past. So this is why I was saying, it's good to monitor your APIs, of course, like have security in whatever places you can insert it, but understand that the 700 buckets worth of data in S3, if you had been looking for abuse of API calls, S3's job is to field gets all day and the data would have been gone. So you really have to solve this stuff architecturally. Next question here. You mentioned about getting the architecture right. Is there a community or trope of resources which are publicly available under this topic? So one thing that we publish as full open source and again, I'm a big fan of having running code as the way to express these ideas, things that you can actually use rather than just like descriptions. If you go to the Fugue on GitHub, Andrew, maybe you can post the URL for regular. If you're using Terraform or other IAC, we publish a very thorough open source project that will check for hundreds of these kinds of architectural mistakes and misconfigurations and design problems. There you go. GitHub.com slash Fugue slash regular. So that's a place. Mostly honestly, what I see out there is a lot of naivety and marketing stuff like security theater. I think looking at real breaches will really open your eyes to what hackers actually do out there. Okay, we're right at the top of the hour. We're like 10 minutes long. So I need to turn it back over to the Linux Foundation. Thank you all for your time and your questions. And I'm sorry, I love folks that I ramble. You're there's no problem at all. So thank you so much, Josh and Drew for your time today. And thank you everyone for joining us. As a reminder, this recording will be on the Linux Foundation YouTube page later today. We hope you join us for future webinars. Have a wonderful day. Thanks, everybody.


You have thousands of reviews. You can see medical doctors, you can see surgeons, chiropractors, hypnotherapists, testosterone therapists, all sorts of different kind of therapists that are using our products themselves and also using it with their clients and with their patients and they love it because it works.


Hi guys, today I'm here with a very different video than what you would normally see on this channel. This video is going to be about how you can book your COVID vaccination slot. So India has just opened it up for the 18 plus age group but getting a slot has not been easy. There's limited availability. In this video, we both, this is my husband Gunjan, are going to share tips and hacks which will help you book your slot and also share our experience of what happened with us on the D-Day. So keep on watching. Today I'm here with my husband Gunjan. Hi guys. And we both are here to share tips and hacks for booking your COVID vaccination slot. So let's get started. So guys, now we're going to share with you the exact steps to book your slot and also a few hacks because the slots are limited and as soon as they're released, they vanish like this. So you will need these hacks and yeah, take it on from here. Tell us how to do it. So here is how you win the fastest stinger first contest. Number one, go to Coven website cowin and register yourself. In one phone number, you can register up to four family members. And everybody who needs a vaccination needs to be registered on the Coven app. So, yeah. Verify and proceed. Now you can register, remember. So register, you can put your photo ID proof, anything. So enter your details. It is going to register you. You need to make sure that you carry the same ID proof on the day of vaccination. So you must have that ID and online adharkar would also do. So for registering, you need a phone number and ID proof. Step number two, here is what this is something which most people do not know. And this is the real hack. Download telegram app. On the telegram app, there are various chatbots and groups, which will send you a notification as soon as the slot is available. So you need to subscribe to that. I will give a link in the description box below. Opening that link, you will find this group or this chatbot for your city. Okay. So to simplify it for people who are not that tech savvy like me, essentially you download your telegram app. And on this, there are groups or channels where people are updating of slot availability, right? In real time. In real time. And this is city-wise.  Yes. Here is the thing. If you miss this alert, even by five seconds, your slot will vanish. So press on the profile icon, go to the notification settings, go to custom settings. In that custom setting, set a unique siren kind of a ringtone for this. So as soon as that vaccine alert comes, your phone should be on siren. This is the time to go and book, book, book. It's very important. Okay. So basically keep an alert which is different from all your other alerts, so that you take action immediately. Absolutely. Okay. Step number three, be logged in onto the Coven website all the time. So because once your alert comes, if you are not logged in on the site, you have to enter your phone number and you will get an OTP. By the time your OTP comes, all the slots will get filled out. Yeah. So you don't need to, you don't want to waste time logging in again and again to the app. So stay logged in. So the hack to stay logged in is very simple. Every two to three minutes, just go after you logged in, try a random pin code search on the Coven website. So the Coven website knows that you are active. You are not become inactive to log you out. So keep searching, say 56008, 56001, 56004, some pin code on the Coven site, so that every two to three minutes, so that the site knows that you are still logged in. Okay. So every two to three minutes, we need to keep basically be active on the site. Without, without hitting the refresh button, because on the Coven site, if you hit the refresh button, it logs you out. So don't you hit the refresh button, just keep on hitting the search button with new parameters. All right. So you essentially need two devices. On one, you are logged in onto the Coven website and you keep that website active. On the other one, you keep track of the alerts, which you're getting from the telegram group. Absolutely. And as soon as an alert comes, which tells you that a slot is available, you go to the app. And I think the alert is also by the pin code, right? It also tells you the pin code. Exactly. So on the Coven app, don't search by city, because you will waste time in scrolling and finding. Say it shows 50 Covishield slots available at Apollo hospital and pin code 560066, you go search by pin code enter 560066, you will get that exact Apollo hospital and boom, you book it right away. So don't search by city or anything. Just hit the exact pin code. And this process expect an effort time of around one to two days, depending on how lucky you are and how much in demand it is in your particular city. So like in Bangalore, when I booked, it took me around eight to 10 attempts. When my friends have booked, it has taken them around 20 odd attempts. Currently it may take even more. So be prepared to spend a day or two actively slot hunting, but if you're in some other city, remain patient, like don't get frustrated because the number of people who are also joining is increasing every day. So when I joined, I found out about these groups on telegram and the bots. On the second day, right? On the second day, they were around 400 people. Yeah. And currently we're on day five, I guess, 9,000 people. So there are 9,000 people. So you can see that it's just exponentially growing. In fact, I subscribe to five or seven such different channels and notifications and bots to tell me. And here I'm sharing with you the best one and the fastest one. On that link, you can select your city. It will tell you the exact, exact channel on telegram to join. Do that. And yes, that's pretty much it. Just one final thing to add. Don't be picky and choosy as to which slot you are getting, what time you are getting, what location you are getting, because it is much better to be vaccinated than to be exposed to the actual coronavirus. So number one, register yourself on the Coven app. Number two, download telegram, subscribe to the channel for which the link is in the description box. And number three, keep track of the alerts, stay logged in on the Coven app, search by the pin code and go ahead and book your slot. Right? So now that you have seen how to get your COVID-19 vaccination slot, let's talk about the steps that you need to follow on the day of the vaccination. And we will share our experience with you. So the first thing that you would need to do is to actually reach the vaccination center, right? And the thing to keep in mind here is to be very careful of the address. So when we booked our slot, it doesn't really mention the complete address. It just gives, I think a pin code or just the area reference, something like that, right? And that can be confusing. So make sure that you double check and you know, you figure out where exactly you have to go. I've had friends who reached the wrong address and they ended up missing their slot. So do not do that. Be careful of the address. Another important thing is to reach your vaccination center at least 30 to 45 minutes before your slot timing.  So for example, if your token number is say 60, you will be called in the 60th position. So the earlier token number you have, the faster you will get your vaccination done. Yeah. So we reached I think by 9 a.m., right?  So we waited for almost two, two and a half hours. But if we had reached a little earlier, say by 8.15 or 8.30, we would have got a faster token or a rather an earlier token number. So try and reach half an hour, 40 minutes before your actual slot. So once you are called, you have to go to the counter they will check your original ID proof. If it's Aadhaar, even the digital version is fine against your booking and you have to make the appropriate payment. We took Kovishield and that costed us 850 rupees in Apollo. So a rupees 600 is the cost of vaccine plus 250 is the cost of administration. Okay. So once you have made the payment, you are taken to the medical checkup room. In that checkup room, they will do a very quick check of your blood pressure and your oxygen level. Assuming like both are fine, you are sent to the vaccination room. At the vaccination room, the nurses will show you the while with the expiry date and they will administer the vaccine for you. The entire process takes under one minute. And after that, they told us to wait for another 30 minutes. This is again for observation to make sure that, you know, nothing is wrong.  And I think after 30 minutes, we just went inside, informed them that we were fine. And then we were free to leave. So this basically was our experience of getting the shot. And yeah, and now I think quickly we can tell them what happened after after we came back home. Yes. Yeah. So why don't you start? So actually like nothing happened till evening. Yeah. Till night actually. Till night nothing happened. 10 p.m. Around 10 ish both of us got slight fever and we had ache in our arm and body aches. Head ache. Head ache and body ache, which lasted I think the entire night and half the day next day. Yeah. So symptoms around like mild headache, body ache and fever for around 24 hours, 18 to 24 to 24 hours from the night of vaccination. Yeah. That's what happened with me. Yeah. Similar for me just that my headache was more severe. And but again, these are the things which are expected and you're also warned about this when you get your shot. So just be prepared. Or you can take a parasitomol or a dolo tablet, you know, if it gets too much for you. But yeah, overall, I think a pretty smooth process of getting the vaccination and the wait time for the next shot is about two months, right? 45 days. So we also get an SMS. So from informing us about our next vaccination date, this SMS has come from Apollo like where we got vaccinated. However, I think you have to schedule again on the Coven app your second vaccination. I don't think it's a normal walking process, but I may be wrong. So if you are aware, comment down and let us know also. The vaccination certificate you will get on the Coven app. So download it from there and it should also be available on the government DigiLocker app. And that could be very, very important for your travel. So especially for international travel, this will become like a vaccine passport, which our guess is that it will become mandatory by the end of this year. Yeah, especially for all the students, for all the people traveling to the US, be very vigilant about this. Keep it handy because like he's saying, I think it's going to become a norm by the end of this year. So guys, this was all about getting yourself vaccinated. I really hope that the tips and hacks that we have shared with you help you. So go ahead, get yourself vaccinated, also share this video with as many people as you can, spread the information and yeah, stay safe, keep the masks on, stay at home and I'll see you very soon in the next video. Till then, make sure that you subscribe and hit the bell icon so that you don't miss on any updates. Signing off for now. Bye.


Hello, I'm Christine Lottie and I play a heart surgeon on Chicago Hope. When I was first preparing for the role of Dr. Kate Austin, I had the opportunity to speak with many women surgeons about their careers, their responsibilities, and their personal lives. And like the three surgeons whom you are about to meet, there is one common emotion that they all share. They love what they do because they save lives. You are about to get a close-up look into the lives of three women surgeons. You will see their operating rooms during real-life trauma, heart surgery, and orthopedic surgery. You will get to know these women both on the job and at home. And most importantly, you will see how they balance successful and satisfying careers with rewarding family lives. I encourage you to watch this program carefully. Give some thought as to whether a career as a surgeon might be in your future. Talk with your guidance counselor, your teachers, and your parents. Get as much information as possible about your career options. Make intelligent decisions about your courses starting now. And don't be afraid of academic challenges. If you work hard and make the proper choices now, many new and exciting opportunities will be open to you. I hope you enjoy the program and best of luck as you plan for your future. I'm really interested in being a trauma surgeon. So I like being with children. I haven't quite figured out exactly what I want to do. They're there when all this excitement is happening. And I just love pressure, and I just think it's so cool. A researcher of microbiology. I really want to be a sports player, but if I can't be a sports player, I'm probably going to like being a doctor. My name is Vicky Stevens, and I'm an orthopedic surgeon. I've considered being a pediatrician or a pediatric surgeon. Being like a doctor should be good. My name is Rosalyn Scott, and I'm a heart surgeon. I know that I can do it. If anybody could do it, I think I could do it. It wouldn't really matter if I was a, you know, a boy or a girl. If I really want something, I can work hard enough to get it. Second to do a burn. I see the feel of surgery that you have to love. Bringing someone back to life, I don't think there's anything more rewarding in life. The St. Mary's Hospital, which is a level two trauma center, is a community hospital. Patients who come to a trauma center are patients who have life-threatening injuries. Most of the patients that we do are blunt trauma, mostly motor vehicle accidents. In the last few years, we've seen more penetrating trauma, like stab wounds and gunshot wounds. I'm a member of the St. Carlos Apache tribe. The reservation is where I do most of my work, where my relatives and many of my friends live. I also have a limited practice in the mining community called GLOBE, which borders the reservation. We have a small hospital that's got 50 beds and a very wonderful operating room that we just remodeled. The people on the reservation lead a life that is fairly isolated from the mainstream of American culture. Economically, we struggle with a poverty level that's quite astounding. And many people live from welfare and social security pains. Your pins were, there you go. You got shot with the BB, huh? And you're the one that did it, huh? You wanted to see if the BB would go through your shoe, huh? And it did, huh? Yeah, it went right into your toe. Hi. I find that working amongst my own people, being in the kind of country that I grew up in, being around people that I know real well, gives me a sense of confidence and comfort that I know is good for me as a person. And therefore, I've chosen to be in the environment where I know my strength is the greatest. Does that hurt you now? Hi, Vicki. To me, the exciting thing about surgery as opposed to medicine in general is that when you operate on somebody, you know they have a problem. You know you can take care of it. And then you're going to see it immediately that you've done a good thing. So I think that to me, that's really the thrill. You do something and you see the effect of your work right away. I'm at the Cleveland Clinic Foundation in Cleveland, Ohio, which is currently the institution that does more open-heart surgeries than any place in the country. They did over 4,000 last year. Yeah, the trick is to remember which room to set up for this story. Oh, oh. Door number one, door number two. Your interest in cardiac surgery and medicine has to almost be seamless with your being. It has to be so much a part of you. And for me, it's seamless with who I am. I will come to the hospital around eight o'clock. Normally, I will have sign-out rounds where the person who was on call the night before will tell me how many admissions he had and what were the problems. Probably after the weekend, I will say. I will give us about four days. Okay? Have a good day. I will do rounds in intensive care unit or the floor, depending on what assignment that I have the day. I'm so sweet. I heard that you've been so good. I've been good. I'm in the Meredith. Yes. I am in the Meredith. Yeah, we have made many times. I can't believe it's only been two weeks and I've come this far. I thought I would be dead by now. No. You got very sick. That's why the day that I had to intubate you. I understand that your family will help you at home as well. Sure. Absolutely. Do you have sisters? I have a husband. And I have a roommate. And I also have a husband. In between, I will get called for a trauma alert, which involved the three men on resuscitation of a trauma victim. Trauma surgeon has to take over. It's a captain of the ship. And basically, you have to make sure that everybody does their part in the resuscitation. Yeah. In trauma, it's easy in a sense because you follow protocols. We call the ABCs of trauma. Guys, do me a favor. Can I have some light in here? In order to be a good surgeon, you have to make decisions right away. You cannot hesitate. I think that you have to be confident. He's fixed and dilated, guys. Because he already got reflex when he got a reflex. I always heard that. Surgeons like to work on depression. That's a reality. But I think that you can train yourself to do that. He is going.  And there are situations that you know that are fatal, no matter what. And you know that you're not going to save that individual. That's very difficult. One of the most rewarding part of my job is seeing individuals that you treat and they are in extremists. And suddenly you can see them a week later, a month later, three months later, going back to the normal life. Orthopedics is a peculiarly physical specialty in medicine. It's closer to a craftsmanship. How well you can set a bone. How well you can put the little itty-bitty pieces together. How well you can sew a tendon without having straggling pieces coming out of it. For me, it's almost a sense of craftsmanship. So you do get to have the medical part of it. But you get to use your hands. You get to be artistic in a sense. And I think that's what really appeals to me about Ortho. Surgery is an exercise in perfection and compulsion. What I think about when I'm in surgery is making sure that I'm completely focused on what I'm doing and remembering all the steps. I will have thought about how I'm going to do the operation. And so mentally I've already done it and now I'm doing it in real life. One of the most exciting times that I have in the operating room is when you're working with a nurse that really knows the procedure and you never have to ask for an instrument. All you have to do is hold that your hand and you get what you asked for. It's really like a ballet because in a ballet you have a group of dancers that are coordinating and intermixing and working together. Even though they may not be doing exactly the same step, you see them somehow meshing together. And that's what a well-performed operation is like. It's just wonderful. I am an academic medicine. And what you do in academic medicine is still taking care of patients in the same way. But in addition, you can be involved in teaching the next generation of physicians, which I think is very important because I need a well-trained physician to take care of me when I get old and sick. So I say I better protect my own self and my family by making sure the next generation of physicians are also well-trained. I'm Mary. I have three children. Ages nine, seven and six. My youngest is a daughter. And my oldest is a boy. My two oldest are boys. How many of you have been in a hospital? All of you have been in a hospital. How many of you have been a victim of a... One of the things that I like to do is go to my kids' classes and tell a mom a surgeon and this is what I do for living.  They really don't realize that a surgeon can be the average person next to you. My husband is an orthopedic surgeon also. His name is Jodi Daggett. She's a good surgeon. She's very skilled. She's very knowledgeable. She's meticulous in the operating room. She has a touch with tissue that I envy. I wish I had. It's something that surgeons strive for and it seems to come very naturally to her. We have had two children, both boys. His name is Henry. He's the younger boy. He's nine years old. And we have Leland, who's 12. And their favorite thing in the world is skateboarding and riding bicycles. Well, I have two daughters. One is 20 and one is 24. The 20-year-old is in her third year of college and she wants to be a lawyer. Her sister is in Washington now in the Presidential Management Internship Program. I'm about the midpoint in my career, so I am not satisfied with where I am now. I still have places that I want to go. It always fascinates me how hard we work to make things better when somebody's gotten sick. Just to imagine what it took and the imagination and the wonder of what God did in creating it in the first place. When did they decide when they wanted to become a surgeon? Well, my father was a dentist and all of his friends were either physicians or dentists. So I really grew up around a lot of medical people. When I was growing up, I spent a lot of time in his office when I could. And one of the big thrills for me was when he let me sterilize his instruments and then put them back in the drawers and the little grooves that each instrument belonged. My father, who did have heart trouble, he had his first heart attack when I was in third grade, said that I should be a heart surgeon because there weren't any women that had been really great heart surgeons. This would be a real opportunity for me. My realization about going to medical school started when I was in freshman English, in high school. We had to write a composition about what we would like to be when we grew up. And I remember my English teacher saying to me after I turned in a paper saying that I was interested in being a psychologist, he said in front of the whole class, he said, well, why wouldn't you be a psychiatrist? And none of us really realized that there was a difference between the two. And so he said, well, a psychiatrist is a doctor who does that same kind of thing. That was the very first time that I had a clue about medicine.  The educational process for medicine today is a long one. First, you finish high school, of course, and then go on to college. After that, there's four years of medical school. After medical school, you go into a residency training program. The residency period is different for different specialties. For heart surgery, for example, you would have to first do five or six years of training in general surgery and then an additional two or three years of training in thoracic surgery. And then, of course, there are a number of individuals who are interested in going into academic medicine who would take another two or three years doing research, perhaps going to NIH. The way that my medical school training was paid for is what's called the health professions program through the United States government. If you are willing to pay the money back after you finish, you can get loans. And I did, in this case from the public health service, loans that pay very good money on a monthly basis and help cover your tuition and all of your living needs. The funding really ought to be the last thing that people worry about. The money will come if the talent and the dedication are there. The advice that I would give to a young person is that this is one of the most exciting things that you can do in life and that it is easy, as anything is easy, when you have a real passion for it. And so then the work becomes reward. You know, it's a very competitive field and if you want to get into a good medical school you have to have good grades. But again, if you do it in a way, if you structure your time and you have fun and at the same time you have good studying habits, you can do it. How do you get the courage enough to put their hands into another person's body? When you actually put your hands in someone's body, you're not thinking about the way it feels or whether it's squishy or whether it's warm or whether it smells funny. You're thinking about the person that you're touching because that person is the thing that you're helping to make better. To me it's not scary knowing that I'm holding somebody's life in my hands. I think it's a big responsibility. So from that perspective, I want to make sure that I try to know as much about the patient that I can and about the problem that we're going to be taking care of in the operating room. When I'm working on people, if their lives are hanging in the balance, that there is a force far bigger than I. My God that I believe in is there. And that's the strength that carries that person, that patient. When you're working on a patient, are you calm or are you like freaked out? You have to keep calm because in order to have people to work well, you have to transmit that confidence. And I think that that's why we make a good surgeon too. Can someone do me a favor and get me another guy or war? If everybody knows what they need to do and you guide them in a way that they don't feel threatened or they don't feel under pressure, they perform better. Do they usually get enough sleep or what do surgeons do to stay awake? I think that you get used to work 24 hours. It's not easy, but I guess with time and doing this for so many years, it becomes part of you. The other thing is to get exercise, which helps to stimulate you. I also practice yoga and that can also be energizing. You have to take care of yourself. You have to take care physically and mentally of yourself. Therefore, you have to try to maintain a good diet, sleep as much as you can when you're off, exercise and take time off for fun. I've heard that surgeries take a long time and so maybe like five hours or so. How do you stay like five hours under pressure doing all this work? Surgery does take a long time. However, it's like doing whatever your favorite thing is. The time passes so quickly that you don't really realize that an hour has gone by or two hours has gone by. My days go faster when I am in the operating room. How do you research about surgery? Medical research is an area that's critical in many ways. One of the areas that affects me particularly since I serve a disadvantaged population without a lot of access to money for care, we can do things now because of research that can get people better faster.  A woman has, I believe, a more sensitive nature towards people in pain. I think that we tend to be more emotionally involved with our patients and therefore able to support them better. We also are good with our hands. You notice women do the sewing at home. We do cooking and good cooking takes talent, takes being able to do certain maneuvers. Women traditionally have done things that require all of the skills that surgery requires. Basically, I think cutting and sewing should be a woman's profession. It was really, to me, a natural extension of what women do anyway and that men have to learn how to be sewers and cutters. So my big argument is that surgery is women's work anyway. What's the feeling when you lose a patient?  There are two aspects of losing a patient. When you lose a patient and you know in your heart that if you saw the same kind of patient with the same kind of problem tomorrow you would do exactly the same thing then you just have to accept that you know that you can't fix everything. What, when you really are disturbed is when you feel that there was something you could have done differently.  Yes, I think as a surgeon you can have a life. Just as how you have to structure and organize your career, you also have to structure and organize your time off so that you maximize the things that you do and how you do them.  Is she doing something with them and then all of a sudden the beeper beeps and she has to, like, run off to the hospital?   And that's kind of, you know, the energizer bunny. You're kind of just going and going and going. But there's the other side of you that you have to pay some attention to. You know, the spiritual, the mental. Your soul needs a lot more attention when you're kind of moving all the time. Like, when some people, like, ask her to go somewhere and she has to do surgery. So she has to keep working. If she doesn't do surgery, he will die. We balance everything by juggling. I think that's the best description. We juggle. And if I get called to the emergency room because somebody shot themselves with a nail gun and the kids are already out of school and we need to eat dinner, we juggle. The kids grab their skateboards. They skateboard in the hospital parking lot. I go in, I get the nail out of somebody's hand. And then instead of being at home doing dinner, grab a quick bite on the way home, come home, and get started on homework. Is your job fulfilling? I really like staying up all night inside a sick patient and doing different things than in the morning saying, wow, the patient's all better. The most rewarding part of my job is when people get better and they come to me and they go, you made me better. And they really do. They literally come to you and say, because of you, I'm better. And you walk on air for a little while after people tell you that. It brings enough energy to you to hear that from a person that you can do five more really hard things just on the positive energy that that person has brought you. The best part of my job is really realizing that you save lives. And that's the bottom line. You make a difference. After you've done everything you've many years of working everything, was it worth it to study hard and everything? The hard work for me has been worth it.  So yes, it was worth it. Most of my friends are always, what does your mom really do? She's like, I say she has a very important job and I like what she does. It makes me feel pretty warm inside that I have a mom that's a doctor. I think of what my mom does is good because it helps save people's lives and I hope to do it when I grow up. The hard work pays off. It's really fun and it's very rewarding. You can do it. You just have to set goals and work for those goals. I have a wonderful life. I couldn't ask to be any happier than I am now.